1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 5 Copyright (C) 2010 Google Inc. 6 Copyright (C) 2011 ProFUSION Embedded Systems 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved. 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 This program is free software; you can redistribute it and/or modify 12 it under the terms of the GNU General Public License version 2 as 13 published by the Free Software Foundation; 14 15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 23 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 26 SOFTWARE IS DISCLAIMED. 27 */ 28 29 /* Bluetooth L2CAP core. */ 30 31 #include <linux/module.h> 32 33 #include <linux/debugfs.h> 34 #include <linux/crc16.h> 35 #include <linux/filter.h> 36 37 #include <net/bluetooth/bluetooth.h> 38 #include <net/bluetooth/hci_core.h> 39 #include <net/bluetooth/l2cap.h> 40 41 #include "smp.h" 42 #include "a2mp.h" 43 #include "amp.h" 44 45 #define LE_FLOWCTL_MAX_CREDITS 65535 46 47 bool disable_ertm; 48 bool enable_ecred; 49 50 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD; 51 52 static LIST_HEAD(chan_list); 53 static DEFINE_RWLOCK(chan_list_lock); 54 55 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 56 u8 code, u8 ident, u16 dlen, void *data); 57 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 58 void *data); 59 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); 60 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); 61 62 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 63 struct sk_buff_head *skbs, u8 event); 64 65 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type) 66 { 67 if (link_type == LE_LINK) { 68 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 69 return BDADDR_LE_PUBLIC; 70 else 71 return BDADDR_LE_RANDOM; 72 } 73 74 return BDADDR_BREDR; 75 } 76 77 static inline u8 bdaddr_src_type(struct hci_conn *hcon) 78 { 79 return bdaddr_type(hcon->type, hcon->src_type); 80 } 81 82 static inline u8 bdaddr_dst_type(struct hci_conn *hcon) 83 { 84 return bdaddr_type(hcon->type, hcon->dst_type); 85 } 86 87 /* ---- L2CAP channels ---- */ 88 89 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 90 u16 cid) 91 { 92 struct l2cap_chan *c; 93 94 list_for_each_entry(c, &conn->chan_l, list) { 95 if (c->dcid == cid) 96 return c; 97 } 98 return NULL; 99 } 100 101 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, 102 u16 cid) 103 { 104 struct l2cap_chan *c; 105 106 list_for_each_entry(c, &conn->chan_l, list) { 107 if (c->scid == cid) 108 return c; 109 } 110 return NULL; 111 } 112 113 /* Find channel with given SCID. 114 * Returns locked channel. */ 115 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, 116 u16 cid) 117 { 118 struct l2cap_chan *c; 119 120 mutex_lock(&conn->chan_lock); 121 c = __l2cap_get_chan_by_scid(conn, cid); 122 if (c) 123 l2cap_chan_lock(c); 124 mutex_unlock(&conn->chan_lock); 125 126 return c; 127 } 128 129 /* Find channel with given DCID. 130 * Returns locked channel. 131 */ 132 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 133 u16 cid) 134 { 135 struct l2cap_chan *c; 136 137 mutex_lock(&conn->chan_lock); 138 c = __l2cap_get_chan_by_dcid(conn, cid); 139 if (c) 140 l2cap_chan_lock(c); 141 mutex_unlock(&conn->chan_lock); 142 143 return c; 144 } 145 146 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, 147 u8 ident) 148 { 149 struct l2cap_chan *c; 150 151 list_for_each_entry(c, &conn->chan_l, list) { 152 if (c->ident == ident) 153 return c; 154 } 155 return NULL; 156 } 157 158 static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, 159 u8 ident) 160 { 161 struct l2cap_chan *c; 162 163 mutex_lock(&conn->chan_lock); 164 c = __l2cap_get_chan_by_ident(conn, ident); 165 if (c) 166 l2cap_chan_lock(c); 167 mutex_unlock(&conn->chan_lock); 168 169 return c; 170 } 171 172 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src, 173 u8 src_type) 174 { 175 struct l2cap_chan *c; 176 177 list_for_each_entry(c, &chan_list, global_l) { 178 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR) 179 continue; 180 181 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR) 182 continue; 183 184 if (c->sport == psm && !bacmp(&c->src, src)) 185 return c; 186 } 187 return NULL; 188 } 189 190 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 191 { 192 int err; 193 194 write_lock(&chan_list_lock); 195 196 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) { 197 err = -EADDRINUSE; 198 goto done; 199 } 200 201 if (psm) { 202 chan->psm = psm; 203 chan->sport = psm; 204 err = 0; 205 } else { 206 u16 p, start, end, incr; 207 208 if (chan->src_type == BDADDR_BREDR) { 209 start = L2CAP_PSM_DYN_START; 210 end = L2CAP_PSM_AUTO_END; 211 incr = 2; 212 } else { 213 start = L2CAP_PSM_LE_DYN_START; 214 end = L2CAP_PSM_LE_DYN_END; 215 incr = 1; 216 } 217 218 err = -EINVAL; 219 for (p = start; p <= end; p += incr) 220 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src, 221 chan->src_type)) { 222 chan->psm = cpu_to_le16(p); 223 chan->sport = cpu_to_le16(p); 224 err = 0; 225 break; 226 } 227 } 228 229 done: 230 write_unlock(&chan_list_lock); 231 return err; 232 } 233 EXPORT_SYMBOL_GPL(l2cap_add_psm); 234 235 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 236 { 237 write_lock(&chan_list_lock); 238 239 /* Override the defaults (which are for conn-oriented) */ 240 chan->omtu = L2CAP_DEFAULT_MTU; 241 chan->chan_type = L2CAP_CHAN_FIXED; 242 243 chan->scid = scid; 244 245 write_unlock(&chan_list_lock); 246 247 return 0; 248 } 249 250 static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 251 { 252 u16 cid, dyn_end; 253 254 if (conn->hcon->type == LE_LINK) 255 dyn_end = L2CAP_CID_LE_DYN_END; 256 else 257 dyn_end = L2CAP_CID_DYN_END; 258 259 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) { 260 if (!__l2cap_get_chan_by_scid(conn, cid)) 261 return cid; 262 } 263 264 return 0; 265 } 266 267 static void l2cap_state_change(struct l2cap_chan *chan, int state) 268 { 269 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state), 270 state_to_string(state)); 271 272 chan->state = state; 273 chan->ops->state_change(chan, state, 0); 274 } 275 276 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan, 277 int state, int err) 278 { 279 chan->state = state; 280 chan->ops->state_change(chan, chan->state, err); 281 } 282 283 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err) 284 { 285 chan->ops->state_change(chan, chan->state, err); 286 } 287 288 static void __set_retrans_timer(struct l2cap_chan *chan) 289 { 290 if (!delayed_work_pending(&chan->monitor_timer) && 291 chan->retrans_timeout) { 292 l2cap_set_timer(chan, &chan->retrans_timer, 293 msecs_to_jiffies(chan->retrans_timeout)); 294 } 295 } 296 297 static void __set_monitor_timer(struct l2cap_chan *chan) 298 { 299 __clear_retrans_timer(chan); 300 if (chan->monitor_timeout) { 301 l2cap_set_timer(chan, &chan->monitor_timer, 302 msecs_to_jiffies(chan->monitor_timeout)); 303 } 304 } 305 306 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head, 307 u16 seq) 308 { 309 struct sk_buff *skb; 310 311 skb_queue_walk(head, skb) { 312 if (bt_cb(skb)->l2cap.txseq == seq) 313 return skb; 314 } 315 316 return NULL; 317 } 318 319 /* ---- L2CAP sequence number lists ---- */ 320 321 /* For ERTM, ordered lists of sequence numbers must be tracked for 322 * SREJ requests that are received and for frames that are to be 323 * retransmitted. These seq_list functions implement a singly-linked 324 * list in an array, where membership in the list can also be checked 325 * in constant time. Items can also be added to the tail of the list 326 * and removed from the head in constant time, without further memory 327 * allocs or frees. 328 */ 329 330 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size) 331 { 332 size_t alloc_size, i; 333 334 /* Allocated size is a power of 2 to map sequence numbers 335 * (which may be up to 14 bits) in to a smaller array that is 336 * sized for the negotiated ERTM transmit windows. 337 */ 338 alloc_size = roundup_pow_of_two(size); 339 340 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL); 341 if (!seq_list->list) 342 return -ENOMEM; 343 344 seq_list->mask = alloc_size - 1; 345 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 346 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 347 for (i = 0; i < alloc_size; i++) 348 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 349 350 return 0; 351 } 352 353 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list) 354 { 355 kfree(seq_list->list); 356 } 357 358 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list, 359 u16 seq) 360 { 361 /* Constant-time check for list membership */ 362 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR; 363 } 364 365 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list) 366 { 367 u16 seq = seq_list->head; 368 u16 mask = seq_list->mask; 369 370 seq_list->head = seq_list->list[seq & mask]; 371 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR; 372 373 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) { 374 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 375 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 376 } 377 378 return seq; 379 } 380 381 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list) 382 { 383 u16 i; 384 385 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) 386 return; 387 388 for (i = 0; i <= seq_list->mask; i++) 389 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 390 391 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 392 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 393 } 394 395 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq) 396 { 397 u16 mask = seq_list->mask; 398 399 /* All appends happen in constant time */ 400 401 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR) 402 return; 403 404 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR) 405 seq_list->head = seq; 406 else 407 seq_list->list[seq_list->tail & mask] = seq; 408 409 seq_list->tail = seq; 410 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL; 411 } 412 413 static void l2cap_chan_timeout(struct work_struct *work) 414 { 415 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 416 chan_timer.work); 417 struct l2cap_conn *conn = chan->conn; 418 int reason; 419 420 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 421 422 mutex_lock(&conn->chan_lock); 423 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling 424 * this work. No need to call l2cap_chan_hold(chan) here again. 425 */ 426 l2cap_chan_lock(chan); 427 428 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 429 reason = ECONNREFUSED; 430 else if (chan->state == BT_CONNECT && 431 chan->sec_level != BT_SECURITY_SDP) 432 reason = ECONNREFUSED; 433 else 434 reason = ETIMEDOUT; 435 436 l2cap_chan_close(chan, reason); 437 438 chan->ops->close(chan); 439 440 l2cap_chan_unlock(chan); 441 l2cap_chan_put(chan); 442 443 mutex_unlock(&conn->chan_lock); 444 } 445 446 struct l2cap_chan *l2cap_chan_create(void) 447 { 448 struct l2cap_chan *chan; 449 450 chan = kzalloc(sizeof(*chan), GFP_ATOMIC); 451 if (!chan) 452 return NULL; 453 454 mutex_init(&chan->lock); 455 456 /* Set default lock nesting level */ 457 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL); 458 459 write_lock(&chan_list_lock); 460 list_add(&chan->global_l, &chan_list); 461 write_unlock(&chan_list_lock); 462 463 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout); 464 465 chan->state = BT_OPEN; 466 467 kref_init(&chan->kref); 468 469 /* This flag is cleared in l2cap_chan_ready() */ 470 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 471 472 BT_DBG("chan %p", chan); 473 474 return chan; 475 } 476 EXPORT_SYMBOL_GPL(l2cap_chan_create); 477 478 static void l2cap_chan_destroy(struct kref *kref) 479 { 480 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref); 481 482 BT_DBG("chan %p", chan); 483 484 write_lock(&chan_list_lock); 485 list_del(&chan->global_l); 486 write_unlock(&chan_list_lock); 487 488 kfree(chan); 489 } 490 491 void l2cap_chan_hold(struct l2cap_chan *c) 492 { 493 BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref)); 494 495 kref_get(&c->kref); 496 } 497 498 void l2cap_chan_put(struct l2cap_chan *c) 499 { 500 BT_DBG("chan %p orig refcnt %d", c, kref_read(&c->kref)); 501 502 kref_put(&c->kref, l2cap_chan_destroy); 503 } 504 EXPORT_SYMBOL_GPL(l2cap_chan_put); 505 506 void l2cap_chan_set_defaults(struct l2cap_chan *chan) 507 { 508 chan->fcs = L2CAP_FCS_CRC16; 509 chan->max_tx = L2CAP_DEFAULT_MAX_TX; 510 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW; 511 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 512 chan->remote_max_tx = chan->max_tx; 513 chan->remote_tx_win = chan->tx_win; 514 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW; 515 chan->sec_level = BT_SECURITY_LOW; 516 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 517 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; 518 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; 519 chan->conf_state = 0; 520 521 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 522 } 523 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults); 524 525 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) 526 { 527 chan->sdu = NULL; 528 chan->sdu_last_frag = NULL; 529 chan->sdu_len = 0; 530 chan->tx_credits = tx_credits; 531 /* Derive MPS from connection MTU to stop HCI fragmentation */ 532 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE); 533 /* Give enough credits for a full packet */ 534 chan->rx_credits = (chan->imtu / chan->mps) + 1; 535 536 skb_queue_head_init(&chan->tx_q); 537 } 538 539 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits) 540 { 541 l2cap_le_flowctl_init(chan, tx_credits); 542 543 /* L2CAP implementations shall support a minimum MPS of 64 octets */ 544 if (chan->mps < L2CAP_ECRED_MIN_MPS) { 545 chan->mps = L2CAP_ECRED_MIN_MPS; 546 chan->rx_credits = (chan->imtu / chan->mps) + 1; 547 } 548 } 549 550 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 551 { 552 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 553 __le16_to_cpu(chan->psm), chan->dcid); 554 555 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 556 557 chan->conn = conn; 558 559 switch (chan->chan_type) { 560 case L2CAP_CHAN_CONN_ORIENTED: 561 /* Alloc CID for connection-oriented socket */ 562 chan->scid = l2cap_alloc_cid(conn); 563 if (conn->hcon->type == ACL_LINK) 564 chan->omtu = L2CAP_DEFAULT_MTU; 565 break; 566 567 case L2CAP_CHAN_CONN_LESS: 568 /* Connectionless socket */ 569 chan->scid = L2CAP_CID_CONN_LESS; 570 chan->dcid = L2CAP_CID_CONN_LESS; 571 chan->omtu = L2CAP_DEFAULT_MTU; 572 break; 573 574 case L2CAP_CHAN_FIXED: 575 /* Caller will set CID and CID specific MTU values */ 576 break; 577 578 default: 579 /* Raw socket can send/recv signalling messages only */ 580 chan->scid = L2CAP_CID_SIGNALING; 581 chan->dcid = L2CAP_CID_SIGNALING; 582 chan->omtu = L2CAP_DEFAULT_MTU; 583 } 584 585 chan->local_id = L2CAP_BESTEFFORT_ID; 586 chan->local_stype = L2CAP_SERV_BESTEFFORT; 587 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE; 588 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME; 589 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT; 590 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO; 591 592 l2cap_chan_hold(chan); 593 594 /* Only keep a reference for fixed channels if they requested it */ 595 if (chan->chan_type != L2CAP_CHAN_FIXED || 596 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 597 hci_conn_hold(conn->hcon); 598 599 list_add(&chan->list, &conn->chan_l); 600 } 601 602 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 603 { 604 mutex_lock(&conn->chan_lock); 605 __l2cap_chan_add(conn, chan); 606 mutex_unlock(&conn->chan_lock); 607 } 608 609 void l2cap_chan_del(struct l2cap_chan *chan, int err) 610 { 611 struct l2cap_conn *conn = chan->conn; 612 613 __clear_chan_timer(chan); 614 615 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err, 616 state_to_string(chan->state)); 617 618 chan->ops->teardown(chan, err); 619 620 if (conn) { 621 struct amp_mgr *mgr = conn->hcon->amp_mgr; 622 /* Delete from channel list */ 623 list_del(&chan->list); 624 625 l2cap_chan_put(chan); 626 627 chan->conn = NULL; 628 629 /* Reference was only held for non-fixed channels or 630 * fixed channels that explicitly requested it using the 631 * FLAG_HOLD_HCI_CONN flag. 632 */ 633 if (chan->chan_type != L2CAP_CHAN_FIXED || 634 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 635 hci_conn_drop(conn->hcon); 636 637 if (mgr && mgr->bredr_chan == chan) 638 mgr->bredr_chan = NULL; 639 } 640 641 if (chan->hs_hchan) { 642 struct hci_chan *hs_hchan = chan->hs_hchan; 643 644 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan); 645 amp_disconnect_logical_link(hs_hchan); 646 } 647 648 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state)) 649 return; 650 651 switch(chan->mode) { 652 case L2CAP_MODE_BASIC: 653 break; 654 655 case L2CAP_MODE_LE_FLOWCTL: 656 case L2CAP_MODE_EXT_FLOWCTL: 657 skb_queue_purge(&chan->tx_q); 658 break; 659 660 case L2CAP_MODE_ERTM: 661 __clear_retrans_timer(chan); 662 __clear_monitor_timer(chan); 663 __clear_ack_timer(chan); 664 665 skb_queue_purge(&chan->srej_q); 666 667 l2cap_seq_list_free(&chan->srej_list); 668 l2cap_seq_list_free(&chan->retrans_list); 669 670 /* fall through */ 671 672 case L2CAP_MODE_STREAMING: 673 skb_queue_purge(&chan->tx_q); 674 break; 675 } 676 677 return; 678 } 679 EXPORT_SYMBOL_GPL(l2cap_chan_del); 680 681 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 682 void *data) 683 { 684 struct l2cap_chan *chan; 685 686 list_for_each_entry(chan, &conn->chan_l, list) { 687 func(chan, data); 688 } 689 } 690 691 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 692 void *data) 693 { 694 if (!conn) 695 return; 696 697 mutex_lock(&conn->chan_lock); 698 __l2cap_chan_list(conn, func, data); 699 mutex_unlock(&conn->chan_lock); 700 } 701 702 EXPORT_SYMBOL_GPL(l2cap_chan_list); 703 704 static void l2cap_conn_update_id_addr(struct work_struct *work) 705 { 706 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 707 id_addr_update_work); 708 struct hci_conn *hcon = conn->hcon; 709 struct l2cap_chan *chan; 710 711 mutex_lock(&conn->chan_lock); 712 713 list_for_each_entry(chan, &conn->chan_l, list) { 714 l2cap_chan_lock(chan); 715 bacpy(&chan->dst, &hcon->dst); 716 chan->dst_type = bdaddr_dst_type(hcon); 717 l2cap_chan_unlock(chan); 718 } 719 720 mutex_unlock(&conn->chan_lock); 721 } 722 723 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) 724 { 725 struct l2cap_conn *conn = chan->conn; 726 struct l2cap_le_conn_rsp rsp; 727 u16 result; 728 729 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 730 result = L2CAP_CR_LE_AUTHORIZATION; 731 else 732 result = L2CAP_CR_LE_BAD_PSM; 733 734 l2cap_state_change(chan, BT_DISCONN); 735 736 rsp.dcid = cpu_to_le16(chan->scid); 737 rsp.mtu = cpu_to_le16(chan->imtu); 738 rsp.mps = cpu_to_le16(chan->mps); 739 rsp.credits = cpu_to_le16(chan->rx_credits); 740 rsp.result = cpu_to_le16(result); 741 742 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 743 &rsp); 744 } 745 746 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) 747 { 748 struct l2cap_conn *conn = chan->conn; 749 struct l2cap_ecred_conn_rsp rsp; 750 u16 result; 751 752 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 753 result = L2CAP_CR_LE_AUTHORIZATION; 754 else 755 result = L2CAP_CR_LE_BAD_PSM; 756 757 l2cap_state_change(chan, BT_DISCONN); 758 759 memset(&rsp, 0, sizeof(rsp)); 760 761 rsp.result = cpu_to_le16(result); 762 763 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 764 &rsp); 765 } 766 767 static void l2cap_chan_connect_reject(struct l2cap_chan *chan) 768 { 769 struct l2cap_conn *conn = chan->conn; 770 struct l2cap_conn_rsp rsp; 771 u16 result; 772 773 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 774 result = L2CAP_CR_SEC_BLOCK; 775 else 776 result = L2CAP_CR_BAD_PSM; 777 778 l2cap_state_change(chan, BT_DISCONN); 779 780 rsp.scid = cpu_to_le16(chan->dcid); 781 rsp.dcid = cpu_to_le16(chan->scid); 782 rsp.result = cpu_to_le16(result); 783 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 784 785 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 786 } 787 788 void l2cap_chan_close(struct l2cap_chan *chan, int reason) 789 { 790 struct l2cap_conn *conn = chan->conn; 791 792 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 793 794 switch (chan->state) { 795 case BT_LISTEN: 796 chan->ops->teardown(chan, 0); 797 break; 798 799 case BT_CONNECTED: 800 case BT_CONFIG: 801 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 802 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 803 l2cap_send_disconn_req(chan, reason); 804 } else 805 l2cap_chan_del(chan, reason); 806 break; 807 808 case BT_CONNECT2: 809 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 810 if (conn->hcon->type == ACL_LINK) 811 l2cap_chan_connect_reject(chan); 812 else if (conn->hcon->type == LE_LINK) { 813 switch (chan->mode) { 814 case L2CAP_MODE_LE_FLOWCTL: 815 l2cap_chan_le_connect_reject(chan); 816 break; 817 case L2CAP_MODE_EXT_FLOWCTL: 818 l2cap_chan_ecred_connect_reject(chan); 819 break; 820 } 821 } 822 } 823 824 l2cap_chan_del(chan, reason); 825 break; 826 827 case BT_CONNECT: 828 case BT_DISCONN: 829 l2cap_chan_del(chan, reason); 830 break; 831 832 default: 833 chan->ops->teardown(chan, 0); 834 break; 835 } 836 } 837 EXPORT_SYMBOL(l2cap_chan_close); 838 839 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 840 { 841 switch (chan->chan_type) { 842 case L2CAP_CHAN_RAW: 843 switch (chan->sec_level) { 844 case BT_SECURITY_HIGH: 845 case BT_SECURITY_FIPS: 846 return HCI_AT_DEDICATED_BONDING_MITM; 847 case BT_SECURITY_MEDIUM: 848 return HCI_AT_DEDICATED_BONDING; 849 default: 850 return HCI_AT_NO_BONDING; 851 } 852 break; 853 case L2CAP_CHAN_CONN_LESS: 854 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) { 855 if (chan->sec_level == BT_SECURITY_LOW) 856 chan->sec_level = BT_SECURITY_SDP; 857 } 858 if (chan->sec_level == BT_SECURITY_HIGH || 859 chan->sec_level == BT_SECURITY_FIPS) 860 return HCI_AT_NO_BONDING_MITM; 861 else 862 return HCI_AT_NO_BONDING; 863 break; 864 case L2CAP_CHAN_CONN_ORIENTED: 865 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) { 866 if (chan->sec_level == BT_SECURITY_LOW) 867 chan->sec_level = BT_SECURITY_SDP; 868 869 if (chan->sec_level == BT_SECURITY_HIGH || 870 chan->sec_level == BT_SECURITY_FIPS) 871 return HCI_AT_NO_BONDING_MITM; 872 else 873 return HCI_AT_NO_BONDING; 874 } 875 /* fall through */ 876 default: 877 switch (chan->sec_level) { 878 case BT_SECURITY_HIGH: 879 case BT_SECURITY_FIPS: 880 return HCI_AT_GENERAL_BONDING_MITM; 881 case BT_SECURITY_MEDIUM: 882 return HCI_AT_GENERAL_BONDING; 883 default: 884 return HCI_AT_NO_BONDING; 885 } 886 break; 887 } 888 } 889 890 /* Service level security */ 891 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator) 892 { 893 struct l2cap_conn *conn = chan->conn; 894 __u8 auth_type; 895 896 if (conn->hcon->type == LE_LINK) 897 return smp_conn_security(conn->hcon, chan->sec_level); 898 899 auth_type = l2cap_get_auth_type(chan); 900 901 return hci_conn_security(conn->hcon, chan->sec_level, auth_type, 902 initiator); 903 } 904 905 static u8 l2cap_get_ident(struct l2cap_conn *conn) 906 { 907 u8 id; 908 909 /* Get next available identificator. 910 * 1 - 128 are used by kernel. 911 * 129 - 199 are reserved. 912 * 200 - 254 are used by utilities like l2ping, etc. 913 */ 914 915 mutex_lock(&conn->ident_lock); 916 917 if (++conn->tx_ident > 128) 918 conn->tx_ident = 1; 919 920 id = conn->tx_ident; 921 922 mutex_unlock(&conn->ident_lock); 923 924 return id; 925 } 926 927 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 928 void *data) 929 { 930 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 931 u8 flags; 932 933 BT_DBG("code 0x%2.2x", code); 934 935 if (!skb) 936 return; 937 938 /* Use NO_FLUSH if supported or we have an LE link (which does 939 * not support auto-flushing packets) */ 940 if (lmp_no_flush_capable(conn->hcon->hdev) || 941 conn->hcon->type == LE_LINK) 942 flags = ACL_START_NO_FLUSH; 943 else 944 flags = ACL_START; 945 946 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 947 skb->priority = HCI_PRIO_MAX; 948 949 hci_send_acl(conn->hchan, skb, flags); 950 } 951 952 static bool __chan_is_moving(struct l2cap_chan *chan) 953 { 954 return chan->move_state != L2CAP_MOVE_STABLE && 955 chan->move_state != L2CAP_MOVE_WAIT_PREPARE; 956 } 957 958 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 959 { 960 struct hci_conn *hcon = chan->conn->hcon; 961 u16 flags; 962 963 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len, 964 skb->priority); 965 966 if (chan->hs_hcon && !__chan_is_moving(chan)) { 967 if (chan->hs_hchan) 968 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE); 969 else 970 kfree_skb(skb); 971 972 return; 973 } 974 975 /* Use NO_FLUSH for LE links (where this is the only option) or 976 * if the BR/EDR link supports it and flushing has not been 977 * explicitly requested (through FLAG_FLUSHABLE). 978 */ 979 if (hcon->type == LE_LINK || 980 (!test_bit(FLAG_FLUSHABLE, &chan->flags) && 981 lmp_no_flush_capable(hcon->hdev))) 982 flags = ACL_START_NO_FLUSH; 983 else 984 flags = ACL_START; 985 986 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 987 hci_send_acl(chan->conn->hchan, skb, flags); 988 } 989 990 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control) 991 { 992 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT; 993 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT; 994 995 if (enh & L2CAP_CTRL_FRAME_TYPE) { 996 /* S-Frame */ 997 control->sframe = 1; 998 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT; 999 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT; 1000 1001 control->sar = 0; 1002 control->txseq = 0; 1003 } else { 1004 /* I-Frame */ 1005 control->sframe = 0; 1006 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT; 1007 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT; 1008 1009 control->poll = 0; 1010 control->super = 0; 1011 } 1012 } 1013 1014 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control) 1015 { 1016 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1017 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT; 1018 1019 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) { 1020 /* S-Frame */ 1021 control->sframe = 1; 1022 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT; 1023 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT; 1024 1025 control->sar = 0; 1026 control->txseq = 0; 1027 } else { 1028 /* I-Frame */ 1029 control->sframe = 0; 1030 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT; 1031 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1032 1033 control->poll = 0; 1034 control->super = 0; 1035 } 1036 } 1037 1038 static inline void __unpack_control(struct l2cap_chan *chan, 1039 struct sk_buff *skb) 1040 { 1041 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1042 __unpack_extended_control(get_unaligned_le32(skb->data), 1043 &bt_cb(skb)->l2cap); 1044 skb_pull(skb, L2CAP_EXT_CTRL_SIZE); 1045 } else { 1046 __unpack_enhanced_control(get_unaligned_le16(skb->data), 1047 &bt_cb(skb)->l2cap); 1048 skb_pull(skb, L2CAP_ENH_CTRL_SIZE); 1049 } 1050 } 1051 1052 static u32 __pack_extended_control(struct l2cap_ctrl *control) 1053 { 1054 u32 packed; 1055 1056 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1057 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT; 1058 1059 if (control->sframe) { 1060 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT; 1061 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT; 1062 packed |= L2CAP_EXT_CTRL_FRAME_TYPE; 1063 } else { 1064 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT; 1065 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1066 } 1067 1068 return packed; 1069 } 1070 1071 static u16 __pack_enhanced_control(struct l2cap_ctrl *control) 1072 { 1073 u16 packed; 1074 1075 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT; 1076 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT; 1077 1078 if (control->sframe) { 1079 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT; 1080 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT; 1081 packed |= L2CAP_CTRL_FRAME_TYPE; 1082 } else { 1083 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT; 1084 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT; 1085 } 1086 1087 return packed; 1088 } 1089 1090 static inline void __pack_control(struct l2cap_chan *chan, 1091 struct l2cap_ctrl *control, 1092 struct sk_buff *skb) 1093 { 1094 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1095 put_unaligned_le32(__pack_extended_control(control), 1096 skb->data + L2CAP_HDR_SIZE); 1097 } else { 1098 put_unaligned_le16(__pack_enhanced_control(control), 1099 skb->data + L2CAP_HDR_SIZE); 1100 } 1101 } 1102 1103 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan) 1104 { 1105 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1106 return L2CAP_EXT_HDR_SIZE; 1107 else 1108 return L2CAP_ENH_HDR_SIZE; 1109 } 1110 1111 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan, 1112 u32 control) 1113 { 1114 struct sk_buff *skb; 1115 struct l2cap_hdr *lh; 1116 int hlen = __ertm_hdr_size(chan); 1117 1118 if (chan->fcs == L2CAP_FCS_CRC16) 1119 hlen += L2CAP_FCS_SIZE; 1120 1121 skb = bt_skb_alloc(hlen, GFP_KERNEL); 1122 1123 if (!skb) 1124 return ERR_PTR(-ENOMEM); 1125 1126 lh = skb_put(skb, L2CAP_HDR_SIZE); 1127 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 1128 lh->cid = cpu_to_le16(chan->dcid); 1129 1130 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1131 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 1132 else 1133 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 1134 1135 if (chan->fcs == L2CAP_FCS_CRC16) { 1136 u16 fcs = crc16(0, (u8 *)skb->data, skb->len); 1137 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1138 } 1139 1140 skb->priority = HCI_PRIO_MAX; 1141 return skb; 1142 } 1143 1144 static void l2cap_send_sframe(struct l2cap_chan *chan, 1145 struct l2cap_ctrl *control) 1146 { 1147 struct sk_buff *skb; 1148 u32 control_field; 1149 1150 BT_DBG("chan %p, control %p", chan, control); 1151 1152 if (!control->sframe) 1153 return; 1154 1155 if (__chan_is_moving(chan)) 1156 return; 1157 1158 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) && 1159 !control->poll) 1160 control->final = 1; 1161 1162 if (control->super == L2CAP_SUPER_RR) 1163 clear_bit(CONN_RNR_SENT, &chan->conn_state); 1164 else if (control->super == L2CAP_SUPER_RNR) 1165 set_bit(CONN_RNR_SENT, &chan->conn_state); 1166 1167 if (control->super != L2CAP_SUPER_SREJ) { 1168 chan->last_acked_seq = control->reqseq; 1169 __clear_ack_timer(chan); 1170 } 1171 1172 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq, 1173 control->final, control->poll, control->super); 1174 1175 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1176 control_field = __pack_extended_control(control); 1177 else 1178 control_field = __pack_enhanced_control(control); 1179 1180 skb = l2cap_create_sframe_pdu(chan, control_field); 1181 if (!IS_ERR(skb)) 1182 l2cap_do_send(chan, skb); 1183 } 1184 1185 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll) 1186 { 1187 struct l2cap_ctrl control; 1188 1189 BT_DBG("chan %p, poll %d", chan, poll); 1190 1191 memset(&control, 0, sizeof(control)); 1192 control.sframe = 1; 1193 control.poll = poll; 1194 1195 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 1196 control.super = L2CAP_SUPER_RNR; 1197 else 1198 control.super = L2CAP_SUPER_RR; 1199 1200 control.reqseq = chan->buffer_seq; 1201 l2cap_send_sframe(chan, &control); 1202 } 1203 1204 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 1205 { 1206 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 1207 return true; 1208 1209 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 1210 } 1211 1212 static bool __amp_capable(struct l2cap_chan *chan) 1213 { 1214 struct l2cap_conn *conn = chan->conn; 1215 struct hci_dev *hdev; 1216 bool amp_available = false; 1217 1218 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) 1219 return false; 1220 1221 if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP)) 1222 return false; 1223 1224 read_lock(&hci_dev_list_lock); 1225 list_for_each_entry(hdev, &hci_dev_list, list) { 1226 if (hdev->amp_type != AMP_TYPE_BREDR && 1227 test_bit(HCI_UP, &hdev->flags)) { 1228 amp_available = true; 1229 break; 1230 } 1231 } 1232 read_unlock(&hci_dev_list_lock); 1233 1234 if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED) 1235 return amp_available; 1236 1237 return false; 1238 } 1239 1240 static bool l2cap_check_efs(struct l2cap_chan *chan) 1241 { 1242 /* Check EFS parameters */ 1243 return true; 1244 } 1245 1246 void l2cap_send_conn_req(struct l2cap_chan *chan) 1247 { 1248 struct l2cap_conn *conn = chan->conn; 1249 struct l2cap_conn_req req; 1250 1251 req.scid = cpu_to_le16(chan->scid); 1252 req.psm = chan->psm; 1253 1254 chan->ident = l2cap_get_ident(conn); 1255 1256 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 1257 1258 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req); 1259 } 1260 1261 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id) 1262 { 1263 struct l2cap_create_chan_req req; 1264 req.scid = cpu_to_le16(chan->scid); 1265 req.psm = chan->psm; 1266 req.amp_id = amp_id; 1267 1268 chan->ident = l2cap_get_ident(chan->conn); 1269 1270 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ, 1271 sizeof(req), &req); 1272 } 1273 1274 static void l2cap_move_setup(struct l2cap_chan *chan) 1275 { 1276 struct sk_buff *skb; 1277 1278 BT_DBG("chan %p", chan); 1279 1280 if (chan->mode != L2CAP_MODE_ERTM) 1281 return; 1282 1283 __clear_retrans_timer(chan); 1284 __clear_monitor_timer(chan); 1285 __clear_ack_timer(chan); 1286 1287 chan->retry_count = 0; 1288 skb_queue_walk(&chan->tx_q, skb) { 1289 if (bt_cb(skb)->l2cap.retries) 1290 bt_cb(skb)->l2cap.retries = 1; 1291 else 1292 break; 1293 } 1294 1295 chan->expected_tx_seq = chan->buffer_seq; 1296 1297 clear_bit(CONN_REJ_ACT, &chan->conn_state); 1298 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 1299 l2cap_seq_list_clear(&chan->retrans_list); 1300 l2cap_seq_list_clear(&chan->srej_list); 1301 skb_queue_purge(&chan->srej_q); 1302 1303 chan->tx_state = L2CAP_TX_STATE_XMIT; 1304 chan->rx_state = L2CAP_RX_STATE_MOVE; 1305 1306 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 1307 } 1308 1309 static void l2cap_move_done(struct l2cap_chan *chan) 1310 { 1311 u8 move_role = chan->move_role; 1312 BT_DBG("chan %p", chan); 1313 1314 chan->move_state = L2CAP_MOVE_STABLE; 1315 chan->move_role = L2CAP_MOVE_ROLE_NONE; 1316 1317 if (chan->mode != L2CAP_MODE_ERTM) 1318 return; 1319 1320 switch (move_role) { 1321 case L2CAP_MOVE_ROLE_INITIATOR: 1322 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL); 1323 chan->rx_state = L2CAP_RX_STATE_WAIT_F; 1324 break; 1325 case L2CAP_MOVE_ROLE_RESPONDER: 1326 chan->rx_state = L2CAP_RX_STATE_WAIT_P; 1327 break; 1328 } 1329 } 1330 1331 static void l2cap_chan_ready(struct l2cap_chan *chan) 1332 { 1333 /* The channel may have already been flagged as connected in 1334 * case of receiving data before the L2CAP info req/rsp 1335 * procedure is complete. 1336 */ 1337 if (chan->state == BT_CONNECTED) 1338 return; 1339 1340 /* This clears all conf flags, including CONF_NOT_COMPLETE */ 1341 chan->conf_state = 0; 1342 __clear_chan_timer(chan); 1343 1344 switch (chan->mode) { 1345 case L2CAP_MODE_LE_FLOWCTL: 1346 case L2CAP_MODE_EXT_FLOWCTL: 1347 if (!chan->tx_credits) 1348 chan->ops->suspend(chan); 1349 break; 1350 } 1351 1352 chan->state = BT_CONNECTED; 1353 1354 chan->ops->ready(chan); 1355 } 1356 1357 static void l2cap_le_connect(struct l2cap_chan *chan) 1358 { 1359 struct l2cap_conn *conn = chan->conn; 1360 struct l2cap_le_conn_req req; 1361 1362 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags)) 1363 return; 1364 1365 if (!chan->imtu) 1366 chan->imtu = chan->conn->mtu; 1367 1368 l2cap_le_flowctl_init(chan, 0); 1369 1370 req.psm = chan->psm; 1371 req.scid = cpu_to_le16(chan->scid); 1372 req.mtu = cpu_to_le16(chan->imtu); 1373 req.mps = cpu_to_le16(chan->mps); 1374 req.credits = cpu_to_le16(chan->rx_credits); 1375 1376 chan->ident = l2cap_get_ident(conn); 1377 1378 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ, 1379 sizeof(req), &req); 1380 } 1381 1382 struct l2cap_ecred_conn_data { 1383 struct { 1384 struct l2cap_ecred_conn_req req; 1385 __le16 scid[5]; 1386 } __packed pdu; 1387 struct l2cap_chan *chan; 1388 struct pid *pid; 1389 int count; 1390 }; 1391 1392 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data) 1393 { 1394 struct l2cap_ecred_conn_data *conn = data; 1395 struct pid *pid; 1396 1397 if (chan == conn->chan) 1398 return; 1399 1400 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 1401 return; 1402 1403 pid = chan->ops->get_peer_pid(chan); 1404 1405 /* Only add deferred channels with the same PID/PSM */ 1406 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident || 1407 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 1408 return; 1409 1410 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1411 return; 1412 1413 l2cap_ecred_init(chan, 0); 1414 1415 /* Set the same ident so we can match on the rsp */ 1416 chan->ident = conn->chan->ident; 1417 1418 /* Include all channels deferred */ 1419 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid); 1420 1421 conn->count++; 1422 } 1423 1424 static void l2cap_ecred_connect(struct l2cap_chan *chan) 1425 { 1426 struct l2cap_conn *conn = chan->conn; 1427 struct l2cap_ecred_conn_data data; 1428 1429 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 1430 return; 1431 1432 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1433 return; 1434 1435 l2cap_ecred_init(chan, 0); 1436 1437 data.pdu.req.psm = chan->psm; 1438 data.pdu.req.mtu = cpu_to_le16(chan->imtu); 1439 data.pdu.req.mps = cpu_to_le16(chan->mps); 1440 data.pdu.req.credits = cpu_to_le16(chan->rx_credits); 1441 data.pdu.scid[0] = cpu_to_le16(chan->scid); 1442 1443 chan->ident = l2cap_get_ident(conn); 1444 data.pid = chan->ops->get_peer_pid(chan); 1445 1446 data.count = 1; 1447 data.chan = chan; 1448 data.pid = chan->ops->get_peer_pid(chan); 1449 1450 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data); 1451 1452 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ, 1453 sizeof(data.pdu.req) + data.count * sizeof(__le16), 1454 &data.pdu); 1455 } 1456 1457 static void l2cap_le_start(struct l2cap_chan *chan) 1458 { 1459 struct l2cap_conn *conn = chan->conn; 1460 1461 if (!smp_conn_security(conn->hcon, chan->sec_level)) 1462 return; 1463 1464 if (!chan->psm) { 1465 l2cap_chan_ready(chan); 1466 return; 1467 } 1468 1469 if (chan->state == BT_CONNECT) { 1470 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) 1471 l2cap_ecred_connect(chan); 1472 else 1473 l2cap_le_connect(chan); 1474 } 1475 } 1476 1477 static void l2cap_start_connection(struct l2cap_chan *chan) 1478 { 1479 if (__amp_capable(chan)) { 1480 BT_DBG("chan %p AMP capable: discover AMPs", chan); 1481 a2mp_discover_amp(chan); 1482 } else if (chan->conn->hcon->type == LE_LINK) { 1483 l2cap_le_start(chan); 1484 } else { 1485 l2cap_send_conn_req(chan); 1486 } 1487 } 1488 1489 static void l2cap_request_info(struct l2cap_conn *conn) 1490 { 1491 struct l2cap_info_req req; 1492 1493 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1494 return; 1495 1496 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 1497 1498 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 1499 conn->info_ident = l2cap_get_ident(conn); 1500 1501 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 1502 1503 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 1504 sizeof(req), &req); 1505 } 1506 1507 static bool l2cap_check_enc_key_size(struct hci_conn *hcon) 1508 { 1509 /* The minimum encryption key size needs to be enforced by the 1510 * host stack before establishing any L2CAP connections. The 1511 * specification in theory allows a minimum of 1, but to align 1512 * BR/EDR and LE transports, a minimum of 7 is chosen. 1513 * 1514 * This check might also be called for unencrypted connections 1515 * that have no key size requirements. Ensure that the link is 1516 * actually encrypted before enforcing a key size. 1517 */ 1518 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || 1519 hcon->enc_key_size >= hcon->hdev->min_enc_key_size); 1520 } 1521 1522 static void l2cap_do_start(struct l2cap_chan *chan) 1523 { 1524 struct l2cap_conn *conn = chan->conn; 1525 1526 if (conn->hcon->type == LE_LINK) { 1527 l2cap_le_start(chan); 1528 return; 1529 } 1530 1531 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) { 1532 l2cap_request_info(conn); 1533 return; 1534 } 1535 1536 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 1537 return; 1538 1539 if (!l2cap_chan_check_security(chan, true) || 1540 !__l2cap_no_conn_pending(chan)) 1541 return; 1542 1543 if (l2cap_check_enc_key_size(conn->hcon)) 1544 l2cap_start_connection(chan); 1545 else 1546 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 1547 } 1548 1549 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 1550 { 1551 u32 local_feat_mask = l2cap_feat_mask; 1552 if (!disable_ertm) 1553 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 1554 1555 switch (mode) { 1556 case L2CAP_MODE_ERTM: 1557 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 1558 case L2CAP_MODE_STREAMING: 1559 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 1560 default: 1561 return 0x00; 1562 } 1563 } 1564 1565 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err) 1566 { 1567 struct l2cap_conn *conn = chan->conn; 1568 struct l2cap_disconn_req req; 1569 1570 if (!conn) 1571 return; 1572 1573 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) { 1574 __clear_retrans_timer(chan); 1575 __clear_monitor_timer(chan); 1576 __clear_ack_timer(chan); 1577 } 1578 1579 if (chan->scid == L2CAP_CID_A2MP) { 1580 l2cap_state_change(chan, BT_DISCONN); 1581 return; 1582 } 1583 1584 req.dcid = cpu_to_le16(chan->dcid); 1585 req.scid = cpu_to_le16(chan->scid); 1586 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ, 1587 sizeof(req), &req); 1588 1589 l2cap_state_change_and_error(chan, BT_DISCONN, err); 1590 } 1591 1592 /* ---- L2CAP connections ---- */ 1593 static void l2cap_conn_start(struct l2cap_conn *conn) 1594 { 1595 struct l2cap_chan *chan, *tmp; 1596 1597 BT_DBG("conn %p", conn); 1598 1599 mutex_lock(&conn->chan_lock); 1600 1601 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 1602 l2cap_chan_lock(chan); 1603 1604 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1605 l2cap_chan_ready(chan); 1606 l2cap_chan_unlock(chan); 1607 continue; 1608 } 1609 1610 if (chan->state == BT_CONNECT) { 1611 if (!l2cap_chan_check_security(chan, true) || 1612 !__l2cap_no_conn_pending(chan)) { 1613 l2cap_chan_unlock(chan); 1614 continue; 1615 } 1616 1617 if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 1618 && test_bit(CONF_STATE2_DEVICE, 1619 &chan->conf_state)) { 1620 l2cap_chan_close(chan, ECONNRESET); 1621 l2cap_chan_unlock(chan); 1622 continue; 1623 } 1624 1625 if (l2cap_check_enc_key_size(conn->hcon)) 1626 l2cap_start_connection(chan); 1627 else 1628 l2cap_chan_close(chan, ECONNREFUSED); 1629 1630 } else if (chan->state == BT_CONNECT2) { 1631 struct l2cap_conn_rsp rsp; 1632 char buf[128]; 1633 rsp.scid = cpu_to_le16(chan->dcid); 1634 rsp.dcid = cpu_to_le16(chan->scid); 1635 1636 if (l2cap_chan_check_security(chan, false)) { 1637 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 1638 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1639 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 1640 chan->ops->defer(chan); 1641 1642 } else { 1643 l2cap_state_change(chan, BT_CONFIG); 1644 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 1645 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 1646 } 1647 } else { 1648 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1649 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 1650 } 1651 1652 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 1653 sizeof(rsp), &rsp); 1654 1655 if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 1656 rsp.result != L2CAP_CR_SUCCESS) { 1657 l2cap_chan_unlock(chan); 1658 continue; 1659 } 1660 1661 set_bit(CONF_REQ_SENT, &chan->conf_state); 1662 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 1663 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 1664 chan->num_conf_req++; 1665 } 1666 1667 l2cap_chan_unlock(chan); 1668 } 1669 1670 mutex_unlock(&conn->chan_lock); 1671 } 1672 1673 static void l2cap_le_conn_ready(struct l2cap_conn *conn) 1674 { 1675 struct hci_conn *hcon = conn->hcon; 1676 struct hci_dev *hdev = hcon->hdev; 1677 1678 BT_DBG("%s conn %p", hdev->name, conn); 1679 1680 /* For outgoing pairing which doesn't necessarily have an 1681 * associated socket (e.g. mgmt_pair_device). 1682 */ 1683 if (hcon->out) 1684 smp_conn_security(hcon, hcon->pending_sec_level); 1685 1686 /* For LE slave connections, make sure the connection interval 1687 * is in the range of the minium and maximum interval that has 1688 * been configured for this connection. If not, then trigger 1689 * the connection update procedure. 1690 */ 1691 if (hcon->role == HCI_ROLE_SLAVE && 1692 (hcon->le_conn_interval < hcon->le_conn_min_interval || 1693 hcon->le_conn_interval > hcon->le_conn_max_interval)) { 1694 struct l2cap_conn_param_update_req req; 1695 1696 req.min = cpu_to_le16(hcon->le_conn_min_interval); 1697 req.max = cpu_to_le16(hcon->le_conn_max_interval); 1698 req.latency = cpu_to_le16(hcon->le_conn_latency); 1699 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout); 1700 1701 l2cap_send_cmd(conn, l2cap_get_ident(conn), 1702 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req); 1703 } 1704 } 1705 1706 static void l2cap_conn_ready(struct l2cap_conn *conn) 1707 { 1708 struct l2cap_chan *chan; 1709 struct hci_conn *hcon = conn->hcon; 1710 1711 BT_DBG("conn %p", conn); 1712 1713 if (hcon->type == ACL_LINK) 1714 l2cap_request_info(conn); 1715 1716 mutex_lock(&conn->chan_lock); 1717 1718 list_for_each_entry(chan, &conn->chan_l, list) { 1719 1720 l2cap_chan_lock(chan); 1721 1722 if (chan->scid == L2CAP_CID_A2MP) { 1723 l2cap_chan_unlock(chan); 1724 continue; 1725 } 1726 1727 if (hcon->type == LE_LINK) { 1728 l2cap_le_start(chan); 1729 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1730 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 1731 l2cap_chan_ready(chan); 1732 } else if (chan->state == BT_CONNECT) { 1733 l2cap_do_start(chan); 1734 } 1735 1736 l2cap_chan_unlock(chan); 1737 } 1738 1739 mutex_unlock(&conn->chan_lock); 1740 1741 if (hcon->type == LE_LINK) 1742 l2cap_le_conn_ready(conn); 1743 1744 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work); 1745 } 1746 1747 /* Notify sockets that we cannot guaranty reliability anymore */ 1748 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 1749 { 1750 struct l2cap_chan *chan; 1751 1752 BT_DBG("conn %p", conn); 1753 1754 mutex_lock(&conn->chan_lock); 1755 1756 list_for_each_entry(chan, &conn->chan_l, list) { 1757 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 1758 l2cap_chan_set_err(chan, err); 1759 } 1760 1761 mutex_unlock(&conn->chan_lock); 1762 } 1763 1764 static void l2cap_info_timeout(struct work_struct *work) 1765 { 1766 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 1767 info_timer.work); 1768 1769 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 1770 conn->info_ident = 0; 1771 1772 l2cap_conn_start(conn); 1773 } 1774 1775 /* 1776 * l2cap_user 1777 * External modules can register l2cap_user objects on l2cap_conn. The ->probe 1778 * callback is called during registration. The ->remove callback is called 1779 * during unregistration. 1780 * An l2cap_user object can either be explicitly unregistered or when the 1781 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon, 1782 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called. 1783 * External modules must own a reference to the l2cap_conn object if they intend 1784 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at 1785 * any time if they don't. 1786 */ 1787 1788 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user) 1789 { 1790 struct hci_dev *hdev = conn->hcon->hdev; 1791 int ret; 1792 1793 /* We need to check whether l2cap_conn is registered. If it is not, we 1794 * must not register the l2cap_user. l2cap_conn_del() is unregisters 1795 * l2cap_conn objects, but doesn't provide its own locking. Instead, it 1796 * relies on the parent hci_conn object to be locked. This itself relies 1797 * on the hci_dev object to be locked. So we must lock the hci device 1798 * here, too. */ 1799 1800 hci_dev_lock(hdev); 1801 1802 if (!list_empty(&user->list)) { 1803 ret = -EINVAL; 1804 goto out_unlock; 1805 } 1806 1807 /* conn->hchan is NULL after l2cap_conn_del() was called */ 1808 if (!conn->hchan) { 1809 ret = -ENODEV; 1810 goto out_unlock; 1811 } 1812 1813 ret = user->probe(conn, user); 1814 if (ret) 1815 goto out_unlock; 1816 1817 list_add(&user->list, &conn->users); 1818 ret = 0; 1819 1820 out_unlock: 1821 hci_dev_unlock(hdev); 1822 return ret; 1823 } 1824 EXPORT_SYMBOL(l2cap_register_user); 1825 1826 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) 1827 { 1828 struct hci_dev *hdev = conn->hcon->hdev; 1829 1830 hci_dev_lock(hdev); 1831 1832 if (list_empty(&user->list)) 1833 goto out_unlock; 1834 1835 list_del_init(&user->list); 1836 user->remove(conn, user); 1837 1838 out_unlock: 1839 hci_dev_unlock(hdev); 1840 } 1841 EXPORT_SYMBOL(l2cap_unregister_user); 1842 1843 static void l2cap_unregister_all_users(struct l2cap_conn *conn) 1844 { 1845 struct l2cap_user *user; 1846 1847 while (!list_empty(&conn->users)) { 1848 user = list_first_entry(&conn->users, struct l2cap_user, list); 1849 list_del_init(&user->list); 1850 user->remove(conn, user); 1851 } 1852 } 1853 1854 static void l2cap_conn_del(struct hci_conn *hcon, int err) 1855 { 1856 struct l2cap_conn *conn = hcon->l2cap_data; 1857 struct l2cap_chan *chan, *l; 1858 1859 if (!conn) 1860 return; 1861 1862 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 1863 1864 kfree_skb(conn->rx_skb); 1865 1866 skb_queue_purge(&conn->pending_rx); 1867 1868 /* We can not call flush_work(&conn->pending_rx_work) here since we 1869 * might block if we are running on a worker from the same workqueue 1870 * pending_rx_work is waiting on. 1871 */ 1872 if (work_pending(&conn->pending_rx_work)) 1873 cancel_work_sync(&conn->pending_rx_work); 1874 1875 if (work_pending(&conn->id_addr_update_work)) 1876 cancel_work_sync(&conn->id_addr_update_work); 1877 1878 l2cap_unregister_all_users(conn); 1879 1880 /* Force the connection to be immediately dropped */ 1881 hcon->disc_timeout = 0; 1882 1883 mutex_lock(&conn->chan_lock); 1884 1885 /* Kill channels */ 1886 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 1887 l2cap_chan_hold(chan); 1888 l2cap_chan_lock(chan); 1889 1890 l2cap_chan_del(chan, err); 1891 1892 chan->ops->close(chan); 1893 1894 l2cap_chan_unlock(chan); 1895 l2cap_chan_put(chan); 1896 } 1897 1898 mutex_unlock(&conn->chan_lock); 1899 1900 hci_chan_del(conn->hchan); 1901 1902 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1903 cancel_delayed_work_sync(&conn->info_timer); 1904 1905 hcon->l2cap_data = NULL; 1906 conn->hchan = NULL; 1907 l2cap_conn_put(conn); 1908 } 1909 1910 static void l2cap_conn_free(struct kref *ref) 1911 { 1912 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); 1913 1914 hci_conn_put(conn->hcon); 1915 kfree(conn); 1916 } 1917 1918 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn) 1919 { 1920 kref_get(&conn->ref); 1921 return conn; 1922 } 1923 EXPORT_SYMBOL(l2cap_conn_get); 1924 1925 void l2cap_conn_put(struct l2cap_conn *conn) 1926 { 1927 kref_put(&conn->ref, l2cap_conn_free); 1928 } 1929 EXPORT_SYMBOL(l2cap_conn_put); 1930 1931 /* ---- Socket interface ---- */ 1932 1933 /* Find socket with psm and source / destination bdaddr. 1934 * Returns closest match. 1935 */ 1936 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, 1937 bdaddr_t *src, 1938 bdaddr_t *dst, 1939 u8 link_type) 1940 { 1941 struct l2cap_chan *c, *c1 = NULL; 1942 1943 read_lock(&chan_list_lock); 1944 1945 list_for_each_entry(c, &chan_list, global_l) { 1946 if (state && c->state != state) 1947 continue; 1948 1949 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR) 1950 continue; 1951 1952 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR) 1953 continue; 1954 1955 if (c->psm == psm) { 1956 int src_match, dst_match; 1957 int src_any, dst_any; 1958 1959 /* Exact match. */ 1960 src_match = !bacmp(&c->src, src); 1961 dst_match = !bacmp(&c->dst, dst); 1962 if (src_match && dst_match) { 1963 l2cap_chan_hold(c); 1964 read_unlock(&chan_list_lock); 1965 return c; 1966 } 1967 1968 /* Closest match */ 1969 src_any = !bacmp(&c->src, BDADDR_ANY); 1970 dst_any = !bacmp(&c->dst, BDADDR_ANY); 1971 if ((src_match && dst_any) || (src_any && dst_match) || 1972 (src_any && dst_any)) 1973 c1 = c; 1974 } 1975 } 1976 1977 if (c1) 1978 l2cap_chan_hold(c1); 1979 1980 read_unlock(&chan_list_lock); 1981 1982 return c1; 1983 } 1984 1985 static void l2cap_monitor_timeout(struct work_struct *work) 1986 { 1987 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 1988 monitor_timer.work); 1989 1990 BT_DBG("chan %p", chan); 1991 1992 l2cap_chan_lock(chan); 1993 1994 if (!chan->conn) { 1995 l2cap_chan_unlock(chan); 1996 l2cap_chan_put(chan); 1997 return; 1998 } 1999 2000 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO); 2001 2002 l2cap_chan_unlock(chan); 2003 l2cap_chan_put(chan); 2004 } 2005 2006 static void l2cap_retrans_timeout(struct work_struct *work) 2007 { 2008 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 2009 retrans_timer.work); 2010 2011 BT_DBG("chan %p", chan); 2012 2013 l2cap_chan_lock(chan); 2014 2015 if (!chan->conn) { 2016 l2cap_chan_unlock(chan); 2017 l2cap_chan_put(chan); 2018 return; 2019 } 2020 2021 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO); 2022 l2cap_chan_unlock(chan); 2023 l2cap_chan_put(chan); 2024 } 2025 2026 static void l2cap_streaming_send(struct l2cap_chan *chan, 2027 struct sk_buff_head *skbs) 2028 { 2029 struct sk_buff *skb; 2030 struct l2cap_ctrl *control; 2031 2032 BT_DBG("chan %p, skbs %p", chan, skbs); 2033 2034 if (__chan_is_moving(chan)) 2035 return; 2036 2037 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2038 2039 while (!skb_queue_empty(&chan->tx_q)) { 2040 2041 skb = skb_dequeue(&chan->tx_q); 2042 2043 bt_cb(skb)->l2cap.retries = 1; 2044 control = &bt_cb(skb)->l2cap; 2045 2046 control->reqseq = 0; 2047 control->txseq = chan->next_tx_seq; 2048 2049 __pack_control(chan, control, skb); 2050 2051 if (chan->fcs == L2CAP_FCS_CRC16) { 2052 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2053 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2054 } 2055 2056 l2cap_do_send(chan, skb); 2057 2058 BT_DBG("Sent txseq %u", control->txseq); 2059 2060 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2061 chan->frames_sent++; 2062 } 2063 } 2064 2065 static int l2cap_ertm_send(struct l2cap_chan *chan) 2066 { 2067 struct sk_buff *skb, *tx_skb; 2068 struct l2cap_ctrl *control; 2069 int sent = 0; 2070 2071 BT_DBG("chan %p", chan); 2072 2073 if (chan->state != BT_CONNECTED) 2074 return -ENOTCONN; 2075 2076 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2077 return 0; 2078 2079 if (__chan_is_moving(chan)) 2080 return 0; 2081 2082 while (chan->tx_send_head && 2083 chan->unacked_frames < chan->remote_tx_win && 2084 chan->tx_state == L2CAP_TX_STATE_XMIT) { 2085 2086 skb = chan->tx_send_head; 2087 2088 bt_cb(skb)->l2cap.retries = 1; 2089 control = &bt_cb(skb)->l2cap; 2090 2091 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2092 control->final = 1; 2093 2094 control->reqseq = chan->buffer_seq; 2095 chan->last_acked_seq = chan->buffer_seq; 2096 control->txseq = chan->next_tx_seq; 2097 2098 __pack_control(chan, control, skb); 2099 2100 if (chan->fcs == L2CAP_FCS_CRC16) { 2101 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 2102 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 2103 } 2104 2105 /* Clone after data has been modified. Data is assumed to be 2106 read-only (for locking purposes) on cloned sk_buffs. 2107 */ 2108 tx_skb = skb_clone(skb, GFP_KERNEL); 2109 2110 if (!tx_skb) 2111 break; 2112 2113 __set_retrans_timer(chan); 2114 2115 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2116 chan->unacked_frames++; 2117 chan->frames_sent++; 2118 sent++; 2119 2120 if (skb_queue_is_last(&chan->tx_q, skb)) 2121 chan->tx_send_head = NULL; 2122 else 2123 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 2124 2125 l2cap_do_send(chan, tx_skb); 2126 BT_DBG("Sent txseq %u", control->txseq); 2127 } 2128 2129 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent, 2130 chan->unacked_frames, skb_queue_len(&chan->tx_q)); 2131 2132 return sent; 2133 } 2134 2135 static void l2cap_ertm_resend(struct l2cap_chan *chan) 2136 { 2137 struct l2cap_ctrl control; 2138 struct sk_buff *skb; 2139 struct sk_buff *tx_skb; 2140 u16 seq; 2141 2142 BT_DBG("chan %p", chan); 2143 2144 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2145 return; 2146 2147 if (__chan_is_moving(chan)) 2148 return; 2149 2150 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) { 2151 seq = l2cap_seq_list_pop(&chan->retrans_list); 2152 2153 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq); 2154 if (!skb) { 2155 BT_DBG("Error: Can't retransmit seq %d, frame missing", 2156 seq); 2157 continue; 2158 } 2159 2160 bt_cb(skb)->l2cap.retries++; 2161 control = bt_cb(skb)->l2cap; 2162 2163 if (chan->max_tx != 0 && 2164 bt_cb(skb)->l2cap.retries > chan->max_tx) { 2165 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 2166 l2cap_send_disconn_req(chan, ECONNRESET); 2167 l2cap_seq_list_clear(&chan->retrans_list); 2168 break; 2169 } 2170 2171 control.reqseq = chan->buffer_seq; 2172 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2173 control.final = 1; 2174 else 2175 control.final = 0; 2176 2177 if (skb_cloned(skb)) { 2178 /* Cloned sk_buffs are read-only, so we need a 2179 * writeable copy 2180 */ 2181 tx_skb = skb_copy(skb, GFP_KERNEL); 2182 } else { 2183 tx_skb = skb_clone(skb, GFP_KERNEL); 2184 } 2185 2186 if (!tx_skb) { 2187 l2cap_seq_list_clear(&chan->retrans_list); 2188 break; 2189 } 2190 2191 /* Update skb contents */ 2192 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 2193 put_unaligned_le32(__pack_extended_control(&control), 2194 tx_skb->data + L2CAP_HDR_SIZE); 2195 } else { 2196 put_unaligned_le16(__pack_enhanced_control(&control), 2197 tx_skb->data + L2CAP_HDR_SIZE); 2198 } 2199 2200 /* Update FCS */ 2201 if (chan->fcs == L2CAP_FCS_CRC16) { 2202 u16 fcs = crc16(0, (u8 *) tx_skb->data, 2203 tx_skb->len - L2CAP_FCS_SIZE); 2204 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) - 2205 L2CAP_FCS_SIZE); 2206 } 2207 2208 l2cap_do_send(chan, tx_skb); 2209 2210 BT_DBG("Resent txseq %d", control.txseq); 2211 2212 chan->last_acked_seq = chan->buffer_seq; 2213 } 2214 } 2215 2216 static void l2cap_retransmit(struct l2cap_chan *chan, 2217 struct l2cap_ctrl *control) 2218 { 2219 BT_DBG("chan %p, control %p", chan, control); 2220 2221 l2cap_seq_list_append(&chan->retrans_list, control->reqseq); 2222 l2cap_ertm_resend(chan); 2223 } 2224 2225 static void l2cap_retransmit_all(struct l2cap_chan *chan, 2226 struct l2cap_ctrl *control) 2227 { 2228 struct sk_buff *skb; 2229 2230 BT_DBG("chan %p, control %p", chan, control); 2231 2232 if (control->poll) 2233 set_bit(CONN_SEND_FBIT, &chan->conn_state); 2234 2235 l2cap_seq_list_clear(&chan->retrans_list); 2236 2237 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2238 return; 2239 2240 if (chan->unacked_frames) { 2241 skb_queue_walk(&chan->tx_q, skb) { 2242 if (bt_cb(skb)->l2cap.txseq == control->reqseq || 2243 skb == chan->tx_send_head) 2244 break; 2245 } 2246 2247 skb_queue_walk_from(&chan->tx_q, skb) { 2248 if (skb == chan->tx_send_head) 2249 break; 2250 2251 l2cap_seq_list_append(&chan->retrans_list, 2252 bt_cb(skb)->l2cap.txseq); 2253 } 2254 2255 l2cap_ertm_resend(chan); 2256 } 2257 } 2258 2259 static void l2cap_send_ack(struct l2cap_chan *chan) 2260 { 2261 struct l2cap_ctrl control; 2262 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 2263 chan->last_acked_seq); 2264 int threshold; 2265 2266 BT_DBG("chan %p last_acked_seq %d buffer_seq %d", 2267 chan, chan->last_acked_seq, chan->buffer_seq); 2268 2269 memset(&control, 0, sizeof(control)); 2270 control.sframe = 1; 2271 2272 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 2273 chan->rx_state == L2CAP_RX_STATE_RECV) { 2274 __clear_ack_timer(chan); 2275 control.super = L2CAP_SUPER_RNR; 2276 control.reqseq = chan->buffer_seq; 2277 l2cap_send_sframe(chan, &control); 2278 } else { 2279 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) { 2280 l2cap_ertm_send(chan); 2281 /* If any i-frames were sent, they included an ack */ 2282 if (chan->buffer_seq == chan->last_acked_seq) 2283 frames_to_ack = 0; 2284 } 2285 2286 /* Ack now if the window is 3/4ths full. 2287 * Calculate without mul or div 2288 */ 2289 threshold = chan->ack_win; 2290 threshold += threshold << 1; 2291 threshold >>= 2; 2292 2293 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack, 2294 threshold); 2295 2296 if (frames_to_ack >= threshold) { 2297 __clear_ack_timer(chan); 2298 control.super = L2CAP_SUPER_RR; 2299 control.reqseq = chan->buffer_seq; 2300 l2cap_send_sframe(chan, &control); 2301 frames_to_ack = 0; 2302 } 2303 2304 if (frames_to_ack) 2305 __set_ack_timer(chan); 2306 } 2307 } 2308 2309 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan, 2310 struct msghdr *msg, int len, 2311 int count, struct sk_buff *skb) 2312 { 2313 struct l2cap_conn *conn = chan->conn; 2314 struct sk_buff **frag; 2315 int sent = 0; 2316 2317 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter)) 2318 return -EFAULT; 2319 2320 sent += count; 2321 len -= count; 2322 2323 /* Continuation fragments (no L2CAP header) */ 2324 frag = &skb_shinfo(skb)->frag_list; 2325 while (len) { 2326 struct sk_buff *tmp; 2327 2328 count = min_t(unsigned int, conn->mtu, len); 2329 2330 tmp = chan->ops->alloc_skb(chan, 0, count, 2331 msg->msg_flags & MSG_DONTWAIT); 2332 if (IS_ERR(tmp)) 2333 return PTR_ERR(tmp); 2334 2335 *frag = tmp; 2336 2337 if (!copy_from_iter_full(skb_put(*frag, count), count, 2338 &msg->msg_iter)) 2339 return -EFAULT; 2340 2341 sent += count; 2342 len -= count; 2343 2344 skb->len += (*frag)->len; 2345 skb->data_len += (*frag)->len; 2346 2347 frag = &(*frag)->next; 2348 } 2349 2350 return sent; 2351 } 2352 2353 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, 2354 struct msghdr *msg, size_t len) 2355 { 2356 struct l2cap_conn *conn = chan->conn; 2357 struct sk_buff *skb; 2358 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE; 2359 struct l2cap_hdr *lh; 2360 2361 BT_DBG("chan %p psm 0x%2.2x len %zu", chan, 2362 __le16_to_cpu(chan->psm), len); 2363 2364 count = min_t(unsigned int, (conn->mtu - hlen), len); 2365 2366 skb = chan->ops->alloc_skb(chan, hlen, count, 2367 msg->msg_flags & MSG_DONTWAIT); 2368 if (IS_ERR(skb)) 2369 return skb; 2370 2371 /* Create L2CAP header */ 2372 lh = skb_put(skb, L2CAP_HDR_SIZE); 2373 lh->cid = cpu_to_le16(chan->dcid); 2374 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE); 2375 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE)); 2376 2377 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2378 if (unlikely(err < 0)) { 2379 kfree_skb(skb); 2380 return ERR_PTR(err); 2381 } 2382 return skb; 2383 } 2384 2385 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, 2386 struct msghdr *msg, size_t len) 2387 { 2388 struct l2cap_conn *conn = chan->conn; 2389 struct sk_buff *skb; 2390 int err, count; 2391 struct l2cap_hdr *lh; 2392 2393 BT_DBG("chan %p len %zu", chan, len); 2394 2395 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len); 2396 2397 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count, 2398 msg->msg_flags & MSG_DONTWAIT); 2399 if (IS_ERR(skb)) 2400 return skb; 2401 2402 /* Create L2CAP header */ 2403 lh = skb_put(skb, L2CAP_HDR_SIZE); 2404 lh->cid = cpu_to_le16(chan->dcid); 2405 lh->len = cpu_to_le16(len); 2406 2407 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2408 if (unlikely(err < 0)) { 2409 kfree_skb(skb); 2410 return ERR_PTR(err); 2411 } 2412 return skb; 2413 } 2414 2415 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 2416 struct msghdr *msg, size_t len, 2417 u16 sdulen) 2418 { 2419 struct l2cap_conn *conn = chan->conn; 2420 struct sk_buff *skb; 2421 int err, count, hlen; 2422 struct l2cap_hdr *lh; 2423 2424 BT_DBG("chan %p len %zu", chan, len); 2425 2426 if (!conn) 2427 return ERR_PTR(-ENOTCONN); 2428 2429 hlen = __ertm_hdr_size(chan); 2430 2431 if (sdulen) 2432 hlen += L2CAP_SDULEN_SIZE; 2433 2434 if (chan->fcs == L2CAP_FCS_CRC16) 2435 hlen += L2CAP_FCS_SIZE; 2436 2437 count = min_t(unsigned int, (conn->mtu - hlen), len); 2438 2439 skb = chan->ops->alloc_skb(chan, hlen, count, 2440 msg->msg_flags & MSG_DONTWAIT); 2441 if (IS_ERR(skb)) 2442 return skb; 2443 2444 /* Create L2CAP header */ 2445 lh = skb_put(skb, L2CAP_HDR_SIZE); 2446 lh->cid = cpu_to_le16(chan->dcid); 2447 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2448 2449 /* Control header is populated later */ 2450 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 2451 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 2452 else 2453 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 2454 2455 if (sdulen) 2456 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2457 2458 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2459 if (unlikely(err < 0)) { 2460 kfree_skb(skb); 2461 return ERR_PTR(err); 2462 } 2463 2464 bt_cb(skb)->l2cap.fcs = chan->fcs; 2465 bt_cb(skb)->l2cap.retries = 0; 2466 return skb; 2467 } 2468 2469 static int l2cap_segment_sdu(struct l2cap_chan *chan, 2470 struct sk_buff_head *seg_queue, 2471 struct msghdr *msg, size_t len) 2472 { 2473 struct sk_buff *skb; 2474 u16 sdu_len; 2475 size_t pdu_len; 2476 u8 sar; 2477 2478 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2479 2480 /* It is critical that ERTM PDUs fit in a single HCI fragment, 2481 * so fragmented skbs are not used. The HCI layer's handling 2482 * of fragmented skbs is not compatible with ERTM's queueing. 2483 */ 2484 2485 /* PDU size is derived from the HCI MTU */ 2486 pdu_len = chan->conn->mtu; 2487 2488 /* Constrain PDU size for BR/EDR connections */ 2489 if (!chan->hs_hcon) 2490 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); 2491 2492 /* Adjust for largest possible L2CAP overhead. */ 2493 if (chan->fcs) 2494 pdu_len -= L2CAP_FCS_SIZE; 2495 2496 pdu_len -= __ertm_hdr_size(chan); 2497 2498 /* Remote device may have requested smaller PDUs */ 2499 pdu_len = min_t(size_t, pdu_len, chan->remote_mps); 2500 2501 if (len <= pdu_len) { 2502 sar = L2CAP_SAR_UNSEGMENTED; 2503 sdu_len = 0; 2504 pdu_len = len; 2505 } else { 2506 sar = L2CAP_SAR_START; 2507 sdu_len = len; 2508 } 2509 2510 while (len > 0) { 2511 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len); 2512 2513 if (IS_ERR(skb)) { 2514 __skb_queue_purge(seg_queue); 2515 return PTR_ERR(skb); 2516 } 2517 2518 bt_cb(skb)->l2cap.sar = sar; 2519 __skb_queue_tail(seg_queue, skb); 2520 2521 len -= pdu_len; 2522 if (sdu_len) 2523 sdu_len = 0; 2524 2525 if (len <= pdu_len) { 2526 sar = L2CAP_SAR_END; 2527 pdu_len = len; 2528 } else { 2529 sar = L2CAP_SAR_CONTINUE; 2530 } 2531 } 2532 2533 return 0; 2534 } 2535 2536 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan, 2537 struct msghdr *msg, 2538 size_t len, u16 sdulen) 2539 { 2540 struct l2cap_conn *conn = chan->conn; 2541 struct sk_buff *skb; 2542 int err, count, hlen; 2543 struct l2cap_hdr *lh; 2544 2545 BT_DBG("chan %p len %zu", chan, len); 2546 2547 if (!conn) 2548 return ERR_PTR(-ENOTCONN); 2549 2550 hlen = L2CAP_HDR_SIZE; 2551 2552 if (sdulen) 2553 hlen += L2CAP_SDULEN_SIZE; 2554 2555 count = min_t(unsigned int, (conn->mtu - hlen), len); 2556 2557 skb = chan->ops->alloc_skb(chan, hlen, count, 2558 msg->msg_flags & MSG_DONTWAIT); 2559 if (IS_ERR(skb)) 2560 return skb; 2561 2562 /* Create L2CAP header */ 2563 lh = skb_put(skb, L2CAP_HDR_SIZE); 2564 lh->cid = cpu_to_le16(chan->dcid); 2565 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2566 2567 if (sdulen) 2568 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2569 2570 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2571 if (unlikely(err < 0)) { 2572 kfree_skb(skb); 2573 return ERR_PTR(err); 2574 } 2575 2576 return skb; 2577 } 2578 2579 static int l2cap_segment_le_sdu(struct l2cap_chan *chan, 2580 struct sk_buff_head *seg_queue, 2581 struct msghdr *msg, size_t len) 2582 { 2583 struct sk_buff *skb; 2584 size_t pdu_len; 2585 u16 sdu_len; 2586 2587 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2588 2589 sdu_len = len; 2590 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE; 2591 2592 while (len > 0) { 2593 if (len <= pdu_len) 2594 pdu_len = len; 2595 2596 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len); 2597 if (IS_ERR(skb)) { 2598 __skb_queue_purge(seg_queue); 2599 return PTR_ERR(skb); 2600 } 2601 2602 __skb_queue_tail(seg_queue, skb); 2603 2604 len -= pdu_len; 2605 2606 if (sdu_len) { 2607 sdu_len = 0; 2608 pdu_len += L2CAP_SDULEN_SIZE; 2609 } 2610 } 2611 2612 return 0; 2613 } 2614 2615 static void l2cap_le_flowctl_send(struct l2cap_chan *chan) 2616 { 2617 int sent = 0; 2618 2619 BT_DBG("chan %p", chan); 2620 2621 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) { 2622 l2cap_do_send(chan, skb_dequeue(&chan->tx_q)); 2623 chan->tx_credits--; 2624 sent++; 2625 } 2626 2627 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits, 2628 skb_queue_len(&chan->tx_q)); 2629 } 2630 2631 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 2632 { 2633 struct sk_buff *skb; 2634 int err; 2635 struct sk_buff_head seg_queue; 2636 2637 if (!chan->conn) 2638 return -ENOTCONN; 2639 2640 /* Connectionless channel */ 2641 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 2642 skb = l2cap_create_connless_pdu(chan, msg, len); 2643 if (IS_ERR(skb)) 2644 return PTR_ERR(skb); 2645 2646 /* Channel lock is released before requesting new skb and then 2647 * reacquired thus we need to recheck channel state. 2648 */ 2649 if (chan->state != BT_CONNECTED) { 2650 kfree_skb(skb); 2651 return -ENOTCONN; 2652 } 2653 2654 l2cap_do_send(chan, skb); 2655 return len; 2656 } 2657 2658 switch (chan->mode) { 2659 case L2CAP_MODE_LE_FLOWCTL: 2660 case L2CAP_MODE_EXT_FLOWCTL: 2661 /* Check outgoing MTU */ 2662 if (len > chan->omtu) 2663 return -EMSGSIZE; 2664 2665 __skb_queue_head_init(&seg_queue); 2666 2667 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len); 2668 2669 if (chan->state != BT_CONNECTED) { 2670 __skb_queue_purge(&seg_queue); 2671 err = -ENOTCONN; 2672 } 2673 2674 if (err) 2675 return err; 2676 2677 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q); 2678 2679 l2cap_le_flowctl_send(chan); 2680 2681 if (!chan->tx_credits) 2682 chan->ops->suspend(chan); 2683 2684 err = len; 2685 2686 break; 2687 2688 case L2CAP_MODE_BASIC: 2689 /* Check outgoing MTU */ 2690 if (len > chan->omtu) 2691 return -EMSGSIZE; 2692 2693 /* Create a basic PDU */ 2694 skb = l2cap_create_basic_pdu(chan, msg, len); 2695 if (IS_ERR(skb)) 2696 return PTR_ERR(skb); 2697 2698 /* Channel lock is released before requesting new skb and then 2699 * reacquired thus we need to recheck channel state. 2700 */ 2701 if (chan->state != BT_CONNECTED) { 2702 kfree_skb(skb); 2703 return -ENOTCONN; 2704 } 2705 2706 l2cap_do_send(chan, skb); 2707 err = len; 2708 break; 2709 2710 case L2CAP_MODE_ERTM: 2711 case L2CAP_MODE_STREAMING: 2712 /* Check outgoing MTU */ 2713 if (len > chan->omtu) { 2714 err = -EMSGSIZE; 2715 break; 2716 } 2717 2718 __skb_queue_head_init(&seg_queue); 2719 2720 /* Do segmentation before calling in to the state machine, 2721 * since it's possible to block while waiting for memory 2722 * allocation. 2723 */ 2724 err = l2cap_segment_sdu(chan, &seg_queue, msg, len); 2725 2726 /* The channel could have been closed while segmenting, 2727 * check that it is still connected. 2728 */ 2729 if (chan->state != BT_CONNECTED) { 2730 __skb_queue_purge(&seg_queue); 2731 err = -ENOTCONN; 2732 } 2733 2734 if (err) 2735 break; 2736 2737 if (chan->mode == L2CAP_MODE_ERTM) 2738 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST); 2739 else 2740 l2cap_streaming_send(chan, &seg_queue); 2741 2742 err = len; 2743 2744 /* If the skbs were not queued for sending, they'll still be in 2745 * seg_queue and need to be purged. 2746 */ 2747 __skb_queue_purge(&seg_queue); 2748 break; 2749 2750 default: 2751 BT_DBG("bad state %1.1x", chan->mode); 2752 err = -EBADFD; 2753 } 2754 2755 return err; 2756 } 2757 EXPORT_SYMBOL_GPL(l2cap_chan_send); 2758 2759 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq) 2760 { 2761 struct l2cap_ctrl control; 2762 u16 seq; 2763 2764 BT_DBG("chan %p, txseq %u", chan, txseq); 2765 2766 memset(&control, 0, sizeof(control)); 2767 control.sframe = 1; 2768 control.super = L2CAP_SUPER_SREJ; 2769 2770 for (seq = chan->expected_tx_seq; seq != txseq; 2771 seq = __next_seq(chan, seq)) { 2772 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) { 2773 control.reqseq = seq; 2774 l2cap_send_sframe(chan, &control); 2775 l2cap_seq_list_append(&chan->srej_list, seq); 2776 } 2777 } 2778 2779 chan->expected_tx_seq = __next_seq(chan, txseq); 2780 } 2781 2782 static void l2cap_send_srej_tail(struct l2cap_chan *chan) 2783 { 2784 struct l2cap_ctrl control; 2785 2786 BT_DBG("chan %p", chan); 2787 2788 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR) 2789 return; 2790 2791 memset(&control, 0, sizeof(control)); 2792 control.sframe = 1; 2793 control.super = L2CAP_SUPER_SREJ; 2794 control.reqseq = chan->srej_list.tail; 2795 l2cap_send_sframe(chan, &control); 2796 } 2797 2798 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq) 2799 { 2800 struct l2cap_ctrl control; 2801 u16 initial_head; 2802 u16 seq; 2803 2804 BT_DBG("chan %p, txseq %u", chan, txseq); 2805 2806 memset(&control, 0, sizeof(control)); 2807 control.sframe = 1; 2808 control.super = L2CAP_SUPER_SREJ; 2809 2810 /* Capture initial list head to allow only one pass through the list. */ 2811 initial_head = chan->srej_list.head; 2812 2813 do { 2814 seq = l2cap_seq_list_pop(&chan->srej_list); 2815 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR) 2816 break; 2817 2818 control.reqseq = seq; 2819 l2cap_send_sframe(chan, &control); 2820 l2cap_seq_list_append(&chan->srej_list, seq); 2821 } while (chan->srej_list.head != initial_head); 2822 } 2823 2824 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq) 2825 { 2826 struct sk_buff *acked_skb; 2827 u16 ackseq; 2828 2829 BT_DBG("chan %p, reqseq %u", chan, reqseq); 2830 2831 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq) 2832 return; 2833 2834 BT_DBG("expected_ack_seq %u, unacked_frames %u", 2835 chan->expected_ack_seq, chan->unacked_frames); 2836 2837 for (ackseq = chan->expected_ack_seq; ackseq != reqseq; 2838 ackseq = __next_seq(chan, ackseq)) { 2839 2840 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq); 2841 if (acked_skb) { 2842 skb_unlink(acked_skb, &chan->tx_q); 2843 kfree_skb(acked_skb); 2844 chan->unacked_frames--; 2845 } 2846 } 2847 2848 chan->expected_ack_seq = reqseq; 2849 2850 if (chan->unacked_frames == 0) 2851 __clear_retrans_timer(chan); 2852 2853 BT_DBG("unacked_frames %u", chan->unacked_frames); 2854 } 2855 2856 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan) 2857 { 2858 BT_DBG("chan %p", chan); 2859 2860 chan->expected_tx_seq = chan->buffer_seq; 2861 l2cap_seq_list_clear(&chan->srej_list); 2862 skb_queue_purge(&chan->srej_q); 2863 chan->rx_state = L2CAP_RX_STATE_RECV; 2864 } 2865 2866 static void l2cap_tx_state_xmit(struct l2cap_chan *chan, 2867 struct l2cap_ctrl *control, 2868 struct sk_buff_head *skbs, u8 event) 2869 { 2870 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2871 event); 2872 2873 switch (event) { 2874 case L2CAP_EV_DATA_REQUEST: 2875 if (chan->tx_send_head == NULL) 2876 chan->tx_send_head = skb_peek(skbs); 2877 2878 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2879 l2cap_ertm_send(chan); 2880 break; 2881 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2882 BT_DBG("Enter LOCAL_BUSY"); 2883 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2884 2885 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2886 /* The SREJ_SENT state must be aborted if we are to 2887 * enter the LOCAL_BUSY state. 2888 */ 2889 l2cap_abort_rx_srej_sent(chan); 2890 } 2891 2892 l2cap_send_ack(chan); 2893 2894 break; 2895 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2896 BT_DBG("Exit LOCAL_BUSY"); 2897 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2898 2899 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2900 struct l2cap_ctrl local_control; 2901 2902 memset(&local_control, 0, sizeof(local_control)); 2903 local_control.sframe = 1; 2904 local_control.super = L2CAP_SUPER_RR; 2905 local_control.poll = 1; 2906 local_control.reqseq = chan->buffer_seq; 2907 l2cap_send_sframe(chan, &local_control); 2908 2909 chan->retry_count = 1; 2910 __set_monitor_timer(chan); 2911 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2912 } 2913 break; 2914 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2915 l2cap_process_reqseq(chan, control->reqseq); 2916 break; 2917 case L2CAP_EV_EXPLICIT_POLL: 2918 l2cap_send_rr_or_rnr(chan, 1); 2919 chan->retry_count = 1; 2920 __set_monitor_timer(chan); 2921 __clear_ack_timer(chan); 2922 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2923 break; 2924 case L2CAP_EV_RETRANS_TO: 2925 l2cap_send_rr_or_rnr(chan, 1); 2926 chan->retry_count = 1; 2927 __set_monitor_timer(chan); 2928 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2929 break; 2930 case L2CAP_EV_RECV_FBIT: 2931 /* Nothing to process */ 2932 break; 2933 default: 2934 break; 2935 } 2936 } 2937 2938 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan, 2939 struct l2cap_ctrl *control, 2940 struct sk_buff_head *skbs, u8 event) 2941 { 2942 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2943 event); 2944 2945 switch (event) { 2946 case L2CAP_EV_DATA_REQUEST: 2947 if (chan->tx_send_head == NULL) 2948 chan->tx_send_head = skb_peek(skbs); 2949 /* Queue data, but don't send. */ 2950 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2951 break; 2952 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2953 BT_DBG("Enter LOCAL_BUSY"); 2954 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2955 2956 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2957 /* The SREJ_SENT state must be aborted if we are to 2958 * enter the LOCAL_BUSY state. 2959 */ 2960 l2cap_abort_rx_srej_sent(chan); 2961 } 2962 2963 l2cap_send_ack(chan); 2964 2965 break; 2966 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2967 BT_DBG("Exit LOCAL_BUSY"); 2968 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2969 2970 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2971 struct l2cap_ctrl local_control; 2972 memset(&local_control, 0, sizeof(local_control)); 2973 local_control.sframe = 1; 2974 local_control.super = L2CAP_SUPER_RR; 2975 local_control.poll = 1; 2976 local_control.reqseq = chan->buffer_seq; 2977 l2cap_send_sframe(chan, &local_control); 2978 2979 chan->retry_count = 1; 2980 __set_monitor_timer(chan); 2981 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2982 } 2983 break; 2984 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2985 l2cap_process_reqseq(chan, control->reqseq); 2986 2987 /* Fall through */ 2988 2989 case L2CAP_EV_RECV_FBIT: 2990 if (control && control->final) { 2991 __clear_monitor_timer(chan); 2992 if (chan->unacked_frames > 0) 2993 __set_retrans_timer(chan); 2994 chan->retry_count = 0; 2995 chan->tx_state = L2CAP_TX_STATE_XMIT; 2996 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state); 2997 } 2998 break; 2999 case L2CAP_EV_EXPLICIT_POLL: 3000 /* Ignore */ 3001 break; 3002 case L2CAP_EV_MONITOR_TO: 3003 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) { 3004 l2cap_send_rr_or_rnr(chan, 1); 3005 __set_monitor_timer(chan); 3006 chan->retry_count++; 3007 } else { 3008 l2cap_send_disconn_req(chan, ECONNABORTED); 3009 } 3010 break; 3011 default: 3012 break; 3013 } 3014 } 3015 3016 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 3017 struct sk_buff_head *skbs, u8 event) 3018 { 3019 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d", 3020 chan, control, skbs, event, chan->tx_state); 3021 3022 switch (chan->tx_state) { 3023 case L2CAP_TX_STATE_XMIT: 3024 l2cap_tx_state_xmit(chan, control, skbs, event); 3025 break; 3026 case L2CAP_TX_STATE_WAIT_F: 3027 l2cap_tx_state_wait_f(chan, control, skbs, event); 3028 break; 3029 default: 3030 /* Ignore event */ 3031 break; 3032 } 3033 } 3034 3035 static void l2cap_pass_to_tx(struct l2cap_chan *chan, 3036 struct l2cap_ctrl *control) 3037 { 3038 BT_DBG("chan %p, control %p", chan, control); 3039 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT); 3040 } 3041 3042 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan, 3043 struct l2cap_ctrl *control) 3044 { 3045 BT_DBG("chan %p, control %p", chan, control); 3046 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT); 3047 } 3048 3049 /* Copy frame to all raw sockets on that connection */ 3050 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 3051 { 3052 struct sk_buff *nskb; 3053 struct l2cap_chan *chan; 3054 3055 BT_DBG("conn %p", conn); 3056 3057 mutex_lock(&conn->chan_lock); 3058 3059 list_for_each_entry(chan, &conn->chan_l, list) { 3060 if (chan->chan_type != L2CAP_CHAN_RAW) 3061 continue; 3062 3063 /* Don't send frame to the channel it came from */ 3064 if (bt_cb(skb)->l2cap.chan == chan) 3065 continue; 3066 3067 nskb = skb_clone(skb, GFP_KERNEL); 3068 if (!nskb) 3069 continue; 3070 if (chan->ops->recv(chan, nskb)) 3071 kfree_skb(nskb); 3072 } 3073 3074 mutex_unlock(&conn->chan_lock); 3075 } 3076 3077 /* ---- L2CAP signalling commands ---- */ 3078 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code, 3079 u8 ident, u16 dlen, void *data) 3080 { 3081 struct sk_buff *skb, **frag; 3082 struct l2cap_cmd_hdr *cmd; 3083 struct l2cap_hdr *lh; 3084 int len, count; 3085 3086 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u", 3087 conn, code, ident, dlen); 3088 3089 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) 3090 return NULL; 3091 3092 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 3093 count = min_t(unsigned int, conn->mtu, len); 3094 3095 skb = bt_skb_alloc(count, GFP_KERNEL); 3096 if (!skb) 3097 return NULL; 3098 3099 lh = skb_put(skb, L2CAP_HDR_SIZE); 3100 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 3101 3102 if (conn->hcon->type == LE_LINK) 3103 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 3104 else 3105 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 3106 3107 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE); 3108 cmd->code = code; 3109 cmd->ident = ident; 3110 cmd->len = cpu_to_le16(dlen); 3111 3112 if (dlen) { 3113 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 3114 skb_put_data(skb, data, count); 3115 data += count; 3116 } 3117 3118 len -= skb->len; 3119 3120 /* Continuation fragments (no L2CAP header) */ 3121 frag = &skb_shinfo(skb)->frag_list; 3122 while (len) { 3123 count = min_t(unsigned int, conn->mtu, len); 3124 3125 *frag = bt_skb_alloc(count, GFP_KERNEL); 3126 if (!*frag) 3127 goto fail; 3128 3129 skb_put_data(*frag, data, count); 3130 3131 len -= count; 3132 data += count; 3133 3134 frag = &(*frag)->next; 3135 } 3136 3137 return skb; 3138 3139 fail: 3140 kfree_skb(skb); 3141 return NULL; 3142 } 3143 3144 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, 3145 unsigned long *val) 3146 { 3147 struct l2cap_conf_opt *opt = *ptr; 3148 int len; 3149 3150 len = L2CAP_CONF_OPT_SIZE + opt->len; 3151 *ptr += len; 3152 3153 *type = opt->type; 3154 *olen = opt->len; 3155 3156 switch (opt->len) { 3157 case 1: 3158 *val = *((u8 *) opt->val); 3159 break; 3160 3161 case 2: 3162 *val = get_unaligned_le16(opt->val); 3163 break; 3164 3165 case 4: 3166 *val = get_unaligned_le32(opt->val); 3167 break; 3168 3169 default: 3170 *val = (unsigned long) opt->val; 3171 break; 3172 } 3173 3174 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val); 3175 return len; 3176 } 3177 3178 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) 3179 { 3180 struct l2cap_conf_opt *opt = *ptr; 3181 3182 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); 3183 3184 if (size < L2CAP_CONF_OPT_SIZE + len) 3185 return; 3186 3187 opt->type = type; 3188 opt->len = len; 3189 3190 switch (len) { 3191 case 1: 3192 *((u8 *) opt->val) = val; 3193 break; 3194 3195 case 2: 3196 put_unaligned_le16(val, opt->val); 3197 break; 3198 3199 case 4: 3200 put_unaligned_le32(val, opt->val); 3201 break; 3202 3203 default: 3204 memcpy(opt->val, (void *) val, len); 3205 break; 3206 } 3207 3208 *ptr += L2CAP_CONF_OPT_SIZE + len; 3209 } 3210 3211 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) 3212 { 3213 struct l2cap_conf_efs efs; 3214 3215 switch (chan->mode) { 3216 case L2CAP_MODE_ERTM: 3217 efs.id = chan->local_id; 3218 efs.stype = chan->local_stype; 3219 efs.msdu = cpu_to_le16(chan->local_msdu); 3220 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3221 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT); 3222 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO); 3223 break; 3224 3225 case L2CAP_MODE_STREAMING: 3226 efs.id = 1; 3227 efs.stype = L2CAP_SERV_BESTEFFORT; 3228 efs.msdu = cpu_to_le16(chan->local_msdu); 3229 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3230 efs.acc_lat = 0; 3231 efs.flush_to = 0; 3232 break; 3233 3234 default: 3235 return; 3236 } 3237 3238 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), 3239 (unsigned long) &efs, size); 3240 } 3241 3242 static void l2cap_ack_timeout(struct work_struct *work) 3243 { 3244 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 3245 ack_timer.work); 3246 u16 frames_to_ack; 3247 3248 BT_DBG("chan %p", chan); 3249 3250 l2cap_chan_lock(chan); 3251 3252 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 3253 chan->last_acked_seq); 3254 3255 if (frames_to_ack) 3256 l2cap_send_rr_or_rnr(chan, 0); 3257 3258 l2cap_chan_unlock(chan); 3259 l2cap_chan_put(chan); 3260 } 3261 3262 int l2cap_ertm_init(struct l2cap_chan *chan) 3263 { 3264 int err; 3265 3266 chan->next_tx_seq = 0; 3267 chan->expected_tx_seq = 0; 3268 chan->expected_ack_seq = 0; 3269 chan->unacked_frames = 0; 3270 chan->buffer_seq = 0; 3271 chan->frames_sent = 0; 3272 chan->last_acked_seq = 0; 3273 chan->sdu = NULL; 3274 chan->sdu_last_frag = NULL; 3275 chan->sdu_len = 0; 3276 3277 skb_queue_head_init(&chan->tx_q); 3278 3279 chan->local_amp_id = AMP_ID_BREDR; 3280 chan->move_id = AMP_ID_BREDR; 3281 chan->move_state = L2CAP_MOVE_STABLE; 3282 chan->move_role = L2CAP_MOVE_ROLE_NONE; 3283 3284 if (chan->mode != L2CAP_MODE_ERTM) 3285 return 0; 3286 3287 chan->rx_state = L2CAP_RX_STATE_RECV; 3288 chan->tx_state = L2CAP_TX_STATE_XMIT; 3289 3290 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); 3291 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); 3292 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); 3293 3294 skb_queue_head_init(&chan->srej_q); 3295 3296 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win); 3297 if (err < 0) 3298 return err; 3299 3300 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); 3301 if (err < 0) 3302 l2cap_seq_list_free(&chan->srej_list); 3303 3304 return err; 3305 } 3306 3307 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 3308 { 3309 switch (mode) { 3310 case L2CAP_MODE_STREAMING: 3311 case L2CAP_MODE_ERTM: 3312 if (l2cap_mode_supported(mode, remote_feat_mask)) 3313 return mode; 3314 /* fall through */ 3315 default: 3316 return L2CAP_MODE_BASIC; 3317 } 3318 } 3319 3320 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn) 3321 { 3322 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) && 3323 (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW)); 3324 } 3325 3326 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn) 3327 { 3328 return ((conn->local_fixed_chan & L2CAP_FC_A2MP) && 3329 (conn->feat_mask & L2CAP_FEAT_EXT_FLOW)); 3330 } 3331 3332 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan, 3333 struct l2cap_conf_rfc *rfc) 3334 { 3335 if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) { 3336 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to; 3337 3338 /* Class 1 devices have must have ERTM timeouts 3339 * exceeding the Link Supervision Timeout. The 3340 * default Link Supervision Timeout for AMP 3341 * controllers is 10 seconds. 3342 * 3343 * Class 1 devices use 0xffffffff for their 3344 * best-effort flush timeout, so the clamping logic 3345 * will result in a timeout that meets the above 3346 * requirement. ERTM timeouts are 16-bit values, so 3347 * the maximum timeout is 65.535 seconds. 3348 */ 3349 3350 /* Convert timeout to milliseconds and round */ 3351 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000); 3352 3353 /* This is the recommended formula for class 2 devices 3354 * that start ERTM timers when packets are sent to the 3355 * controller. 3356 */ 3357 ertm_to = 3 * ertm_to + 500; 3358 3359 if (ertm_to > 0xffff) 3360 ertm_to = 0xffff; 3361 3362 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to); 3363 rfc->monitor_timeout = rfc->retrans_timeout; 3364 } else { 3365 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 3366 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 3367 } 3368 } 3369 3370 static inline void l2cap_txwin_setup(struct l2cap_chan *chan) 3371 { 3372 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW && 3373 __l2cap_ews_supported(chan->conn)) { 3374 /* use extended control field */ 3375 set_bit(FLAG_EXT_CTRL, &chan->flags); 3376 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3377 } else { 3378 chan->tx_win = min_t(u16, chan->tx_win, 3379 L2CAP_DEFAULT_TX_WINDOW); 3380 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 3381 } 3382 chan->ack_win = chan->tx_win; 3383 } 3384 3385 static void l2cap_mtu_auto(struct l2cap_chan *chan) 3386 { 3387 struct hci_conn *conn = chan->conn->hcon; 3388 3389 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3390 3391 /* The 2-DH1 packet has between 2 and 56 information bytes 3392 * (including the 2-byte payload header) 3393 */ 3394 if (!(conn->pkt_type & HCI_2DH1)) 3395 chan->imtu = 54; 3396 3397 /* The 3-DH1 packet has between 2 and 85 information bytes 3398 * (including the 2-byte payload header) 3399 */ 3400 if (!(conn->pkt_type & HCI_3DH1)) 3401 chan->imtu = 83; 3402 3403 /* The 2-DH3 packet has between 2 and 369 information bytes 3404 * (including the 2-byte payload header) 3405 */ 3406 if (!(conn->pkt_type & HCI_2DH3)) 3407 chan->imtu = 367; 3408 3409 /* The 3-DH3 packet has between 2 and 554 information bytes 3410 * (including the 2-byte payload header) 3411 */ 3412 if (!(conn->pkt_type & HCI_3DH3)) 3413 chan->imtu = 552; 3414 3415 /* The 2-DH5 packet has between 2 and 681 information bytes 3416 * (including the 2-byte payload header) 3417 */ 3418 if (!(conn->pkt_type & HCI_2DH5)) 3419 chan->imtu = 679; 3420 3421 /* The 3-DH5 packet has between 2 and 1023 information bytes 3422 * (including the 2-byte payload header) 3423 */ 3424 if (!(conn->pkt_type & HCI_3DH5)) 3425 chan->imtu = 1021; 3426 } 3427 3428 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3429 { 3430 struct l2cap_conf_req *req = data; 3431 struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 3432 void *ptr = req->data; 3433 void *endptr = data + data_size; 3434 u16 size; 3435 3436 BT_DBG("chan %p", chan); 3437 3438 if (chan->num_conf_req || chan->num_conf_rsp) 3439 goto done; 3440 3441 switch (chan->mode) { 3442 case L2CAP_MODE_STREAMING: 3443 case L2CAP_MODE_ERTM: 3444 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 3445 break; 3446 3447 if (__l2cap_efs_supported(chan->conn)) 3448 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3449 3450 /* fall through */ 3451 default: 3452 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 3453 break; 3454 } 3455 3456 done: 3457 if (chan->imtu != L2CAP_DEFAULT_MTU) { 3458 if (!chan->imtu) 3459 l2cap_mtu_auto(chan); 3460 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3461 endptr - ptr); 3462 } 3463 3464 switch (chan->mode) { 3465 case L2CAP_MODE_BASIC: 3466 if (disable_ertm) 3467 break; 3468 3469 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 3470 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 3471 break; 3472 3473 rfc.mode = L2CAP_MODE_BASIC; 3474 rfc.txwin_size = 0; 3475 rfc.max_transmit = 0; 3476 rfc.retrans_timeout = 0; 3477 rfc.monitor_timeout = 0; 3478 rfc.max_pdu_size = 0; 3479 3480 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3481 (unsigned long) &rfc, endptr - ptr); 3482 break; 3483 3484 case L2CAP_MODE_ERTM: 3485 rfc.mode = L2CAP_MODE_ERTM; 3486 rfc.max_transmit = chan->max_tx; 3487 3488 __l2cap_set_ertm_timeouts(chan, &rfc); 3489 3490 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3491 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3492 L2CAP_FCS_SIZE); 3493 rfc.max_pdu_size = cpu_to_le16(size); 3494 3495 l2cap_txwin_setup(chan); 3496 3497 rfc.txwin_size = min_t(u16, chan->tx_win, 3498 L2CAP_DEFAULT_TX_WINDOW); 3499 3500 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3501 (unsigned long) &rfc, endptr - ptr); 3502 3503 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3504 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3505 3506 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 3507 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3508 chan->tx_win, endptr - ptr); 3509 3510 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3511 if (chan->fcs == L2CAP_FCS_NONE || 3512 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3513 chan->fcs = L2CAP_FCS_NONE; 3514 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3515 chan->fcs, endptr - ptr); 3516 } 3517 break; 3518 3519 case L2CAP_MODE_STREAMING: 3520 l2cap_txwin_setup(chan); 3521 rfc.mode = L2CAP_MODE_STREAMING; 3522 rfc.txwin_size = 0; 3523 rfc.max_transmit = 0; 3524 rfc.retrans_timeout = 0; 3525 rfc.monitor_timeout = 0; 3526 3527 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3528 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3529 L2CAP_FCS_SIZE); 3530 rfc.max_pdu_size = cpu_to_le16(size); 3531 3532 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3533 (unsigned long) &rfc, endptr - ptr); 3534 3535 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3536 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3537 3538 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3539 if (chan->fcs == L2CAP_FCS_NONE || 3540 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3541 chan->fcs = L2CAP_FCS_NONE; 3542 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3543 chan->fcs, endptr - ptr); 3544 } 3545 break; 3546 } 3547 3548 req->dcid = cpu_to_le16(chan->dcid); 3549 req->flags = cpu_to_le16(0); 3550 3551 return ptr - data; 3552 } 3553 3554 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3555 { 3556 struct l2cap_conf_rsp *rsp = data; 3557 void *ptr = rsp->data; 3558 void *endptr = data + data_size; 3559 void *req = chan->conf_req; 3560 int len = chan->conf_len; 3561 int type, hint, olen; 3562 unsigned long val; 3563 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3564 struct l2cap_conf_efs efs; 3565 u8 remote_efs = 0; 3566 u16 mtu = L2CAP_DEFAULT_MTU; 3567 u16 result = L2CAP_CONF_SUCCESS; 3568 u16 size; 3569 3570 BT_DBG("chan %p", chan); 3571 3572 while (len >= L2CAP_CONF_OPT_SIZE) { 3573 len -= l2cap_get_conf_opt(&req, &type, &olen, &val); 3574 if (len < 0) 3575 break; 3576 3577 hint = type & L2CAP_CONF_HINT; 3578 type &= L2CAP_CONF_MASK; 3579 3580 switch (type) { 3581 case L2CAP_CONF_MTU: 3582 if (olen != 2) 3583 break; 3584 mtu = val; 3585 break; 3586 3587 case L2CAP_CONF_FLUSH_TO: 3588 if (olen != 2) 3589 break; 3590 chan->flush_to = val; 3591 break; 3592 3593 case L2CAP_CONF_QOS: 3594 break; 3595 3596 case L2CAP_CONF_RFC: 3597 if (olen != sizeof(rfc)) 3598 break; 3599 memcpy(&rfc, (void *) val, olen); 3600 break; 3601 3602 case L2CAP_CONF_FCS: 3603 if (olen != 1) 3604 break; 3605 if (val == L2CAP_FCS_NONE) 3606 set_bit(CONF_RECV_NO_FCS, &chan->conf_state); 3607 break; 3608 3609 case L2CAP_CONF_EFS: 3610 if (olen != sizeof(efs)) 3611 break; 3612 remote_efs = 1; 3613 memcpy(&efs, (void *) val, olen); 3614 break; 3615 3616 case L2CAP_CONF_EWS: 3617 if (olen != 2) 3618 break; 3619 if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP)) 3620 return -ECONNREFUSED; 3621 set_bit(FLAG_EXT_CTRL, &chan->flags); 3622 set_bit(CONF_EWS_RECV, &chan->conf_state); 3623 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3624 chan->remote_tx_win = val; 3625 break; 3626 3627 default: 3628 if (hint) 3629 break; 3630 result = L2CAP_CONF_UNKNOWN; 3631 *((u8 *) ptr++) = type; 3632 break; 3633 } 3634 } 3635 3636 if (chan->num_conf_rsp || chan->num_conf_req > 1) 3637 goto done; 3638 3639 switch (chan->mode) { 3640 case L2CAP_MODE_STREAMING: 3641 case L2CAP_MODE_ERTM: 3642 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 3643 chan->mode = l2cap_select_mode(rfc.mode, 3644 chan->conn->feat_mask); 3645 break; 3646 } 3647 3648 if (remote_efs) { 3649 if (__l2cap_efs_supported(chan->conn)) 3650 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3651 else 3652 return -ECONNREFUSED; 3653 } 3654 3655 if (chan->mode != rfc.mode) 3656 return -ECONNREFUSED; 3657 3658 break; 3659 } 3660 3661 done: 3662 if (chan->mode != rfc.mode) { 3663 result = L2CAP_CONF_UNACCEPT; 3664 rfc.mode = chan->mode; 3665 3666 if (chan->num_conf_rsp == 1) 3667 return -ECONNREFUSED; 3668 3669 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3670 (unsigned long) &rfc, endptr - ptr); 3671 } 3672 3673 if (result == L2CAP_CONF_SUCCESS) { 3674 /* Configure output options and let the other side know 3675 * which ones we don't like. */ 3676 3677 if (mtu < L2CAP_DEFAULT_MIN_MTU) 3678 result = L2CAP_CONF_UNACCEPT; 3679 else { 3680 chan->omtu = mtu; 3681 set_bit(CONF_MTU_DONE, &chan->conf_state); 3682 } 3683 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); 3684 3685 if (remote_efs) { 3686 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3687 efs.stype != L2CAP_SERV_NOTRAFIC && 3688 efs.stype != chan->local_stype) { 3689 3690 result = L2CAP_CONF_UNACCEPT; 3691 3692 if (chan->num_conf_req >= 1) 3693 return -ECONNREFUSED; 3694 3695 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3696 sizeof(efs), 3697 (unsigned long) &efs, endptr - ptr); 3698 } else { 3699 /* Send PENDING Conf Rsp */ 3700 result = L2CAP_CONF_PENDING; 3701 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 3702 } 3703 } 3704 3705 switch (rfc.mode) { 3706 case L2CAP_MODE_BASIC: 3707 chan->fcs = L2CAP_FCS_NONE; 3708 set_bit(CONF_MODE_DONE, &chan->conf_state); 3709 break; 3710 3711 case L2CAP_MODE_ERTM: 3712 if (!test_bit(CONF_EWS_RECV, &chan->conf_state)) 3713 chan->remote_tx_win = rfc.txwin_size; 3714 else 3715 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 3716 3717 chan->remote_max_tx = rfc.max_transmit; 3718 3719 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3720 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3721 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3722 rfc.max_pdu_size = cpu_to_le16(size); 3723 chan->remote_mps = size; 3724 3725 __l2cap_set_ertm_timeouts(chan, &rfc); 3726 3727 set_bit(CONF_MODE_DONE, &chan->conf_state); 3728 3729 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 3730 sizeof(rfc), (unsigned long) &rfc, endptr - ptr); 3731 3732 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3733 chan->remote_id = efs.id; 3734 chan->remote_stype = efs.stype; 3735 chan->remote_msdu = le16_to_cpu(efs.msdu); 3736 chan->remote_flush_to = 3737 le32_to_cpu(efs.flush_to); 3738 chan->remote_acc_lat = 3739 le32_to_cpu(efs.acc_lat); 3740 chan->remote_sdu_itime = 3741 le32_to_cpu(efs.sdu_itime); 3742 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3743 sizeof(efs), 3744 (unsigned long) &efs, endptr - ptr); 3745 } 3746 break; 3747 3748 case L2CAP_MODE_STREAMING: 3749 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3750 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3751 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3752 rfc.max_pdu_size = cpu_to_le16(size); 3753 chan->remote_mps = size; 3754 3755 set_bit(CONF_MODE_DONE, &chan->conf_state); 3756 3757 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3758 (unsigned long) &rfc, endptr - ptr); 3759 3760 break; 3761 3762 default: 3763 result = L2CAP_CONF_UNACCEPT; 3764 3765 memset(&rfc, 0, sizeof(rfc)); 3766 rfc.mode = chan->mode; 3767 } 3768 3769 if (result == L2CAP_CONF_SUCCESS) 3770 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 3771 } 3772 rsp->scid = cpu_to_le16(chan->dcid); 3773 rsp->result = cpu_to_le16(result); 3774 rsp->flags = cpu_to_le16(0); 3775 3776 return ptr - data; 3777 } 3778 3779 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 3780 void *data, size_t size, u16 *result) 3781 { 3782 struct l2cap_conf_req *req = data; 3783 void *ptr = req->data; 3784 void *endptr = data + size; 3785 int type, olen; 3786 unsigned long val; 3787 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3788 struct l2cap_conf_efs efs; 3789 3790 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 3791 3792 while (len >= L2CAP_CONF_OPT_SIZE) { 3793 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 3794 if (len < 0) 3795 break; 3796 3797 switch (type) { 3798 case L2CAP_CONF_MTU: 3799 if (olen != 2) 3800 break; 3801 if (val < L2CAP_DEFAULT_MIN_MTU) { 3802 *result = L2CAP_CONF_UNACCEPT; 3803 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3804 } else 3805 chan->imtu = val; 3806 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3807 endptr - ptr); 3808 break; 3809 3810 case L2CAP_CONF_FLUSH_TO: 3811 if (olen != 2) 3812 break; 3813 chan->flush_to = val; 3814 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, 3815 chan->flush_to, endptr - ptr); 3816 break; 3817 3818 case L2CAP_CONF_RFC: 3819 if (olen != sizeof(rfc)) 3820 break; 3821 memcpy(&rfc, (void *)val, olen); 3822 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 3823 rfc.mode != chan->mode) 3824 return -ECONNREFUSED; 3825 chan->fcs = 0; 3826 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3827 (unsigned long) &rfc, endptr - ptr); 3828 break; 3829 3830 case L2CAP_CONF_EWS: 3831 if (olen != 2) 3832 break; 3833 chan->ack_win = min_t(u16, val, chan->ack_win); 3834 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3835 chan->tx_win, endptr - ptr); 3836 break; 3837 3838 case L2CAP_CONF_EFS: 3839 if (olen != sizeof(efs)) 3840 break; 3841 memcpy(&efs, (void *)val, olen); 3842 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3843 efs.stype != L2CAP_SERV_NOTRAFIC && 3844 efs.stype != chan->local_stype) 3845 return -ECONNREFUSED; 3846 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), 3847 (unsigned long) &efs, endptr - ptr); 3848 break; 3849 3850 case L2CAP_CONF_FCS: 3851 if (olen != 1) 3852 break; 3853 if (*result == L2CAP_CONF_PENDING) 3854 if (val == L2CAP_FCS_NONE) 3855 set_bit(CONF_RECV_NO_FCS, 3856 &chan->conf_state); 3857 break; 3858 } 3859 } 3860 3861 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) 3862 return -ECONNREFUSED; 3863 3864 chan->mode = rfc.mode; 3865 3866 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) { 3867 switch (rfc.mode) { 3868 case L2CAP_MODE_ERTM: 3869 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 3870 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 3871 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3872 if (!test_bit(FLAG_EXT_CTRL, &chan->flags)) 3873 chan->ack_win = min_t(u16, chan->ack_win, 3874 rfc.txwin_size); 3875 3876 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3877 chan->local_msdu = le16_to_cpu(efs.msdu); 3878 chan->local_sdu_itime = 3879 le32_to_cpu(efs.sdu_itime); 3880 chan->local_acc_lat = le32_to_cpu(efs.acc_lat); 3881 chan->local_flush_to = 3882 le32_to_cpu(efs.flush_to); 3883 } 3884 break; 3885 3886 case L2CAP_MODE_STREAMING: 3887 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3888 } 3889 } 3890 3891 req->dcid = cpu_to_le16(chan->dcid); 3892 req->flags = cpu_to_le16(0); 3893 3894 return ptr - data; 3895 } 3896 3897 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, 3898 u16 result, u16 flags) 3899 { 3900 struct l2cap_conf_rsp *rsp = data; 3901 void *ptr = rsp->data; 3902 3903 BT_DBG("chan %p", chan); 3904 3905 rsp->scid = cpu_to_le16(chan->dcid); 3906 rsp->result = cpu_to_le16(result); 3907 rsp->flags = cpu_to_le16(flags); 3908 3909 return ptr - data; 3910 } 3911 3912 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) 3913 { 3914 struct l2cap_le_conn_rsp rsp; 3915 struct l2cap_conn *conn = chan->conn; 3916 3917 BT_DBG("chan %p", chan); 3918 3919 rsp.dcid = cpu_to_le16(chan->scid); 3920 rsp.mtu = cpu_to_le16(chan->imtu); 3921 rsp.mps = cpu_to_le16(chan->mps); 3922 rsp.credits = cpu_to_le16(chan->rx_credits); 3923 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3924 3925 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 3926 &rsp); 3927 } 3928 3929 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) 3930 { 3931 struct { 3932 struct l2cap_ecred_conn_rsp rsp; 3933 __le16 dcid[5]; 3934 } __packed pdu; 3935 struct l2cap_conn *conn = chan->conn; 3936 u16 ident = chan->ident; 3937 int i = 0; 3938 3939 if (!ident) 3940 return; 3941 3942 BT_DBG("chan %p ident %d", chan, ident); 3943 3944 pdu.rsp.mtu = cpu_to_le16(chan->imtu); 3945 pdu.rsp.mps = cpu_to_le16(chan->mps); 3946 pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 3947 pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3948 3949 mutex_lock(&conn->chan_lock); 3950 3951 list_for_each_entry(chan, &conn->chan_l, list) { 3952 if (chan->ident != ident) 3953 continue; 3954 3955 /* Reset ident so only one response is sent */ 3956 chan->ident = 0; 3957 3958 /* Include all channels pending with the same ident */ 3959 pdu.dcid[i++] = cpu_to_le16(chan->scid); 3960 } 3961 3962 mutex_unlock(&conn->chan_lock); 3963 3964 l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP, 3965 sizeof(pdu.rsp) + i * sizeof(__le16), &pdu); 3966 } 3967 3968 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 3969 { 3970 struct l2cap_conn_rsp rsp; 3971 struct l2cap_conn *conn = chan->conn; 3972 u8 buf[128]; 3973 u8 rsp_code; 3974 3975 rsp.scid = cpu_to_le16(chan->dcid); 3976 rsp.dcid = cpu_to_le16(chan->scid); 3977 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 3978 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 3979 3980 if (chan->hs_hcon) 3981 rsp_code = L2CAP_CREATE_CHAN_RSP; 3982 else 3983 rsp_code = L2CAP_CONN_RSP; 3984 3985 BT_DBG("chan %p rsp_code %u", chan, rsp_code); 3986 3987 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp); 3988 3989 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 3990 return; 3991 3992 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 3993 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 3994 chan->num_conf_req++; 3995 } 3996 3997 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 3998 { 3999 int type, olen; 4000 unsigned long val; 4001 /* Use sane default values in case a misbehaving remote device 4002 * did not send an RFC or extended window size option. 4003 */ 4004 u16 txwin_ext = chan->ack_win; 4005 struct l2cap_conf_rfc rfc = { 4006 .mode = chan->mode, 4007 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO), 4008 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO), 4009 .max_pdu_size = cpu_to_le16(chan->imtu), 4010 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW), 4011 }; 4012 4013 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 4014 4015 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 4016 return; 4017 4018 while (len >= L2CAP_CONF_OPT_SIZE) { 4019 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 4020 if (len < 0) 4021 break; 4022 4023 switch (type) { 4024 case L2CAP_CONF_RFC: 4025 if (olen != sizeof(rfc)) 4026 break; 4027 memcpy(&rfc, (void *)val, olen); 4028 break; 4029 case L2CAP_CONF_EWS: 4030 if (olen != 2) 4031 break; 4032 txwin_ext = val; 4033 break; 4034 } 4035 } 4036 4037 switch (rfc.mode) { 4038 case L2CAP_MODE_ERTM: 4039 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 4040 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 4041 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4042 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 4043 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext); 4044 else 4045 chan->ack_win = min_t(u16, chan->ack_win, 4046 rfc.txwin_size); 4047 break; 4048 case L2CAP_MODE_STREAMING: 4049 chan->mps = le16_to_cpu(rfc.max_pdu_size); 4050 } 4051 } 4052 4053 static inline int l2cap_command_rej(struct l2cap_conn *conn, 4054 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4055 u8 *data) 4056 { 4057 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 4058 4059 if (cmd_len < sizeof(*rej)) 4060 return -EPROTO; 4061 4062 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 4063 return 0; 4064 4065 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 4066 cmd->ident == conn->info_ident) { 4067 cancel_delayed_work(&conn->info_timer); 4068 4069 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4070 conn->info_ident = 0; 4071 4072 l2cap_conn_start(conn); 4073 } 4074 4075 return 0; 4076 } 4077 4078 static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn, 4079 struct l2cap_cmd_hdr *cmd, 4080 u8 *data, u8 rsp_code, u8 amp_id) 4081 { 4082 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 4083 struct l2cap_conn_rsp rsp; 4084 struct l2cap_chan *chan = NULL, *pchan; 4085 int result, status = L2CAP_CS_NO_INFO; 4086 4087 u16 dcid = 0, scid = __le16_to_cpu(req->scid); 4088 __le16 psm = req->psm; 4089 4090 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid); 4091 4092 /* Check if we have socket listening on psm */ 4093 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 4094 &conn->hcon->dst, ACL_LINK); 4095 if (!pchan) { 4096 result = L2CAP_CR_BAD_PSM; 4097 goto sendresp; 4098 } 4099 4100 mutex_lock(&conn->chan_lock); 4101 l2cap_chan_lock(pchan); 4102 4103 /* Check if the ACL is secure enough (if not SDP) */ 4104 if (psm != cpu_to_le16(L2CAP_PSM_SDP) && 4105 !hci_conn_check_link_mode(conn->hcon)) { 4106 conn->disc_reason = HCI_ERROR_AUTH_FAILURE; 4107 result = L2CAP_CR_SEC_BLOCK; 4108 goto response; 4109 } 4110 4111 result = L2CAP_CR_NO_MEM; 4112 4113 /* Check for valid dynamic CID range (as per Erratum 3253) */ 4114 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) { 4115 result = L2CAP_CR_INVALID_SCID; 4116 goto response; 4117 } 4118 4119 /* Check if we already have channel with that dcid */ 4120 if (__l2cap_get_chan_by_dcid(conn, scid)) { 4121 result = L2CAP_CR_SCID_IN_USE; 4122 goto response; 4123 } 4124 4125 chan = pchan->ops->new_connection(pchan); 4126 if (!chan) 4127 goto response; 4128 4129 /* For certain devices (ex: HID mouse), support for authentication, 4130 * pairing and bonding is optional. For such devices, inorder to avoid 4131 * the ACL alive for too long after L2CAP disconnection, reset the ACL 4132 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect. 4133 */ 4134 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT; 4135 4136 bacpy(&chan->src, &conn->hcon->src); 4137 bacpy(&chan->dst, &conn->hcon->dst); 4138 chan->src_type = bdaddr_src_type(conn->hcon); 4139 chan->dst_type = bdaddr_dst_type(conn->hcon); 4140 chan->psm = psm; 4141 chan->dcid = scid; 4142 chan->local_amp_id = amp_id; 4143 4144 __l2cap_chan_add(conn, chan); 4145 4146 dcid = chan->scid; 4147 4148 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 4149 4150 chan->ident = cmd->ident; 4151 4152 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 4153 if (l2cap_chan_check_security(chan, false)) { 4154 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 4155 l2cap_state_change(chan, BT_CONNECT2); 4156 result = L2CAP_CR_PEND; 4157 status = L2CAP_CS_AUTHOR_PEND; 4158 chan->ops->defer(chan); 4159 } else { 4160 /* Force pending result for AMP controllers. 4161 * The connection will succeed after the 4162 * physical link is up. 4163 */ 4164 if (amp_id == AMP_ID_BREDR) { 4165 l2cap_state_change(chan, BT_CONFIG); 4166 result = L2CAP_CR_SUCCESS; 4167 } else { 4168 l2cap_state_change(chan, BT_CONNECT2); 4169 result = L2CAP_CR_PEND; 4170 } 4171 status = L2CAP_CS_NO_INFO; 4172 } 4173 } else { 4174 l2cap_state_change(chan, BT_CONNECT2); 4175 result = L2CAP_CR_PEND; 4176 status = L2CAP_CS_AUTHEN_PEND; 4177 } 4178 } else { 4179 l2cap_state_change(chan, BT_CONNECT2); 4180 result = L2CAP_CR_PEND; 4181 status = L2CAP_CS_NO_INFO; 4182 } 4183 4184 response: 4185 l2cap_chan_unlock(pchan); 4186 mutex_unlock(&conn->chan_lock); 4187 l2cap_chan_put(pchan); 4188 4189 sendresp: 4190 rsp.scid = cpu_to_le16(scid); 4191 rsp.dcid = cpu_to_le16(dcid); 4192 rsp.result = cpu_to_le16(result); 4193 rsp.status = cpu_to_le16(status); 4194 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4195 4196 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 4197 struct l2cap_info_req info; 4198 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4199 4200 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 4201 conn->info_ident = l2cap_get_ident(conn); 4202 4203 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 4204 4205 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 4206 sizeof(info), &info); 4207 } 4208 4209 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 4210 result == L2CAP_CR_SUCCESS) { 4211 u8 buf[128]; 4212 set_bit(CONF_REQ_SENT, &chan->conf_state); 4213 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4214 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4215 chan->num_conf_req++; 4216 } 4217 4218 return chan; 4219 } 4220 4221 static int l2cap_connect_req(struct l2cap_conn *conn, 4222 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 4223 { 4224 struct hci_dev *hdev = conn->hcon->hdev; 4225 struct hci_conn *hcon = conn->hcon; 4226 4227 if (cmd_len < sizeof(struct l2cap_conn_req)) 4228 return -EPROTO; 4229 4230 hci_dev_lock(hdev); 4231 if (hci_dev_test_flag(hdev, HCI_MGMT) && 4232 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags)) 4233 mgmt_device_connected(hdev, hcon, 0, NULL, 0); 4234 hci_dev_unlock(hdev); 4235 4236 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0); 4237 return 0; 4238 } 4239 4240 static int l2cap_connect_create_rsp(struct l2cap_conn *conn, 4241 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4242 u8 *data) 4243 { 4244 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 4245 u16 scid, dcid, result, status; 4246 struct l2cap_chan *chan; 4247 u8 req[128]; 4248 int err; 4249 4250 if (cmd_len < sizeof(*rsp)) 4251 return -EPROTO; 4252 4253 scid = __le16_to_cpu(rsp->scid); 4254 dcid = __le16_to_cpu(rsp->dcid); 4255 result = __le16_to_cpu(rsp->result); 4256 status = __le16_to_cpu(rsp->status); 4257 4258 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", 4259 dcid, scid, result, status); 4260 4261 mutex_lock(&conn->chan_lock); 4262 4263 if (scid) { 4264 chan = __l2cap_get_chan_by_scid(conn, scid); 4265 if (!chan) { 4266 err = -EBADSLT; 4267 goto unlock; 4268 } 4269 } else { 4270 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 4271 if (!chan) { 4272 err = -EBADSLT; 4273 goto unlock; 4274 } 4275 } 4276 4277 err = 0; 4278 4279 l2cap_chan_lock(chan); 4280 4281 switch (result) { 4282 case L2CAP_CR_SUCCESS: 4283 l2cap_state_change(chan, BT_CONFIG); 4284 chan->ident = 0; 4285 chan->dcid = dcid; 4286 clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 4287 4288 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4289 break; 4290 4291 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4292 l2cap_build_conf_req(chan, req, sizeof(req)), req); 4293 chan->num_conf_req++; 4294 break; 4295 4296 case L2CAP_CR_PEND: 4297 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 4298 break; 4299 4300 default: 4301 l2cap_chan_del(chan, ECONNREFUSED); 4302 break; 4303 } 4304 4305 l2cap_chan_unlock(chan); 4306 4307 unlock: 4308 mutex_unlock(&conn->chan_lock); 4309 4310 return err; 4311 } 4312 4313 static inline void set_default_fcs(struct l2cap_chan *chan) 4314 { 4315 /* FCS is enabled only in ERTM or streaming mode, if one or both 4316 * sides request it. 4317 */ 4318 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 4319 chan->fcs = L2CAP_FCS_NONE; 4320 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) 4321 chan->fcs = L2CAP_FCS_CRC16; 4322 } 4323 4324 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data, 4325 u8 ident, u16 flags) 4326 { 4327 struct l2cap_conn *conn = chan->conn; 4328 4329 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident, 4330 flags); 4331 4332 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 4333 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 4334 4335 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP, 4336 l2cap_build_conf_rsp(chan, data, 4337 L2CAP_CONF_SUCCESS, flags), data); 4338 } 4339 4340 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident, 4341 u16 scid, u16 dcid) 4342 { 4343 struct l2cap_cmd_rej_cid rej; 4344 4345 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 4346 rej.scid = __cpu_to_le16(scid); 4347 rej.dcid = __cpu_to_le16(dcid); 4348 4349 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 4350 } 4351 4352 static inline int l2cap_config_req(struct l2cap_conn *conn, 4353 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4354 u8 *data) 4355 { 4356 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 4357 u16 dcid, flags; 4358 u8 rsp[64]; 4359 struct l2cap_chan *chan; 4360 int len, err = 0; 4361 4362 if (cmd_len < sizeof(*req)) 4363 return -EPROTO; 4364 4365 dcid = __le16_to_cpu(req->dcid); 4366 flags = __le16_to_cpu(req->flags); 4367 4368 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 4369 4370 chan = l2cap_get_chan_by_scid(conn, dcid); 4371 if (!chan) { 4372 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0); 4373 return 0; 4374 } 4375 4376 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && 4377 chan->state != BT_CONNECTED) { 4378 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4379 chan->dcid); 4380 goto unlock; 4381 } 4382 4383 /* Reject if config buffer is too small. */ 4384 len = cmd_len - sizeof(*req); 4385 if (chan->conf_len + len > sizeof(chan->conf_req)) { 4386 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4387 l2cap_build_conf_rsp(chan, rsp, 4388 L2CAP_CONF_REJECT, flags), rsp); 4389 goto unlock; 4390 } 4391 4392 /* Store config. */ 4393 memcpy(chan->conf_req + chan->conf_len, req->data, len); 4394 chan->conf_len += len; 4395 4396 if (flags & L2CAP_CONF_FLAG_CONTINUATION) { 4397 /* Incomplete config. Send empty response. */ 4398 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4399 l2cap_build_conf_rsp(chan, rsp, 4400 L2CAP_CONF_SUCCESS, flags), rsp); 4401 goto unlock; 4402 } 4403 4404 /* Complete config. */ 4405 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); 4406 if (len < 0) { 4407 l2cap_send_disconn_req(chan, ECONNRESET); 4408 goto unlock; 4409 } 4410 4411 chan->ident = cmd->ident; 4412 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 4413 chan->num_conf_rsp++; 4414 4415 /* Reset config buffer. */ 4416 chan->conf_len = 0; 4417 4418 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 4419 goto unlock; 4420 4421 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 4422 set_default_fcs(chan); 4423 4424 if (chan->mode == L2CAP_MODE_ERTM || 4425 chan->mode == L2CAP_MODE_STREAMING) 4426 err = l2cap_ertm_init(chan); 4427 4428 if (err < 0) 4429 l2cap_send_disconn_req(chan, -err); 4430 else 4431 l2cap_chan_ready(chan); 4432 4433 goto unlock; 4434 } 4435 4436 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 4437 u8 buf[64]; 4438 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4439 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4440 chan->num_conf_req++; 4441 } 4442 4443 /* Got Conf Rsp PENDING from remote side and assume we sent 4444 Conf Rsp PENDING in the code above */ 4445 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) && 4446 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4447 4448 /* check compatibility */ 4449 4450 /* Send rsp for BR/EDR channel */ 4451 if (!chan->hs_hcon) 4452 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); 4453 else 4454 chan->ident = cmd->ident; 4455 } 4456 4457 unlock: 4458 l2cap_chan_unlock(chan); 4459 return err; 4460 } 4461 4462 static inline int l2cap_config_rsp(struct l2cap_conn *conn, 4463 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4464 u8 *data) 4465 { 4466 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 4467 u16 scid, flags, result; 4468 struct l2cap_chan *chan; 4469 int len = cmd_len - sizeof(*rsp); 4470 int err = 0; 4471 4472 if (cmd_len < sizeof(*rsp)) 4473 return -EPROTO; 4474 4475 scid = __le16_to_cpu(rsp->scid); 4476 flags = __le16_to_cpu(rsp->flags); 4477 result = __le16_to_cpu(rsp->result); 4478 4479 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags, 4480 result, len); 4481 4482 chan = l2cap_get_chan_by_scid(conn, scid); 4483 if (!chan) 4484 return 0; 4485 4486 switch (result) { 4487 case L2CAP_CONF_SUCCESS: 4488 l2cap_conf_rfc_get(chan, rsp->data, len); 4489 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4490 break; 4491 4492 case L2CAP_CONF_PENDING: 4493 set_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4494 4495 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4496 char buf[64]; 4497 4498 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4499 buf, sizeof(buf), &result); 4500 if (len < 0) { 4501 l2cap_send_disconn_req(chan, ECONNRESET); 4502 goto done; 4503 } 4504 4505 if (!chan->hs_hcon) { 4506 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 4507 0); 4508 } else { 4509 if (l2cap_check_efs(chan)) { 4510 amp_create_logical_link(chan); 4511 chan->ident = cmd->ident; 4512 } 4513 } 4514 } 4515 goto done; 4516 4517 case L2CAP_CONF_UNACCEPT: 4518 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 4519 char req[64]; 4520 4521 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 4522 l2cap_send_disconn_req(chan, ECONNRESET); 4523 goto done; 4524 } 4525 4526 /* throw out any old stored conf requests */ 4527 result = L2CAP_CONF_SUCCESS; 4528 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4529 req, sizeof(req), &result); 4530 if (len < 0) { 4531 l2cap_send_disconn_req(chan, ECONNRESET); 4532 goto done; 4533 } 4534 4535 l2cap_send_cmd(conn, l2cap_get_ident(conn), 4536 L2CAP_CONF_REQ, len, req); 4537 chan->num_conf_req++; 4538 if (result != L2CAP_CONF_SUCCESS) 4539 goto done; 4540 break; 4541 } 4542 /* fall through */ 4543 4544 default: 4545 l2cap_chan_set_err(chan, ECONNRESET); 4546 4547 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT); 4548 l2cap_send_disconn_req(chan, ECONNRESET); 4549 goto done; 4550 } 4551 4552 if (flags & L2CAP_CONF_FLAG_CONTINUATION) 4553 goto done; 4554 4555 set_bit(CONF_INPUT_DONE, &chan->conf_state); 4556 4557 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 4558 set_default_fcs(chan); 4559 4560 if (chan->mode == L2CAP_MODE_ERTM || 4561 chan->mode == L2CAP_MODE_STREAMING) 4562 err = l2cap_ertm_init(chan); 4563 4564 if (err < 0) 4565 l2cap_send_disconn_req(chan, -err); 4566 else 4567 l2cap_chan_ready(chan); 4568 } 4569 4570 done: 4571 l2cap_chan_unlock(chan); 4572 return err; 4573 } 4574 4575 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, 4576 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4577 u8 *data) 4578 { 4579 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 4580 struct l2cap_disconn_rsp rsp; 4581 u16 dcid, scid; 4582 struct l2cap_chan *chan; 4583 4584 if (cmd_len != sizeof(*req)) 4585 return -EPROTO; 4586 4587 scid = __le16_to_cpu(req->scid); 4588 dcid = __le16_to_cpu(req->dcid); 4589 4590 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 4591 4592 mutex_lock(&conn->chan_lock); 4593 4594 chan = __l2cap_get_chan_by_scid(conn, dcid); 4595 if (!chan) { 4596 mutex_unlock(&conn->chan_lock); 4597 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); 4598 return 0; 4599 } 4600 4601 l2cap_chan_hold(chan); 4602 l2cap_chan_lock(chan); 4603 4604 rsp.dcid = cpu_to_le16(chan->scid); 4605 rsp.scid = cpu_to_le16(chan->dcid); 4606 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 4607 4608 chan->ops->set_shutdown(chan); 4609 4610 l2cap_chan_del(chan, ECONNRESET); 4611 4612 chan->ops->close(chan); 4613 4614 l2cap_chan_unlock(chan); 4615 l2cap_chan_put(chan); 4616 4617 mutex_unlock(&conn->chan_lock); 4618 4619 return 0; 4620 } 4621 4622 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, 4623 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4624 u8 *data) 4625 { 4626 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 4627 u16 dcid, scid; 4628 struct l2cap_chan *chan; 4629 4630 if (cmd_len != sizeof(*rsp)) 4631 return -EPROTO; 4632 4633 scid = __le16_to_cpu(rsp->scid); 4634 dcid = __le16_to_cpu(rsp->dcid); 4635 4636 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 4637 4638 mutex_lock(&conn->chan_lock); 4639 4640 chan = __l2cap_get_chan_by_scid(conn, scid); 4641 if (!chan) { 4642 mutex_unlock(&conn->chan_lock); 4643 return 0; 4644 } 4645 4646 l2cap_chan_hold(chan); 4647 l2cap_chan_lock(chan); 4648 4649 if (chan->state != BT_DISCONN) { 4650 l2cap_chan_unlock(chan); 4651 l2cap_chan_put(chan); 4652 mutex_unlock(&conn->chan_lock); 4653 return 0; 4654 } 4655 4656 l2cap_chan_del(chan, 0); 4657 4658 chan->ops->close(chan); 4659 4660 l2cap_chan_unlock(chan); 4661 l2cap_chan_put(chan); 4662 4663 mutex_unlock(&conn->chan_lock); 4664 4665 return 0; 4666 } 4667 4668 static inline int l2cap_information_req(struct l2cap_conn *conn, 4669 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4670 u8 *data) 4671 { 4672 struct l2cap_info_req *req = (struct l2cap_info_req *) data; 4673 u16 type; 4674 4675 if (cmd_len != sizeof(*req)) 4676 return -EPROTO; 4677 4678 type = __le16_to_cpu(req->type); 4679 4680 BT_DBG("type 0x%4.4x", type); 4681 4682 if (type == L2CAP_IT_FEAT_MASK) { 4683 u8 buf[8]; 4684 u32 feat_mask = l2cap_feat_mask; 4685 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4686 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4687 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4688 if (!disable_ertm) 4689 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 4690 | L2CAP_FEAT_FCS; 4691 if (conn->local_fixed_chan & L2CAP_FC_A2MP) 4692 feat_mask |= L2CAP_FEAT_EXT_FLOW 4693 | L2CAP_FEAT_EXT_WINDOW; 4694 4695 put_unaligned_le32(feat_mask, rsp->data); 4696 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4697 buf); 4698 } else if (type == L2CAP_IT_FIXED_CHAN) { 4699 u8 buf[12]; 4700 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4701 4702 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4703 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4704 rsp->data[0] = conn->local_fixed_chan; 4705 memset(rsp->data + 1, 0, 7); 4706 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4707 buf); 4708 } else { 4709 struct l2cap_info_rsp rsp; 4710 rsp.type = cpu_to_le16(type); 4711 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 4712 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), 4713 &rsp); 4714 } 4715 4716 return 0; 4717 } 4718 4719 static inline int l2cap_information_rsp(struct l2cap_conn *conn, 4720 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4721 u8 *data) 4722 { 4723 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 4724 u16 type, result; 4725 4726 if (cmd_len < sizeof(*rsp)) 4727 return -EPROTO; 4728 4729 type = __le16_to_cpu(rsp->type); 4730 result = __le16_to_cpu(rsp->result); 4731 4732 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 4733 4734 /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 4735 if (cmd->ident != conn->info_ident || 4736 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 4737 return 0; 4738 4739 cancel_delayed_work(&conn->info_timer); 4740 4741 if (result != L2CAP_IR_SUCCESS) { 4742 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4743 conn->info_ident = 0; 4744 4745 l2cap_conn_start(conn); 4746 4747 return 0; 4748 } 4749 4750 switch (type) { 4751 case L2CAP_IT_FEAT_MASK: 4752 conn->feat_mask = get_unaligned_le32(rsp->data); 4753 4754 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 4755 struct l2cap_info_req req; 4756 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4757 4758 conn->info_ident = l2cap_get_ident(conn); 4759 4760 l2cap_send_cmd(conn, conn->info_ident, 4761 L2CAP_INFO_REQ, sizeof(req), &req); 4762 } else { 4763 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4764 conn->info_ident = 0; 4765 4766 l2cap_conn_start(conn); 4767 } 4768 break; 4769 4770 case L2CAP_IT_FIXED_CHAN: 4771 conn->remote_fixed_chan = rsp->data[0]; 4772 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4773 conn->info_ident = 0; 4774 4775 l2cap_conn_start(conn); 4776 break; 4777 } 4778 4779 return 0; 4780 } 4781 4782 static int l2cap_create_channel_req(struct l2cap_conn *conn, 4783 struct l2cap_cmd_hdr *cmd, 4784 u16 cmd_len, void *data) 4785 { 4786 struct l2cap_create_chan_req *req = data; 4787 struct l2cap_create_chan_rsp rsp; 4788 struct l2cap_chan *chan; 4789 struct hci_dev *hdev; 4790 u16 psm, scid; 4791 4792 if (cmd_len != sizeof(*req)) 4793 return -EPROTO; 4794 4795 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) 4796 return -EINVAL; 4797 4798 psm = le16_to_cpu(req->psm); 4799 scid = le16_to_cpu(req->scid); 4800 4801 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id); 4802 4803 /* For controller id 0 make BR/EDR connection */ 4804 if (req->amp_id == AMP_ID_BREDR) { 4805 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP, 4806 req->amp_id); 4807 return 0; 4808 } 4809 4810 /* Validate AMP controller id */ 4811 hdev = hci_dev_get(req->amp_id); 4812 if (!hdev) 4813 goto error; 4814 4815 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) { 4816 hci_dev_put(hdev); 4817 goto error; 4818 } 4819 4820 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP, 4821 req->amp_id); 4822 if (chan) { 4823 struct amp_mgr *mgr = conn->hcon->amp_mgr; 4824 struct hci_conn *hs_hcon; 4825 4826 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, 4827 &conn->hcon->dst); 4828 if (!hs_hcon) { 4829 hci_dev_put(hdev); 4830 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4831 chan->dcid); 4832 return 0; 4833 } 4834 4835 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon); 4836 4837 mgr->bredr_chan = chan; 4838 chan->hs_hcon = hs_hcon; 4839 chan->fcs = L2CAP_FCS_NONE; 4840 conn->mtu = hdev->block_mtu; 4841 } 4842 4843 hci_dev_put(hdev); 4844 4845 return 0; 4846 4847 error: 4848 rsp.dcid = 0; 4849 rsp.scid = cpu_to_le16(scid); 4850 rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP); 4851 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 4852 4853 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP, 4854 sizeof(rsp), &rsp); 4855 4856 return 0; 4857 } 4858 4859 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id) 4860 { 4861 struct l2cap_move_chan_req req; 4862 u8 ident; 4863 4864 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id); 4865 4866 ident = l2cap_get_ident(chan->conn); 4867 chan->ident = ident; 4868 4869 req.icid = cpu_to_le16(chan->scid); 4870 req.dest_amp_id = dest_amp_id; 4871 4872 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req), 4873 &req); 4874 4875 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT); 4876 } 4877 4878 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result) 4879 { 4880 struct l2cap_move_chan_rsp rsp; 4881 4882 BT_DBG("chan %p, result 0x%4.4x", chan, result); 4883 4884 rsp.icid = cpu_to_le16(chan->dcid); 4885 rsp.result = cpu_to_le16(result); 4886 4887 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP, 4888 sizeof(rsp), &rsp); 4889 } 4890 4891 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result) 4892 { 4893 struct l2cap_move_chan_cfm cfm; 4894 4895 BT_DBG("chan %p, result 0x%4.4x", chan, result); 4896 4897 chan->ident = l2cap_get_ident(chan->conn); 4898 4899 cfm.icid = cpu_to_le16(chan->scid); 4900 cfm.result = cpu_to_le16(result); 4901 4902 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM, 4903 sizeof(cfm), &cfm); 4904 4905 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT); 4906 } 4907 4908 static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid) 4909 { 4910 struct l2cap_move_chan_cfm cfm; 4911 4912 BT_DBG("conn %p, icid 0x%4.4x", conn, icid); 4913 4914 cfm.icid = cpu_to_le16(icid); 4915 cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED); 4916 4917 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM, 4918 sizeof(cfm), &cfm); 4919 } 4920 4921 static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident, 4922 u16 icid) 4923 { 4924 struct l2cap_move_chan_cfm_rsp rsp; 4925 4926 BT_DBG("icid 0x%4.4x", icid); 4927 4928 rsp.icid = cpu_to_le16(icid); 4929 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp); 4930 } 4931 4932 static void __release_logical_link(struct l2cap_chan *chan) 4933 { 4934 chan->hs_hchan = NULL; 4935 chan->hs_hcon = NULL; 4936 4937 /* Placeholder - release the logical link */ 4938 } 4939 4940 static void l2cap_logical_fail(struct l2cap_chan *chan) 4941 { 4942 /* Logical link setup failed */ 4943 if (chan->state != BT_CONNECTED) { 4944 /* Create channel failure, disconnect */ 4945 l2cap_send_disconn_req(chan, ECONNRESET); 4946 return; 4947 } 4948 4949 switch (chan->move_role) { 4950 case L2CAP_MOVE_ROLE_RESPONDER: 4951 l2cap_move_done(chan); 4952 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP); 4953 break; 4954 case L2CAP_MOVE_ROLE_INITIATOR: 4955 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP || 4956 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) { 4957 /* Remote has only sent pending or 4958 * success responses, clean up 4959 */ 4960 l2cap_move_done(chan); 4961 } 4962 4963 /* Other amp move states imply that the move 4964 * has already aborted 4965 */ 4966 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 4967 break; 4968 } 4969 } 4970 4971 static void l2cap_logical_finish_create(struct l2cap_chan *chan, 4972 struct hci_chan *hchan) 4973 { 4974 struct l2cap_conf_rsp rsp; 4975 4976 chan->hs_hchan = hchan; 4977 chan->hs_hcon->l2cap_data = chan->conn; 4978 4979 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0); 4980 4981 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 4982 int err; 4983 4984 set_default_fcs(chan); 4985 4986 err = l2cap_ertm_init(chan); 4987 if (err < 0) 4988 l2cap_send_disconn_req(chan, -err); 4989 else 4990 l2cap_chan_ready(chan); 4991 } 4992 } 4993 4994 static void l2cap_logical_finish_move(struct l2cap_chan *chan, 4995 struct hci_chan *hchan) 4996 { 4997 chan->hs_hcon = hchan->conn; 4998 chan->hs_hcon->l2cap_data = chan->conn; 4999 5000 BT_DBG("move_state %d", chan->move_state); 5001 5002 switch (chan->move_state) { 5003 case L2CAP_MOVE_WAIT_LOGICAL_COMP: 5004 /* Move confirm will be sent after a success 5005 * response is received 5006 */ 5007 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; 5008 break; 5009 case L2CAP_MOVE_WAIT_LOGICAL_CFM: 5010 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5011 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; 5012 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) { 5013 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP; 5014 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); 5015 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) { 5016 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; 5017 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS); 5018 } 5019 break; 5020 default: 5021 /* Move was not in expected state, free the channel */ 5022 __release_logical_link(chan); 5023 5024 chan->move_state = L2CAP_MOVE_STABLE; 5025 } 5026 } 5027 5028 /* Call with chan locked */ 5029 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan, 5030 u8 status) 5031 { 5032 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status); 5033 5034 if (status) { 5035 l2cap_logical_fail(chan); 5036 __release_logical_link(chan); 5037 return; 5038 } 5039 5040 if (chan->state != BT_CONNECTED) { 5041 /* Ignore logical link if channel is on BR/EDR */ 5042 if (chan->local_amp_id != AMP_ID_BREDR) 5043 l2cap_logical_finish_create(chan, hchan); 5044 } else { 5045 l2cap_logical_finish_move(chan, hchan); 5046 } 5047 } 5048 5049 void l2cap_move_start(struct l2cap_chan *chan) 5050 { 5051 BT_DBG("chan %p", chan); 5052 5053 if (chan->local_amp_id == AMP_ID_BREDR) { 5054 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED) 5055 return; 5056 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR; 5057 chan->move_state = L2CAP_MOVE_WAIT_PREPARE; 5058 /* Placeholder - start physical link setup */ 5059 } else { 5060 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR; 5061 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; 5062 chan->move_id = 0; 5063 l2cap_move_setup(chan); 5064 l2cap_send_move_chan_req(chan, 0); 5065 } 5066 } 5067 5068 static void l2cap_do_create(struct l2cap_chan *chan, int result, 5069 u8 local_amp_id, u8 remote_amp_id) 5070 { 5071 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state), 5072 local_amp_id, remote_amp_id); 5073 5074 chan->fcs = L2CAP_FCS_NONE; 5075 5076 /* Outgoing channel on AMP */ 5077 if (chan->state == BT_CONNECT) { 5078 if (result == L2CAP_CR_SUCCESS) { 5079 chan->local_amp_id = local_amp_id; 5080 l2cap_send_create_chan_req(chan, remote_amp_id); 5081 } else { 5082 /* Revert to BR/EDR connect */ 5083 l2cap_send_conn_req(chan); 5084 } 5085 5086 return; 5087 } 5088 5089 /* Incoming channel on AMP */ 5090 if (__l2cap_no_conn_pending(chan)) { 5091 struct l2cap_conn_rsp rsp; 5092 char buf[128]; 5093 rsp.scid = cpu_to_le16(chan->dcid); 5094 rsp.dcid = cpu_to_le16(chan->scid); 5095 5096 if (result == L2CAP_CR_SUCCESS) { 5097 /* Send successful response */ 5098 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 5099 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 5100 } else { 5101 /* Send negative response */ 5102 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM); 5103 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 5104 } 5105 5106 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP, 5107 sizeof(rsp), &rsp); 5108 5109 if (result == L2CAP_CR_SUCCESS) { 5110 l2cap_state_change(chan, BT_CONFIG); 5111 set_bit(CONF_REQ_SENT, &chan->conf_state); 5112 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), 5113 L2CAP_CONF_REQ, 5114 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 5115 chan->num_conf_req++; 5116 } 5117 } 5118 } 5119 5120 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id, 5121 u8 remote_amp_id) 5122 { 5123 l2cap_move_setup(chan); 5124 chan->move_id = local_amp_id; 5125 chan->move_state = L2CAP_MOVE_WAIT_RSP; 5126 5127 l2cap_send_move_chan_req(chan, remote_amp_id); 5128 } 5129 5130 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result) 5131 { 5132 struct hci_chan *hchan = NULL; 5133 5134 /* Placeholder - get hci_chan for logical link */ 5135 5136 if (hchan) { 5137 if (hchan->state == BT_CONNECTED) { 5138 /* Logical link is ready to go */ 5139 chan->hs_hcon = hchan->conn; 5140 chan->hs_hcon->l2cap_data = chan->conn; 5141 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; 5142 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS); 5143 5144 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS); 5145 } else { 5146 /* Wait for logical link to be ready */ 5147 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; 5148 } 5149 } else { 5150 /* Logical link not available */ 5151 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED); 5152 } 5153 } 5154 5155 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result) 5156 { 5157 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) { 5158 u8 rsp_result; 5159 if (result == -EINVAL) 5160 rsp_result = L2CAP_MR_BAD_ID; 5161 else 5162 rsp_result = L2CAP_MR_NOT_ALLOWED; 5163 5164 l2cap_send_move_chan_rsp(chan, rsp_result); 5165 } 5166 5167 chan->move_role = L2CAP_MOVE_ROLE_NONE; 5168 chan->move_state = L2CAP_MOVE_STABLE; 5169 5170 /* Restart data transmission */ 5171 l2cap_ertm_send(chan); 5172 } 5173 5174 /* Invoke with locked chan */ 5175 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result) 5176 { 5177 u8 local_amp_id = chan->local_amp_id; 5178 u8 remote_amp_id = chan->remote_amp_id; 5179 5180 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d", 5181 chan, result, local_amp_id, remote_amp_id); 5182 5183 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) 5184 return; 5185 5186 if (chan->state != BT_CONNECTED) { 5187 l2cap_do_create(chan, result, local_amp_id, remote_amp_id); 5188 } else if (result != L2CAP_MR_SUCCESS) { 5189 l2cap_do_move_cancel(chan, result); 5190 } else { 5191 switch (chan->move_role) { 5192 case L2CAP_MOVE_ROLE_INITIATOR: 5193 l2cap_do_move_initiate(chan, local_amp_id, 5194 remote_amp_id); 5195 break; 5196 case L2CAP_MOVE_ROLE_RESPONDER: 5197 l2cap_do_move_respond(chan, result); 5198 break; 5199 default: 5200 l2cap_do_move_cancel(chan, result); 5201 break; 5202 } 5203 } 5204 } 5205 5206 static inline int l2cap_move_channel_req(struct l2cap_conn *conn, 5207 struct l2cap_cmd_hdr *cmd, 5208 u16 cmd_len, void *data) 5209 { 5210 struct l2cap_move_chan_req *req = data; 5211 struct l2cap_move_chan_rsp rsp; 5212 struct l2cap_chan *chan; 5213 u16 icid = 0; 5214 u16 result = L2CAP_MR_NOT_ALLOWED; 5215 5216 if (cmd_len != sizeof(*req)) 5217 return -EPROTO; 5218 5219 icid = le16_to_cpu(req->icid); 5220 5221 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id); 5222 5223 if (!(conn->local_fixed_chan & L2CAP_FC_A2MP)) 5224 return -EINVAL; 5225 5226 chan = l2cap_get_chan_by_dcid(conn, icid); 5227 if (!chan) { 5228 rsp.icid = cpu_to_le16(icid); 5229 rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED); 5230 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP, 5231 sizeof(rsp), &rsp); 5232 return 0; 5233 } 5234 5235 chan->ident = cmd->ident; 5236 5237 if (chan->scid < L2CAP_CID_DYN_START || 5238 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY || 5239 (chan->mode != L2CAP_MODE_ERTM && 5240 chan->mode != L2CAP_MODE_STREAMING)) { 5241 result = L2CAP_MR_NOT_ALLOWED; 5242 goto send_move_response; 5243 } 5244 5245 if (chan->local_amp_id == req->dest_amp_id) { 5246 result = L2CAP_MR_SAME_ID; 5247 goto send_move_response; 5248 } 5249 5250 if (req->dest_amp_id != AMP_ID_BREDR) { 5251 struct hci_dev *hdev; 5252 hdev = hci_dev_get(req->dest_amp_id); 5253 if (!hdev || hdev->dev_type != HCI_AMP || 5254 !test_bit(HCI_UP, &hdev->flags)) { 5255 if (hdev) 5256 hci_dev_put(hdev); 5257 5258 result = L2CAP_MR_BAD_ID; 5259 goto send_move_response; 5260 } 5261 hci_dev_put(hdev); 5262 } 5263 5264 /* Detect a move collision. Only send a collision response 5265 * if this side has "lost", otherwise proceed with the move. 5266 * The winner has the larger bd_addr. 5267 */ 5268 if ((__chan_is_moving(chan) || 5269 chan->move_role != L2CAP_MOVE_ROLE_NONE) && 5270 bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) { 5271 result = L2CAP_MR_COLLISION; 5272 goto send_move_response; 5273 } 5274 5275 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER; 5276 l2cap_move_setup(chan); 5277 chan->move_id = req->dest_amp_id; 5278 5279 if (req->dest_amp_id == AMP_ID_BREDR) { 5280 /* Moving to BR/EDR */ 5281 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5282 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; 5283 result = L2CAP_MR_PEND; 5284 } else { 5285 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM; 5286 result = L2CAP_MR_SUCCESS; 5287 } 5288 } else { 5289 chan->move_state = L2CAP_MOVE_WAIT_PREPARE; 5290 /* Placeholder - uncomment when amp functions are available */ 5291 /*amp_accept_physical(chan, req->dest_amp_id);*/ 5292 result = L2CAP_MR_PEND; 5293 } 5294 5295 send_move_response: 5296 l2cap_send_move_chan_rsp(chan, result); 5297 5298 l2cap_chan_unlock(chan); 5299 5300 return 0; 5301 } 5302 5303 static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result) 5304 { 5305 struct l2cap_chan *chan; 5306 struct hci_chan *hchan = NULL; 5307 5308 chan = l2cap_get_chan_by_scid(conn, icid); 5309 if (!chan) { 5310 l2cap_send_move_chan_cfm_icid(conn, icid); 5311 return; 5312 } 5313 5314 __clear_chan_timer(chan); 5315 if (result == L2CAP_MR_PEND) 5316 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT); 5317 5318 switch (chan->move_state) { 5319 case L2CAP_MOVE_WAIT_LOGICAL_COMP: 5320 /* Move confirm will be sent when logical link 5321 * is complete. 5322 */ 5323 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; 5324 break; 5325 case L2CAP_MOVE_WAIT_RSP_SUCCESS: 5326 if (result == L2CAP_MR_PEND) { 5327 break; 5328 } else if (test_bit(CONN_LOCAL_BUSY, 5329 &chan->conn_state)) { 5330 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY; 5331 } else { 5332 /* Logical link is up or moving to BR/EDR, 5333 * proceed with move 5334 */ 5335 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP; 5336 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); 5337 } 5338 break; 5339 case L2CAP_MOVE_WAIT_RSP: 5340 /* Moving to AMP */ 5341 if (result == L2CAP_MR_SUCCESS) { 5342 /* Remote is ready, send confirm immediately 5343 * after logical link is ready 5344 */ 5345 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM; 5346 } else { 5347 /* Both logical link and move success 5348 * are required to confirm 5349 */ 5350 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP; 5351 } 5352 5353 /* Placeholder - get hci_chan for logical link */ 5354 if (!hchan) { 5355 /* Logical link not available */ 5356 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5357 break; 5358 } 5359 5360 /* If the logical link is not yet connected, do not 5361 * send confirmation. 5362 */ 5363 if (hchan->state != BT_CONNECTED) 5364 break; 5365 5366 /* Logical link is already ready to go */ 5367 5368 chan->hs_hcon = hchan->conn; 5369 chan->hs_hcon->l2cap_data = chan->conn; 5370 5371 if (result == L2CAP_MR_SUCCESS) { 5372 /* Can confirm now */ 5373 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED); 5374 } else { 5375 /* Now only need move success 5376 * to confirm 5377 */ 5378 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS; 5379 } 5380 5381 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS); 5382 break; 5383 default: 5384 /* Any other amp move state means the move failed. */ 5385 chan->move_id = chan->local_amp_id; 5386 l2cap_move_done(chan); 5387 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5388 } 5389 5390 l2cap_chan_unlock(chan); 5391 } 5392 5393 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid, 5394 u16 result) 5395 { 5396 struct l2cap_chan *chan; 5397 5398 chan = l2cap_get_chan_by_ident(conn, ident); 5399 if (!chan) { 5400 /* Could not locate channel, icid is best guess */ 5401 l2cap_send_move_chan_cfm_icid(conn, icid); 5402 return; 5403 } 5404 5405 __clear_chan_timer(chan); 5406 5407 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) { 5408 if (result == L2CAP_MR_COLLISION) { 5409 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER; 5410 } else { 5411 /* Cleanup - cancel move */ 5412 chan->move_id = chan->local_amp_id; 5413 l2cap_move_done(chan); 5414 } 5415 } 5416 5417 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED); 5418 5419 l2cap_chan_unlock(chan); 5420 } 5421 5422 static int l2cap_move_channel_rsp(struct l2cap_conn *conn, 5423 struct l2cap_cmd_hdr *cmd, 5424 u16 cmd_len, void *data) 5425 { 5426 struct l2cap_move_chan_rsp *rsp = data; 5427 u16 icid, result; 5428 5429 if (cmd_len != sizeof(*rsp)) 5430 return -EPROTO; 5431 5432 icid = le16_to_cpu(rsp->icid); 5433 result = le16_to_cpu(rsp->result); 5434 5435 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result); 5436 5437 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND) 5438 l2cap_move_continue(conn, icid, result); 5439 else 5440 l2cap_move_fail(conn, cmd->ident, icid, result); 5441 5442 return 0; 5443 } 5444 5445 static int l2cap_move_channel_confirm(struct l2cap_conn *conn, 5446 struct l2cap_cmd_hdr *cmd, 5447 u16 cmd_len, void *data) 5448 { 5449 struct l2cap_move_chan_cfm *cfm = data; 5450 struct l2cap_chan *chan; 5451 u16 icid, result; 5452 5453 if (cmd_len != sizeof(*cfm)) 5454 return -EPROTO; 5455 5456 icid = le16_to_cpu(cfm->icid); 5457 result = le16_to_cpu(cfm->result); 5458 5459 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result); 5460 5461 chan = l2cap_get_chan_by_dcid(conn, icid); 5462 if (!chan) { 5463 /* Spec requires a response even if the icid was not found */ 5464 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); 5465 return 0; 5466 } 5467 5468 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) { 5469 if (result == L2CAP_MC_CONFIRMED) { 5470 chan->local_amp_id = chan->move_id; 5471 if (chan->local_amp_id == AMP_ID_BREDR) 5472 __release_logical_link(chan); 5473 } else { 5474 chan->move_id = chan->local_amp_id; 5475 } 5476 5477 l2cap_move_done(chan); 5478 } 5479 5480 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid); 5481 5482 l2cap_chan_unlock(chan); 5483 5484 return 0; 5485 } 5486 5487 static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn, 5488 struct l2cap_cmd_hdr *cmd, 5489 u16 cmd_len, void *data) 5490 { 5491 struct l2cap_move_chan_cfm_rsp *rsp = data; 5492 struct l2cap_chan *chan; 5493 u16 icid; 5494 5495 if (cmd_len != sizeof(*rsp)) 5496 return -EPROTO; 5497 5498 icid = le16_to_cpu(rsp->icid); 5499 5500 BT_DBG("icid 0x%4.4x", icid); 5501 5502 chan = l2cap_get_chan_by_scid(conn, icid); 5503 if (!chan) 5504 return 0; 5505 5506 __clear_chan_timer(chan); 5507 5508 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) { 5509 chan->local_amp_id = chan->move_id; 5510 5511 if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan) 5512 __release_logical_link(chan); 5513 5514 l2cap_move_done(chan); 5515 } 5516 5517 l2cap_chan_unlock(chan); 5518 5519 return 0; 5520 } 5521 5522 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 5523 struct l2cap_cmd_hdr *cmd, 5524 u16 cmd_len, u8 *data) 5525 { 5526 struct hci_conn *hcon = conn->hcon; 5527 struct l2cap_conn_param_update_req *req; 5528 struct l2cap_conn_param_update_rsp rsp; 5529 u16 min, max, latency, to_multiplier; 5530 int err; 5531 5532 if (hcon->role != HCI_ROLE_MASTER) 5533 return -EINVAL; 5534 5535 if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 5536 return -EPROTO; 5537 5538 req = (struct l2cap_conn_param_update_req *) data; 5539 min = __le16_to_cpu(req->min); 5540 max = __le16_to_cpu(req->max); 5541 latency = __le16_to_cpu(req->latency); 5542 to_multiplier = __le16_to_cpu(req->to_multiplier); 5543 5544 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 5545 min, max, latency, to_multiplier); 5546 5547 memset(&rsp, 0, sizeof(rsp)); 5548 5549 err = hci_check_conn_params(min, max, latency, to_multiplier); 5550 if (err) 5551 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 5552 else 5553 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 5554 5555 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 5556 sizeof(rsp), &rsp); 5557 5558 if (!err) { 5559 u8 store_hint; 5560 5561 store_hint = hci_le_conn_update(hcon, min, max, latency, 5562 to_multiplier); 5563 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type, 5564 store_hint, min, max, latency, 5565 to_multiplier); 5566 5567 } 5568 5569 return 0; 5570 } 5571 5572 static int l2cap_le_connect_rsp(struct l2cap_conn *conn, 5573 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5574 u8 *data) 5575 { 5576 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data; 5577 struct hci_conn *hcon = conn->hcon; 5578 u16 dcid, mtu, mps, credits, result; 5579 struct l2cap_chan *chan; 5580 int err, sec_level; 5581 5582 if (cmd_len < sizeof(*rsp)) 5583 return -EPROTO; 5584 5585 dcid = __le16_to_cpu(rsp->dcid); 5586 mtu = __le16_to_cpu(rsp->mtu); 5587 mps = __le16_to_cpu(rsp->mps); 5588 credits = __le16_to_cpu(rsp->credits); 5589 result = __le16_to_cpu(rsp->result); 5590 5591 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 || 5592 dcid < L2CAP_CID_DYN_START || 5593 dcid > L2CAP_CID_LE_DYN_END)) 5594 return -EPROTO; 5595 5596 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", 5597 dcid, mtu, mps, credits, result); 5598 5599 mutex_lock(&conn->chan_lock); 5600 5601 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 5602 if (!chan) { 5603 err = -EBADSLT; 5604 goto unlock; 5605 } 5606 5607 err = 0; 5608 5609 l2cap_chan_lock(chan); 5610 5611 switch (result) { 5612 case L2CAP_CR_LE_SUCCESS: 5613 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 5614 err = -EBADSLT; 5615 break; 5616 } 5617 5618 chan->ident = 0; 5619 chan->dcid = dcid; 5620 chan->omtu = mtu; 5621 chan->remote_mps = mps; 5622 chan->tx_credits = credits; 5623 l2cap_chan_ready(chan); 5624 break; 5625 5626 case L2CAP_CR_LE_AUTHENTICATION: 5627 case L2CAP_CR_LE_ENCRYPTION: 5628 /* If we already have MITM protection we can't do 5629 * anything. 5630 */ 5631 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 5632 l2cap_chan_del(chan, ECONNREFUSED); 5633 break; 5634 } 5635 5636 sec_level = hcon->sec_level + 1; 5637 if (chan->sec_level < sec_level) 5638 chan->sec_level = sec_level; 5639 5640 /* We'll need to send a new Connect Request */ 5641 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags); 5642 5643 smp_conn_security(hcon, chan->sec_level); 5644 break; 5645 5646 default: 5647 l2cap_chan_del(chan, ECONNREFUSED); 5648 break; 5649 } 5650 5651 l2cap_chan_unlock(chan); 5652 5653 unlock: 5654 mutex_unlock(&conn->chan_lock); 5655 5656 return err; 5657 } 5658 5659 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 5660 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5661 u8 *data) 5662 { 5663 int err = 0; 5664 5665 switch (cmd->code) { 5666 case L2CAP_COMMAND_REJ: 5667 l2cap_command_rej(conn, cmd, cmd_len, data); 5668 break; 5669 5670 case L2CAP_CONN_REQ: 5671 err = l2cap_connect_req(conn, cmd, cmd_len, data); 5672 break; 5673 5674 case L2CAP_CONN_RSP: 5675 case L2CAP_CREATE_CHAN_RSP: 5676 l2cap_connect_create_rsp(conn, cmd, cmd_len, data); 5677 break; 5678 5679 case L2CAP_CONF_REQ: 5680 err = l2cap_config_req(conn, cmd, cmd_len, data); 5681 break; 5682 5683 case L2CAP_CONF_RSP: 5684 l2cap_config_rsp(conn, cmd, cmd_len, data); 5685 break; 5686 5687 case L2CAP_DISCONN_REQ: 5688 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 5689 break; 5690 5691 case L2CAP_DISCONN_RSP: 5692 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 5693 break; 5694 5695 case L2CAP_ECHO_REQ: 5696 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 5697 break; 5698 5699 case L2CAP_ECHO_RSP: 5700 break; 5701 5702 case L2CAP_INFO_REQ: 5703 err = l2cap_information_req(conn, cmd, cmd_len, data); 5704 break; 5705 5706 case L2CAP_INFO_RSP: 5707 l2cap_information_rsp(conn, cmd, cmd_len, data); 5708 break; 5709 5710 case L2CAP_CREATE_CHAN_REQ: 5711 err = l2cap_create_channel_req(conn, cmd, cmd_len, data); 5712 break; 5713 5714 case L2CAP_MOVE_CHAN_REQ: 5715 err = l2cap_move_channel_req(conn, cmd, cmd_len, data); 5716 break; 5717 5718 case L2CAP_MOVE_CHAN_RSP: 5719 l2cap_move_channel_rsp(conn, cmd, cmd_len, data); 5720 break; 5721 5722 case L2CAP_MOVE_CHAN_CFM: 5723 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data); 5724 break; 5725 5726 case L2CAP_MOVE_CHAN_CFM_RSP: 5727 l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data); 5728 break; 5729 5730 default: 5731 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 5732 err = -EINVAL; 5733 break; 5734 } 5735 5736 return err; 5737 } 5738 5739 static int l2cap_le_connect_req(struct l2cap_conn *conn, 5740 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5741 u8 *data) 5742 { 5743 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data; 5744 struct l2cap_le_conn_rsp rsp; 5745 struct l2cap_chan *chan, *pchan; 5746 u16 dcid, scid, credits, mtu, mps; 5747 __le16 psm; 5748 u8 result; 5749 5750 if (cmd_len != sizeof(*req)) 5751 return -EPROTO; 5752 5753 scid = __le16_to_cpu(req->scid); 5754 mtu = __le16_to_cpu(req->mtu); 5755 mps = __le16_to_cpu(req->mps); 5756 psm = req->psm; 5757 dcid = 0; 5758 credits = 0; 5759 5760 if (mtu < 23 || mps < 23) 5761 return -EPROTO; 5762 5763 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm), 5764 scid, mtu, mps); 5765 5766 /* Check if we have socket listening on psm */ 5767 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5768 &conn->hcon->dst, LE_LINK); 5769 if (!pchan) { 5770 result = L2CAP_CR_LE_BAD_PSM; 5771 chan = NULL; 5772 goto response; 5773 } 5774 5775 mutex_lock(&conn->chan_lock); 5776 l2cap_chan_lock(pchan); 5777 5778 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5779 SMP_ALLOW_STK)) { 5780 result = L2CAP_CR_LE_AUTHENTICATION; 5781 chan = NULL; 5782 goto response_unlock; 5783 } 5784 5785 /* Check for valid dynamic CID range */ 5786 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5787 result = L2CAP_CR_LE_INVALID_SCID; 5788 chan = NULL; 5789 goto response_unlock; 5790 } 5791 5792 /* Check if we already have channel with that dcid */ 5793 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5794 result = L2CAP_CR_LE_SCID_IN_USE; 5795 chan = NULL; 5796 goto response_unlock; 5797 } 5798 5799 chan = pchan->ops->new_connection(pchan); 5800 if (!chan) { 5801 result = L2CAP_CR_LE_NO_MEM; 5802 goto response_unlock; 5803 } 5804 5805 bacpy(&chan->src, &conn->hcon->src); 5806 bacpy(&chan->dst, &conn->hcon->dst); 5807 chan->src_type = bdaddr_src_type(conn->hcon); 5808 chan->dst_type = bdaddr_dst_type(conn->hcon); 5809 chan->psm = psm; 5810 chan->dcid = scid; 5811 chan->omtu = mtu; 5812 chan->remote_mps = mps; 5813 5814 __l2cap_chan_add(conn, chan); 5815 5816 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits)); 5817 5818 dcid = chan->scid; 5819 credits = chan->rx_credits; 5820 5821 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5822 5823 chan->ident = cmd->ident; 5824 5825 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5826 l2cap_state_change(chan, BT_CONNECT2); 5827 /* The following result value is actually not defined 5828 * for LE CoC but we use it to let the function know 5829 * that it should bail out after doing its cleanup 5830 * instead of sending a response. 5831 */ 5832 result = L2CAP_CR_PEND; 5833 chan->ops->defer(chan); 5834 } else { 5835 l2cap_chan_ready(chan); 5836 result = L2CAP_CR_LE_SUCCESS; 5837 } 5838 5839 response_unlock: 5840 l2cap_chan_unlock(pchan); 5841 mutex_unlock(&conn->chan_lock); 5842 l2cap_chan_put(pchan); 5843 5844 if (result == L2CAP_CR_PEND) 5845 return 0; 5846 5847 response: 5848 if (chan) { 5849 rsp.mtu = cpu_to_le16(chan->imtu); 5850 rsp.mps = cpu_to_le16(chan->mps); 5851 } else { 5852 rsp.mtu = 0; 5853 rsp.mps = 0; 5854 } 5855 5856 rsp.dcid = cpu_to_le16(dcid); 5857 rsp.credits = cpu_to_le16(credits); 5858 rsp.result = cpu_to_le16(result); 5859 5860 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp); 5861 5862 return 0; 5863 } 5864 5865 static inline int l2cap_le_credits(struct l2cap_conn *conn, 5866 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5867 u8 *data) 5868 { 5869 struct l2cap_le_credits *pkt; 5870 struct l2cap_chan *chan; 5871 u16 cid, credits, max_credits; 5872 5873 if (cmd_len != sizeof(*pkt)) 5874 return -EPROTO; 5875 5876 pkt = (struct l2cap_le_credits *) data; 5877 cid = __le16_to_cpu(pkt->cid); 5878 credits = __le16_to_cpu(pkt->credits); 5879 5880 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits); 5881 5882 chan = l2cap_get_chan_by_dcid(conn, cid); 5883 if (!chan) 5884 return -EBADSLT; 5885 5886 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits; 5887 if (credits > max_credits) { 5888 BT_ERR("LE credits overflow"); 5889 l2cap_send_disconn_req(chan, ECONNRESET); 5890 l2cap_chan_unlock(chan); 5891 5892 /* Return 0 so that we don't trigger an unnecessary 5893 * command reject packet. 5894 */ 5895 return 0; 5896 } 5897 5898 chan->tx_credits += credits; 5899 5900 /* Resume sending */ 5901 l2cap_le_flowctl_send(chan); 5902 5903 if (chan->tx_credits) 5904 chan->ops->resume(chan); 5905 5906 l2cap_chan_unlock(chan); 5907 5908 return 0; 5909 } 5910 5911 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, 5912 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5913 u8 *data) 5914 { 5915 struct l2cap_ecred_conn_req *req = (void *) data; 5916 struct { 5917 struct l2cap_ecred_conn_rsp rsp; 5918 __le16 dcid[5]; 5919 } __packed pdu; 5920 struct l2cap_chan *chan, *pchan; 5921 u16 mtu, mps; 5922 __le16 psm; 5923 u8 result, len = 0; 5924 int i, num_scid; 5925 bool defer = false; 5926 5927 if (!enable_ecred) 5928 return -EINVAL; 5929 5930 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 5931 result = L2CAP_CR_LE_INVALID_PARAMS; 5932 goto response; 5933 } 5934 5935 mtu = __le16_to_cpu(req->mtu); 5936 mps = __le16_to_cpu(req->mps); 5937 5938 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) { 5939 result = L2CAP_CR_LE_UNACCEPT_PARAMS; 5940 goto response; 5941 } 5942 5943 psm = req->psm; 5944 5945 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps); 5946 5947 memset(&pdu, 0, sizeof(pdu)); 5948 5949 /* Check if we have socket listening on psm */ 5950 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5951 &conn->hcon->dst, LE_LINK); 5952 if (!pchan) { 5953 result = L2CAP_CR_LE_BAD_PSM; 5954 goto response; 5955 } 5956 5957 mutex_lock(&conn->chan_lock); 5958 l2cap_chan_lock(pchan); 5959 5960 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5961 SMP_ALLOW_STK)) { 5962 result = L2CAP_CR_LE_AUTHENTICATION; 5963 goto unlock; 5964 } 5965 5966 result = L2CAP_CR_LE_SUCCESS; 5967 cmd_len -= sizeof(*req); 5968 num_scid = cmd_len / sizeof(u16); 5969 5970 for (i = 0; i < num_scid; i++) { 5971 u16 scid = __le16_to_cpu(req->scid[i]); 5972 5973 BT_DBG("scid[%d] 0x%4.4x", i, scid); 5974 5975 pdu.dcid[i] = 0x0000; 5976 len += sizeof(*pdu.dcid); 5977 5978 /* Check for valid dynamic CID range */ 5979 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5980 result = L2CAP_CR_LE_INVALID_SCID; 5981 continue; 5982 } 5983 5984 /* Check if we already have channel with that dcid */ 5985 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5986 result = L2CAP_CR_LE_SCID_IN_USE; 5987 continue; 5988 } 5989 5990 chan = pchan->ops->new_connection(pchan); 5991 if (!chan) { 5992 result = L2CAP_CR_LE_NO_MEM; 5993 continue; 5994 } 5995 5996 bacpy(&chan->src, &conn->hcon->src); 5997 bacpy(&chan->dst, &conn->hcon->dst); 5998 chan->src_type = bdaddr_src_type(conn->hcon); 5999 chan->dst_type = bdaddr_dst_type(conn->hcon); 6000 chan->psm = psm; 6001 chan->dcid = scid; 6002 chan->omtu = mtu; 6003 chan->remote_mps = mps; 6004 6005 __l2cap_chan_add(conn, chan); 6006 6007 l2cap_ecred_init(chan, __le16_to_cpu(req->credits)); 6008 6009 /* Init response */ 6010 if (!pdu.rsp.credits) { 6011 pdu.rsp.mtu = cpu_to_le16(chan->imtu); 6012 pdu.rsp.mps = cpu_to_le16(chan->mps); 6013 pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 6014 } 6015 6016 pdu.dcid[i] = cpu_to_le16(chan->scid); 6017 6018 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 6019 6020 chan->ident = cmd->ident; 6021 6022 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 6023 l2cap_state_change(chan, BT_CONNECT2); 6024 defer = true; 6025 chan->ops->defer(chan); 6026 } else { 6027 l2cap_chan_ready(chan); 6028 } 6029 } 6030 6031 unlock: 6032 l2cap_chan_unlock(pchan); 6033 mutex_unlock(&conn->chan_lock); 6034 l2cap_chan_put(pchan); 6035 6036 response: 6037 pdu.rsp.result = cpu_to_le16(result); 6038 6039 if (defer) 6040 return 0; 6041 6042 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP, 6043 sizeof(pdu.rsp) + len, &pdu); 6044 6045 return 0; 6046 } 6047 6048 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 6049 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6050 u8 *data) 6051 { 6052 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 6053 struct hci_conn *hcon = conn->hcon; 6054 u16 mtu, mps, credits, result; 6055 struct l2cap_chan *chan; 6056 int err = 0, sec_level; 6057 int i = 0; 6058 6059 if (cmd_len < sizeof(*rsp)) 6060 return -EPROTO; 6061 6062 mtu = __le16_to_cpu(rsp->mtu); 6063 mps = __le16_to_cpu(rsp->mps); 6064 credits = __le16_to_cpu(rsp->credits); 6065 result = __le16_to_cpu(rsp->result); 6066 6067 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, 6068 result); 6069 6070 mutex_lock(&conn->chan_lock); 6071 6072 cmd_len -= sizeof(*rsp); 6073 6074 list_for_each_entry(chan, &conn->chan_l, list) { 6075 u16 dcid; 6076 6077 if (chan->ident != cmd->ident || 6078 chan->mode != L2CAP_MODE_EXT_FLOWCTL || 6079 chan->state == BT_CONNECTED) 6080 continue; 6081 6082 l2cap_chan_lock(chan); 6083 6084 /* Check that there is a dcid for each pending channel */ 6085 if (cmd_len < sizeof(dcid)) { 6086 l2cap_chan_del(chan, ECONNREFUSED); 6087 l2cap_chan_unlock(chan); 6088 continue; 6089 } 6090 6091 dcid = __le16_to_cpu(rsp->dcid[i++]); 6092 cmd_len -= sizeof(u16); 6093 6094 BT_DBG("dcid[%d] 0x%4.4x", i, dcid); 6095 6096 /* Check if dcid is already in use */ 6097 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) { 6098 /* If a device receives a 6099 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an 6100 * already-assigned Destination CID, then both the 6101 * original channel and the new channel shall be 6102 * immediately discarded and not used. 6103 */ 6104 l2cap_chan_del(chan, ECONNREFUSED); 6105 l2cap_chan_unlock(chan); 6106 chan = __l2cap_get_chan_by_dcid(conn, dcid); 6107 l2cap_chan_lock(chan); 6108 l2cap_chan_del(chan, ECONNRESET); 6109 l2cap_chan_unlock(chan); 6110 continue; 6111 } 6112 6113 switch (result) { 6114 case L2CAP_CR_LE_AUTHENTICATION: 6115 case L2CAP_CR_LE_ENCRYPTION: 6116 /* If we already have MITM protection we can't do 6117 * anything. 6118 */ 6119 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 6120 l2cap_chan_del(chan, ECONNREFUSED); 6121 break; 6122 } 6123 6124 sec_level = hcon->sec_level + 1; 6125 if (chan->sec_level < sec_level) 6126 chan->sec_level = sec_level; 6127 6128 /* We'll need to send a new Connect Request */ 6129 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags); 6130 6131 smp_conn_security(hcon, chan->sec_level); 6132 break; 6133 6134 case L2CAP_CR_LE_BAD_PSM: 6135 l2cap_chan_del(chan, ECONNREFUSED); 6136 break; 6137 6138 default: 6139 /* If dcid was not set it means channels was refused */ 6140 if (!dcid) { 6141 l2cap_chan_del(chan, ECONNREFUSED); 6142 break; 6143 } 6144 6145 chan->ident = 0; 6146 chan->dcid = dcid; 6147 chan->omtu = mtu; 6148 chan->remote_mps = mps; 6149 chan->tx_credits = credits; 6150 l2cap_chan_ready(chan); 6151 break; 6152 } 6153 6154 l2cap_chan_unlock(chan); 6155 } 6156 6157 mutex_unlock(&conn->chan_lock); 6158 6159 return err; 6160 } 6161 6162 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn, 6163 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6164 u8 *data) 6165 { 6166 struct l2cap_ecred_reconf_req *req = (void *) data; 6167 struct l2cap_ecred_reconf_rsp rsp; 6168 u16 mtu, mps, result; 6169 struct l2cap_chan *chan; 6170 int i, num_scid; 6171 6172 if (!enable_ecred) 6173 return -EINVAL; 6174 6175 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) { 6176 result = L2CAP_CR_LE_INVALID_PARAMS; 6177 goto respond; 6178 } 6179 6180 mtu = __le16_to_cpu(req->mtu); 6181 mps = __le16_to_cpu(req->mps); 6182 6183 BT_DBG("mtu %u mps %u", mtu, mps); 6184 6185 if (mtu < L2CAP_ECRED_MIN_MTU) { 6186 result = L2CAP_RECONF_INVALID_MTU; 6187 goto respond; 6188 } 6189 6190 if (mps < L2CAP_ECRED_MIN_MPS) { 6191 result = L2CAP_RECONF_INVALID_MPS; 6192 goto respond; 6193 } 6194 6195 cmd_len -= sizeof(*req); 6196 num_scid = cmd_len / sizeof(u16); 6197 result = L2CAP_RECONF_SUCCESS; 6198 6199 for (i = 0; i < num_scid; i++) { 6200 u16 scid; 6201 6202 scid = __le16_to_cpu(req->scid[i]); 6203 if (!scid) 6204 return -EPROTO; 6205 6206 chan = __l2cap_get_chan_by_dcid(conn, scid); 6207 if (!chan) 6208 continue; 6209 6210 /* If the MTU value is decreased for any of the included 6211 * channels, then the receiver shall disconnect all 6212 * included channels. 6213 */ 6214 if (chan->omtu > mtu) { 6215 BT_ERR("chan %p decreased MTU %u -> %u", chan, 6216 chan->omtu, mtu); 6217 result = L2CAP_RECONF_INVALID_MTU; 6218 } 6219 6220 chan->omtu = mtu; 6221 chan->remote_mps = mps; 6222 } 6223 6224 respond: 6225 rsp.result = cpu_to_le16(result); 6226 6227 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp), 6228 &rsp); 6229 6230 return 0; 6231 } 6232 6233 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 6234 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6235 u8 *data) 6236 { 6237 struct l2cap_chan *chan; 6238 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 6239 u16 result; 6240 6241 if (cmd_len < sizeof(*rsp)) 6242 return -EPROTO; 6243 6244 result = __le16_to_cpu(rsp->result); 6245 6246 BT_DBG("result 0x%4.4x", rsp->result); 6247 6248 if (!result) 6249 return 0; 6250 6251 list_for_each_entry(chan, &conn->chan_l, list) { 6252 if (chan->ident != cmd->ident) 6253 continue; 6254 6255 l2cap_chan_del(chan, ECONNRESET); 6256 } 6257 6258 return 0; 6259 } 6260 6261 static inline int l2cap_le_command_rej(struct l2cap_conn *conn, 6262 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6263 u8 *data) 6264 { 6265 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 6266 struct l2cap_chan *chan; 6267 6268 if (cmd_len < sizeof(*rej)) 6269 return -EPROTO; 6270 6271 mutex_lock(&conn->chan_lock); 6272 6273 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 6274 if (!chan) 6275 goto done; 6276 6277 l2cap_chan_lock(chan); 6278 l2cap_chan_del(chan, ECONNREFUSED); 6279 l2cap_chan_unlock(chan); 6280 6281 done: 6282 mutex_unlock(&conn->chan_lock); 6283 return 0; 6284 } 6285 6286 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 6287 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 6288 u8 *data) 6289 { 6290 int err = 0; 6291 6292 switch (cmd->code) { 6293 case L2CAP_COMMAND_REJ: 6294 l2cap_le_command_rej(conn, cmd, cmd_len, data); 6295 break; 6296 6297 case L2CAP_CONN_PARAM_UPDATE_REQ: 6298 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data); 6299 break; 6300 6301 case L2CAP_CONN_PARAM_UPDATE_RSP: 6302 break; 6303 6304 case L2CAP_LE_CONN_RSP: 6305 l2cap_le_connect_rsp(conn, cmd, cmd_len, data); 6306 break; 6307 6308 case L2CAP_LE_CONN_REQ: 6309 err = l2cap_le_connect_req(conn, cmd, cmd_len, data); 6310 break; 6311 6312 case L2CAP_LE_CREDITS: 6313 err = l2cap_le_credits(conn, cmd, cmd_len, data); 6314 break; 6315 6316 case L2CAP_ECRED_CONN_REQ: 6317 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data); 6318 break; 6319 6320 case L2CAP_ECRED_CONN_RSP: 6321 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data); 6322 break; 6323 6324 case L2CAP_ECRED_RECONF_REQ: 6325 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data); 6326 break; 6327 6328 case L2CAP_ECRED_RECONF_RSP: 6329 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data); 6330 break; 6331 6332 case L2CAP_DISCONN_REQ: 6333 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 6334 break; 6335 6336 case L2CAP_DISCONN_RSP: 6337 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 6338 break; 6339 6340 default: 6341 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 6342 err = -EINVAL; 6343 break; 6344 } 6345 6346 return err; 6347 } 6348 6349 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 6350 struct sk_buff *skb) 6351 { 6352 struct hci_conn *hcon = conn->hcon; 6353 struct l2cap_cmd_hdr *cmd; 6354 u16 len; 6355 int err; 6356 6357 if (hcon->type != LE_LINK) 6358 goto drop; 6359 6360 if (skb->len < L2CAP_CMD_HDR_SIZE) 6361 goto drop; 6362 6363 cmd = (void *) skb->data; 6364 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 6365 6366 len = le16_to_cpu(cmd->len); 6367 6368 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident); 6369 6370 if (len != skb->len || !cmd->ident) { 6371 BT_DBG("corrupted command"); 6372 goto drop; 6373 } 6374 6375 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data); 6376 if (err) { 6377 struct l2cap_cmd_rej_unk rej; 6378 6379 BT_ERR("Wrong link type (%d)", err); 6380 6381 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 6382 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 6383 sizeof(rej), &rej); 6384 } 6385 6386 drop: 6387 kfree_skb(skb); 6388 } 6389 6390 static inline void l2cap_sig_channel(struct l2cap_conn *conn, 6391 struct sk_buff *skb) 6392 { 6393 struct hci_conn *hcon = conn->hcon; 6394 struct l2cap_cmd_hdr *cmd; 6395 int err; 6396 6397 l2cap_raw_recv(conn, skb); 6398 6399 if (hcon->type != ACL_LINK) 6400 goto drop; 6401 6402 while (skb->len >= L2CAP_CMD_HDR_SIZE) { 6403 u16 len; 6404 6405 cmd = (void *) skb->data; 6406 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 6407 6408 len = le16_to_cpu(cmd->len); 6409 6410 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, 6411 cmd->ident); 6412 6413 if (len > skb->len || !cmd->ident) { 6414 BT_DBG("corrupted command"); 6415 break; 6416 } 6417 6418 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); 6419 if (err) { 6420 struct l2cap_cmd_rej_unk rej; 6421 6422 BT_ERR("Wrong link type (%d)", err); 6423 6424 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 6425 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 6426 sizeof(rej), &rej); 6427 } 6428 6429 skb_pull(skb, len); 6430 } 6431 6432 drop: 6433 kfree_skb(skb); 6434 } 6435 6436 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 6437 { 6438 u16 our_fcs, rcv_fcs; 6439 int hdr_size; 6440 6441 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 6442 hdr_size = L2CAP_EXT_HDR_SIZE; 6443 else 6444 hdr_size = L2CAP_ENH_HDR_SIZE; 6445 6446 if (chan->fcs == L2CAP_FCS_CRC16) { 6447 skb_trim(skb, skb->len - L2CAP_FCS_SIZE); 6448 rcv_fcs = get_unaligned_le16(skb->data + skb->len); 6449 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 6450 6451 if (our_fcs != rcv_fcs) 6452 return -EBADMSG; 6453 } 6454 return 0; 6455 } 6456 6457 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 6458 { 6459 struct l2cap_ctrl control; 6460 6461 BT_DBG("chan %p", chan); 6462 6463 memset(&control, 0, sizeof(control)); 6464 control.sframe = 1; 6465 control.final = 1; 6466 control.reqseq = chan->buffer_seq; 6467 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6468 6469 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6470 control.super = L2CAP_SUPER_RNR; 6471 l2cap_send_sframe(chan, &control); 6472 } 6473 6474 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 6475 chan->unacked_frames > 0) 6476 __set_retrans_timer(chan); 6477 6478 /* Send pending iframes */ 6479 l2cap_ertm_send(chan); 6480 6481 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 6482 test_bit(CONN_SEND_FBIT, &chan->conn_state)) { 6483 /* F-bit wasn't sent in an s-frame or i-frame yet, so 6484 * send it now. 6485 */ 6486 control.super = L2CAP_SUPER_RR; 6487 l2cap_send_sframe(chan, &control); 6488 } 6489 } 6490 6491 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag, 6492 struct sk_buff **last_frag) 6493 { 6494 /* skb->len reflects data in skb as well as all fragments 6495 * skb->data_len reflects only data in fragments 6496 */ 6497 if (!skb_has_frag_list(skb)) 6498 skb_shinfo(skb)->frag_list = new_frag; 6499 6500 new_frag->next = NULL; 6501 6502 (*last_frag)->next = new_frag; 6503 *last_frag = new_frag; 6504 6505 skb->len += new_frag->len; 6506 skb->data_len += new_frag->len; 6507 skb->truesize += new_frag->truesize; 6508 } 6509 6510 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, 6511 struct l2cap_ctrl *control) 6512 { 6513 int err = -EINVAL; 6514 6515 switch (control->sar) { 6516 case L2CAP_SAR_UNSEGMENTED: 6517 if (chan->sdu) 6518 break; 6519 6520 err = chan->ops->recv(chan, skb); 6521 break; 6522 6523 case L2CAP_SAR_START: 6524 if (chan->sdu) 6525 break; 6526 6527 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) 6528 break; 6529 6530 chan->sdu_len = get_unaligned_le16(skb->data); 6531 skb_pull(skb, L2CAP_SDULEN_SIZE); 6532 6533 if (chan->sdu_len > chan->imtu) { 6534 err = -EMSGSIZE; 6535 break; 6536 } 6537 6538 if (skb->len >= chan->sdu_len) 6539 break; 6540 6541 chan->sdu = skb; 6542 chan->sdu_last_frag = skb; 6543 6544 skb = NULL; 6545 err = 0; 6546 break; 6547 6548 case L2CAP_SAR_CONTINUE: 6549 if (!chan->sdu) 6550 break; 6551 6552 append_skb_frag(chan->sdu, skb, 6553 &chan->sdu_last_frag); 6554 skb = NULL; 6555 6556 if (chan->sdu->len >= chan->sdu_len) 6557 break; 6558 6559 err = 0; 6560 break; 6561 6562 case L2CAP_SAR_END: 6563 if (!chan->sdu) 6564 break; 6565 6566 append_skb_frag(chan->sdu, skb, 6567 &chan->sdu_last_frag); 6568 skb = NULL; 6569 6570 if (chan->sdu->len != chan->sdu_len) 6571 break; 6572 6573 err = chan->ops->recv(chan, chan->sdu); 6574 6575 if (!err) { 6576 /* Reassembly complete */ 6577 chan->sdu = NULL; 6578 chan->sdu_last_frag = NULL; 6579 chan->sdu_len = 0; 6580 } 6581 break; 6582 } 6583 6584 if (err) { 6585 kfree_skb(skb); 6586 kfree_skb(chan->sdu); 6587 chan->sdu = NULL; 6588 chan->sdu_last_frag = NULL; 6589 chan->sdu_len = 0; 6590 } 6591 6592 return err; 6593 } 6594 6595 static int l2cap_resegment(struct l2cap_chan *chan) 6596 { 6597 /* Placeholder */ 6598 return 0; 6599 } 6600 6601 void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 6602 { 6603 u8 event; 6604 6605 if (chan->mode != L2CAP_MODE_ERTM) 6606 return; 6607 6608 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR; 6609 l2cap_tx(chan, NULL, NULL, event); 6610 } 6611 6612 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan) 6613 { 6614 int err = 0; 6615 /* Pass sequential frames to l2cap_reassemble_sdu() 6616 * until a gap is encountered. 6617 */ 6618 6619 BT_DBG("chan %p", chan); 6620 6621 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6622 struct sk_buff *skb; 6623 BT_DBG("Searching for skb with txseq %d (queue len %d)", 6624 chan->buffer_seq, skb_queue_len(&chan->srej_q)); 6625 6626 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq); 6627 6628 if (!skb) 6629 break; 6630 6631 skb_unlink(skb, &chan->srej_q); 6632 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6633 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap); 6634 if (err) 6635 break; 6636 } 6637 6638 if (skb_queue_empty(&chan->srej_q)) { 6639 chan->rx_state = L2CAP_RX_STATE_RECV; 6640 l2cap_send_ack(chan); 6641 } 6642 6643 return err; 6644 } 6645 6646 static void l2cap_handle_srej(struct l2cap_chan *chan, 6647 struct l2cap_ctrl *control) 6648 { 6649 struct sk_buff *skb; 6650 6651 BT_DBG("chan %p, control %p", chan, control); 6652 6653 if (control->reqseq == chan->next_tx_seq) { 6654 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6655 l2cap_send_disconn_req(chan, ECONNRESET); 6656 return; 6657 } 6658 6659 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6660 6661 if (skb == NULL) { 6662 BT_DBG("Seq %d not available for retransmission", 6663 control->reqseq); 6664 return; 6665 } 6666 6667 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6668 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6669 l2cap_send_disconn_req(chan, ECONNRESET); 6670 return; 6671 } 6672 6673 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6674 6675 if (control->poll) { 6676 l2cap_pass_to_tx(chan, control); 6677 6678 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6679 l2cap_retransmit(chan, control); 6680 l2cap_ertm_send(chan); 6681 6682 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6683 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6684 chan->srej_save_reqseq = control->reqseq; 6685 } 6686 } else { 6687 l2cap_pass_to_tx_fbit(chan, control); 6688 6689 if (control->final) { 6690 if (chan->srej_save_reqseq != control->reqseq || 6691 !test_and_clear_bit(CONN_SREJ_ACT, 6692 &chan->conn_state)) 6693 l2cap_retransmit(chan, control); 6694 } else { 6695 l2cap_retransmit(chan, control); 6696 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 6697 set_bit(CONN_SREJ_ACT, &chan->conn_state); 6698 chan->srej_save_reqseq = control->reqseq; 6699 } 6700 } 6701 } 6702 } 6703 6704 static void l2cap_handle_rej(struct l2cap_chan *chan, 6705 struct l2cap_ctrl *control) 6706 { 6707 struct sk_buff *skb; 6708 6709 BT_DBG("chan %p, control %p", chan, control); 6710 6711 if (control->reqseq == chan->next_tx_seq) { 6712 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 6713 l2cap_send_disconn_req(chan, ECONNRESET); 6714 return; 6715 } 6716 6717 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 6718 6719 if (chan->max_tx && skb && 6720 bt_cb(skb)->l2cap.retries >= chan->max_tx) { 6721 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 6722 l2cap_send_disconn_req(chan, ECONNRESET); 6723 return; 6724 } 6725 6726 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6727 6728 l2cap_pass_to_tx(chan, control); 6729 6730 if (control->final) { 6731 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 6732 l2cap_retransmit_all(chan, control); 6733 } else { 6734 l2cap_retransmit_all(chan, control); 6735 l2cap_ertm_send(chan); 6736 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) 6737 set_bit(CONN_REJ_ACT, &chan->conn_state); 6738 } 6739 } 6740 6741 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq) 6742 { 6743 BT_DBG("chan %p, txseq %d", chan, txseq); 6744 6745 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq, 6746 chan->expected_tx_seq); 6747 6748 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 6749 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6750 chan->tx_win) { 6751 /* See notes below regarding "double poll" and 6752 * invalid packets. 6753 */ 6754 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6755 BT_DBG("Invalid/Ignore - after SREJ"); 6756 return L2CAP_TXSEQ_INVALID_IGNORE; 6757 } else { 6758 BT_DBG("Invalid - in window after SREJ sent"); 6759 return L2CAP_TXSEQ_INVALID; 6760 } 6761 } 6762 6763 if (chan->srej_list.head == txseq) { 6764 BT_DBG("Expected SREJ"); 6765 return L2CAP_TXSEQ_EXPECTED_SREJ; 6766 } 6767 6768 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) { 6769 BT_DBG("Duplicate SREJ - txseq already stored"); 6770 return L2CAP_TXSEQ_DUPLICATE_SREJ; 6771 } 6772 6773 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) { 6774 BT_DBG("Unexpected SREJ - not requested"); 6775 return L2CAP_TXSEQ_UNEXPECTED_SREJ; 6776 } 6777 } 6778 6779 if (chan->expected_tx_seq == txseq) { 6780 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 6781 chan->tx_win) { 6782 BT_DBG("Invalid - txseq outside tx window"); 6783 return L2CAP_TXSEQ_INVALID; 6784 } else { 6785 BT_DBG("Expected"); 6786 return L2CAP_TXSEQ_EXPECTED; 6787 } 6788 } 6789 6790 if (__seq_offset(chan, txseq, chan->last_acked_seq) < 6791 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) { 6792 BT_DBG("Duplicate - expected_tx_seq later than txseq"); 6793 return L2CAP_TXSEQ_DUPLICATE; 6794 } 6795 6796 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) { 6797 /* A source of invalid packets is a "double poll" condition, 6798 * where delays cause us to send multiple poll packets. If 6799 * the remote stack receives and processes both polls, 6800 * sequence numbers can wrap around in such a way that a 6801 * resent frame has a sequence number that looks like new data 6802 * with a sequence gap. This would trigger an erroneous SREJ 6803 * request. 6804 * 6805 * Fortunately, this is impossible with a tx window that's 6806 * less than half of the maximum sequence number, which allows 6807 * invalid frames to be safely ignored. 6808 * 6809 * With tx window sizes greater than half of the tx window 6810 * maximum, the frame is invalid and cannot be ignored. This 6811 * causes a disconnect. 6812 */ 6813 6814 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 6815 BT_DBG("Invalid/Ignore - txseq outside tx window"); 6816 return L2CAP_TXSEQ_INVALID_IGNORE; 6817 } else { 6818 BT_DBG("Invalid - txseq outside tx window"); 6819 return L2CAP_TXSEQ_INVALID; 6820 } 6821 } else { 6822 BT_DBG("Unexpected - txseq indicates missing frames"); 6823 return L2CAP_TXSEQ_UNEXPECTED; 6824 } 6825 } 6826 6827 static int l2cap_rx_state_recv(struct l2cap_chan *chan, 6828 struct l2cap_ctrl *control, 6829 struct sk_buff *skb, u8 event) 6830 { 6831 int err = 0; 6832 bool skb_in_use = false; 6833 6834 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6835 event); 6836 6837 switch (event) { 6838 case L2CAP_EV_RECV_IFRAME: 6839 switch (l2cap_classify_txseq(chan, control->txseq)) { 6840 case L2CAP_TXSEQ_EXPECTED: 6841 l2cap_pass_to_tx(chan, control); 6842 6843 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6844 BT_DBG("Busy, discarding expected seq %d", 6845 control->txseq); 6846 break; 6847 } 6848 6849 chan->expected_tx_seq = __next_seq(chan, 6850 control->txseq); 6851 6852 chan->buffer_seq = chan->expected_tx_seq; 6853 skb_in_use = true; 6854 6855 err = l2cap_reassemble_sdu(chan, skb, control); 6856 if (err) 6857 break; 6858 6859 if (control->final) { 6860 if (!test_and_clear_bit(CONN_REJ_ACT, 6861 &chan->conn_state)) { 6862 control->final = 0; 6863 l2cap_retransmit_all(chan, control); 6864 l2cap_ertm_send(chan); 6865 } 6866 } 6867 6868 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 6869 l2cap_send_ack(chan); 6870 break; 6871 case L2CAP_TXSEQ_UNEXPECTED: 6872 l2cap_pass_to_tx(chan, control); 6873 6874 /* Can't issue SREJ frames in the local busy state. 6875 * Drop this frame, it will be seen as missing 6876 * when local busy is exited. 6877 */ 6878 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6879 BT_DBG("Busy, discarding unexpected seq %d", 6880 control->txseq); 6881 break; 6882 } 6883 6884 /* There was a gap in the sequence, so an SREJ 6885 * must be sent for each missing frame. The 6886 * current frame is stored for later use. 6887 */ 6888 skb_queue_tail(&chan->srej_q, skb); 6889 skb_in_use = true; 6890 BT_DBG("Queued %p (queue len %d)", skb, 6891 skb_queue_len(&chan->srej_q)); 6892 6893 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 6894 l2cap_seq_list_clear(&chan->srej_list); 6895 l2cap_send_srej(chan, control->txseq); 6896 6897 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT; 6898 break; 6899 case L2CAP_TXSEQ_DUPLICATE: 6900 l2cap_pass_to_tx(chan, control); 6901 break; 6902 case L2CAP_TXSEQ_INVALID_IGNORE: 6903 break; 6904 case L2CAP_TXSEQ_INVALID: 6905 default: 6906 l2cap_send_disconn_req(chan, ECONNRESET); 6907 break; 6908 } 6909 break; 6910 case L2CAP_EV_RECV_RR: 6911 l2cap_pass_to_tx(chan, control); 6912 if (control->final) { 6913 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6914 6915 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) && 6916 !__chan_is_moving(chan)) { 6917 control->final = 0; 6918 l2cap_retransmit_all(chan, control); 6919 } 6920 6921 l2cap_ertm_send(chan); 6922 } else if (control->poll) { 6923 l2cap_send_i_or_rr_or_rnr(chan); 6924 } else { 6925 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6926 &chan->conn_state) && 6927 chan->unacked_frames) 6928 __set_retrans_timer(chan); 6929 6930 l2cap_ertm_send(chan); 6931 } 6932 break; 6933 case L2CAP_EV_RECV_RNR: 6934 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6935 l2cap_pass_to_tx(chan, control); 6936 if (control && control->poll) { 6937 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6938 l2cap_send_rr_or_rnr(chan, 0); 6939 } 6940 __clear_retrans_timer(chan); 6941 l2cap_seq_list_clear(&chan->retrans_list); 6942 break; 6943 case L2CAP_EV_RECV_REJ: 6944 l2cap_handle_rej(chan, control); 6945 break; 6946 case L2CAP_EV_RECV_SREJ: 6947 l2cap_handle_srej(chan, control); 6948 break; 6949 default: 6950 break; 6951 } 6952 6953 if (skb && !skb_in_use) { 6954 BT_DBG("Freeing %p", skb); 6955 kfree_skb(skb); 6956 } 6957 6958 return err; 6959 } 6960 6961 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan, 6962 struct l2cap_ctrl *control, 6963 struct sk_buff *skb, u8 event) 6964 { 6965 int err = 0; 6966 u16 txseq = control->txseq; 6967 bool skb_in_use = false; 6968 6969 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6970 event); 6971 6972 switch (event) { 6973 case L2CAP_EV_RECV_IFRAME: 6974 switch (l2cap_classify_txseq(chan, txseq)) { 6975 case L2CAP_TXSEQ_EXPECTED: 6976 /* Keep frame for reassembly later */ 6977 l2cap_pass_to_tx(chan, control); 6978 skb_queue_tail(&chan->srej_q, skb); 6979 skb_in_use = true; 6980 BT_DBG("Queued %p (queue len %d)", skb, 6981 skb_queue_len(&chan->srej_q)); 6982 6983 chan->expected_tx_seq = __next_seq(chan, txseq); 6984 break; 6985 case L2CAP_TXSEQ_EXPECTED_SREJ: 6986 l2cap_seq_list_pop(&chan->srej_list); 6987 6988 l2cap_pass_to_tx(chan, control); 6989 skb_queue_tail(&chan->srej_q, skb); 6990 skb_in_use = true; 6991 BT_DBG("Queued %p (queue len %d)", skb, 6992 skb_queue_len(&chan->srej_q)); 6993 6994 err = l2cap_rx_queued_iframes(chan); 6995 if (err) 6996 break; 6997 6998 break; 6999 case L2CAP_TXSEQ_UNEXPECTED: 7000 /* Got a frame that can't be reassembled yet. 7001 * Save it for later, and send SREJs to cover 7002 * the missing frames. 7003 */ 7004 skb_queue_tail(&chan->srej_q, skb); 7005 skb_in_use = true; 7006 BT_DBG("Queued %p (queue len %d)", skb, 7007 skb_queue_len(&chan->srej_q)); 7008 7009 l2cap_pass_to_tx(chan, control); 7010 l2cap_send_srej(chan, control->txseq); 7011 break; 7012 case L2CAP_TXSEQ_UNEXPECTED_SREJ: 7013 /* This frame was requested with an SREJ, but 7014 * some expected retransmitted frames are 7015 * missing. Request retransmission of missing 7016 * SREJ'd frames. 7017 */ 7018 skb_queue_tail(&chan->srej_q, skb); 7019 skb_in_use = true; 7020 BT_DBG("Queued %p (queue len %d)", skb, 7021 skb_queue_len(&chan->srej_q)); 7022 7023 l2cap_pass_to_tx(chan, control); 7024 l2cap_send_srej_list(chan, control->txseq); 7025 break; 7026 case L2CAP_TXSEQ_DUPLICATE_SREJ: 7027 /* We've already queued this frame. Drop this copy. */ 7028 l2cap_pass_to_tx(chan, control); 7029 break; 7030 case L2CAP_TXSEQ_DUPLICATE: 7031 /* Expecting a later sequence number, so this frame 7032 * was already received. Ignore it completely. 7033 */ 7034 break; 7035 case L2CAP_TXSEQ_INVALID_IGNORE: 7036 break; 7037 case L2CAP_TXSEQ_INVALID: 7038 default: 7039 l2cap_send_disconn_req(chan, ECONNRESET); 7040 break; 7041 } 7042 break; 7043 case L2CAP_EV_RECV_RR: 7044 l2cap_pass_to_tx(chan, control); 7045 if (control->final) { 7046 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7047 7048 if (!test_and_clear_bit(CONN_REJ_ACT, 7049 &chan->conn_state)) { 7050 control->final = 0; 7051 l2cap_retransmit_all(chan, control); 7052 } 7053 7054 l2cap_ertm_send(chan); 7055 } else if (control->poll) { 7056 if (test_and_clear_bit(CONN_REMOTE_BUSY, 7057 &chan->conn_state) && 7058 chan->unacked_frames) { 7059 __set_retrans_timer(chan); 7060 } 7061 7062 set_bit(CONN_SEND_FBIT, &chan->conn_state); 7063 l2cap_send_srej_tail(chan); 7064 } else { 7065 if (test_and_clear_bit(CONN_REMOTE_BUSY, 7066 &chan->conn_state) && 7067 chan->unacked_frames) 7068 __set_retrans_timer(chan); 7069 7070 l2cap_send_ack(chan); 7071 } 7072 break; 7073 case L2CAP_EV_RECV_RNR: 7074 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7075 l2cap_pass_to_tx(chan, control); 7076 if (control->poll) { 7077 l2cap_send_srej_tail(chan); 7078 } else { 7079 struct l2cap_ctrl rr_control; 7080 memset(&rr_control, 0, sizeof(rr_control)); 7081 rr_control.sframe = 1; 7082 rr_control.super = L2CAP_SUPER_RR; 7083 rr_control.reqseq = chan->buffer_seq; 7084 l2cap_send_sframe(chan, &rr_control); 7085 } 7086 7087 break; 7088 case L2CAP_EV_RECV_REJ: 7089 l2cap_handle_rej(chan, control); 7090 break; 7091 case L2CAP_EV_RECV_SREJ: 7092 l2cap_handle_srej(chan, control); 7093 break; 7094 } 7095 7096 if (skb && !skb_in_use) { 7097 BT_DBG("Freeing %p", skb); 7098 kfree_skb(skb); 7099 } 7100 7101 return err; 7102 } 7103 7104 static int l2cap_finish_move(struct l2cap_chan *chan) 7105 { 7106 BT_DBG("chan %p", chan); 7107 7108 chan->rx_state = L2CAP_RX_STATE_RECV; 7109 7110 if (chan->hs_hcon) 7111 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; 7112 else 7113 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; 7114 7115 return l2cap_resegment(chan); 7116 } 7117 7118 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan, 7119 struct l2cap_ctrl *control, 7120 struct sk_buff *skb, u8 event) 7121 { 7122 int err; 7123 7124 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 7125 event); 7126 7127 if (!control->poll) 7128 return -EPROTO; 7129 7130 l2cap_process_reqseq(chan, control->reqseq); 7131 7132 if (!skb_queue_empty(&chan->tx_q)) 7133 chan->tx_send_head = skb_peek(&chan->tx_q); 7134 else 7135 chan->tx_send_head = NULL; 7136 7137 /* Rewind next_tx_seq to the point expected 7138 * by the receiver. 7139 */ 7140 chan->next_tx_seq = control->reqseq; 7141 chan->unacked_frames = 0; 7142 7143 err = l2cap_finish_move(chan); 7144 if (err) 7145 return err; 7146 7147 set_bit(CONN_SEND_FBIT, &chan->conn_state); 7148 l2cap_send_i_or_rr_or_rnr(chan); 7149 7150 if (event == L2CAP_EV_RECV_IFRAME) 7151 return -EPROTO; 7152 7153 return l2cap_rx_state_recv(chan, control, NULL, event); 7154 } 7155 7156 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, 7157 struct l2cap_ctrl *control, 7158 struct sk_buff *skb, u8 event) 7159 { 7160 int err; 7161 7162 if (!control->final) 7163 return -EPROTO; 7164 7165 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 7166 7167 chan->rx_state = L2CAP_RX_STATE_RECV; 7168 l2cap_process_reqseq(chan, control->reqseq); 7169 7170 if (!skb_queue_empty(&chan->tx_q)) 7171 chan->tx_send_head = skb_peek(&chan->tx_q); 7172 else 7173 chan->tx_send_head = NULL; 7174 7175 /* Rewind next_tx_seq to the point expected 7176 * by the receiver. 7177 */ 7178 chan->next_tx_seq = control->reqseq; 7179 chan->unacked_frames = 0; 7180 7181 if (chan->hs_hcon) 7182 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu; 7183 else 7184 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu; 7185 7186 err = l2cap_resegment(chan); 7187 7188 if (!err) 7189 err = l2cap_rx_state_recv(chan, control, skb, event); 7190 7191 return err; 7192 } 7193 7194 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq) 7195 { 7196 /* Make sure reqseq is for a packet that has been sent but not acked */ 7197 u16 unacked; 7198 7199 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq); 7200 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked; 7201 } 7202 7203 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 7204 struct sk_buff *skb, u8 event) 7205 { 7206 int err = 0; 7207 7208 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan, 7209 control, skb, event, chan->rx_state); 7210 7211 if (__valid_reqseq(chan, control->reqseq)) { 7212 switch (chan->rx_state) { 7213 case L2CAP_RX_STATE_RECV: 7214 err = l2cap_rx_state_recv(chan, control, skb, event); 7215 break; 7216 case L2CAP_RX_STATE_SREJ_SENT: 7217 err = l2cap_rx_state_srej_sent(chan, control, skb, 7218 event); 7219 break; 7220 case L2CAP_RX_STATE_WAIT_P: 7221 err = l2cap_rx_state_wait_p(chan, control, skb, event); 7222 break; 7223 case L2CAP_RX_STATE_WAIT_F: 7224 err = l2cap_rx_state_wait_f(chan, control, skb, event); 7225 break; 7226 default: 7227 /* shut it down */ 7228 break; 7229 } 7230 } else { 7231 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d", 7232 control->reqseq, chan->next_tx_seq, 7233 chan->expected_ack_seq); 7234 l2cap_send_disconn_req(chan, ECONNRESET); 7235 } 7236 7237 return err; 7238 } 7239 7240 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 7241 struct sk_buff *skb) 7242 { 7243 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, 7244 chan->rx_state); 7245 7246 if (l2cap_classify_txseq(chan, control->txseq) == 7247 L2CAP_TXSEQ_EXPECTED) { 7248 l2cap_pass_to_tx(chan, control); 7249 7250 BT_DBG("buffer_seq %d->%d", chan->buffer_seq, 7251 __next_seq(chan, chan->buffer_seq)); 7252 7253 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 7254 7255 l2cap_reassemble_sdu(chan, skb, control); 7256 } else { 7257 if (chan->sdu) { 7258 kfree_skb(chan->sdu); 7259 chan->sdu = NULL; 7260 } 7261 chan->sdu_last_frag = NULL; 7262 chan->sdu_len = 0; 7263 7264 if (skb) { 7265 BT_DBG("Freeing %p", skb); 7266 kfree_skb(skb); 7267 } 7268 } 7269 7270 chan->last_acked_seq = control->txseq; 7271 chan->expected_tx_seq = __next_seq(chan, control->txseq); 7272 7273 return 0; 7274 } 7275 7276 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 7277 { 7278 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap; 7279 u16 len; 7280 u8 event; 7281 7282 __unpack_control(chan, skb); 7283 7284 len = skb->len; 7285 7286 /* 7287 * We can just drop the corrupted I-frame here. 7288 * Receiver will miss it and start proper recovery 7289 * procedures and ask for retransmission. 7290 */ 7291 if (l2cap_check_fcs(chan, skb)) 7292 goto drop; 7293 7294 if (!control->sframe && control->sar == L2CAP_SAR_START) 7295 len -= L2CAP_SDULEN_SIZE; 7296 7297 if (chan->fcs == L2CAP_FCS_CRC16) 7298 len -= L2CAP_FCS_SIZE; 7299 7300 if (len > chan->mps) { 7301 l2cap_send_disconn_req(chan, ECONNRESET); 7302 goto drop; 7303 } 7304 7305 if ((chan->mode == L2CAP_MODE_ERTM || 7306 chan->mode == L2CAP_MODE_STREAMING) && sk_filter(chan->data, skb)) 7307 goto drop; 7308 7309 if (!control->sframe) { 7310 int err; 7311 7312 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d", 7313 control->sar, control->reqseq, control->final, 7314 control->txseq); 7315 7316 /* Validate F-bit - F=0 always valid, F=1 only 7317 * valid in TX WAIT_F 7318 */ 7319 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F) 7320 goto drop; 7321 7322 if (chan->mode != L2CAP_MODE_STREAMING) { 7323 event = L2CAP_EV_RECV_IFRAME; 7324 err = l2cap_rx(chan, control, skb, event); 7325 } else { 7326 err = l2cap_stream_rx(chan, control, skb); 7327 } 7328 7329 if (err) 7330 l2cap_send_disconn_req(chan, ECONNRESET); 7331 } else { 7332 const u8 rx_func_to_event[4] = { 7333 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ, 7334 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ 7335 }; 7336 7337 /* Only I-frames are expected in streaming mode */ 7338 if (chan->mode == L2CAP_MODE_STREAMING) 7339 goto drop; 7340 7341 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d", 7342 control->reqseq, control->final, control->poll, 7343 control->super); 7344 7345 if (len != 0) { 7346 BT_ERR("Trailing bytes: %d in sframe", len); 7347 l2cap_send_disconn_req(chan, ECONNRESET); 7348 goto drop; 7349 } 7350 7351 /* Validate F and P bits */ 7352 if (control->final && (control->poll || 7353 chan->tx_state != L2CAP_TX_STATE_WAIT_F)) 7354 goto drop; 7355 7356 event = rx_func_to_event[control->super]; 7357 if (l2cap_rx(chan, control, skb, event)) 7358 l2cap_send_disconn_req(chan, ECONNRESET); 7359 } 7360 7361 return 0; 7362 7363 drop: 7364 kfree_skb(skb); 7365 return 0; 7366 } 7367 7368 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) 7369 { 7370 struct l2cap_conn *conn = chan->conn; 7371 struct l2cap_le_credits pkt; 7372 u16 return_credits; 7373 7374 return_credits = (chan->imtu / chan->mps) + 1; 7375 7376 if (chan->rx_credits >= return_credits) 7377 return; 7378 7379 return_credits -= chan->rx_credits; 7380 7381 BT_DBG("chan %p returning %u credits to sender", chan, return_credits); 7382 7383 chan->rx_credits += return_credits; 7384 7385 pkt.cid = cpu_to_le16(chan->scid); 7386 pkt.credits = cpu_to_le16(return_credits); 7387 7388 chan->ident = l2cap_get_ident(conn); 7389 7390 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); 7391 } 7392 7393 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) 7394 { 7395 int err; 7396 7397 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len); 7398 7399 /* Wait recv to confirm reception before updating the credits */ 7400 err = chan->ops->recv(chan, skb); 7401 7402 /* Update credits whenever an SDU is received */ 7403 l2cap_chan_le_send_credits(chan); 7404 7405 return err; 7406 } 7407 7408 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 7409 { 7410 int err; 7411 7412 if (!chan->rx_credits) { 7413 BT_ERR("No credits to receive LE L2CAP data"); 7414 l2cap_send_disconn_req(chan, ECONNRESET); 7415 return -ENOBUFS; 7416 } 7417 7418 if (chan->imtu < skb->len) { 7419 BT_ERR("Too big LE L2CAP PDU"); 7420 return -ENOBUFS; 7421 } 7422 7423 chan->rx_credits--; 7424 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits); 7425 7426 /* Update if remote had run out of credits, this should only happens 7427 * if the remote is not using the entire MPS. 7428 */ 7429 if (!chan->rx_credits) 7430 l2cap_chan_le_send_credits(chan); 7431 7432 err = 0; 7433 7434 if (!chan->sdu) { 7435 u16 sdu_len; 7436 7437 sdu_len = get_unaligned_le16(skb->data); 7438 skb_pull(skb, L2CAP_SDULEN_SIZE); 7439 7440 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u", 7441 sdu_len, skb->len, chan->imtu); 7442 7443 if (sdu_len > chan->imtu) { 7444 BT_ERR("Too big LE L2CAP SDU length received"); 7445 err = -EMSGSIZE; 7446 goto failed; 7447 } 7448 7449 if (skb->len > sdu_len) { 7450 BT_ERR("Too much LE L2CAP data received"); 7451 err = -EINVAL; 7452 goto failed; 7453 } 7454 7455 if (skb->len == sdu_len) 7456 return l2cap_ecred_recv(chan, skb); 7457 7458 chan->sdu = skb; 7459 chan->sdu_len = sdu_len; 7460 chan->sdu_last_frag = skb; 7461 7462 /* Detect if remote is not able to use the selected MPS */ 7463 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { 7464 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; 7465 7466 /* Adjust the number of credits */ 7467 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); 7468 chan->mps = mps_len; 7469 l2cap_chan_le_send_credits(chan); 7470 } 7471 7472 return 0; 7473 } 7474 7475 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u", 7476 chan->sdu->len, skb->len, chan->sdu_len); 7477 7478 if (chan->sdu->len + skb->len > chan->sdu_len) { 7479 BT_ERR("Too much LE L2CAP data received"); 7480 err = -EINVAL; 7481 goto failed; 7482 } 7483 7484 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag); 7485 skb = NULL; 7486 7487 if (chan->sdu->len == chan->sdu_len) { 7488 err = l2cap_ecred_recv(chan, chan->sdu); 7489 if (!err) { 7490 chan->sdu = NULL; 7491 chan->sdu_last_frag = NULL; 7492 chan->sdu_len = 0; 7493 } 7494 } 7495 7496 failed: 7497 if (err) { 7498 kfree_skb(skb); 7499 kfree_skb(chan->sdu); 7500 chan->sdu = NULL; 7501 chan->sdu_last_frag = NULL; 7502 chan->sdu_len = 0; 7503 } 7504 7505 /* We can't return an error here since we took care of the skb 7506 * freeing internally. An error return would cause the caller to 7507 * do a double-free of the skb. 7508 */ 7509 return 0; 7510 } 7511 7512 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, 7513 struct sk_buff *skb) 7514 { 7515 struct l2cap_chan *chan; 7516 7517 chan = l2cap_get_chan_by_scid(conn, cid); 7518 if (!chan) { 7519 if (cid == L2CAP_CID_A2MP) { 7520 chan = a2mp_channel_create(conn, skb); 7521 if (!chan) { 7522 kfree_skb(skb); 7523 return; 7524 } 7525 7526 l2cap_chan_lock(chan); 7527 } else { 7528 BT_DBG("unknown cid 0x%4.4x", cid); 7529 /* Drop packet and return */ 7530 kfree_skb(skb); 7531 return; 7532 } 7533 } 7534 7535 BT_DBG("chan %p, len %d", chan, skb->len); 7536 7537 /* If we receive data on a fixed channel before the info req/rsp 7538 * procdure is done simply assume that the channel is supported 7539 * and mark it as ready. 7540 */ 7541 if (chan->chan_type == L2CAP_CHAN_FIXED) 7542 l2cap_chan_ready(chan); 7543 7544 if (chan->state != BT_CONNECTED) 7545 goto drop; 7546 7547 switch (chan->mode) { 7548 case L2CAP_MODE_LE_FLOWCTL: 7549 case L2CAP_MODE_EXT_FLOWCTL: 7550 if (l2cap_ecred_data_rcv(chan, skb) < 0) 7551 goto drop; 7552 7553 goto done; 7554 7555 case L2CAP_MODE_BASIC: 7556 /* If socket recv buffers overflows we drop data here 7557 * which is *bad* because L2CAP has to be reliable. 7558 * But we don't have any other choice. L2CAP doesn't 7559 * provide flow control mechanism. */ 7560 7561 if (chan->imtu < skb->len) { 7562 BT_ERR("Dropping L2CAP data: receive buffer overflow"); 7563 goto drop; 7564 } 7565 7566 if (!chan->ops->recv(chan, skb)) 7567 goto done; 7568 break; 7569 7570 case L2CAP_MODE_ERTM: 7571 case L2CAP_MODE_STREAMING: 7572 l2cap_data_rcv(chan, skb); 7573 goto done; 7574 7575 default: 7576 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 7577 break; 7578 } 7579 7580 drop: 7581 kfree_skb(skb); 7582 7583 done: 7584 l2cap_chan_unlock(chan); 7585 } 7586 7587 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, 7588 struct sk_buff *skb) 7589 { 7590 struct hci_conn *hcon = conn->hcon; 7591 struct l2cap_chan *chan; 7592 7593 if (hcon->type != ACL_LINK) 7594 goto free_skb; 7595 7596 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst, 7597 ACL_LINK); 7598 if (!chan) 7599 goto free_skb; 7600 7601 BT_DBG("chan %p, len %d", chan, skb->len); 7602 7603 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 7604 goto drop; 7605 7606 if (chan->imtu < skb->len) 7607 goto drop; 7608 7609 /* Store remote BD_ADDR and PSM for msg_name */ 7610 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst); 7611 bt_cb(skb)->l2cap.psm = psm; 7612 7613 if (!chan->ops->recv(chan, skb)) { 7614 l2cap_chan_put(chan); 7615 return; 7616 } 7617 7618 drop: 7619 l2cap_chan_put(chan); 7620 free_skb: 7621 kfree_skb(skb); 7622 } 7623 7624 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 7625 { 7626 struct l2cap_hdr *lh = (void *) skb->data; 7627 struct hci_conn *hcon = conn->hcon; 7628 u16 cid, len; 7629 __le16 psm; 7630 7631 if (hcon->state != BT_CONNECTED) { 7632 BT_DBG("queueing pending rx skb"); 7633 skb_queue_tail(&conn->pending_rx, skb); 7634 return; 7635 } 7636 7637 skb_pull(skb, L2CAP_HDR_SIZE); 7638 cid = __le16_to_cpu(lh->cid); 7639 len = __le16_to_cpu(lh->len); 7640 7641 if (len != skb->len) { 7642 kfree_skb(skb); 7643 return; 7644 } 7645 7646 /* Since we can't actively block incoming LE connections we must 7647 * at least ensure that we ignore incoming data from them. 7648 */ 7649 if (hcon->type == LE_LINK && 7650 hci_bdaddr_list_lookup(&hcon->hdev->blacklist, &hcon->dst, 7651 bdaddr_dst_type(hcon))) { 7652 kfree_skb(skb); 7653 return; 7654 } 7655 7656 BT_DBG("len %d, cid 0x%4.4x", len, cid); 7657 7658 switch (cid) { 7659 case L2CAP_CID_SIGNALING: 7660 l2cap_sig_channel(conn, skb); 7661 break; 7662 7663 case L2CAP_CID_CONN_LESS: 7664 psm = get_unaligned((__le16 *) skb->data); 7665 skb_pull(skb, L2CAP_PSMLEN_SIZE); 7666 l2cap_conless_channel(conn, psm, skb); 7667 break; 7668 7669 case L2CAP_CID_LE_SIGNALING: 7670 l2cap_le_sig_channel(conn, skb); 7671 break; 7672 7673 default: 7674 l2cap_data_channel(conn, cid, skb); 7675 break; 7676 } 7677 } 7678 7679 static void process_pending_rx(struct work_struct *work) 7680 { 7681 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 7682 pending_rx_work); 7683 struct sk_buff *skb; 7684 7685 BT_DBG(""); 7686 7687 while ((skb = skb_dequeue(&conn->pending_rx))) 7688 l2cap_recv_frame(conn, skb); 7689 } 7690 7691 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) 7692 { 7693 struct l2cap_conn *conn = hcon->l2cap_data; 7694 struct hci_chan *hchan; 7695 7696 if (conn) 7697 return conn; 7698 7699 hchan = hci_chan_create(hcon); 7700 if (!hchan) 7701 return NULL; 7702 7703 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 7704 if (!conn) { 7705 hci_chan_del(hchan); 7706 return NULL; 7707 } 7708 7709 kref_init(&conn->ref); 7710 hcon->l2cap_data = conn; 7711 conn->hcon = hci_conn_get(hcon); 7712 conn->hchan = hchan; 7713 7714 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); 7715 7716 switch (hcon->type) { 7717 case LE_LINK: 7718 if (hcon->hdev->le_mtu) { 7719 conn->mtu = hcon->hdev->le_mtu; 7720 break; 7721 } 7722 /* fall through */ 7723 default: 7724 conn->mtu = hcon->hdev->acl_mtu; 7725 break; 7726 } 7727 7728 conn->feat_mask = 0; 7729 7730 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; 7731 7732 if (hcon->type == ACL_LINK && 7733 hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED)) 7734 conn->local_fixed_chan |= L2CAP_FC_A2MP; 7735 7736 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) && 7737 (bredr_sc_enabled(hcon->hdev) || 7738 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP))) 7739 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; 7740 7741 mutex_init(&conn->ident_lock); 7742 mutex_init(&conn->chan_lock); 7743 7744 INIT_LIST_HEAD(&conn->chan_l); 7745 INIT_LIST_HEAD(&conn->users); 7746 7747 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout); 7748 7749 skb_queue_head_init(&conn->pending_rx); 7750 INIT_WORK(&conn->pending_rx_work, process_pending_rx); 7751 INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr); 7752 7753 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 7754 7755 return conn; 7756 } 7757 7758 static bool is_valid_psm(u16 psm, u8 dst_type) { 7759 if (!psm) 7760 return false; 7761 7762 if (bdaddr_type_is_le(dst_type)) 7763 return (psm <= 0x00ff); 7764 7765 /* PSM must be odd and lsb of upper byte must be 0 */ 7766 return ((psm & 0x0101) == 0x0001); 7767 } 7768 7769 struct l2cap_chan_data { 7770 struct l2cap_chan *chan; 7771 struct pid *pid; 7772 int count; 7773 }; 7774 7775 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data) 7776 { 7777 struct l2cap_chan_data *d = data; 7778 struct pid *pid; 7779 7780 if (chan == d->chan) 7781 return; 7782 7783 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 7784 return; 7785 7786 pid = chan->ops->get_peer_pid(chan); 7787 7788 /* Only count deferred channels with the same PID/PSM */ 7789 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident || 7790 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 7791 return; 7792 7793 d->count++; 7794 } 7795 7796 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, 7797 bdaddr_t *dst, u8 dst_type) 7798 { 7799 struct l2cap_conn *conn; 7800 struct hci_conn *hcon; 7801 struct hci_dev *hdev; 7802 int err; 7803 7804 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src, 7805 dst, dst_type, __le16_to_cpu(psm), chan->mode); 7806 7807 hdev = hci_get_route(dst, &chan->src, chan->src_type); 7808 if (!hdev) 7809 return -EHOSTUNREACH; 7810 7811 hci_dev_lock(hdev); 7812 7813 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid && 7814 chan->chan_type != L2CAP_CHAN_RAW) { 7815 err = -EINVAL; 7816 goto done; 7817 } 7818 7819 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) { 7820 err = -EINVAL; 7821 goto done; 7822 } 7823 7824 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) { 7825 err = -EINVAL; 7826 goto done; 7827 } 7828 7829 switch (chan->mode) { 7830 case L2CAP_MODE_BASIC: 7831 break; 7832 case L2CAP_MODE_LE_FLOWCTL: 7833 break; 7834 case L2CAP_MODE_EXT_FLOWCTL: 7835 if (!enable_ecred) { 7836 err = -EOPNOTSUPP; 7837 goto done; 7838 } 7839 break; 7840 case L2CAP_MODE_ERTM: 7841 case L2CAP_MODE_STREAMING: 7842 if (!disable_ertm) 7843 break; 7844 /* fall through */ 7845 default: 7846 err = -EOPNOTSUPP; 7847 goto done; 7848 } 7849 7850 switch (chan->state) { 7851 case BT_CONNECT: 7852 case BT_CONNECT2: 7853 case BT_CONFIG: 7854 /* Already connecting */ 7855 err = 0; 7856 goto done; 7857 7858 case BT_CONNECTED: 7859 /* Already connected */ 7860 err = -EISCONN; 7861 goto done; 7862 7863 case BT_OPEN: 7864 case BT_BOUND: 7865 /* Can connect */ 7866 break; 7867 7868 default: 7869 err = -EBADFD; 7870 goto done; 7871 } 7872 7873 /* Set destination address and psm */ 7874 bacpy(&chan->dst, dst); 7875 chan->dst_type = dst_type; 7876 7877 chan->psm = psm; 7878 chan->dcid = cid; 7879 7880 if (bdaddr_type_is_le(dst_type)) { 7881 /* Convert from L2CAP channel address type to HCI address type 7882 */ 7883 if (dst_type == BDADDR_LE_PUBLIC) 7884 dst_type = ADDR_LE_DEV_PUBLIC; 7885 else 7886 dst_type = ADDR_LE_DEV_RANDOM; 7887 7888 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7889 hcon = hci_connect_le(hdev, dst, dst_type, 7890 chan->sec_level, 7891 HCI_LE_CONN_TIMEOUT, 7892 HCI_ROLE_SLAVE, NULL); 7893 else 7894 hcon = hci_connect_le_scan(hdev, dst, dst_type, 7895 chan->sec_level, 7896 HCI_LE_CONN_TIMEOUT); 7897 7898 } else { 7899 u8 auth_type = l2cap_get_auth_type(chan); 7900 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type); 7901 } 7902 7903 if (IS_ERR(hcon)) { 7904 err = PTR_ERR(hcon); 7905 goto done; 7906 } 7907 7908 conn = l2cap_conn_add(hcon); 7909 if (!conn) { 7910 hci_conn_drop(hcon); 7911 err = -ENOMEM; 7912 goto done; 7913 } 7914 7915 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 7916 struct l2cap_chan_data data; 7917 7918 data.chan = chan; 7919 data.pid = chan->ops->get_peer_pid(chan); 7920 data.count = 1; 7921 7922 l2cap_chan_list(conn, l2cap_chan_by_pid, &data); 7923 7924 /* Check if there isn't too many channels being connected */ 7925 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) { 7926 hci_conn_drop(hcon); 7927 err = -EPROTO; 7928 goto done; 7929 } 7930 } 7931 7932 mutex_lock(&conn->chan_lock); 7933 l2cap_chan_lock(chan); 7934 7935 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) { 7936 hci_conn_drop(hcon); 7937 err = -EBUSY; 7938 goto chan_unlock; 7939 } 7940 7941 /* Update source addr of the socket */ 7942 bacpy(&chan->src, &hcon->src); 7943 chan->src_type = bdaddr_src_type(hcon); 7944 7945 __l2cap_chan_add(conn, chan); 7946 7947 /* l2cap_chan_add takes its own ref so we can drop this one */ 7948 hci_conn_drop(hcon); 7949 7950 l2cap_state_change(chan, BT_CONNECT); 7951 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 7952 7953 /* Release chan->sport so that it can be reused by other 7954 * sockets (as it's only used for listening sockets). 7955 */ 7956 write_lock(&chan_list_lock); 7957 chan->sport = 0; 7958 write_unlock(&chan_list_lock); 7959 7960 if (hcon->state == BT_CONNECTED) { 7961 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 7962 __clear_chan_timer(chan); 7963 if (l2cap_chan_check_security(chan, true)) 7964 l2cap_state_change(chan, BT_CONNECTED); 7965 } else 7966 l2cap_do_start(chan); 7967 } 7968 7969 err = 0; 7970 7971 chan_unlock: 7972 l2cap_chan_unlock(chan); 7973 mutex_unlock(&conn->chan_lock); 7974 done: 7975 hci_dev_unlock(hdev); 7976 hci_dev_put(hdev); 7977 return err; 7978 } 7979 EXPORT_SYMBOL_GPL(l2cap_chan_connect); 7980 7981 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan) 7982 { 7983 struct l2cap_conn *conn = chan->conn; 7984 struct { 7985 struct l2cap_ecred_reconf_req req; 7986 __le16 scid; 7987 } pdu; 7988 7989 pdu.req.mtu = cpu_to_le16(chan->imtu); 7990 pdu.req.mps = cpu_to_le16(chan->mps); 7991 pdu.scid = cpu_to_le16(chan->scid); 7992 7993 chan->ident = l2cap_get_ident(conn); 7994 7995 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, 7996 sizeof(pdu), &pdu); 7997 } 7998 7999 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu) 8000 { 8001 if (chan->imtu > mtu) 8002 return -EINVAL; 8003 8004 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu); 8005 8006 chan->imtu = mtu; 8007 8008 l2cap_ecred_reconfigure(chan); 8009 8010 return 0; 8011 } 8012 8013 /* ---- L2CAP interface with lower layer (HCI) ---- */ 8014 8015 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr) 8016 { 8017 int exact = 0, lm1 = 0, lm2 = 0; 8018 struct l2cap_chan *c; 8019 8020 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 8021 8022 /* Find listening sockets and check their link_mode */ 8023 read_lock(&chan_list_lock); 8024 list_for_each_entry(c, &chan_list, global_l) { 8025 if (c->state != BT_LISTEN) 8026 continue; 8027 8028 if (!bacmp(&c->src, &hdev->bdaddr)) { 8029 lm1 |= HCI_LM_ACCEPT; 8030 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 8031 lm1 |= HCI_LM_MASTER; 8032 exact++; 8033 } else if (!bacmp(&c->src, BDADDR_ANY)) { 8034 lm2 |= HCI_LM_ACCEPT; 8035 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 8036 lm2 |= HCI_LM_MASTER; 8037 } 8038 } 8039 read_unlock(&chan_list_lock); 8040 8041 return exact ? lm1 : lm2; 8042 } 8043 8044 /* Find the next fixed channel in BT_LISTEN state, continue iteration 8045 * from an existing channel in the list or from the beginning of the 8046 * global list (by passing NULL as first parameter). 8047 */ 8048 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, 8049 struct hci_conn *hcon) 8050 { 8051 u8 src_type = bdaddr_src_type(hcon); 8052 8053 read_lock(&chan_list_lock); 8054 8055 if (c) 8056 c = list_next_entry(c, global_l); 8057 else 8058 c = list_entry(chan_list.next, typeof(*c), global_l); 8059 8060 list_for_each_entry_from(c, &chan_list, global_l) { 8061 if (c->chan_type != L2CAP_CHAN_FIXED) 8062 continue; 8063 if (c->state != BT_LISTEN) 8064 continue; 8065 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY)) 8066 continue; 8067 if (src_type != c->src_type) 8068 continue; 8069 8070 l2cap_chan_hold(c); 8071 read_unlock(&chan_list_lock); 8072 return c; 8073 } 8074 8075 read_unlock(&chan_list_lock); 8076 8077 return NULL; 8078 } 8079 8080 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 8081 { 8082 struct hci_dev *hdev = hcon->hdev; 8083 struct l2cap_conn *conn; 8084 struct l2cap_chan *pchan; 8085 u8 dst_type; 8086 8087 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 8088 return; 8089 8090 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); 8091 8092 if (status) { 8093 l2cap_conn_del(hcon, bt_to_errno(status)); 8094 return; 8095 } 8096 8097 conn = l2cap_conn_add(hcon); 8098 if (!conn) 8099 return; 8100 8101 dst_type = bdaddr_dst_type(hcon); 8102 8103 /* If device is blocked, do not create channels for it */ 8104 if (hci_bdaddr_list_lookup(&hdev->blacklist, &hcon->dst, dst_type)) 8105 return; 8106 8107 /* Find fixed channels and notify them of the new connection. We 8108 * use multiple individual lookups, continuing each time where 8109 * we left off, because the list lock would prevent calling the 8110 * potentially sleeping l2cap_chan_lock() function. 8111 */ 8112 pchan = l2cap_global_fixed_chan(NULL, hcon); 8113 while (pchan) { 8114 struct l2cap_chan *chan, *next; 8115 8116 /* Client fixed channels should override server ones */ 8117 if (__l2cap_get_chan_by_dcid(conn, pchan->scid)) 8118 goto next; 8119 8120 l2cap_chan_lock(pchan); 8121 chan = pchan->ops->new_connection(pchan); 8122 if (chan) { 8123 bacpy(&chan->src, &hcon->src); 8124 bacpy(&chan->dst, &hcon->dst); 8125 chan->src_type = bdaddr_src_type(hcon); 8126 chan->dst_type = dst_type; 8127 8128 __l2cap_chan_add(conn, chan); 8129 } 8130 8131 l2cap_chan_unlock(pchan); 8132 next: 8133 next = l2cap_global_fixed_chan(pchan, hcon); 8134 l2cap_chan_put(pchan); 8135 pchan = next; 8136 } 8137 8138 l2cap_conn_ready(conn); 8139 } 8140 8141 int l2cap_disconn_ind(struct hci_conn *hcon) 8142 { 8143 struct l2cap_conn *conn = hcon->l2cap_data; 8144 8145 BT_DBG("hcon %p", hcon); 8146 8147 if (!conn) 8148 return HCI_ERROR_REMOTE_USER_TERM; 8149 return conn->disc_reason; 8150 } 8151 8152 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 8153 { 8154 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 8155 return; 8156 8157 BT_DBG("hcon %p reason %d", hcon, reason); 8158 8159 l2cap_conn_del(hcon, bt_to_errno(reason)); 8160 } 8161 8162 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 8163 { 8164 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 8165 return; 8166 8167 if (encrypt == 0x00) { 8168 if (chan->sec_level == BT_SECURITY_MEDIUM) { 8169 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT); 8170 } else if (chan->sec_level == BT_SECURITY_HIGH || 8171 chan->sec_level == BT_SECURITY_FIPS) 8172 l2cap_chan_close(chan, ECONNREFUSED); 8173 } else { 8174 if (chan->sec_level == BT_SECURITY_MEDIUM) 8175 __clear_chan_timer(chan); 8176 } 8177 } 8178 8179 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 8180 { 8181 struct l2cap_conn *conn = hcon->l2cap_data; 8182 struct l2cap_chan *chan; 8183 8184 if (!conn) 8185 return; 8186 8187 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); 8188 8189 mutex_lock(&conn->chan_lock); 8190 8191 list_for_each_entry(chan, &conn->chan_l, list) { 8192 l2cap_chan_lock(chan); 8193 8194 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid, 8195 state_to_string(chan->state)); 8196 8197 if (chan->scid == L2CAP_CID_A2MP) { 8198 l2cap_chan_unlock(chan); 8199 continue; 8200 } 8201 8202 if (!status && encrypt) 8203 chan->sec_level = hcon->sec_level; 8204 8205 if (!__l2cap_no_conn_pending(chan)) { 8206 l2cap_chan_unlock(chan); 8207 continue; 8208 } 8209 8210 if (!status && (chan->state == BT_CONNECTED || 8211 chan->state == BT_CONFIG)) { 8212 chan->ops->resume(chan); 8213 l2cap_check_encryption(chan, encrypt); 8214 l2cap_chan_unlock(chan); 8215 continue; 8216 } 8217 8218 if (chan->state == BT_CONNECT) { 8219 if (!status && l2cap_check_enc_key_size(hcon)) 8220 l2cap_start_connection(chan); 8221 else 8222 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 8223 } else if (chan->state == BT_CONNECT2 && 8224 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL || 8225 chan->mode == L2CAP_MODE_LE_FLOWCTL)) { 8226 struct l2cap_conn_rsp rsp; 8227 __u16 res, stat; 8228 8229 if (!status && l2cap_check_enc_key_size(hcon)) { 8230 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 8231 res = L2CAP_CR_PEND; 8232 stat = L2CAP_CS_AUTHOR_PEND; 8233 chan->ops->defer(chan); 8234 } else { 8235 l2cap_state_change(chan, BT_CONFIG); 8236 res = L2CAP_CR_SUCCESS; 8237 stat = L2CAP_CS_NO_INFO; 8238 } 8239 } else { 8240 l2cap_state_change(chan, BT_DISCONN); 8241 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 8242 res = L2CAP_CR_SEC_BLOCK; 8243 stat = L2CAP_CS_NO_INFO; 8244 } 8245 8246 rsp.scid = cpu_to_le16(chan->dcid); 8247 rsp.dcid = cpu_to_le16(chan->scid); 8248 rsp.result = cpu_to_le16(res); 8249 rsp.status = cpu_to_le16(stat); 8250 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 8251 sizeof(rsp), &rsp); 8252 8253 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) && 8254 res == L2CAP_CR_SUCCESS) { 8255 char buf[128]; 8256 set_bit(CONF_REQ_SENT, &chan->conf_state); 8257 l2cap_send_cmd(conn, l2cap_get_ident(conn), 8258 L2CAP_CONF_REQ, 8259 l2cap_build_conf_req(chan, buf, sizeof(buf)), 8260 buf); 8261 chan->num_conf_req++; 8262 } 8263 } 8264 8265 l2cap_chan_unlock(chan); 8266 } 8267 8268 mutex_unlock(&conn->chan_lock); 8269 } 8270 8271 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) 8272 { 8273 struct l2cap_conn *conn = hcon->l2cap_data; 8274 struct l2cap_hdr *hdr; 8275 int len; 8276 8277 /* For AMP controller do not create l2cap conn */ 8278 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY) 8279 goto drop; 8280 8281 if (!conn) 8282 conn = l2cap_conn_add(hcon); 8283 8284 if (!conn) 8285 goto drop; 8286 8287 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags); 8288 8289 switch (flags) { 8290 case ACL_START: 8291 case ACL_START_NO_FLUSH: 8292 case ACL_COMPLETE: 8293 if (conn->rx_len) { 8294 BT_ERR("Unexpected start frame (len %d)", skb->len); 8295 kfree_skb(conn->rx_skb); 8296 conn->rx_skb = NULL; 8297 conn->rx_len = 0; 8298 l2cap_conn_unreliable(conn, ECOMM); 8299 } 8300 8301 /* Start fragment always begin with Basic L2CAP header */ 8302 if (skb->len < L2CAP_HDR_SIZE) { 8303 BT_ERR("Frame is too short (len %d)", skb->len); 8304 l2cap_conn_unreliable(conn, ECOMM); 8305 goto drop; 8306 } 8307 8308 hdr = (struct l2cap_hdr *) skb->data; 8309 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE; 8310 8311 if (len == skb->len) { 8312 /* Complete frame received */ 8313 l2cap_recv_frame(conn, skb); 8314 return; 8315 } 8316 8317 BT_DBG("Start: total len %d, frag len %d", len, skb->len); 8318 8319 if (skb->len > len) { 8320 BT_ERR("Frame is too long (len %d, expected len %d)", 8321 skb->len, len); 8322 l2cap_conn_unreliable(conn, ECOMM); 8323 goto drop; 8324 } 8325 8326 /* Allocate skb for the complete frame (with header) */ 8327 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL); 8328 if (!conn->rx_skb) 8329 goto drop; 8330 8331 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), 8332 skb->len); 8333 conn->rx_len = len - skb->len; 8334 break; 8335 8336 case ACL_CONT: 8337 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len); 8338 8339 if (!conn->rx_len) { 8340 BT_ERR("Unexpected continuation frame (len %d)", skb->len); 8341 l2cap_conn_unreliable(conn, ECOMM); 8342 goto drop; 8343 } 8344 8345 if (skb->len > conn->rx_len) { 8346 BT_ERR("Fragment is too long (len %d, expected %d)", 8347 skb->len, conn->rx_len); 8348 kfree_skb(conn->rx_skb); 8349 conn->rx_skb = NULL; 8350 conn->rx_len = 0; 8351 l2cap_conn_unreliable(conn, ECOMM); 8352 goto drop; 8353 } 8354 8355 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), 8356 skb->len); 8357 conn->rx_len -= skb->len; 8358 8359 if (!conn->rx_len) { 8360 /* Complete frame received. l2cap_recv_frame 8361 * takes ownership of the skb so set the global 8362 * rx_skb pointer to NULL first. 8363 */ 8364 struct sk_buff *rx_skb = conn->rx_skb; 8365 conn->rx_skb = NULL; 8366 l2cap_recv_frame(conn, rx_skb); 8367 } 8368 break; 8369 } 8370 8371 drop: 8372 kfree_skb(skb); 8373 } 8374 8375 static struct hci_cb l2cap_cb = { 8376 .name = "L2CAP", 8377 .connect_cfm = l2cap_connect_cfm, 8378 .disconn_cfm = l2cap_disconn_cfm, 8379 .security_cfm = l2cap_security_cfm, 8380 }; 8381 8382 static int l2cap_debugfs_show(struct seq_file *f, void *p) 8383 { 8384 struct l2cap_chan *c; 8385 8386 read_lock(&chan_list_lock); 8387 8388 list_for_each_entry(c, &chan_list, global_l) { 8389 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 8390 &c->src, c->src_type, &c->dst, c->dst_type, 8391 c->state, __le16_to_cpu(c->psm), 8392 c->scid, c->dcid, c->imtu, c->omtu, 8393 c->sec_level, c->mode); 8394 } 8395 8396 read_unlock(&chan_list_lock); 8397 8398 return 0; 8399 } 8400 8401 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs); 8402 8403 static struct dentry *l2cap_debugfs; 8404 8405 int __init l2cap_init(void) 8406 { 8407 int err; 8408 8409 err = l2cap_init_sockets(); 8410 if (err < 0) 8411 return err; 8412 8413 hci_register_cb(&l2cap_cb); 8414 8415 if (IS_ERR_OR_NULL(bt_debugfs)) 8416 return 0; 8417 8418 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs, 8419 NULL, &l2cap_debugfs_fops); 8420 8421 return 0; 8422 } 8423 8424 void l2cap_exit(void) 8425 { 8426 debugfs_remove(l2cap_debugfs); 8427 hci_unregister_cb(&l2cap_cb); 8428 l2cap_cleanup_sockets(); 8429 } 8430 8431 module_param(disable_ertm, bool, 0644); 8432 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 8433 8434 module_param(enable_ecred, bool, 0644); 8435 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode"); 8436