1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 5 Copyright (C) 2010 Google Inc. 6 Copyright (C) 2011 ProFUSION Embedded Systems 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved. 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 This program is free software; you can redistribute it and/or modify 12 it under the terms of the GNU General Public License version 2 as 13 published by the Free Software Foundation; 14 15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 23 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 26 SOFTWARE IS DISCLAIMED. 27 */ 28 29 /* Bluetooth L2CAP core. */ 30 31 #include <linux/module.h> 32 33 #include <linux/debugfs.h> 34 #include <linux/crc16.h> 35 #include <linux/filter.h> 36 37 #include <net/bluetooth/bluetooth.h> 38 #include <net/bluetooth/hci_core.h> 39 #include <net/bluetooth/l2cap.h> 40 41 #include "smp.h" 42 #include "a2mp.h" 43 #include "amp.h" 44 45 #define LE_FLOWCTL_MAX_CREDITS 65535 46 47 bool disable_ertm; 48 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED); 49 50 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD; 51 52 static LIST_HEAD(chan_list); 53 static DEFINE_RWLOCK(chan_list_lock); 54 55 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 56 u8 code, u8 ident, u16 dlen, void *data); 57 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 58 void *data); 59 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); 60 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); 61 62 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 63 struct sk_buff_head *skbs, u8 event); 64 static void l2cap_retrans_timeout(struct work_struct *work); 65 static void l2cap_monitor_timeout(struct work_struct *work); 66 static void l2cap_ack_timeout(struct work_struct *work); 67 68 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type) 69 { 70 if (link_type == LE_LINK) { 71 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 72 return BDADDR_LE_PUBLIC; 73 else 74 return BDADDR_LE_RANDOM; 75 } 76 77 return BDADDR_BREDR; 78 } 79 80 static inline u8 bdaddr_src_type(struct hci_conn *hcon) 81 { 82 return bdaddr_type(hcon->type, hcon->src_type); 83 } 84 85 static inline u8 bdaddr_dst_type(struct hci_conn *hcon) 86 { 87 return bdaddr_type(hcon->type, hcon->dst_type); 88 } 89 90 /* ---- L2CAP channels ---- */ 91 92 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 93 u16 cid) 94 { 95 struct l2cap_chan *c; 96 97 list_for_each_entry(c, &conn->chan_l, list) { 98 if (c->dcid == cid) 99 return c; 100 } 101 return NULL; 102 } 103 104 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, 105 u16 cid) 106 { 107 struct l2cap_chan *c; 108 109 list_for_each_entry(c, &conn->chan_l, list) { 110 if (c->scid == cid) 111 return c; 112 } 113 return NULL; 114 } 115 116 /* Find channel with given SCID. 117 * Returns a reference locked channel. 118 */ 119 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, 120 u16 cid) 121 { 122 struct l2cap_chan *c; 123 124 mutex_lock(&conn->chan_lock); 125 c = __l2cap_get_chan_by_scid(conn, cid); 126 if (c) { 127 /* Only lock if chan reference is not 0 */ 128 c = l2cap_chan_hold_unless_zero(c); 129 if (c) 130 l2cap_chan_lock(c); 131 } 132 mutex_unlock(&conn->chan_lock); 133 134 return c; 135 } 136 137 /* Find channel with given DCID. 138 * Returns a reference locked channel. 139 */ 140 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 141 u16 cid) 142 { 143 struct l2cap_chan *c; 144 145 mutex_lock(&conn->chan_lock); 146 c = __l2cap_get_chan_by_dcid(conn, cid); 147 if (c) { 148 /* Only lock if chan reference is not 0 */ 149 c = l2cap_chan_hold_unless_zero(c); 150 if (c) 151 l2cap_chan_lock(c); 152 } 153 mutex_unlock(&conn->chan_lock); 154 155 return c; 156 } 157 158 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, 159 u8 ident) 160 { 161 struct l2cap_chan *c; 162 163 list_for_each_entry(c, &conn->chan_l, list) { 164 if (c->ident == ident) 165 return c; 166 } 167 return NULL; 168 } 169 170 static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, 171 u8 ident) 172 { 173 struct l2cap_chan *c; 174 175 mutex_lock(&conn->chan_lock); 176 c = __l2cap_get_chan_by_ident(conn, ident); 177 if (c) { 178 /* Only lock if chan reference is not 0 */ 179 c = l2cap_chan_hold_unless_zero(c); 180 if (c) 181 l2cap_chan_lock(c); 182 } 183 mutex_unlock(&conn->chan_lock); 184 185 return c; 186 } 187 188 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src, 189 u8 src_type) 190 { 191 struct l2cap_chan *c; 192 193 list_for_each_entry(c, &chan_list, global_l) { 194 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR) 195 continue; 196 197 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR) 198 continue; 199 200 if (c->sport == psm && !bacmp(&c->src, src)) 201 return c; 202 } 203 return NULL; 204 } 205 206 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 207 { 208 int err; 209 210 write_lock(&chan_list_lock); 211 212 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) { 213 err = -EADDRINUSE; 214 goto done; 215 } 216 217 if (psm) { 218 chan->psm = psm; 219 chan->sport = psm; 220 err = 0; 221 } else { 222 u16 p, start, end, incr; 223 224 if (chan->src_type == BDADDR_BREDR) { 225 start = L2CAP_PSM_DYN_START; 226 end = L2CAP_PSM_AUTO_END; 227 incr = 2; 228 } else { 229 start = L2CAP_PSM_LE_DYN_START; 230 end = L2CAP_PSM_LE_DYN_END; 231 incr = 1; 232 } 233 234 err = -EINVAL; 235 for (p = start; p <= end; p += incr) 236 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src, 237 chan->src_type)) { 238 chan->psm = cpu_to_le16(p); 239 chan->sport = cpu_to_le16(p); 240 err = 0; 241 break; 242 } 243 } 244 245 done: 246 write_unlock(&chan_list_lock); 247 return err; 248 } 249 EXPORT_SYMBOL_GPL(l2cap_add_psm); 250 251 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 252 { 253 write_lock(&chan_list_lock); 254 255 /* Override the defaults (which are for conn-oriented) */ 256 chan->omtu = L2CAP_DEFAULT_MTU; 257 chan->chan_type = L2CAP_CHAN_FIXED; 258 259 chan->scid = scid; 260 261 write_unlock(&chan_list_lock); 262 263 return 0; 264 } 265 266 static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 267 { 268 u16 cid, dyn_end; 269 270 if (conn->hcon->type == LE_LINK) 271 dyn_end = L2CAP_CID_LE_DYN_END; 272 else 273 dyn_end = L2CAP_CID_DYN_END; 274 275 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) { 276 if (!__l2cap_get_chan_by_scid(conn, cid)) 277 return cid; 278 } 279 280 return 0; 281 } 282 283 static void l2cap_state_change(struct l2cap_chan *chan, int state) 284 { 285 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state), 286 state_to_string(state)); 287 288 chan->state = state; 289 chan->ops->state_change(chan, state, 0); 290 } 291 292 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan, 293 int state, int err) 294 { 295 chan->state = state; 296 chan->ops->state_change(chan, chan->state, err); 297 } 298 299 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err) 300 { 301 chan->ops->state_change(chan, chan->state, err); 302 } 303 304 static void __set_retrans_timer(struct l2cap_chan *chan) 305 { 306 if (!delayed_work_pending(&chan->monitor_timer) && 307 chan->retrans_timeout) { 308 l2cap_set_timer(chan, &chan->retrans_timer, 309 msecs_to_jiffies(chan->retrans_timeout)); 310 } 311 } 312 313 static void __set_monitor_timer(struct l2cap_chan *chan) 314 { 315 __clear_retrans_timer(chan); 316 if (chan->monitor_timeout) { 317 l2cap_set_timer(chan, &chan->monitor_timer, 318 msecs_to_jiffies(chan->monitor_timeout)); 319 } 320 } 321 322 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head, 323 u16 seq) 324 { 325 struct sk_buff *skb; 326 327 skb_queue_walk(head, skb) { 328 if (bt_cb(skb)->l2cap.txseq == seq) 329 return skb; 330 } 331 332 return NULL; 333 } 334 335 /* ---- L2CAP sequence number lists ---- */ 336 337 /* For ERTM, ordered lists of sequence numbers must be tracked for 338 * SREJ requests that are received and for frames that are to be 339 * retransmitted. These seq_list functions implement a singly-linked 340 * list in an array, where membership in the list can also be checked 341 * in constant time. Items can also be added to the tail of the list 342 * and removed from the head in constant time, without further memory 343 * allocs or frees. 344 */ 345 346 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size) 347 { 348 size_t alloc_size, i; 349 350 /* Allocated size is a power of 2 to map sequence numbers 351 * (which may be up to 14 bits) in to a smaller array that is 352 * sized for the negotiated ERTM transmit windows. 353 */ 354 alloc_size = roundup_pow_of_two(size); 355 356 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL); 357 if (!seq_list->list) 358 return -ENOMEM; 359 360 seq_list->mask = alloc_size - 1; 361 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 362 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 363 for (i = 0; i < alloc_size; i++) 364 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 365 366 return 0; 367 } 368 369 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list) 370 { 371 kfree(seq_list->list); 372 } 373 374 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list, 375 u16 seq) 376 { 377 /* Constant-time check for list membership */ 378 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR; 379 } 380 381 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list) 382 { 383 u16 seq = seq_list->head; 384 u16 mask = seq_list->mask; 385 386 seq_list->head = seq_list->list[seq & mask]; 387 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR; 388 389 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) { 390 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 391 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 392 } 393 394 return seq; 395 } 396 397 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list) 398 { 399 u16 i; 400 401 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) 402 return; 403 404 for (i = 0; i <= seq_list->mask; i++) 405 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 406 407 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 408 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 409 } 410 411 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq) 412 { 413 u16 mask = seq_list->mask; 414 415 /* All appends happen in constant time */ 416 417 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR) 418 return; 419 420 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR) 421 seq_list->head = seq; 422 else 423 seq_list->list[seq_list->tail & mask] = seq; 424 425 seq_list->tail = seq; 426 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL; 427 } 428 429 static void l2cap_chan_timeout(struct work_struct *work) 430 { 431 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 432 chan_timer.work); 433 struct l2cap_conn *conn = chan->conn; 434 int reason; 435 436 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 437 438 mutex_lock(&conn->chan_lock); 439 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling 440 * this work. No need to call l2cap_chan_hold(chan) here again. 441 */ 442 l2cap_chan_lock(chan); 443 444 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 445 reason = ECONNREFUSED; 446 else if (chan->state == BT_CONNECT && 447 chan->sec_level != BT_SECURITY_SDP) 448 reason = ECONNREFUSED; 449 else 450 reason = ETIMEDOUT; 451 452 l2cap_chan_close(chan, reason); 453 454 chan->ops->close(chan); 455 456 l2cap_chan_unlock(chan); 457 l2cap_chan_put(chan); 458 459 mutex_unlock(&conn->chan_lock); 460 } 461 462 struct l2cap_chan *l2cap_chan_create(void) 463 { 464 struct l2cap_chan *chan; 465 466 chan = kzalloc(sizeof(*chan), GFP_ATOMIC); 467 if (!chan) 468 return NULL; 469 470 skb_queue_head_init(&chan->tx_q); 471 skb_queue_head_init(&chan->srej_q); 472 mutex_init(&chan->lock); 473 474 /* Set default lock nesting level */ 475 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL); 476 477 write_lock(&chan_list_lock); 478 list_add(&chan->global_l, &chan_list); 479 write_unlock(&chan_list_lock); 480 481 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout); 482 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); 483 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); 484 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); 485 486 chan->state = BT_OPEN; 487 488 kref_init(&chan->kref); 489 490 /* This flag is cleared in l2cap_chan_ready() */ 491 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 492 493 BT_DBG("chan %p", chan); 494 495 return chan; 496 } 497 EXPORT_SYMBOL_GPL(l2cap_chan_create); 498 499 static void l2cap_chan_destroy(struct kref *kref) 500 { 501 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref); 502 503 BT_DBG("chan %p", chan); 504 505 write_lock(&chan_list_lock); 506 list_del(&chan->global_l); 507 write_unlock(&chan_list_lock); 508 509 kfree(chan); 510 } 511 512 void l2cap_chan_hold(struct l2cap_chan *c) 513 { 514 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 515 516 kref_get(&c->kref); 517 } 518 519 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) 520 { 521 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 522 523 if (!kref_get_unless_zero(&c->kref)) 524 return NULL; 525 526 return c; 527 } 528 529 void l2cap_chan_put(struct l2cap_chan *c) 530 { 531 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 532 533 kref_put(&c->kref, l2cap_chan_destroy); 534 } 535 EXPORT_SYMBOL_GPL(l2cap_chan_put); 536 537 void l2cap_chan_set_defaults(struct l2cap_chan *chan) 538 { 539 chan->fcs = L2CAP_FCS_CRC16; 540 chan->max_tx = L2CAP_DEFAULT_MAX_TX; 541 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW; 542 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 543 chan->remote_max_tx = chan->max_tx; 544 chan->remote_tx_win = chan->tx_win; 545 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW; 546 chan->sec_level = BT_SECURITY_LOW; 547 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 548 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; 549 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; 550 551 chan->conf_state = 0; 552 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 553 554 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 555 } 556 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults); 557 558 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) 559 { 560 chan->sdu = NULL; 561 chan->sdu_last_frag = NULL; 562 chan->sdu_len = 0; 563 chan->tx_credits = tx_credits; 564 /* Derive MPS from connection MTU to stop HCI fragmentation */ 565 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE); 566 /* Give enough credits for a full packet */ 567 chan->rx_credits = (chan->imtu / chan->mps) + 1; 568 569 skb_queue_head_init(&chan->tx_q); 570 } 571 572 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits) 573 { 574 l2cap_le_flowctl_init(chan, tx_credits); 575 576 /* L2CAP implementations shall support a minimum MPS of 64 octets */ 577 if (chan->mps < L2CAP_ECRED_MIN_MPS) { 578 chan->mps = L2CAP_ECRED_MIN_MPS; 579 chan->rx_credits = (chan->imtu / chan->mps) + 1; 580 } 581 } 582 583 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 584 { 585 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 586 __le16_to_cpu(chan->psm), chan->dcid); 587 588 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 589 590 chan->conn = conn; 591 592 switch (chan->chan_type) { 593 case L2CAP_CHAN_CONN_ORIENTED: 594 /* Alloc CID for connection-oriented socket */ 595 chan->scid = l2cap_alloc_cid(conn); 596 if (conn->hcon->type == ACL_LINK) 597 chan->omtu = L2CAP_DEFAULT_MTU; 598 break; 599 600 case L2CAP_CHAN_CONN_LESS: 601 /* Connectionless socket */ 602 chan->scid = L2CAP_CID_CONN_LESS; 603 chan->dcid = L2CAP_CID_CONN_LESS; 604 chan->omtu = L2CAP_DEFAULT_MTU; 605 break; 606 607 case L2CAP_CHAN_FIXED: 608 /* Caller will set CID and CID specific MTU values */ 609 break; 610 611 default: 612 /* Raw socket can send/recv signalling messages only */ 613 chan->scid = L2CAP_CID_SIGNALING; 614 chan->dcid = L2CAP_CID_SIGNALING; 615 chan->omtu = L2CAP_DEFAULT_MTU; 616 } 617 618 chan->local_id = L2CAP_BESTEFFORT_ID; 619 chan->local_stype = L2CAP_SERV_BESTEFFORT; 620 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE; 621 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME; 622 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT; 623 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO; 624 625 l2cap_chan_hold(chan); 626 627 /* Only keep a reference for fixed channels if they requested it */ 628 if (chan->chan_type != L2CAP_CHAN_FIXED || 629 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 630 hci_conn_hold(conn->hcon); 631 632 list_add(&chan->list, &conn->chan_l); 633 } 634 635 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 636 { 637 mutex_lock(&conn->chan_lock); 638 __l2cap_chan_add(conn, chan); 639 mutex_unlock(&conn->chan_lock); 640 } 641 642 void l2cap_chan_del(struct l2cap_chan *chan, int err) 643 { 644 struct l2cap_conn *conn = chan->conn; 645 646 __clear_chan_timer(chan); 647 648 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err, 649 state_to_string(chan->state)); 650 651 chan->ops->teardown(chan, err); 652 653 if (conn) { 654 struct amp_mgr *mgr = conn->hcon->amp_mgr; 655 /* Delete from channel list */ 656 list_del(&chan->list); 657 658 l2cap_chan_put(chan); 659 660 chan->conn = NULL; 661 662 /* Reference was only held for non-fixed channels or 663 * fixed channels that explicitly requested it using the 664 * FLAG_HOLD_HCI_CONN flag. 665 */ 666 if (chan->chan_type != L2CAP_CHAN_FIXED || 667 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 668 hci_conn_drop(conn->hcon); 669 670 if (mgr && mgr->bredr_chan == chan) 671 mgr->bredr_chan = NULL; 672 } 673 674 if (chan->hs_hchan) { 675 struct hci_chan *hs_hchan = chan->hs_hchan; 676 677 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan); 678 amp_disconnect_logical_link(hs_hchan); 679 } 680 681 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state)) 682 return; 683 684 switch (chan->mode) { 685 case L2CAP_MODE_BASIC: 686 break; 687 688 case L2CAP_MODE_LE_FLOWCTL: 689 case L2CAP_MODE_EXT_FLOWCTL: 690 skb_queue_purge(&chan->tx_q); 691 break; 692 693 case L2CAP_MODE_ERTM: 694 __clear_retrans_timer(chan); 695 __clear_monitor_timer(chan); 696 __clear_ack_timer(chan); 697 698 skb_queue_purge(&chan->srej_q); 699 700 l2cap_seq_list_free(&chan->srej_list); 701 l2cap_seq_list_free(&chan->retrans_list); 702 fallthrough; 703 704 case L2CAP_MODE_STREAMING: 705 skb_queue_purge(&chan->tx_q); 706 break; 707 } 708 } 709 EXPORT_SYMBOL_GPL(l2cap_chan_del); 710 711 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id, 712 l2cap_chan_func_t func, void *data) 713 { 714 struct l2cap_chan *chan, *l; 715 716 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 717 if (chan->ident == id) 718 func(chan, data); 719 } 720 } 721 722 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 723 void *data) 724 { 725 struct l2cap_chan *chan; 726 727 list_for_each_entry(chan, &conn->chan_l, list) { 728 func(chan, data); 729 } 730 } 731 732 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 733 void *data) 734 { 735 if (!conn) 736 return; 737 738 mutex_lock(&conn->chan_lock); 739 __l2cap_chan_list(conn, func, data); 740 mutex_unlock(&conn->chan_lock); 741 } 742 743 EXPORT_SYMBOL_GPL(l2cap_chan_list); 744 745 static void l2cap_conn_update_id_addr(struct work_struct *work) 746 { 747 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 748 id_addr_update_work); 749 struct hci_conn *hcon = conn->hcon; 750 struct l2cap_chan *chan; 751 752 mutex_lock(&conn->chan_lock); 753 754 list_for_each_entry(chan, &conn->chan_l, list) { 755 l2cap_chan_lock(chan); 756 bacpy(&chan->dst, &hcon->dst); 757 chan->dst_type = bdaddr_dst_type(hcon); 758 l2cap_chan_unlock(chan); 759 } 760 761 mutex_unlock(&conn->chan_lock); 762 } 763 764 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) 765 { 766 struct l2cap_conn *conn = chan->conn; 767 struct l2cap_le_conn_rsp rsp; 768 u16 result; 769 770 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 771 result = L2CAP_CR_LE_AUTHORIZATION; 772 else 773 result = L2CAP_CR_LE_BAD_PSM; 774 775 l2cap_state_change(chan, BT_DISCONN); 776 777 rsp.dcid = cpu_to_le16(chan->scid); 778 rsp.mtu = cpu_to_le16(chan->imtu); 779 rsp.mps = cpu_to_le16(chan->mps); 780 rsp.credits = cpu_to_le16(chan->rx_credits); 781 rsp.result = cpu_to_le16(result); 782 783 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 784 &rsp); 785 } 786 787 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) 788 { 789 l2cap_state_change(chan, BT_DISCONN); 790 791 __l2cap_ecred_conn_rsp_defer(chan); 792 } 793 794 static void l2cap_chan_connect_reject(struct l2cap_chan *chan) 795 { 796 struct l2cap_conn *conn = chan->conn; 797 struct l2cap_conn_rsp rsp; 798 u16 result; 799 800 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 801 result = L2CAP_CR_SEC_BLOCK; 802 else 803 result = L2CAP_CR_BAD_PSM; 804 805 l2cap_state_change(chan, BT_DISCONN); 806 807 rsp.scid = cpu_to_le16(chan->dcid); 808 rsp.dcid = cpu_to_le16(chan->scid); 809 rsp.result = cpu_to_le16(result); 810 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 811 812 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 813 } 814 815 void l2cap_chan_close(struct l2cap_chan *chan, int reason) 816 { 817 struct l2cap_conn *conn = chan->conn; 818 819 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 820 821 switch (chan->state) { 822 case BT_LISTEN: 823 chan->ops->teardown(chan, 0); 824 break; 825 826 case BT_CONNECTED: 827 case BT_CONFIG: 828 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 829 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 830 l2cap_send_disconn_req(chan, reason); 831 } else 832 l2cap_chan_del(chan, reason); 833 break; 834 835 case BT_CONNECT2: 836 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 837 if (conn->hcon->type == ACL_LINK) 838 l2cap_chan_connect_reject(chan); 839 else if (conn->hcon->type == LE_LINK) { 840 switch (chan->mode) { 841 case L2CAP_MODE_LE_FLOWCTL: 842 l2cap_chan_le_connect_reject(chan); 843 break; 844 case L2CAP_MODE_EXT_FLOWCTL: 845 l2cap_chan_ecred_connect_reject(chan); 846 return; 847 } 848 } 849 } 850 851 l2cap_chan_del(chan, reason); 852 break; 853 854 case BT_CONNECT: 855 case BT_DISCONN: 856 l2cap_chan_del(chan, reason); 857 break; 858 859 default: 860 chan->ops->teardown(chan, 0); 861 break; 862 } 863 } 864 EXPORT_SYMBOL(l2cap_chan_close); 865 866 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 867 { 868 switch (chan->chan_type) { 869 case L2CAP_CHAN_RAW: 870 switch (chan->sec_level) { 871 case BT_SECURITY_HIGH: 872 case BT_SECURITY_FIPS: 873 return HCI_AT_DEDICATED_BONDING_MITM; 874 case BT_SECURITY_MEDIUM: 875 return HCI_AT_DEDICATED_BONDING; 876 default: 877 return HCI_AT_NO_BONDING; 878 } 879 break; 880 case L2CAP_CHAN_CONN_LESS: 881 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) { 882 if (chan->sec_level == BT_SECURITY_LOW) 883 chan->sec_level = BT_SECURITY_SDP; 884 } 885 if (chan->sec_level == BT_SECURITY_HIGH || 886 chan->sec_level == BT_SECURITY_FIPS) 887 return HCI_AT_NO_BONDING_MITM; 888 else 889 return HCI_AT_NO_BONDING; 890 break; 891 case L2CAP_CHAN_CONN_ORIENTED: 892 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) { 893 if (chan->sec_level == BT_SECURITY_LOW) 894 chan->sec_level = BT_SECURITY_SDP; 895 896 if (chan->sec_level == BT_SECURITY_HIGH || 897 chan->sec_level == BT_SECURITY_FIPS) 898 return HCI_AT_NO_BONDING_MITM; 899 else 900 return HCI_AT_NO_BONDING; 901 } 902 fallthrough; 903 904 default: 905 switch (chan->sec_level) { 906 case BT_SECURITY_HIGH: 907 case BT_SECURITY_FIPS: 908 return HCI_AT_GENERAL_BONDING_MITM; 909 case BT_SECURITY_MEDIUM: 910 return HCI_AT_GENERAL_BONDING; 911 default: 912 return HCI_AT_NO_BONDING; 913 } 914 break; 915 } 916 } 917 918 /* Service level security */ 919 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator) 920 { 921 struct l2cap_conn *conn = chan->conn; 922 __u8 auth_type; 923 924 if (conn->hcon->type == LE_LINK) 925 return smp_conn_security(conn->hcon, chan->sec_level); 926 927 auth_type = l2cap_get_auth_type(chan); 928 929 return hci_conn_security(conn->hcon, chan->sec_level, auth_type, 930 initiator); 931 } 932 933 static u8 l2cap_get_ident(struct l2cap_conn *conn) 934 { 935 u8 id; 936 937 /* Get next available identificator. 938 * 1 - 128 are used by kernel. 939 * 129 - 199 are reserved. 940 * 200 - 254 are used by utilities like l2ping, etc. 941 */ 942 943 mutex_lock(&conn->ident_lock); 944 945 if (++conn->tx_ident > 128) 946 conn->tx_ident = 1; 947 948 id = conn->tx_ident; 949 950 mutex_unlock(&conn->ident_lock); 951 952 return id; 953 } 954 955 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 956 void *data) 957 { 958 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 959 u8 flags; 960 961 BT_DBG("code 0x%2.2x", code); 962 963 if (!skb) 964 return; 965 966 /* Use NO_FLUSH if supported or we have an LE link (which does 967 * not support auto-flushing packets) */ 968 if (lmp_no_flush_capable(conn->hcon->hdev) || 969 conn->hcon->type == LE_LINK) 970 flags = ACL_START_NO_FLUSH; 971 else 972 flags = ACL_START; 973 974 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 975 skb->priority = HCI_PRIO_MAX; 976 977 hci_send_acl(conn->hchan, skb, flags); 978 } 979 980 static bool __chan_is_moving(struct l2cap_chan *chan) 981 { 982 return chan->move_state != L2CAP_MOVE_STABLE && 983 chan->move_state != L2CAP_MOVE_WAIT_PREPARE; 984 } 985 986 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 987 { 988 struct hci_conn *hcon = chan->conn->hcon; 989 u16 flags; 990 991 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len, 992 skb->priority); 993 994 if (chan->hs_hcon && !__chan_is_moving(chan)) { 995 if (chan->hs_hchan) 996 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE); 997 else 998 kfree_skb(skb); 999 1000 return; 1001 } 1002 1003 /* Use NO_FLUSH for LE links (where this is the only option) or 1004 * if the BR/EDR link supports it and flushing has not been 1005 * explicitly requested (through FLAG_FLUSHABLE). 1006 */ 1007 if (hcon->type == LE_LINK || 1008 (!test_bit(FLAG_FLUSHABLE, &chan->flags) && 1009 lmp_no_flush_capable(hcon->hdev))) 1010 flags = ACL_START_NO_FLUSH; 1011 else 1012 flags = ACL_START; 1013 1014 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1015 hci_send_acl(chan->conn->hchan, skb, flags); 1016 } 1017 1018 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control) 1019 { 1020 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT; 1021 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT; 1022 1023 if (enh & L2CAP_CTRL_FRAME_TYPE) { 1024 /* S-Frame */ 1025 control->sframe = 1; 1026 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT; 1027 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT; 1028 1029 control->sar = 0; 1030 control->txseq = 0; 1031 } else { 1032 /* I-Frame */ 1033 control->sframe = 0; 1034 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT; 1035 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT; 1036 1037 control->poll = 0; 1038 control->super = 0; 1039 } 1040 } 1041 1042 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control) 1043 { 1044 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1045 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT; 1046 1047 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) { 1048 /* S-Frame */ 1049 control->sframe = 1; 1050 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT; 1051 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT; 1052 1053 control->sar = 0; 1054 control->txseq = 0; 1055 } else { 1056 /* I-Frame */ 1057 control->sframe = 0; 1058 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT; 1059 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1060 1061 control->poll = 0; 1062 control->super = 0; 1063 } 1064 } 1065 1066 static inline void __unpack_control(struct l2cap_chan *chan, 1067 struct sk_buff *skb) 1068 { 1069 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1070 __unpack_extended_control(get_unaligned_le32(skb->data), 1071 &bt_cb(skb)->l2cap); 1072 skb_pull(skb, L2CAP_EXT_CTRL_SIZE); 1073 } else { 1074 __unpack_enhanced_control(get_unaligned_le16(skb->data), 1075 &bt_cb(skb)->l2cap); 1076 skb_pull(skb, L2CAP_ENH_CTRL_SIZE); 1077 } 1078 } 1079 1080 static u32 __pack_extended_control(struct l2cap_ctrl *control) 1081 { 1082 u32 packed; 1083 1084 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1085 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT; 1086 1087 if (control->sframe) { 1088 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT; 1089 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT; 1090 packed |= L2CAP_EXT_CTRL_FRAME_TYPE; 1091 } else { 1092 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT; 1093 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1094 } 1095 1096 return packed; 1097 } 1098 1099 static u16 __pack_enhanced_control(struct l2cap_ctrl *control) 1100 { 1101 u16 packed; 1102 1103 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT; 1104 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT; 1105 1106 if (control->sframe) { 1107 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT; 1108 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT; 1109 packed |= L2CAP_CTRL_FRAME_TYPE; 1110 } else { 1111 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT; 1112 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT; 1113 } 1114 1115 return packed; 1116 } 1117 1118 static inline void __pack_control(struct l2cap_chan *chan, 1119 struct l2cap_ctrl *control, 1120 struct sk_buff *skb) 1121 { 1122 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1123 put_unaligned_le32(__pack_extended_control(control), 1124 skb->data + L2CAP_HDR_SIZE); 1125 } else { 1126 put_unaligned_le16(__pack_enhanced_control(control), 1127 skb->data + L2CAP_HDR_SIZE); 1128 } 1129 } 1130 1131 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan) 1132 { 1133 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1134 return L2CAP_EXT_HDR_SIZE; 1135 else 1136 return L2CAP_ENH_HDR_SIZE; 1137 } 1138 1139 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan, 1140 u32 control) 1141 { 1142 struct sk_buff *skb; 1143 struct l2cap_hdr *lh; 1144 int hlen = __ertm_hdr_size(chan); 1145 1146 if (chan->fcs == L2CAP_FCS_CRC16) 1147 hlen += L2CAP_FCS_SIZE; 1148 1149 skb = bt_skb_alloc(hlen, GFP_KERNEL); 1150 1151 if (!skb) 1152 return ERR_PTR(-ENOMEM); 1153 1154 lh = skb_put(skb, L2CAP_HDR_SIZE); 1155 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 1156 lh->cid = cpu_to_le16(chan->dcid); 1157 1158 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1159 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 1160 else 1161 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 1162 1163 if (chan->fcs == L2CAP_FCS_CRC16) { 1164 u16 fcs = crc16(0, (u8 *)skb->data, skb->len); 1165 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1166 } 1167 1168 skb->priority = HCI_PRIO_MAX; 1169 return skb; 1170 } 1171 1172 static void l2cap_send_sframe(struct l2cap_chan *chan, 1173 struct l2cap_ctrl *control) 1174 { 1175 struct sk_buff *skb; 1176 u32 control_field; 1177 1178 BT_DBG("chan %p, control %p", chan, control); 1179 1180 if (!control->sframe) 1181 return; 1182 1183 if (__chan_is_moving(chan)) 1184 return; 1185 1186 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) && 1187 !control->poll) 1188 control->final = 1; 1189 1190 if (control->super == L2CAP_SUPER_RR) 1191 clear_bit(CONN_RNR_SENT, &chan->conn_state); 1192 else if (control->super == L2CAP_SUPER_RNR) 1193 set_bit(CONN_RNR_SENT, &chan->conn_state); 1194 1195 if (control->super != L2CAP_SUPER_SREJ) { 1196 chan->last_acked_seq = control->reqseq; 1197 __clear_ack_timer(chan); 1198 } 1199 1200 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq, 1201 control->final, control->poll, control->super); 1202 1203 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1204 control_field = __pack_extended_control(control); 1205 else 1206 control_field = __pack_enhanced_control(control); 1207 1208 skb = l2cap_create_sframe_pdu(chan, control_field); 1209 if (!IS_ERR(skb)) 1210 l2cap_do_send(chan, skb); 1211 } 1212 1213 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll) 1214 { 1215 struct l2cap_ctrl control; 1216 1217 BT_DBG("chan %p, poll %d", chan, poll); 1218 1219 memset(&control, 0, sizeof(control)); 1220 control.sframe = 1; 1221 control.poll = poll; 1222 1223 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 1224 control.super = L2CAP_SUPER_RNR; 1225 else 1226 control.super = L2CAP_SUPER_RR; 1227 1228 control.reqseq = chan->buffer_seq; 1229 l2cap_send_sframe(chan, &control); 1230 } 1231 1232 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 1233 { 1234 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 1235 return true; 1236 1237 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 1238 } 1239 1240 static bool __amp_capable(struct l2cap_chan *chan) 1241 { 1242 struct l2cap_conn *conn = chan->conn; 1243 struct hci_dev *hdev; 1244 bool amp_available = false; 1245 1246 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) 1247 return false; 1248 1249 if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP)) 1250 return false; 1251 1252 read_lock(&hci_dev_list_lock); 1253 list_for_each_entry(hdev, &hci_dev_list, list) { 1254 if (hdev->amp_type != AMP_TYPE_BREDR && 1255 test_bit(HCI_UP, &hdev->flags)) { 1256 amp_available = true; 1257 break; 1258 } 1259 } 1260 read_unlock(&hci_dev_list_lock); 1261 1262 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED) 1263 return amp_available; 1264 1265 return false; 1266 } 1267 1268 static bool l2cap_check_efs(struct l2cap_chan *chan) 1269 { 1270 /* Check EFS parameters */ 1271 return true; 1272 } 1273 1274 void l2cap_send_conn_req(struct l2cap_chan *chan) 1275 { 1276 struct l2cap_conn *conn = chan->conn; 1277 struct l2cap_conn_req req; 1278 1279 req.scid = cpu_to_le16(chan->scid); 1280 req.psm = chan->psm; 1281 1282 chan->ident = l2cap_get_ident(conn); 1283 1284 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 1285 1286 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req); 1287 } 1288 1289 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id) 1290 { 1291 struct l2cap_create_chan_req req; 1292 req.scid = cpu_to_le16(chan->scid); 1293 req.psm = chan->psm; 1294 req.amp_id = amp_id; 1295 1296 chan->ident = l2cap_get_ident(chan->conn); 1297 1298 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ, 1299 sizeof(req), &req); 1300 } 1301 1302 static void l2cap_move_setup(struct l2cap_chan *chan) 1303 { 1304 struct sk_buff *skb; 1305 1306 BT_DBG("chan %p", chan); 1307 1308 if (chan->mode != L2CAP_MODE_ERTM) 1309 return; 1310 1311 __clear_retrans_timer(chan); 1312 __clear_monitor_timer(chan); 1313 __clear_ack_timer(chan); 1314 1315 chan->retry_count = 0; 1316 skb_queue_walk(&chan->tx_q, skb) { 1317 if (bt_cb(skb)->l2cap.retries) 1318 bt_cb(skb)->l2cap.retries = 1; 1319 else 1320 break; 1321 } 1322 1323 chan->expected_tx_seq = chan->buffer_seq; 1324 1325 clear_bit(CONN_REJ_ACT, &chan->conn_state); 1326 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 1327 l2cap_seq_list_clear(&chan->retrans_list); 1328 l2cap_seq_list_clear(&chan->srej_list); 1329 skb_queue_purge(&chan->srej_q); 1330 1331 chan->tx_state = L2CAP_TX_STATE_XMIT; 1332 chan->rx_state = L2CAP_RX_STATE_MOVE; 1333 1334 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 1335 } 1336 1337 static void l2cap_move_done(struct l2cap_chan *chan) 1338 { 1339 u8 move_role = chan->move_role; 1340 BT_DBG("chan %p", chan); 1341 1342 chan->move_state = L2CAP_MOVE_STABLE; 1343 chan->move_role = L2CAP_MOVE_ROLE_NONE; 1344 1345 if (chan->mode != L2CAP_MODE_ERTM) 1346 return; 1347 1348 switch (move_role) { 1349 case L2CAP_MOVE_ROLE_INITIATOR: 1350 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL); 1351 chan->rx_state = L2CAP_RX_STATE_WAIT_F; 1352 break; 1353 case L2CAP_MOVE_ROLE_RESPONDER: 1354 chan->rx_state = L2CAP_RX_STATE_WAIT_P; 1355 break; 1356 } 1357 } 1358 1359 static void l2cap_chan_ready(struct l2cap_chan *chan) 1360 { 1361 /* The channel may have already been flagged as connected in 1362 * case of receiving data before the L2CAP info req/rsp 1363 * procedure is complete. 1364 */ 1365 if (chan->state == BT_CONNECTED) 1366 return; 1367 1368 /* This clears all conf flags, including CONF_NOT_COMPLETE */ 1369 chan->conf_state = 0; 1370 __clear_chan_timer(chan); 1371 1372 switch (chan->mode) { 1373 case L2CAP_MODE_LE_FLOWCTL: 1374 case L2CAP_MODE_EXT_FLOWCTL: 1375 if (!chan->tx_credits) 1376 chan->ops->suspend(chan); 1377 break; 1378 } 1379 1380 chan->state = BT_CONNECTED; 1381 1382 chan->ops->ready(chan); 1383 } 1384 1385 static void l2cap_le_connect(struct l2cap_chan *chan) 1386 { 1387 struct l2cap_conn *conn = chan->conn; 1388 struct l2cap_le_conn_req req; 1389 1390 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags)) 1391 return; 1392 1393 if (!chan->imtu) 1394 chan->imtu = chan->conn->mtu; 1395 1396 l2cap_le_flowctl_init(chan, 0); 1397 1398 memset(&req, 0, sizeof(req)); 1399 req.psm = chan->psm; 1400 req.scid = cpu_to_le16(chan->scid); 1401 req.mtu = cpu_to_le16(chan->imtu); 1402 req.mps = cpu_to_le16(chan->mps); 1403 req.credits = cpu_to_le16(chan->rx_credits); 1404 1405 chan->ident = l2cap_get_ident(conn); 1406 1407 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ, 1408 sizeof(req), &req); 1409 } 1410 1411 struct l2cap_ecred_conn_data { 1412 struct { 1413 struct l2cap_ecred_conn_req req; 1414 __le16 scid[5]; 1415 } __packed pdu; 1416 struct l2cap_chan *chan; 1417 struct pid *pid; 1418 int count; 1419 }; 1420 1421 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data) 1422 { 1423 struct l2cap_ecred_conn_data *conn = data; 1424 struct pid *pid; 1425 1426 if (chan == conn->chan) 1427 return; 1428 1429 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 1430 return; 1431 1432 pid = chan->ops->get_peer_pid(chan); 1433 1434 /* Only add deferred channels with the same PID/PSM */ 1435 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident || 1436 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 1437 return; 1438 1439 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1440 return; 1441 1442 l2cap_ecred_init(chan, 0); 1443 1444 /* Set the same ident so we can match on the rsp */ 1445 chan->ident = conn->chan->ident; 1446 1447 /* Include all channels deferred */ 1448 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid); 1449 1450 conn->count++; 1451 } 1452 1453 static void l2cap_ecred_connect(struct l2cap_chan *chan) 1454 { 1455 struct l2cap_conn *conn = chan->conn; 1456 struct l2cap_ecred_conn_data data; 1457 1458 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 1459 return; 1460 1461 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1462 return; 1463 1464 l2cap_ecred_init(chan, 0); 1465 1466 memset(&data, 0, sizeof(data)); 1467 data.pdu.req.psm = chan->psm; 1468 data.pdu.req.mtu = cpu_to_le16(chan->imtu); 1469 data.pdu.req.mps = cpu_to_le16(chan->mps); 1470 data.pdu.req.credits = cpu_to_le16(chan->rx_credits); 1471 data.pdu.scid[0] = cpu_to_le16(chan->scid); 1472 1473 chan->ident = l2cap_get_ident(conn); 1474 1475 data.count = 1; 1476 data.chan = chan; 1477 data.pid = chan->ops->get_peer_pid(chan); 1478 1479 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data); 1480 1481 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ, 1482 sizeof(data.pdu.req) + data.count * sizeof(__le16), 1483 &data.pdu); 1484 } 1485 1486 static void l2cap_le_start(struct l2cap_chan *chan) 1487 { 1488 struct l2cap_conn *conn = chan->conn; 1489 1490 if (!smp_conn_security(conn->hcon, chan->sec_level)) 1491 return; 1492 1493 if (!chan->psm) { 1494 l2cap_chan_ready(chan); 1495 return; 1496 } 1497 1498 if (chan->state == BT_CONNECT) { 1499 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) 1500 l2cap_ecred_connect(chan); 1501 else 1502 l2cap_le_connect(chan); 1503 } 1504 } 1505 1506 static void l2cap_start_connection(struct l2cap_chan *chan) 1507 { 1508 if (__amp_capable(chan)) { 1509 BT_DBG("chan %p AMP capable: discover AMPs", chan); 1510 a2mp_discover_amp(chan); 1511 } else if (chan->conn->hcon->type == LE_LINK) { 1512 l2cap_le_start(chan); 1513 } else { 1514 l2cap_send_conn_req(chan); 1515 } 1516 } 1517 1518 static void l2cap_request_info(struct l2cap_conn *conn) 1519 { 1520 struct l2cap_info_req req; 1521 1522 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1523 return; 1524 1525 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 1526 1527 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 1528 conn->info_ident = l2cap_get_ident(conn); 1529 1530 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 1531 1532 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 1533 sizeof(req), &req); 1534 } 1535 1536 static bool l2cap_check_enc_key_size(struct hci_conn *hcon) 1537 { 1538 /* The minimum encryption key size needs to be enforced by the 1539 * host stack before establishing any L2CAP connections. The 1540 * specification in theory allows a minimum of 1, but to align 1541 * BR/EDR and LE transports, a minimum of 7 is chosen. 1542 * 1543 * This check might also be called for unencrypted connections 1544 * that have no key size requirements. Ensure that the link is 1545 * actually encrypted before enforcing a key size. 1546 */ 1547 int min_key_size = hcon->hdev->min_enc_key_size; 1548 1549 /* On FIPS security level, key size must be 16 bytes */ 1550 if (hcon->sec_level == BT_SECURITY_FIPS) 1551 min_key_size = 16; 1552 1553 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || 1554 hcon->enc_key_size >= min_key_size); 1555 } 1556 1557 static void l2cap_do_start(struct l2cap_chan *chan) 1558 { 1559 struct l2cap_conn *conn = chan->conn; 1560 1561 if (conn->hcon->type == LE_LINK) { 1562 l2cap_le_start(chan); 1563 return; 1564 } 1565 1566 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) { 1567 l2cap_request_info(conn); 1568 return; 1569 } 1570 1571 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 1572 return; 1573 1574 if (!l2cap_chan_check_security(chan, true) || 1575 !__l2cap_no_conn_pending(chan)) 1576 return; 1577 1578 if (l2cap_check_enc_key_size(conn->hcon)) 1579 l2cap_start_connection(chan); 1580 else 1581 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 1582 } 1583 1584 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 1585 { 1586 u32 local_feat_mask = l2cap_feat_mask; 1587 if (!disable_ertm) 1588 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 1589 1590 switch (mode) { 1591 case L2CAP_MODE_ERTM: 1592 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 1593 case L2CAP_MODE_STREAMING: 1594 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 1595 default: 1596 return 0x00; 1597 } 1598 } 1599 1600 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err) 1601 { 1602 struct l2cap_conn *conn = chan->conn; 1603 struct l2cap_disconn_req req; 1604 1605 if (!conn) 1606 return; 1607 1608 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) { 1609 __clear_retrans_timer(chan); 1610 __clear_monitor_timer(chan); 1611 __clear_ack_timer(chan); 1612 } 1613 1614 if (chan->scid == L2CAP_CID_A2MP) { 1615 l2cap_state_change(chan, BT_DISCONN); 1616 return; 1617 } 1618 1619 req.dcid = cpu_to_le16(chan->dcid); 1620 req.scid = cpu_to_le16(chan->scid); 1621 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ, 1622 sizeof(req), &req); 1623 1624 l2cap_state_change_and_error(chan, BT_DISCONN, err); 1625 } 1626 1627 /* ---- L2CAP connections ---- */ 1628 static void l2cap_conn_start(struct l2cap_conn *conn) 1629 { 1630 struct l2cap_chan *chan, *tmp; 1631 1632 BT_DBG("conn %p", conn); 1633 1634 mutex_lock(&conn->chan_lock); 1635 1636 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 1637 l2cap_chan_lock(chan); 1638 1639 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1640 l2cap_chan_ready(chan); 1641 l2cap_chan_unlock(chan); 1642 continue; 1643 } 1644 1645 if (chan->state == BT_CONNECT) { 1646 if (!l2cap_chan_check_security(chan, true) || 1647 !__l2cap_no_conn_pending(chan)) { 1648 l2cap_chan_unlock(chan); 1649 continue; 1650 } 1651 1652 if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 1653 && test_bit(CONF_STATE2_DEVICE, 1654 &chan->conf_state)) { 1655 l2cap_chan_close(chan, ECONNRESET); 1656 l2cap_chan_unlock(chan); 1657 continue; 1658 } 1659 1660 if (l2cap_check_enc_key_size(conn->hcon)) 1661 l2cap_start_connection(chan); 1662 else 1663 l2cap_chan_close(chan, ECONNREFUSED); 1664 1665 } else if (chan->state == BT_CONNECT2) { 1666 struct l2cap_conn_rsp rsp; 1667 char buf[128]; 1668 rsp.scid = cpu_to_le16(chan->dcid); 1669 rsp.dcid = cpu_to_le16(chan->scid); 1670 1671 if (l2cap_chan_check_security(chan, false)) { 1672 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 1673 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1674 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 1675 chan->ops->defer(chan); 1676 1677 } else { 1678 l2cap_state_change(chan, BT_CONFIG); 1679 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 1680 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 1681 } 1682 } else { 1683 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1684 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 1685 } 1686 1687 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 1688 sizeof(rsp), &rsp); 1689 1690 if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 1691 rsp.result != L2CAP_CR_SUCCESS) { 1692 l2cap_chan_unlock(chan); 1693 continue; 1694 } 1695 1696 set_bit(CONF_REQ_SENT, &chan->conf_state); 1697 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 1698 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 1699 chan->num_conf_req++; 1700 } 1701 1702 l2cap_chan_unlock(chan); 1703 } 1704 1705 mutex_unlock(&conn->chan_lock); 1706 } 1707 1708 static void l2cap_le_conn_ready(struct l2cap_conn *conn) 1709 { 1710 struct hci_conn *hcon = conn->hcon; 1711 struct hci_dev *hdev = hcon->hdev; 1712 1713 BT_DBG("%s conn %p", hdev->name, conn); 1714 1715 /* For outgoing pairing which doesn't necessarily have an 1716 * associated socket (e.g. mgmt_pair_device). 1717 */ 1718 if (hcon->out) 1719 smp_conn_security(hcon, hcon->pending_sec_level); 1720 1721 /* For LE peripheral connections, make sure the connection interval 1722 * is in the range of the minimum and maximum interval that has 1723 * been configured for this connection. If not, then trigger 1724 * the connection update procedure. 1725 */ 1726 if (hcon->role == HCI_ROLE_SLAVE && 1727 (hcon->le_conn_interval < hcon->le_conn_min_interval || 1728 hcon->le_conn_interval > hcon->le_conn_max_interval)) { 1729 struct l2cap_conn_param_update_req req; 1730 1731 req.min = cpu_to_le16(hcon->le_conn_min_interval); 1732 req.max = cpu_to_le16(hcon->le_conn_max_interval); 1733 req.latency = cpu_to_le16(hcon->le_conn_latency); 1734 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout); 1735 1736 l2cap_send_cmd(conn, l2cap_get_ident(conn), 1737 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req); 1738 } 1739 } 1740 1741 static void l2cap_conn_ready(struct l2cap_conn *conn) 1742 { 1743 struct l2cap_chan *chan; 1744 struct hci_conn *hcon = conn->hcon; 1745 1746 BT_DBG("conn %p", conn); 1747 1748 if (hcon->type == ACL_LINK) 1749 l2cap_request_info(conn); 1750 1751 mutex_lock(&conn->chan_lock); 1752 1753 list_for_each_entry(chan, &conn->chan_l, list) { 1754 1755 l2cap_chan_lock(chan); 1756 1757 if (chan->scid == L2CAP_CID_A2MP) { 1758 l2cap_chan_unlock(chan); 1759 continue; 1760 } 1761 1762 if (hcon->type == LE_LINK) { 1763 l2cap_le_start(chan); 1764 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1765 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 1766 l2cap_chan_ready(chan); 1767 } else if (chan->state == BT_CONNECT) { 1768 l2cap_do_start(chan); 1769 } 1770 1771 l2cap_chan_unlock(chan); 1772 } 1773 1774 mutex_unlock(&conn->chan_lock); 1775 1776 if (hcon->type == LE_LINK) 1777 l2cap_le_conn_ready(conn); 1778 1779 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work); 1780 } 1781 1782 /* Notify sockets that we cannot guaranty reliability anymore */ 1783 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 1784 { 1785 struct l2cap_chan *chan; 1786 1787 BT_DBG("conn %p", conn); 1788 1789 mutex_lock(&conn->chan_lock); 1790 1791 list_for_each_entry(chan, &conn->chan_l, list) { 1792 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 1793 l2cap_chan_set_err(chan, err); 1794 } 1795 1796 mutex_unlock(&conn->chan_lock); 1797 } 1798 1799 static void l2cap_info_timeout(struct work_struct *work) 1800 { 1801 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 1802 info_timer.work); 1803 1804 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 1805 conn->info_ident = 0; 1806 1807 l2cap_conn_start(conn); 1808 } 1809 1810 /* 1811 * l2cap_user 1812 * External modules can register l2cap_user objects on l2cap_conn. The ->probe 1813 * callback is called during registration. The ->remove callback is called 1814 * during unregistration. 1815 * An l2cap_user object can either be explicitly unregistered or when the 1816 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon, 1817 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called. 1818 * External modules must own a reference to the l2cap_conn object if they intend 1819 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at 1820 * any time if they don't. 1821 */ 1822 1823 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user) 1824 { 1825 struct hci_dev *hdev = conn->hcon->hdev; 1826 int ret; 1827 1828 /* We need to check whether l2cap_conn is registered. If it is not, we 1829 * must not register the l2cap_user. l2cap_conn_del() is unregisters 1830 * l2cap_conn objects, but doesn't provide its own locking. Instead, it 1831 * relies on the parent hci_conn object to be locked. This itself relies 1832 * on the hci_dev object to be locked. So we must lock the hci device 1833 * here, too. */ 1834 1835 hci_dev_lock(hdev); 1836 1837 if (!list_empty(&user->list)) { 1838 ret = -EINVAL; 1839 goto out_unlock; 1840 } 1841 1842 /* conn->hchan is NULL after l2cap_conn_del() was called */ 1843 if (!conn->hchan) { 1844 ret = -ENODEV; 1845 goto out_unlock; 1846 } 1847 1848 ret = user->probe(conn, user); 1849 if (ret) 1850 goto out_unlock; 1851 1852 list_add(&user->list, &conn->users); 1853 ret = 0; 1854 1855 out_unlock: 1856 hci_dev_unlock(hdev); 1857 return ret; 1858 } 1859 EXPORT_SYMBOL(l2cap_register_user); 1860 1861 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) 1862 { 1863 struct hci_dev *hdev = conn->hcon->hdev; 1864 1865 hci_dev_lock(hdev); 1866 1867 if (list_empty(&user->list)) 1868 goto out_unlock; 1869 1870 list_del_init(&user->list); 1871 user->remove(conn, user); 1872 1873 out_unlock: 1874 hci_dev_unlock(hdev); 1875 } 1876 EXPORT_SYMBOL(l2cap_unregister_user); 1877 1878 static void l2cap_unregister_all_users(struct l2cap_conn *conn) 1879 { 1880 struct l2cap_user *user; 1881 1882 while (!list_empty(&conn->users)) { 1883 user = list_first_entry(&conn->users, struct l2cap_user, list); 1884 list_del_init(&user->list); 1885 user->remove(conn, user); 1886 } 1887 } 1888 1889 static void l2cap_conn_del(struct hci_conn *hcon, int err) 1890 { 1891 struct l2cap_conn *conn = hcon->l2cap_data; 1892 struct l2cap_chan *chan, *l; 1893 1894 if (!conn) 1895 return; 1896 1897 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 1898 1899 kfree_skb(conn->rx_skb); 1900 1901 skb_queue_purge(&conn->pending_rx); 1902 1903 /* We can not call flush_work(&conn->pending_rx_work) here since we 1904 * might block if we are running on a worker from the same workqueue 1905 * pending_rx_work is waiting on. 1906 */ 1907 if (work_pending(&conn->pending_rx_work)) 1908 cancel_work_sync(&conn->pending_rx_work); 1909 1910 if (work_pending(&conn->id_addr_update_work)) 1911 cancel_work_sync(&conn->id_addr_update_work); 1912 1913 l2cap_unregister_all_users(conn); 1914 1915 /* Force the connection to be immediately dropped */ 1916 hcon->disc_timeout = 0; 1917 1918 mutex_lock(&conn->chan_lock); 1919 1920 /* Kill channels */ 1921 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 1922 l2cap_chan_hold(chan); 1923 l2cap_chan_lock(chan); 1924 1925 l2cap_chan_del(chan, err); 1926 1927 chan->ops->close(chan); 1928 1929 l2cap_chan_unlock(chan); 1930 l2cap_chan_put(chan); 1931 } 1932 1933 mutex_unlock(&conn->chan_lock); 1934 1935 hci_chan_del(conn->hchan); 1936 1937 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1938 cancel_delayed_work_sync(&conn->info_timer); 1939 1940 hcon->l2cap_data = NULL; 1941 conn->hchan = NULL; 1942 l2cap_conn_put(conn); 1943 } 1944 1945 static void l2cap_conn_free(struct kref *ref) 1946 { 1947 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); 1948 1949 hci_conn_put(conn->hcon); 1950 kfree(conn); 1951 } 1952 1953 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn) 1954 { 1955 kref_get(&conn->ref); 1956 return conn; 1957 } 1958 EXPORT_SYMBOL(l2cap_conn_get); 1959 1960 void l2cap_conn_put(struct l2cap_conn *conn) 1961 { 1962 kref_put(&conn->ref, l2cap_conn_free); 1963 } 1964 EXPORT_SYMBOL(l2cap_conn_put); 1965 1966 /* ---- Socket interface ---- */ 1967 1968 /* Find socket with psm and source / destination bdaddr. 1969 * Returns closest match. 1970 */ 1971 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, 1972 bdaddr_t *src, 1973 bdaddr_t *dst, 1974 u8 link_type) 1975 { 1976 struct l2cap_chan *c, *tmp, *c1 = NULL; 1977 1978 read_lock(&chan_list_lock); 1979 1980 list_for_each_entry_safe(c, tmp, &chan_list, global_l) { 1981 if (state && c->state != state) 1982 continue; 1983 1984 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR) 1985 continue; 1986 1987 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR) 1988 continue; 1989 1990 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) { 1991 int src_match, dst_match; 1992 int src_any, dst_any; 1993 1994 /* Exact match. */ 1995 src_match = !bacmp(&c->src, src); 1996 dst_match = !bacmp(&c->dst, dst); 1997 if (src_match && dst_match) { 1998 if (!l2cap_chan_hold_unless_zero(c)) 1999 continue; 2000 2001 read_unlock(&chan_list_lock); 2002 return c; 2003 } 2004 2005 /* Closest match */ 2006 src_any = !bacmp(&c->src, BDADDR_ANY); 2007 dst_any = !bacmp(&c->dst, BDADDR_ANY); 2008 if ((src_match && dst_any) || (src_any && dst_match) || 2009 (src_any && dst_any)) 2010 c1 = c; 2011 } 2012 } 2013 2014 if (c1) 2015 c1 = l2cap_chan_hold_unless_zero(c1); 2016 2017 read_unlock(&chan_list_lock); 2018 2019 return c1; 2020 } 2021 2022 static void l2cap_monitor_timeout(struct work_struct *work) 2023 { 2024 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 2025 monitor_timer.work); 2026 2027 BT_DBG("chan %p", chan); 2028 2029 l2cap_chan_lock(chan); 2030 2031 if (!chan->conn) { 2032 l2cap_chan_unlock(chan); 2033 l2cap_chan_put(chan); 2034 return; 2035 } 2036 2037 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO); 2038 2039 l2cap_chan_unlock(chan); 2040 l2cap_chan_put(chan); 2041 } 2042 2043 static void l2cap_retrans_timeout(struct work_struct *work) 2044 { 2045 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 2046 retrans_timer.work); 2047 2048 BT_DBG("chan %p", chan); 2049 2050 l2cap_chan_lock(chan); 2051 2052 if (!chan->conn) { 2053 l2cap_chan_unlock(chan); 2054 l2cap_chan_put(chan); 2055 return; 2056 } 2057 2058 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO); 2059 l2cap_chan_unlock(chan); 2060 l2cap_chan_put(chan); 2061 } 2062 2063 static void l2cap_streaming_send(struct l2cap_chan *chan, 2064 struct sk_buff_head *skbs) 2065 { 2066 struct sk_buff *skb; 2067 struct l2cap_ctrl *control; 2068 2069 BT_DBG("chan %p, skbs %p", chan, skbs); 2070 2071 if (__chan_is_moving(chan)) 2072 return; 2073 2074 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2075 2076 while (!skb_queue_empty(&chan->tx_q)) { 2077 2078 skb = skb_dequeue(&chan->tx_q); 2079 2080 bt_cb(skb)->l2cap.retries = 1; 2081 control = &bt_cb(skb)->l2cap; 2082 2083 control->reqseq = 0; 2084 control->txseq = chan->next_tx_seq; 2085 2086 __pack_control(chan, control, skb); 2087 2088 if (chan->fcs == L2CAP_FCS_CRC16) { 2089 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2090 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2091 } 2092 2093 l2cap_do_send(chan, skb); 2094 2095 BT_DBG("Sent txseq %u", control->txseq); 2096 2097 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2098 chan->frames_sent++; 2099 } 2100 } 2101 2102 static int l2cap_ertm_send(struct l2cap_chan *chan) 2103 { 2104 struct sk_buff *skb, *tx_skb; 2105 struct l2cap_ctrl *control; 2106 int sent = 0; 2107 2108 BT_DBG("chan %p", chan); 2109 2110 if (chan->state != BT_CONNECTED) 2111 return -ENOTCONN; 2112 2113 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2114 return 0; 2115 2116 if (__chan_is_moving(chan)) 2117 return 0; 2118 2119 while (chan->tx_send_head && 2120 chan->unacked_frames < chan->remote_tx_win && 2121 chan->tx_state == L2CAP_TX_STATE_XMIT) { 2122 2123 skb = chan->tx_send_head; 2124 2125 bt_cb(skb)->l2cap.retries = 1; 2126 control = &bt_cb(skb)->l2cap; 2127 2128 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2129 control->final = 1; 2130 2131 control->reqseq = chan->buffer_seq; 2132 chan->last_acked_seq = chan->buffer_seq; 2133 control->txseq = chan->next_tx_seq; 2134 2135 __pack_control(chan, control, skb); 2136 2137 if (chan->fcs == L2CAP_FCS_CRC16) { 2138 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2139 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2140 } 2141 2142 /* Clone after data has been modified. Data is assumed to be 2143 read-only (for locking purposes) on cloned sk_buffs. 2144 */ 2145 tx_skb = skb_clone(skb, GFP_KERNEL); 2146 2147 if (!tx_skb) 2148 break; 2149 2150 __set_retrans_timer(chan); 2151 2152 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2153 chan->unacked_frames++; 2154 chan->frames_sent++; 2155 sent++; 2156 2157 if (skb_queue_is_last(&chan->tx_q, skb)) 2158 chan->tx_send_head = NULL; 2159 else 2160 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 2161 2162 l2cap_do_send(chan, tx_skb); 2163 BT_DBG("Sent txseq %u", control->txseq); 2164 } 2165 2166 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent, 2167 chan->unacked_frames, skb_queue_len(&chan->tx_q)); 2168 2169 return sent; 2170 } 2171 2172 static void l2cap_ertm_resend(struct l2cap_chan *chan) 2173 { 2174 struct l2cap_ctrl control; 2175 struct sk_buff *skb; 2176 struct sk_buff *tx_skb; 2177 u16 seq; 2178 2179 BT_DBG("chan %p", chan); 2180 2181 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2182 return; 2183 2184 if (__chan_is_moving(chan)) 2185 return; 2186 2187 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) { 2188 seq = l2cap_seq_list_pop(&chan->retrans_list); 2189 2190 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq); 2191 if (!skb) { 2192 BT_DBG("Error: Can't retransmit seq %d, frame missing", 2193 seq); 2194 continue; 2195 } 2196 2197 bt_cb(skb)->l2cap.retries++; 2198 control = bt_cb(skb)->l2cap; 2199 2200 if (chan->max_tx != 0 && 2201 bt_cb(skb)->l2cap.retries > chan->max_tx) { 2202 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 2203 l2cap_send_disconn_req(chan, ECONNRESET); 2204 l2cap_seq_list_clear(&chan->retrans_list); 2205 break; 2206 } 2207 2208 control.reqseq = chan->buffer_seq; 2209 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2210 control.final = 1; 2211 else 2212 control.final = 0; 2213 2214 if (skb_cloned(skb)) { 2215 /* Cloned sk_buffs are read-only, so we need a 2216 * writeable copy 2217 */ 2218 tx_skb = skb_copy(skb, GFP_KERNEL); 2219 } else { 2220 tx_skb = skb_clone(skb, GFP_KERNEL); 2221 } 2222 2223 if (!tx_skb) { 2224 l2cap_seq_list_clear(&chan->retrans_list); 2225 break; 2226 } 2227 2228 /* Update skb contents */ 2229 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 2230 put_unaligned_le32(__pack_extended_control(&control), 2231 tx_skb->data + L2CAP_HDR_SIZE); 2232 } else { 2233 put_unaligned_le16(__pack_enhanced_control(&control), 2234 tx_skb->data + L2CAP_HDR_SIZE); 2235 } 2236 2237 /* Update FCS */ 2238 if (chan->fcs == L2CAP_FCS_CRC16) { 2239 u16 fcs = crc16(0, (u8 *) tx_skb->data, 2240 tx_skb->len - L2CAP_FCS_SIZE); 2241 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) - 2242 L2CAP_FCS_SIZE); 2243 } 2244 2245 l2cap_do_send(chan, tx_skb); 2246 2247 BT_DBG("Resent txseq %d", control.txseq); 2248 2249 chan->last_acked_seq = chan->buffer_seq; 2250 } 2251 } 2252 2253 static void l2cap_retransmit(struct l2cap_chan *chan, 2254 struct l2cap_ctrl *control) 2255 { 2256 BT_DBG("chan %p, control %p", chan, control); 2257 2258 l2cap_seq_list_append(&chan->retrans_list, control->reqseq); 2259 l2cap_ertm_resend(chan); 2260 } 2261 2262 static void l2cap_retransmit_all(struct l2cap_chan *chan, 2263 struct l2cap_ctrl *control) 2264 { 2265 struct sk_buff *skb; 2266 2267 BT_DBG("chan %p, control %p", chan, control); 2268 2269 if (control->poll) 2270 set_bit(CONN_SEND_FBIT, &chan->conn_state); 2271 2272 l2cap_seq_list_clear(&chan->retrans_list); 2273 2274 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2275 return; 2276 2277 if (chan->unacked_frames) { 2278 skb_queue_walk(&chan->tx_q, skb) { 2279 if (bt_cb(skb)->l2cap.txseq == control->reqseq || 2280 skb == chan->tx_send_head) 2281 break; 2282 } 2283 2284 skb_queue_walk_from(&chan->tx_q, skb) { 2285 if (skb == chan->tx_send_head) 2286 break; 2287 2288 l2cap_seq_list_append(&chan->retrans_list, 2289 bt_cb(skb)->l2cap.txseq); 2290 } 2291 2292 l2cap_ertm_resend(chan); 2293 } 2294 } 2295 2296 static void l2cap_send_ack(struct l2cap_chan *chan) 2297 { 2298 struct l2cap_ctrl control; 2299 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 2300 chan->last_acked_seq); 2301 int threshold; 2302 2303 BT_DBG("chan %p last_acked_seq %d buffer_seq %d", 2304 chan, chan->last_acked_seq, chan->buffer_seq); 2305 2306 memset(&control, 0, sizeof(control)); 2307 control.sframe = 1; 2308 2309 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 2310 chan->rx_state == L2CAP_RX_STATE_RECV) { 2311 __clear_ack_timer(chan); 2312 control.super = L2CAP_SUPER_RNR; 2313 control.reqseq = chan->buffer_seq; 2314 l2cap_send_sframe(chan, &control); 2315 } else { 2316 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) { 2317 l2cap_ertm_send(chan); 2318 /* If any i-frames were sent, they included an ack */ 2319 if (chan->buffer_seq == chan->last_acked_seq) 2320 frames_to_ack = 0; 2321 } 2322 2323 /* Ack now if the window is 3/4ths full. 2324 * Calculate without mul or div 2325 */ 2326 threshold = chan->ack_win; 2327 threshold += threshold << 1; 2328 threshold >>= 2; 2329 2330 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack, 2331 threshold); 2332 2333 if (frames_to_ack >= threshold) { 2334 __clear_ack_timer(chan); 2335 control.super = L2CAP_SUPER_RR; 2336 control.reqseq = chan->buffer_seq; 2337 l2cap_send_sframe(chan, &control); 2338 frames_to_ack = 0; 2339 } 2340 2341 if (frames_to_ack) 2342 __set_ack_timer(chan); 2343 } 2344 } 2345 2346 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan, 2347 struct msghdr *msg, int len, 2348 int count, struct sk_buff *skb) 2349 { 2350 struct l2cap_conn *conn = chan->conn; 2351 struct sk_buff **frag; 2352 int sent = 0; 2353 2354 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter)) 2355 return -EFAULT; 2356 2357 sent += count; 2358 len -= count; 2359 2360 /* Continuation fragments (no L2CAP header) */ 2361 frag = &skb_shinfo(skb)->frag_list; 2362 while (len) { 2363 struct sk_buff *tmp; 2364 2365 count = min_t(unsigned int, conn->mtu, len); 2366 2367 tmp = chan->ops->alloc_skb(chan, 0, count, 2368 msg->msg_flags & MSG_DONTWAIT); 2369 if (IS_ERR(tmp)) 2370 return PTR_ERR(tmp); 2371 2372 *frag = tmp; 2373 2374 if (!copy_from_iter_full(skb_put(*frag, count), count, 2375 &msg->msg_iter)) 2376 return -EFAULT; 2377 2378 sent += count; 2379 len -= count; 2380 2381 skb->len += (*frag)->len; 2382 skb->data_len += (*frag)->len; 2383 2384 frag = &(*frag)->next; 2385 } 2386 2387 return sent; 2388 } 2389 2390 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, 2391 struct msghdr *msg, size_t len) 2392 { 2393 struct l2cap_conn *conn = chan->conn; 2394 struct sk_buff *skb; 2395 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE; 2396 struct l2cap_hdr *lh; 2397 2398 BT_DBG("chan %p psm 0x%2.2x len %zu", chan, 2399 __le16_to_cpu(chan->psm), len); 2400 2401 count = min_t(unsigned int, (conn->mtu - hlen), len); 2402 2403 skb = chan->ops->alloc_skb(chan, hlen, count, 2404 msg->msg_flags & MSG_DONTWAIT); 2405 if (IS_ERR(skb)) 2406 return skb; 2407 2408 /* Create L2CAP header */ 2409 lh = skb_put(skb, L2CAP_HDR_SIZE); 2410 lh->cid = cpu_to_le16(chan->dcid); 2411 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE); 2412 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE)); 2413 2414 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2415 if (unlikely(err < 0)) { 2416 kfree_skb(skb); 2417 return ERR_PTR(err); 2418 } 2419 return skb; 2420 } 2421 2422 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, 2423 struct msghdr *msg, size_t len) 2424 { 2425 struct l2cap_conn *conn = chan->conn; 2426 struct sk_buff *skb; 2427 int err, count; 2428 struct l2cap_hdr *lh; 2429 2430 BT_DBG("chan %p len %zu", chan, len); 2431 2432 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len); 2433 2434 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count, 2435 msg->msg_flags & MSG_DONTWAIT); 2436 if (IS_ERR(skb)) 2437 return skb; 2438 2439 /* Create L2CAP header */ 2440 lh = skb_put(skb, L2CAP_HDR_SIZE); 2441 lh->cid = cpu_to_le16(chan->dcid); 2442 lh->len = cpu_to_le16(len); 2443 2444 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2445 if (unlikely(err < 0)) { 2446 kfree_skb(skb); 2447 return ERR_PTR(err); 2448 } 2449 return skb; 2450 } 2451 2452 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 2453 struct msghdr *msg, size_t len, 2454 u16 sdulen) 2455 { 2456 struct l2cap_conn *conn = chan->conn; 2457 struct sk_buff *skb; 2458 int err, count, hlen; 2459 struct l2cap_hdr *lh; 2460 2461 BT_DBG("chan %p len %zu", chan, len); 2462 2463 if (!conn) 2464 return ERR_PTR(-ENOTCONN); 2465 2466 hlen = __ertm_hdr_size(chan); 2467 2468 if (sdulen) 2469 hlen += L2CAP_SDULEN_SIZE; 2470 2471 if (chan->fcs == L2CAP_FCS_CRC16) 2472 hlen += L2CAP_FCS_SIZE; 2473 2474 count = min_t(unsigned int, (conn->mtu - hlen), len); 2475 2476 skb = chan->ops->alloc_skb(chan, hlen, count, 2477 msg->msg_flags & MSG_DONTWAIT); 2478 if (IS_ERR(skb)) 2479 return skb; 2480 2481 /* Create L2CAP header */ 2482 lh = skb_put(skb, L2CAP_HDR_SIZE); 2483 lh->cid = cpu_to_le16(chan->dcid); 2484 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2485 2486 /* Control header is populated later */ 2487 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 2488 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 2489 else 2490 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 2491 2492 if (sdulen) 2493 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2494 2495 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2496 if (unlikely(err < 0)) { 2497 kfree_skb(skb); 2498 return ERR_PTR(err); 2499 } 2500 2501 bt_cb(skb)->l2cap.fcs = chan->fcs; 2502 bt_cb(skb)->l2cap.retries = 0; 2503 return skb; 2504 } 2505 2506 static int l2cap_segment_sdu(struct l2cap_chan *chan, 2507 struct sk_buff_head *seg_queue, 2508 struct msghdr *msg, size_t len) 2509 { 2510 struct sk_buff *skb; 2511 u16 sdu_len; 2512 size_t pdu_len; 2513 u8 sar; 2514 2515 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2516 2517 /* It is critical that ERTM PDUs fit in a single HCI fragment, 2518 * so fragmented skbs are not used. The HCI layer's handling 2519 * of fragmented skbs is not compatible with ERTM's queueing. 2520 */ 2521 2522 /* PDU size is derived from the HCI MTU */ 2523 pdu_len = chan->conn->mtu; 2524 2525 /* Constrain PDU size for BR/EDR connections */ 2526 if (!chan->hs_hcon) 2527 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); 2528 2529 /* Adjust for largest possible L2CAP overhead. */ 2530 if (chan->fcs) 2531 pdu_len -= L2CAP_FCS_SIZE; 2532 2533 pdu_len -= __ertm_hdr_size(chan); 2534 2535 /* Remote device may have requested smaller PDUs */ 2536 pdu_len = min_t(size_t, pdu_len, chan->remote_mps); 2537 2538 if (len <= pdu_len) { 2539 sar = L2CAP_SAR_UNSEGMENTED; 2540 sdu_len = 0; 2541 pdu_len = len; 2542 } else { 2543 sar = L2CAP_SAR_START; 2544 sdu_len = len; 2545 } 2546 2547 while (len > 0) { 2548 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len); 2549 2550 if (IS_ERR(skb)) { 2551 __skb_queue_purge(seg_queue); 2552 return PTR_ERR(skb); 2553 } 2554 2555 bt_cb(skb)->l2cap.sar = sar; 2556 __skb_queue_tail(seg_queue, skb); 2557 2558 len -= pdu_len; 2559 if (sdu_len) 2560 sdu_len = 0; 2561 2562 if (len <= pdu_len) { 2563 sar = L2CAP_SAR_END; 2564 pdu_len = len; 2565 } else { 2566 sar = L2CAP_SAR_CONTINUE; 2567 } 2568 } 2569 2570 return 0; 2571 } 2572 2573 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan, 2574 struct msghdr *msg, 2575 size_t len, u16 sdulen) 2576 { 2577 struct l2cap_conn *conn = chan->conn; 2578 struct sk_buff *skb; 2579 int err, count, hlen; 2580 struct l2cap_hdr *lh; 2581 2582 BT_DBG("chan %p len %zu", chan, len); 2583 2584 if (!conn) 2585 return ERR_PTR(-ENOTCONN); 2586 2587 hlen = L2CAP_HDR_SIZE; 2588 2589 if (sdulen) 2590 hlen += L2CAP_SDULEN_SIZE; 2591 2592 count = min_t(unsigned int, (conn->mtu - hlen), len); 2593 2594 skb = chan->ops->alloc_skb(chan, hlen, count, 2595 msg->msg_flags & MSG_DONTWAIT); 2596 if (IS_ERR(skb)) 2597 return skb; 2598 2599 /* Create L2CAP header */ 2600 lh = skb_put(skb, L2CAP_HDR_SIZE); 2601 lh->cid = cpu_to_le16(chan->dcid); 2602 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2603 2604 if (sdulen) 2605 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2606 2607 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2608 if (unlikely(err < 0)) { 2609 kfree_skb(skb); 2610 return ERR_PTR(err); 2611 } 2612 2613 return skb; 2614 } 2615 2616 static int l2cap_segment_le_sdu(struct l2cap_chan *chan, 2617 struct sk_buff_head *seg_queue, 2618 struct msghdr *msg, size_t len) 2619 { 2620 struct sk_buff *skb; 2621 size_t pdu_len; 2622 u16 sdu_len; 2623 2624 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2625 2626 sdu_len = len; 2627 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE; 2628 2629 while (len > 0) { 2630 if (len <= pdu_len) 2631 pdu_len = len; 2632 2633 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len); 2634 if (IS_ERR(skb)) { 2635 __skb_queue_purge(seg_queue); 2636 return PTR_ERR(skb); 2637 } 2638 2639 __skb_queue_tail(seg_queue, skb); 2640 2641 len -= pdu_len; 2642 2643 if (sdu_len) { 2644 sdu_len = 0; 2645 pdu_len += L2CAP_SDULEN_SIZE; 2646 } 2647 } 2648 2649 return 0; 2650 } 2651 2652 static void l2cap_le_flowctl_send(struct l2cap_chan *chan) 2653 { 2654 int sent = 0; 2655 2656 BT_DBG("chan %p", chan); 2657 2658 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) { 2659 l2cap_do_send(chan, skb_dequeue(&chan->tx_q)); 2660 chan->tx_credits--; 2661 sent++; 2662 } 2663 2664 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits, 2665 skb_queue_len(&chan->tx_q)); 2666 } 2667 2668 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 2669 { 2670 struct sk_buff *skb; 2671 int err; 2672 struct sk_buff_head seg_queue; 2673 2674 if (!chan->conn) 2675 return -ENOTCONN; 2676 2677 /* Connectionless channel */ 2678 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 2679 skb = l2cap_create_connless_pdu(chan, msg, len); 2680 if (IS_ERR(skb)) 2681 return PTR_ERR(skb); 2682 2683 l2cap_do_send(chan, skb); 2684 return len; 2685 } 2686 2687 switch (chan->mode) { 2688 case L2CAP_MODE_LE_FLOWCTL: 2689 case L2CAP_MODE_EXT_FLOWCTL: 2690 /* Check outgoing MTU */ 2691 if (len > chan->omtu) 2692 return -EMSGSIZE; 2693 2694 __skb_queue_head_init(&seg_queue); 2695 2696 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len); 2697 2698 if (chan->state != BT_CONNECTED) { 2699 __skb_queue_purge(&seg_queue); 2700 err = -ENOTCONN; 2701 } 2702 2703 if (err) 2704 return err; 2705 2706 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q); 2707 2708 l2cap_le_flowctl_send(chan); 2709 2710 if (!chan->tx_credits) 2711 chan->ops->suspend(chan); 2712 2713 err = len; 2714 2715 break; 2716 2717 case L2CAP_MODE_BASIC: 2718 /* Check outgoing MTU */ 2719 if (len > chan->omtu) 2720 return -EMSGSIZE; 2721 2722 /* Create a basic PDU */ 2723 skb = l2cap_create_basic_pdu(chan, msg, len); 2724 if (IS_ERR(skb)) 2725 return PTR_ERR(skb); 2726 2727 l2cap_do_send(chan, skb); 2728 err = len; 2729 break; 2730 2731 case L2CAP_MODE_ERTM: 2732 case L2CAP_MODE_STREAMING: 2733 /* Check outgoing MTU */ 2734 if (len > chan->omtu) { 2735 err = -EMSGSIZE; 2736 break; 2737 } 2738 2739 __skb_queue_head_init(&seg_queue); 2740 2741 /* Do segmentation before calling in to the state machine, 2742 * since it's possible to block while waiting for memory 2743 * allocation. 2744 */ 2745 err = l2cap_segment_sdu(chan, &seg_queue, msg, len); 2746 2747 if (err) 2748 break; 2749 2750 if (chan->mode == L2CAP_MODE_ERTM) 2751 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST); 2752 else 2753 l2cap_streaming_send(chan, &seg_queue); 2754 2755 err = len; 2756 2757 /* If the skbs were not queued for sending, they'll still be in 2758 * seg_queue and need to be purged. 2759 */ 2760 __skb_queue_purge(&seg_queue); 2761 break; 2762 2763 default: 2764 BT_DBG("bad state %1.1x", chan->mode); 2765 err = -EBADFD; 2766 } 2767 2768 return err; 2769 } 2770 EXPORT_SYMBOL_GPL(l2cap_chan_send); 2771 2772 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq) 2773 { 2774 struct l2cap_ctrl control; 2775 u16 seq; 2776 2777 BT_DBG("chan %p, txseq %u", chan, txseq); 2778 2779 memset(&control, 0, sizeof(control)); 2780 control.sframe = 1; 2781 control.super = L2CAP_SUPER_SREJ; 2782 2783 for (seq = chan->expected_tx_seq; seq != txseq; 2784 seq = __next_seq(chan, seq)) { 2785 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) { 2786 control.reqseq = seq; 2787 l2cap_send_sframe(chan, &control); 2788 l2cap_seq_list_append(&chan->srej_list, seq); 2789 } 2790 } 2791 2792 chan->expected_tx_seq = __next_seq(chan, txseq); 2793 } 2794 2795 static void l2cap_send_srej_tail(struct l2cap_chan *chan) 2796 { 2797 struct l2cap_ctrl control; 2798 2799 BT_DBG("chan %p", chan); 2800 2801 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR) 2802 return; 2803 2804 memset(&control, 0, sizeof(control)); 2805 control.sframe = 1; 2806 control.super = L2CAP_SUPER_SREJ; 2807 control.reqseq = chan->srej_list.tail; 2808 l2cap_send_sframe(chan, &control); 2809 } 2810 2811 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq) 2812 { 2813 struct l2cap_ctrl control; 2814 u16 initial_head; 2815 u16 seq; 2816 2817 BT_DBG("chan %p, txseq %u", chan, txseq); 2818 2819 memset(&control, 0, sizeof(control)); 2820 control.sframe = 1; 2821 control.super = L2CAP_SUPER_SREJ; 2822 2823 /* Capture initial list head to allow only one pass through the list. */ 2824 initial_head = chan->srej_list.head; 2825 2826 do { 2827 seq = l2cap_seq_list_pop(&chan->srej_list); 2828 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR) 2829 break; 2830 2831 control.reqseq = seq; 2832 l2cap_send_sframe(chan, &control); 2833 l2cap_seq_list_append(&chan->srej_list, seq); 2834 } while (chan->srej_list.head != initial_head); 2835 } 2836 2837 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq) 2838 { 2839 struct sk_buff *acked_skb; 2840 u16 ackseq; 2841 2842 BT_DBG("chan %p, reqseq %u", chan, reqseq); 2843 2844 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq) 2845 return; 2846 2847 BT_DBG("expected_ack_seq %u, unacked_frames %u", 2848 chan->expected_ack_seq, chan->unacked_frames); 2849 2850 for (ackseq = chan->expected_ack_seq; ackseq != reqseq; 2851 ackseq = __next_seq(chan, ackseq)) { 2852 2853 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq); 2854 if (acked_skb) { 2855 skb_unlink(acked_skb, &chan->tx_q); 2856 kfree_skb(acked_skb); 2857 chan->unacked_frames--; 2858 } 2859 } 2860 2861 chan->expected_ack_seq = reqseq; 2862 2863 if (chan->unacked_frames == 0) 2864 __clear_retrans_timer(chan); 2865 2866 BT_DBG("unacked_frames %u", chan->unacked_frames); 2867 } 2868 2869 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan) 2870 { 2871 BT_DBG("chan %p", chan); 2872 2873 chan->expected_tx_seq = chan->buffer_seq; 2874 l2cap_seq_list_clear(&chan->srej_list); 2875 skb_queue_purge(&chan->srej_q); 2876 chan->rx_state = L2CAP_RX_STATE_RECV; 2877 } 2878 2879 static void l2cap_tx_state_xmit(struct l2cap_chan *chan, 2880 struct l2cap_ctrl *control, 2881 struct sk_buff_head *skbs, u8 event) 2882 { 2883 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2884 event); 2885 2886 switch (event) { 2887 case L2CAP_EV_DATA_REQUEST: 2888 if (chan->tx_send_head == NULL) 2889 chan->tx_send_head = skb_peek(skbs); 2890 2891 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2892 l2cap_ertm_send(chan); 2893 break; 2894 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2895 BT_DBG("Enter LOCAL_BUSY"); 2896 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2897 2898 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2899 /* The SREJ_SENT state must be aborted if we are to 2900 * enter the LOCAL_BUSY state. 2901 */ 2902 l2cap_abort_rx_srej_sent(chan); 2903 } 2904 2905 l2cap_send_ack(chan); 2906 2907 break; 2908 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2909 BT_DBG("Exit LOCAL_BUSY"); 2910 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2911 2912 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2913 struct l2cap_ctrl local_control; 2914 2915 memset(&local_control, 0, sizeof(local_control)); 2916 local_control.sframe = 1; 2917 local_control.super = L2CAP_SUPER_RR; 2918 local_control.poll = 1; 2919 local_control.reqseq = chan->buffer_seq; 2920 l2cap_send_sframe(chan, &local_control); 2921 2922 chan->retry_count = 1; 2923 __set_monitor_timer(chan); 2924 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2925 } 2926 break; 2927 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2928 l2cap_process_reqseq(chan, control->reqseq); 2929 break; 2930 case L2CAP_EV_EXPLICIT_POLL: 2931 l2cap_send_rr_or_rnr(chan, 1); 2932 chan->retry_count = 1; 2933 __set_monitor_timer(chan); 2934 __clear_ack_timer(chan); 2935 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2936 break; 2937 case L2CAP_EV_RETRANS_TO: 2938 l2cap_send_rr_or_rnr(chan, 1); 2939 chan->retry_count = 1; 2940 __set_monitor_timer(chan); 2941 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2942 break; 2943 case L2CAP_EV_RECV_FBIT: 2944 /* Nothing to process */ 2945 break; 2946 default: 2947 break; 2948 } 2949 } 2950 2951 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan, 2952 struct l2cap_ctrl *control, 2953 struct sk_buff_head *skbs, u8 event) 2954 { 2955 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2956 event); 2957 2958 switch (event) { 2959 case L2CAP_EV_DATA_REQUEST: 2960 if (chan->tx_send_head == NULL) 2961 chan->tx_send_head = skb_peek(skbs); 2962 /* Queue data, but don't send. */ 2963 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2964 break; 2965 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2966 BT_DBG("Enter LOCAL_BUSY"); 2967 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2968 2969 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2970 /* The SREJ_SENT state must be aborted if we are to 2971 * enter the LOCAL_BUSY state. 2972 */ 2973 l2cap_abort_rx_srej_sent(chan); 2974 } 2975 2976 l2cap_send_ack(chan); 2977 2978 break; 2979 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2980 BT_DBG("Exit LOCAL_BUSY"); 2981 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2982 2983 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2984 struct l2cap_ctrl local_control; 2985 memset(&local_control, 0, sizeof(local_control)); 2986 local_control.sframe = 1; 2987 local_control.super = L2CAP_SUPER_RR; 2988 local_control.poll = 1; 2989 local_control.reqseq = chan->buffer_seq; 2990 l2cap_send_sframe(chan, &local_control); 2991 2992 chan->retry_count = 1; 2993 __set_monitor_timer(chan); 2994 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2995 } 2996 break; 2997 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2998 l2cap_process_reqseq(chan, control->reqseq); 2999 fallthrough; 3000 3001 case L2CAP_EV_RECV_FBIT: 3002 if (control && control->final) { 3003 __clear_monitor_timer(chan); 3004 if (chan->unacked_frames > 0) 3005 __set_retrans_timer(chan); 3006 chan->retry_count = 0; 3007 chan->tx_state = L2CAP_TX_STATE_XMIT; 3008 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state); 3009 } 3010 break; 3011 case L2CAP_EV_EXPLICIT_POLL: 3012 /* Ignore */ 3013 break; 3014 case L2CAP_EV_MONITOR_TO: 3015 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) { 3016 l2cap_send_rr_or_rnr(chan, 1); 3017 __set_monitor_timer(chan); 3018 chan->retry_count++; 3019 } else { 3020 l2cap_send_disconn_req(chan, ECONNABORTED); 3021 } 3022 break; 3023 default: 3024 break; 3025 } 3026 } 3027 3028 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 3029 struct sk_buff_head *skbs, u8 event) 3030 { 3031 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d", 3032 chan, control, skbs, event, chan->tx_state); 3033 3034 switch (chan->tx_state) { 3035 case L2CAP_TX_STATE_XMIT: 3036 l2cap_tx_state_xmit(chan, control, skbs, event); 3037 break; 3038 case L2CAP_TX_STATE_WAIT_F: 3039 l2cap_tx_state_wait_f(chan, control, skbs, event); 3040 break; 3041 default: 3042 /* Ignore event */ 3043 break; 3044 } 3045 } 3046 3047 static void l2cap_pass_to_tx(struct l2cap_chan *chan, 3048 struct l2cap_ctrl *control) 3049 { 3050 BT_DBG("chan %p, control %p", chan, control); 3051 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT); 3052 } 3053 3054 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan, 3055 struct l2cap_ctrl *control) 3056 { 3057 BT_DBG("chan %p, control %p", chan, control); 3058 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT); 3059 } 3060 3061 /* Copy frame to all raw sockets on that connection */ 3062 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 3063 { 3064 struct sk_buff *nskb; 3065 struct l2cap_chan *chan; 3066 3067 BT_DBG("conn %p", conn); 3068 3069 mutex_lock(&conn->chan_lock); 3070 3071 list_for_each_entry(chan, &conn->chan_l, list) { 3072 if (chan->chan_type != L2CAP_CHAN_RAW) 3073 continue; 3074 3075 /* Don't send frame to the channel it came from */ 3076 if (bt_cb(skb)->l2cap.chan == chan) 3077 continue; 3078 3079 nskb = skb_clone(skb, GFP_KERNEL); 3080 if (!nskb) 3081 continue; 3082 if (chan->ops->recv(chan, nskb)) 3083 kfree_skb(nskb); 3084 } 3085 3086 mutex_unlock(&conn->chan_lock); 3087 } 3088 3089 /* ---- L2CAP signalling commands ---- */ 3090 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code, 3091 u8 ident, u16 dlen, void *data) 3092 { 3093 struct sk_buff *skb, **frag; 3094 struct l2cap_cmd_hdr *cmd; 3095 struct l2cap_hdr *lh; 3096 int len, count; 3097 3098 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u", 3099 conn, code, ident, dlen); 3100 3101 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) 3102 return NULL; 3103 3104 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 3105 count = min_t(unsigned int, conn->mtu, len); 3106 3107 skb = bt_skb_alloc(count, GFP_KERNEL); 3108 if (!skb) 3109 return NULL; 3110 3111 lh = skb_put(skb, L2CAP_HDR_SIZE); 3112 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 3113 3114 if (conn->hcon->type == LE_LINK) 3115 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 3116 else 3117 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 3118 3119 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE); 3120 cmd->code = code; 3121 cmd->ident = ident; 3122 cmd->len = cpu_to_le16(dlen); 3123 3124 if (dlen) { 3125 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 3126 skb_put_data(skb, data, count); 3127 data += count; 3128 } 3129 3130 len -= skb->len; 3131 3132 /* Continuation fragments (no L2CAP header) */ 3133 frag = &skb_shinfo(skb)->frag_list; 3134 while (len) { 3135 count = min_t(unsigned int, conn->mtu, len); 3136 3137 *frag = bt_skb_alloc(count, GFP_KERNEL); 3138 if (!*frag) 3139 goto fail; 3140 3141 skb_put_data(*frag, data, count); 3142 3143 len -= count; 3144 data += count; 3145 3146 frag = &(*frag)->next; 3147 } 3148 3149 return skb; 3150 3151 fail: 3152 kfree_skb(skb); 3153 return NULL; 3154 } 3155 3156 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, 3157 unsigned long *val) 3158 { 3159 struct l2cap_conf_opt *opt = *ptr; 3160 int len; 3161 3162 len = L2CAP_CONF_OPT_SIZE + opt->len; 3163 *ptr += len; 3164 3165 *type = opt->type; 3166 *olen = opt->len; 3167 3168 switch (opt->len) { 3169 case 1: 3170 *val = *((u8 *) opt->val); 3171 break; 3172 3173 case 2: 3174 *val = get_unaligned_le16(opt->val); 3175 break; 3176 3177 case 4: 3178 *val = get_unaligned_le32(opt->val); 3179 break; 3180 3181 default: 3182 *val = (unsigned long) opt->val; 3183 break; 3184 } 3185 3186 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val); 3187 return len; 3188 } 3189 3190 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) 3191 { 3192 struct l2cap_conf_opt *opt = *ptr; 3193 3194 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); 3195 3196 if (size < L2CAP_CONF_OPT_SIZE + len) 3197 return; 3198 3199 opt->type = type; 3200 opt->len = len; 3201 3202 switch (len) { 3203 case 1: 3204 *((u8 *) opt->val) = val; 3205 break; 3206 3207 case 2: 3208 put_unaligned_le16(val, opt->val); 3209 break; 3210 3211 case 4: 3212 put_unaligned_le32(val, opt->val); 3213 break; 3214 3215 default: 3216 memcpy(opt->val, (void *) val, len); 3217 break; 3218 } 3219 3220 *ptr += L2CAP_CONF_OPT_SIZE + len; 3221 } 3222 3223 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) 3224 { 3225 struct l2cap_conf_efs efs; 3226 3227 switch (chan->mode) { 3228 case L2CAP_MODE_ERTM: 3229 efs.id = chan->local_id; 3230 efs.stype = chan->local_stype; 3231 efs.msdu = cpu_to_le16(chan->local_msdu); 3232 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3233 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT); 3234 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO); 3235 break; 3236 3237 case L2CAP_MODE_STREAMING: 3238 efs.id = 1; 3239 efs.stype = L2CAP_SERV_BESTEFFORT; 3240 efs.msdu = cpu_to_le16(chan->local_msdu); 3241 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3242 efs.acc_lat = 0; 3243 efs.flush_to = 0; 3244 break; 3245 3246 default: 3247 return; 3248 } 3249 3250 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), 3251 (unsigned long) &efs, size); 3252 } 3253 3254 static void l2cap_ack_timeout(struct work_struct *work) 3255 { 3256 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 3257 ack_timer.work); 3258 u16 frames_to_ack; 3259 3260 BT_DBG("chan %p", chan); 3261 3262 l2cap_chan_lock(chan); 3263 3264 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 3265 chan->last_acked_seq); 3266 3267 if (frames_to_ack) 3268 l2cap_send_rr_or_rnr(chan, 0); 3269 3270 l2cap_chan_unlock(chan); 3271 l2cap_chan_put(chan); 3272 } 3273 3274 int l2cap_ertm_init(struct l2cap_chan *chan) 3275 { 3276 int err; 3277 3278 chan->next_tx_seq = 0; 3279 chan->expected_tx_seq = 0; 3280 chan->expected_ack_seq = 0; 3281 chan->unacked_frames = 0; 3282 chan->buffer_seq = 0; 3283 chan->frames_sent = 0; 3284 chan->last_acked_seq = 0; 3285 chan->sdu = NULL; 3286 chan->sdu_last_frag = NULL; 3287 chan->sdu_len = 0; 3288 3289 skb_queue_head_init(&chan->tx_q); 3290 3291 chan->local_amp_id = AMP_ID_BREDR; 3292 chan->move_id = AMP_ID_BREDR; 3293 chan->move_state = L2CAP_MOVE_STABLE; 3294 chan->move_role = L2CAP_MOVE_ROLE_NONE; 3295 3296 if (chan->mode != L2CAP_MODE_ERTM) 3297 return 0; 3298 3299 chan->rx_state = L2CAP_RX_STATE_RECV; 3300 chan->tx_state = L2CAP_TX_STATE_XMIT; 3301 3302 skb_queue_head_init(&chan->srej_q); 3303 3304 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win); 3305 if (err < 0) 3306 return err; 3307 3308 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); 3309 if (err < 0) 3310 l2cap_seq_list_free(&chan->srej_list); 3311 3312 return err; 3313 } 3314 3315 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 3316 { 3317 switch (mode) { 3318 case L2CAP_MODE_STREAMING: 3319 case L2CAP_MODE_ERTM: 3320 if (l2cap_mode_supported(mode, remote_feat_mask)) 3321 return mode; 3322 fallthrough; 3323 default: 3324 return L2CAP_MODE_BASIC; 3325 } 3326 } 3327 3328 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn) 3329 { 3330 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) && 3331 (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW)); 3332 } 3333 3334 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn) 3335 { 3336 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) && 3337 (conn->feat_mask & L2CAP_FEAT_EXT_FLOW)); 3338 } 3339 3340 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan, 3341 struct l2cap_conf_rfc *rfc) 3342 { 3343 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) { 3344 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to; 3345 3346 /* Class 1 devices have must have ERTM timeouts 3347 * exceeding the Link Supervision Timeout. The 3348 * default Link Supervision Timeout for AMP 3349 * controllers is 10 seconds. 3350 * 3351 * Class 1 devices use 0xffffffff for their 3352 * best-effort flush timeout, so the clamping logic 3353 * will result in a timeout that meets the above 3354 * requirement. ERTM timeouts are 16-bit values, so 3355 * the maximum timeout is 65.535 seconds. 3356 */ 3357 3358 /* Convert timeout to milliseconds and round */ 3359 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000); 3360 3361 /* This is the recommended formula for class 2 devices 3362 * that start ERTM timers when packets are sent to the 3363 * controller. 3364 */ 3365 ertm_to = 3 * ertm_to + 500; 3366 3367 if (ertm_to > 0xffff) 3368 ertm_to = 0xffff; 3369 3370 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to); 3371 rfc->monitor_timeout = rfc->retrans_timeout; 3372 } else { 3373 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 3374 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 3375 } 3376 } 3377 3378 static inline void l2cap_txwin_setup(struct l2cap_chan *chan) 3379 { 3380 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW && 3381 __l2cap_ews_supported(chan->conn)) { 3382 /* use extended control field */ 3383 set_bit(FLAG_EXT_CTRL, &chan->flags); 3384 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3385 } else { 3386 chan->tx_win = min_t(u16, chan->tx_win, 3387 L2CAP_DEFAULT_TX_WINDOW); 3388 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 3389 } 3390 chan->ack_win = chan->tx_win; 3391 } 3392 3393 static void l2cap_mtu_auto(struct l2cap_chan *chan) 3394 { 3395 struct hci_conn *conn = chan->conn->hcon; 3396 3397 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3398 3399 /* The 2-DH1 packet has between 2 and 56 information bytes 3400 * (including the 2-byte payload header) 3401 */ 3402 if (!(conn->pkt_type & HCI_2DH1)) 3403 chan->imtu = 54; 3404 3405 /* The 3-DH1 packet has between 2 and 85 information bytes 3406 * (including the 2-byte payload header) 3407 */ 3408 if (!(conn->pkt_type & HCI_3DH1)) 3409 chan->imtu = 83; 3410 3411 /* The 2-DH3 packet has between 2 and 369 information bytes 3412 * (including the 2-byte payload header) 3413 */ 3414 if (!(conn->pkt_type & HCI_2DH3)) 3415 chan->imtu = 367; 3416 3417 /* The 3-DH3 packet has between 2 and 554 information bytes 3418 * (including the 2-byte payload header) 3419 */ 3420 if (!(conn->pkt_type & HCI_3DH3)) 3421 chan->imtu = 552; 3422 3423 /* The 2-DH5 packet has between 2 and 681 information bytes 3424 * (including the 2-byte payload header) 3425 */ 3426 if (!(conn->pkt_type & HCI_2DH5)) 3427 chan->imtu = 679; 3428 3429 /* The 3-DH5 packet has between 2 and 1023 information bytes 3430 * (including the 2-byte payload header) 3431 */ 3432 if (!(conn->pkt_type & HCI_3DH5)) 3433 chan->imtu = 1021; 3434 } 3435 3436 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3437 { 3438 struct l2cap_conf_req *req = data; 3439 struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 3440 void *ptr = req->data; 3441 void *endptr = data + data_size; 3442 u16 size; 3443 3444 BT_DBG("chan %p", chan); 3445 3446 if (chan->num_conf_req || chan->num_conf_rsp) 3447 goto done; 3448 3449 switch (chan->mode) { 3450 case L2CAP_MODE_STREAMING: 3451 case L2CAP_MODE_ERTM: 3452 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 3453 break; 3454 3455 if (__l2cap_efs_supported(chan->conn)) 3456 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3457 3458 fallthrough; 3459 default: 3460 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 3461 break; 3462 } 3463 3464 done: 3465 if (chan->imtu != L2CAP_DEFAULT_MTU) { 3466 if (!chan->imtu) 3467 l2cap_mtu_auto(chan); 3468 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3469 endptr - ptr); 3470 } 3471 3472 switch (chan->mode) { 3473 case L2CAP_MODE_BASIC: 3474 if (disable_ertm) 3475 break; 3476 3477 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 3478 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 3479 break; 3480 3481 rfc.mode = L2CAP_MODE_BASIC; 3482 rfc.txwin_size = 0; 3483 rfc.max_transmit = 0; 3484 rfc.retrans_timeout = 0; 3485 rfc.monitor_timeout = 0; 3486 rfc.max_pdu_size = 0; 3487 3488 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3489 (unsigned long) &rfc, endptr - ptr); 3490 break; 3491 3492 case L2CAP_MODE_ERTM: 3493 rfc.mode = L2CAP_MODE_ERTM; 3494 rfc.max_transmit = chan->max_tx; 3495 3496 __l2cap_set_ertm_timeouts(chan, &rfc); 3497 3498 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3499 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3500 L2CAP_FCS_SIZE); 3501 rfc.max_pdu_size = cpu_to_le16(size); 3502 3503 l2cap_txwin_setup(chan); 3504 3505 rfc.txwin_size = min_t(u16, chan->tx_win, 3506 L2CAP_DEFAULT_TX_WINDOW); 3507 3508 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3509 (unsigned long) &rfc, endptr - ptr); 3510 3511 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3512 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3513 3514 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 3515 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3516 chan->tx_win, endptr - ptr); 3517 3518 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3519 if (chan->fcs == L2CAP_FCS_NONE || 3520 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3521 chan->fcs = L2CAP_FCS_NONE; 3522 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3523 chan->fcs, endptr - ptr); 3524 } 3525 break; 3526 3527 case L2CAP_MODE_STREAMING: 3528 l2cap_txwin_setup(chan); 3529 rfc.mode = L2CAP_MODE_STREAMING; 3530 rfc.txwin_size = 0; 3531 rfc.max_transmit = 0; 3532 rfc.retrans_timeout = 0; 3533 rfc.monitor_timeout = 0; 3534 3535 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3536 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3537 L2CAP_FCS_SIZE); 3538 rfc.max_pdu_size = cpu_to_le16(size); 3539 3540 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3541 (unsigned long) &rfc, endptr - ptr); 3542 3543 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3544 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3545 3546 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3547 if (chan->fcs == L2CAP_FCS_NONE || 3548 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3549 chan->fcs = L2CAP_FCS_NONE; 3550 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3551 chan->fcs, endptr - ptr); 3552 } 3553 break; 3554 } 3555 3556 req->dcid = cpu_to_le16(chan->dcid); 3557 req->flags = cpu_to_le16(0); 3558 3559 return ptr - data; 3560 } 3561 3562 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3563 { 3564 struct l2cap_conf_rsp *rsp = data; 3565 void *ptr = rsp->data; 3566 void *endptr = data + data_size; 3567 void *req = chan->conf_req; 3568 int len = chan->conf_len; 3569 int type, hint, olen; 3570 unsigned long val; 3571 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3572 struct l2cap_conf_efs efs; 3573 u8 remote_efs = 0; 3574 u16 mtu = L2CAP_DEFAULT_MTU; 3575 u16 result = L2CAP_CONF_SUCCESS; 3576 u16 size; 3577 3578 BT_DBG("chan %p", chan); 3579 3580 while (len >= L2CAP_CONF_OPT_SIZE) { 3581 len -= l2cap_get_conf_opt(&req, &type, &olen, &val); 3582 if (len < 0) 3583 break; 3584 3585 hint = type & L2CAP_CONF_HINT; 3586 type &= L2CAP_CONF_MASK; 3587 3588 switch (type) { 3589 case L2CAP_CONF_MTU: 3590 if (olen != 2) 3591 break; 3592 mtu = val; 3593 break; 3594 3595 case L2CAP_CONF_FLUSH_TO: 3596 if (olen != 2) 3597 break; 3598 chan->flush_to = val; 3599 break; 3600 3601 case L2CAP_CONF_QOS: 3602 break; 3603 3604 case L2CAP_CONF_RFC: 3605 if (olen != sizeof(rfc)) 3606 break; 3607 memcpy(&rfc, (void *) val, olen); 3608 break; 3609 3610 case L2CAP_CONF_FCS: 3611 if (olen != 1) 3612 break; 3613 if (val == L2CAP_FCS_NONE) 3614 set_bit(CONF_RECV_NO_FCS, &chan->conf_state); 3615 break; 3616 3617 case L2CAP_CONF_EFS: 3618 if (olen != sizeof(efs)) 3619 break; 3620 remote_efs = 1; 3621 memcpy(&efs, (void *) val, olen); 3622 break; 3623 3624 case L2CAP_CONF_EWS: 3625 if (olen != 2) 3626 break; 3627 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) 3628 return -ECONNREFUSED; 3629 set_bit(FLAG_EXT_CTRL, &chan->flags); 3630 set_bit(CONF_EWS_RECV, &chan->conf_state); 3631 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3632 chan->remote_tx_win = val; 3633 break; 3634 3635 default: 3636 if (hint) 3637 break; 3638 result = L2CAP_CONF_UNKNOWN; 3639 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr); 3640 break; 3641 } 3642 } 3643 3644 if (chan->num_conf_rsp || chan->num_conf_req > 1) 3645 goto done; 3646 3647 switch (chan->mode) { 3648 case L2CAP_MODE_STREAMING: 3649 case L2CAP_MODE_ERTM: 3650 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 3651 chan->mode = l2cap_select_mode(rfc.mode, 3652 chan->conn->feat_mask); 3653 break; 3654 } 3655 3656 if (remote_efs) { 3657 if (__l2cap_efs_supported(chan->conn)) 3658 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3659 else 3660 return -ECONNREFUSED; 3661 } 3662 3663 if (chan->mode != rfc.mode) 3664 return -ECONNREFUSED; 3665 3666 break; 3667 } 3668 3669 done: 3670 if (chan->mode != rfc.mode) { 3671 result = L2CAP_CONF_UNACCEPT; 3672 rfc.mode = chan->mode; 3673 3674 if (chan->num_conf_rsp == 1) 3675 return -ECONNREFUSED; 3676 3677 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3678 (unsigned long) &rfc, endptr - ptr); 3679 } 3680 3681 if (result == L2CAP_CONF_SUCCESS) { 3682 /* Configure output options and let the other side know 3683 * which ones we don't like. */ 3684 3685 if (mtu < L2CAP_DEFAULT_MIN_MTU) 3686 result = L2CAP_CONF_UNACCEPT; 3687 else { 3688 chan->omtu = mtu; 3689 set_bit(CONF_MTU_DONE, &chan->conf_state); 3690 } 3691 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); 3692 3693 if (remote_efs) { 3694 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3695 efs.stype != L2CAP_SERV_NOTRAFIC && 3696 efs.stype != chan->local_stype) { 3697 3698 result = L2CAP_CONF_UNACCEPT; 3699 3700 if (chan->num_conf_req >= 1) 3701 return -ECONNREFUSED; 3702 3703 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3704 sizeof(efs), 3705 (unsigned long) &efs, endptr - ptr); 3706 } else { 3707 /* Send PENDING Conf Rsp */ 3708 result = L2CAP_CONF_PENDING; 3709 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 3710 } 3711 } 3712 3713 switch (rfc.mode) { 3714 case L2CAP_MODE_BASIC: 3715 chan->fcs = L2CAP_FCS_NONE; 3716 set_bit(CONF_MODE_DONE, &chan->conf_state); 3717 break; 3718 3719 case L2CAP_MODE_ERTM: 3720 if (!test_bit(CONF_EWS_RECV, &chan->conf_state)) 3721 chan->remote_tx_win = rfc.txwin_size; 3722 else 3723 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 3724 3725 chan->remote_max_tx = rfc.max_transmit; 3726 3727 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3728 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3729 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3730 rfc.max_pdu_size = cpu_to_le16(size); 3731 chan->remote_mps = size; 3732 3733 __l2cap_set_ertm_timeouts(chan, &rfc); 3734 3735 set_bit(CONF_MODE_DONE, &chan->conf_state); 3736 3737 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 3738 sizeof(rfc), (unsigned long) &rfc, endptr - ptr); 3739 3740 if (remote_efs && 3741 test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3742 chan->remote_id = efs.id; 3743 chan->remote_stype = efs.stype; 3744 chan->remote_msdu = le16_to_cpu(efs.msdu); 3745 chan->remote_flush_to = 3746 le32_to_cpu(efs.flush_to); 3747 chan->remote_acc_lat = 3748 le32_to_cpu(efs.acc_lat); 3749 chan->remote_sdu_itime = 3750 le32_to_cpu(efs.sdu_itime); 3751 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3752 sizeof(efs), 3753 (unsigned long) &efs, endptr - ptr); 3754 } 3755 break; 3756 3757 case L2CAP_MODE_STREAMING: 3758 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3759 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3760 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3761 rfc.max_pdu_size = cpu_to_le16(size); 3762 chan->remote_mps = size; 3763 3764 set_bit(CONF_MODE_DONE, &chan->conf_state); 3765 3766 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3767 (unsigned long) &rfc, endptr - ptr); 3768 3769 break; 3770 3771 default: 3772 result = L2CAP_CONF_UNACCEPT; 3773 3774 memset(&rfc, 0, sizeof(rfc)); 3775 rfc.mode = chan->mode; 3776 } 3777 3778 if (result == L2CAP_CONF_SUCCESS) 3779 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 3780 } 3781 rsp->scid = cpu_to_le16(chan->dcid); 3782 rsp->result = cpu_to_le16(result); 3783 rsp->flags = cpu_to_le16(0); 3784 3785 return ptr - data; 3786 } 3787 3788 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 3789 void *data, size_t size, u16 *result) 3790 { 3791 struct l2cap_conf_req *req = data; 3792 void *ptr = req->data; 3793 void *endptr = data + size; 3794 int type, olen; 3795 unsigned long val; 3796 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3797 struct l2cap_conf_efs efs; 3798 3799 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 3800 3801 while (len >= L2CAP_CONF_OPT_SIZE) { 3802 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 3803 if (len < 0) 3804 break; 3805 3806 switch (type) { 3807 case L2CAP_CONF_MTU: 3808 if (olen != 2) 3809 break; 3810 if (val < L2CAP_DEFAULT_MIN_MTU) { 3811 *result = L2CAP_CONF_UNACCEPT; 3812 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3813 } else 3814 chan->imtu = val; 3815 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3816 endptr - ptr); 3817 break; 3818 3819 case L2CAP_CONF_FLUSH_TO: 3820 if (olen != 2) 3821 break; 3822 chan->flush_to = val; 3823 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, 3824 chan->flush_to, endptr - ptr); 3825 break; 3826 3827 case L2CAP_CONF_RFC: 3828 if (olen != sizeof(rfc)) 3829 break; 3830 memcpy(&rfc, (void *)val, olen); 3831 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 3832 rfc.mode != chan->mode) 3833 return -ECONNREFUSED; 3834 chan->fcs = 0; 3835 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3836 (unsigned long) &rfc, endptr - ptr); 3837 break; 3838 3839 case L2CAP_CONF_EWS: 3840 if (olen != 2) 3841 break; 3842 chan->ack_win = min_t(u16, val, chan->ack_win); 3843 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3844 chan->tx_win, endptr - ptr); 3845 break; 3846 3847 case L2CAP_CONF_EFS: 3848 if (olen != sizeof(efs)) 3849 break; 3850 memcpy(&efs, (void *)val, olen); 3851 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3852 efs.stype != L2CAP_SERV_NOTRAFIC && 3853 efs.stype != chan->local_stype) 3854 return -ECONNREFUSED; 3855 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), 3856 (unsigned long) &efs, endptr - ptr); 3857 break; 3858 3859 case L2CAP_CONF_FCS: 3860 if (olen != 1) 3861 break; 3862 if (*result == L2CAP_CONF_PENDING) 3863 if (val == L2CAP_FCS_NONE) 3864 set_bit(CONF_RECV_NO_FCS, 3865 &chan->conf_state); 3866 break; 3867 } 3868 } 3869 3870 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) 3871 return -ECONNREFUSED; 3872 3873 chan->mode = rfc.mode; 3874 3875 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) { 3876 switch (rfc.mode) { 3877 case L2CAP_MODE_ERTM: 3878 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 3879 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 3880 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3881 if (!test_bit(FLAG_EXT_CTRL, &chan->flags)) 3882 chan->ack_win = min_t(u16, chan->ack_win, 3883 rfc.txwin_size); 3884 3885 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3886 chan->local_msdu = le16_to_cpu(efs.msdu); 3887 chan->local_sdu_itime = 3888 le32_to_cpu(efs.sdu_itime); 3889 chan->local_acc_lat = le32_to_cpu(efs.acc_lat); 3890 chan->local_flush_to = 3891 le32_to_cpu(efs.flush_to); 3892 } 3893 break; 3894 3895 case L2CAP_MODE_STREAMING: 3896 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3897 } 3898 } 3899 3900 req->dcid = cpu_to_le16(chan->dcid); 3901 req->flags = cpu_to_le16(0); 3902 3903 return ptr - data; 3904 } 3905 3906 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, 3907 u16 result, u16 flags) 3908 { 3909 struct l2cap_conf_rsp *rsp = data; 3910 void *ptr = rsp->data; 3911 3912 BT_DBG("chan %p", chan); 3913 3914 rsp->scid = cpu_to_le16(chan->dcid); 3915 rsp->result = cpu_to_le16(result); 3916 rsp->flags = cpu_to_le16(flags); 3917 3918 return ptr - data; 3919 } 3920 3921 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) 3922 { 3923 struct l2cap_le_conn_rsp rsp; 3924 struct l2cap_conn *conn = chan->conn; 3925 3926 BT_DBG("chan %p", chan); 3927 3928 rsp.dcid = cpu_to_le16(chan->scid); 3929 rsp.mtu = cpu_to_le16(chan->imtu); 3930 rsp.mps = cpu_to_le16(chan->mps); 3931 rsp.credits = cpu_to_le16(chan->rx_credits); 3932 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3933 3934 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 3935 &rsp); 3936 } 3937 3938 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data) 3939 { 3940 int *result = data; 3941 3942 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 3943 return; 3944 3945 switch (chan->state) { 3946 case BT_CONNECT2: 3947 /* If channel still pending accept add to result */ 3948 (*result)++; 3949 return; 3950 case BT_CONNECTED: 3951 return; 3952 default: 3953 /* If not connected or pending accept it has been refused */ 3954 *result = -ECONNREFUSED; 3955 return; 3956 } 3957 } 3958 3959 struct l2cap_ecred_rsp_data { 3960 struct { 3961 struct l2cap_ecred_conn_rsp rsp; 3962 __le16 scid[L2CAP_ECRED_MAX_CID]; 3963 } __packed pdu; 3964 int count; 3965 }; 3966 3967 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) 3968 { 3969 struct l2cap_ecred_rsp_data *rsp = data; 3970 3971 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 3972 return; 3973 3974 /* Reset ident so only one response is sent */ 3975 chan->ident = 0; 3976 3977 /* Include all channels pending with the same ident */ 3978 if (!rsp->pdu.rsp.result) 3979 rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid); 3980 else 3981 l2cap_chan_del(chan, ECONNRESET); 3982 } 3983 3984 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) 3985 { 3986 struct l2cap_conn *conn = chan->conn; 3987 struct l2cap_ecred_rsp_data data; 3988 u16 id = chan->ident; 3989 int result = 0; 3990 3991 if (!id) 3992 return; 3993 3994 BT_DBG("chan %p id %d", chan, id); 3995 3996 memset(&data, 0, sizeof(data)); 3997 3998 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu); 3999 data.pdu.rsp.mps = cpu_to_le16(chan->mps); 4000 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 4001 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 4002 4003 /* Verify that all channels are ready */ 4004 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result); 4005 4006 if (result > 0) 4007 return; 4008 4009 if (result < 0) 4010 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION); 4011 4012 /* Build response */ 4013 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data); 4014 4015 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP, 4016 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)), 4017 &data.pdu); 4018 } 4019 4020 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 4021 { 4022 struct l2cap_conn_rsp rsp; 4023 struct l2cap_conn *conn = chan->conn; 4024 u8 buf[128]; 4025 u8 rsp_code; 4026 4027 rsp.scid = cpu_to_le16(chan->dcid); 4028 rsp.dcid = cpu_to_le16(chan->scid); 4029 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 4030 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 4031 4032 if (chan->hs_hcon) 4033 rsp_code = L2CAP_CREATE_CHAN_RSP; 4034 else 4035 rsp_code = L2CAP_CONN_RSP; 4036 4037 BT_DBG("chan %p rsp_code %u", chan, rsp_code); 4038 4039 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp); 4040 4041 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4042 return; 4043 4044 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4045 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4046 chan->num_conf_req++; 4047 } 4048 4049 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 4050 { 4051 int type, olen; 4052 unsigned long val; 4053 /* Use sane default values in case a misbehaving remote device 4054 * did not send an RFC or extended window size option. 4055 */ 4056 u16 txwin_ext = chan->ack_win; 4057 struct l2cap_conf_rfc rfc = { 4058 .mode = chan->mode, 4059 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO), 4060 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO), 4061 .max_pdu_size = cpu_to_le16(chan->imtu), 4062 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW), 4063 }; 4064 4065 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 4066 4067 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 4068 return; 4069 4070 while (len >= L2CAP_CONF_OPT_SIZE) { 4071 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 4072 if (len < 0) 4073 break; 4074 4075 switch (type) { 4076 case L2CAP_CONF_RFC: 4077 if (olen != sizeof(rfc)) 4078 break; 4079 memcpy(&rfc, (void *)val, olen); 4080 break; 4081 case L2CAP_CONF_EWS: 4082 if (olen != 2) 4083 break; 4084 txwin_ext = val; 4085 break; 4086 } 4087 } 4088 4089 switch (rfc.mode) { 4090 case L2CAP_MODE_ERTM: 4091 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 4092 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 4093 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4094 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 4095 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext); 4096 else 4097 chan->ack_win = min_t(u16, chan->ack_win, 4098 rfc.txwin_size); 4099 break; 4100 case L2CAP_MODE_STREAMING: 4101 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4102 } 4103 } 4104 4105 static inline int l2cap_command_rej(struct l2cap_conn *conn, 4106 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4107 u8 *data) 4108 { 4109 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 4110 4111 if (cmd_len < sizeof(*rej)) 4112 return -EPROTO; 4113 4114 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 4115 return 0; 4116 4117 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 4118 cmd->ident == conn->info_ident) { 4119 cancel_delayed_work(&conn->info_timer); 4120 4121 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4122 conn->info_ident = 0; 4123 4124 l2cap_conn_start(conn); 4125 } 4126 4127 return 0; 4128 } 4129 4130 static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, 4131 struct l2cap_cmd_hdr *cmd, 4132 u8 *data, u8 rsp_code, u8 amp_id) 4133 { 4134 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 4135 struct l2cap_conn_rsp rsp; 4136 struct l2cap_chan *chan = NULL, *pchan; 4137 int result, status = L2CAP_CS_NO_INFO; 4138 4139 u16 dcid = 0, scid = __le16_to_cpu(req->scid); 4140 __le16 psm = req->psm; 4141 4142 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid); 4143 4144 /* Check if we have socket listening on psm */ 4145 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 4146 &conn->hcon->dst, ACL_LINK); 4147 if (!pchan) { 4148 result = L2CAP_CR_BAD_PSM; 4149 goto sendresp; 4150 } 4151 4152 mutex_lock(&conn->chan_lock); 4153 l2cap_chan_lock(pchan); 4154 4155 /* Check if the ACL is secure enough (if not SDP) */ 4156 if (psm != cpu_to_le16(L2CAP_PSM_SDP) && 4157 !hci_conn_check_link_mode(conn->hcon)) { 4158 conn->disc_reason = HCI_ERROR_AUTH_FAILURE; 4159 result = L2CAP_CR_SEC_BLOCK; 4160 goto response; 4161 } 4162 4163 result = L2CAP_CR_NO_MEM; 4164 4165 /* Check for valid dynamic CID range (as per Erratum 3253) */ 4166 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) { 4167 result = L2CAP_CR_INVALID_SCID; 4168 goto response; 4169 } 4170 4171 /* Check if we already have channel with that dcid */ 4172 if (__l2cap_get_chan_by_dcid(conn, scid)) { 4173 result = L2CAP_CR_SCID_IN_USE; 4174 goto response; 4175 } 4176 4177 chan = pchan->ops->new_connection(pchan); 4178 if (!chan) 4179 goto response; 4180 4181 /* For certain devices (ex: HID mouse), support for authentication, 4182 * pairing and bonding is optional. For such devices, inorder to avoid 4183 * the ACL alive for too long after L2CAP disconnection, reset the ACL 4184 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect. 4185 */ 4186 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT; 4187 4188 bacpy(&chan->src, &conn->hcon->src); 4189 bacpy(&chan->dst, &conn->hcon->dst); 4190 chan->src_type = bdaddr_src_type(conn->hcon); 4191 chan->dst_type = bdaddr_dst_type(conn->hcon); 4192 chan->psm = psm; 4193 chan->dcid = scid; 4194 chan->local_amp_id = amp_id; 4195 4196 __l2cap_chan_add(conn, chan); 4197 4198 dcid = chan->scid; 4199 4200 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 4201 4202 chan->ident = cmd->ident; 4203 4204 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 4205 if (l2cap_chan_check_security(chan, false)) { 4206 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 4207 l2cap_state_change(chan, BT_CONNECT2); 4208 result = L2CAP_CR_PEND; 4209 status = L2CAP_CS_AUTHOR_PEND; 4210 chan->ops->defer(chan); 4211 } else { 4212 /* Force pending result for AMP controllers. 4213 * The connection will succeed after the 4214 * physical link is up. 4215 */ 4216 if (amp_id == AMP_ID_BREDR) { 4217 l2cap_state_change(chan, BT_CONFIG); 4218 result = L2CAP_CR_SUCCESS; 4219 } else { 4220 l2cap_state_change(chan, BT_CONNECT2); 4221 result = L2CAP_CR_PEND; 4222 } 4223 status = L2CAP_CS_NO_INFO; 4224 } 4225 } else { 4226 l2cap_state_change(chan, BT_CONNECT2); 4227 result = L2CAP_CR_PEND; 4228 status = L2CAP_CS_AUTHEN_PEND; 4229 } 4230 } else { 4231 l2cap_state_change(chan, BT_CONNECT2); 4232 result = L2CAP_CR_PEND; 4233 status = L2CAP_CS_NO_INFO; 4234 } 4235 4236 response: 4237 l2cap_chan_unlock(pchan); 4238 mutex_unlock(&conn->chan_lock); 4239 l2cap_chan_put(pchan); 4240 4241 sendresp: 4242 rsp.scid = cpu_to_le16(scid); 4243 rsp.dcid = cpu_to_le16(dcid); 4244 rsp.result = cpu_to_le16(result); 4245 rsp.status = cpu_to_le16(status); 4246 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4247 4248 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 4249 struct l2cap_info_req info; 4250 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4251 4252 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 4253 conn->info_ident = l2cap_get_ident(conn); 4254 4255 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 4256 4257 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 4258 sizeof(info), &info); 4259 } 4260 4261 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 4262 result == L2CAP_CR_SUCCESS) { 4263 u8 buf[128]; 4264 set_bit(CONF_REQ_SENT, &chan->conf_state); 4265 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4266 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4267 chan->num_conf_req++; 4268 } 4269 4270 return chan; 4271 } 4272 4273 static int l2cap_connect_req(struct l2cap_conn *conn, 4274 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 4275 { 4276 struct hci_dev *hdev = conn->hcon->hdev; 4277 struct hci_conn *hcon = conn->hcon; 4278 4279 if (cmd_len < sizeof(struct l2cap_conn_req)) 4280 return -EPROTO; 4281 4282 hci_dev_lock(hdev); 4283 if (hci_dev_test_flag(hdev, HCI_MGMT) && 4284 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags)) 4285 mgmt_device_connected(hdev, hcon, NULL, 0); 4286 hci_dev_unlock(hdev); 4287 4288 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0); 4289 return 0; 4290 } 4291 4292 static int l2cap_connect_create_rsp(struct l2cap_conn *conn, 4293 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4294 u8 *data) 4295 { 4296 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 4297 u16 scid, dcid, result, status; 4298 struct l2cap_chan *chan; 4299 u8 req[128]; 4300 int err; 4301 4302 if (cmd_len < sizeof(*rsp)) 4303 return -EPROTO; 4304 4305 scid = __le16_to_cpu(rsp->scid); 4306 dcid = __le16_to_cpu(rsp->dcid); 4307 result = __le16_to_cpu(rsp->result); 4308 status = __le16_to_cpu(rsp->status); 4309 4310 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", 4311 dcid, scid, result, status); 4312 4313 mutex_lock(&conn->chan_lock); 4314 4315 if (scid) { 4316 chan = __l2cap_get_chan_by_scid(conn, scid); 4317 if (!chan) { 4318 err = -EBADSLT; 4319 goto unlock; 4320 } 4321 } else { 4322 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 4323 if (!chan) { 4324 err = -EBADSLT; 4325 goto unlock; 4326 } 4327 } 4328 4329 chan = l2cap_chan_hold_unless_zero(chan); 4330 if (!chan) { 4331 err = -EBADSLT; 4332 goto unlock; 4333 } 4334 4335 err = 0; 4336 4337 l2cap_chan_lock(chan); 4338 4339 switch (result) { 4340 case L2CAP_CR_SUCCESS: 4341 l2cap_state_change(chan, BT_CONFIG); 4342 chan->ident = 0; 4343 chan->dcid = dcid; 4344 clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 4345 4346 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4347 break; 4348 4349 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4350 l2cap_build_conf_req(chan, req, sizeof(req)), req); 4351 chan->num_conf_req++; 4352 break; 4353 4354 case L2CAP_CR_PEND: 4355 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 4356 break; 4357 4358 default: 4359 l2cap_chan_del(chan, ECONNREFUSED); 4360 break; 4361 } 4362 4363 l2cap_chan_unlock(chan); 4364 l2cap_chan_put(chan); 4365 4366 unlock: 4367 mutex_unlock(&conn->chan_lock); 4368 4369 return err; 4370 } 4371 4372 static inline void set_default_fcs(struct l2cap_chan *chan) 4373 { 4374 /* FCS is enabled only in ERTM or streaming mode, if one or both 4375 * sides request it. 4376 */ 4377 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 4378 chan->fcs = L2CAP_FCS_NONE; 4379 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) 4380 chan->fcs = L2CAP_FCS_CRC16; 4381 } 4382 4383 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data, 4384 u8 ident, u16 flags) 4385 { 4386 struct l2cap_conn *conn = chan->conn; 4387 4388 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident, 4389 flags); 4390 4391 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 4392 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 4393 4394 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP, 4395 l2cap_build_conf_rsp(chan, data, 4396 L2CAP_CONF_SUCCESS, flags), data); 4397 } 4398 4399 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident, 4400 u16 scid, u16 dcid) 4401 { 4402 struct l2cap_cmd_rej_cid rej; 4403 4404 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 4405 rej.scid = __cpu_to_le16(scid); 4406 rej.dcid = __cpu_to_le16(dcid); 4407 4408 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 4409 } 4410 4411 static inline int l2cap_config_req(struct l2cap_conn *conn, 4412 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4413 u8 *data) 4414 { 4415 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 4416 u16 dcid, flags; 4417 u8 rsp[64]; 4418 struct l2cap_chan *chan; 4419 int len, err = 0; 4420 4421 if (cmd_len < sizeof(*req)) 4422 return -EPROTO; 4423 4424 dcid = __le16_to_cpu(req->dcid); 4425 flags = __le16_to_cpu(req->flags); 4426 4427 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 4428 4429 chan = l2cap_get_chan_by_scid(conn, dcid); 4430 if (!chan) { 4431 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0); 4432 return 0; 4433 } 4434 4435 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && 4436 chan->state != BT_CONNECTED) { 4437 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4438 chan->dcid); 4439 goto unlock; 4440 } 4441 4442 /* Reject if config buffer is too small. */ 4443 len = cmd_len - sizeof(*req); 4444 if (chan->conf_len + len > sizeof(chan->conf_req)) { 4445 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4446 l2cap_build_conf_rsp(chan, rsp, 4447 L2CAP_CONF_REJECT, flags), rsp); 4448 goto unlock; 4449 } 4450 4451 /* Store config. */ 4452 memcpy(chan->conf_req + chan->conf_len, req->data, len); 4453 chan->conf_len += len; 4454 4455 if (flags & L2CAP_CONF_FLAG_CONTINUATION) { 4456 /* Incomplete config. Send empty response. */ 4457 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4458 l2cap_build_conf_rsp(chan, rsp, 4459 L2CAP_CONF_SUCCESS, flags), rsp); 4460 goto unlock; 4461 } 4462 4463 /* Complete config. */ 4464 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); 4465 if (len < 0) { 4466 l2cap_send_disconn_req(chan, ECONNRESET); 4467 goto unlock; 4468 } 4469 4470 chan->ident = cmd->ident; 4471 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 4472 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) 4473 chan->num_conf_rsp++; 4474 4475 /* Reset config buffer. */ 4476 chan->conf_len = 0; 4477 4478 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 4479 goto unlock; 4480 4481 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 4482 set_default_fcs(chan); 4483 4484 if (chan->mode == L2CAP_MODE_ERTM || 4485 chan->mode == L2CAP_MODE_STREAMING) 4486 err = l2cap_ertm_init(chan); 4487 4488 if (err < 0) 4489 l2cap_send_disconn_req(chan, -err); 4490 else 4491 l2cap_chan_ready(chan); 4492 4493 goto unlock; 4494 } 4495 4496 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 4497 u8 buf[64]; 4498 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4499 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4500 chan->num_conf_req++; 4501 } 4502 4503 /* Got Conf Rsp PENDING from remote side and assume we sent 4504 Conf Rsp PENDING in the code above */ 4505 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) && 4506 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4507 4508 /* check compatibility */ 4509 4510 /* Send rsp for BR/EDR channel */ 4511 if (!chan->hs_hcon) 4512 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); 4513 else 4514 chan->ident = cmd->ident; 4515 } 4516 4517 unlock: 4518 l2cap_chan_unlock(chan); 4519 l2cap_chan_put(chan); 4520 return err; 4521 } 4522 4523 static inline int l2cap_config_rsp(struct l2cap_conn *conn, 4524 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4525 u8 *data) 4526 { 4527 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 4528 u16 scid, flags, result; 4529 struct l2cap_chan *chan; 4530 int len = cmd_len - sizeof(*rsp); 4531 int err = 0; 4532 4533 if (cmd_len < sizeof(*rsp)) 4534 return -EPROTO; 4535 4536 scid = __le16_to_cpu(rsp->scid); 4537 flags = __le16_to_cpu(rsp->flags); 4538 result = __le16_to_cpu(rsp->result); 4539 4540 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags, 4541 result, len); 4542 4543 chan = l2cap_get_chan_by_scid(conn, scid); 4544 if (!chan) 4545 return 0; 4546 4547 switch (result) { 4548 case L2CAP_CONF_SUCCESS: 4549 l2cap_conf_rfc_get(chan, rsp->data, len); 4550 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4551 break; 4552 4553 case L2CAP_CONF_PENDING: 4554 set_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4555 4556 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4557 char buf[64]; 4558 4559 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4560 buf, sizeof(buf), &result); 4561 if (len < 0) { 4562 l2cap_send_disconn_req(chan, ECONNRESET); 4563 goto done; 4564 } 4565 4566 if (!chan->hs_hcon) { 4567 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 4568 0); 4569 } else { 4570 if (l2cap_check_efs(chan)) { 4571 amp_create_logical_link(chan); 4572 chan->ident = cmd->ident; 4573 } 4574 } 4575 } 4576 goto done; 4577 4578 case L2CAP_CONF_UNKNOWN: 4579 case L2CAP_CONF_UNACCEPT: 4580 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 4581 char req[64]; 4582 4583 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 4584 l2cap_send_disconn_req(chan, ECONNRESET); 4585 goto done; 4586 } 4587 4588 /* throw out any old stored conf requests */ 4589 result = L2CAP_CONF_SUCCESS; 4590 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4591 req, sizeof(req), &result); 4592 if (len < 0) { 4593 l2cap_send_disconn_req(chan, ECONNRESET); 4594 goto done; 4595 } 4596 4597 l2cap_send_cmd(conn, l2cap_get_ident(conn), 4598 L2CAP_CONF_REQ, len, req); 4599 chan->num_conf_req++; 4600 if (result != L2CAP_CONF_SUCCESS) 4601 goto done; 4602 break; 4603 } 4604 fallthrough; 4605 4606 default: 4607 l2cap_chan_set_err(chan, ECONNRESET); 4608 4609 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT); 4610 l2cap_send_disconn_req(chan, ECONNRESET); 4611 goto done; 4612 } 4613 4614 if (flags & L2CAP_CONF_FLAG_CONTINUATION) 4615 goto done; 4616 4617 set_bit(CONF_INPUT_DONE, &chan->conf_state); 4618 4619 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 4620 set_default_fcs(chan); 4621 4622 if (chan->mode == L2CAP_MODE_ERTM || 4623 chan->mode == L2CAP_MODE_STREAMING) 4624 err = l2cap_ertm_init(chan); 4625 4626 if (err < 0) 4627 l2cap_send_disconn_req(chan, -err); 4628 else 4629 l2cap_chan_ready(chan); 4630 } 4631 4632 done: 4633 l2cap_chan_unlock(chan); 4634 l2cap_chan_put(chan); 4635 return err; 4636 } 4637 4638 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, 4639 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4640 u8 *data) 4641 { 4642 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 4643 struct l2cap_disconn_rsp rsp; 4644 u16 dcid, scid; 4645 struct l2cap_chan *chan; 4646 4647 if (cmd_len != sizeof(*req)) 4648 return -EPROTO; 4649 4650 scid = __le16_to_cpu(req->scid); 4651 dcid = __le16_to_cpu(req->dcid); 4652 4653 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 4654 4655 chan = l2cap_get_chan_by_scid(conn, dcid); 4656 if (!chan) { 4657 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); 4658 return 0; 4659 } 4660 4661 rsp.dcid = cpu_to_le16(chan->scid); 4662 rsp.scid = cpu_to_le16(chan->dcid); 4663 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 4664 4665 chan->ops->set_shutdown(chan); 4666 4667 mutex_lock(&conn->chan_lock); 4668 l2cap_chan_del(chan, ECONNRESET); 4669 mutex_unlock(&conn->chan_lock); 4670 4671 chan->ops->close(chan); 4672 4673 l2cap_chan_unlock(chan); 4674 l2cap_chan_put(chan); 4675 4676 return 0; 4677 } 4678 4679 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, 4680 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4681 u8 *data) 4682 { 4683 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 4684 u16 dcid, scid; 4685 struct l2cap_chan *chan; 4686 4687 if (cmd_len != sizeof(*rsp)) 4688 return -EPROTO; 4689 4690 scid = __le16_to_cpu(rsp->scid); 4691 dcid = __le16_to_cpu(rsp->dcid); 4692 4693 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 4694 4695 chan = l2cap_get_chan_by_scid(conn, scid); 4696 if (!chan) { 4697 mutex_unlock(&conn->chan_lock); 4698 return 0; 4699 } 4700 4701 if (chan->state != BT_DISCONN) { 4702 l2cap_chan_unlock(chan); 4703 l2cap_chan_put(chan); 4704 return 0; 4705 } 4706 4707 mutex_lock(&conn->chan_lock); 4708 l2cap_chan_del(chan, 0); 4709 mutex_unlock(&conn->chan_lock); 4710 4711 chan->ops->close(chan); 4712 4713 l2cap_chan_unlock(chan); 4714 l2cap_chan_put(chan); 4715 4716 return 0; 4717 } 4718 4719 static inline int l2cap_information_req(struct l2cap_conn *conn, 4720 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4721 u8 *data) 4722 { 4723 struct l2cap_info_req *req = (struct l2cap_info_req *) data; 4724 u16 type; 4725 4726 if (cmd_len != sizeof(*req)) 4727 return -EPROTO; 4728 4729 type = __le16_to_cpu(req->type); 4730 4731 BT_DBG("type 0x%4.4x", type); 4732 4733 if (type == L2CAP_IT_FEAT_MASK) { 4734 u8 buf[8]; 4735 u32 feat_mask = l2cap_feat_mask; 4736 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4737 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4738 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4739 if (!disable_ertm) 4740 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 4741 | L2CAP_FEAT_FCS; 4742 if (conn->local_fixed_chan & L2CAP_FC_A2MP) 4743 feat_mask |= L2CAP_FEAT_EXT_FLOW 4744 | L2CAP_FEAT_EXT_WINDOW; 4745 4746 put_unaligned_le32(feat_mask, rsp->data); 4747 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4748 buf); 4749 } else if (type == L2CAP_IT_FIXED_CHAN) { 4750 u8 buf[12]; 4751 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4752 4753 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4754 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4755 rsp->data[0] = conn->local_fixed_chan; 4756 memset(rsp->data + 1, 0, 7); 4757 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4758 buf); 4759 } else { 4760 struct l2cap_info_rsp rsp; 4761 rsp.type = cpu_to_le16(type); 4762 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 4763 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), 4764 &rsp); 4765 } 4766 4767 return 0; 4768 } 4769 4770 static inline int l2cap_information_rsp(struct l2cap_conn *conn, 4771 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4772 u8 *data) 4773 { 4774 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 4775 u16 type, result; 4776 4777 if (cmd_len < sizeof(*rsp)) 4778 return -EPROTO; 4779 4780 type = __le16_to_cpu(rsp->type); 4781 result = __le16_to_cpu(rsp->result); 4782 4783 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 4784 4785 /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 4786 if (cmd->ident != conn->info_ident || 4787 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 4788 return 0; 4789 4790 cancel_delayed_work(&conn->info_timer); 4791 4792 if (result != L2CAP_IR_SUCCESS) { 4793 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4794 conn->info_ident = 0; 4795 4796 l2cap_conn_start(conn); 4797 4798 return 0; 4799 } 4800 4801 switch (type) { 4802 case L2CAP_IT_FEAT_MASK: 4803 conn->feat_mask = get_unaligned_le32(rsp->data); 4804 4805 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 4806 struct l2cap_info_req req; 4807 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4808 4809 conn->info_ident = l2cap_get_ident(conn); 4810 4811 l2cap_send_cmd(conn, conn->info_ident, 4812 L2CAP_INFO_REQ, sizeof(req), &req); 4813 } else { 4814 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4815 conn->info_ident = 0; 4816 4817 l2cap_conn_start(conn); 4818 } 4819 break; 4820 4821 case L2CAP_IT_FIXED_CHAN: 4822 conn->remote_fixed_chan = rsp->data[0]; 4823 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4824 conn->info_ident = 0; 4825 4826 l2cap_conn_start(conn); 4827 break; 4828 } 4829 4830 return 0; 4831 } 4832 4833 static int l2cap_create_channel_req(struct l2cap_conn *conn, 4834 struct l2cap_cmd_hdr *cmd, 4835 u16 cmd_len, void *data) 4836 { 4837 struct l2cap_create_chan_req *req = data; 4838 struct l2cap_create_chan_rsp rsp; 4839 struct l2cap_chan *chan; 4840 struct hci_dev *hdev; 4841 u16 psm, scid; 4842 4843 if (cmd_len != sizeof(*req)) 4844 return -EPROTO; 4845 4846 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) 4847 return -EINVAL; 4848 4849 psm = le16_to_cpu(req->psm); 4850 scid = le16_to_cpu(req->scid); 4851 4852 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id); 4853 4854 /* For controller id 0 make BR/EDR connection */ 4855 if (req->amp_id == AMP_ID_BREDR) { 4856 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP, 4857 req->amp_id); 4858 return 0; 4859 } 4860 4861 /* Validate AMP controller id */ 4862 hdev = hci_dev_get(req->amp_id); 4863 if (!hdev) 4864 goto error; 4865 4866 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) { 4867 hci_dev_put(hdev); 4868 goto error; 4869 } 4870 4871 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP, 4872 req->amp_id); 4873 if (chan) { 4874 struct amp_mgr *mgr = conn->hcon->amp_mgr; 4875 struct hci_conn *hs_hcon; 4876 4877 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, 4878 &conn->hcon->dst); 4879 if (!hs_hcon) { 4880 hci_dev_put(hdev); 4881 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4882 chan->dcid); 4883 return 0; 4884 } 4885 4886 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon); 4887 4888 mgr->bredr_chan = chan; 4889 chan->hs_hcon = hs_hcon; 4890 chan->fcs = L2CAP_FCS_NONE; 4891 conn->mtu = hdev->block_mtu; 4892 } 4893 4894 hci_dev_put(hdev); 4895 4896 return 0; 4897 4898 error: 4899 rsp.dcid = 0; 4900 rsp.scid = cpu_to_le16(scid); 4901 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP); 4902 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 4903 4904 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP, 4905 sizeof(rsp), &rsp); 4906 4907 return 0; 4908 } 4909 4910 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id) 4911 { 4912 struct l2cap_move_chan_req req; 4913 u8 ident; 4914 4915 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id); 4916 4917 ident = l2cap_get_ident(chan->conn); 4918 chan->ident = ident; 4919 4920 req.icid = cpu_to_le16(chan->scid); 4921 req.dest_amp_id = dest_amp_id; 4922 4923 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req), 4924 &req); 4925 4926 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT); 4927 } 4928 4929 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result) 4930 { 4931 struct l2cap_move_chan_rsp rsp; 4932 4933 BT_DBG("chan %p, result 0x%4.4x", chan, result); 4934 4935 rsp.icid = cpu_to_le16(chan->dcid); 4936 rsp.result = cpu_to_le16(result); 4937 4938 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP, 4939 sizeof(rsp), &rsp); 4940 } 4941 4942 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result) 4943 { 4944 struct l2cap_move_chan_cfm cfm; 4945 4946 BT_DBG("chan %p, result 0x%4.4x", chan, result); 4947 4948 chan->ident = l2cap_get_ident(chan->conn); 4949 4950 cfm.icid = cpu_to_le16(chan->scid); 4951 cfm.result = cpu_to_le16(result); 4952 4953 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM, 4954 sizeof(cfm), &cfm); 4955 4956 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT); 4957 } 4958 4959 static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid) 4960 { 4961 struct l2cap_move_chan_cfm cfm; 4962 4963 BT_DBG("conn %p, icid 0x%4.4x", conn, icid); 4964 4965 cfm.icid = cpu_to_le16(icid); 4966 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED); 4967 4968 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM, 4969 sizeof(cfm), &cfm); 4970 } 4971 4972 static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident, 4973 u16 icid) 4974 { 4975 struct l2cap_move_chan_cfm_rsp rsp; 4976 4977 BT_DBG("icid 0x%4.4x", icid); 4978 4979 rsp.icid = cpu_to_le16(icid); 4980 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp); 4981 } 4982 4983 static void __release_logical_link(struct l2cap_chan *chan) 4984 { 4985 chan->hs_hchan = NULL; 4986 chan->hs_hcon = NULL; 4987 4988 /* Placeholder - release the logical link */ 4989 } 4990 4991 static void l2cap_logical_fail(struct l2cap_chan *chan) 4992 { 4993 /* Logical link setup failed */ 4994 if (chan->state != BT_CONNECTED) { 4995 /* Create channel failure, disconnect */ 4996 l2cap_send_disconn_req(chan, ECONNRESET); 4997 return; 4998 } 4999 5000 switch (chan->move_role) { 5001 case L2CAP_MOVE_ROLE_RESPONDER: 5002 l2cap_move_done(chan); 5003 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP); 5004 break; 5005 case L2CAP_MOVE_ROLE_INITIATOR: 5006 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP || 5007 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) { 5008 /* Remote has only sent pending or 5009 * success responses, clean up 5010 */ 5011 l2cap_move_done(chan); 5012 } 5013 5014 /* Other amp move states imply that the move 5015 * has already aborted 5016 */ 5017 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5018 break; 5019 } 5020 } 5021 5022 static void l2cap_logical_finish_create(struct l2cap_chan *chan, 5023 struct hci_chan *hchan) 5024 { 5025 struct l2cap_conf_rsp rsp; 5026 5027 chan->hs_hchan = hchan; 5028 chan->hs_hcon->l2cap_data = chan->conn; 5029 5030 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0); 5031 5032 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 5033 int err; 5034 5035 set_default_fcs(chan); 5036 5037 err = l2cap_ertm_init(chan); 5038 if (err < 0) 5039 l2cap_send_disconn_req(chan, -err); 5040 else 5041 l2cap_chan_ready(chan); 5042 } 5043 } 5044 5045 static void l2cap_logical_finish_move(struct l2cap_chan *chan, 5046 struct hci_chan *hchan) 5047 { 5048 chan->hs_hcon = hchan->conn; 5049 chan->hs_hcon->l2cap_data = chan->conn; 5050 5051 BT_DBG("move_state %d", chan->move_state); 5052 5053 switch (chan->move_state) { 5054 case L2CAP_MOVE_WAIT_LOGICAL_COMP: 5055 /* Move confirm will be sent after a success 5056 * response is received 5057 */ 5058 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; 5059 break; 5060 case L2CAP_MOVE_WAIT_LOGICAL_CFM: 5061 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5062 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; 5063 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) { 5064 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP; 5065 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); 5066 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) { 5067 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; 5068 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS); 5069 } 5070 break; 5071 default: 5072 /* Move was not in expected state, free the channel */ 5073 __release_logical_link(chan); 5074 5075 chan->move_state = L2CAP_MOVE_STABLE; 5076 } 5077 } 5078 5079 /* Call with chan locked */ 5080 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan, 5081 u8 status) 5082 { 5083 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status); 5084 5085 if (status) { 5086 l2cap_logical_fail(chan); 5087 __release_logical_link(chan); 5088 return; 5089 } 5090 5091 if (chan->state != BT_CONNECTED) { 5092 /* Ignore logical link if channel is on BR/EDR */ 5093 if (chan->local_amp_id != AMP_ID_BREDR) 5094 l2cap_logical_finish_create(chan, hchan); 5095 } else { 5096 l2cap_logical_finish_move(chan, hchan); 5097 } 5098 } 5099 5100 void l2cap_move_start(struct l2cap_chan *chan) 5101 { 5102 BT_DBG("chan %p", chan); 5103 5104 if (chan->local_amp_id == AMP_ID_BREDR) { 5105 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED) 5106 return; 5107 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR; 5108 chan->move_state = L2CAP_MOVE_WAIT_PREPARE; 5109 /* Placeholder - start physical link setup */ 5110 } else { 5111 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR; 5112 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; 5113 chan->move_id = 0; 5114 l2cap_move_setup(chan); 5115 l2cap_send_move_chan_req(chan, 0); 5116 } 5117 } 5118 5119 static void l2cap_do_create(struct l2cap_chan *chan, int result, 5120 u8 local_amp_id, u8 remote_amp_id) 5121 { 5122 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state), 5123 local_amp_id, remote_amp_id); 5124 5125 chan->fcs = L2CAP_FCS_NONE; 5126 5127 /* Outgoing channel on AMP */ 5128 if (chan->state == BT_CONNECT) { 5129 if (result == L2CAP_CR_SUCCESS) { 5130 chan->local_amp_id = local_amp_id; 5131 l2cap_send_create_chan_req(chan, remote_amp_id); 5132 } else { 5133 /* Revert to BR/EDR connect */ 5134 l2cap_send_conn_req(chan); 5135 } 5136 5137 return; 5138 } 5139 5140 /* Incoming channel on AMP */ 5141 if (__l2cap_no_conn_pending(chan)) { 5142 struct l2cap_conn_rsp rsp; 5143 char buf[128]; 5144 rsp.scid = cpu_to_le16(chan->dcid); 5145 rsp.dcid = cpu_to_le16(chan->scid); 5146 5147 if (result == L2CAP_CR_SUCCESS) { 5148 /* Send successful response */ 5149 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 5150 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 5151 } else { 5152 /* Send negative response */ 5153 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM); 5154 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 5155 } 5156 5157 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP, 5158 sizeof(rsp), &rsp); 5159 5160 if (result == L2CAP_CR_SUCCESS) { 5161 l2cap_state_change(chan, BT_CONFIG); 5162 set_bit(CONF_REQ_SENT, &chan->conf_state); 5163 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), 5164 L2CAP_CONF_REQ, 5165 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 5166 chan->num_conf_req++; 5167 } 5168 } 5169 } 5170 5171 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id, 5172 u8 remote_amp_id) 5173 { 5174 l2cap_move_setup(chan); 5175 chan->move_id = local_amp_id; 5176 chan->move_state = L2CAP_MOVE_WAIT_RSP; 5177 5178 l2cap_send_move_chan_req(chan, remote_amp_id); 5179 } 5180 5181 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result) 5182 { 5183 struct hci_chan *hchan = NULL; 5184 5185 /* Placeholder - get hci_chan for logical link */ 5186 5187 if (hchan) { 5188 if (hchan->state == BT_CONNECTED) { 5189 /* Logical link is ready to go */ 5190 chan->hs_hcon = hchan->conn; 5191 chan->hs_hcon->l2cap_data = chan->conn; 5192 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; 5193 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS); 5194 5195 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS); 5196 } else { 5197 /* Wait for logical link to be ready */ 5198 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; 5199 } 5200 } else { 5201 /* Logical link not available */ 5202 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED); 5203 } 5204 } 5205 5206 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result) 5207 { 5208 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) { 5209 u8 rsp_result; 5210 if (result == -EINVAL) 5211 rsp_result = L2CAP_MR_BAD_ID; 5212 else 5213 rsp_result = L2CAP_MR_NOT_ALLOWED; 5214 5215 l2cap_send_move_chan_rsp(chan, rsp_result); 5216 } 5217 5218 chan->move_role = L2CAP_MOVE_ROLE_NONE; 5219 chan->move_state = L2CAP_MOVE_STABLE; 5220 5221 /* Restart data transmission */ 5222 l2cap_ertm_send(chan); 5223 } 5224 5225 /* Invoke with locked chan */ 5226 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) 5227 { 5228 u8 local_amp_id = chan->local_amp_id; 5229 u8 remote_amp_id = chan->remote_amp_id; 5230 5231 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", 5232 chan, result, local_amp_id, remote_amp_id); 5233 5234 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) 5235 return; 5236 5237 if (chan->state != BT_CONNECTED) { 5238 l2cap_do_create(chan, result, local_amp_id, remote_amp_id); 5239 } else if (result != L2CAP_MR_SUCCESS) { 5240 l2cap_do_move_cancel(chan, result); 5241 } else { 5242 switch (chan->move_role) { 5243 case L2CAP_MOVE_ROLE_INITIATOR: 5244 l2cap_do_move_initiate(chan, local_amp_id, 5245 remote_amp_id); 5246 break; 5247 case L2CAP_MOVE_ROLE_RESPONDER: 5248 l2cap_do_move_respond(chan, result); 5249 break; 5250 default: 5251 l2cap_do_move_cancel(chan, result); 5252 break; 5253 } 5254 } 5255 } 5256 5257 static inline int l2cap_move_channel_req(struct l2cap_conn *conn, 5258 struct l2cap_cmd_hdr *cmd, 5259 u16 cmd_len, void *data) 5260 { 5261 struct l2cap_move_chan_req *req = data; 5262 struct l2cap_move_chan_rsp rsp; 5263 struct l2cap_chan *chan; 5264 u16 icid = 0; 5265 u16 result = L2CAP_MR_NOT_ALLOWED; 5266 5267 if (cmd_len != sizeof(*req)) 5268 return -EPROTO; 5269 5270 icid = le16_to_cpu(req->icid); 5271 5272 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id); 5273 5274 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) 5275 return -EINVAL; 5276 5277 chan = l2cap_get_chan_by_dcid(conn, icid); 5278 if (!chan) { 5279 rsp.icid = cpu_to_le16(icid); 5280 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED); 5281 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP, 5282 sizeof(rsp), &rsp); 5283 return 0; 5284 } 5285 5286 chan->ident = cmd->ident; 5287 5288 if (chan->scid < L2CAP_CID_DYN_START || 5289 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY || 5290 (chan->mode != L2CAP_MODE_ERTM && 5291 chan->mode != L2CAP_MODE_STREAMING)) { 5292 result = L2CAP_MR_NOT_ALLOWED; 5293 goto send_move_response; 5294 } 5295 5296 if (chan->local_amp_id == req->dest_amp_id) { 5297 result = L2CAP_MR_SAME_ID; 5298 goto send_move_response; 5299 } 5300 5301 if (req->dest_amp_id != AMP_ID_BREDR) { 5302 struct hci_dev *hdev; 5303 hdev = hci_dev_get(req->dest_amp_id); 5304 if (!hdev || hdev->dev_type != HCI_AMP || 5305 !test_bit(HCI_UP, &hdev->flags)) { 5306 if (hdev) 5307 hci_dev_put(hdev); 5308 5309 result = L2CAP_MR_BAD_ID; 5310 goto send_move_response; 5311 } 5312 hci_dev_put(hdev); 5313 } 5314 5315 /* Detect a move collision. Only send a collision response 5316 * if this side has "lost", otherwise proceed with the move. 5317 * The winner has the larger bd_addr. 5318 */ 5319 if ((__chan_is_moving(chan) || 5320 chan->move_role != L2CAP_MOVE_ROLE_NONE) && 5321 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) { 5322 result = L2CAP_MR_COLLISION; 5323 goto send_move_response; 5324 } 5325 5326 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER; 5327 l2cap_move_setup(chan); 5328 chan->move_id = req->dest_amp_id; 5329 5330 if (req->dest_amp_id == AMP_ID_BREDR) { 5331 /* Moving to BR/EDR */ 5332 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5333 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; 5334 result = L2CAP_MR_PEND; 5335 } else { 5336 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; 5337 result = L2CAP_MR_SUCCESS; 5338 } 5339 } else { 5340 chan->move_state = L2CAP_MOVE_WAIT_PREPARE; 5341 /* Placeholder - uncomment when amp functions are available */ 5342 /*amp_accept_physical(chan, req->dest_amp_id);*/ 5343 result = L2CAP_MR_PEND; 5344 } 5345 5346 send_move_response: 5347 l2cap_send_move_chan_rsp(chan, result); 5348 5349 l2cap_chan_unlock(chan); 5350 l2cap_chan_put(chan); 5351 5352 return 0; 5353 } 5354 5355 static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result) 5356 { 5357 struct l2cap_chan *chan; 5358 struct hci_chan *hchan = NULL; 5359 5360 chan = l2cap_get_chan_by_scid(conn, icid); 5361 if (!chan) { 5362 l2cap_send_move_chan_cfm_icid(conn, icid); 5363 return; 5364 } 5365 5366 __clear_chan_timer(chan); 5367 if (result == L2CAP_MR_PEND) 5368 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT); 5369 5370 switch (chan->move_state) { 5371 case L2CAP_MOVE_WAIT_LOGICAL_COMP: 5372 /* Move confirm will be sent when logical link 5373 * is complete. 5374 */ 5375 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; 5376 break; 5377 case L2CAP_MOVE_WAIT_RSP_SUCCESS: 5378 if (result == L2CAP_MR_PEND) { 5379 break; 5380 } else if (test_bit(CONN_LOCAL_BUSY, 5381 &chan->conn_state)) { 5382 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; 5383 } else { 5384 /* Logical link is up or moving to BR/EDR, 5385 * proceed with move 5386 */ 5387 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP; 5388 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); 5389 } 5390 break; 5391 case L2CAP_MOVE_WAIT_RSP: 5392 /* Moving to AMP */ 5393 if (result == L2CAP_MR_SUCCESS) { 5394 /* Remote is ready, send confirm immediately 5395 * after logical link is ready 5396 */ 5397 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; 5398 } else { 5399 /* Both logical link and move success 5400 * are required to confirm 5401 */ 5402 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP; 5403 } 5404 5405 /* Placeholder - get hci_chan for logical link */ 5406 if (!hchan) { 5407 /* Logical link not available */ 5408 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5409 break; 5410 } 5411 5412 /* If the logical link is not yet connected, do not 5413 * send confirmation. 5414 */ 5415 if (hchan->state != BT_CONNECTED) 5416 break; 5417 5418 /* Logical link is already ready to go */ 5419 5420 chan->hs_hcon = hchan->conn; 5421 chan->hs_hcon->l2cap_data = chan->conn; 5422 5423 if (result == L2CAP_MR_SUCCESS) { 5424 /* Can confirm now */ 5425 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); 5426 } else { 5427 /* Now only need move success 5428 * to confirm 5429 */ 5430 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; 5431 } 5432 5433 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS); 5434 break; 5435 default: 5436 /* Any other amp move state means the move failed. */ 5437 chan->move_id = chan->local_amp_id; 5438 l2cap_move_done(chan); 5439 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5440 } 5441 5442 l2cap_chan_unlock(chan); 5443 l2cap_chan_put(chan); 5444 } 5445 5446 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid, 5447 u16 result) 5448 { 5449 struct l2cap_chan *chan; 5450 5451 chan = l2cap_get_chan_by_ident(conn, ident); 5452 if (!chan) { 5453 /* Could not locate channel, icid is best guess */ 5454 l2cap_send_move_chan_cfm_icid(conn, icid); 5455 return; 5456 } 5457 5458 __clear_chan_timer(chan); 5459 5460 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) { 5461 if (result == L2CAP_MR_COLLISION) { 5462 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER; 5463 } else { 5464 /* Cleanup - cancel move */ 5465 chan->move_id = chan->local_amp_id; 5466 l2cap_move_done(chan); 5467 } 5468 } 5469 5470 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5471 5472 l2cap_chan_unlock(chan); 5473 l2cap_chan_put(chan); 5474 } 5475 5476 static int l2cap_move_channel_rsp(struct l2cap_conn *conn, 5477 struct l2cap_cmd_hdr *cmd, 5478 u16 cmd_len, void *data) 5479 { 5480 struct l2cap_move_chan_rsp *rsp = data; 5481 u16 icid, result; 5482 5483 if (cmd_len != sizeof(*rsp)) 5484 return -EPROTO; 5485 5486 icid = le16_to_cpu(rsp->icid); 5487 result = le16_to_cpu(rsp->result); 5488 5489 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result); 5490 5491 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND) 5492 l2cap_move_continue(conn, icid, result); 5493 else 5494 l2cap_move_fail(conn, cmd->ident, icid, result); 5495 5496 return 0; 5497 } 5498 5499 static int l2cap_move_channel_confirm(struct l2cap_conn *conn, 5500 struct l2cap_cmd_hdr *cmd, 5501 u16 cmd_len, void *data) 5502 { 5503 struct l2cap_move_chan_cfm *cfm = data; 5504 struct l2cap_chan *chan; 5505 u16 icid, result; 5506 5507 if (cmd_len != sizeof(*cfm)) 5508 return -EPROTO; 5509 5510 icid = le16_to_cpu(cfm->icid); 5511 result = le16_to_cpu(cfm->result); 5512 5513 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result); 5514 5515 chan = l2cap_get_chan_by_dcid(conn, icid); 5516 if (!chan) { 5517 /* Spec requires a response even if the icid was not found */ 5518 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); 5519 return 0; 5520 } 5521 5522 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) { 5523 if (result == L2CAP_MC_CONFIRMED) { 5524 chan->local_amp_id = chan->move_id; 5525 if (chan->local_amp_id == AMP_ID_BREDR) 5526 __release_logical_link(chan); 5527 } else { 5528 chan->move_id = chan->local_amp_id; 5529 } 5530 5531 l2cap_move_done(chan); 5532 } 5533 5534 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); 5535 5536 l2cap_chan_unlock(chan); 5537 l2cap_chan_put(chan); 5538 5539 return 0; 5540 } 5541 5542 static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn, 5543 struct l2cap_cmd_hdr *cmd, 5544 u16 cmd_len, void *data) 5545 { 5546 struct l2cap_move_chan_cfm_rsp *rsp = data; 5547 struct l2cap_chan *chan; 5548 u16 icid; 5549 5550 if (cmd_len != sizeof(*rsp)) 5551 return -EPROTO; 5552 5553 icid = le16_to_cpu(rsp->icid); 5554 5555 BT_DBG("icid 0x%4.4x", icid); 5556 5557 chan = l2cap_get_chan_by_scid(conn, icid); 5558 if (!chan) 5559 return 0; 5560 5561 __clear_chan_timer(chan); 5562 5563 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) { 5564 chan->local_amp_id = chan->move_id; 5565 5566 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan) 5567 __release_logical_link(chan); 5568 5569 l2cap_move_done(chan); 5570 } 5571 5572 l2cap_chan_unlock(chan); 5573 l2cap_chan_put(chan); 5574 5575 return 0; 5576 } 5577 5578 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 5579 struct l2cap_cmd_hdr *cmd, 5580 u16 cmd_len, u8 *data) 5581 { 5582 struct hci_conn *hcon = conn->hcon; 5583 struct l2cap_conn_param_update_req *req; 5584 struct l2cap_conn_param_update_rsp rsp; 5585 u16 min, max, latency, to_multiplier; 5586 int err; 5587 5588 if (hcon->role != HCI_ROLE_MASTER) 5589 return -EINVAL; 5590 5591 if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 5592 return -EPROTO; 5593 5594 req = (struct l2cap_conn_param_update_req *) data; 5595 min = __le16_to_cpu(req->min); 5596 max = __le16_to_cpu(req->max); 5597 latency = __le16_to_cpu(req->latency); 5598 to_multiplier = __le16_to_cpu(req->to_multiplier); 5599 5600 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 5601 min, max, latency, to_multiplier); 5602 5603 memset(&rsp, 0, sizeof(rsp)); 5604 5605 err = hci_check_conn_params(min, max, latency, to_multiplier); 5606 if (err) 5607 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 5608 else 5609 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 5610 5611 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 5612 sizeof(rsp), &rsp); 5613 5614 if (!err) { 5615 u8 store_hint; 5616 5617 store_hint = hci_le_conn_update(hcon, min, max, latency, 5618 to_multiplier); 5619 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type, 5620 store_hint, min, max, latency, 5621 to_multiplier); 5622 5623 } 5624 5625 return 0; 5626 } 5627 5628 static int l2cap_le_connect_rsp(struct l2cap_conn *conn, 5629 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5630 u8 *data) 5631 { 5632 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data; 5633 struct hci_conn *hcon = conn->hcon; 5634 u16 dcid, mtu, mps, credits, result; 5635 struct l2cap_chan *chan; 5636 int err, sec_level; 5637 5638 if (cmd_len < sizeof(*rsp)) 5639 return -EPROTO; 5640 5641 dcid = __le16_to_cpu(rsp->dcid); 5642 mtu = __le16_to_cpu(rsp->mtu); 5643 mps = __le16_to_cpu(rsp->mps); 5644 credits = __le16_to_cpu(rsp->credits); 5645 result = __le16_to_cpu(rsp->result); 5646 5647 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 || 5648 dcid < L2CAP_CID_DYN_START || 5649 dcid > L2CAP_CID_LE_DYN_END)) 5650 return -EPROTO; 5651 5652 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", 5653 dcid, mtu, mps, credits, result); 5654 5655 mutex_lock(&conn->chan_lock); 5656 5657 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 5658 if (!chan) { 5659 err = -EBADSLT; 5660 goto unlock; 5661 } 5662 5663 err = 0; 5664 5665 l2cap_chan_lock(chan); 5666 5667 switch (result) { 5668 case L2CAP_CR_LE_SUCCESS: 5669 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 5670 err = -EBADSLT; 5671 break; 5672 } 5673 5674 chan->ident = 0; 5675 chan->dcid = dcid; 5676 chan->omtu = mtu; 5677 chan->remote_mps = mps; 5678 chan->tx_credits = credits; 5679 l2cap_chan_ready(chan); 5680 break; 5681 5682 case L2CAP_CR_LE_AUTHENTICATION: 5683 case L2CAP_CR_LE_ENCRYPTION: 5684 /* If we already have MITM protection we can't do 5685 * anything. 5686 */ 5687 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 5688 l2cap_chan_del(chan, ECONNREFUSED); 5689 break; 5690 } 5691 5692 sec_level = hcon->sec_level + 1; 5693 if (chan->sec_level < sec_level) 5694 chan->sec_level = sec_level; 5695 5696 /* We'll need to send a new Connect Request */ 5697 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags); 5698 5699 smp_conn_security(hcon, chan->sec_level); 5700 break; 5701 5702 default: 5703 l2cap_chan_del(chan, ECONNREFUSED); 5704 break; 5705 } 5706 5707 l2cap_chan_unlock(chan); 5708 5709 unlock: 5710 mutex_unlock(&conn->chan_lock); 5711 5712 return err; 5713 } 5714 5715 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 5716 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5717 u8 *data) 5718 { 5719 int err = 0; 5720 5721 switch (cmd->code) { 5722 case L2CAP_COMMAND_REJ: 5723 l2cap_command_rej(conn, cmd, cmd_len, data); 5724 break; 5725 5726 case L2CAP_CONN_REQ: 5727 err = l2cap_connect_req(conn, cmd, cmd_len, data); 5728 break; 5729 5730 case L2CAP_CONN_RSP: 5731 case L2CAP_CREATE_CHAN_RSP: 5732 l2cap_connect_create_rsp(conn, cmd, cmd_len, data); 5733 break; 5734 5735 case L2CAP_CONF_REQ: 5736 err = l2cap_config_req(conn, cmd, cmd_len, data); 5737 break; 5738 5739 case L2CAP_CONF_RSP: 5740 l2cap_config_rsp(conn, cmd, cmd_len, data); 5741 break; 5742 5743 case L2CAP_DISCONN_REQ: 5744 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 5745 break; 5746 5747 case L2CAP_DISCONN_RSP: 5748 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 5749 break; 5750 5751 case L2CAP_ECHO_REQ: 5752 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 5753 break; 5754 5755 case L2CAP_ECHO_RSP: 5756 break; 5757 5758 case L2CAP_INFO_REQ: 5759 err = l2cap_information_req(conn, cmd, cmd_len, data); 5760 break; 5761 5762 case L2CAP_INFO_RSP: 5763 l2cap_information_rsp(conn, cmd, cmd_len, data); 5764 break; 5765 5766 case L2CAP_CREATE_CHAN_REQ: 5767 err = l2cap_create_channel_req(conn, cmd, cmd_len, data); 5768 break; 5769 5770 case L2CAP_MOVE_CHAN_REQ: 5771 err = l2cap_move_channel_req(conn, cmd, cmd_len, data); 5772 break; 5773 5774 case L2CAP_MOVE_CHAN_RSP: 5775 l2cap_move_channel_rsp(conn, cmd, cmd_len, data); 5776 break; 5777 5778 case L2CAP_MOVE_CHAN_CFM: 5779 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data); 5780 break; 5781 5782 case L2CAP_MOVE_CHAN_CFM_RSP: 5783 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data); 5784 break; 5785 5786 default: 5787 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 5788 err = -EINVAL; 5789 break; 5790 } 5791 5792 return err; 5793 } 5794 5795 static int l2cap_le_connect_req(struct l2cap_conn *conn, 5796 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5797 u8 *data) 5798 { 5799 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data; 5800 struct l2cap_le_conn_rsp rsp; 5801 struct l2cap_chan *chan, *pchan; 5802 u16 dcid, scid, credits, mtu, mps; 5803 __le16 psm; 5804 u8 result; 5805 5806 if (cmd_len != sizeof(*req)) 5807 return -EPROTO; 5808 5809 scid = __le16_to_cpu(req->scid); 5810 mtu = __le16_to_cpu(req->mtu); 5811 mps = __le16_to_cpu(req->mps); 5812 psm = req->psm; 5813 dcid = 0; 5814 credits = 0; 5815 5816 if (mtu < 23 || mps < 23) 5817 return -EPROTO; 5818 5819 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm), 5820 scid, mtu, mps); 5821 5822 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 5823 * page 1059: 5824 * 5825 * Valid range: 0x0001-0x00ff 5826 * 5827 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 5828 */ 5829 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 5830 result = L2CAP_CR_LE_BAD_PSM; 5831 chan = NULL; 5832 goto response; 5833 } 5834 5835 /* Check if we have socket listening on psm */ 5836 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5837 &conn->hcon->dst, LE_LINK); 5838 if (!pchan) { 5839 result = L2CAP_CR_LE_BAD_PSM; 5840 chan = NULL; 5841 goto response; 5842 } 5843 5844 mutex_lock(&conn->chan_lock); 5845 l2cap_chan_lock(pchan); 5846 5847 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5848 SMP_ALLOW_STK)) { 5849 result = L2CAP_CR_LE_AUTHENTICATION; 5850 chan = NULL; 5851 goto response_unlock; 5852 } 5853 5854 /* Check for valid dynamic CID range */ 5855 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5856 result = L2CAP_CR_LE_INVALID_SCID; 5857 chan = NULL; 5858 goto response_unlock; 5859 } 5860 5861 /* Check if we already have channel with that dcid */ 5862 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5863 result = L2CAP_CR_LE_SCID_IN_USE; 5864 chan = NULL; 5865 goto response_unlock; 5866 } 5867 5868 chan = pchan->ops->new_connection(pchan); 5869 if (!chan) { 5870 result = L2CAP_CR_LE_NO_MEM; 5871 goto response_unlock; 5872 } 5873 5874 bacpy(&chan->src, &conn->hcon->src); 5875 bacpy(&chan->dst, &conn->hcon->dst); 5876 chan->src_type = bdaddr_src_type(conn->hcon); 5877 chan->dst_type = bdaddr_dst_type(conn->hcon); 5878 chan->psm = psm; 5879 chan->dcid = scid; 5880 chan->omtu = mtu; 5881 chan->remote_mps = mps; 5882 5883 __l2cap_chan_add(conn, chan); 5884 5885 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits)); 5886 5887 dcid = chan->scid; 5888 credits = chan->rx_credits; 5889 5890 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5891 5892 chan->ident = cmd->ident; 5893 5894 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5895 l2cap_state_change(chan, BT_CONNECT2); 5896 /* The following result value is actually not defined 5897 * for LE CoC but we use it to let the function know 5898 * that it should bail out after doing its cleanup 5899 * instead of sending a response. 5900 */ 5901 result = L2CAP_CR_PEND; 5902 chan->ops->defer(chan); 5903 } else { 5904 l2cap_chan_ready(chan); 5905 result = L2CAP_CR_LE_SUCCESS; 5906 } 5907 5908 response_unlock: 5909 l2cap_chan_unlock(pchan); 5910 mutex_unlock(&conn->chan_lock); 5911 l2cap_chan_put(pchan); 5912 5913 if (result == L2CAP_CR_PEND) 5914 return 0; 5915 5916 response: 5917 if (chan) { 5918 rsp.mtu = cpu_to_le16(chan->imtu); 5919 rsp.mps = cpu_to_le16(chan->mps); 5920 } else { 5921 rsp.mtu = 0; 5922 rsp.mps = 0; 5923 } 5924 5925 rsp.dcid = cpu_to_le16(dcid); 5926 rsp.credits = cpu_to_le16(credits); 5927 rsp.result = cpu_to_le16(result); 5928 5929 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp); 5930 5931 return 0; 5932 } 5933 5934 static inline int l2cap_le_credits(struct l2cap_conn *conn, 5935 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5936 u8 *data) 5937 { 5938 struct l2cap_le_credits *pkt; 5939 struct l2cap_chan *chan; 5940 u16 cid, credits, max_credits; 5941 5942 if (cmd_len != sizeof(*pkt)) 5943 return -EPROTO; 5944 5945 pkt = (struct l2cap_le_credits *) data; 5946 cid = __le16_to_cpu(pkt->cid); 5947 credits = __le16_to_cpu(pkt->credits); 5948 5949 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits); 5950 5951 chan = l2cap_get_chan_by_dcid(conn, cid); 5952 if (!chan) 5953 return -EBADSLT; 5954 5955 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits; 5956 if (credits > max_credits) { 5957 BT_ERR("LE credits overflow"); 5958 l2cap_send_disconn_req(chan, ECONNRESET); 5959 5960 /* Return 0 so that we don't trigger an unnecessary 5961 * command reject packet. 5962 */ 5963 goto unlock; 5964 } 5965 5966 chan->tx_credits += credits; 5967 5968 /* Resume sending */ 5969 l2cap_le_flowctl_send(chan); 5970 5971 if (chan->tx_credits) 5972 chan->ops->resume(chan); 5973 5974 unlock: 5975 l2cap_chan_unlock(chan); 5976 l2cap_chan_put(chan); 5977 5978 return 0; 5979 } 5980 5981 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, 5982 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5983 u8 *data) 5984 { 5985 struct l2cap_ecred_conn_req *req = (void *) data; 5986 struct { 5987 struct l2cap_ecred_conn_rsp rsp; 5988 __le16 dcid[L2CAP_ECRED_MAX_CID]; 5989 } __packed pdu; 5990 struct l2cap_chan *chan, *pchan; 5991 u16 mtu, mps; 5992 __le16 psm; 5993 u8 result, len = 0; 5994 int i, num_scid; 5995 bool defer = false; 5996 5997 if (!enable_ecred) 5998 return -EINVAL; 5999 6000 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 6001 result = L2CAP_CR_LE_INVALID_PARAMS; 6002 goto response; 6003 } 6004 6005 cmd_len -= sizeof(*req); 6006 num_scid = cmd_len / sizeof(u16); 6007 6008 if (num_scid > ARRAY_SIZE(pdu.dcid)) { 6009 result = L2CAP_CR_LE_INVALID_PARAMS; 6010 goto response; 6011 } 6012 6013 mtu = __le16_to_cpu(req->mtu); 6014 mps = __le16_to_cpu(req->mps); 6015 6016 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) { 6017 result = L2CAP_CR_LE_UNACCEPT_PARAMS; 6018 goto response; 6019 } 6020 6021 psm = req->psm; 6022 6023 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 6024 * page 1059: 6025 * 6026 * Valid range: 0x0001-0x00ff 6027 * 6028 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 6029 */ 6030 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 6031 result = L2CAP_CR_LE_BAD_PSM; 6032 goto response; 6033 } 6034 6035 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps); 6036 6037 memset(&pdu, 0, sizeof(pdu)); 6038 6039 /* Check if we have socket listening on psm */ 6040 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 6041 &conn->hcon->dst, LE_LINK); 6042 if (!pchan) { 6043 result = L2CAP_CR_LE_BAD_PSM; 6044 goto response; 6045 } 6046 6047 mutex_lock(&conn->chan_lock); 6048 l2cap_chan_lock(pchan); 6049 6050 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 6051 SMP_ALLOW_STK)) { 6052 result = L2CAP_CR_LE_AUTHENTICATION; 6053 goto unlock; 6054 } 6055 6056 result = L2CAP_CR_LE_SUCCESS; 6057 6058 for (i = 0; i < num_scid; i++) { 6059 u16 scid = __le16_to_cpu(req->scid[i]); 6060 6061 BT_DBG("scid[%d] 0x%4.4x", i, scid); 6062 6063 pdu.dcid[i] = 0x0000; 6064 len += sizeof(*pdu.dcid); 6065 6066 /* Check for valid dynamic CID range */ 6067 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 6068 result = L2CAP_CR_LE_INVALID_SCID; 6069 continue; 6070 } 6071 6072 /* Check if we already have channel with that dcid */ 6073 if (__l2cap_get_chan_by_dcid(conn, scid)) { 6074 result = L2CAP_CR_LE_SCID_IN_USE; 6075 continue; 6076 } 6077 6078 chan = pchan->ops->new_connection(pchan); 6079 if (!chan) { 6080 result = L2CAP_CR_LE_NO_MEM; 6081 continue; 6082 } 6083 6084 bacpy(&chan->src, &conn->hcon->src); 6085 bacpy(&chan->dst, &conn->hcon->dst); 6086 chan->src_type = bdaddr_src_type(conn->hcon); 6087 chan->dst_type = bdaddr_dst_type(conn->hcon); 6088 chan->psm = psm; 6089 chan->dcid = scid; 6090 chan->omtu = mtu; 6091 chan->remote_mps = mps; 6092 6093 __l2cap_chan_add(conn, chan); 6094 6095 l2cap_ecred_init(chan, __le16_to_cpu(req->credits)); 6096 6097 /* Init response */ 6098 if (!pdu.rsp.credits) { 6099 pdu.rsp.mtu = cpu_to_le16(chan->imtu); 6100 pdu.rsp.mps = cpu_to_le16(chan->mps); 6101 pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 6102 } 6103 6104 pdu.dcid[i] = cpu_to_le16(chan->scid); 6105 6106 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 6107 6108 chan->ident = cmd->ident; 6109 chan->mode = L2CAP_MODE_EXT_FLOWCTL; 6110 6111 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 6112 l2cap_state_change(chan, BT_CONNECT2); 6113 defer = true; 6114 chan->ops->defer(chan); 6115 } else { 6116 l2cap_chan_ready(chan); 6117 } 6118 } 6119 6120 unlock: 6121 l2cap_chan_unlock(pchan); 6122 mutex_unlock(&conn->chan_lock); 6123 l2cap_chan_put(pchan); 6124 6125 response: 6126 pdu.rsp.result = cpu_to_le16(result); 6127 6128 if (defer) 6129 return 0; 6130 6131 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP, 6132 sizeof(pdu.rsp) + len, &pdu); 6133 6134 return 0; 6135 } 6136 6137 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 6138 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6139 u8 *data) 6140 { 6141 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 6142 struct hci_conn *hcon = conn->hcon; 6143 u16 mtu, mps, credits, result; 6144 struct l2cap_chan *chan, *tmp; 6145 int err = 0, sec_level; 6146 int i = 0; 6147 6148 if (cmd_len < sizeof(*rsp)) 6149 return -EPROTO; 6150 6151 mtu = __le16_to_cpu(rsp->mtu); 6152 mps = __le16_to_cpu(rsp->mps); 6153 credits = __le16_to_cpu(rsp->credits); 6154 result = __le16_to_cpu(rsp->result); 6155 6156 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, 6157 result); 6158 6159 mutex_lock(&conn->chan_lock); 6160 6161 cmd_len -= sizeof(*rsp); 6162 6163 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 6164 u16 dcid; 6165 6166 if (chan->ident != cmd->ident || 6167 chan->mode != L2CAP_MODE_EXT_FLOWCTL || 6168 chan->state == BT_CONNECTED) 6169 continue; 6170 6171 l2cap_chan_lock(chan); 6172 6173 /* Check that there is a dcid for each pending channel */ 6174 if (cmd_len < sizeof(dcid)) { 6175 l2cap_chan_del(chan, ECONNREFUSED); 6176 l2cap_chan_unlock(chan); 6177 continue; 6178 } 6179 6180 dcid = __le16_to_cpu(rsp->dcid[i++]); 6181 cmd_len -= sizeof(u16); 6182 6183 BT_DBG("dcid[%d] 0x%4.4x", i, dcid); 6184 6185 /* Check if dcid is already in use */ 6186 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) { 6187 /* If a device receives a 6188 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an 6189 * already-assigned Destination CID, then both the 6190 * original channel and the new channel shall be 6191 * immediately discarded and not used. 6192 */ 6193 l2cap_chan_del(chan, ECONNREFUSED); 6194 l2cap_chan_unlock(chan); 6195 chan = __l2cap_get_chan_by_dcid(conn, dcid); 6196 l2cap_chan_lock(chan); 6197 l2cap_chan_del(chan, ECONNRESET); 6198 l2cap_chan_unlock(chan); 6199 continue; 6200 } 6201 6202 switch (result) { 6203 case L2CAP_CR_LE_AUTHENTICATION: 6204 case L2CAP_CR_LE_ENCRYPTION: 6205 /* If we already have MITM protection we can't do 6206 * anything. 6207 */ 6208 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 6209 l2cap_chan_del(chan, ECONNREFUSED); 6210 break; 6211 } 6212 6213 sec_level = hcon->sec_level + 1; 6214 if (chan->sec_level < sec_level) 6215 chan->sec_level = sec_level; 6216 6217 /* We'll need to send a new Connect Request */ 6218 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags); 6219 6220 smp_conn_security(hcon, chan->sec_level); 6221 break; 6222 6223 case L2CAP_CR_LE_BAD_PSM: 6224 l2cap_chan_del(chan, ECONNREFUSED); 6225 break; 6226 6227 default: 6228 /* If dcid was not set it means channels was refused */ 6229 if (!dcid) { 6230 l2cap_chan_del(chan, ECONNREFUSED); 6231 break; 6232 } 6233 6234 chan->ident = 0; 6235 chan->dcid = dcid; 6236 chan->omtu = mtu; 6237 chan->remote_mps = mps; 6238 chan->tx_credits = credits; 6239 l2cap_chan_ready(chan); 6240 break; 6241 } 6242 6243 l2cap_chan_unlock(chan); 6244 } 6245 6246 mutex_unlock(&conn->chan_lock); 6247 6248 return err; 6249 } 6250 6251 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn, 6252 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6253 u8 *data) 6254 { 6255 struct l2cap_ecred_reconf_req *req = (void *) data; 6256 struct l2cap_ecred_reconf_rsp rsp; 6257 u16 mtu, mps, result; 6258 struct l2cap_chan *chan; 6259 int i, num_scid; 6260 6261 if (!enable_ecred) 6262 return -EINVAL; 6263 6264 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) { 6265 result = L2CAP_CR_LE_INVALID_PARAMS; 6266 goto respond; 6267 } 6268 6269 mtu = __le16_to_cpu(req->mtu); 6270 mps = __le16_to_cpu(req->mps); 6271 6272 BT_DBG("mtu %u mps %u", mtu, mps); 6273 6274 if (mtu < L2CAP_ECRED_MIN_MTU) { 6275 result = L2CAP_RECONF_INVALID_MTU; 6276 goto respond; 6277 } 6278 6279 if (mps < L2CAP_ECRED_MIN_MPS) { 6280 result = L2CAP_RECONF_INVALID_MPS; 6281 goto respond; 6282 } 6283 6284 cmd_len -= sizeof(*req); 6285 num_scid = cmd_len / sizeof(u16); 6286 result = L2CAP_RECONF_SUCCESS; 6287 6288 for (i = 0; i < num_scid; i++) { 6289 u16 scid; 6290 6291 scid = __le16_to_cpu(req->scid[i]); 6292 if (!scid) 6293 return -EPROTO; 6294 6295 chan = __l2cap_get_chan_by_dcid(conn, scid); 6296 if (!chan) 6297 continue; 6298 6299 /* If the MTU value is decreased for any of the included 6300 * channels, then the receiver shall disconnect all 6301 * included channels. 6302 */ 6303 if (chan->omtu > mtu) { 6304 BT_ERR("chan %p decreased MTU %u -> %u", chan, 6305 chan->omtu, mtu); 6306 result = L2CAP_RECONF_INVALID_MTU; 6307 } 6308 6309 chan->omtu = mtu; 6310 chan->remote_mps = mps; 6311 } 6312 6313 respond: 6314 rsp.result = cpu_to_le16(result); 6315 6316 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp), 6317 &rsp); 6318 6319 return 0; 6320 } 6321 6322 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 6323 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6324 u8 *data) 6325 { 6326 struct l2cap_chan *chan, *tmp; 6327 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 6328 u16 result; 6329 6330 if (cmd_len < sizeof(*rsp)) 6331 return -EPROTO; 6332 6333 result = __le16_to_cpu(rsp->result); 6334 6335 BT_DBG("result 0x%4.4x", rsp->result); 6336 6337 if (!result) 6338 return 0; 6339 6340 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 6341 if (chan->ident != cmd->ident) 6342 continue; 6343 6344 l2cap_chan_del(chan, ECONNRESET); 6345 } 6346 6347 return 0; 6348 } 6349 6350 static inline int l2cap_le_command_rej(struct l2cap_conn *conn, 6351 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6352 u8 *data) 6353 { 6354 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 6355 struct l2cap_chan *chan; 6356 6357 if (cmd_len < sizeof(*rej)) 6358 return -EPROTO; 6359 6360 mutex_lock(&conn->chan_lock); 6361 6362 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 6363 if (!chan) 6364 goto done; 6365 6366 l2cap_chan_lock(chan); 6367 l2cap_chan_del(chan, ECONNREFUSED); 6368 l2cap_chan_unlock(chan); 6369 6370 done: 6371 mutex_unlock(&conn->chan_lock); 6372 return 0; 6373 } 6374 6375 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 6376 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6377 u8 *data) 6378 { 6379 int err = 0; 6380 6381 switch (cmd->code) { 6382 case L2CAP_COMMAND_REJ: 6383 l2cap_le_command_rej(conn, cmd, cmd_len, data); 6384 break; 6385 6386 case L2CAP_CONN_PARAM_UPDATE_REQ: 6387 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data); 6388 break; 6389 6390 case L2CAP_CONN_PARAM_UPDATE_RSP: 6391 break; 6392 6393 case L2CAP_LE_CONN_RSP: 6394 l2cap_le_connect_rsp(conn, cmd, cmd_len, data); 6395 break; 6396 6397 case L2CAP_LE_CONN_REQ: 6398 err = l2cap_le_connect_req(conn, cmd, cmd_len, data); 6399 break; 6400 6401 case L2CAP_LE_CREDITS: 6402 err = l2cap_le_credits(conn, cmd, cmd_len, data); 6403 break; 6404 6405 case L2CAP_ECRED_CONN_REQ: 6406 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data); 6407 break; 6408 6409 case L2CAP_ECRED_CONN_RSP: 6410 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data); 6411 break; 6412 6413 case L2CAP_ECRED_RECONF_REQ: 6414 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data); 6415 break; 6416 6417 case L2CAP_ECRED_RECONF_RSP: 6418 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data); 6419 break; 6420 6421 case L2CAP_DISCONN_REQ: 6422 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 6423 break; 6424 6425 case L2CAP_DISCONN_RSP: 6426 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 6427 break; 6428 6429 default: 6430 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 6431 err = -EINVAL; 6432 break; 6433 } 6434 6435 return err; 6436 } 6437 6438 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 6439 struct sk_buff *skb) 6440 { 6441 struct hci_conn *hcon = conn->hcon; 6442 struct l2cap_cmd_hdr *cmd; 6443 u16 len; 6444 int err; 6445 6446 if (hcon->type != LE_LINK) 6447 goto drop; 6448 6449 if (skb->len < L2CAP_CMD_HDR_SIZE) 6450 goto drop; 6451 6452 cmd = (void *) skb->data; 6453 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 6454 6455 len = le16_to_cpu(cmd->len); 6456 6457 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident); 6458 6459 if (len != skb->len || !cmd->ident) { 6460 BT_DBG("corrupted command"); 6461 goto drop; 6462 } 6463 6464 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data); 6465 if (err) { 6466 struct l2cap_cmd_rej_unk rej; 6467 6468 BT_ERR("Wrong link type (%d)", err); 6469 6470 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 6471 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 6472 sizeof(rej), &rej); 6473 } 6474 6475 drop: 6476 kfree_skb(skb); 6477 } 6478 6479 static inline void l2cap_sig_channel(struct l2cap_conn *conn, 6480 struct sk_buff *skb) 6481 { 6482 struct hci_conn *hcon = conn->hcon; 6483 struct l2cap_cmd_hdr *cmd; 6484 int err; 6485 6486 l2cap_raw_recv(conn, skb); 6487 6488 if (hcon->type != ACL_LINK) 6489 goto drop; 6490 6491 while (skb->len >= L2CAP_CMD_HDR_SIZE) { 6492 u16 len; 6493 6494 cmd = (void *) skb->data; 6495 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 6496 6497 len = le16_to_cpu(cmd->len); 6498 6499 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, 6500 cmd->ident); 6501 6502 if (len > skb->len || !cmd->ident) { 6503 BT_DBG("corrupted command"); 6504 break; 6505 } 6506 6507 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); 6508 if (err) { 6509 struct l2cap_cmd_rej_unk rej; 6510 6511 BT_ERR("Wrong link type (%d)", err); 6512 6513 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 6514 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 6515 sizeof(rej), &rej); 6516 } 6517 6518 skb_pull(skb, len); 6519 } 6520 6521 drop: 6522 kfree_skb(skb); 6523 } 6524 6525 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 6526 { 6527 u16 our_fcs, rcv_fcs; 6528 int hdr_size; 6529 6530 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 6531 hdr_size = L2CAP_EXT_HDR_SIZE; 6532 else 6533 hdr_size = L2CAP_ENH_HDR_SIZE; 6534 6535 if (chan->fcs == L2CAP_FCS_CRC16) { 6536 skb_trim(skb, skb->len - L2CAP_FCS_SIZE); 6537 rcv_fcs = get_unaligned_le16(skb->data + skb->len); 6538 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 6539 6540 if (our_fcs != rcv_fcs) 6541 return -EBADMSG; 6542 } 6543 return 0; 6544 } 6545 6546 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 6547 { 6548 struct l2cap_ctrl control; 6549 6550 BT_DBG("chan %p", chan); 6551 6552 memset(&control, 0, sizeof(control)); 6553 control.sframe = 1; 6554 control.final = 1; 6555 control.reqseq = chan->buffer_seq; 6556 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6557 6558 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6559 control.super = L2CAP_SUPER_RNR; 6560 l2cap_send_sframe(chan, &control); 6561 } 6562 6563 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 6564 chan->unacked_frames > 0) 6565 __set_retrans_timer(chan); 6566 6567 /* Send pending iframes */ 6568 l2cap_ertm_send(chan); 6569 6570 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 6571 test_bit(CONN_SEND_FBIT, &chan->conn_state)) { 6572 /* F-bit wasn't sent in an s-frame or i-frame yet, so 6573 * send it now. 6574 */ 6575 control.super = L2CAP_SUPER_RR; 6576 l2cap_send_sframe(chan, &control); 6577 } 6578 } 6579 6580 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag, 6581 struct sk_buff **last_frag) 6582 { 6583 /* skb->len reflects data in skb as well as all fragments 6584 * skb->data_len reflects only data in fragments 6585 */ 6586 if (!skb_has_frag_list(skb)) 6587 skb_shinfo(skb)->frag_list = new_frag; 6588 6589 new_frag->next = NULL; 6590 6591 (*last_frag)->next = new_frag; 6592 *last_frag = new_frag; 6593 6594 skb->len += new_frag->len; 6595 skb->data_len += new_frag->len; 6596 skb->truesize += new_frag->truesize; 6597 } 6598 6599 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, 6600 struct l2cap_ctrl *control) 6601 { 6602 int err = -EINVAL; 6603 6604 switch (control->sar) { 6605 case L2CAP_SAR_UNSEGMENTED: 6606 if (chan->sdu) 6607 break; 6608 6609 err = chan->ops->recv(chan, skb); 6610 break; 6611 6612 case L2CAP_SAR_START: 6613 if (chan->sdu) 6614 break; 6615 6616 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) 6617 break; 6618 6619 chan->sdu_len = get_unaligned_le16(skb->data); 6620 skb_pull(skb, L2CAP_SDULEN_SIZE); 6621 6622 if (chan->sdu_len > chan->imtu) { 6623 err = -EMSGSIZE; 6624 break; 6625 } 6626 6627 if (skb->len >= chan->sdu_len) 6628 break; 6629 6630 chan->sdu = skb; 6631 chan->sdu_last_frag = skb; 6632 6633 skb = NULL; 6634 err = 0; 6635 break; 6636 6637 case L2CAP_SAR_CONTINUE: 6638 if (!chan->sdu) 6639 break; 6640 6641 append_skb_frag(chan->sdu, skb, 6642 &chan->sdu_last_frag); 6643 skb = NULL; 6644 6645 if (chan->sdu->len >= chan->sdu_len) 6646 break; 6647 6648 err = 0; 6649 break; 6650 6651 case L2CAP_SAR_END: 6652 if (!chan->sdu) 6653 break; 6654 6655 append_skb_frag(chan->sdu, skb, 6656 &chan->sdu_last_frag); 6657 skb = NULL; 6658 6659 if (chan->sdu->len != chan->sdu_len) 6660 break; 6661 6662 err = chan->ops->recv(chan, chan->sdu); 6663 6664 if (!err) { 6665 /* Reassembly complete */ 6666 chan->sdu = NULL; 6667 chan->sdu_last_frag = NULL; 6668 chan->sdu_len = 0; 6669 } 6670 break; 6671 } 6672 6673 if (err) { 6674 kfree_skb(skb); 6675 kfree_skb(chan->sdu); 6676 chan->sdu = NULL; 6677 chan->sdu_last_frag = NULL; 6678 chan->sdu_len = 0; 6679 } 6680 6681 return err; 6682 } 6683 6684 static int l2cap_resegment(struct l2cap_chan *chan) 6685 { 6686 /* Placeholder */ 6687 return 0; 6688 } 6689 6690 void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 6691 { 6692 u8 event; 6693 6694 if (chan->mode != L2CAP_MODE_ERTM) 6695 return; 6696 6697 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR; 6698 l2cap_tx(chan, NULL, NULL, event); 6699 } 6700 6701 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan) 6702 { 6703 int err = 0; 6704 /* Pass sequential frames to l2cap_reassemble_sdu() 6705 * until a gap is encountered. 6706 */ 6707 6708 BT_DBG("chan %p", chan); 6709 6710 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6711 struct sk_buff *skb; 6712 BT_DBG("Searching for skb with txseq %d (queue len %d)", 6713 chan->buffer_seq, skb_queue_len(&chan->srej_q)); 6714 6715 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq); 6716 6717 if (!skb) 6718 break; 6719 6720 skb_unlink(skb, &chan->srej_q); 6721 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6722 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap); 6723 if (err) 6724 break; 6725 } 6726 6727 if (skb_queue_empty(&chan->srej_q)) { 6728 chan->rx_state = L2CAP_RX_STATE_RECV; 6729 l2cap_send_ack(chan); 6730 } 6731 6732 return err; 6733 } 6734 6735 static void l2cap_handle_srej(struct l2cap_chan *chan, 6736 struct l2cap_ctrl *control) 6737 { 6738 struct sk_buff *skb; 6739 6740 BT_DBG("chan %p, control %p", chan, control); 6741 6742 if (control->reqseq == chan->next_tx_seq) { 6743 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6744 l2cap_send_disconn_req(chan, ECONNRESET); 6745 return; 6746 } 6747 6748 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6749 6750 if (skb == NULL) { 6751 BT_DBG("Seq %d not available for retransmission", 6752 control->reqseq); 6753 return; 6754 } 6755 6756 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6757 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6758 l2cap_send_disconn_req(chan, ECONNRESET); 6759 return; 6760 } 6761 6762 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6763 6764 if (control->poll) { 6765 l2cap_pass_to_tx(chan, control); 6766 6767 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6768 l2cap_retransmit(chan, control); 6769 l2cap_ertm_send(chan); 6770 6771 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6772 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6773 chan->srej_save_reqseq = control->reqseq; 6774 } 6775 } else { 6776 l2cap_pass_to_tx_fbit(chan, control); 6777 6778 if (control->final) { 6779 if (chan->srej_save_reqseq != control->reqseq || 6780 !test_and_clear_bit(CONN_SREJ_ACT, 6781 &chan->conn_state)) 6782 l2cap_retransmit(chan, control); 6783 } else { 6784 l2cap_retransmit(chan, control); 6785 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6786 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6787 chan->srej_save_reqseq = control->reqseq; 6788 } 6789 } 6790 } 6791 } 6792 6793 static void l2cap_handle_rej(struct l2cap_chan *chan, 6794 struct l2cap_ctrl *control) 6795 { 6796 struct sk_buff *skb; 6797 6798 BT_DBG("chan %p, control %p", chan, control); 6799 6800 if (control->reqseq == chan->next_tx_seq) { 6801 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6802 l2cap_send_disconn_req(chan, ECONNRESET); 6803 return; 6804 } 6805 6806 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6807 6808 if (chan->max_tx && skb && 6809 bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6810 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6811 l2cap_send_disconn_req(chan, ECONNRESET); 6812 return; 6813 } 6814 6815 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6816 6817 l2cap_pass_to_tx(chan, control); 6818 6819 if (control->final) { 6820 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 6821 l2cap_retransmit_all(chan, control); 6822 } else { 6823 l2cap_retransmit_all(chan, control); 6824 l2cap_ertm_send(chan); 6825 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) 6826 set_bit(CONN_REJ_ACT, &chan->conn_state); 6827 } 6828 } 6829 6830 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq) 6831 { 6832 BT_DBG("chan %p, txseq %d", chan, txseq); 6833 6834 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq, 6835 chan->expected_tx_seq); 6836 6837 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 6838 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6839 chan->tx_win) { 6840 /* See notes below regarding "double poll" and 6841 * invalid packets. 6842 */ 6843 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6844 BT_DBG("Invalid/Ignore - after SREJ"); 6845 return L2CAP_TXSEQ_INVALID_IGNORE; 6846 } else { 6847 BT_DBG("Invalid - in window after SREJ sent"); 6848 return L2CAP_TXSEQ_INVALID; 6849 } 6850 } 6851 6852 if (chan->srej_list.head == txseq) { 6853 BT_DBG("Expected SREJ"); 6854 return L2CAP_TXSEQ_EXPECTED_SREJ; 6855 } 6856 6857 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) { 6858 BT_DBG("Duplicate SREJ - txseq already stored"); 6859 return L2CAP_TXSEQ_DUPLICATE_SREJ; 6860 } 6861 6862 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) { 6863 BT_DBG("Unexpected SREJ - not requested"); 6864 return L2CAP_TXSEQ_UNEXPECTED_SREJ; 6865 } 6866 } 6867 6868 if (chan->expected_tx_seq == txseq) { 6869 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6870 chan->tx_win) { 6871 BT_DBG("Invalid - txseq outside tx window"); 6872 return L2CAP_TXSEQ_INVALID; 6873 } else { 6874 BT_DBG("Expected"); 6875 return L2CAP_TXSEQ_EXPECTED; 6876 } 6877 } 6878 6879 if (__seq_offset(chan, txseq, chan->last_acked_seq) < 6880 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) { 6881 BT_DBG("Duplicate - expected_tx_seq later than txseq"); 6882 return L2CAP_TXSEQ_DUPLICATE; 6883 } 6884 6885 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) { 6886 /* A source of invalid packets is a "double poll" condition, 6887 * where delays cause us to send multiple poll packets. If 6888 * the remote stack receives and processes both polls, 6889 * sequence numbers can wrap around in such a way that a 6890 * resent frame has a sequence number that looks like new data 6891 * with a sequence gap. This would trigger an erroneous SREJ 6892 * request. 6893 * 6894 * Fortunately, this is impossible with a tx window that's 6895 * less than half of the maximum sequence number, which allows 6896 * invalid frames to be safely ignored. 6897 * 6898 * With tx window sizes greater than half of the tx window 6899 * maximum, the frame is invalid and cannot be ignored. This 6900 * causes a disconnect. 6901 */ 6902 6903 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6904 BT_DBG("Invalid/Ignore - txseq outside tx window"); 6905 return L2CAP_TXSEQ_INVALID_IGNORE; 6906 } else { 6907 BT_DBG("Invalid - txseq outside tx window"); 6908 return L2CAP_TXSEQ_INVALID; 6909 } 6910 } else { 6911 BT_DBG("Unexpected - txseq indicates missing frames"); 6912 return L2CAP_TXSEQ_UNEXPECTED; 6913 } 6914 } 6915 6916 static int l2cap_rx_state_recv(struct l2cap_chan *chan, 6917 struct l2cap_ctrl *control, 6918 struct sk_buff *skb, u8 event) 6919 { 6920 struct l2cap_ctrl local_control; 6921 int err = 0; 6922 bool skb_in_use = false; 6923 6924 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6925 event); 6926 6927 switch (event) { 6928 case L2CAP_EV_RECV_IFRAME: 6929 switch (l2cap_classify_txseq(chan, control->txseq)) { 6930 case L2CAP_TXSEQ_EXPECTED: 6931 l2cap_pass_to_tx(chan, control); 6932 6933 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6934 BT_DBG("Busy, discarding expected seq %d", 6935 control->txseq); 6936 break; 6937 } 6938 6939 chan->expected_tx_seq = __next_seq(chan, 6940 control->txseq); 6941 6942 chan->buffer_seq = chan->expected_tx_seq; 6943 skb_in_use = true; 6944 6945 /* l2cap_reassemble_sdu may free skb, hence invalidate 6946 * control, so make a copy in advance to use it after 6947 * l2cap_reassemble_sdu returns and to avoid the race 6948 * condition, for example: 6949 * 6950 * The current thread calls: 6951 * l2cap_reassemble_sdu 6952 * chan->ops->recv == l2cap_sock_recv_cb 6953 * __sock_queue_rcv_skb 6954 * Another thread calls: 6955 * bt_sock_recvmsg 6956 * skb_recv_datagram 6957 * skb_free_datagram 6958 * Then the current thread tries to access control, but 6959 * it was freed by skb_free_datagram. 6960 */ 6961 local_control = *control; 6962 err = l2cap_reassemble_sdu(chan, skb, control); 6963 if (err) 6964 break; 6965 6966 if (local_control.final) { 6967 if (!test_and_clear_bit(CONN_REJ_ACT, 6968 &chan->conn_state)) { 6969 local_control.final = 0; 6970 l2cap_retransmit_all(chan, &local_control); 6971 l2cap_ertm_send(chan); 6972 } 6973 } 6974 6975 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 6976 l2cap_send_ack(chan); 6977 break; 6978 case L2CAP_TXSEQ_UNEXPECTED: 6979 l2cap_pass_to_tx(chan, control); 6980 6981 /* Can't issue SREJ frames in the local busy state. 6982 * Drop this frame, it will be seen as missing 6983 * when local busy is exited. 6984 */ 6985 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6986 BT_DBG("Busy, discarding unexpected seq %d", 6987 control->txseq); 6988 break; 6989 } 6990 6991 /* There was a gap in the sequence, so an SREJ 6992 * must be sent for each missing frame. The 6993 * current frame is stored for later use. 6994 */ 6995 skb_queue_tail(&chan->srej_q, skb); 6996 skb_in_use = true; 6997 BT_DBG("Queued %p (queue len %d)", skb, 6998 skb_queue_len(&chan->srej_q)); 6999 7000 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 7001 l2cap_seq_list_clear(&chan->srej_list); 7002 l2cap_send_srej(chan, control->txseq); 7003 7004 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT; 7005 break; 7006 case L2CAP_TXSEQ_DUPLICATE: 7007 l2cap_pass_to_tx(chan, control); 7008 break; 7009 case L2CAP_TXSEQ_INVALID_IGNORE: 7010 break; 7011 case L2CAP_TXSEQ_INVALID: 7012 default: 7013 l2cap_send_disconn_req(chan, ECONNRESET); 7014 break; 7015 } 7016 break; 7017 case L2CAP_EV_RECV_RR: 7018 l2cap_pass_to_tx(chan, control); 7019 if (control->final) { 7020 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7021 7022 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) && 7023 !__chan_is_moving(chan)) { 7024 control->final = 0; 7025 l2cap_retransmit_all(chan, control); 7026 } 7027 7028 l2cap_ertm_send(chan); 7029 } else if (control->poll) { 7030 l2cap_send_i_or_rr_or_rnr(chan); 7031 } else { 7032 if (test_and_clear_bit(CONN_REMOTE_BUSY, 7033 &chan->conn_state) && 7034 chan->unacked_frames) 7035 __set_retrans_timer(chan); 7036 7037 l2cap_ertm_send(chan); 7038 } 7039 break; 7040 case L2CAP_EV_RECV_RNR: 7041 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7042 l2cap_pass_to_tx(chan, control); 7043 if (control && control->poll) { 7044 set_bit(CONN_SEND_FBIT, &chan->conn_state); 7045 l2cap_send_rr_or_rnr(chan, 0); 7046 } 7047 __clear_retrans_timer(chan); 7048 l2cap_seq_list_clear(&chan->retrans_list); 7049 break; 7050 case L2CAP_EV_RECV_REJ: 7051 l2cap_handle_rej(chan, control); 7052 break; 7053 case L2CAP_EV_RECV_SREJ: 7054 l2cap_handle_srej(chan, control); 7055 break; 7056 default: 7057 break; 7058 } 7059 7060 if (skb && !skb_in_use) { 7061 BT_DBG("Freeing %p", skb); 7062 kfree_skb(skb); 7063 } 7064 7065 return err; 7066 } 7067 7068 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan, 7069 struct l2cap_ctrl *control, 7070 struct sk_buff *skb, u8 event) 7071 { 7072 int err = 0; 7073 u16 txseq = control->txseq; 7074 bool skb_in_use = false; 7075 7076 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 7077 event); 7078 7079 switch (event) { 7080 case L2CAP_EV_RECV_IFRAME: 7081 switch (l2cap_classify_txseq(chan, txseq)) { 7082 case L2CAP_TXSEQ_EXPECTED: 7083 /* Keep frame for reassembly later */ 7084 l2cap_pass_to_tx(chan, control); 7085 skb_queue_tail(&chan->srej_q, skb); 7086 skb_in_use = true; 7087 BT_DBG("Queued %p (queue len %d)", skb, 7088 skb_queue_len(&chan->srej_q)); 7089 7090 chan->expected_tx_seq = __next_seq(chan, txseq); 7091 break; 7092 case L2CAP_TXSEQ_EXPECTED_SREJ: 7093 l2cap_seq_list_pop(&chan->srej_list); 7094 7095 l2cap_pass_to_tx(chan, control); 7096 skb_queue_tail(&chan->srej_q, skb); 7097 skb_in_use = true; 7098 BT_DBG("Queued %p (queue len %d)", skb, 7099 skb_queue_len(&chan->srej_q)); 7100 7101 err = l2cap_rx_queued_iframes(chan); 7102 if (err) 7103 break; 7104 7105 break; 7106 case L2CAP_TXSEQ_UNEXPECTED: 7107 /* Got a frame that can't be reassembled yet. 7108 * Save it for later, and send SREJs to cover 7109 * the missing frames. 7110 */ 7111 skb_queue_tail(&chan->srej_q, skb); 7112 skb_in_use = true; 7113 BT_DBG("Queued %p (queue len %d)", skb, 7114 skb_queue_len(&chan->srej_q)); 7115 7116 l2cap_pass_to_tx(chan, control); 7117 l2cap_send_srej(chan, control->txseq); 7118 break; 7119 case L2CAP_TXSEQ_UNEXPECTED_SREJ: 7120 /* This frame was requested with an SREJ, but 7121 * some expected retransmitted frames are 7122 * missing. Request retransmission of missing 7123 * SREJ'd frames. 7124 */ 7125 skb_queue_tail(&chan->srej_q, skb); 7126 skb_in_use = true; 7127 BT_DBG("Queued %p (queue len %d)", skb, 7128 skb_queue_len(&chan->srej_q)); 7129 7130 l2cap_pass_to_tx(chan, control); 7131 l2cap_send_srej_list(chan, control->txseq); 7132 break; 7133 case L2CAP_TXSEQ_DUPLICATE_SREJ: 7134 /* We've already queued this frame. Drop this copy. */ 7135 l2cap_pass_to_tx(chan, control); 7136 break; 7137 case L2CAP_TXSEQ_DUPLICATE: 7138 /* Expecting a later sequence number, so this frame 7139 * was already received. Ignore it completely. 7140 */ 7141 break; 7142 case L2CAP_TXSEQ_INVALID_IGNORE: 7143 break; 7144 case L2CAP_TXSEQ_INVALID: 7145 default: 7146 l2cap_send_disconn_req(chan, ECONNRESET); 7147 break; 7148 } 7149 break; 7150 case L2CAP_EV_RECV_RR: 7151 l2cap_pass_to_tx(chan, control); 7152 if (control->final) { 7153 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7154 7155 if (!test_and_clear_bit(CONN_REJ_ACT, 7156 &chan->conn_state)) { 7157 control->final = 0; 7158 l2cap_retransmit_all(chan, control); 7159 } 7160 7161 l2cap_ertm_send(chan); 7162 } else if (control->poll) { 7163 if (test_and_clear_bit(CONN_REMOTE_BUSY, 7164 &chan->conn_state) && 7165 chan->unacked_frames) { 7166 __set_retrans_timer(chan); 7167 } 7168 7169 set_bit(CONN_SEND_FBIT, &chan->conn_state); 7170 l2cap_send_srej_tail(chan); 7171 } else { 7172 if (test_and_clear_bit(CONN_REMOTE_BUSY, 7173 &chan->conn_state) && 7174 chan->unacked_frames) 7175 __set_retrans_timer(chan); 7176 7177 l2cap_send_ack(chan); 7178 } 7179 break; 7180 case L2CAP_EV_RECV_RNR: 7181 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7182 l2cap_pass_to_tx(chan, control); 7183 if (control->poll) { 7184 l2cap_send_srej_tail(chan); 7185 } else { 7186 struct l2cap_ctrl rr_control; 7187 memset(&rr_control, 0, sizeof(rr_control)); 7188 rr_control.sframe = 1; 7189 rr_control.super = L2CAP_SUPER_RR; 7190 rr_control.reqseq = chan->buffer_seq; 7191 l2cap_send_sframe(chan, &rr_control); 7192 } 7193 7194 break; 7195 case L2CAP_EV_RECV_REJ: 7196 l2cap_handle_rej(chan, control); 7197 break; 7198 case L2CAP_EV_RECV_SREJ: 7199 l2cap_handle_srej(chan, control); 7200 break; 7201 } 7202 7203 if (skb && !skb_in_use) { 7204 BT_DBG("Freeing %p", skb); 7205 kfree_skb(skb); 7206 } 7207 7208 return err; 7209 } 7210 7211 static int l2cap_finish_move(struct l2cap_chan *chan) 7212 { 7213 BT_DBG("chan %p", chan); 7214 7215 chan->rx_state = L2CAP_RX_STATE_RECV; 7216 7217 if (chan->hs_hcon) 7218 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; 7219 else 7220 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; 7221 7222 return l2cap_resegment(chan); 7223 } 7224 7225 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan, 7226 struct l2cap_ctrl *control, 7227 struct sk_buff *skb, u8 event) 7228 { 7229 int err; 7230 7231 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 7232 event); 7233 7234 if (!control->poll) 7235 return -EPROTO; 7236 7237 l2cap_process_reqseq(chan, control->reqseq); 7238 7239 if (!skb_queue_empty(&chan->tx_q)) 7240 chan->tx_send_head = skb_peek(&chan->tx_q); 7241 else 7242 chan->tx_send_head = NULL; 7243 7244 /* Rewind next_tx_seq to the point expected 7245 * by the receiver. 7246 */ 7247 chan->next_tx_seq = control->reqseq; 7248 chan->unacked_frames = 0; 7249 7250 err = l2cap_finish_move(chan); 7251 if (err) 7252 return err; 7253 7254 set_bit(CONN_SEND_FBIT, &chan->conn_state); 7255 l2cap_send_i_or_rr_or_rnr(chan); 7256 7257 if (event == L2CAP_EV_RECV_IFRAME) 7258 return -EPROTO; 7259 7260 return l2cap_rx_state_recv(chan, control, NULL, event); 7261 } 7262 7263 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, 7264 struct l2cap_ctrl *control, 7265 struct sk_buff *skb, u8 event) 7266 { 7267 int err; 7268 7269 if (!control->final) 7270 return -EPROTO; 7271 7272 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7273 7274 chan->rx_state = L2CAP_RX_STATE_RECV; 7275 l2cap_process_reqseq(chan, control->reqseq); 7276 7277 if (!skb_queue_empty(&chan->tx_q)) 7278 chan->tx_send_head = skb_peek(&chan->tx_q); 7279 else 7280 chan->tx_send_head = NULL; 7281 7282 /* Rewind next_tx_seq to the point expected 7283 * by the receiver. 7284 */ 7285 chan->next_tx_seq = control->reqseq; 7286 chan->unacked_frames = 0; 7287 7288 if (chan->hs_hcon) 7289 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; 7290 else 7291 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; 7292 7293 err = l2cap_resegment(chan); 7294 7295 if (!err) 7296 err = l2cap_rx_state_recv(chan, control, skb, event); 7297 7298 return err; 7299 } 7300 7301 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq) 7302 { 7303 /* Make sure reqseq is for a packet that has been sent but not acked */ 7304 u16 unacked; 7305 7306 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq); 7307 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked; 7308 } 7309 7310 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 7311 struct sk_buff *skb, u8 event) 7312 { 7313 int err = 0; 7314 7315 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan, 7316 control, skb, event, chan->rx_state); 7317 7318 if (__valid_reqseq(chan, control->reqseq)) { 7319 switch (chan->rx_state) { 7320 case L2CAP_RX_STATE_RECV: 7321 err = l2cap_rx_state_recv(chan, control, skb, event); 7322 break; 7323 case L2CAP_RX_STATE_SREJ_SENT: 7324 err = l2cap_rx_state_srej_sent(chan, control, skb, 7325 event); 7326 break; 7327 case L2CAP_RX_STATE_WAIT_P: 7328 err = l2cap_rx_state_wait_p(chan, control, skb, event); 7329 break; 7330 case L2CAP_RX_STATE_WAIT_F: 7331 err = l2cap_rx_state_wait_f(chan, control, skb, event); 7332 break; 7333 default: 7334 /* shut it down */ 7335 break; 7336 } 7337 } else { 7338 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d", 7339 control->reqseq, chan->next_tx_seq, 7340 chan->expected_ack_seq); 7341 l2cap_send_disconn_req(chan, ECONNRESET); 7342 } 7343 7344 return err; 7345 } 7346 7347 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 7348 struct sk_buff *skb) 7349 { 7350 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store 7351 * the txseq field in advance to use it after l2cap_reassemble_sdu 7352 * returns and to avoid the race condition, for example: 7353 * 7354 * The current thread calls: 7355 * l2cap_reassemble_sdu 7356 * chan->ops->recv == l2cap_sock_recv_cb 7357 * __sock_queue_rcv_skb 7358 * Another thread calls: 7359 * bt_sock_recvmsg 7360 * skb_recv_datagram 7361 * skb_free_datagram 7362 * Then the current thread tries to access control, but it was freed by 7363 * skb_free_datagram. 7364 */ 7365 u16 txseq = control->txseq; 7366 7367 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, 7368 chan->rx_state); 7369 7370 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { 7371 l2cap_pass_to_tx(chan, control); 7372 7373 BT_DBG("buffer_seq %u->%u", chan->buffer_seq, 7374 __next_seq(chan, chan->buffer_seq)); 7375 7376 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 7377 7378 l2cap_reassemble_sdu(chan, skb, control); 7379 } else { 7380 if (chan->sdu) { 7381 kfree_skb(chan->sdu); 7382 chan->sdu = NULL; 7383 } 7384 chan->sdu_last_frag = NULL; 7385 chan->sdu_len = 0; 7386 7387 if (skb) { 7388 BT_DBG("Freeing %p", skb); 7389 kfree_skb(skb); 7390 } 7391 } 7392 7393 chan->last_acked_seq = txseq; 7394 chan->expected_tx_seq = __next_seq(chan, txseq); 7395 7396 return 0; 7397 } 7398 7399 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 7400 { 7401 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap; 7402 u16 len; 7403 u8 event; 7404 7405 __unpack_control(chan, skb); 7406 7407 len = skb->len; 7408 7409 /* 7410 * We can just drop the corrupted I-frame here. 7411 * Receiver will miss it and start proper recovery 7412 * procedures and ask for retransmission. 7413 */ 7414 if (l2cap_check_fcs(chan, skb)) 7415 goto drop; 7416 7417 if (!control->sframe && control->sar == L2CAP_SAR_START) 7418 len -= L2CAP_SDULEN_SIZE; 7419 7420 if (chan->fcs == L2CAP_FCS_CRC16) 7421 len -= L2CAP_FCS_SIZE; 7422 7423 if (len > chan->mps) { 7424 l2cap_send_disconn_req(chan, ECONNRESET); 7425 goto drop; 7426 } 7427 7428 if (chan->ops->filter) { 7429 if (chan->ops->filter(chan, skb)) 7430 goto drop; 7431 } 7432 7433 if (!control->sframe) { 7434 int err; 7435 7436 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d", 7437 control->sar, control->reqseq, control->final, 7438 control->txseq); 7439 7440 /* Validate F-bit - F=0 always valid, F=1 only 7441 * valid in TX WAIT_F 7442 */ 7443 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F) 7444 goto drop; 7445 7446 if (chan->mode != L2CAP_MODE_STREAMING) { 7447 event = L2CAP_EV_RECV_IFRAME; 7448 err = l2cap_rx(chan, control, skb, event); 7449 } else { 7450 err = l2cap_stream_rx(chan, control, skb); 7451 } 7452 7453 if (err) 7454 l2cap_send_disconn_req(chan, ECONNRESET); 7455 } else { 7456 const u8 rx_func_to_event[4] = { 7457 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ, 7458 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ 7459 }; 7460 7461 /* Only I-frames are expected in streaming mode */ 7462 if (chan->mode == L2CAP_MODE_STREAMING) 7463 goto drop; 7464 7465 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d", 7466 control->reqseq, control->final, control->poll, 7467 control->super); 7468 7469 if (len != 0) { 7470 BT_ERR("Trailing bytes: %d in sframe", len); 7471 l2cap_send_disconn_req(chan, ECONNRESET); 7472 goto drop; 7473 } 7474 7475 /* Validate F and P bits */ 7476 if (control->final && (control->poll || 7477 chan->tx_state != L2CAP_TX_STATE_WAIT_F)) 7478 goto drop; 7479 7480 event = rx_func_to_event[control->super]; 7481 if (l2cap_rx(chan, control, skb, event)) 7482 l2cap_send_disconn_req(chan, ECONNRESET); 7483 } 7484 7485 return 0; 7486 7487 drop: 7488 kfree_skb(skb); 7489 return 0; 7490 } 7491 7492 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) 7493 { 7494 struct l2cap_conn *conn = chan->conn; 7495 struct l2cap_le_credits pkt; 7496 u16 return_credits; 7497 7498 return_credits = (chan->imtu / chan->mps) + 1; 7499 7500 if (chan->rx_credits >= return_credits) 7501 return; 7502 7503 return_credits -= chan->rx_credits; 7504 7505 BT_DBG("chan %p returning %u credits to sender", chan, return_credits); 7506 7507 chan->rx_credits += return_credits; 7508 7509 pkt.cid = cpu_to_le16(chan->scid); 7510 pkt.credits = cpu_to_le16(return_credits); 7511 7512 chan->ident = l2cap_get_ident(conn); 7513 7514 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); 7515 } 7516 7517 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) 7518 { 7519 int err; 7520 7521 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len); 7522 7523 /* Wait recv to confirm reception before updating the credits */ 7524 err = chan->ops->recv(chan, skb); 7525 7526 /* Update credits whenever an SDU is received */ 7527 l2cap_chan_le_send_credits(chan); 7528 7529 return err; 7530 } 7531 7532 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 7533 { 7534 int err; 7535 7536 if (!chan->rx_credits) { 7537 BT_ERR("No credits to receive LE L2CAP data"); 7538 l2cap_send_disconn_req(chan, ECONNRESET); 7539 return -ENOBUFS; 7540 } 7541 7542 if (chan->imtu < skb->len) { 7543 BT_ERR("Too big LE L2CAP PDU"); 7544 return -ENOBUFS; 7545 } 7546 7547 chan->rx_credits--; 7548 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits); 7549 7550 /* Update if remote had run out of credits, this should only happens 7551 * if the remote is not using the entire MPS. 7552 */ 7553 if (!chan->rx_credits) 7554 l2cap_chan_le_send_credits(chan); 7555 7556 err = 0; 7557 7558 if (!chan->sdu) { 7559 u16 sdu_len; 7560 7561 sdu_len = get_unaligned_le16(skb->data); 7562 skb_pull(skb, L2CAP_SDULEN_SIZE); 7563 7564 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u", 7565 sdu_len, skb->len, chan->imtu); 7566 7567 if (sdu_len > chan->imtu) { 7568 BT_ERR("Too big LE L2CAP SDU length received"); 7569 err = -EMSGSIZE; 7570 goto failed; 7571 } 7572 7573 if (skb->len > sdu_len) { 7574 BT_ERR("Too much LE L2CAP data received"); 7575 err = -EINVAL; 7576 goto failed; 7577 } 7578 7579 if (skb->len == sdu_len) 7580 return l2cap_ecred_recv(chan, skb); 7581 7582 chan->sdu = skb; 7583 chan->sdu_len = sdu_len; 7584 chan->sdu_last_frag = skb; 7585 7586 /* Detect if remote is not able to use the selected MPS */ 7587 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { 7588 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; 7589 7590 /* Adjust the number of credits */ 7591 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); 7592 chan->mps = mps_len; 7593 l2cap_chan_le_send_credits(chan); 7594 } 7595 7596 return 0; 7597 } 7598 7599 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u", 7600 chan->sdu->len, skb->len, chan->sdu_len); 7601 7602 if (chan->sdu->len + skb->len > chan->sdu_len) { 7603 BT_ERR("Too much LE L2CAP data received"); 7604 err = -EINVAL; 7605 goto failed; 7606 } 7607 7608 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag); 7609 skb = NULL; 7610 7611 if (chan->sdu->len == chan->sdu_len) { 7612 err = l2cap_ecred_recv(chan, chan->sdu); 7613 if (!err) { 7614 chan->sdu = NULL; 7615 chan->sdu_last_frag = NULL; 7616 chan->sdu_len = 0; 7617 } 7618 } 7619 7620 failed: 7621 if (err) { 7622 kfree_skb(skb); 7623 kfree_skb(chan->sdu); 7624 chan->sdu = NULL; 7625 chan->sdu_last_frag = NULL; 7626 chan->sdu_len = 0; 7627 } 7628 7629 /* We can't return an error here since we took care of the skb 7630 * freeing internally. An error return would cause the caller to 7631 * do a double-free of the skb. 7632 */ 7633 return 0; 7634 } 7635 7636 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, 7637 struct sk_buff *skb) 7638 { 7639 struct l2cap_chan *chan; 7640 7641 chan = l2cap_get_chan_by_scid(conn, cid); 7642 if (!chan) { 7643 if (cid == L2CAP_CID_A2MP) { 7644 chan = a2mp_channel_create(conn, skb); 7645 if (!chan) { 7646 kfree_skb(skb); 7647 return; 7648 } 7649 7650 l2cap_chan_hold(chan); 7651 l2cap_chan_lock(chan); 7652 } else { 7653 BT_DBG("unknown cid 0x%4.4x", cid); 7654 /* Drop packet and return */ 7655 kfree_skb(skb); 7656 return; 7657 } 7658 } 7659 7660 BT_DBG("chan %p, len %d", chan, skb->len); 7661 7662 /* If we receive data on a fixed channel before the info req/rsp 7663 * procedure is done simply assume that the channel is supported 7664 * and mark it as ready. 7665 */ 7666 if (chan->chan_type == L2CAP_CHAN_FIXED) 7667 l2cap_chan_ready(chan); 7668 7669 if (chan->state != BT_CONNECTED) 7670 goto drop; 7671 7672 switch (chan->mode) { 7673 case L2CAP_MODE_LE_FLOWCTL: 7674 case L2CAP_MODE_EXT_FLOWCTL: 7675 if (l2cap_ecred_data_rcv(chan, skb) < 0) 7676 goto drop; 7677 7678 goto done; 7679 7680 case L2CAP_MODE_BASIC: 7681 /* If socket recv buffers overflows we drop data here 7682 * which is *bad* because L2CAP has to be reliable. 7683 * But we don't have any other choice. L2CAP doesn't 7684 * provide flow control mechanism. */ 7685 7686 if (chan->imtu < skb->len) { 7687 BT_ERR("Dropping L2CAP data: receive buffer overflow"); 7688 goto drop; 7689 } 7690 7691 if (!chan->ops->recv(chan, skb)) 7692 goto done; 7693 break; 7694 7695 case L2CAP_MODE_ERTM: 7696 case L2CAP_MODE_STREAMING: 7697 l2cap_data_rcv(chan, skb); 7698 goto done; 7699 7700 default: 7701 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 7702 break; 7703 } 7704 7705 drop: 7706 kfree_skb(skb); 7707 7708 done: 7709 l2cap_chan_unlock(chan); 7710 l2cap_chan_put(chan); 7711 } 7712 7713 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, 7714 struct sk_buff *skb) 7715 { 7716 struct hci_conn *hcon = conn->hcon; 7717 struct l2cap_chan *chan; 7718 7719 if (hcon->type != ACL_LINK) 7720 goto free_skb; 7721 7722 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst, 7723 ACL_LINK); 7724 if (!chan) 7725 goto free_skb; 7726 7727 BT_DBG("chan %p, len %d", chan, skb->len); 7728 7729 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 7730 goto drop; 7731 7732 if (chan->imtu < skb->len) 7733 goto drop; 7734 7735 /* Store remote BD_ADDR and PSM for msg_name */ 7736 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst); 7737 bt_cb(skb)->l2cap.psm = psm; 7738 7739 if (!chan->ops->recv(chan, skb)) { 7740 l2cap_chan_put(chan); 7741 return; 7742 } 7743 7744 drop: 7745 l2cap_chan_put(chan); 7746 free_skb: 7747 kfree_skb(skb); 7748 } 7749 7750 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 7751 { 7752 struct l2cap_hdr *lh = (void *) skb->data; 7753 struct hci_conn *hcon = conn->hcon; 7754 u16 cid, len; 7755 __le16 psm; 7756 7757 if (hcon->state != BT_CONNECTED) { 7758 BT_DBG("queueing pending rx skb"); 7759 skb_queue_tail(&conn->pending_rx, skb); 7760 return; 7761 } 7762 7763 skb_pull(skb, L2CAP_HDR_SIZE); 7764 cid = __le16_to_cpu(lh->cid); 7765 len = __le16_to_cpu(lh->len); 7766 7767 if (len != skb->len) { 7768 kfree_skb(skb); 7769 return; 7770 } 7771 7772 /* Since we can't actively block incoming LE connections we must 7773 * at least ensure that we ignore incoming data from them. 7774 */ 7775 if (hcon->type == LE_LINK && 7776 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst, 7777 bdaddr_dst_type(hcon))) { 7778 kfree_skb(skb); 7779 return; 7780 } 7781 7782 BT_DBG("len %d, cid 0x%4.4x", len, cid); 7783 7784 switch (cid) { 7785 case L2CAP_CID_SIGNALING: 7786 l2cap_sig_channel(conn, skb); 7787 break; 7788 7789 case L2CAP_CID_CONN_LESS: 7790 psm = get_unaligned((__le16 *) skb->data); 7791 skb_pull(skb, L2CAP_PSMLEN_SIZE); 7792 l2cap_conless_channel(conn, psm, skb); 7793 break; 7794 7795 case L2CAP_CID_LE_SIGNALING: 7796 l2cap_le_sig_channel(conn, skb); 7797 break; 7798 7799 default: 7800 l2cap_data_channel(conn, cid, skb); 7801 break; 7802 } 7803 } 7804 7805 static void process_pending_rx(struct work_struct *work) 7806 { 7807 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 7808 pending_rx_work); 7809 struct sk_buff *skb; 7810 7811 BT_DBG(""); 7812 7813 while ((skb = skb_dequeue(&conn->pending_rx))) 7814 l2cap_recv_frame(conn, skb); 7815 } 7816 7817 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) 7818 { 7819 struct l2cap_conn *conn = hcon->l2cap_data; 7820 struct hci_chan *hchan; 7821 7822 if (conn) 7823 return conn; 7824 7825 hchan = hci_chan_create(hcon); 7826 if (!hchan) 7827 return NULL; 7828 7829 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 7830 if (!conn) { 7831 hci_chan_del(hchan); 7832 return NULL; 7833 } 7834 7835 kref_init(&conn->ref); 7836 hcon->l2cap_data = conn; 7837 conn->hcon = hci_conn_get(hcon); 7838 conn->hchan = hchan; 7839 7840 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); 7841 7842 switch (hcon->type) { 7843 case LE_LINK: 7844 if (hcon->hdev->le_mtu) { 7845 conn->mtu = hcon->hdev->le_mtu; 7846 break; 7847 } 7848 fallthrough; 7849 default: 7850 conn->mtu = hcon->hdev->acl_mtu; 7851 break; 7852 } 7853 7854 conn->feat_mask = 0; 7855 7856 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; 7857 7858 if (hcon->type == ACL_LINK && 7859 hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED)) 7860 conn->local_fixed_chan |= L2CAP_FC_A2MP; 7861 7862 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) && 7863 (bredr_sc_enabled(hcon->hdev) || 7864 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP))) 7865 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; 7866 7867 mutex_init(&conn->ident_lock); 7868 mutex_init(&conn->chan_lock); 7869 7870 INIT_LIST_HEAD(&conn->chan_l); 7871 INIT_LIST_HEAD(&conn->users); 7872 7873 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout); 7874 7875 skb_queue_head_init(&conn->pending_rx); 7876 INIT_WORK(&conn->pending_rx_work, process_pending_rx); 7877 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr); 7878 7879 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 7880 7881 return conn; 7882 } 7883 7884 static bool is_valid_psm(u16 psm, u8 dst_type) 7885 { 7886 if (!psm) 7887 return false; 7888 7889 if (bdaddr_type_is_le(dst_type)) 7890 return (psm <= 0x00ff); 7891 7892 /* PSM must be odd and lsb of upper byte must be 0 */ 7893 return ((psm & 0x0101) == 0x0001); 7894 } 7895 7896 struct l2cap_chan_data { 7897 struct l2cap_chan *chan; 7898 struct pid *pid; 7899 int count; 7900 }; 7901 7902 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data) 7903 { 7904 struct l2cap_chan_data *d = data; 7905 struct pid *pid; 7906 7907 if (chan == d->chan) 7908 return; 7909 7910 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 7911 return; 7912 7913 pid = chan->ops->get_peer_pid(chan); 7914 7915 /* Only count deferred channels with the same PID/PSM */ 7916 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident || 7917 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 7918 return; 7919 7920 d->count++; 7921 } 7922 7923 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, 7924 bdaddr_t *dst, u8 dst_type) 7925 { 7926 struct l2cap_conn *conn; 7927 struct hci_conn *hcon; 7928 struct hci_dev *hdev; 7929 int err; 7930 7931 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src, 7932 dst, dst_type, __le16_to_cpu(psm), chan->mode); 7933 7934 hdev = hci_get_route(dst, &chan->src, chan->src_type); 7935 if (!hdev) 7936 return -EHOSTUNREACH; 7937 7938 hci_dev_lock(hdev); 7939 7940 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid && 7941 chan->chan_type != L2CAP_CHAN_RAW) { 7942 err = -EINVAL; 7943 goto done; 7944 } 7945 7946 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) { 7947 err = -EINVAL; 7948 goto done; 7949 } 7950 7951 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) { 7952 err = -EINVAL; 7953 goto done; 7954 } 7955 7956 switch (chan->mode) { 7957 case L2CAP_MODE_BASIC: 7958 break; 7959 case L2CAP_MODE_LE_FLOWCTL: 7960 break; 7961 case L2CAP_MODE_EXT_FLOWCTL: 7962 if (!enable_ecred) { 7963 err = -EOPNOTSUPP; 7964 goto done; 7965 } 7966 break; 7967 case L2CAP_MODE_ERTM: 7968 case L2CAP_MODE_STREAMING: 7969 if (!disable_ertm) 7970 break; 7971 fallthrough; 7972 default: 7973 err = -EOPNOTSUPP; 7974 goto done; 7975 } 7976 7977 switch (chan->state) { 7978 case BT_CONNECT: 7979 case BT_CONNECT2: 7980 case BT_CONFIG: 7981 /* Already connecting */ 7982 err = 0; 7983 goto done; 7984 7985 case BT_CONNECTED: 7986 /* Already connected */ 7987 err = -EISCONN; 7988 goto done; 7989 7990 case BT_OPEN: 7991 case BT_BOUND: 7992 /* Can connect */ 7993 break; 7994 7995 default: 7996 err = -EBADFD; 7997 goto done; 7998 } 7999 8000 /* Set destination address and psm */ 8001 bacpy(&chan->dst, dst); 8002 chan->dst_type = dst_type; 8003 8004 chan->psm = psm; 8005 chan->dcid = cid; 8006 8007 if (bdaddr_type_is_le(dst_type)) { 8008 /* Convert from L2CAP channel address type to HCI address type 8009 */ 8010 if (dst_type == BDADDR_LE_PUBLIC) 8011 dst_type = ADDR_LE_DEV_PUBLIC; 8012 else 8013 dst_type = ADDR_LE_DEV_RANDOM; 8014 8015 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8016 hcon = hci_connect_le(hdev, dst, dst_type, false, 8017 chan->sec_level, 8018 HCI_LE_CONN_TIMEOUT, 8019 HCI_ROLE_SLAVE); 8020 else 8021 hcon = hci_connect_le_scan(hdev, dst, dst_type, 8022 chan->sec_level, 8023 HCI_LE_CONN_TIMEOUT, 8024 CONN_REASON_L2CAP_CHAN); 8025 8026 } else { 8027 u8 auth_type = l2cap_get_auth_type(chan); 8028 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type, 8029 CONN_REASON_L2CAP_CHAN); 8030 } 8031 8032 if (IS_ERR(hcon)) { 8033 err = PTR_ERR(hcon); 8034 goto done; 8035 } 8036 8037 conn = l2cap_conn_add(hcon); 8038 if (!conn) { 8039 hci_conn_drop(hcon); 8040 err = -ENOMEM; 8041 goto done; 8042 } 8043 8044 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 8045 struct l2cap_chan_data data; 8046 8047 data.chan = chan; 8048 data.pid = chan->ops->get_peer_pid(chan); 8049 data.count = 1; 8050 8051 l2cap_chan_list(conn, l2cap_chan_by_pid, &data); 8052 8053 /* Check if there isn't too many channels being connected */ 8054 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) { 8055 hci_conn_drop(hcon); 8056 err = -EPROTO; 8057 goto done; 8058 } 8059 } 8060 8061 mutex_lock(&conn->chan_lock); 8062 l2cap_chan_lock(chan); 8063 8064 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) { 8065 hci_conn_drop(hcon); 8066 err = -EBUSY; 8067 goto chan_unlock; 8068 } 8069 8070 /* Update source addr of the socket */ 8071 bacpy(&chan->src, &hcon->src); 8072 chan->src_type = bdaddr_src_type(hcon); 8073 8074 __l2cap_chan_add(conn, chan); 8075 8076 /* l2cap_chan_add takes its own ref so we can drop this one */ 8077 hci_conn_drop(hcon); 8078 8079 l2cap_state_change(chan, BT_CONNECT); 8080 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 8081 8082 /* Release chan->sport so that it can be reused by other 8083 * sockets (as it's only used for listening sockets). 8084 */ 8085 write_lock(&chan_list_lock); 8086 chan->sport = 0; 8087 write_unlock(&chan_list_lock); 8088 8089 if (hcon->state == BT_CONNECTED) { 8090 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 8091 __clear_chan_timer(chan); 8092 if (l2cap_chan_check_security(chan, true)) 8093 l2cap_state_change(chan, BT_CONNECTED); 8094 } else 8095 l2cap_do_start(chan); 8096 } 8097 8098 err = 0; 8099 8100 chan_unlock: 8101 l2cap_chan_unlock(chan); 8102 mutex_unlock(&conn->chan_lock); 8103 done: 8104 hci_dev_unlock(hdev); 8105 hci_dev_put(hdev); 8106 return err; 8107 } 8108 EXPORT_SYMBOL_GPL(l2cap_chan_connect); 8109 8110 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan) 8111 { 8112 struct l2cap_conn *conn = chan->conn; 8113 struct { 8114 struct l2cap_ecred_reconf_req req; 8115 __le16 scid; 8116 } pdu; 8117 8118 pdu.req.mtu = cpu_to_le16(chan->imtu); 8119 pdu.req.mps = cpu_to_le16(chan->mps); 8120 pdu.scid = cpu_to_le16(chan->scid); 8121 8122 chan->ident = l2cap_get_ident(conn); 8123 8124 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, 8125 sizeof(pdu), &pdu); 8126 } 8127 8128 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu) 8129 { 8130 if (chan->imtu > mtu) 8131 return -EINVAL; 8132 8133 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu); 8134 8135 chan->imtu = mtu; 8136 8137 l2cap_ecred_reconfigure(chan); 8138 8139 return 0; 8140 } 8141 8142 /* ---- L2CAP interface with lower layer (HCI) ---- */ 8143 8144 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr) 8145 { 8146 int exact = 0, lm1 = 0, lm2 = 0; 8147 struct l2cap_chan *c; 8148 8149 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 8150 8151 /* Find listening sockets and check their link_mode */ 8152 read_lock(&chan_list_lock); 8153 list_for_each_entry(c, &chan_list, global_l) { 8154 if (c->state != BT_LISTEN) 8155 continue; 8156 8157 if (!bacmp(&c->src, &hdev->bdaddr)) { 8158 lm1 |= HCI_LM_ACCEPT; 8159 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 8160 lm1 |= HCI_LM_MASTER; 8161 exact++; 8162 } else if (!bacmp(&c->src, BDADDR_ANY)) { 8163 lm2 |= HCI_LM_ACCEPT; 8164 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 8165 lm2 |= HCI_LM_MASTER; 8166 } 8167 } 8168 read_unlock(&chan_list_lock); 8169 8170 return exact ? lm1 : lm2; 8171 } 8172 8173 /* Find the next fixed channel in BT_LISTEN state, continue iteration 8174 * from an existing channel in the list or from the beginning of the 8175 * global list (by passing NULL as first parameter). 8176 */ 8177 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, 8178 struct hci_conn *hcon) 8179 { 8180 u8 src_type = bdaddr_src_type(hcon); 8181 8182 read_lock(&chan_list_lock); 8183 8184 if (c) 8185 c = list_next_entry(c, global_l); 8186 else 8187 c = list_entry(chan_list.next, typeof(*c), global_l); 8188 8189 list_for_each_entry_from(c, &chan_list, global_l) { 8190 if (c->chan_type != L2CAP_CHAN_FIXED) 8191 continue; 8192 if (c->state != BT_LISTEN) 8193 continue; 8194 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY)) 8195 continue; 8196 if (src_type != c->src_type) 8197 continue; 8198 8199 c = l2cap_chan_hold_unless_zero(c); 8200 read_unlock(&chan_list_lock); 8201 return c; 8202 } 8203 8204 read_unlock(&chan_list_lock); 8205 8206 return NULL; 8207 } 8208 8209 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 8210 { 8211 struct hci_dev *hdev = hcon->hdev; 8212 struct l2cap_conn *conn; 8213 struct l2cap_chan *pchan; 8214 u8 dst_type; 8215 8216 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 8217 return; 8218 8219 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); 8220 8221 if (status) { 8222 l2cap_conn_del(hcon, bt_to_errno(status)); 8223 return; 8224 } 8225 8226 conn = l2cap_conn_add(hcon); 8227 if (!conn) 8228 return; 8229 8230 dst_type = bdaddr_dst_type(hcon); 8231 8232 /* If device is blocked, do not create channels for it */ 8233 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type)) 8234 return; 8235 8236 /* Find fixed channels and notify them of the new connection. We 8237 * use multiple individual lookups, continuing each time where 8238 * we left off, because the list lock would prevent calling the 8239 * potentially sleeping l2cap_chan_lock() function. 8240 */ 8241 pchan = l2cap_global_fixed_chan(NULL, hcon); 8242 while (pchan) { 8243 struct l2cap_chan *chan, *next; 8244 8245 /* Client fixed channels should override server ones */ 8246 if (__l2cap_get_chan_by_dcid(conn, pchan->scid)) 8247 goto next; 8248 8249 l2cap_chan_lock(pchan); 8250 chan = pchan->ops->new_connection(pchan); 8251 if (chan) { 8252 bacpy(&chan->src, &hcon->src); 8253 bacpy(&chan->dst, &hcon->dst); 8254 chan->src_type = bdaddr_src_type(hcon); 8255 chan->dst_type = dst_type; 8256 8257 __l2cap_chan_add(conn, chan); 8258 } 8259 8260 l2cap_chan_unlock(pchan); 8261 next: 8262 next = l2cap_global_fixed_chan(pchan, hcon); 8263 l2cap_chan_put(pchan); 8264 pchan = next; 8265 } 8266 8267 l2cap_conn_ready(conn); 8268 } 8269 8270 int l2cap_disconn_ind(struct hci_conn *hcon) 8271 { 8272 struct l2cap_conn *conn = hcon->l2cap_data; 8273 8274 BT_DBG("hcon %p", hcon); 8275 8276 if (!conn) 8277 return HCI_ERROR_REMOTE_USER_TERM; 8278 return conn->disc_reason; 8279 } 8280 8281 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 8282 { 8283 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 8284 return; 8285 8286 BT_DBG("hcon %p reason %d", hcon, reason); 8287 8288 l2cap_conn_del(hcon, bt_to_errno(reason)); 8289 } 8290 8291 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 8292 { 8293 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 8294 return; 8295 8296 if (encrypt == 0x00) { 8297 if (chan->sec_level == BT_SECURITY_MEDIUM) { 8298 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT); 8299 } else if (chan->sec_level == BT_SECURITY_HIGH || 8300 chan->sec_level == BT_SECURITY_FIPS) 8301 l2cap_chan_close(chan, ECONNREFUSED); 8302 } else { 8303 if (chan->sec_level == BT_SECURITY_MEDIUM) 8304 __clear_chan_timer(chan); 8305 } 8306 } 8307 8308 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 8309 { 8310 struct l2cap_conn *conn = hcon->l2cap_data; 8311 struct l2cap_chan *chan; 8312 8313 if (!conn) 8314 return; 8315 8316 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); 8317 8318 mutex_lock(&conn->chan_lock); 8319 8320 list_for_each_entry(chan, &conn->chan_l, list) { 8321 l2cap_chan_lock(chan); 8322 8323 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid, 8324 state_to_string(chan->state)); 8325 8326 if (chan->scid == L2CAP_CID_A2MP) { 8327 l2cap_chan_unlock(chan); 8328 continue; 8329 } 8330 8331 if (!status && encrypt) 8332 chan->sec_level = hcon->sec_level; 8333 8334 if (!__l2cap_no_conn_pending(chan)) { 8335 l2cap_chan_unlock(chan); 8336 continue; 8337 } 8338 8339 if (!status && (chan->state == BT_CONNECTED || 8340 chan->state == BT_CONFIG)) { 8341 chan->ops->resume(chan); 8342 l2cap_check_encryption(chan, encrypt); 8343 l2cap_chan_unlock(chan); 8344 continue; 8345 } 8346 8347 if (chan->state == BT_CONNECT) { 8348 if (!status && l2cap_check_enc_key_size(hcon)) 8349 l2cap_start_connection(chan); 8350 else 8351 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 8352 } else if (chan->state == BT_CONNECT2 && 8353 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL || 8354 chan->mode == L2CAP_MODE_LE_FLOWCTL)) { 8355 struct l2cap_conn_rsp rsp; 8356 __u16 res, stat; 8357 8358 if (!status && l2cap_check_enc_key_size(hcon)) { 8359 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 8360 res = L2CAP_CR_PEND; 8361 stat = L2CAP_CS_AUTHOR_PEND; 8362 chan->ops->defer(chan); 8363 } else { 8364 l2cap_state_change(chan, BT_CONFIG); 8365 res = L2CAP_CR_SUCCESS; 8366 stat = L2CAP_CS_NO_INFO; 8367 } 8368 } else { 8369 l2cap_state_change(chan, BT_DISCONN); 8370 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 8371 res = L2CAP_CR_SEC_BLOCK; 8372 stat = L2CAP_CS_NO_INFO; 8373 } 8374 8375 rsp.scid = cpu_to_le16(chan->dcid); 8376 rsp.dcid = cpu_to_le16(chan->scid); 8377 rsp.result = cpu_to_le16(res); 8378 rsp.status = cpu_to_le16(stat); 8379 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 8380 sizeof(rsp), &rsp); 8381 8382 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) && 8383 res == L2CAP_CR_SUCCESS) { 8384 char buf[128]; 8385 set_bit(CONF_REQ_SENT, &chan->conf_state); 8386 l2cap_send_cmd(conn, l2cap_get_ident(conn), 8387 L2CAP_CONF_REQ, 8388 l2cap_build_conf_req(chan, buf, sizeof(buf)), 8389 buf); 8390 chan->num_conf_req++; 8391 } 8392 } 8393 8394 l2cap_chan_unlock(chan); 8395 } 8396 8397 mutex_unlock(&conn->chan_lock); 8398 } 8399 8400 /* Append fragment into frame respecting the maximum len of rx_skb */ 8401 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb, 8402 u16 len) 8403 { 8404 if (!conn->rx_skb) { 8405 /* Allocate skb for the complete frame (with header) */ 8406 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL); 8407 if (!conn->rx_skb) 8408 return -ENOMEM; 8409 /* Init rx_len */ 8410 conn->rx_len = len; 8411 } 8412 8413 /* Copy as much as the rx_skb can hold */ 8414 len = min_t(u16, len, skb->len); 8415 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len); 8416 skb_pull(skb, len); 8417 conn->rx_len -= len; 8418 8419 return len; 8420 } 8421 8422 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb) 8423 { 8424 struct sk_buff *rx_skb; 8425 int len; 8426 8427 /* Append just enough to complete the header */ 8428 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len); 8429 8430 /* If header could not be read just continue */ 8431 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE) 8432 return len; 8433 8434 rx_skb = conn->rx_skb; 8435 len = get_unaligned_le16(rx_skb->data); 8436 8437 /* Check if rx_skb has enough space to received all fragments */ 8438 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) { 8439 /* Update expected len */ 8440 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE); 8441 return L2CAP_LEN_SIZE; 8442 } 8443 8444 /* Reset conn->rx_skb since it will need to be reallocated in order to 8445 * fit all fragments. 8446 */ 8447 conn->rx_skb = NULL; 8448 8449 /* Reallocates rx_skb using the exact expected length */ 8450 len = l2cap_recv_frag(conn, rx_skb, 8451 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE)); 8452 kfree_skb(rx_skb); 8453 8454 return len; 8455 } 8456 8457 static void l2cap_recv_reset(struct l2cap_conn *conn) 8458 { 8459 kfree_skb(conn->rx_skb); 8460 conn->rx_skb = NULL; 8461 conn->rx_len = 0; 8462 } 8463 8464 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) 8465 { 8466 struct l2cap_conn *conn = hcon->l2cap_data; 8467 int len; 8468 8469 /* For AMP controller do not create l2cap conn */ 8470 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY) 8471 goto drop; 8472 8473 if (!conn) 8474 conn = l2cap_conn_add(hcon); 8475 8476 if (!conn) 8477 goto drop; 8478 8479 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); 8480 8481 switch (flags) { 8482 case ACL_START: 8483 case ACL_START_NO_FLUSH: 8484 case ACL_COMPLETE: 8485 if (conn->rx_skb) { 8486 BT_ERR("Unexpected start frame (len %d)", skb->len); 8487 l2cap_recv_reset(conn); 8488 l2cap_conn_unreliable(conn, ECOMM); 8489 } 8490 8491 /* Start fragment may not contain the L2CAP length so just 8492 * copy the initial byte when that happens and use conn->mtu as 8493 * expected length. 8494 */ 8495 if (skb->len < L2CAP_LEN_SIZE) { 8496 l2cap_recv_frag(conn, skb, conn->mtu); 8497 break; 8498 } 8499 8500 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE; 8501 8502 if (len == skb->len) { 8503 /* Complete frame received */ 8504 l2cap_recv_frame(conn, skb); 8505 return; 8506 } 8507 8508 BT_DBG("Start: total len %d, frag len %u", len, skb->len); 8509 8510 if (skb->len > len) { 8511 BT_ERR("Frame is too long (len %u, expected len %d)", 8512 skb->len, len); 8513 l2cap_conn_unreliable(conn, ECOMM); 8514 goto drop; 8515 } 8516 8517 /* Append fragment into frame (with header) */ 8518 if (l2cap_recv_frag(conn, skb, len) < 0) 8519 goto drop; 8520 8521 break; 8522 8523 case ACL_CONT: 8524 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len); 8525 8526 if (!conn->rx_skb) { 8527 BT_ERR("Unexpected continuation frame (len %d)", skb->len); 8528 l2cap_conn_unreliable(conn, ECOMM); 8529 goto drop; 8530 } 8531 8532 /* Complete the L2CAP length if it has not been read */ 8533 if (conn->rx_skb->len < L2CAP_LEN_SIZE) { 8534 if (l2cap_recv_len(conn, skb) < 0) { 8535 l2cap_conn_unreliable(conn, ECOMM); 8536 goto drop; 8537 } 8538 8539 /* Header still could not be read just continue */ 8540 if (conn->rx_skb->len < L2CAP_LEN_SIZE) 8541 break; 8542 } 8543 8544 if (skb->len > conn->rx_len) { 8545 BT_ERR("Fragment is too long (len %u, expected %u)", 8546 skb->len, conn->rx_len); 8547 l2cap_recv_reset(conn); 8548 l2cap_conn_unreliable(conn, ECOMM); 8549 goto drop; 8550 } 8551 8552 /* Append fragment into frame (with header) */ 8553 l2cap_recv_frag(conn, skb, skb->len); 8554 8555 if (!conn->rx_len) { 8556 /* Complete frame received. l2cap_recv_frame 8557 * takes ownership of the skb so set the global 8558 * rx_skb pointer to NULL first. 8559 */ 8560 struct sk_buff *rx_skb = conn->rx_skb; 8561 conn->rx_skb = NULL; 8562 l2cap_recv_frame(conn, rx_skb); 8563 } 8564 break; 8565 } 8566 8567 drop: 8568 kfree_skb(skb); 8569 } 8570 8571 static struct hci_cb l2cap_cb = { 8572 .name = "L2CAP", 8573 .connect_cfm = l2cap_connect_cfm, 8574 .disconn_cfm = l2cap_disconn_cfm, 8575 .security_cfm = l2cap_security_cfm, 8576 }; 8577 8578 static int l2cap_debugfs_show(struct seq_file *f, void *p) 8579 { 8580 struct l2cap_chan *c; 8581 8582 read_lock(&chan_list_lock); 8583 8584 list_for_each_entry(c, &chan_list, global_l) { 8585 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 8586 &c->src, c->src_type, &c->dst, c->dst_type, 8587 c->state, __le16_to_cpu(c->psm), 8588 c->scid, c->dcid, c->imtu, c->omtu, 8589 c->sec_level, c->mode); 8590 } 8591 8592 read_unlock(&chan_list_lock); 8593 8594 return 0; 8595 } 8596 8597 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs); 8598 8599 static struct dentry *l2cap_debugfs; 8600 8601 int __init l2cap_init(void) 8602 { 8603 int err; 8604 8605 err = l2cap_init_sockets(); 8606 if (err < 0) 8607 return err; 8608 8609 hci_register_cb(&l2cap_cb); 8610 8611 if (IS_ERR_OR_NULL(bt_debugfs)) 8612 return 0; 8613 8614 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs, 8615 NULL, &l2cap_debugfs_fops); 8616 8617 return 0; 8618 } 8619 8620 void l2cap_exit(void) 8621 { 8622 debugfs_remove(l2cap_debugfs); 8623 hci_unregister_cb(&l2cap_cb); 8624 l2cap_cleanup_sockets(); 8625 } 8626 8627 module_param(disable_ertm, bool, 0644); 8628 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 8629 8630 module_param(enable_ecred, bool, 0644); 8631 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode"); 8632