xref: /openbmc/linux/net/bluetooth/l2cap_core.c (revision 5b448065)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5    Copyright (C) 2010 Google Inc.
6    Copyright (C) 2011 ProFUSION Embedded Systems
7    Copyright (c) 2012 Code Aurora Forum.  All rights reserved.
8 
9    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License version 2 as
13    published by the Free Software Foundation;
14 
15    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 
24    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26    SOFTWARE IS DISCLAIMED.
27 */
28 
29 /* Bluetooth L2CAP core. */
30 
31 #include <linux/module.h>
32 
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
36 
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40 
41 #include "smp.h"
42 #include "a2mp.h"
43 #include "amp.h"
44 
45 #define LE_FLOWCTL_MAX_CREDITS 65535
46 
47 bool disable_ertm;
48 bool enable_ecred;
49 
50 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
51 
52 static LIST_HEAD(chan_list);
53 static DEFINE_RWLOCK(chan_list_lock);
54 
55 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
56 				       u8 code, u8 ident, u16 dlen, void *data);
57 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
58 			   void *data);
59 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
60 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
61 
62 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
63 		     struct sk_buff_head *skbs, u8 event);
64 
65 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
66 {
67 	if (link_type == LE_LINK) {
68 		if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
69 			return BDADDR_LE_PUBLIC;
70 		else
71 			return BDADDR_LE_RANDOM;
72 	}
73 
74 	return BDADDR_BREDR;
75 }
76 
77 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
78 {
79 	return bdaddr_type(hcon->type, hcon->src_type);
80 }
81 
82 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
83 {
84 	return bdaddr_type(hcon->type, hcon->dst_type);
85 }
86 
87 /* ---- L2CAP channels ---- */
88 
89 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
90 						   u16 cid)
91 {
92 	struct l2cap_chan *c;
93 
94 	list_for_each_entry(c, &conn->chan_l, list) {
95 		if (c->dcid == cid)
96 			return c;
97 	}
98 	return NULL;
99 }
100 
101 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
102 						   u16 cid)
103 {
104 	struct l2cap_chan *c;
105 
106 	list_for_each_entry(c, &conn->chan_l, list) {
107 		if (c->scid == cid)
108 			return c;
109 	}
110 	return NULL;
111 }
112 
113 /* Find channel with given SCID.
114  * Returns locked channel. */
115 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
116 						 u16 cid)
117 {
118 	struct l2cap_chan *c;
119 
120 	mutex_lock(&conn->chan_lock);
121 	c = __l2cap_get_chan_by_scid(conn, cid);
122 	if (c)
123 		l2cap_chan_lock(c);
124 	mutex_unlock(&conn->chan_lock);
125 
126 	return c;
127 }
128 
129 /* Find channel with given DCID.
130  * Returns locked channel.
131  */
132 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
133 						 u16 cid)
134 {
135 	struct l2cap_chan *c;
136 
137 	mutex_lock(&conn->chan_lock);
138 	c = __l2cap_get_chan_by_dcid(conn, cid);
139 	if (c)
140 		l2cap_chan_lock(c);
141 	mutex_unlock(&conn->chan_lock);
142 
143 	return c;
144 }
145 
146 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
147 						    u8 ident)
148 {
149 	struct l2cap_chan *c;
150 
151 	list_for_each_entry(c, &conn->chan_l, list) {
152 		if (c->ident == ident)
153 			return c;
154 	}
155 	return NULL;
156 }
157 
158 static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
159 						  u8 ident)
160 {
161 	struct l2cap_chan *c;
162 
163 	mutex_lock(&conn->chan_lock);
164 	c = __l2cap_get_chan_by_ident(conn, ident);
165 	if (c)
166 		l2cap_chan_lock(c);
167 	mutex_unlock(&conn->chan_lock);
168 
169 	return c;
170 }
171 
172 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
173 						      u8 src_type)
174 {
175 	struct l2cap_chan *c;
176 
177 	list_for_each_entry(c, &chan_list, global_l) {
178 		if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
179 			continue;
180 
181 		if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
182 			continue;
183 
184 		if (c->sport == psm && !bacmp(&c->src, src))
185 			return c;
186 	}
187 	return NULL;
188 }
189 
190 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
191 {
192 	int err;
193 
194 	write_lock(&chan_list_lock);
195 
196 	if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
197 		err = -EADDRINUSE;
198 		goto done;
199 	}
200 
201 	if (psm) {
202 		chan->psm = psm;
203 		chan->sport = psm;
204 		err = 0;
205 	} else {
206 		u16 p, start, end, incr;
207 
208 		if (chan->src_type == BDADDR_BREDR) {
209 			start = L2CAP_PSM_DYN_START;
210 			end = L2CAP_PSM_AUTO_END;
211 			incr = 2;
212 		} else {
213 			start = L2CAP_PSM_LE_DYN_START;
214 			end = L2CAP_PSM_LE_DYN_END;
215 			incr = 1;
216 		}
217 
218 		err = -EINVAL;
219 		for (p = start; p <= end; p += incr)
220 			if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
221 							 chan->src_type)) {
222 				chan->psm   = cpu_to_le16(p);
223 				chan->sport = cpu_to_le16(p);
224 				err = 0;
225 				break;
226 			}
227 	}
228 
229 done:
230 	write_unlock(&chan_list_lock);
231 	return err;
232 }
233 EXPORT_SYMBOL_GPL(l2cap_add_psm);
234 
235 int l2cap_add_scid(struct l2cap_chan *chan,  __u16 scid)
236 {
237 	write_lock(&chan_list_lock);
238 
239 	/* Override the defaults (which are for conn-oriented) */
240 	chan->omtu = L2CAP_DEFAULT_MTU;
241 	chan->chan_type = L2CAP_CHAN_FIXED;
242 
243 	chan->scid = scid;
244 
245 	write_unlock(&chan_list_lock);
246 
247 	return 0;
248 }
249 
250 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
251 {
252 	u16 cid, dyn_end;
253 
254 	if (conn->hcon->type == LE_LINK)
255 		dyn_end = L2CAP_CID_LE_DYN_END;
256 	else
257 		dyn_end = L2CAP_CID_DYN_END;
258 
259 	for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
260 		if (!__l2cap_get_chan_by_scid(conn, cid))
261 			return cid;
262 	}
263 
264 	return 0;
265 }
266 
267 static void l2cap_state_change(struct l2cap_chan *chan, int state)
268 {
269 	BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
270 	       state_to_string(state));
271 
272 	chan->state = state;
273 	chan->ops->state_change(chan, state, 0);
274 }
275 
276 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
277 						int state, int err)
278 {
279 	chan->state = state;
280 	chan->ops->state_change(chan, chan->state, err);
281 }
282 
283 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
284 {
285 	chan->ops->state_change(chan, chan->state, err);
286 }
287 
288 static void __set_retrans_timer(struct l2cap_chan *chan)
289 {
290 	if (!delayed_work_pending(&chan->monitor_timer) &&
291 	    chan->retrans_timeout) {
292 		l2cap_set_timer(chan, &chan->retrans_timer,
293 				msecs_to_jiffies(chan->retrans_timeout));
294 	}
295 }
296 
297 static void __set_monitor_timer(struct l2cap_chan *chan)
298 {
299 	__clear_retrans_timer(chan);
300 	if (chan->monitor_timeout) {
301 		l2cap_set_timer(chan, &chan->monitor_timer,
302 				msecs_to_jiffies(chan->monitor_timeout));
303 	}
304 }
305 
306 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
307 					       u16 seq)
308 {
309 	struct sk_buff *skb;
310 
311 	skb_queue_walk(head, skb) {
312 		if (bt_cb(skb)->l2cap.txseq == seq)
313 			return skb;
314 	}
315 
316 	return NULL;
317 }
318 
319 /* ---- L2CAP sequence number lists ---- */
320 
321 /* For ERTM, ordered lists of sequence numbers must be tracked for
322  * SREJ requests that are received and for frames that are to be
323  * retransmitted. These seq_list functions implement a singly-linked
324  * list in an array, where membership in the list can also be checked
325  * in constant time. Items can also be added to the tail of the list
326  * and removed from the head in constant time, without further memory
327  * allocs or frees.
328  */
329 
330 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
331 {
332 	size_t alloc_size, i;
333 
334 	/* Allocated size is a power of 2 to map sequence numbers
335 	 * (which may be up to 14 bits) in to a smaller array that is
336 	 * sized for the negotiated ERTM transmit windows.
337 	 */
338 	alloc_size = roundup_pow_of_two(size);
339 
340 	seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
341 	if (!seq_list->list)
342 		return -ENOMEM;
343 
344 	seq_list->mask = alloc_size - 1;
345 	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
346 	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
347 	for (i = 0; i < alloc_size; i++)
348 		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
349 
350 	return 0;
351 }
352 
353 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
354 {
355 	kfree(seq_list->list);
356 }
357 
358 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
359 					   u16 seq)
360 {
361 	/* Constant-time check for list membership */
362 	return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
363 }
364 
365 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
366 {
367 	u16 seq = seq_list->head;
368 	u16 mask = seq_list->mask;
369 
370 	seq_list->head = seq_list->list[seq & mask];
371 	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
372 
373 	if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
374 		seq_list->head = L2CAP_SEQ_LIST_CLEAR;
375 		seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
376 	}
377 
378 	return seq;
379 }
380 
381 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
382 {
383 	u16 i;
384 
385 	if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
386 		return;
387 
388 	for (i = 0; i <= seq_list->mask; i++)
389 		seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
390 
391 	seq_list->head = L2CAP_SEQ_LIST_CLEAR;
392 	seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
393 }
394 
395 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
396 {
397 	u16 mask = seq_list->mask;
398 
399 	/* All appends happen in constant time */
400 
401 	if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
402 		return;
403 
404 	if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
405 		seq_list->head = seq;
406 	else
407 		seq_list->list[seq_list->tail & mask] = seq;
408 
409 	seq_list->tail = seq;
410 	seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
411 }
412 
413 static void l2cap_chan_timeout(struct work_struct *work)
414 {
415 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
416 					       chan_timer.work);
417 	struct l2cap_conn *conn = chan->conn;
418 	int reason;
419 
420 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
421 
422 	mutex_lock(&conn->chan_lock);
423 	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
424 	 * this work. No need to call l2cap_chan_hold(chan) here again.
425 	 */
426 	l2cap_chan_lock(chan);
427 
428 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
429 		reason = ECONNREFUSED;
430 	else if (chan->state == BT_CONNECT &&
431 		 chan->sec_level != BT_SECURITY_SDP)
432 		reason = ECONNREFUSED;
433 	else
434 		reason = ETIMEDOUT;
435 
436 	l2cap_chan_close(chan, reason);
437 
438 	chan->ops->close(chan);
439 
440 	l2cap_chan_unlock(chan);
441 	l2cap_chan_put(chan);
442 
443 	mutex_unlock(&conn->chan_lock);
444 }
445 
446 struct l2cap_chan *l2cap_chan_create(void)
447 {
448 	struct l2cap_chan *chan;
449 
450 	chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
451 	if (!chan)
452 		return NULL;
453 
454 	skb_queue_head_init(&chan->tx_q);
455 	skb_queue_head_init(&chan->srej_q);
456 	mutex_init(&chan->lock);
457 
458 	/* Set default lock nesting level */
459 	atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
460 
461 	write_lock(&chan_list_lock);
462 	list_add(&chan->global_l, &chan_list);
463 	write_unlock(&chan_list_lock);
464 
465 	INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
466 
467 	chan->state = BT_OPEN;
468 
469 	kref_init(&chan->kref);
470 
471 	/* This flag is cleared in l2cap_chan_ready() */
472 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
473 
474 	BT_DBG("chan %p", chan);
475 
476 	return chan;
477 }
478 EXPORT_SYMBOL_GPL(l2cap_chan_create);
479 
480 static void l2cap_chan_destroy(struct kref *kref)
481 {
482 	struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
483 
484 	BT_DBG("chan %p", chan);
485 
486 	write_lock(&chan_list_lock);
487 	list_del(&chan->global_l);
488 	write_unlock(&chan_list_lock);
489 
490 	kfree(chan);
491 }
492 
493 void l2cap_chan_hold(struct l2cap_chan *c)
494 {
495 	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
496 
497 	kref_get(&c->kref);
498 }
499 
500 void l2cap_chan_put(struct l2cap_chan *c)
501 {
502 	BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
503 
504 	kref_put(&c->kref, l2cap_chan_destroy);
505 }
506 EXPORT_SYMBOL_GPL(l2cap_chan_put);
507 
508 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
509 {
510 	chan->fcs  = L2CAP_FCS_CRC16;
511 	chan->max_tx = L2CAP_DEFAULT_MAX_TX;
512 	chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
513 	chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
514 	chan->remote_max_tx = chan->max_tx;
515 	chan->remote_tx_win = chan->tx_win;
516 	chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
517 	chan->sec_level = BT_SECURITY_LOW;
518 	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
519 	chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
520 	chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
521 
522 	chan->conf_state = 0;
523 	set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
524 
525 	set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
526 }
527 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
528 
529 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
530 {
531 	chan->sdu = NULL;
532 	chan->sdu_last_frag = NULL;
533 	chan->sdu_len = 0;
534 	chan->tx_credits = tx_credits;
535 	/* Derive MPS from connection MTU to stop HCI fragmentation */
536 	chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
537 	/* Give enough credits for a full packet */
538 	chan->rx_credits = (chan->imtu / chan->mps) + 1;
539 
540 	skb_queue_head_init(&chan->tx_q);
541 }
542 
543 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
544 {
545 	l2cap_le_flowctl_init(chan, tx_credits);
546 
547 	/* L2CAP implementations shall support a minimum MPS of 64 octets */
548 	if (chan->mps < L2CAP_ECRED_MIN_MPS) {
549 		chan->mps = L2CAP_ECRED_MIN_MPS;
550 		chan->rx_credits = (chan->imtu / chan->mps) + 1;
551 	}
552 }
553 
554 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
555 {
556 	BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
557 	       __le16_to_cpu(chan->psm), chan->dcid);
558 
559 	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
560 
561 	chan->conn = conn;
562 
563 	switch (chan->chan_type) {
564 	case L2CAP_CHAN_CONN_ORIENTED:
565 		/* Alloc CID for connection-oriented socket */
566 		chan->scid = l2cap_alloc_cid(conn);
567 		if (conn->hcon->type == ACL_LINK)
568 			chan->omtu = L2CAP_DEFAULT_MTU;
569 		break;
570 
571 	case L2CAP_CHAN_CONN_LESS:
572 		/* Connectionless socket */
573 		chan->scid = L2CAP_CID_CONN_LESS;
574 		chan->dcid = L2CAP_CID_CONN_LESS;
575 		chan->omtu = L2CAP_DEFAULT_MTU;
576 		break;
577 
578 	case L2CAP_CHAN_FIXED:
579 		/* Caller will set CID and CID specific MTU values */
580 		break;
581 
582 	default:
583 		/* Raw socket can send/recv signalling messages only */
584 		chan->scid = L2CAP_CID_SIGNALING;
585 		chan->dcid = L2CAP_CID_SIGNALING;
586 		chan->omtu = L2CAP_DEFAULT_MTU;
587 	}
588 
589 	chan->local_id		= L2CAP_BESTEFFORT_ID;
590 	chan->local_stype	= L2CAP_SERV_BESTEFFORT;
591 	chan->local_msdu	= L2CAP_DEFAULT_MAX_SDU_SIZE;
592 	chan->local_sdu_itime	= L2CAP_DEFAULT_SDU_ITIME;
593 	chan->local_acc_lat	= L2CAP_DEFAULT_ACC_LAT;
594 	chan->local_flush_to	= L2CAP_EFS_DEFAULT_FLUSH_TO;
595 
596 	l2cap_chan_hold(chan);
597 
598 	/* Only keep a reference for fixed channels if they requested it */
599 	if (chan->chan_type != L2CAP_CHAN_FIXED ||
600 	    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
601 		hci_conn_hold(conn->hcon);
602 
603 	list_add(&chan->list, &conn->chan_l);
604 }
605 
606 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
607 {
608 	mutex_lock(&conn->chan_lock);
609 	__l2cap_chan_add(conn, chan);
610 	mutex_unlock(&conn->chan_lock);
611 }
612 
613 void l2cap_chan_del(struct l2cap_chan *chan, int err)
614 {
615 	struct l2cap_conn *conn = chan->conn;
616 
617 	__clear_chan_timer(chan);
618 
619 	BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
620 	       state_to_string(chan->state));
621 
622 	chan->ops->teardown(chan, err);
623 
624 	if (conn) {
625 		struct amp_mgr *mgr = conn->hcon->amp_mgr;
626 		/* Delete from channel list */
627 		list_del(&chan->list);
628 
629 		l2cap_chan_put(chan);
630 
631 		chan->conn = NULL;
632 
633 		/* Reference was only held for non-fixed channels or
634 		 * fixed channels that explicitly requested it using the
635 		 * FLAG_HOLD_HCI_CONN flag.
636 		 */
637 		if (chan->chan_type != L2CAP_CHAN_FIXED ||
638 		    test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
639 			hci_conn_drop(conn->hcon);
640 
641 		if (mgr && mgr->bredr_chan == chan)
642 			mgr->bredr_chan = NULL;
643 	}
644 
645 	if (chan->hs_hchan) {
646 		struct hci_chan *hs_hchan = chan->hs_hchan;
647 
648 		BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
649 		amp_disconnect_logical_link(hs_hchan);
650 	}
651 
652 	if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
653 		return;
654 
655 	switch (chan->mode) {
656 	case L2CAP_MODE_BASIC:
657 		break;
658 
659 	case L2CAP_MODE_LE_FLOWCTL:
660 	case L2CAP_MODE_EXT_FLOWCTL:
661 		skb_queue_purge(&chan->tx_q);
662 		break;
663 
664 	case L2CAP_MODE_ERTM:
665 		__clear_retrans_timer(chan);
666 		__clear_monitor_timer(chan);
667 		__clear_ack_timer(chan);
668 
669 		skb_queue_purge(&chan->srej_q);
670 
671 		l2cap_seq_list_free(&chan->srej_list);
672 		l2cap_seq_list_free(&chan->retrans_list);
673 		fallthrough;
674 
675 	case L2CAP_MODE_STREAMING:
676 		skb_queue_purge(&chan->tx_q);
677 		break;
678 	}
679 }
680 EXPORT_SYMBOL_GPL(l2cap_chan_del);
681 
682 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
683 			      void *data)
684 {
685 	struct l2cap_chan *chan;
686 
687 	list_for_each_entry(chan, &conn->chan_l, list) {
688 		func(chan, data);
689 	}
690 }
691 
692 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
693 		     void *data)
694 {
695 	if (!conn)
696 		return;
697 
698 	mutex_lock(&conn->chan_lock);
699 	__l2cap_chan_list(conn, func, data);
700 	mutex_unlock(&conn->chan_lock);
701 }
702 
703 EXPORT_SYMBOL_GPL(l2cap_chan_list);
704 
705 static void l2cap_conn_update_id_addr(struct work_struct *work)
706 {
707 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
708 					       id_addr_update_work);
709 	struct hci_conn *hcon = conn->hcon;
710 	struct l2cap_chan *chan;
711 
712 	mutex_lock(&conn->chan_lock);
713 
714 	list_for_each_entry(chan, &conn->chan_l, list) {
715 		l2cap_chan_lock(chan);
716 		bacpy(&chan->dst, &hcon->dst);
717 		chan->dst_type = bdaddr_dst_type(hcon);
718 		l2cap_chan_unlock(chan);
719 	}
720 
721 	mutex_unlock(&conn->chan_lock);
722 }
723 
724 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
725 {
726 	struct l2cap_conn *conn = chan->conn;
727 	struct l2cap_le_conn_rsp rsp;
728 	u16 result;
729 
730 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
731 		result = L2CAP_CR_LE_AUTHORIZATION;
732 	else
733 		result = L2CAP_CR_LE_BAD_PSM;
734 
735 	l2cap_state_change(chan, BT_DISCONN);
736 
737 	rsp.dcid    = cpu_to_le16(chan->scid);
738 	rsp.mtu     = cpu_to_le16(chan->imtu);
739 	rsp.mps     = cpu_to_le16(chan->mps);
740 	rsp.credits = cpu_to_le16(chan->rx_credits);
741 	rsp.result  = cpu_to_le16(result);
742 
743 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
744 		       &rsp);
745 }
746 
747 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
748 {
749 	struct l2cap_conn *conn = chan->conn;
750 	struct l2cap_ecred_conn_rsp rsp;
751 	u16 result;
752 
753 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
754 		result = L2CAP_CR_LE_AUTHORIZATION;
755 	else
756 		result = L2CAP_CR_LE_BAD_PSM;
757 
758 	l2cap_state_change(chan, BT_DISCONN);
759 
760 	memset(&rsp, 0, sizeof(rsp));
761 
762 	rsp.result  = cpu_to_le16(result);
763 
764 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
765 		       &rsp);
766 }
767 
768 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
769 {
770 	struct l2cap_conn *conn = chan->conn;
771 	struct l2cap_conn_rsp rsp;
772 	u16 result;
773 
774 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
775 		result = L2CAP_CR_SEC_BLOCK;
776 	else
777 		result = L2CAP_CR_BAD_PSM;
778 
779 	l2cap_state_change(chan, BT_DISCONN);
780 
781 	rsp.scid   = cpu_to_le16(chan->dcid);
782 	rsp.dcid   = cpu_to_le16(chan->scid);
783 	rsp.result = cpu_to_le16(result);
784 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
785 
786 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
787 }
788 
789 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
790 {
791 	struct l2cap_conn *conn = chan->conn;
792 
793 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
794 
795 	switch (chan->state) {
796 	case BT_LISTEN:
797 		chan->ops->teardown(chan, 0);
798 		break;
799 
800 	case BT_CONNECTED:
801 	case BT_CONFIG:
802 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
803 			__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
804 			l2cap_send_disconn_req(chan, reason);
805 		} else
806 			l2cap_chan_del(chan, reason);
807 		break;
808 
809 	case BT_CONNECT2:
810 		if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
811 			if (conn->hcon->type == ACL_LINK)
812 				l2cap_chan_connect_reject(chan);
813 			else if (conn->hcon->type == LE_LINK) {
814 				switch (chan->mode) {
815 				case L2CAP_MODE_LE_FLOWCTL:
816 					l2cap_chan_le_connect_reject(chan);
817 					break;
818 				case L2CAP_MODE_EXT_FLOWCTL:
819 					l2cap_chan_ecred_connect_reject(chan);
820 					break;
821 				}
822 			}
823 		}
824 
825 		l2cap_chan_del(chan, reason);
826 		break;
827 
828 	case BT_CONNECT:
829 	case BT_DISCONN:
830 		l2cap_chan_del(chan, reason);
831 		break;
832 
833 	default:
834 		chan->ops->teardown(chan, 0);
835 		break;
836 	}
837 }
838 EXPORT_SYMBOL(l2cap_chan_close);
839 
840 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
841 {
842 	switch (chan->chan_type) {
843 	case L2CAP_CHAN_RAW:
844 		switch (chan->sec_level) {
845 		case BT_SECURITY_HIGH:
846 		case BT_SECURITY_FIPS:
847 			return HCI_AT_DEDICATED_BONDING_MITM;
848 		case BT_SECURITY_MEDIUM:
849 			return HCI_AT_DEDICATED_BONDING;
850 		default:
851 			return HCI_AT_NO_BONDING;
852 		}
853 		break;
854 	case L2CAP_CHAN_CONN_LESS:
855 		if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
856 			if (chan->sec_level == BT_SECURITY_LOW)
857 				chan->sec_level = BT_SECURITY_SDP;
858 		}
859 		if (chan->sec_level == BT_SECURITY_HIGH ||
860 		    chan->sec_level == BT_SECURITY_FIPS)
861 			return HCI_AT_NO_BONDING_MITM;
862 		else
863 			return HCI_AT_NO_BONDING;
864 		break;
865 	case L2CAP_CHAN_CONN_ORIENTED:
866 		if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
867 			if (chan->sec_level == BT_SECURITY_LOW)
868 				chan->sec_level = BT_SECURITY_SDP;
869 
870 			if (chan->sec_level == BT_SECURITY_HIGH ||
871 			    chan->sec_level == BT_SECURITY_FIPS)
872 				return HCI_AT_NO_BONDING_MITM;
873 			else
874 				return HCI_AT_NO_BONDING;
875 		}
876 		fallthrough;
877 
878 	default:
879 		switch (chan->sec_level) {
880 		case BT_SECURITY_HIGH:
881 		case BT_SECURITY_FIPS:
882 			return HCI_AT_GENERAL_BONDING_MITM;
883 		case BT_SECURITY_MEDIUM:
884 			return HCI_AT_GENERAL_BONDING;
885 		default:
886 			return HCI_AT_NO_BONDING;
887 		}
888 		break;
889 	}
890 }
891 
892 /* Service level security */
893 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
894 {
895 	struct l2cap_conn *conn = chan->conn;
896 	__u8 auth_type;
897 
898 	if (conn->hcon->type == LE_LINK)
899 		return smp_conn_security(conn->hcon, chan->sec_level);
900 
901 	auth_type = l2cap_get_auth_type(chan);
902 
903 	return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
904 				 initiator);
905 }
906 
907 static u8 l2cap_get_ident(struct l2cap_conn *conn)
908 {
909 	u8 id;
910 
911 	/* Get next available identificator.
912 	 *    1 - 128 are used by kernel.
913 	 *  129 - 199 are reserved.
914 	 *  200 - 254 are used by utilities like l2ping, etc.
915 	 */
916 
917 	mutex_lock(&conn->ident_lock);
918 
919 	if (++conn->tx_ident > 128)
920 		conn->tx_ident = 1;
921 
922 	id = conn->tx_ident;
923 
924 	mutex_unlock(&conn->ident_lock);
925 
926 	return id;
927 }
928 
929 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
930 			   void *data)
931 {
932 	struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
933 	u8 flags;
934 
935 	BT_DBG("code 0x%2.2x", code);
936 
937 	if (!skb)
938 		return;
939 
940 	/* Use NO_FLUSH if supported or we have an LE link (which does
941 	 * not support auto-flushing packets) */
942 	if (lmp_no_flush_capable(conn->hcon->hdev) ||
943 	    conn->hcon->type == LE_LINK)
944 		flags = ACL_START_NO_FLUSH;
945 	else
946 		flags = ACL_START;
947 
948 	bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
949 	skb->priority = HCI_PRIO_MAX;
950 
951 	hci_send_acl(conn->hchan, skb, flags);
952 }
953 
954 static bool __chan_is_moving(struct l2cap_chan *chan)
955 {
956 	return chan->move_state != L2CAP_MOVE_STABLE &&
957 	       chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
958 }
959 
960 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
961 {
962 	struct hci_conn *hcon = chan->conn->hcon;
963 	u16 flags;
964 
965 	BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
966 	       skb->priority);
967 
968 	if (chan->hs_hcon && !__chan_is_moving(chan)) {
969 		if (chan->hs_hchan)
970 			hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
971 		else
972 			kfree_skb(skb);
973 
974 		return;
975 	}
976 
977 	/* Use NO_FLUSH for LE links (where this is the only option) or
978 	 * if the BR/EDR link supports it and flushing has not been
979 	 * explicitly requested (through FLAG_FLUSHABLE).
980 	 */
981 	if (hcon->type == LE_LINK ||
982 	    (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
983 	     lmp_no_flush_capable(hcon->hdev)))
984 		flags = ACL_START_NO_FLUSH;
985 	else
986 		flags = ACL_START;
987 
988 	bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
989 	hci_send_acl(chan->conn->hchan, skb, flags);
990 }
991 
992 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
993 {
994 	control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
995 	control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
996 
997 	if (enh & L2CAP_CTRL_FRAME_TYPE) {
998 		/* S-Frame */
999 		control->sframe = 1;
1000 		control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
1001 		control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
1002 
1003 		control->sar = 0;
1004 		control->txseq = 0;
1005 	} else {
1006 		/* I-Frame */
1007 		control->sframe = 0;
1008 		control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
1009 		control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
1010 
1011 		control->poll = 0;
1012 		control->super = 0;
1013 	}
1014 }
1015 
1016 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
1017 {
1018 	control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1019 	control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1020 
1021 	if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1022 		/* S-Frame */
1023 		control->sframe = 1;
1024 		control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1025 		control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1026 
1027 		control->sar = 0;
1028 		control->txseq = 0;
1029 	} else {
1030 		/* I-Frame */
1031 		control->sframe = 0;
1032 		control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1033 		control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1034 
1035 		control->poll = 0;
1036 		control->super = 0;
1037 	}
1038 }
1039 
1040 static inline void __unpack_control(struct l2cap_chan *chan,
1041 				    struct sk_buff *skb)
1042 {
1043 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1044 		__unpack_extended_control(get_unaligned_le32(skb->data),
1045 					  &bt_cb(skb)->l2cap);
1046 		skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1047 	} else {
1048 		__unpack_enhanced_control(get_unaligned_le16(skb->data),
1049 					  &bt_cb(skb)->l2cap);
1050 		skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1051 	}
1052 }
1053 
1054 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1055 {
1056 	u32 packed;
1057 
1058 	packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1059 	packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1060 
1061 	if (control->sframe) {
1062 		packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1063 		packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1064 		packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1065 	} else {
1066 		packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1067 		packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1068 	}
1069 
1070 	return packed;
1071 }
1072 
1073 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1074 {
1075 	u16 packed;
1076 
1077 	packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1078 	packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1079 
1080 	if (control->sframe) {
1081 		packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1082 		packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1083 		packed |= L2CAP_CTRL_FRAME_TYPE;
1084 	} else {
1085 		packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1086 		packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1087 	}
1088 
1089 	return packed;
1090 }
1091 
1092 static inline void __pack_control(struct l2cap_chan *chan,
1093 				  struct l2cap_ctrl *control,
1094 				  struct sk_buff *skb)
1095 {
1096 	if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1097 		put_unaligned_le32(__pack_extended_control(control),
1098 				   skb->data + L2CAP_HDR_SIZE);
1099 	} else {
1100 		put_unaligned_le16(__pack_enhanced_control(control),
1101 				   skb->data + L2CAP_HDR_SIZE);
1102 	}
1103 }
1104 
1105 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1106 {
1107 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1108 		return L2CAP_EXT_HDR_SIZE;
1109 	else
1110 		return L2CAP_ENH_HDR_SIZE;
1111 }
1112 
1113 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1114 					       u32 control)
1115 {
1116 	struct sk_buff *skb;
1117 	struct l2cap_hdr *lh;
1118 	int hlen = __ertm_hdr_size(chan);
1119 
1120 	if (chan->fcs == L2CAP_FCS_CRC16)
1121 		hlen += L2CAP_FCS_SIZE;
1122 
1123 	skb = bt_skb_alloc(hlen, GFP_KERNEL);
1124 
1125 	if (!skb)
1126 		return ERR_PTR(-ENOMEM);
1127 
1128 	lh = skb_put(skb, L2CAP_HDR_SIZE);
1129 	lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1130 	lh->cid = cpu_to_le16(chan->dcid);
1131 
1132 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1133 		put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1134 	else
1135 		put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1136 
1137 	if (chan->fcs == L2CAP_FCS_CRC16) {
1138 		u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1139 		put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1140 	}
1141 
1142 	skb->priority = HCI_PRIO_MAX;
1143 	return skb;
1144 }
1145 
1146 static void l2cap_send_sframe(struct l2cap_chan *chan,
1147 			      struct l2cap_ctrl *control)
1148 {
1149 	struct sk_buff *skb;
1150 	u32 control_field;
1151 
1152 	BT_DBG("chan %p, control %p", chan, control);
1153 
1154 	if (!control->sframe)
1155 		return;
1156 
1157 	if (__chan_is_moving(chan))
1158 		return;
1159 
1160 	if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1161 	    !control->poll)
1162 		control->final = 1;
1163 
1164 	if (control->super == L2CAP_SUPER_RR)
1165 		clear_bit(CONN_RNR_SENT, &chan->conn_state);
1166 	else if (control->super == L2CAP_SUPER_RNR)
1167 		set_bit(CONN_RNR_SENT, &chan->conn_state);
1168 
1169 	if (control->super != L2CAP_SUPER_SREJ) {
1170 		chan->last_acked_seq = control->reqseq;
1171 		__clear_ack_timer(chan);
1172 	}
1173 
1174 	BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1175 	       control->final, control->poll, control->super);
1176 
1177 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1178 		control_field = __pack_extended_control(control);
1179 	else
1180 		control_field = __pack_enhanced_control(control);
1181 
1182 	skb = l2cap_create_sframe_pdu(chan, control_field);
1183 	if (!IS_ERR(skb))
1184 		l2cap_do_send(chan, skb);
1185 }
1186 
1187 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1188 {
1189 	struct l2cap_ctrl control;
1190 
1191 	BT_DBG("chan %p, poll %d", chan, poll);
1192 
1193 	memset(&control, 0, sizeof(control));
1194 	control.sframe = 1;
1195 	control.poll = poll;
1196 
1197 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1198 		control.super = L2CAP_SUPER_RNR;
1199 	else
1200 		control.super = L2CAP_SUPER_RR;
1201 
1202 	control.reqseq = chan->buffer_seq;
1203 	l2cap_send_sframe(chan, &control);
1204 }
1205 
1206 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1207 {
1208 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1209 		return true;
1210 
1211 	return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1212 }
1213 
1214 static bool __amp_capable(struct l2cap_chan *chan)
1215 {
1216 	struct l2cap_conn *conn = chan->conn;
1217 	struct hci_dev *hdev;
1218 	bool amp_available = false;
1219 
1220 	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
1221 		return false;
1222 
1223 	if (!(conn->remote_fixed_chan & L2CAP_FC_A2MP))
1224 		return false;
1225 
1226 	read_lock(&hci_dev_list_lock);
1227 	list_for_each_entry(hdev, &hci_dev_list, list) {
1228 		if (hdev->amp_type != AMP_TYPE_BREDR &&
1229 		    test_bit(HCI_UP, &hdev->flags)) {
1230 			amp_available = true;
1231 			break;
1232 		}
1233 	}
1234 	read_unlock(&hci_dev_list_lock);
1235 
1236 	if (chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED)
1237 		return amp_available;
1238 
1239 	return false;
1240 }
1241 
1242 static bool l2cap_check_efs(struct l2cap_chan *chan)
1243 {
1244 	/* Check EFS parameters */
1245 	return true;
1246 }
1247 
1248 void l2cap_send_conn_req(struct l2cap_chan *chan)
1249 {
1250 	struct l2cap_conn *conn = chan->conn;
1251 	struct l2cap_conn_req req;
1252 
1253 	req.scid = cpu_to_le16(chan->scid);
1254 	req.psm  = chan->psm;
1255 
1256 	chan->ident = l2cap_get_ident(conn);
1257 
1258 	set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1259 
1260 	l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1261 }
1262 
1263 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1264 {
1265 	struct l2cap_create_chan_req req;
1266 	req.scid = cpu_to_le16(chan->scid);
1267 	req.psm  = chan->psm;
1268 	req.amp_id = amp_id;
1269 
1270 	chan->ident = l2cap_get_ident(chan->conn);
1271 
1272 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1273 		       sizeof(req), &req);
1274 }
1275 
1276 static void l2cap_move_setup(struct l2cap_chan *chan)
1277 {
1278 	struct sk_buff *skb;
1279 
1280 	BT_DBG("chan %p", chan);
1281 
1282 	if (chan->mode != L2CAP_MODE_ERTM)
1283 		return;
1284 
1285 	__clear_retrans_timer(chan);
1286 	__clear_monitor_timer(chan);
1287 	__clear_ack_timer(chan);
1288 
1289 	chan->retry_count = 0;
1290 	skb_queue_walk(&chan->tx_q, skb) {
1291 		if (bt_cb(skb)->l2cap.retries)
1292 			bt_cb(skb)->l2cap.retries = 1;
1293 		else
1294 			break;
1295 	}
1296 
1297 	chan->expected_tx_seq = chan->buffer_seq;
1298 
1299 	clear_bit(CONN_REJ_ACT, &chan->conn_state);
1300 	clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1301 	l2cap_seq_list_clear(&chan->retrans_list);
1302 	l2cap_seq_list_clear(&chan->srej_list);
1303 	skb_queue_purge(&chan->srej_q);
1304 
1305 	chan->tx_state = L2CAP_TX_STATE_XMIT;
1306 	chan->rx_state = L2CAP_RX_STATE_MOVE;
1307 
1308 	set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1309 }
1310 
1311 static void l2cap_move_done(struct l2cap_chan *chan)
1312 {
1313 	u8 move_role = chan->move_role;
1314 	BT_DBG("chan %p", chan);
1315 
1316 	chan->move_state = L2CAP_MOVE_STABLE;
1317 	chan->move_role = L2CAP_MOVE_ROLE_NONE;
1318 
1319 	if (chan->mode != L2CAP_MODE_ERTM)
1320 		return;
1321 
1322 	switch (move_role) {
1323 	case L2CAP_MOVE_ROLE_INITIATOR:
1324 		l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1325 		chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1326 		break;
1327 	case L2CAP_MOVE_ROLE_RESPONDER:
1328 		chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1329 		break;
1330 	}
1331 }
1332 
1333 static void l2cap_chan_ready(struct l2cap_chan *chan)
1334 {
1335 	/* The channel may have already been flagged as connected in
1336 	 * case of receiving data before the L2CAP info req/rsp
1337 	 * procedure is complete.
1338 	 */
1339 	if (chan->state == BT_CONNECTED)
1340 		return;
1341 
1342 	/* This clears all conf flags, including CONF_NOT_COMPLETE */
1343 	chan->conf_state = 0;
1344 	__clear_chan_timer(chan);
1345 
1346 	switch (chan->mode) {
1347 	case L2CAP_MODE_LE_FLOWCTL:
1348 	case L2CAP_MODE_EXT_FLOWCTL:
1349 		if (!chan->tx_credits)
1350 			chan->ops->suspend(chan);
1351 		break;
1352 	}
1353 
1354 	chan->state = BT_CONNECTED;
1355 
1356 	chan->ops->ready(chan);
1357 }
1358 
1359 static void l2cap_le_connect(struct l2cap_chan *chan)
1360 {
1361 	struct l2cap_conn *conn = chan->conn;
1362 	struct l2cap_le_conn_req req;
1363 
1364 	if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1365 		return;
1366 
1367 	if (!chan->imtu)
1368 		chan->imtu = chan->conn->mtu;
1369 
1370 	l2cap_le_flowctl_init(chan, 0);
1371 
1372 	req.psm     = chan->psm;
1373 	req.scid    = cpu_to_le16(chan->scid);
1374 	req.mtu     = cpu_to_le16(chan->imtu);
1375 	req.mps     = cpu_to_le16(chan->mps);
1376 	req.credits = cpu_to_le16(chan->rx_credits);
1377 
1378 	chan->ident = l2cap_get_ident(conn);
1379 
1380 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1381 		       sizeof(req), &req);
1382 }
1383 
1384 struct l2cap_ecred_conn_data {
1385 	struct {
1386 		struct l2cap_ecred_conn_req req;
1387 		__le16 scid[5];
1388 	} __packed pdu;
1389 	struct l2cap_chan *chan;
1390 	struct pid *pid;
1391 	int count;
1392 };
1393 
1394 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1395 {
1396 	struct l2cap_ecred_conn_data *conn = data;
1397 	struct pid *pid;
1398 
1399 	if (chan == conn->chan)
1400 		return;
1401 
1402 	if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1403 		return;
1404 
1405 	pid = chan->ops->get_peer_pid(chan);
1406 
1407 	/* Only add deferred channels with the same PID/PSM */
1408 	if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1409 	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1410 		return;
1411 
1412 	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1413 		return;
1414 
1415 	l2cap_ecred_init(chan, 0);
1416 
1417 	/* Set the same ident so we can match on the rsp */
1418 	chan->ident = conn->chan->ident;
1419 
1420 	/* Include all channels deferred */
1421 	conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1422 
1423 	conn->count++;
1424 }
1425 
1426 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1427 {
1428 	struct l2cap_conn *conn = chan->conn;
1429 	struct l2cap_ecred_conn_data data;
1430 
1431 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1432 		return;
1433 
1434 	if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1435 		return;
1436 
1437 	l2cap_ecred_init(chan, 0);
1438 
1439 	data.pdu.req.psm     = chan->psm;
1440 	data.pdu.req.mtu     = cpu_to_le16(chan->imtu);
1441 	data.pdu.req.mps     = cpu_to_le16(chan->mps);
1442 	data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1443 	data.pdu.scid[0]     = cpu_to_le16(chan->scid);
1444 
1445 	chan->ident = l2cap_get_ident(conn);
1446 	data.pid = chan->ops->get_peer_pid(chan);
1447 
1448 	data.count = 1;
1449 	data.chan = chan;
1450 	data.pid = chan->ops->get_peer_pid(chan);
1451 
1452 	__l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1453 
1454 	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1455 		       sizeof(data.pdu.req) + data.count * sizeof(__le16),
1456 		       &data.pdu);
1457 }
1458 
1459 static void l2cap_le_start(struct l2cap_chan *chan)
1460 {
1461 	struct l2cap_conn *conn = chan->conn;
1462 
1463 	if (!smp_conn_security(conn->hcon, chan->sec_level))
1464 		return;
1465 
1466 	if (!chan->psm) {
1467 		l2cap_chan_ready(chan);
1468 		return;
1469 	}
1470 
1471 	if (chan->state == BT_CONNECT) {
1472 		if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1473 			l2cap_ecred_connect(chan);
1474 		else
1475 			l2cap_le_connect(chan);
1476 	}
1477 }
1478 
1479 static void l2cap_start_connection(struct l2cap_chan *chan)
1480 {
1481 	if (__amp_capable(chan)) {
1482 		BT_DBG("chan %p AMP capable: discover AMPs", chan);
1483 		a2mp_discover_amp(chan);
1484 	} else if (chan->conn->hcon->type == LE_LINK) {
1485 		l2cap_le_start(chan);
1486 	} else {
1487 		l2cap_send_conn_req(chan);
1488 	}
1489 }
1490 
1491 static void l2cap_request_info(struct l2cap_conn *conn)
1492 {
1493 	struct l2cap_info_req req;
1494 
1495 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1496 		return;
1497 
1498 	req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1499 
1500 	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1501 	conn->info_ident = l2cap_get_ident(conn);
1502 
1503 	schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1504 
1505 	l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1506 		       sizeof(req), &req);
1507 }
1508 
1509 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1510 {
1511 	/* The minimum encryption key size needs to be enforced by the
1512 	 * host stack before establishing any L2CAP connections. The
1513 	 * specification in theory allows a minimum of 1, but to align
1514 	 * BR/EDR and LE transports, a minimum of 7 is chosen.
1515 	 *
1516 	 * This check might also be called for unencrypted connections
1517 	 * that have no key size requirements. Ensure that the link is
1518 	 * actually encrypted before enforcing a key size.
1519 	 */
1520 	int min_key_size = hcon->hdev->min_enc_key_size;
1521 
1522 	/* On FIPS security level, key size must be 16 bytes */
1523 	if (hcon->sec_level == BT_SECURITY_FIPS)
1524 		min_key_size = 16;
1525 
1526 	return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1527 		hcon->enc_key_size >= min_key_size);
1528 }
1529 
1530 static void l2cap_do_start(struct l2cap_chan *chan)
1531 {
1532 	struct l2cap_conn *conn = chan->conn;
1533 
1534 	if (conn->hcon->type == LE_LINK) {
1535 		l2cap_le_start(chan);
1536 		return;
1537 	}
1538 
1539 	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1540 		l2cap_request_info(conn);
1541 		return;
1542 	}
1543 
1544 	if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1545 		return;
1546 
1547 	if (!l2cap_chan_check_security(chan, true) ||
1548 	    !__l2cap_no_conn_pending(chan))
1549 		return;
1550 
1551 	if (l2cap_check_enc_key_size(conn->hcon))
1552 		l2cap_start_connection(chan);
1553 	else
1554 		__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1555 }
1556 
1557 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1558 {
1559 	u32 local_feat_mask = l2cap_feat_mask;
1560 	if (!disable_ertm)
1561 		local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1562 
1563 	switch (mode) {
1564 	case L2CAP_MODE_ERTM:
1565 		return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1566 	case L2CAP_MODE_STREAMING:
1567 		return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1568 	default:
1569 		return 0x00;
1570 	}
1571 }
1572 
1573 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1574 {
1575 	struct l2cap_conn *conn = chan->conn;
1576 	struct l2cap_disconn_req req;
1577 
1578 	if (!conn)
1579 		return;
1580 
1581 	if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1582 		__clear_retrans_timer(chan);
1583 		__clear_monitor_timer(chan);
1584 		__clear_ack_timer(chan);
1585 	}
1586 
1587 	if (chan->scid == L2CAP_CID_A2MP) {
1588 		l2cap_state_change(chan, BT_DISCONN);
1589 		return;
1590 	}
1591 
1592 	req.dcid = cpu_to_le16(chan->dcid);
1593 	req.scid = cpu_to_le16(chan->scid);
1594 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1595 		       sizeof(req), &req);
1596 
1597 	l2cap_state_change_and_error(chan, BT_DISCONN, err);
1598 }
1599 
1600 /* ---- L2CAP connections ---- */
1601 static void l2cap_conn_start(struct l2cap_conn *conn)
1602 {
1603 	struct l2cap_chan *chan, *tmp;
1604 
1605 	BT_DBG("conn %p", conn);
1606 
1607 	mutex_lock(&conn->chan_lock);
1608 
1609 	list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1610 		l2cap_chan_lock(chan);
1611 
1612 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1613 			l2cap_chan_ready(chan);
1614 			l2cap_chan_unlock(chan);
1615 			continue;
1616 		}
1617 
1618 		if (chan->state == BT_CONNECT) {
1619 			if (!l2cap_chan_check_security(chan, true) ||
1620 			    !__l2cap_no_conn_pending(chan)) {
1621 				l2cap_chan_unlock(chan);
1622 				continue;
1623 			}
1624 
1625 			if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1626 			    && test_bit(CONF_STATE2_DEVICE,
1627 					&chan->conf_state)) {
1628 				l2cap_chan_close(chan, ECONNRESET);
1629 				l2cap_chan_unlock(chan);
1630 				continue;
1631 			}
1632 
1633 			if (l2cap_check_enc_key_size(conn->hcon))
1634 				l2cap_start_connection(chan);
1635 			else
1636 				l2cap_chan_close(chan, ECONNREFUSED);
1637 
1638 		} else if (chan->state == BT_CONNECT2) {
1639 			struct l2cap_conn_rsp rsp;
1640 			char buf[128];
1641 			rsp.scid = cpu_to_le16(chan->dcid);
1642 			rsp.dcid = cpu_to_le16(chan->scid);
1643 
1644 			if (l2cap_chan_check_security(chan, false)) {
1645 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1646 					rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1647 					rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1648 					chan->ops->defer(chan);
1649 
1650 				} else {
1651 					l2cap_state_change(chan, BT_CONFIG);
1652 					rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1653 					rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1654 				}
1655 			} else {
1656 				rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1657 				rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1658 			}
1659 
1660 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1661 				       sizeof(rsp), &rsp);
1662 
1663 			if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1664 			    rsp.result != L2CAP_CR_SUCCESS) {
1665 				l2cap_chan_unlock(chan);
1666 				continue;
1667 			}
1668 
1669 			set_bit(CONF_REQ_SENT, &chan->conf_state);
1670 			l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1671 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1672 			chan->num_conf_req++;
1673 		}
1674 
1675 		l2cap_chan_unlock(chan);
1676 	}
1677 
1678 	mutex_unlock(&conn->chan_lock);
1679 }
1680 
1681 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1682 {
1683 	struct hci_conn *hcon = conn->hcon;
1684 	struct hci_dev *hdev = hcon->hdev;
1685 
1686 	BT_DBG("%s conn %p", hdev->name, conn);
1687 
1688 	/* For outgoing pairing which doesn't necessarily have an
1689 	 * associated socket (e.g. mgmt_pair_device).
1690 	 */
1691 	if (hcon->out)
1692 		smp_conn_security(hcon, hcon->pending_sec_level);
1693 
1694 	/* For LE slave connections, make sure the connection interval
1695 	 * is in the range of the minimum and maximum interval that has
1696 	 * been configured for this connection. If not, then trigger
1697 	 * the connection update procedure.
1698 	 */
1699 	if (hcon->role == HCI_ROLE_SLAVE &&
1700 	    (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1701 	     hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1702 		struct l2cap_conn_param_update_req req;
1703 
1704 		req.min = cpu_to_le16(hcon->le_conn_min_interval);
1705 		req.max = cpu_to_le16(hcon->le_conn_max_interval);
1706 		req.latency = cpu_to_le16(hcon->le_conn_latency);
1707 		req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1708 
1709 		l2cap_send_cmd(conn, l2cap_get_ident(conn),
1710 			       L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1711 	}
1712 }
1713 
1714 static void l2cap_conn_ready(struct l2cap_conn *conn)
1715 {
1716 	struct l2cap_chan *chan;
1717 	struct hci_conn *hcon = conn->hcon;
1718 
1719 	BT_DBG("conn %p", conn);
1720 
1721 	if (hcon->type == ACL_LINK)
1722 		l2cap_request_info(conn);
1723 
1724 	mutex_lock(&conn->chan_lock);
1725 
1726 	list_for_each_entry(chan, &conn->chan_l, list) {
1727 
1728 		l2cap_chan_lock(chan);
1729 
1730 		if (chan->scid == L2CAP_CID_A2MP) {
1731 			l2cap_chan_unlock(chan);
1732 			continue;
1733 		}
1734 
1735 		if (hcon->type == LE_LINK) {
1736 			l2cap_le_start(chan);
1737 		} else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1738 			if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1739 				l2cap_chan_ready(chan);
1740 		} else if (chan->state == BT_CONNECT) {
1741 			l2cap_do_start(chan);
1742 		}
1743 
1744 		l2cap_chan_unlock(chan);
1745 	}
1746 
1747 	mutex_unlock(&conn->chan_lock);
1748 
1749 	if (hcon->type == LE_LINK)
1750 		l2cap_le_conn_ready(conn);
1751 
1752 	queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1753 }
1754 
1755 /* Notify sockets that we cannot guaranty reliability anymore */
1756 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1757 {
1758 	struct l2cap_chan *chan;
1759 
1760 	BT_DBG("conn %p", conn);
1761 
1762 	mutex_lock(&conn->chan_lock);
1763 
1764 	list_for_each_entry(chan, &conn->chan_l, list) {
1765 		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1766 			l2cap_chan_set_err(chan, err);
1767 	}
1768 
1769 	mutex_unlock(&conn->chan_lock);
1770 }
1771 
1772 static void l2cap_info_timeout(struct work_struct *work)
1773 {
1774 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1775 					       info_timer.work);
1776 
1777 	conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1778 	conn->info_ident = 0;
1779 
1780 	l2cap_conn_start(conn);
1781 }
1782 
1783 /*
1784  * l2cap_user
1785  * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1786  * callback is called during registration. The ->remove callback is called
1787  * during unregistration.
1788  * An l2cap_user object can either be explicitly unregistered or when the
1789  * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1790  * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1791  * External modules must own a reference to the l2cap_conn object if they intend
1792  * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1793  * any time if they don't.
1794  */
1795 
1796 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1797 {
1798 	struct hci_dev *hdev = conn->hcon->hdev;
1799 	int ret;
1800 
1801 	/* We need to check whether l2cap_conn is registered. If it is not, we
1802 	 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1803 	 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1804 	 * relies on the parent hci_conn object to be locked. This itself relies
1805 	 * on the hci_dev object to be locked. So we must lock the hci device
1806 	 * here, too. */
1807 
1808 	hci_dev_lock(hdev);
1809 
1810 	if (!list_empty(&user->list)) {
1811 		ret = -EINVAL;
1812 		goto out_unlock;
1813 	}
1814 
1815 	/* conn->hchan is NULL after l2cap_conn_del() was called */
1816 	if (!conn->hchan) {
1817 		ret = -ENODEV;
1818 		goto out_unlock;
1819 	}
1820 
1821 	ret = user->probe(conn, user);
1822 	if (ret)
1823 		goto out_unlock;
1824 
1825 	list_add(&user->list, &conn->users);
1826 	ret = 0;
1827 
1828 out_unlock:
1829 	hci_dev_unlock(hdev);
1830 	return ret;
1831 }
1832 EXPORT_SYMBOL(l2cap_register_user);
1833 
1834 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1835 {
1836 	struct hci_dev *hdev = conn->hcon->hdev;
1837 
1838 	hci_dev_lock(hdev);
1839 
1840 	if (list_empty(&user->list))
1841 		goto out_unlock;
1842 
1843 	list_del_init(&user->list);
1844 	user->remove(conn, user);
1845 
1846 out_unlock:
1847 	hci_dev_unlock(hdev);
1848 }
1849 EXPORT_SYMBOL(l2cap_unregister_user);
1850 
1851 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1852 {
1853 	struct l2cap_user *user;
1854 
1855 	while (!list_empty(&conn->users)) {
1856 		user = list_first_entry(&conn->users, struct l2cap_user, list);
1857 		list_del_init(&user->list);
1858 		user->remove(conn, user);
1859 	}
1860 }
1861 
1862 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1863 {
1864 	struct l2cap_conn *conn = hcon->l2cap_data;
1865 	struct l2cap_chan *chan, *l;
1866 
1867 	if (!conn)
1868 		return;
1869 
1870 	BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1871 
1872 	kfree_skb(conn->rx_skb);
1873 
1874 	skb_queue_purge(&conn->pending_rx);
1875 
1876 	/* We can not call flush_work(&conn->pending_rx_work) here since we
1877 	 * might block if we are running on a worker from the same workqueue
1878 	 * pending_rx_work is waiting on.
1879 	 */
1880 	if (work_pending(&conn->pending_rx_work))
1881 		cancel_work_sync(&conn->pending_rx_work);
1882 
1883 	if (work_pending(&conn->id_addr_update_work))
1884 		cancel_work_sync(&conn->id_addr_update_work);
1885 
1886 	l2cap_unregister_all_users(conn);
1887 
1888 	/* Force the connection to be immediately dropped */
1889 	hcon->disc_timeout = 0;
1890 
1891 	mutex_lock(&conn->chan_lock);
1892 
1893 	/* Kill channels */
1894 	list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1895 		l2cap_chan_hold(chan);
1896 		l2cap_chan_lock(chan);
1897 
1898 		l2cap_chan_del(chan, err);
1899 
1900 		chan->ops->close(chan);
1901 
1902 		l2cap_chan_unlock(chan);
1903 		l2cap_chan_put(chan);
1904 	}
1905 
1906 	mutex_unlock(&conn->chan_lock);
1907 
1908 	hci_chan_del(conn->hchan);
1909 
1910 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1911 		cancel_delayed_work_sync(&conn->info_timer);
1912 
1913 	hcon->l2cap_data = NULL;
1914 	conn->hchan = NULL;
1915 	l2cap_conn_put(conn);
1916 }
1917 
1918 static void l2cap_conn_free(struct kref *ref)
1919 {
1920 	struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1921 
1922 	hci_conn_put(conn->hcon);
1923 	kfree(conn);
1924 }
1925 
1926 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1927 {
1928 	kref_get(&conn->ref);
1929 	return conn;
1930 }
1931 EXPORT_SYMBOL(l2cap_conn_get);
1932 
1933 void l2cap_conn_put(struct l2cap_conn *conn)
1934 {
1935 	kref_put(&conn->ref, l2cap_conn_free);
1936 }
1937 EXPORT_SYMBOL(l2cap_conn_put);
1938 
1939 /* ---- Socket interface ---- */
1940 
1941 /* Find socket with psm and source / destination bdaddr.
1942  * Returns closest match.
1943  */
1944 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1945 						   bdaddr_t *src,
1946 						   bdaddr_t *dst,
1947 						   u8 link_type)
1948 {
1949 	struct l2cap_chan *c, *c1 = NULL;
1950 
1951 	read_lock(&chan_list_lock);
1952 
1953 	list_for_each_entry(c, &chan_list, global_l) {
1954 		if (state && c->state != state)
1955 			continue;
1956 
1957 		if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1958 			continue;
1959 
1960 		if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1961 			continue;
1962 
1963 		if (c->psm == psm) {
1964 			int src_match, dst_match;
1965 			int src_any, dst_any;
1966 
1967 			/* Exact match. */
1968 			src_match = !bacmp(&c->src, src);
1969 			dst_match = !bacmp(&c->dst, dst);
1970 			if (src_match && dst_match) {
1971 				l2cap_chan_hold(c);
1972 				read_unlock(&chan_list_lock);
1973 				return c;
1974 			}
1975 
1976 			/* Closest match */
1977 			src_any = !bacmp(&c->src, BDADDR_ANY);
1978 			dst_any = !bacmp(&c->dst, BDADDR_ANY);
1979 			if ((src_match && dst_any) || (src_any && dst_match) ||
1980 			    (src_any && dst_any))
1981 				c1 = c;
1982 		}
1983 	}
1984 
1985 	if (c1)
1986 		l2cap_chan_hold(c1);
1987 
1988 	read_unlock(&chan_list_lock);
1989 
1990 	return c1;
1991 }
1992 
1993 static void l2cap_monitor_timeout(struct work_struct *work)
1994 {
1995 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1996 					       monitor_timer.work);
1997 
1998 	BT_DBG("chan %p", chan);
1999 
2000 	l2cap_chan_lock(chan);
2001 
2002 	if (!chan->conn) {
2003 		l2cap_chan_unlock(chan);
2004 		l2cap_chan_put(chan);
2005 		return;
2006 	}
2007 
2008 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
2009 
2010 	l2cap_chan_unlock(chan);
2011 	l2cap_chan_put(chan);
2012 }
2013 
2014 static void l2cap_retrans_timeout(struct work_struct *work)
2015 {
2016 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2017 					       retrans_timer.work);
2018 
2019 	BT_DBG("chan %p", chan);
2020 
2021 	l2cap_chan_lock(chan);
2022 
2023 	if (!chan->conn) {
2024 		l2cap_chan_unlock(chan);
2025 		l2cap_chan_put(chan);
2026 		return;
2027 	}
2028 
2029 	l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
2030 	l2cap_chan_unlock(chan);
2031 	l2cap_chan_put(chan);
2032 }
2033 
2034 static void l2cap_streaming_send(struct l2cap_chan *chan,
2035 				 struct sk_buff_head *skbs)
2036 {
2037 	struct sk_buff *skb;
2038 	struct l2cap_ctrl *control;
2039 
2040 	BT_DBG("chan %p, skbs %p", chan, skbs);
2041 
2042 	if (__chan_is_moving(chan))
2043 		return;
2044 
2045 	skb_queue_splice_tail_init(skbs, &chan->tx_q);
2046 
2047 	while (!skb_queue_empty(&chan->tx_q)) {
2048 
2049 		skb = skb_dequeue(&chan->tx_q);
2050 
2051 		bt_cb(skb)->l2cap.retries = 1;
2052 		control = &bt_cb(skb)->l2cap;
2053 
2054 		control->reqseq = 0;
2055 		control->txseq = chan->next_tx_seq;
2056 
2057 		__pack_control(chan, control, skb);
2058 
2059 		if (chan->fcs == L2CAP_FCS_CRC16) {
2060 			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2061 			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
2062 		}
2063 
2064 		l2cap_do_send(chan, skb);
2065 
2066 		BT_DBG("Sent txseq %u", control->txseq);
2067 
2068 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2069 		chan->frames_sent++;
2070 	}
2071 }
2072 
2073 static int l2cap_ertm_send(struct l2cap_chan *chan)
2074 {
2075 	struct sk_buff *skb, *tx_skb;
2076 	struct l2cap_ctrl *control;
2077 	int sent = 0;
2078 
2079 	BT_DBG("chan %p", chan);
2080 
2081 	if (chan->state != BT_CONNECTED)
2082 		return -ENOTCONN;
2083 
2084 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2085 		return 0;
2086 
2087 	if (__chan_is_moving(chan))
2088 		return 0;
2089 
2090 	while (chan->tx_send_head &&
2091 	       chan->unacked_frames < chan->remote_tx_win &&
2092 	       chan->tx_state == L2CAP_TX_STATE_XMIT) {
2093 
2094 		skb = chan->tx_send_head;
2095 
2096 		bt_cb(skb)->l2cap.retries = 1;
2097 		control = &bt_cb(skb)->l2cap;
2098 
2099 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2100 			control->final = 1;
2101 
2102 		control->reqseq = chan->buffer_seq;
2103 		chan->last_acked_seq = chan->buffer_seq;
2104 		control->txseq = chan->next_tx_seq;
2105 
2106 		__pack_control(chan, control, skb);
2107 
2108 		if (chan->fcs == L2CAP_FCS_CRC16) {
2109 			u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2110 			put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
2111 		}
2112 
2113 		/* Clone after data has been modified. Data is assumed to be
2114 		   read-only (for locking purposes) on cloned sk_buffs.
2115 		 */
2116 		tx_skb = skb_clone(skb, GFP_KERNEL);
2117 
2118 		if (!tx_skb)
2119 			break;
2120 
2121 		__set_retrans_timer(chan);
2122 
2123 		chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2124 		chan->unacked_frames++;
2125 		chan->frames_sent++;
2126 		sent++;
2127 
2128 		if (skb_queue_is_last(&chan->tx_q, skb))
2129 			chan->tx_send_head = NULL;
2130 		else
2131 			chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2132 
2133 		l2cap_do_send(chan, tx_skb);
2134 		BT_DBG("Sent txseq %u", control->txseq);
2135 	}
2136 
2137 	BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2138 	       chan->unacked_frames, skb_queue_len(&chan->tx_q));
2139 
2140 	return sent;
2141 }
2142 
2143 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2144 {
2145 	struct l2cap_ctrl control;
2146 	struct sk_buff *skb;
2147 	struct sk_buff *tx_skb;
2148 	u16 seq;
2149 
2150 	BT_DBG("chan %p", chan);
2151 
2152 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2153 		return;
2154 
2155 	if (__chan_is_moving(chan))
2156 		return;
2157 
2158 	while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2159 		seq = l2cap_seq_list_pop(&chan->retrans_list);
2160 
2161 		skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2162 		if (!skb) {
2163 			BT_DBG("Error: Can't retransmit seq %d, frame missing",
2164 			       seq);
2165 			continue;
2166 		}
2167 
2168 		bt_cb(skb)->l2cap.retries++;
2169 		control = bt_cb(skb)->l2cap;
2170 
2171 		if (chan->max_tx != 0 &&
2172 		    bt_cb(skb)->l2cap.retries > chan->max_tx) {
2173 			BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2174 			l2cap_send_disconn_req(chan, ECONNRESET);
2175 			l2cap_seq_list_clear(&chan->retrans_list);
2176 			break;
2177 		}
2178 
2179 		control.reqseq = chan->buffer_seq;
2180 		if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2181 			control.final = 1;
2182 		else
2183 			control.final = 0;
2184 
2185 		if (skb_cloned(skb)) {
2186 			/* Cloned sk_buffs are read-only, so we need a
2187 			 * writeable copy
2188 			 */
2189 			tx_skb = skb_copy(skb, GFP_KERNEL);
2190 		} else {
2191 			tx_skb = skb_clone(skb, GFP_KERNEL);
2192 		}
2193 
2194 		if (!tx_skb) {
2195 			l2cap_seq_list_clear(&chan->retrans_list);
2196 			break;
2197 		}
2198 
2199 		/* Update skb contents */
2200 		if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2201 			put_unaligned_le32(__pack_extended_control(&control),
2202 					   tx_skb->data + L2CAP_HDR_SIZE);
2203 		} else {
2204 			put_unaligned_le16(__pack_enhanced_control(&control),
2205 					   tx_skb->data + L2CAP_HDR_SIZE);
2206 		}
2207 
2208 		/* Update FCS */
2209 		if (chan->fcs == L2CAP_FCS_CRC16) {
2210 			u16 fcs = crc16(0, (u8 *) tx_skb->data,
2211 					tx_skb->len - L2CAP_FCS_SIZE);
2212 			put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2213 						L2CAP_FCS_SIZE);
2214 		}
2215 
2216 		l2cap_do_send(chan, tx_skb);
2217 
2218 		BT_DBG("Resent txseq %d", control.txseq);
2219 
2220 		chan->last_acked_seq = chan->buffer_seq;
2221 	}
2222 }
2223 
2224 static void l2cap_retransmit(struct l2cap_chan *chan,
2225 			     struct l2cap_ctrl *control)
2226 {
2227 	BT_DBG("chan %p, control %p", chan, control);
2228 
2229 	l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2230 	l2cap_ertm_resend(chan);
2231 }
2232 
2233 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2234 				 struct l2cap_ctrl *control)
2235 {
2236 	struct sk_buff *skb;
2237 
2238 	BT_DBG("chan %p, control %p", chan, control);
2239 
2240 	if (control->poll)
2241 		set_bit(CONN_SEND_FBIT, &chan->conn_state);
2242 
2243 	l2cap_seq_list_clear(&chan->retrans_list);
2244 
2245 	if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2246 		return;
2247 
2248 	if (chan->unacked_frames) {
2249 		skb_queue_walk(&chan->tx_q, skb) {
2250 			if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2251 			    skb == chan->tx_send_head)
2252 				break;
2253 		}
2254 
2255 		skb_queue_walk_from(&chan->tx_q, skb) {
2256 			if (skb == chan->tx_send_head)
2257 				break;
2258 
2259 			l2cap_seq_list_append(&chan->retrans_list,
2260 					      bt_cb(skb)->l2cap.txseq);
2261 		}
2262 
2263 		l2cap_ertm_resend(chan);
2264 	}
2265 }
2266 
2267 static void l2cap_send_ack(struct l2cap_chan *chan)
2268 {
2269 	struct l2cap_ctrl control;
2270 	u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2271 					 chan->last_acked_seq);
2272 	int threshold;
2273 
2274 	BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2275 	       chan, chan->last_acked_seq, chan->buffer_seq);
2276 
2277 	memset(&control, 0, sizeof(control));
2278 	control.sframe = 1;
2279 
2280 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2281 	    chan->rx_state == L2CAP_RX_STATE_RECV) {
2282 		__clear_ack_timer(chan);
2283 		control.super = L2CAP_SUPER_RNR;
2284 		control.reqseq = chan->buffer_seq;
2285 		l2cap_send_sframe(chan, &control);
2286 	} else {
2287 		if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2288 			l2cap_ertm_send(chan);
2289 			/* If any i-frames were sent, they included an ack */
2290 			if (chan->buffer_seq == chan->last_acked_seq)
2291 				frames_to_ack = 0;
2292 		}
2293 
2294 		/* Ack now if the window is 3/4ths full.
2295 		 * Calculate without mul or div
2296 		 */
2297 		threshold = chan->ack_win;
2298 		threshold += threshold << 1;
2299 		threshold >>= 2;
2300 
2301 		BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2302 		       threshold);
2303 
2304 		if (frames_to_ack >= threshold) {
2305 			__clear_ack_timer(chan);
2306 			control.super = L2CAP_SUPER_RR;
2307 			control.reqseq = chan->buffer_seq;
2308 			l2cap_send_sframe(chan, &control);
2309 			frames_to_ack = 0;
2310 		}
2311 
2312 		if (frames_to_ack)
2313 			__set_ack_timer(chan);
2314 	}
2315 }
2316 
2317 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2318 					 struct msghdr *msg, int len,
2319 					 int count, struct sk_buff *skb)
2320 {
2321 	struct l2cap_conn *conn = chan->conn;
2322 	struct sk_buff **frag;
2323 	int sent = 0;
2324 
2325 	if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2326 		return -EFAULT;
2327 
2328 	sent += count;
2329 	len  -= count;
2330 
2331 	/* Continuation fragments (no L2CAP header) */
2332 	frag = &skb_shinfo(skb)->frag_list;
2333 	while (len) {
2334 		struct sk_buff *tmp;
2335 
2336 		count = min_t(unsigned int, conn->mtu, len);
2337 
2338 		tmp = chan->ops->alloc_skb(chan, 0, count,
2339 					   msg->msg_flags & MSG_DONTWAIT);
2340 		if (IS_ERR(tmp))
2341 			return PTR_ERR(tmp);
2342 
2343 		*frag = tmp;
2344 
2345 		if (!copy_from_iter_full(skb_put(*frag, count), count,
2346 				   &msg->msg_iter))
2347 			return -EFAULT;
2348 
2349 		sent += count;
2350 		len  -= count;
2351 
2352 		skb->len += (*frag)->len;
2353 		skb->data_len += (*frag)->len;
2354 
2355 		frag = &(*frag)->next;
2356 	}
2357 
2358 	return sent;
2359 }
2360 
2361 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2362 						 struct msghdr *msg, size_t len)
2363 {
2364 	struct l2cap_conn *conn = chan->conn;
2365 	struct sk_buff *skb;
2366 	int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2367 	struct l2cap_hdr *lh;
2368 
2369 	BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2370 	       __le16_to_cpu(chan->psm), len);
2371 
2372 	count = min_t(unsigned int, (conn->mtu - hlen), len);
2373 
2374 	skb = chan->ops->alloc_skb(chan, hlen, count,
2375 				   msg->msg_flags & MSG_DONTWAIT);
2376 	if (IS_ERR(skb))
2377 		return skb;
2378 
2379 	/* Create L2CAP header */
2380 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2381 	lh->cid = cpu_to_le16(chan->dcid);
2382 	lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2383 	put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2384 
2385 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2386 	if (unlikely(err < 0)) {
2387 		kfree_skb(skb);
2388 		return ERR_PTR(err);
2389 	}
2390 	return skb;
2391 }
2392 
2393 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2394 					      struct msghdr *msg, size_t len)
2395 {
2396 	struct l2cap_conn *conn = chan->conn;
2397 	struct sk_buff *skb;
2398 	int err, count;
2399 	struct l2cap_hdr *lh;
2400 
2401 	BT_DBG("chan %p len %zu", chan, len);
2402 
2403 	count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2404 
2405 	skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2406 				   msg->msg_flags & MSG_DONTWAIT);
2407 	if (IS_ERR(skb))
2408 		return skb;
2409 
2410 	/* Create L2CAP header */
2411 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2412 	lh->cid = cpu_to_le16(chan->dcid);
2413 	lh->len = cpu_to_le16(len);
2414 
2415 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2416 	if (unlikely(err < 0)) {
2417 		kfree_skb(skb);
2418 		return ERR_PTR(err);
2419 	}
2420 	return skb;
2421 }
2422 
2423 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2424 					       struct msghdr *msg, size_t len,
2425 					       u16 sdulen)
2426 {
2427 	struct l2cap_conn *conn = chan->conn;
2428 	struct sk_buff *skb;
2429 	int err, count, hlen;
2430 	struct l2cap_hdr *lh;
2431 
2432 	BT_DBG("chan %p len %zu", chan, len);
2433 
2434 	if (!conn)
2435 		return ERR_PTR(-ENOTCONN);
2436 
2437 	hlen = __ertm_hdr_size(chan);
2438 
2439 	if (sdulen)
2440 		hlen += L2CAP_SDULEN_SIZE;
2441 
2442 	if (chan->fcs == L2CAP_FCS_CRC16)
2443 		hlen += L2CAP_FCS_SIZE;
2444 
2445 	count = min_t(unsigned int, (conn->mtu - hlen), len);
2446 
2447 	skb = chan->ops->alloc_skb(chan, hlen, count,
2448 				   msg->msg_flags & MSG_DONTWAIT);
2449 	if (IS_ERR(skb))
2450 		return skb;
2451 
2452 	/* Create L2CAP header */
2453 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2454 	lh->cid = cpu_to_le16(chan->dcid);
2455 	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2456 
2457 	/* Control header is populated later */
2458 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2459 		put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2460 	else
2461 		put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2462 
2463 	if (sdulen)
2464 		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2465 
2466 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2467 	if (unlikely(err < 0)) {
2468 		kfree_skb(skb);
2469 		return ERR_PTR(err);
2470 	}
2471 
2472 	bt_cb(skb)->l2cap.fcs = chan->fcs;
2473 	bt_cb(skb)->l2cap.retries = 0;
2474 	return skb;
2475 }
2476 
2477 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2478 			     struct sk_buff_head *seg_queue,
2479 			     struct msghdr *msg, size_t len)
2480 {
2481 	struct sk_buff *skb;
2482 	u16 sdu_len;
2483 	size_t pdu_len;
2484 	u8 sar;
2485 
2486 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2487 
2488 	/* It is critical that ERTM PDUs fit in a single HCI fragment,
2489 	 * so fragmented skbs are not used.  The HCI layer's handling
2490 	 * of fragmented skbs is not compatible with ERTM's queueing.
2491 	 */
2492 
2493 	/* PDU size is derived from the HCI MTU */
2494 	pdu_len = chan->conn->mtu;
2495 
2496 	/* Constrain PDU size for BR/EDR connections */
2497 	if (!chan->hs_hcon)
2498 		pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2499 
2500 	/* Adjust for largest possible L2CAP overhead. */
2501 	if (chan->fcs)
2502 		pdu_len -= L2CAP_FCS_SIZE;
2503 
2504 	pdu_len -= __ertm_hdr_size(chan);
2505 
2506 	/* Remote device may have requested smaller PDUs */
2507 	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2508 
2509 	if (len <= pdu_len) {
2510 		sar = L2CAP_SAR_UNSEGMENTED;
2511 		sdu_len = 0;
2512 		pdu_len = len;
2513 	} else {
2514 		sar = L2CAP_SAR_START;
2515 		sdu_len = len;
2516 	}
2517 
2518 	while (len > 0) {
2519 		skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2520 
2521 		if (IS_ERR(skb)) {
2522 			__skb_queue_purge(seg_queue);
2523 			return PTR_ERR(skb);
2524 		}
2525 
2526 		bt_cb(skb)->l2cap.sar = sar;
2527 		__skb_queue_tail(seg_queue, skb);
2528 
2529 		len -= pdu_len;
2530 		if (sdu_len)
2531 			sdu_len = 0;
2532 
2533 		if (len <= pdu_len) {
2534 			sar = L2CAP_SAR_END;
2535 			pdu_len = len;
2536 		} else {
2537 			sar = L2CAP_SAR_CONTINUE;
2538 		}
2539 	}
2540 
2541 	return 0;
2542 }
2543 
2544 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2545 						   struct msghdr *msg,
2546 						   size_t len, u16 sdulen)
2547 {
2548 	struct l2cap_conn *conn = chan->conn;
2549 	struct sk_buff *skb;
2550 	int err, count, hlen;
2551 	struct l2cap_hdr *lh;
2552 
2553 	BT_DBG("chan %p len %zu", chan, len);
2554 
2555 	if (!conn)
2556 		return ERR_PTR(-ENOTCONN);
2557 
2558 	hlen = L2CAP_HDR_SIZE;
2559 
2560 	if (sdulen)
2561 		hlen += L2CAP_SDULEN_SIZE;
2562 
2563 	count = min_t(unsigned int, (conn->mtu - hlen), len);
2564 
2565 	skb = chan->ops->alloc_skb(chan, hlen, count,
2566 				   msg->msg_flags & MSG_DONTWAIT);
2567 	if (IS_ERR(skb))
2568 		return skb;
2569 
2570 	/* Create L2CAP header */
2571 	lh = skb_put(skb, L2CAP_HDR_SIZE);
2572 	lh->cid = cpu_to_le16(chan->dcid);
2573 	lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2574 
2575 	if (sdulen)
2576 		put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2577 
2578 	err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2579 	if (unlikely(err < 0)) {
2580 		kfree_skb(skb);
2581 		return ERR_PTR(err);
2582 	}
2583 
2584 	return skb;
2585 }
2586 
2587 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2588 				struct sk_buff_head *seg_queue,
2589 				struct msghdr *msg, size_t len)
2590 {
2591 	struct sk_buff *skb;
2592 	size_t pdu_len;
2593 	u16 sdu_len;
2594 
2595 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2596 
2597 	sdu_len = len;
2598 	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2599 
2600 	while (len > 0) {
2601 		if (len <= pdu_len)
2602 			pdu_len = len;
2603 
2604 		skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2605 		if (IS_ERR(skb)) {
2606 			__skb_queue_purge(seg_queue);
2607 			return PTR_ERR(skb);
2608 		}
2609 
2610 		__skb_queue_tail(seg_queue, skb);
2611 
2612 		len -= pdu_len;
2613 
2614 		if (sdu_len) {
2615 			sdu_len = 0;
2616 			pdu_len += L2CAP_SDULEN_SIZE;
2617 		}
2618 	}
2619 
2620 	return 0;
2621 }
2622 
2623 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2624 {
2625 	int sent = 0;
2626 
2627 	BT_DBG("chan %p", chan);
2628 
2629 	while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2630 		l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2631 		chan->tx_credits--;
2632 		sent++;
2633 	}
2634 
2635 	BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2636 	       skb_queue_len(&chan->tx_q));
2637 }
2638 
2639 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2640 {
2641 	struct sk_buff *skb;
2642 	int err;
2643 	struct sk_buff_head seg_queue;
2644 
2645 	if (!chan->conn)
2646 		return -ENOTCONN;
2647 
2648 	/* Connectionless channel */
2649 	if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2650 		skb = l2cap_create_connless_pdu(chan, msg, len);
2651 		if (IS_ERR(skb))
2652 			return PTR_ERR(skb);
2653 
2654 		/* Channel lock is released before requesting new skb and then
2655 		 * reacquired thus we need to recheck channel state.
2656 		 */
2657 		if (chan->state != BT_CONNECTED) {
2658 			kfree_skb(skb);
2659 			return -ENOTCONN;
2660 		}
2661 
2662 		l2cap_do_send(chan, skb);
2663 		return len;
2664 	}
2665 
2666 	switch (chan->mode) {
2667 	case L2CAP_MODE_LE_FLOWCTL:
2668 	case L2CAP_MODE_EXT_FLOWCTL:
2669 		/* Check outgoing MTU */
2670 		if (len > chan->omtu)
2671 			return -EMSGSIZE;
2672 
2673 		__skb_queue_head_init(&seg_queue);
2674 
2675 		err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2676 
2677 		if (chan->state != BT_CONNECTED) {
2678 			__skb_queue_purge(&seg_queue);
2679 			err = -ENOTCONN;
2680 		}
2681 
2682 		if (err)
2683 			return err;
2684 
2685 		skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2686 
2687 		l2cap_le_flowctl_send(chan);
2688 
2689 		if (!chan->tx_credits)
2690 			chan->ops->suspend(chan);
2691 
2692 		err = len;
2693 
2694 		break;
2695 
2696 	case L2CAP_MODE_BASIC:
2697 		/* Check outgoing MTU */
2698 		if (len > chan->omtu)
2699 			return -EMSGSIZE;
2700 
2701 		/* Create a basic PDU */
2702 		skb = l2cap_create_basic_pdu(chan, msg, len);
2703 		if (IS_ERR(skb))
2704 			return PTR_ERR(skb);
2705 
2706 		/* Channel lock is released before requesting new skb and then
2707 		 * reacquired thus we need to recheck channel state.
2708 		 */
2709 		if (chan->state != BT_CONNECTED) {
2710 			kfree_skb(skb);
2711 			return -ENOTCONN;
2712 		}
2713 
2714 		l2cap_do_send(chan, skb);
2715 		err = len;
2716 		break;
2717 
2718 	case L2CAP_MODE_ERTM:
2719 	case L2CAP_MODE_STREAMING:
2720 		/* Check outgoing MTU */
2721 		if (len > chan->omtu) {
2722 			err = -EMSGSIZE;
2723 			break;
2724 		}
2725 
2726 		__skb_queue_head_init(&seg_queue);
2727 
2728 		/* Do segmentation before calling in to the state machine,
2729 		 * since it's possible to block while waiting for memory
2730 		 * allocation.
2731 		 */
2732 		err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2733 
2734 		/* The channel could have been closed while segmenting,
2735 		 * check that it is still connected.
2736 		 */
2737 		if (chan->state != BT_CONNECTED) {
2738 			__skb_queue_purge(&seg_queue);
2739 			err = -ENOTCONN;
2740 		}
2741 
2742 		if (err)
2743 			break;
2744 
2745 		if (chan->mode == L2CAP_MODE_ERTM)
2746 			l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2747 		else
2748 			l2cap_streaming_send(chan, &seg_queue);
2749 
2750 		err = len;
2751 
2752 		/* If the skbs were not queued for sending, they'll still be in
2753 		 * seg_queue and need to be purged.
2754 		 */
2755 		__skb_queue_purge(&seg_queue);
2756 		break;
2757 
2758 	default:
2759 		BT_DBG("bad state %1.1x", chan->mode);
2760 		err = -EBADFD;
2761 	}
2762 
2763 	return err;
2764 }
2765 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2766 
2767 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2768 {
2769 	struct l2cap_ctrl control;
2770 	u16 seq;
2771 
2772 	BT_DBG("chan %p, txseq %u", chan, txseq);
2773 
2774 	memset(&control, 0, sizeof(control));
2775 	control.sframe = 1;
2776 	control.super = L2CAP_SUPER_SREJ;
2777 
2778 	for (seq = chan->expected_tx_seq; seq != txseq;
2779 	     seq = __next_seq(chan, seq)) {
2780 		if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2781 			control.reqseq = seq;
2782 			l2cap_send_sframe(chan, &control);
2783 			l2cap_seq_list_append(&chan->srej_list, seq);
2784 		}
2785 	}
2786 
2787 	chan->expected_tx_seq = __next_seq(chan, txseq);
2788 }
2789 
2790 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2791 {
2792 	struct l2cap_ctrl control;
2793 
2794 	BT_DBG("chan %p", chan);
2795 
2796 	if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2797 		return;
2798 
2799 	memset(&control, 0, sizeof(control));
2800 	control.sframe = 1;
2801 	control.super = L2CAP_SUPER_SREJ;
2802 	control.reqseq = chan->srej_list.tail;
2803 	l2cap_send_sframe(chan, &control);
2804 }
2805 
2806 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2807 {
2808 	struct l2cap_ctrl control;
2809 	u16 initial_head;
2810 	u16 seq;
2811 
2812 	BT_DBG("chan %p, txseq %u", chan, txseq);
2813 
2814 	memset(&control, 0, sizeof(control));
2815 	control.sframe = 1;
2816 	control.super = L2CAP_SUPER_SREJ;
2817 
2818 	/* Capture initial list head to allow only one pass through the list. */
2819 	initial_head = chan->srej_list.head;
2820 
2821 	do {
2822 		seq = l2cap_seq_list_pop(&chan->srej_list);
2823 		if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2824 			break;
2825 
2826 		control.reqseq = seq;
2827 		l2cap_send_sframe(chan, &control);
2828 		l2cap_seq_list_append(&chan->srej_list, seq);
2829 	} while (chan->srej_list.head != initial_head);
2830 }
2831 
2832 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2833 {
2834 	struct sk_buff *acked_skb;
2835 	u16 ackseq;
2836 
2837 	BT_DBG("chan %p, reqseq %u", chan, reqseq);
2838 
2839 	if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2840 		return;
2841 
2842 	BT_DBG("expected_ack_seq %u, unacked_frames %u",
2843 	       chan->expected_ack_seq, chan->unacked_frames);
2844 
2845 	for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2846 	     ackseq = __next_seq(chan, ackseq)) {
2847 
2848 		acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2849 		if (acked_skb) {
2850 			skb_unlink(acked_skb, &chan->tx_q);
2851 			kfree_skb(acked_skb);
2852 			chan->unacked_frames--;
2853 		}
2854 	}
2855 
2856 	chan->expected_ack_seq = reqseq;
2857 
2858 	if (chan->unacked_frames == 0)
2859 		__clear_retrans_timer(chan);
2860 
2861 	BT_DBG("unacked_frames %u", chan->unacked_frames);
2862 }
2863 
2864 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2865 {
2866 	BT_DBG("chan %p", chan);
2867 
2868 	chan->expected_tx_seq = chan->buffer_seq;
2869 	l2cap_seq_list_clear(&chan->srej_list);
2870 	skb_queue_purge(&chan->srej_q);
2871 	chan->rx_state = L2CAP_RX_STATE_RECV;
2872 }
2873 
2874 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2875 				struct l2cap_ctrl *control,
2876 				struct sk_buff_head *skbs, u8 event)
2877 {
2878 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2879 	       event);
2880 
2881 	switch (event) {
2882 	case L2CAP_EV_DATA_REQUEST:
2883 		if (chan->tx_send_head == NULL)
2884 			chan->tx_send_head = skb_peek(skbs);
2885 
2886 		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2887 		l2cap_ertm_send(chan);
2888 		break;
2889 	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2890 		BT_DBG("Enter LOCAL_BUSY");
2891 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2892 
2893 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2894 			/* The SREJ_SENT state must be aborted if we are to
2895 			 * enter the LOCAL_BUSY state.
2896 			 */
2897 			l2cap_abort_rx_srej_sent(chan);
2898 		}
2899 
2900 		l2cap_send_ack(chan);
2901 
2902 		break;
2903 	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2904 		BT_DBG("Exit LOCAL_BUSY");
2905 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2906 
2907 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2908 			struct l2cap_ctrl local_control;
2909 
2910 			memset(&local_control, 0, sizeof(local_control));
2911 			local_control.sframe = 1;
2912 			local_control.super = L2CAP_SUPER_RR;
2913 			local_control.poll = 1;
2914 			local_control.reqseq = chan->buffer_seq;
2915 			l2cap_send_sframe(chan, &local_control);
2916 
2917 			chan->retry_count = 1;
2918 			__set_monitor_timer(chan);
2919 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2920 		}
2921 		break;
2922 	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2923 		l2cap_process_reqseq(chan, control->reqseq);
2924 		break;
2925 	case L2CAP_EV_EXPLICIT_POLL:
2926 		l2cap_send_rr_or_rnr(chan, 1);
2927 		chan->retry_count = 1;
2928 		__set_monitor_timer(chan);
2929 		__clear_ack_timer(chan);
2930 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2931 		break;
2932 	case L2CAP_EV_RETRANS_TO:
2933 		l2cap_send_rr_or_rnr(chan, 1);
2934 		chan->retry_count = 1;
2935 		__set_monitor_timer(chan);
2936 		chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2937 		break;
2938 	case L2CAP_EV_RECV_FBIT:
2939 		/* Nothing to process */
2940 		break;
2941 	default:
2942 		break;
2943 	}
2944 }
2945 
2946 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2947 				  struct l2cap_ctrl *control,
2948 				  struct sk_buff_head *skbs, u8 event)
2949 {
2950 	BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2951 	       event);
2952 
2953 	switch (event) {
2954 	case L2CAP_EV_DATA_REQUEST:
2955 		if (chan->tx_send_head == NULL)
2956 			chan->tx_send_head = skb_peek(skbs);
2957 		/* Queue data, but don't send. */
2958 		skb_queue_splice_tail_init(skbs, &chan->tx_q);
2959 		break;
2960 	case L2CAP_EV_LOCAL_BUSY_DETECTED:
2961 		BT_DBG("Enter LOCAL_BUSY");
2962 		set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2963 
2964 		if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2965 			/* The SREJ_SENT state must be aborted if we are to
2966 			 * enter the LOCAL_BUSY state.
2967 			 */
2968 			l2cap_abort_rx_srej_sent(chan);
2969 		}
2970 
2971 		l2cap_send_ack(chan);
2972 
2973 		break;
2974 	case L2CAP_EV_LOCAL_BUSY_CLEAR:
2975 		BT_DBG("Exit LOCAL_BUSY");
2976 		clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2977 
2978 		if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2979 			struct l2cap_ctrl local_control;
2980 			memset(&local_control, 0, sizeof(local_control));
2981 			local_control.sframe = 1;
2982 			local_control.super = L2CAP_SUPER_RR;
2983 			local_control.poll = 1;
2984 			local_control.reqseq = chan->buffer_seq;
2985 			l2cap_send_sframe(chan, &local_control);
2986 
2987 			chan->retry_count = 1;
2988 			__set_monitor_timer(chan);
2989 			chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2990 		}
2991 		break;
2992 	case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2993 		l2cap_process_reqseq(chan, control->reqseq);
2994 		fallthrough;
2995 
2996 	case L2CAP_EV_RECV_FBIT:
2997 		if (control && control->final) {
2998 			__clear_monitor_timer(chan);
2999 			if (chan->unacked_frames > 0)
3000 				__set_retrans_timer(chan);
3001 			chan->retry_count = 0;
3002 			chan->tx_state = L2CAP_TX_STATE_XMIT;
3003 			BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
3004 		}
3005 		break;
3006 	case L2CAP_EV_EXPLICIT_POLL:
3007 		/* Ignore */
3008 		break;
3009 	case L2CAP_EV_MONITOR_TO:
3010 		if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
3011 			l2cap_send_rr_or_rnr(chan, 1);
3012 			__set_monitor_timer(chan);
3013 			chan->retry_count++;
3014 		} else {
3015 			l2cap_send_disconn_req(chan, ECONNABORTED);
3016 		}
3017 		break;
3018 	default:
3019 		break;
3020 	}
3021 }
3022 
3023 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
3024 		     struct sk_buff_head *skbs, u8 event)
3025 {
3026 	BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
3027 	       chan, control, skbs, event, chan->tx_state);
3028 
3029 	switch (chan->tx_state) {
3030 	case L2CAP_TX_STATE_XMIT:
3031 		l2cap_tx_state_xmit(chan, control, skbs, event);
3032 		break;
3033 	case L2CAP_TX_STATE_WAIT_F:
3034 		l2cap_tx_state_wait_f(chan, control, skbs, event);
3035 		break;
3036 	default:
3037 		/* Ignore event */
3038 		break;
3039 	}
3040 }
3041 
3042 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
3043 			     struct l2cap_ctrl *control)
3044 {
3045 	BT_DBG("chan %p, control %p", chan, control);
3046 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
3047 }
3048 
3049 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
3050 				  struct l2cap_ctrl *control)
3051 {
3052 	BT_DBG("chan %p, control %p", chan, control);
3053 	l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
3054 }
3055 
3056 /* Copy frame to all raw sockets on that connection */
3057 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
3058 {
3059 	struct sk_buff *nskb;
3060 	struct l2cap_chan *chan;
3061 
3062 	BT_DBG("conn %p", conn);
3063 
3064 	mutex_lock(&conn->chan_lock);
3065 
3066 	list_for_each_entry(chan, &conn->chan_l, list) {
3067 		if (chan->chan_type != L2CAP_CHAN_RAW)
3068 			continue;
3069 
3070 		/* Don't send frame to the channel it came from */
3071 		if (bt_cb(skb)->l2cap.chan == chan)
3072 			continue;
3073 
3074 		nskb = skb_clone(skb, GFP_KERNEL);
3075 		if (!nskb)
3076 			continue;
3077 		if (chan->ops->recv(chan, nskb))
3078 			kfree_skb(nskb);
3079 	}
3080 
3081 	mutex_unlock(&conn->chan_lock);
3082 }
3083 
3084 /* ---- L2CAP signalling commands ---- */
3085 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
3086 				       u8 ident, u16 dlen, void *data)
3087 {
3088 	struct sk_buff *skb, **frag;
3089 	struct l2cap_cmd_hdr *cmd;
3090 	struct l2cap_hdr *lh;
3091 	int len, count;
3092 
3093 	BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
3094 	       conn, code, ident, dlen);
3095 
3096 	if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
3097 		return NULL;
3098 
3099 	len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
3100 	count = min_t(unsigned int, conn->mtu, len);
3101 
3102 	skb = bt_skb_alloc(count, GFP_KERNEL);
3103 	if (!skb)
3104 		return NULL;
3105 
3106 	lh = skb_put(skb, L2CAP_HDR_SIZE);
3107 	lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3108 
3109 	if (conn->hcon->type == LE_LINK)
3110 		lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3111 	else
3112 		lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
3113 
3114 	cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
3115 	cmd->code  = code;
3116 	cmd->ident = ident;
3117 	cmd->len   = cpu_to_le16(dlen);
3118 
3119 	if (dlen) {
3120 		count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
3121 		skb_put_data(skb, data, count);
3122 		data += count;
3123 	}
3124 
3125 	len -= skb->len;
3126 
3127 	/* Continuation fragments (no L2CAP header) */
3128 	frag = &skb_shinfo(skb)->frag_list;
3129 	while (len) {
3130 		count = min_t(unsigned int, conn->mtu, len);
3131 
3132 		*frag = bt_skb_alloc(count, GFP_KERNEL);
3133 		if (!*frag)
3134 			goto fail;
3135 
3136 		skb_put_data(*frag, data, count);
3137 
3138 		len  -= count;
3139 		data += count;
3140 
3141 		frag = &(*frag)->next;
3142 	}
3143 
3144 	return skb;
3145 
3146 fail:
3147 	kfree_skb(skb);
3148 	return NULL;
3149 }
3150 
3151 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
3152 				     unsigned long *val)
3153 {
3154 	struct l2cap_conf_opt *opt = *ptr;
3155 	int len;
3156 
3157 	len = L2CAP_CONF_OPT_SIZE + opt->len;
3158 	*ptr += len;
3159 
3160 	*type = opt->type;
3161 	*olen = opt->len;
3162 
3163 	switch (opt->len) {
3164 	case 1:
3165 		*val = *((u8 *) opt->val);
3166 		break;
3167 
3168 	case 2:
3169 		*val = get_unaligned_le16(opt->val);
3170 		break;
3171 
3172 	case 4:
3173 		*val = get_unaligned_le32(opt->val);
3174 		break;
3175 
3176 	default:
3177 		*val = (unsigned long) opt->val;
3178 		break;
3179 	}
3180 
3181 	BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3182 	return len;
3183 }
3184 
3185 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3186 {
3187 	struct l2cap_conf_opt *opt = *ptr;
3188 
3189 	BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3190 
3191 	if (size < L2CAP_CONF_OPT_SIZE + len)
3192 		return;
3193 
3194 	opt->type = type;
3195 	opt->len  = len;
3196 
3197 	switch (len) {
3198 	case 1:
3199 		*((u8 *) opt->val)  = val;
3200 		break;
3201 
3202 	case 2:
3203 		put_unaligned_le16(val, opt->val);
3204 		break;
3205 
3206 	case 4:
3207 		put_unaligned_le32(val, opt->val);
3208 		break;
3209 
3210 	default:
3211 		memcpy(opt->val, (void *) val, len);
3212 		break;
3213 	}
3214 
3215 	*ptr += L2CAP_CONF_OPT_SIZE + len;
3216 }
3217 
3218 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3219 {
3220 	struct l2cap_conf_efs efs;
3221 
3222 	switch (chan->mode) {
3223 	case L2CAP_MODE_ERTM:
3224 		efs.id		= chan->local_id;
3225 		efs.stype	= chan->local_stype;
3226 		efs.msdu	= cpu_to_le16(chan->local_msdu);
3227 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3228 		efs.acc_lat	= cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3229 		efs.flush_to	= cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3230 		break;
3231 
3232 	case L2CAP_MODE_STREAMING:
3233 		efs.id		= 1;
3234 		efs.stype	= L2CAP_SERV_BESTEFFORT;
3235 		efs.msdu	= cpu_to_le16(chan->local_msdu);
3236 		efs.sdu_itime	= cpu_to_le32(chan->local_sdu_itime);
3237 		efs.acc_lat	= 0;
3238 		efs.flush_to	= 0;
3239 		break;
3240 
3241 	default:
3242 		return;
3243 	}
3244 
3245 	l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3246 			   (unsigned long) &efs, size);
3247 }
3248 
3249 static void l2cap_ack_timeout(struct work_struct *work)
3250 {
3251 	struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3252 					       ack_timer.work);
3253 	u16 frames_to_ack;
3254 
3255 	BT_DBG("chan %p", chan);
3256 
3257 	l2cap_chan_lock(chan);
3258 
3259 	frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3260 				     chan->last_acked_seq);
3261 
3262 	if (frames_to_ack)
3263 		l2cap_send_rr_or_rnr(chan, 0);
3264 
3265 	l2cap_chan_unlock(chan);
3266 	l2cap_chan_put(chan);
3267 }
3268 
3269 int l2cap_ertm_init(struct l2cap_chan *chan)
3270 {
3271 	int err;
3272 
3273 	chan->next_tx_seq = 0;
3274 	chan->expected_tx_seq = 0;
3275 	chan->expected_ack_seq = 0;
3276 	chan->unacked_frames = 0;
3277 	chan->buffer_seq = 0;
3278 	chan->frames_sent = 0;
3279 	chan->last_acked_seq = 0;
3280 	chan->sdu = NULL;
3281 	chan->sdu_last_frag = NULL;
3282 	chan->sdu_len = 0;
3283 
3284 	skb_queue_head_init(&chan->tx_q);
3285 
3286 	chan->local_amp_id = AMP_ID_BREDR;
3287 	chan->move_id = AMP_ID_BREDR;
3288 	chan->move_state = L2CAP_MOVE_STABLE;
3289 	chan->move_role = L2CAP_MOVE_ROLE_NONE;
3290 
3291 	if (chan->mode != L2CAP_MODE_ERTM)
3292 		return 0;
3293 
3294 	chan->rx_state = L2CAP_RX_STATE_RECV;
3295 	chan->tx_state = L2CAP_TX_STATE_XMIT;
3296 
3297 	INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3298 	INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3299 	INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
3300 
3301 	skb_queue_head_init(&chan->srej_q);
3302 
3303 	err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3304 	if (err < 0)
3305 		return err;
3306 
3307 	err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3308 	if (err < 0)
3309 		l2cap_seq_list_free(&chan->srej_list);
3310 
3311 	return err;
3312 }
3313 
3314 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3315 {
3316 	switch (mode) {
3317 	case L2CAP_MODE_STREAMING:
3318 	case L2CAP_MODE_ERTM:
3319 		if (l2cap_mode_supported(mode, remote_feat_mask))
3320 			return mode;
3321 		fallthrough;
3322 	default:
3323 		return L2CAP_MODE_BASIC;
3324 	}
3325 }
3326 
3327 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3328 {
3329 	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3330 		(conn->feat_mask & L2CAP_FEAT_EXT_WINDOW));
3331 }
3332 
3333 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3334 {
3335 	return ((conn->local_fixed_chan & L2CAP_FC_A2MP) &&
3336 		(conn->feat_mask & L2CAP_FEAT_EXT_FLOW));
3337 }
3338 
3339 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3340 				      struct l2cap_conf_rfc *rfc)
3341 {
3342 	if (chan->local_amp_id != AMP_ID_BREDR && chan->hs_hcon) {
3343 		u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3344 
3345 		/* Class 1 devices have must have ERTM timeouts
3346 		 * exceeding the Link Supervision Timeout.  The
3347 		 * default Link Supervision Timeout for AMP
3348 		 * controllers is 10 seconds.
3349 		 *
3350 		 * Class 1 devices use 0xffffffff for their
3351 		 * best-effort flush timeout, so the clamping logic
3352 		 * will result in a timeout that meets the above
3353 		 * requirement.  ERTM timeouts are 16-bit values, so
3354 		 * the maximum timeout is 65.535 seconds.
3355 		 */
3356 
3357 		/* Convert timeout to milliseconds and round */
3358 		ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3359 
3360 		/* This is the recommended formula for class 2 devices
3361 		 * that start ERTM timers when packets are sent to the
3362 		 * controller.
3363 		 */
3364 		ertm_to = 3 * ertm_to + 500;
3365 
3366 		if (ertm_to > 0xffff)
3367 			ertm_to = 0xffff;
3368 
3369 		rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3370 		rfc->monitor_timeout = rfc->retrans_timeout;
3371 	} else {
3372 		rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3373 		rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3374 	}
3375 }
3376 
3377 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3378 {
3379 	if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3380 	    __l2cap_ews_supported(chan->conn)) {
3381 		/* use extended control field */
3382 		set_bit(FLAG_EXT_CTRL, &chan->flags);
3383 		chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3384 	} else {
3385 		chan->tx_win = min_t(u16, chan->tx_win,
3386 				     L2CAP_DEFAULT_TX_WINDOW);
3387 		chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3388 	}
3389 	chan->ack_win = chan->tx_win;
3390 }
3391 
3392 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3393 {
3394 	struct hci_conn *conn = chan->conn->hcon;
3395 
3396 	chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3397 
3398 	/* The 2-DH1 packet has between 2 and 56 information bytes
3399 	 * (including the 2-byte payload header)
3400 	 */
3401 	if (!(conn->pkt_type & HCI_2DH1))
3402 		chan->imtu = 54;
3403 
3404 	/* The 3-DH1 packet has between 2 and 85 information bytes
3405 	 * (including the 2-byte payload header)
3406 	 */
3407 	if (!(conn->pkt_type & HCI_3DH1))
3408 		chan->imtu = 83;
3409 
3410 	/* The 2-DH3 packet has between 2 and 369 information bytes
3411 	 * (including the 2-byte payload header)
3412 	 */
3413 	if (!(conn->pkt_type & HCI_2DH3))
3414 		chan->imtu = 367;
3415 
3416 	/* The 3-DH3 packet has between 2 and 554 information bytes
3417 	 * (including the 2-byte payload header)
3418 	 */
3419 	if (!(conn->pkt_type & HCI_3DH3))
3420 		chan->imtu = 552;
3421 
3422 	/* The 2-DH5 packet has between 2 and 681 information bytes
3423 	 * (including the 2-byte payload header)
3424 	 */
3425 	if (!(conn->pkt_type & HCI_2DH5))
3426 		chan->imtu = 679;
3427 
3428 	/* The 3-DH5 packet has between 2 and 1023 information bytes
3429 	 * (including the 2-byte payload header)
3430 	 */
3431 	if (!(conn->pkt_type & HCI_3DH5))
3432 		chan->imtu = 1021;
3433 }
3434 
3435 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3436 {
3437 	struct l2cap_conf_req *req = data;
3438 	struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3439 	void *ptr = req->data;
3440 	void *endptr = data + data_size;
3441 	u16 size;
3442 
3443 	BT_DBG("chan %p", chan);
3444 
3445 	if (chan->num_conf_req || chan->num_conf_rsp)
3446 		goto done;
3447 
3448 	switch (chan->mode) {
3449 	case L2CAP_MODE_STREAMING:
3450 	case L2CAP_MODE_ERTM:
3451 		if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3452 			break;
3453 
3454 		if (__l2cap_efs_supported(chan->conn))
3455 			set_bit(FLAG_EFS_ENABLE, &chan->flags);
3456 
3457 		fallthrough;
3458 	default:
3459 		chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3460 		break;
3461 	}
3462 
3463 done:
3464 	if (chan->imtu != L2CAP_DEFAULT_MTU) {
3465 		if (!chan->imtu)
3466 			l2cap_mtu_auto(chan);
3467 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3468 				   endptr - ptr);
3469 	}
3470 
3471 	switch (chan->mode) {
3472 	case L2CAP_MODE_BASIC:
3473 		if (disable_ertm)
3474 			break;
3475 
3476 		if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3477 		    !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3478 			break;
3479 
3480 		rfc.mode            = L2CAP_MODE_BASIC;
3481 		rfc.txwin_size      = 0;
3482 		rfc.max_transmit    = 0;
3483 		rfc.retrans_timeout = 0;
3484 		rfc.monitor_timeout = 0;
3485 		rfc.max_pdu_size    = 0;
3486 
3487 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3488 				   (unsigned long) &rfc, endptr - ptr);
3489 		break;
3490 
3491 	case L2CAP_MODE_ERTM:
3492 		rfc.mode            = L2CAP_MODE_ERTM;
3493 		rfc.max_transmit    = chan->max_tx;
3494 
3495 		__l2cap_set_ertm_timeouts(chan, &rfc);
3496 
3497 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3498 			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3499 			     L2CAP_FCS_SIZE);
3500 		rfc.max_pdu_size = cpu_to_le16(size);
3501 
3502 		l2cap_txwin_setup(chan);
3503 
3504 		rfc.txwin_size = min_t(u16, chan->tx_win,
3505 				       L2CAP_DEFAULT_TX_WINDOW);
3506 
3507 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3508 				   (unsigned long) &rfc, endptr - ptr);
3509 
3510 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3511 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3512 
3513 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3514 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3515 					   chan->tx_win, endptr - ptr);
3516 
3517 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3518 			if (chan->fcs == L2CAP_FCS_NONE ||
3519 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3520 				chan->fcs = L2CAP_FCS_NONE;
3521 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3522 						   chan->fcs, endptr - ptr);
3523 			}
3524 		break;
3525 
3526 	case L2CAP_MODE_STREAMING:
3527 		l2cap_txwin_setup(chan);
3528 		rfc.mode            = L2CAP_MODE_STREAMING;
3529 		rfc.txwin_size      = 0;
3530 		rfc.max_transmit    = 0;
3531 		rfc.retrans_timeout = 0;
3532 		rfc.monitor_timeout = 0;
3533 
3534 		size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3535 			     L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3536 			     L2CAP_FCS_SIZE);
3537 		rfc.max_pdu_size = cpu_to_le16(size);
3538 
3539 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3540 				   (unsigned long) &rfc, endptr - ptr);
3541 
3542 		if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3543 			l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3544 
3545 		if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3546 			if (chan->fcs == L2CAP_FCS_NONE ||
3547 			    test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3548 				chan->fcs = L2CAP_FCS_NONE;
3549 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3550 						   chan->fcs, endptr - ptr);
3551 			}
3552 		break;
3553 	}
3554 
3555 	req->dcid  = cpu_to_le16(chan->dcid);
3556 	req->flags = cpu_to_le16(0);
3557 
3558 	return ptr - data;
3559 }
3560 
3561 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3562 {
3563 	struct l2cap_conf_rsp *rsp = data;
3564 	void *ptr = rsp->data;
3565 	void *endptr = data + data_size;
3566 	void *req = chan->conf_req;
3567 	int len = chan->conf_len;
3568 	int type, hint, olen;
3569 	unsigned long val;
3570 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3571 	struct l2cap_conf_efs efs;
3572 	u8 remote_efs = 0;
3573 	u16 mtu = L2CAP_DEFAULT_MTU;
3574 	u16 result = L2CAP_CONF_SUCCESS;
3575 	u16 size;
3576 
3577 	BT_DBG("chan %p", chan);
3578 
3579 	while (len >= L2CAP_CONF_OPT_SIZE) {
3580 		len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3581 		if (len < 0)
3582 			break;
3583 
3584 		hint  = type & L2CAP_CONF_HINT;
3585 		type &= L2CAP_CONF_MASK;
3586 
3587 		switch (type) {
3588 		case L2CAP_CONF_MTU:
3589 			if (olen != 2)
3590 				break;
3591 			mtu = val;
3592 			break;
3593 
3594 		case L2CAP_CONF_FLUSH_TO:
3595 			if (olen != 2)
3596 				break;
3597 			chan->flush_to = val;
3598 			break;
3599 
3600 		case L2CAP_CONF_QOS:
3601 			break;
3602 
3603 		case L2CAP_CONF_RFC:
3604 			if (olen != sizeof(rfc))
3605 				break;
3606 			memcpy(&rfc, (void *) val, olen);
3607 			break;
3608 
3609 		case L2CAP_CONF_FCS:
3610 			if (olen != 1)
3611 				break;
3612 			if (val == L2CAP_FCS_NONE)
3613 				set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3614 			break;
3615 
3616 		case L2CAP_CONF_EFS:
3617 			if (olen != sizeof(efs))
3618 				break;
3619 			remote_efs = 1;
3620 			memcpy(&efs, (void *) val, olen);
3621 			break;
3622 
3623 		case L2CAP_CONF_EWS:
3624 			if (olen != 2)
3625 				break;
3626 			if (!(chan->conn->local_fixed_chan & L2CAP_FC_A2MP))
3627 				return -ECONNREFUSED;
3628 			set_bit(FLAG_EXT_CTRL, &chan->flags);
3629 			set_bit(CONF_EWS_RECV, &chan->conf_state);
3630 			chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3631 			chan->remote_tx_win = val;
3632 			break;
3633 
3634 		default:
3635 			if (hint)
3636 				break;
3637 			result = L2CAP_CONF_UNKNOWN;
3638 			l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3639 			break;
3640 		}
3641 	}
3642 
3643 	if (chan->num_conf_rsp || chan->num_conf_req > 1)
3644 		goto done;
3645 
3646 	switch (chan->mode) {
3647 	case L2CAP_MODE_STREAMING:
3648 	case L2CAP_MODE_ERTM:
3649 		if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3650 			chan->mode = l2cap_select_mode(rfc.mode,
3651 						       chan->conn->feat_mask);
3652 			break;
3653 		}
3654 
3655 		if (remote_efs) {
3656 			if (__l2cap_efs_supported(chan->conn))
3657 				set_bit(FLAG_EFS_ENABLE, &chan->flags);
3658 			else
3659 				return -ECONNREFUSED;
3660 		}
3661 
3662 		if (chan->mode != rfc.mode)
3663 			return -ECONNREFUSED;
3664 
3665 		break;
3666 	}
3667 
3668 done:
3669 	if (chan->mode != rfc.mode) {
3670 		result = L2CAP_CONF_UNACCEPT;
3671 		rfc.mode = chan->mode;
3672 
3673 		if (chan->num_conf_rsp == 1)
3674 			return -ECONNREFUSED;
3675 
3676 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3677 				   (unsigned long) &rfc, endptr - ptr);
3678 	}
3679 
3680 	if (result == L2CAP_CONF_SUCCESS) {
3681 		/* Configure output options and let the other side know
3682 		 * which ones we don't like. */
3683 
3684 		if (mtu < L2CAP_DEFAULT_MIN_MTU)
3685 			result = L2CAP_CONF_UNACCEPT;
3686 		else {
3687 			chan->omtu = mtu;
3688 			set_bit(CONF_MTU_DONE, &chan->conf_state);
3689 		}
3690 		l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3691 
3692 		if (remote_efs) {
3693 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3694 			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3695 			    efs.stype != chan->local_stype) {
3696 
3697 				result = L2CAP_CONF_UNACCEPT;
3698 
3699 				if (chan->num_conf_req >= 1)
3700 					return -ECONNREFUSED;
3701 
3702 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3703 						   sizeof(efs),
3704 						   (unsigned long) &efs, endptr - ptr);
3705 			} else {
3706 				/* Send PENDING Conf Rsp */
3707 				result = L2CAP_CONF_PENDING;
3708 				set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3709 			}
3710 		}
3711 
3712 		switch (rfc.mode) {
3713 		case L2CAP_MODE_BASIC:
3714 			chan->fcs = L2CAP_FCS_NONE;
3715 			set_bit(CONF_MODE_DONE, &chan->conf_state);
3716 			break;
3717 
3718 		case L2CAP_MODE_ERTM:
3719 			if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3720 				chan->remote_tx_win = rfc.txwin_size;
3721 			else
3722 				rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3723 
3724 			chan->remote_max_tx = rfc.max_transmit;
3725 
3726 			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3727 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3728 				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3729 			rfc.max_pdu_size = cpu_to_le16(size);
3730 			chan->remote_mps = size;
3731 
3732 			__l2cap_set_ertm_timeouts(chan, &rfc);
3733 
3734 			set_bit(CONF_MODE_DONE, &chan->conf_state);
3735 
3736 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3737 					   sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3738 
3739 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3740 				chan->remote_id = efs.id;
3741 				chan->remote_stype = efs.stype;
3742 				chan->remote_msdu = le16_to_cpu(efs.msdu);
3743 				chan->remote_flush_to =
3744 					le32_to_cpu(efs.flush_to);
3745 				chan->remote_acc_lat =
3746 					le32_to_cpu(efs.acc_lat);
3747 				chan->remote_sdu_itime =
3748 					le32_to_cpu(efs.sdu_itime);
3749 				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3750 						   sizeof(efs),
3751 						   (unsigned long) &efs, endptr - ptr);
3752 			}
3753 			break;
3754 
3755 		case L2CAP_MODE_STREAMING:
3756 			size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3757 				     chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3758 				     L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3759 			rfc.max_pdu_size = cpu_to_le16(size);
3760 			chan->remote_mps = size;
3761 
3762 			set_bit(CONF_MODE_DONE, &chan->conf_state);
3763 
3764 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3765 					   (unsigned long) &rfc, endptr - ptr);
3766 
3767 			break;
3768 
3769 		default:
3770 			result = L2CAP_CONF_UNACCEPT;
3771 
3772 			memset(&rfc, 0, sizeof(rfc));
3773 			rfc.mode = chan->mode;
3774 		}
3775 
3776 		if (result == L2CAP_CONF_SUCCESS)
3777 			set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3778 	}
3779 	rsp->scid   = cpu_to_le16(chan->dcid);
3780 	rsp->result = cpu_to_le16(result);
3781 	rsp->flags  = cpu_to_le16(0);
3782 
3783 	return ptr - data;
3784 }
3785 
3786 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3787 				void *data, size_t size, u16 *result)
3788 {
3789 	struct l2cap_conf_req *req = data;
3790 	void *ptr = req->data;
3791 	void *endptr = data + size;
3792 	int type, olen;
3793 	unsigned long val;
3794 	struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3795 	struct l2cap_conf_efs efs;
3796 
3797 	BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3798 
3799 	while (len >= L2CAP_CONF_OPT_SIZE) {
3800 		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3801 		if (len < 0)
3802 			break;
3803 
3804 		switch (type) {
3805 		case L2CAP_CONF_MTU:
3806 			if (olen != 2)
3807 				break;
3808 			if (val < L2CAP_DEFAULT_MIN_MTU) {
3809 				*result = L2CAP_CONF_UNACCEPT;
3810 				chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3811 			} else
3812 				chan->imtu = val;
3813 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3814 					   endptr - ptr);
3815 			break;
3816 
3817 		case L2CAP_CONF_FLUSH_TO:
3818 			if (olen != 2)
3819 				break;
3820 			chan->flush_to = val;
3821 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3822 					   chan->flush_to, endptr - ptr);
3823 			break;
3824 
3825 		case L2CAP_CONF_RFC:
3826 			if (olen != sizeof(rfc))
3827 				break;
3828 			memcpy(&rfc, (void *)val, olen);
3829 			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3830 			    rfc.mode != chan->mode)
3831 				return -ECONNREFUSED;
3832 			chan->fcs = 0;
3833 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3834 					   (unsigned long) &rfc, endptr - ptr);
3835 			break;
3836 
3837 		case L2CAP_CONF_EWS:
3838 			if (olen != 2)
3839 				break;
3840 			chan->ack_win = min_t(u16, val, chan->ack_win);
3841 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3842 					   chan->tx_win, endptr - ptr);
3843 			break;
3844 
3845 		case L2CAP_CONF_EFS:
3846 			if (olen != sizeof(efs))
3847 				break;
3848 			memcpy(&efs, (void *)val, olen);
3849 			if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3850 			    efs.stype != L2CAP_SERV_NOTRAFIC &&
3851 			    efs.stype != chan->local_stype)
3852 				return -ECONNREFUSED;
3853 			l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3854 					   (unsigned long) &efs, endptr - ptr);
3855 			break;
3856 
3857 		case L2CAP_CONF_FCS:
3858 			if (olen != 1)
3859 				break;
3860 			if (*result == L2CAP_CONF_PENDING)
3861 				if (val == L2CAP_FCS_NONE)
3862 					set_bit(CONF_RECV_NO_FCS,
3863 						&chan->conf_state);
3864 			break;
3865 		}
3866 	}
3867 
3868 	if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3869 		return -ECONNREFUSED;
3870 
3871 	chan->mode = rfc.mode;
3872 
3873 	if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3874 		switch (rfc.mode) {
3875 		case L2CAP_MODE_ERTM:
3876 			chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3877 			chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3878 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3879 			if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3880 				chan->ack_win = min_t(u16, chan->ack_win,
3881 						      rfc.txwin_size);
3882 
3883 			if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3884 				chan->local_msdu = le16_to_cpu(efs.msdu);
3885 				chan->local_sdu_itime =
3886 					le32_to_cpu(efs.sdu_itime);
3887 				chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3888 				chan->local_flush_to =
3889 					le32_to_cpu(efs.flush_to);
3890 			}
3891 			break;
3892 
3893 		case L2CAP_MODE_STREAMING:
3894 			chan->mps    = le16_to_cpu(rfc.max_pdu_size);
3895 		}
3896 	}
3897 
3898 	req->dcid   = cpu_to_le16(chan->dcid);
3899 	req->flags  = cpu_to_le16(0);
3900 
3901 	return ptr - data;
3902 }
3903 
3904 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3905 				u16 result, u16 flags)
3906 {
3907 	struct l2cap_conf_rsp *rsp = data;
3908 	void *ptr = rsp->data;
3909 
3910 	BT_DBG("chan %p", chan);
3911 
3912 	rsp->scid   = cpu_to_le16(chan->dcid);
3913 	rsp->result = cpu_to_le16(result);
3914 	rsp->flags  = cpu_to_le16(flags);
3915 
3916 	return ptr - data;
3917 }
3918 
3919 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3920 {
3921 	struct l2cap_le_conn_rsp rsp;
3922 	struct l2cap_conn *conn = chan->conn;
3923 
3924 	BT_DBG("chan %p", chan);
3925 
3926 	rsp.dcid    = cpu_to_le16(chan->scid);
3927 	rsp.mtu     = cpu_to_le16(chan->imtu);
3928 	rsp.mps     = cpu_to_le16(chan->mps);
3929 	rsp.credits = cpu_to_le16(chan->rx_credits);
3930 	rsp.result  = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3931 
3932 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3933 		       &rsp);
3934 }
3935 
3936 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3937 {
3938 	struct {
3939 		struct l2cap_ecred_conn_rsp rsp;
3940 		__le16 dcid[5];
3941 	} __packed pdu;
3942 	struct l2cap_conn *conn = chan->conn;
3943 	u16 ident = chan->ident;
3944 	int i = 0;
3945 
3946 	if (!ident)
3947 		return;
3948 
3949 	BT_DBG("chan %p ident %d", chan, ident);
3950 
3951 	pdu.rsp.mtu     = cpu_to_le16(chan->imtu);
3952 	pdu.rsp.mps     = cpu_to_le16(chan->mps);
3953 	pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3954 	pdu.rsp.result  = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3955 
3956 	mutex_lock(&conn->chan_lock);
3957 
3958 	list_for_each_entry(chan, &conn->chan_l, list) {
3959 		if (chan->ident != ident)
3960 			continue;
3961 
3962 		/* Reset ident so only one response is sent */
3963 		chan->ident = 0;
3964 
3965 		/* Include all channels pending with the same ident */
3966 		pdu.dcid[i++] = cpu_to_le16(chan->scid);
3967 	}
3968 
3969 	mutex_unlock(&conn->chan_lock);
3970 
3971 	l2cap_send_cmd(conn, ident, L2CAP_ECRED_CONN_RSP,
3972 			sizeof(pdu.rsp) + i * sizeof(__le16), &pdu);
3973 }
3974 
3975 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3976 {
3977 	struct l2cap_conn_rsp rsp;
3978 	struct l2cap_conn *conn = chan->conn;
3979 	u8 buf[128];
3980 	u8 rsp_code;
3981 
3982 	rsp.scid   = cpu_to_le16(chan->dcid);
3983 	rsp.dcid   = cpu_to_le16(chan->scid);
3984 	rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3985 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3986 
3987 	if (chan->hs_hcon)
3988 		rsp_code = L2CAP_CREATE_CHAN_RSP;
3989 	else
3990 		rsp_code = L2CAP_CONN_RSP;
3991 
3992 	BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3993 
3994 	l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3995 
3996 	if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3997 		return;
3998 
3999 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4000 		       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4001 	chan->num_conf_req++;
4002 }
4003 
4004 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
4005 {
4006 	int type, olen;
4007 	unsigned long val;
4008 	/* Use sane default values in case a misbehaving remote device
4009 	 * did not send an RFC or extended window size option.
4010 	 */
4011 	u16 txwin_ext = chan->ack_win;
4012 	struct l2cap_conf_rfc rfc = {
4013 		.mode = chan->mode,
4014 		.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
4015 		.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
4016 		.max_pdu_size = cpu_to_le16(chan->imtu),
4017 		.txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
4018 	};
4019 
4020 	BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
4021 
4022 	if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
4023 		return;
4024 
4025 	while (len >= L2CAP_CONF_OPT_SIZE) {
4026 		len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
4027 		if (len < 0)
4028 			break;
4029 
4030 		switch (type) {
4031 		case L2CAP_CONF_RFC:
4032 			if (olen != sizeof(rfc))
4033 				break;
4034 			memcpy(&rfc, (void *)val, olen);
4035 			break;
4036 		case L2CAP_CONF_EWS:
4037 			if (olen != 2)
4038 				break;
4039 			txwin_ext = val;
4040 			break;
4041 		}
4042 	}
4043 
4044 	switch (rfc.mode) {
4045 	case L2CAP_MODE_ERTM:
4046 		chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
4047 		chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
4048 		chan->mps = le16_to_cpu(rfc.max_pdu_size);
4049 		if (test_bit(FLAG_EXT_CTRL, &chan->flags))
4050 			chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
4051 		else
4052 			chan->ack_win = min_t(u16, chan->ack_win,
4053 					      rfc.txwin_size);
4054 		break;
4055 	case L2CAP_MODE_STREAMING:
4056 		chan->mps    = le16_to_cpu(rfc.max_pdu_size);
4057 	}
4058 }
4059 
4060 static inline int l2cap_command_rej(struct l2cap_conn *conn,
4061 				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4062 				    u8 *data)
4063 {
4064 	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4065 
4066 	if (cmd_len < sizeof(*rej))
4067 		return -EPROTO;
4068 
4069 	if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4070 		return 0;
4071 
4072 	if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
4073 	    cmd->ident == conn->info_ident) {
4074 		cancel_delayed_work(&conn->info_timer);
4075 
4076 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4077 		conn->info_ident = 0;
4078 
4079 		l2cap_conn_start(conn);
4080 	}
4081 
4082 	return 0;
4083 }
4084 
4085 static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
4086 					struct l2cap_cmd_hdr *cmd,
4087 					u8 *data, u8 rsp_code, u8 amp_id)
4088 {
4089 	struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
4090 	struct l2cap_conn_rsp rsp;
4091 	struct l2cap_chan *chan = NULL, *pchan;
4092 	int result, status = L2CAP_CS_NO_INFO;
4093 
4094 	u16 dcid = 0, scid = __le16_to_cpu(req->scid);
4095 	__le16 psm = req->psm;
4096 
4097 	BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
4098 
4099 	/* Check if we have socket listening on psm */
4100 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4101 					 &conn->hcon->dst, ACL_LINK);
4102 	if (!pchan) {
4103 		result = L2CAP_CR_BAD_PSM;
4104 		goto sendresp;
4105 	}
4106 
4107 	mutex_lock(&conn->chan_lock);
4108 	l2cap_chan_lock(pchan);
4109 
4110 	/* Check if the ACL is secure enough (if not SDP) */
4111 	if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
4112 	    !hci_conn_check_link_mode(conn->hcon)) {
4113 		conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
4114 		result = L2CAP_CR_SEC_BLOCK;
4115 		goto response;
4116 	}
4117 
4118 	result = L2CAP_CR_NO_MEM;
4119 
4120 	/* Check for valid dynamic CID range (as per Erratum 3253) */
4121 	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
4122 		result = L2CAP_CR_INVALID_SCID;
4123 		goto response;
4124 	}
4125 
4126 	/* Check if we already have channel with that dcid */
4127 	if (__l2cap_get_chan_by_dcid(conn, scid)) {
4128 		result = L2CAP_CR_SCID_IN_USE;
4129 		goto response;
4130 	}
4131 
4132 	chan = pchan->ops->new_connection(pchan);
4133 	if (!chan)
4134 		goto response;
4135 
4136 	/* For certain devices (ex: HID mouse), support for authentication,
4137 	 * pairing and bonding is optional. For such devices, inorder to avoid
4138 	 * the ACL alive for too long after L2CAP disconnection, reset the ACL
4139 	 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
4140 	 */
4141 	conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4142 
4143 	bacpy(&chan->src, &conn->hcon->src);
4144 	bacpy(&chan->dst, &conn->hcon->dst);
4145 	chan->src_type = bdaddr_src_type(conn->hcon);
4146 	chan->dst_type = bdaddr_dst_type(conn->hcon);
4147 	chan->psm  = psm;
4148 	chan->dcid = scid;
4149 	chan->local_amp_id = amp_id;
4150 
4151 	__l2cap_chan_add(conn, chan);
4152 
4153 	dcid = chan->scid;
4154 
4155 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4156 
4157 	chan->ident = cmd->ident;
4158 
4159 	if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
4160 		if (l2cap_chan_check_security(chan, false)) {
4161 			if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4162 				l2cap_state_change(chan, BT_CONNECT2);
4163 				result = L2CAP_CR_PEND;
4164 				status = L2CAP_CS_AUTHOR_PEND;
4165 				chan->ops->defer(chan);
4166 			} else {
4167 				/* Force pending result for AMP controllers.
4168 				 * The connection will succeed after the
4169 				 * physical link is up.
4170 				 */
4171 				if (amp_id == AMP_ID_BREDR) {
4172 					l2cap_state_change(chan, BT_CONFIG);
4173 					result = L2CAP_CR_SUCCESS;
4174 				} else {
4175 					l2cap_state_change(chan, BT_CONNECT2);
4176 					result = L2CAP_CR_PEND;
4177 				}
4178 				status = L2CAP_CS_NO_INFO;
4179 			}
4180 		} else {
4181 			l2cap_state_change(chan, BT_CONNECT2);
4182 			result = L2CAP_CR_PEND;
4183 			status = L2CAP_CS_AUTHEN_PEND;
4184 		}
4185 	} else {
4186 		l2cap_state_change(chan, BT_CONNECT2);
4187 		result = L2CAP_CR_PEND;
4188 		status = L2CAP_CS_NO_INFO;
4189 	}
4190 
4191 response:
4192 	l2cap_chan_unlock(pchan);
4193 	mutex_unlock(&conn->chan_lock);
4194 	l2cap_chan_put(pchan);
4195 
4196 sendresp:
4197 	rsp.scid   = cpu_to_le16(scid);
4198 	rsp.dcid   = cpu_to_le16(dcid);
4199 	rsp.result = cpu_to_le16(result);
4200 	rsp.status = cpu_to_le16(status);
4201 	l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4202 
4203 	if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4204 		struct l2cap_info_req info;
4205 		info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4206 
4207 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4208 		conn->info_ident = l2cap_get_ident(conn);
4209 
4210 		schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4211 
4212 		l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4213 			       sizeof(info), &info);
4214 	}
4215 
4216 	if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4217 	    result == L2CAP_CR_SUCCESS) {
4218 		u8 buf[128];
4219 		set_bit(CONF_REQ_SENT, &chan->conf_state);
4220 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4221 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4222 		chan->num_conf_req++;
4223 	}
4224 
4225 	return chan;
4226 }
4227 
4228 static int l2cap_connect_req(struct l2cap_conn *conn,
4229 			     struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4230 {
4231 	struct hci_dev *hdev = conn->hcon->hdev;
4232 	struct hci_conn *hcon = conn->hcon;
4233 
4234 	if (cmd_len < sizeof(struct l2cap_conn_req))
4235 		return -EPROTO;
4236 
4237 	hci_dev_lock(hdev);
4238 	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
4239 	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
4240 		mgmt_device_connected(hdev, hcon, 0, NULL, 0);
4241 	hci_dev_unlock(hdev);
4242 
4243 	l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
4244 	return 0;
4245 }
4246 
4247 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4248 				    struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4249 				    u8 *data)
4250 {
4251 	struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4252 	u16 scid, dcid, result, status;
4253 	struct l2cap_chan *chan;
4254 	u8 req[128];
4255 	int err;
4256 
4257 	if (cmd_len < sizeof(*rsp))
4258 		return -EPROTO;
4259 
4260 	scid   = __le16_to_cpu(rsp->scid);
4261 	dcid   = __le16_to_cpu(rsp->dcid);
4262 	result = __le16_to_cpu(rsp->result);
4263 	status = __le16_to_cpu(rsp->status);
4264 
4265 	BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4266 	       dcid, scid, result, status);
4267 
4268 	mutex_lock(&conn->chan_lock);
4269 
4270 	if (scid) {
4271 		chan = __l2cap_get_chan_by_scid(conn, scid);
4272 		if (!chan) {
4273 			err = -EBADSLT;
4274 			goto unlock;
4275 		}
4276 	} else {
4277 		chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4278 		if (!chan) {
4279 			err = -EBADSLT;
4280 			goto unlock;
4281 		}
4282 	}
4283 
4284 	err = 0;
4285 
4286 	l2cap_chan_lock(chan);
4287 
4288 	switch (result) {
4289 	case L2CAP_CR_SUCCESS:
4290 		l2cap_state_change(chan, BT_CONFIG);
4291 		chan->ident = 0;
4292 		chan->dcid = dcid;
4293 		clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4294 
4295 		if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4296 			break;
4297 
4298 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4299 			       l2cap_build_conf_req(chan, req, sizeof(req)), req);
4300 		chan->num_conf_req++;
4301 		break;
4302 
4303 	case L2CAP_CR_PEND:
4304 		set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4305 		break;
4306 
4307 	default:
4308 		l2cap_chan_del(chan, ECONNREFUSED);
4309 		break;
4310 	}
4311 
4312 	l2cap_chan_unlock(chan);
4313 
4314 unlock:
4315 	mutex_unlock(&conn->chan_lock);
4316 
4317 	return err;
4318 }
4319 
4320 static inline void set_default_fcs(struct l2cap_chan *chan)
4321 {
4322 	/* FCS is enabled only in ERTM or streaming mode, if one or both
4323 	 * sides request it.
4324 	 */
4325 	if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4326 		chan->fcs = L2CAP_FCS_NONE;
4327 	else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4328 		chan->fcs = L2CAP_FCS_CRC16;
4329 }
4330 
4331 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4332 				    u8 ident, u16 flags)
4333 {
4334 	struct l2cap_conn *conn = chan->conn;
4335 
4336 	BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4337 	       flags);
4338 
4339 	clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4340 	set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4341 
4342 	l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4343 		       l2cap_build_conf_rsp(chan, data,
4344 					    L2CAP_CONF_SUCCESS, flags), data);
4345 }
4346 
4347 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4348 				   u16 scid, u16 dcid)
4349 {
4350 	struct l2cap_cmd_rej_cid rej;
4351 
4352 	rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4353 	rej.scid = __cpu_to_le16(scid);
4354 	rej.dcid = __cpu_to_le16(dcid);
4355 
4356 	l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4357 }
4358 
4359 static inline int l2cap_config_req(struct l2cap_conn *conn,
4360 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4361 				   u8 *data)
4362 {
4363 	struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4364 	u16 dcid, flags;
4365 	u8 rsp[64];
4366 	struct l2cap_chan *chan;
4367 	int len, err = 0;
4368 
4369 	if (cmd_len < sizeof(*req))
4370 		return -EPROTO;
4371 
4372 	dcid  = __le16_to_cpu(req->dcid);
4373 	flags = __le16_to_cpu(req->flags);
4374 
4375 	BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4376 
4377 	chan = l2cap_get_chan_by_scid(conn, dcid);
4378 	if (!chan) {
4379 		cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4380 		return 0;
4381 	}
4382 
4383 	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4384 	    chan->state != BT_CONNECTED) {
4385 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4386 				       chan->dcid);
4387 		goto unlock;
4388 	}
4389 
4390 	/* Reject if config buffer is too small. */
4391 	len = cmd_len - sizeof(*req);
4392 	if (chan->conf_len + len > sizeof(chan->conf_req)) {
4393 		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4394 			       l2cap_build_conf_rsp(chan, rsp,
4395 			       L2CAP_CONF_REJECT, flags), rsp);
4396 		goto unlock;
4397 	}
4398 
4399 	/* Store config. */
4400 	memcpy(chan->conf_req + chan->conf_len, req->data, len);
4401 	chan->conf_len += len;
4402 
4403 	if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4404 		/* Incomplete config. Send empty response. */
4405 		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4406 			       l2cap_build_conf_rsp(chan, rsp,
4407 			       L2CAP_CONF_SUCCESS, flags), rsp);
4408 		goto unlock;
4409 	}
4410 
4411 	/* Complete config. */
4412 	len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4413 	if (len < 0) {
4414 		l2cap_send_disconn_req(chan, ECONNRESET);
4415 		goto unlock;
4416 	}
4417 
4418 	chan->ident = cmd->ident;
4419 	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4420 	chan->num_conf_rsp++;
4421 
4422 	/* Reset config buffer. */
4423 	chan->conf_len = 0;
4424 
4425 	if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4426 		goto unlock;
4427 
4428 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4429 		set_default_fcs(chan);
4430 
4431 		if (chan->mode == L2CAP_MODE_ERTM ||
4432 		    chan->mode == L2CAP_MODE_STREAMING)
4433 			err = l2cap_ertm_init(chan);
4434 
4435 		if (err < 0)
4436 			l2cap_send_disconn_req(chan, -err);
4437 		else
4438 			l2cap_chan_ready(chan);
4439 
4440 		goto unlock;
4441 	}
4442 
4443 	if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4444 		u8 buf[64];
4445 		l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4446 			       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4447 		chan->num_conf_req++;
4448 	}
4449 
4450 	/* Got Conf Rsp PENDING from remote side and assume we sent
4451 	   Conf Rsp PENDING in the code above */
4452 	if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4453 	    test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4454 
4455 		/* check compatibility */
4456 
4457 		/* Send rsp for BR/EDR channel */
4458 		if (!chan->hs_hcon)
4459 			l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4460 		else
4461 			chan->ident = cmd->ident;
4462 	}
4463 
4464 unlock:
4465 	l2cap_chan_unlock(chan);
4466 	return err;
4467 }
4468 
4469 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4470 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4471 				   u8 *data)
4472 {
4473 	struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4474 	u16 scid, flags, result;
4475 	struct l2cap_chan *chan;
4476 	int len = cmd_len - sizeof(*rsp);
4477 	int err = 0;
4478 
4479 	if (cmd_len < sizeof(*rsp))
4480 		return -EPROTO;
4481 
4482 	scid   = __le16_to_cpu(rsp->scid);
4483 	flags  = __le16_to_cpu(rsp->flags);
4484 	result = __le16_to_cpu(rsp->result);
4485 
4486 	BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4487 	       result, len);
4488 
4489 	chan = l2cap_get_chan_by_scid(conn, scid);
4490 	if (!chan)
4491 		return 0;
4492 
4493 	switch (result) {
4494 	case L2CAP_CONF_SUCCESS:
4495 		l2cap_conf_rfc_get(chan, rsp->data, len);
4496 		clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4497 		break;
4498 
4499 	case L2CAP_CONF_PENDING:
4500 		set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4501 
4502 		if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4503 			char buf[64];
4504 
4505 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4506 						   buf, sizeof(buf), &result);
4507 			if (len < 0) {
4508 				l2cap_send_disconn_req(chan, ECONNRESET);
4509 				goto done;
4510 			}
4511 
4512 			if (!chan->hs_hcon) {
4513 				l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4514 							0);
4515 			} else {
4516 				if (l2cap_check_efs(chan)) {
4517 					amp_create_logical_link(chan);
4518 					chan->ident = cmd->ident;
4519 				}
4520 			}
4521 		}
4522 		goto done;
4523 
4524 	case L2CAP_CONF_UNKNOWN:
4525 	case L2CAP_CONF_UNACCEPT:
4526 		if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4527 			char req[64];
4528 
4529 			if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4530 				l2cap_send_disconn_req(chan, ECONNRESET);
4531 				goto done;
4532 			}
4533 
4534 			/* throw out any old stored conf requests */
4535 			result = L2CAP_CONF_SUCCESS;
4536 			len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4537 						   req, sizeof(req), &result);
4538 			if (len < 0) {
4539 				l2cap_send_disconn_req(chan, ECONNRESET);
4540 				goto done;
4541 			}
4542 
4543 			l2cap_send_cmd(conn, l2cap_get_ident(conn),
4544 				       L2CAP_CONF_REQ, len, req);
4545 			chan->num_conf_req++;
4546 			if (result != L2CAP_CONF_SUCCESS)
4547 				goto done;
4548 			break;
4549 		}
4550 		fallthrough;
4551 
4552 	default:
4553 		l2cap_chan_set_err(chan, ECONNRESET);
4554 
4555 		__set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4556 		l2cap_send_disconn_req(chan, ECONNRESET);
4557 		goto done;
4558 	}
4559 
4560 	if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4561 		goto done;
4562 
4563 	set_bit(CONF_INPUT_DONE, &chan->conf_state);
4564 
4565 	if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4566 		set_default_fcs(chan);
4567 
4568 		if (chan->mode == L2CAP_MODE_ERTM ||
4569 		    chan->mode == L2CAP_MODE_STREAMING)
4570 			err = l2cap_ertm_init(chan);
4571 
4572 		if (err < 0)
4573 			l2cap_send_disconn_req(chan, -err);
4574 		else
4575 			l2cap_chan_ready(chan);
4576 	}
4577 
4578 done:
4579 	l2cap_chan_unlock(chan);
4580 	return err;
4581 }
4582 
4583 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4584 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4585 				       u8 *data)
4586 {
4587 	struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4588 	struct l2cap_disconn_rsp rsp;
4589 	u16 dcid, scid;
4590 	struct l2cap_chan *chan;
4591 
4592 	if (cmd_len != sizeof(*req))
4593 		return -EPROTO;
4594 
4595 	scid = __le16_to_cpu(req->scid);
4596 	dcid = __le16_to_cpu(req->dcid);
4597 
4598 	BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4599 
4600 	mutex_lock(&conn->chan_lock);
4601 
4602 	chan = __l2cap_get_chan_by_scid(conn, dcid);
4603 	if (!chan) {
4604 		mutex_unlock(&conn->chan_lock);
4605 		cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4606 		return 0;
4607 	}
4608 
4609 	l2cap_chan_hold(chan);
4610 	l2cap_chan_lock(chan);
4611 
4612 	rsp.dcid = cpu_to_le16(chan->scid);
4613 	rsp.scid = cpu_to_le16(chan->dcid);
4614 	l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4615 
4616 	chan->ops->set_shutdown(chan);
4617 
4618 	l2cap_chan_del(chan, ECONNRESET);
4619 
4620 	chan->ops->close(chan);
4621 
4622 	l2cap_chan_unlock(chan);
4623 	l2cap_chan_put(chan);
4624 
4625 	mutex_unlock(&conn->chan_lock);
4626 
4627 	return 0;
4628 }
4629 
4630 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4631 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4632 				       u8 *data)
4633 {
4634 	struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4635 	u16 dcid, scid;
4636 	struct l2cap_chan *chan;
4637 
4638 	if (cmd_len != sizeof(*rsp))
4639 		return -EPROTO;
4640 
4641 	scid = __le16_to_cpu(rsp->scid);
4642 	dcid = __le16_to_cpu(rsp->dcid);
4643 
4644 	BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4645 
4646 	mutex_lock(&conn->chan_lock);
4647 
4648 	chan = __l2cap_get_chan_by_scid(conn, scid);
4649 	if (!chan) {
4650 		mutex_unlock(&conn->chan_lock);
4651 		return 0;
4652 	}
4653 
4654 	l2cap_chan_hold(chan);
4655 	l2cap_chan_lock(chan);
4656 
4657 	if (chan->state != BT_DISCONN) {
4658 		l2cap_chan_unlock(chan);
4659 		l2cap_chan_put(chan);
4660 		mutex_unlock(&conn->chan_lock);
4661 		return 0;
4662 	}
4663 
4664 	l2cap_chan_del(chan, 0);
4665 
4666 	chan->ops->close(chan);
4667 
4668 	l2cap_chan_unlock(chan);
4669 	l2cap_chan_put(chan);
4670 
4671 	mutex_unlock(&conn->chan_lock);
4672 
4673 	return 0;
4674 }
4675 
4676 static inline int l2cap_information_req(struct l2cap_conn *conn,
4677 					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4678 					u8 *data)
4679 {
4680 	struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4681 	u16 type;
4682 
4683 	if (cmd_len != sizeof(*req))
4684 		return -EPROTO;
4685 
4686 	type = __le16_to_cpu(req->type);
4687 
4688 	BT_DBG("type 0x%4.4x", type);
4689 
4690 	if (type == L2CAP_IT_FEAT_MASK) {
4691 		u8 buf[8];
4692 		u32 feat_mask = l2cap_feat_mask;
4693 		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4694 		rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4695 		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4696 		if (!disable_ertm)
4697 			feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4698 				| L2CAP_FEAT_FCS;
4699 		if (conn->local_fixed_chan & L2CAP_FC_A2MP)
4700 			feat_mask |= L2CAP_FEAT_EXT_FLOW
4701 				| L2CAP_FEAT_EXT_WINDOW;
4702 
4703 		put_unaligned_le32(feat_mask, rsp->data);
4704 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4705 			       buf);
4706 	} else if (type == L2CAP_IT_FIXED_CHAN) {
4707 		u8 buf[12];
4708 		struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4709 
4710 		rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4711 		rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4712 		rsp->data[0] = conn->local_fixed_chan;
4713 		memset(rsp->data + 1, 0, 7);
4714 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4715 			       buf);
4716 	} else {
4717 		struct l2cap_info_rsp rsp;
4718 		rsp.type   = cpu_to_le16(type);
4719 		rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4720 		l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4721 			       &rsp);
4722 	}
4723 
4724 	return 0;
4725 }
4726 
4727 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4728 					struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4729 					u8 *data)
4730 {
4731 	struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4732 	u16 type, result;
4733 
4734 	if (cmd_len < sizeof(*rsp))
4735 		return -EPROTO;
4736 
4737 	type   = __le16_to_cpu(rsp->type);
4738 	result = __le16_to_cpu(rsp->result);
4739 
4740 	BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4741 
4742 	/* L2CAP Info req/rsp are unbound to channels, add extra checks */
4743 	if (cmd->ident != conn->info_ident ||
4744 	    conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4745 		return 0;
4746 
4747 	cancel_delayed_work(&conn->info_timer);
4748 
4749 	if (result != L2CAP_IR_SUCCESS) {
4750 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4751 		conn->info_ident = 0;
4752 
4753 		l2cap_conn_start(conn);
4754 
4755 		return 0;
4756 	}
4757 
4758 	switch (type) {
4759 	case L2CAP_IT_FEAT_MASK:
4760 		conn->feat_mask = get_unaligned_le32(rsp->data);
4761 
4762 		if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4763 			struct l2cap_info_req req;
4764 			req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4765 
4766 			conn->info_ident = l2cap_get_ident(conn);
4767 
4768 			l2cap_send_cmd(conn, conn->info_ident,
4769 				       L2CAP_INFO_REQ, sizeof(req), &req);
4770 		} else {
4771 			conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4772 			conn->info_ident = 0;
4773 
4774 			l2cap_conn_start(conn);
4775 		}
4776 		break;
4777 
4778 	case L2CAP_IT_FIXED_CHAN:
4779 		conn->remote_fixed_chan = rsp->data[0];
4780 		conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4781 		conn->info_ident = 0;
4782 
4783 		l2cap_conn_start(conn);
4784 		break;
4785 	}
4786 
4787 	return 0;
4788 }
4789 
4790 static int l2cap_create_channel_req(struct l2cap_conn *conn,
4791 				    struct l2cap_cmd_hdr *cmd,
4792 				    u16 cmd_len, void *data)
4793 {
4794 	struct l2cap_create_chan_req *req = data;
4795 	struct l2cap_create_chan_rsp rsp;
4796 	struct l2cap_chan *chan;
4797 	struct hci_dev *hdev;
4798 	u16 psm, scid;
4799 
4800 	if (cmd_len != sizeof(*req))
4801 		return -EPROTO;
4802 
4803 	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
4804 		return -EINVAL;
4805 
4806 	psm = le16_to_cpu(req->psm);
4807 	scid = le16_to_cpu(req->scid);
4808 
4809 	BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
4810 
4811 	/* For controller id 0 make BR/EDR connection */
4812 	if (req->amp_id == AMP_ID_BREDR) {
4813 		l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4814 			      req->amp_id);
4815 		return 0;
4816 	}
4817 
4818 	/* Validate AMP controller id */
4819 	hdev = hci_dev_get(req->amp_id);
4820 	if (!hdev)
4821 		goto error;
4822 
4823 	if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4824 		hci_dev_put(hdev);
4825 		goto error;
4826 	}
4827 
4828 	chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4829 			     req->amp_id);
4830 	if (chan) {
4831 		struct amp_mgr *mgr = conn->hcon->amp_mgr;
4832 		struct hci_conn *hs_hcon;
4833 
4834 		hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK,
4835 						  &conn->hcon->dst);
4836 		if (!hs_hcon) {
4837 			hci_dev_put(hdev);
4838 			cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4839 					       chan->dcid);
4840 			return 0;
4841 		}
4842 
4843 		BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4844 
4845 		mgr->bredr_chan = chan;
4846 		chan->hs_hcon = hs_hcon;
4847 		chan->fcs = L2CAP_FCS_NONE;
4848 		conn->mtu = hdev->block_mtu;
4849 	}
4850 
4851 	hci_dev_put(hdev);
4852 
4853 	return 0;
4854 
4855 error:
4856 	rsp.dcid = 0;
4857 	rsp.scid = cpu_to_le16(scid);
4858 	rsp.result = cpu_to_le16(L2CAP_CR_BAD_AMP);
4859 	rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4860 
4861 	l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4862 		       sizeof(rsp), &rsp);
4863 
4864 	return 0;
4865 }
4866 
4867 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4868 {
4869 	struct l2cap_move_chan_req req;
4870 	u8 ident;
4871 
4872 	BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4873 
4874 	ident = l2cap_get_ident(chan->conn);
4875 	chan->ident = ident;
4876 
4877 	req.icid = cpu_to_le16(chan->scid);
4878 	req.dest_amp_id = dest_amp_id;
4879 
4880 	l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4881 		       &req);
4882 
4883 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4884 }
4885 
4886 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
4887 {
4888 	struct l2cap_move_chan_rsp rsp;
4889 
4890 	BT_DBG("chan %p, result 0x%4.4x", chan, result);
4891 
4892 	rsp.icid = cpu_to_le16(chan->dcid);
4893 	rsp.result = cpu_to_le16(result);
4894 
4895 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4896 		       sizeof(rsp), &rsp);
4897 }
4898 
4899 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
4900 {
4901 	struct l2cap_move_chan_cfm cfm;
4902 
4903 	BT_DBG("chan %p, result 0x%4.4x", chan, result);
4904 
4905 	chan->ident = l2cap_get_ident(chan->conn);
4906 
4907 	cfm.icid = cpu_to_le16(chan->scid);
4908 	cfm.result = cpu_to_le16(result);
4909 
4910 	l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4911 		       sizeof(cfm), &cfm);
4912 
4913 	__set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4914 }
4915 
4916 static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4917 {
4918 	struct l2cap_move_chan_cfm cfm;
4919 
4920 	BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4921 
4922 	cfm.icid = cpu_to_le16(icid);
4923 	cfm.result = cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4924 
4925 	l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4926 		       sizeof(cfm), &cfm);
4927 }
4928 
4929 static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
4930 					 u16 icid)
4931 {
4932 	struct l2cap_move_chan_cfm_rsp rsp;
4933 
4934 	BT_DBG("icid 0x%4.4x", icid);
4935 
4936 	rsp.icid = cpu_to_le16(icid);
4937 	l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4938 }
4939 
4940 static void __release_logical_link(struct l2cap_chan *chan)
4941 {
4942 	chan->hs_hchan = NULL;
4943 	chan->hs_hcon = NULL;
4944 
4945 	/* Placeholder - release the logical link */
4946 }
4947 
4948 static void l2cap_logical_fail(struct l2cap_chan *chan)
4949 {
4950 	/* Logical link setup failed */
4951 	if (chan->state != BT_CONNECTED) {
4952 		/* Create channel failure, disconnect */
4953 		l2cap_send_disconn_req(chan, ECONNRESET);
4954 		return;
4955 	}
4956 
4957 	switch (chan->move_role) {
4958 	case L2CAP_MOVE_ROLE_RESPONDER:
4959 		l2cap_move_done(chan);
4960 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4961 		break;
4962 	case L2CAP_MOVE_ROLE_INITIATOR:
4963 		if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4964 		    chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4965 			/* Remote has only sent pending or
4966 			 * success responses, clean up
4967 			 */
4968 			l2cap_move_done(chan);
4969 		}
4970 
4971 		/* Other amp move states imply that the move
4972 		 * has already aborted
4973 		 */
4974 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4975 		break;
4976 	}
4977 }
4978 
4979 static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4980 					struct hci_chan *hchan)
4981 {
4982 	struct l2cap_conf_rsp rsp;
4983 
4984 	chan->hs_hchan = hchan;
4985 	chan->hs_hcon->l2cap_data = chan->conn;
4986 
4987 	l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
4988 
4989 	if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4990 		int err;
4991 
4992 		set_default_fcs(chan);
4993 
4994 		err = l2cap_ertm_init(chan);
4995 		if (err < 0)
4996 			l2cap_send_disconn_req(chan, -err);
4997 		else
4998 			l2cap_chan_ready(chan);
4999 	}
5000 }
5001 
5002 static void l2cap_logical_finish_move(struct l2cap_chan *chan,
5003 				      struct hci_chan *hchan)
5004 {
5005 	chan->hs_hcon = hchan->conn;
5006 	chan->hs_hcon->l2cap_data = chan->conn;
5007 
5008 	BT_DBG("move_state %d", chan->move_state);
5009 
5010 	switch (chan->move_state) {
5011 	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5012 		/* Move confirm will be sent after a success
5013 		 * response is received
5014 		 */
5015 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5016 		break;
5017 	case L2CAP_MOVE_WAIT_LOGICAL_CFM:
5018 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5019 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5020 		} else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5021 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5022 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5023 		} else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
5024 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5025 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
5026 		}
5027 		break;
5028 	default:
5029 		/* Move was not in expected state, free the channel */
5030 		__release_logical_link(chan);
5031 
5032 		chan->move_state = L2CAP_MOVE_STABLE;
5033 	}
5034 }
5035 
5036 /* Call with chan locked */
5037 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
5038 		       u8 status)
5039 {
5040 	BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
5041 
5042 	if (status) {
5043 		l2cap_logical_fail(chan);
5044 		__release_logical_link(chan);
5045 		return;
5046 	}
5047 
5048 	if (chan->state != BT_CONNECTED) {
5049 		/* Ignore logical link if channel is on BR/EDR */
5050 		if (chan->local_amp_id != AMP_ID_BREDR)
5051 			l2cap_logical_finish_create(chan, hchan);
5052 	} else {
5053 		l2cap_logical_finish_move(chan, hchan);
5054 	}
5055 }
5056 
5057 void l2cap_move_start(struct l2cap_chan *chan)
5058 {
5059 	BT_DBG("chan %p", chan);
5060 
5061 	if (chan->local_amp_id == AMP_ID_BREDR) {
5062 		if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
5063 			return;
5064 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
5065 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
5066 		/* Placeholder - start physical link setup */
5067 	} else {
5068 		chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
5069 		chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5070 		chan->move_id = 0;
5071 		l2cap_move_setup(chan);
5072 		l2cap_send_move_chan_req(chan, 0);
5073 	}
5074 }
5075 
5076 static void l2cap_do_create(struct l2cap_chan *chan, int result,
5077 			    u8 local_amp_id, u8 remote_amp_id)
5078 {
5079 	BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
5080 	       local_amp_id, remote_amp_id);
5081 
5082 	chan->fcs = L2CAP_FCS_NONE;
5083 
5084 	/* Outgoing channel on AMP */
5085 	if (chan->state == BT_CONNECT) {
5086 		if (result == L2CAP_CR_SUCCESS) {
5087 			chan->local_amp_id = local_amp_id;
5088 			l2cap_send_create_chan_req(chan, remote_amp_id);
5089 		} else {
5090 			/* Revert to BR/EDR connect */
5091 			l2cap_send_conn_req(chan);
5092 		}
5093 
5094 		return;
5095 	}
5096 
5097 	/* Incoming channel on AMP */
5098 	if (__l2cap_no_conn_pending(chan)) {
5099 		struct l2cap_conn_rsp rsp;
5100 		char buf[128];
5101 		rsp.scid = cpu_to_le16(chan->dcid);
5102 		rsp.dcid = cpu_to_le16(chan->scid);
5103 
5104 		if (result == L2CAP_CR_SUCCESS) {
5105 			/* Send successful response */
5106 			rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
5107 			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
5108 		} else {
5109 			/* Send negative response */
5110 			rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
5111 			rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
5112 		}
5113 
5114 		l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
5115 			       sizeof(rsp), &rsp);
5116 
5117 		if (result == L2CAP_CR_SUCCESS) {
5118 			l2cap_state_change(chan, BT_CONFIG);
5119 			set_bit(CONF_REQ_SENT, &chan->conf_state);
5120 			l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
5121 				       L2CAP_CONF_REQ,
5122 				       l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
5123 			chan->num_conf_req++;
5124 		}
5125 	}
5126 }
5127 
5128 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
5129 				   u8 remote_amp_id)
5130 {
5131 	l2cap_move_setup(chan);
5132 	chan->move_id = local_amp_id;
5133 	chan->move_state = L2CAP_MOVE_WAIT_RSP;
5134 
5135 	l2cap_send_move_chan_req(chan, remote_amp_id);
5136 }
5137 
5138 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
5139 {
5140 	struct hci_chan *hchan = NULL;
5141 
5142 	/* Placeholder - get hci_chan for logical link */
5143 
5144 	if (hchan) {
5145 		if (hchan->state == BT_CONNECTED) {
5146 			/* Logical link is ready to go */
5147 			chan->hs_hcon = hchan->conn;
5148 			chan->hs_hcon->l2cap_data = chan->conn;
5149 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5150 			l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
5151 
5152 			l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5153 		} else {
5154 			/* Wait for logical link to be ready */
5155 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5156 		}
5157 	} else {
5158 		/* Logical link not available */
5159 		l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
5160 	}
5161 }
5162 
5163 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
5164 {
5165 	if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
5166 		u8 rsp_result;
5167 		if (result == -EINVAL)
5168 			rsp_result = L2CAP_MR_BAD_ID;
5169 		else
5170 			rsp_result = L2CAP_MR_NOT_ALLOWED;
5171 
5172 		l2cap_send_move_chan_rsp(chan, rsp_result);
5173 	}
5174 
5175 	chan->move_role = L2CAP_MOVE_ROLE_NONE;
5176 	chan->move_state = L2CAP_MOVE_STABLE;
5177 
5178 	/* Restart data transmission */
5179 	l2cap_ertm_send(chan);
5180 }
5181 
5182 /* Invoke with locked chan */
5183 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
5184 {
5185 	u8 local_amp_id = chan->local_amp_id;
5186 	u8 remote_amp_id = chan->remote_amp_id;
5187 
5188 	BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
5189 	       chan, result, local_amp_id, remote_amp_id);
5190 
5191 	if (chan->state == BT_DISCONN || chan->state == BT_CLOSED)
5192 		return;
5193 
5194 	if (chan->state != BT_CONNECTED) {
5195 		l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
5196 	} else if (result != L2CAP_MR_SUCCESS) {
5197 		l2cap_do_move_cancel(chan, result);
5198 	} else {
5199 		switch (chan->move_role) {
5200 		case L2CAP_MOVE_ROLE_INITIATOR:
5201 			l2cap_do_move_initiate(chan, local_amp_id,
5202 					       remote_amp_id);
5203 			break;
5204 		case L2CAP_MOVE_ROLE_RESPONDER:
5205 			l2cap_do_move_respond(chan, result);
5206 			break;
5207 		default:
5208 			l2cap_do_move_cancel(chan, result);
5209 			break;
5210 		}
5211 	}
5212 }
5213 
5214 static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
5215 					 struct l2cap_cmd_hdr *cmd,
5216 					 u16 cmd_len, void *data)
5217 {
5218 	struct l2cap_move_chan_req *req = data;
5219 	struct l2cap_move_chan_rsp rsp;
5220 	struct l2cap_chan *chan;
5221 	u16 icid = 0;
5222 	u16 result = L2CAP_MR_NOT_ALLOWED;
5223 
5224 	if (cmd_len != sizeof(*req))
5225 		return -EPROTO;
5226 
5227 	icid = le16_to_cpu(req->icid);
5228 
5229 	BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
5230 
5231 	if (!(conn->local_fixed_chan & L2CAP_FC_A2MP))
5232 		return -EINVAL;
5233 
5234 	chan = l2cap_get_chan_by_dcid(conn, icid);
5235 	if (!chan) {
5236 		rsp.icid = cpu_to_le16(icid);
5237 		rsp.result = cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
5238 		l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
5239 			       sizeof(rsp), &rsp);
5240 		return 0;
5241 	}
5242 
5243 	chan->ident = cmd->ident;
5244 
5245 	if (chan->scid < L2CAP_CID_DYN_START ||
5246 	    chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
5247 	    (chan->mode != L2CAP_MODE_ERTM &&
5248 	     chan->mode != L2CAP_MODE_STREAMING)) {
5249 		result = L2CAP_MR_NOT_ALLOWED;
5250 		goto send_move_response;
5251 	}
5252 
5253 	if (chan->local_amp_id == req->dest_amp_id) {
5254 		result = L2CAP_MR_SAME_ID;
5255 		goto send_move_response;
5256 	}
5257 
5258 	if (req->dest_amp_id != AMP_ID_BREDR) {
5259 		struct hci_dev *hdev;
5260 		hdev = hci_dev_get(req->dest_amp_id);
5261 		if (!hdev || hdev->dev_type != HCI_AMP ||
5262 		    !test_bit(HCI_UP, &hdev->flags)) {
5263 			if (hdev)
5264 				hci_dev_put(hdev);
5265 
5266 			result = L2CAP_MR_BAD_ID;
5267 			goto send_move_response;
5268 		}
5269 		hci_dev_put(hdev);
5270 	}
5271 
5272 	/* Detect a move collision.  Only send a collision response
5273 	 * if this side has "lost", otherwise proceed with the move.
5274 	 * The winner has the larger bd_addr.
5275 	 */
5276 	if ((__chan_is_moving(chan) ||
5277 	     chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
5278 	    bacmp(&conn->hcon->src, &conn->hcon->dst) > 0) {
5279 		result = L2CAP_MR_COLLISION;
5280 		goto send_move_response;
5281 	}
5282 
5283 	chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5284 	l2cap_move_setup(chan);
5285 	chan->move_id = req->dest_amp_id;
5286 
5287 	if (req->dest_amp_id == AMP_ID_BREDR) {
5288 		/* Moving to BR/EDR */
5289 		if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5290 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5291 			result = L2CAP_MR_PEND;
5292 		} else {
5293 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
5294 			result = L2CAP_MR_SUCCESS;
5295 		}
5296 	} else {
5297 		chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
5298 		/* Placeholder - uncomment when amp functions are available */
5299 		/*amp_accept_physical(chan, req->dest_amp_id);*/
5300 		result = L2CAP_MR_PEND;
5301 	}
5302 
5303 send_move_response:
5304 	l2cap_send_move_chan_rsp(chan, result);
5305 
5306 	l2cap_chan_unlock(chan);
5307 
5308 	return 0;
5309 }
5310 
5311 static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
5312 {
5313 	struct l2cap_chan *chan;
5314 	struct hci_chan *hchan = NULL;
5315 
5316 	chan = l2cap_get_chan_by_scid(conn, icid);
5317 	if (!chan) {
5318 		l2cap_send_move_chan_cfm_icid(conn, icid);
5319 		return;
5320 	}
5321 
5322 	__clear_chan_timer(chan);
5323 	if (result == L2CAP_MR_PEND)
5324 		__set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
5325 
5326 	switch (chan->move_state) {
5327 	case L2CAP_MOVE_WAIT_LOGICAL_COMP:
5328 		/* Move confirm will be sent when logical link
5329 		 * is complete.
5330 		 */
5331 		chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5332 		break;
5333 	case L2CAP_MOVE_WAIT_RSP_SUCCESS:
5334 		if (result == L2CAP_MR_PEND) {
5335 			break;
5336 		} else if (test_bit(CONN_LOCAL_BUSY,
5337 				    &chan->conn_state)) {
5338 			chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
5339 		} else {
5340 			/* Logical link is up or moving to BR/EDR,
5341 			 * proceed with move
5342 			 */
5343 			chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
5344 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5345 		}
5346 		break;
5347 	case L2CAP_MOVE_WAIT_RSP:
5348 		/* Moving to AMP */
5349 		if (result == L2CAP_MR_SUCCESS) {
5350 			/* Remote is ready, send confirm immediately
5351 			 * after logical link is ready
5352 			 */
5353 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
5354 		} else {
5355 			/* Both logical link and move success
5356 			 * are required to confirm
5357 			 */
5358 			chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
5359 		}
5360 
5361 		/* Placeholder - get hci_chan for logical link */
5362 		if (!hchan) {
5363 			/* Logical link not available */
5364 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5365 			break;
5366 		}
5367 
5368 		/* If the logical link is not yet connected, do not
5369 		 * send confirmation.
5370 		 */
5371 		if (hchan->state != BT_CONNECTED)
5372 			break;
5373 
5374 		/* Logical link is already ready to go */
5375 
5376 		chan->hs_hcon = hchan->conn;
5377 		chan->hs_hcon->l2cap_data = chan->conn;
5378 
5379 		if (result == L2CAP_MR_SUCCESS) {
5380 			/* Can confirm now */
5381 			l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
5382 		} else {
5383 			/* Now only need move success
5384 			 * to confirm
5385 			 */
5386 			chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
5387 		}
5388 
5389 		l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
5390 		break;
5391 	default:
5392 		/* Any other amp move state means the move failed. */
5393 		chan->move_id = chan->local_amp_id;
5394 		l2cap_move_done(chan);
5395 		l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5396 	}
5397 
5398 	l2cap_chan_unlock(chan);
5399 }
5400 
5401 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5402 			    u16 result)
5403 {
5404 	struct l2cap_chan *chan;
5405 
5406 	chan = l2cap_get_chan_by_ident(conn, ident);
5407 	if (!chan) {
5408 		/* Could not locate channel, icid is best guess */
5409 		l2cap_send_move_chan_cfm_icid(conn, icid);
5410 		return;
5411 	}
5412 
5413 	__clear_chan_timer(chan);
5414 
5415 	if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5416 		if (result == L2CAP_MR_COLLISION) {
5417 			chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5418 		} else {
5419 			/* Cleanup - cancel move */
5420 			chan->move_id = chan->local_amp_id;
5421 			l2cap_move_done(chan);
5422 		}
5423 	}
5424 
5425 	l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5426 
5427 	l2cap_chan_unlock(chan);
5428 }
5429 
5430 static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5431 				  struct l2cap_cmd_hdr *cmd,
5432 				  u16 cmd_len, void *data)
5433 {
5434 	struct l2cap_move_chan_rsp *rsp = data;
5435 	u16 icid, result;
5436 
5437 	if (cmd_len != sizeof(*rsp))
5438 		return -EPROTO;
5439 
5440 	icid = le16_to_cpu(rsp->icid);
5441 	result = le16_to_cpu(rsp->result);
5442 
5443 	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5444 
5445 	if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5446 		l2cap_move_continue(conn, icid, result);
5447 	else
5448 		l2cap_move_fail(conn, cmd->ident, icid, result);
5449 
5450 	return 0;
5451 }
5452 
5453 static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5454 				      struct l2cap_cmd_hdr *cmd,
5455 				      u16 cmd_len, void *data)
5456 {
5457 	struct l2cap_move_chan_cfm *cfm = data;
5458 	struct l2cap_chan *chan;
5459 	u16 icid, result;
5460 
5461 	if (cmd_len != sizeof(*cfm))
5462 		return -EPROTO;
5463 
5464 	icid = le16_to_cpu(cfm->icid);
5465 	result = le16_to_cpu(cfm->result);
5466 
5467 	BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5468 
5469 	chan = l2cap_get_chan_by_dcid(conn, icid);
5470 	if (!chan) {
5471 		/* Spec requires a response even if the icid was not found */
5472 		l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5473 		return 0;
5474 	}
5475 
5476 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5477 		if (result == L2CAP_MC_CONFIRMED) {
5478 			chan->local_amp_id = chan->move_id;
5479 			if (chan->local_amp_id == AMP_ID_BREDR)
5480 				__release_logical_link(chan);
5481 		} else {
5482 			chan->move_id = chan->local_amp_id;
5483 		}
5484 
5485 		l2cap_move_done(chan);
5486 	}
5487 
5488 	l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5489 
5490 	l2cap_chan_unlock(chan);
5491 
5492 	return 0;
5493 }
5494 
5495 static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
5496 						 struct l2cap_cmd_hdr *cmd,
5497 						 u16 cmd_len, void *data)
5498 {
5499 	struct l2cap_move_chan_cfm_rsp *rsp = data;
5500 	struct l2cap_chan *chan;
5501 	u16 icid;
5502 
5503 	if (cmd_len != sizeof(*rsp))
5504 		return -EPROTO;
5505 
5506 	icid = le16_to_cpu(rsp->icid);
5507 
5508 	BT_DBG("icid 0x%4.4x", icid);
5509 
5510 	chan = l2cap_get_chan_by_scid(conn, icid);
5511 	if (!chan)
5512 		return 0;
5513 
5514 	__clear_chan_timer(chan);
5515 
5516 	if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5517 		chan->local_amp_id = chan->move_id;
5518 
5519 		if (chan->local_amp_id == AMP_ID_BREDR && chan->hs_hchan)
5520 			__release_logical_link(chan);
5521 
5522 		l2cap_move_done(chan);
5523 	}
5524 
5525 	l2cap_chan_unlock(chan);
5526 
5527 	return 0;
5528 }
5529 
5530 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
5531 					      struct l2cap_cmd_hdr *cmd,
5532 					      u16 cmd_len, u8 *data)
5533 {
5534 	struct hci_conn *hcon = conn->hcon;
5535 	struct l2cap_conn_param_update_req *req;
5536 	struct l2cap_conn_param_update_rsp rsp;
5537 	u16 min, max, latency, to_multiplier;
5538 	int err;
5539 
5540 	if (hcon->role != HCI_ROLE_MASTER)
5541 		return -EINVAL;
5542 
5543 	if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5544 		return -EPROTO;
5545 
5546 	req = (struct l2cap_conn_param_update_req *) data;
5547 	min		= __le16_to_cpu(req->min);
5548 	max		= __le16_to_cpu(req->max);
5549 	latency		= __le16_to_cpu(req->latency);
5550 	to_multiplier	= __le16_to_cpu(req->to_multiplier);
5551 
5552 	BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
5553 	       min, max, latency, to_multiplier);
5554 
5555 	memset(&rsp, 0, sizeof(rsp));
5556 
5557 	err = hci_check_conn_params(min, max, latency, to_multiplier);
5558 	if (err)
5559 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
5560 	else
5561 		rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
5562 
5563 	l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
5564 		       sizeof(rsp), &rsp);
5565 
5566 	if (!err) {
5567 		u8 store_hint;
5568 
5569 		store_hint = hci_le_conn_update(hcon, min, max, latency,
5570 						to_multiplier);
5571 		mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
5572 				    store_hint, min, max, latency,
5573 				    to_multiplier);
5574 
5575 	}
5576 
5577 	return 0;
5578 }
5579 
5580 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
5581 				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5582 				u8 *data)
5583 {
5584 	struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
5585 	struct hci_conn *hcon = conn->hcon;
5586 	u16 dcid, mtu, mps, credits, result;
5587 	struct l2cap_chan *chan;
5588 	int err, sec_level;
5589 
5590 	if (cmd_len < sizeof(*rsp))
5591 		return -EPROTO;
5592 
5593 	dcid    = __le16_to_cpu(rsp->dcid);
5594 	mtu     = __le16_to_cpu(rsp->mtu);
5595 	mps     = __le16_to_cpu(rsp->mps);
5596 	credits = __le16_to_cpu(rsp->credits);
5597 	result  = __le16_to_cpu(rsp->result);
5598 
5599 	if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
5600 					   dcid < L2CAP_CID_DYN_START ||
5601 					   dcid > L2CAP_CID_LE_DYN_END))
5602 		return -EPROTO;
5603 
5604 	BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
5605 	       dcid, mtu, mps, credits, result);
5606 
5607 	mutex_lock(&conn->chan_lock);
5608 
5609 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5610 	if (!chan) {
5611 		err = -EBADSLT;
5612 		goto unlock;
5613 	}
5614 
5615 	err = 0;
5616 
5617 	l2cap_chan_lock(chan);
5618 
5619 	switch (result) {
5620 	case L2CAP_CR_LE_SUCCESS:
5621 		if (__l2cap_get_chan_by_dcid(conn, dcid)) {
5622 			err = -EBADSLT;
5623 			break;
5624 		}
5625 
5626 		chan->ident = 0;
5627 		chan->dcid = dcid;
5628 		chan->omtu = mtu;
5629 		chan->remote_mps = mps;
5630 		chan->tx_credits = credits;
5631 		l2cap_chan_ready(chan);
5632 		break;
5633 
5634 	case L2CAP_CR_LE_AUTHENTICATION:
5635 	case L2CAP_CR_LE_ENCRYPTION:
5636 		/* If we already have MITM protection we can't do
5637 		 * anything.
5638 		 */
5639 		if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5640 			l2cap_chan_del(chan, ECONNREFUSED);
5641 			break;
5642 		}
5643 
5644 		sec_level = hcon->sec_level + 1;
5645 		if (chan->sec_level < sec_level)
5646 			chan->sec_level = sec_level;
5647 
5648 		/* We'll need to send a new Connect Request */
5649 		clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
5650 
5651 		smp_conn_security(hcon, chan->sec_level);
5652 		break;
5653 
5654 	default:
5655 		l2cap_chan_del(chan, ECONNREFUSED);
5656 		break;
5657 	}
5658 
5659 	l2cap_chan_unlock(chan);
5660 
5661 unlock:
5662 	mutex_unlock(&conn->chan_lock);
5663 
5664 	return err;
5665 }
5666 
5667 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
5668 				      struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5669 				      u8 *data)
5670 {
5671 	int err = 0;
5672 
5673 	switch (cmd->code) {
5674 	case L2CAP_COMMAND_REJ:
5675 		l2cap_command_rej(conn, cmd, cmd_len, data);
5676 		break;
5677 
5678 	case L2CAP_CONN_REQ:
5679 		err = l2cap_connect_req(conn, cmd, cmd_len, data);
5680 		break;
5681 
5682 	case L2CAP_CONN_RSP:
5683 	case L2CAP_CREATE_CHAN_RSP:
5684 		l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
5685 		break;
5686 
5687 	case L2CAP_CONF_REQ:
5688 		err = l2cap_config_req(conn, cmd, cmd_len, data);
5689 		break;
5690 
5691 	case L2CAP_CONF_RSP:
5692 		l2cap_config_rsp(conn, cmd, cmd_len, data);
5693 		break;
5694 
5695 	case L2CAP_DISCONN_REQ:
5696 		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5697 		break;
5698 
5699 	case L2CAP_DISCONN_RSP:
5700 		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5701 		break;
5702 
5703 	case L2CAP_ECHO_REQ:
5704 		l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5705 		break;
5706 
5707 	case L2CAP_ECHO_RSP:
5708 		break;
5709 
5710 	case L2CAP_INFO_REQ:
5711 		err = l2cap_information_req(conn, cmd, cmd_len, data);
5712 		break;
5713 
5714 	case L2CAP_INFO_RSP:
5715 		l2cap_information_rsp(conn, cmd, cmd_len, data);
5716 		break;
5717 
5718 	case L2CAP_CREATE_CHAN_REQ:
5719 		err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5720 		break;
5721 
5722 	case L2CAP_MOVE_CHAN_REQ:
5723 		err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5724 		break;
5725 
5726 	case L2CAP_MOVE_CHAN_RSP:
5727 		l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
5728 		break;
5729 
5730 	case L2CAP_MOVE_CHAN_CFM:
5731 		err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5732 		break;
5733 
5734 	case L2CAP_MOVE_CHAN_CFM_RSP:
5735 		l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
5736 		break;
5737 
5738 	default:
5739 		BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5740 		err = -EINVAL;
5741 		break;
5742 	}
5743 
5744 	return err;
5745 }
5746 
5747 static int l2cap_le_connect_req(struct l2cap_conn *conn,
5748 				struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5749 				u8 *data)
5750 {
5751 	struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
5752 	struct l2cap_le_conn_rsp rsp;
5753 	struct l2cap_chan *chan, *pchan;
5754 	u16 dcid, scid, credits, mtu, mps;
5755 	__le16 psm;
5756 	u8 result;
5757 
5758 	if (cmd_len != sizeof(*req))
5759 		return -EPROTO;
5760 
5761 	scid = __le16_to_cpu(req->scid);
5762 	mtu  = __le16_to_cpu(req->mtu);
5763 	mps  = __le16_to_cpu(req->mps);
5764 	psm  = req->psm;
5765 	dcid = 0;
5766 	credits = 0;
5767 
5768 	if (mtu < 23 || mps < 23)
5769 		return -EPROTO;
5770 
5771 	BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
5772 	       scid, mtu, mps);
5773 
5774 	/* Check if we have socket listening on psm */
5775 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5776 					 &conn->hcon->dst, LE_LINK);
5777 	if (!pchan) {
5778 		result = L2CAP_CR_LE_BAD_PSM;
5779 		chan = NULL;
5780 		goto response;
5781 	}
5782 
5783 	mutex_lock(&conn->chan_lock);
5784 	l2cap_chan_lock(pchan);
5785 
5786 	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5787 				     SMP_ALLOW_STK)) {
5788 		result = L2CAP_CR_LE_AUTHENTICATION;
5789 		chan = NULL;
5790 		goto response_unlock;
5791 	}
5792 
5793 	/* Check for valid dynamic CID range */
5794 	if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5795 		result = L2CAP_CR_LE_INVALID_SCID;
5796 		chan = NULL;
5797 		goto response_unlock;
5798 	}
5799 
5800 	/* Check if we already have channel with that dcid */
5801 	if (__l2cap_get_chan_by_dcid(conn, scid)) {
5802 		result = L2CAP_CR_LE_SCID_IN_USE;
5803 		chan = NULL;
5804 		goto response_unlock;
5805 	}
5806 
5807 	chan = pchan->ops->new_connection(pchan);
5808 	if (!chan) {
5809 		result = L2CAP_CR_LE_NO_MEM;
5810 		goto response_unlock;
5811 	}
5812 
5813 	bacpy(&chan->src, &conn->hcon->src);
5814 	bacpy(&chan->dst, &conn->hcon->dst);
5815 	chan->src_type = bdaddr_src_type(conn->hcon);
5816 	chan->dst_type = bdaddr_dst_type(conn->hcon);
5817 	chan->psm  = psm;
5818 	chan->dcid = scid;
5819 	chan->omtu = mtu;
5820 	chan->remote_mps = mps;
5821 
5822 	__l2cap_chan_add(conn, chan);
5823 
5824 	l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
5825 
5826 	dcid = chan->scid;
5827 	credits = chan->rx_credits;
5828 
5829 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5830 
5831 	chan->ident = cmd->ident;
5832 
5833 	if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5834 		l2cap_state_change(chan, BT_CONNECT2);
5835 		/* The following result value is actually not defined
5836 		 * for LE CoC but we use it to let the function know
5837 		 * that it should bail out after doing its cleanup
5838 		 * instead of sending a response.
5839 		 */
5840 		result = L2CAP_CR_PEND;
5841 		chan->ops->defer(chan);
5842 	} else {
5843 		l2cap_chan_ready(chan);
5844 		result = L2CAP_CR_LE_SUCCESS;
5845 	}
5846 
5847 response_unlock:
5848 	l2cap_chan_unlock(pchan);
5849 	mutex_unlock(&conn->chan_lock);
5850 	l2cap_chan_put(pchan);
5851 
5852 	if (result == L2CAP_CR_PEND)
5853 		return 0;
5854 
5855 response:
5856 	if (chan) {
5857 		rsp.mtu = cpu_to_le16(chan->imtu);
5858 		rsp.mps = cpu_to_le16(chan->mps);
5859 	} else {
5860 		rsp.mtu = 0;
5861 		rsp.mps = 0;
5862 	}
5863 
5864 	rsp.dcid    = cpu_to_le16(dcid);
5865 	rsp.credits = cpu_to_le16(credits);
5866 	rsp.result  = cpu_to_le16(result);
5867 
5868 	l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
5869 
5870 	return 0;
5871 }
5872 
5873 static inline int l2cap_le_credits(struct l2cap_conn *conn,
5874 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5875 				   u8 *data)
5876 {
5877 	struct l2cap_le_credits *pkt;
5878 	struct l2cap_chan *chan;
5879 	u16 cid, credits, max_credits;
5880 
5881 	if (cmd_len != sizeof(*pkt))
5882 		return -EPROTO;
5883 
5884 	pkt = (struct l2cap_le_credits *) data;
5885 	cid	= __le16_to_cpu(pkt->cid);
5886 	credits	= __le16_to_cpu(pkt->credits);
5887 
5888 	BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
5889 
5890 	chan = l2cap_get_chan_by_dcid(conn, cid);
5891 	if (!chan)
5892 		return -EBADSLT;
5893 
5894 	max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
5895 	if (credits > max_credits) {
5896 		BT_ERR("LE credits overflow");
5897 		l2cap_send_disconn_req(chan, ECONNRESET);
5898 		l2cap_chan_unlock(chan);
5899 
5900 		/* Return 0 so that we don't trigger an unnecessary
5901 		 * command reject packet.
5902 		 */
5903 		return 0;
5904 	}
5905 
5906 	chan->tx_credits += credits;
5907 
5908 	/* Resume sending */
5909 	l2cap_le_flowctl_send(chan);
5910 
5911 	if (chan->tx_credits)
5912 		chan->ops->resume(chan);
5913 
5914 	l2cap_chan_unlock(chan);
5915 
5916 	return 0;
5917 }
5918 
5919 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
5920 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5921 				       u8 *data)
5922 {
5923 	struct l2cap_ecred_conn_req *req = (void *) data;
5924 	struct {
5925 		struct l2cap_ecred_conn_rsp rsp;
5926 		__le16 dcid[L2CAP_ECRED_MAX_CID];
5927 	} __packed pdu;
5928 	struct l2cap_chan *chan, *pchan;
5929 	u16 mtu, mps;
5930 	__le16 psm;
5931 	u8 result, len = 0;
5932 	int i, num_scid;
5933 	bool defer = false;
5934 
5935 	if (!enable_ecred)
5936 		return -EINVAL;
5937 
5938 	if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5939 		result = L2CAP_CR_LE_INVALID_PARAMS;
5940 		goto response;
5941 	}
5942 
5943 	cmd_len -= sizeof(*req);
5944 	num_scid = cmd_len / sizeof(u16);
5945 
5946 	if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5947 		result = L2CAP_CR_LE_INVALID_PARAMS;
5948 		goto response;
5949 	}
5950 
5951 	mtu  = __le16_to_cpu(req->mtu);
5952 	mps  = __le16_to_cpu(req->mps);
5953 
5954 	if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5955 		result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5956 		goto response;
5957 	}
5958 
5959 	psm  = req->psm;
5960 
5961 	BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5962 
5963 	memset(&pdu, 0, sizeof(pdu));
5964 
5965 	/* Check if we have socket listening on psm */
5966 	pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5967 					 &conn->hcon->dst, LE_LINK);
5968 	if (!pchan) {
5969 		result = L2CAP_CR_LE_BAD_PSM;
5970 		goto response;
5971 	}
5972 
5973 	mutex_lock(&conn->chan_lock);
5974 	l2cap_chan_lock(pchan);
5975 
5976 	if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5977 				     SMP_ALLOW_STK)) {
5978 		result = L2CAP_CR_LE_AUTHENTICATION;
5979 		goto unlock;
5980 	}
5981 
5982 	result = L2CAP_CR_LE_SUCCESS;
5983 
5984 	for (i = 0; i < num_scid; i++) {
5985 		u16 scid = __le16_to_cpu(req->scid[i]);
5986 
5987 		BT_DBG("scid[%d] 0x%4.4x", i, scid);
5988 
5989 		pdu.dcid[i] = 0x0000;
5990 		len += sizeof(*pdu.dcid);
5991 
5992 		/* Check for valid dynamic CID range */
5993 		if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5994 			result = L2CAP_CR_LE_INVALID_SCID;
5995 			continue;
5996 		}
5997 
5998 		/* Check if we already have channel with that dcid */
5999 		if (__l2cap_get_chan_by_dcid(conn, scid)) {
6000 			result = L2CAP_CR_LE_SCID_IN_USE;
6001 			continue;
6002 		}
6003 
6004 		chan = pchan->ops->new_connection(pchan);
6005 		if (!chan) {
6006 			result = L2CAP_CR_LE_NO_MEM;
6007 			continue;
6008 		}
6009 
6010 		bacpy(&chan->src, &conn->hcon->src);
6011 		bacpy(&chan->dst, &conn->hcon->dst);
6012 		chan->src_type = bdaddr_src_type(conn->hcon);
6013 		chan->dst_type = bdaddr_dst_type(conn->hcon);
6014 		chan->psm  = psm;
6015 		chan->dcid = scid;
6016 		chan->omtu = mtu;
6017 		chan->remote_mps = mps;
6018 
6019 		__l2cap_chan_add(conn, chan);
6020 
6021 		l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
6022 
6023 		/* Init response */
6024 		if (!pdu.rsp.credits) {
6025 			pdu.rsp.mtu = cpu_to_le16(chan->imtu);
6026 			pdu.rsp.mps = cpu_to_le16(chan->mps);
6027 			pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
6028 		}
6029 
6030 		pdu.dcid[i] = cpu_to_le16(chan->scid);
6031 
6032 		__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
6033 
6034 		chan->ident = cmd->ident;
6035 
6036 		if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
6037 			l2cap_state_change(chan, BT_CONNECT2);
6038 			defer = true;
6039 			chan->ops->defer(chan);
6040 		} else {
6041 			l2cap_chan_ready(chan);
6042 		}
6043 	}
6044 
6045 unlock:
6046 	l2cap_chan_unlock(pchan);
6047 	mutex_unlock(&conn->chan_lock);
6048 	l2cap_chan_put(pchan);
6049 
6050 response:
6051 	pdu.rsp.result = cpu_to_le16(result);
6052 
6053 	if (defer)
6054 		return 0;
6055 
6056 	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
6057 		       sizeof(pdu.rsp) + len, &pdu);
6058 
6059 	return 0;
6060 }
6061 
6062 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
6063 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6064 				       u8 *data)
6065 {
6066 	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
6067 	struct hci_conn *hcon = conn->hcon;
6068 	u16 mtu, mps, credits, result;
6069 	struct l2cap_chan *chan;
6070 	int err = 0, sec_level;
6071 	int i = 0;
6072 
6073 	if (cmd_len < sizeof(*rsp))
6074 		return -EPROTO;
6075 
6076 	mtu     = __le16_to_cpu(rsp->mtu);
6077 	mps     = __le16_to_cpu(rsp->mps);
6078 	credits = __le16_to_cpu(rsp->credits);
6079 	result  = __le16_to_cpu(rsp->result);
6080 
6081 	BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
6082 	       result);
6083 
6084 	mutex_lock(&conn->chan_lock);
6085 
6086 	cmd_len -= sizeof(*rsp);
6087 
6088 	list_for_each_entry(chan, &conn->chan_l, list) {
6089 		u16 dcid;
6090 
6091 		if (chan->ident != cmd->ident ||
6092 		    chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
6093 		    chan->state == BT_CONNECTED)
6094 			continue;
6095 
6096 		l2cap_chan_lock(chan);
6097 
6098 		/* Check that there is a dcid for each pending channel */
6099 		if (cmd_len < sizeof(dcid)) {
6100 			l2cap_chan_del(chan, ECONNREFUSED);
6101 			l2cap_chan_unlock(chan);
6102 			continue;
6103 		}
6104 
6105 		dcid = __le16_to_cpu(rsp->dcid[i++]);
6106 		cmd_len -= sizeof(u16);
6107 
6108 		BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
6109 
6110 		/* Check if dcid is already in use */
6111 		if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
6112 			/* If a device receives a
6113 			 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
6114 			 * already-assigned Destination CID, then both the
6115 			 * original channel and the new channel shall be
6116 			 * immediately discarded and not used.
6117 			 */
6118 			l2cap_chan_del(chan, ECONNREFUSED);
6119 			l2cap_chan_unlock(chan);
6120 			chan = __l2cap_get_chan_by_dcid(conn, dcid);
6121 			l2cap_chan_lock(chan);
6122 			l2cap_chan_del(chan, ECONNRESET);
6123 			l2cap_chan_unlock(chan);
6124 			continue;
6125 		}
6126 
6127 		switch (result) {
6128 		case L2CAP_CR_LE_AUTHENTICATION:
6129 		case L2CAP_CR_LE_ENCRYPTION:
6130 			/* If we already have MITM protection we can't do
6131 			 * anything.
6132 			 */
6133 			if (hcon->sec_level > BT_SECURITY_MEDIUM) {
6134 				l2cap_chan_del(chan, ECONNREFUSED);
6135 				break;
6136 			}
6137 
6138 			sec_level = hcon->sec_level + 1;
6139 			if (chan->sec_level < sec_level)
6140 				chan->sec_level = sec_level;
6141 
6142 			/* We'll need to send a new Connect Request */
6143 			clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
6144 
6145 			smp_conn_security(hcon, chan->sec_level);
6146 			break;
6147 
6148 		case L2CAP_CR_LE_BAD_PSM:
6149 			l2cap_chan_del(chan, ECONNREFUSED);
6150 			break;
6151 
6152 		default:
6153 			/* If dcid was not set it means channels was refused */
6154 			if (!dcid) {
6155 				l2cap_chan_del(chan, ECONNREFUSED);
6156 				break;
6157 			}
6158 
6159 			chan->ident = 0;
6160 			chan->dcid = dcid;
6161 			chan->omtu = mtu;
6162 			chan->remote_mps = mps;
6163 			chan->tx_credits = credits;
6164 			l2cap_chan_ready(chan);
6165 			break;
6166 		}
6167 
6168 		l2cap_chan_unlock(chan);
6169 	}
6170 
6171 	mutex_unlock(&conn->chan_lock);
6172 
6173 	return err;
6174 }
6175 
6176 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
6177 					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6178 					 u8 *data)
6179 {
6180 	struct l2cap_ecred_reconf_req *req = (void *) data;
6181 	struct l2cap_ecred_reconf_rsp rsp;
6182 	u16 mtu, mps, result;
6183 	struct l2cap_chan *chan;
6184 	int i, num_scid;
6185 
6186 	if (!enable_ecred)
6187 		return -EINVAL;
6188 
6189 	if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
6190 		result = L2CAP_CR_LE_INVALID_PARAMS;
6191 		goto respond;
6192 	}
6193 
6194 	mtu = __le16_to_cpu(req->mtu);
6195 	mps = __le16_to_cpu(req->mps);
6196 
6197 	BT_DBG("mtu %u mps %u", mtu, mps);
6198 
6199 	if (mtu < L2CAP_ECRED_MIN_MTU) {
6200 		result = L2CAP_RECONF_INVALID_MTU;
6201 		goto respond;
6202 	}
6203 
6204 	if (mps < L2CAP_ECRED_MIN_MPS) {
6205 		result = L2CAP_RECONF_INVALID_MPS;
6206 		goto respond;
6207 	}
6208 
6209 	cmd_len -= sizeof(*req);
6210 	num_scid = cmd_len / sizeof(u16);
6211 	result = L2CAP_RECONF_SUCCESS;
6212 
6213 	for (i = 0; i < num_scid; i++) {
6214 		u16 scid;
6215 
6216 		scid = __le16_to_cpu(req->scid[i]);
6217 		if (!scid)
6218 			return -EPROTO;
6219 
6220 		chan = __l2cap_get_chan_by_dcid(conn, scid);
6221 		if (!chan)
6222 			continue;
6223 
6224 		/* If the MTU value is decreased for any of the included
6225 		 * channels, then the receiver shall disconnect all
6226 		 * included channels.
6227 		 */
6228 		if (chan->omtu > mtu) {
6229 			BT_ERR("chan %p decreased MTU %u -> %u", chan,
6230 			       chan->omtu, mtu);
6231 			result = L2CAP_RECONF_INVALID_MTU;
6232 		}
6233 
6234 		chan->omtu = mtu;
6235 		chan->remote_mps = mps;
6236 	}
6237 
6238 respond:
6239 	rsp.result = cpu_to_le16(result);
6240 
6241 	l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
6242 		       &rsp);
6243 
6244 	return 0;
6245 }
6246 
6247 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
6248 					 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6249 					 u8 *data)
6250 {
6251 	struct l2cap_chan *chan;
6252 	struct l2cap_ecred_conn_rsp *rsp = (void *) data;
6253 	u16 result;
6254 
6255 	if (cmd_len < sizeof(*rsp))
6256 		return -EPROTO;
6257 
6258 	result = __le16_to_cpu(rsp->result);
6259 
6260 	BT_DBG("result 0x%4.4x", rsp->result);
6261 
6262 	if (!result)
6263 		return 0;
6264 
6265 	list_for_each_entry(chan, &conn->chan_l, list) {
6266 		if (chan->ident != cmd->ident)
6267 			continue;
6268 
6269 		l2cap_chan_del(chan, ECONNRESET);
6270 	}
6271 
6272 	return 0;
6273 }
6274 
6275 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
6276 				       struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6277 				       u8 *data)
6278 {
6279 	struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
6280 	struct l2cap_chan *chan;
6281 
6282 	if (cmd_len < sizeof(*rej))
6283 		return -EPROTO;
6284 
6285 	mutex_lock(&conn->chan_lock);
6286 
6287 	chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
6288 	if (!chan)
6289 		goto done;
6290 
6291 	l2cap_chan_lock(chan);
6292 	l2cap_chan_del(chan, ECONNREFUSED);
6293 	l2cap_chan_unlock(chan);
6294 
6295 done:
6296 	mutex_unlock(&conn->chan_lock);
6297 	return 0;
6298 }
6299 
6300 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
6301 				   struct l2cap_cmd_hdr *cmd, u16 cmd_len,
6302 				   u8 *data)
6303 {
6304 	int err = 0;
6305 
6306 	switch (cmd->code) {
6307 	case L2CAP_COMMAND_REJ:
6308 		l2cap_le_command_rej(conn, cmd, cmd_len, data);
6309 		break;
6310 
6311 	case L2CAP_CONN_PARAM_UPDATE_REQ:
6312 		err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
6313 		break;
6314 
6315 	case L2CAP_CONN_PARAM_UPDATE_RSP:
6316 		break;
6317 
6318 	case L2CAP_LE_CONN_RSP:
6319 		l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
6320 		break;
6321 
6322 	case L2CAP_LE_CONN_REQ:
6323 		err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
6324 		break;
6325 
6326 	case L2CAP_LE_CREDITS:
6327 		err = l2cap_le_credits(conn, cmd, cmd_len, data);
6328 		break;
6329 
6330 	case L2CAP_ECRED_CONN_REQ:
6331 		err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
6332 		break;
6333 
6334 	case L2CAP_ECRED_CONN_RSP:
6335 		err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
6336 		break;
6337 
6338 	case L2CAP_ECRED_RECONF_REQ:
6339 		err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
6340 		break;
6341 
6342 	case L2CAP_ECRED_RECONF_RSP:
6343 		err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
6344 		break;
6345 
6346 	case L2CAP_DISCONN_REQ:
6347 		err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
6348 		break;
6349 
6350 	case L2CAP_DISCONN_RSP:
6351 		l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
6352 		break;
6353 
6354 	default:
6355 		BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
6356 		err = -EINVAL;
6357 		break;
6358 	}
6359 
6360 	return err;
6361 }
6362 
6363 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
6364 					struct sk_buff *skb)
6365 {
6366 	struct hci_conn *hcon = conn->hcon;
6367 	struct l2cap_cmd_hdr *cmd;
6368 	u16 len;
6369 	int err;
6370 
6371 	if (hcon->type != LE_LINK)
6372 		goto drop;
6373 
6374 	if (skb->len < L2CAP_CMD_HDR_SIZE)
6375 		goto drop;
6376 
6377 	cmd = (void *) skb->data;
6378 	skb_pull(skb, L2CAP_CMD_HDR_SIZE);
6379 
6380 	len = le16_to_cpu(cmd->len);
6381 
6382 	BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
6383 
6384 	if (len != skb->len || !cmd->ident) {
6385 		BT_DBG("corrupted command");
6386 		goto drop;
6387 	}
6388 
6389 	err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
6390 	if (err) {
6391 		struct l2cap_cmd_rej_unk rej;
6392 
6393 		BT_ERR("Wrong link type (%d)", err);
6394 
6395 		rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
6396 		l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
6397 			       sizeof(rej), &rej);
6398 	}
6399 
6400 drop:
6401 	kfree_skb(skb);
6402 }
6403 
6404 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
6405 				     struct sk_buff *skb)
6406 {
6407 	struct hci_conn *hcon = conn->hcon;
6408 	struct l2cap_cmd_hdr *cmd;
6409 	int err;
6410 
6411 	l2cap_raw_recv(conn, skb);
6412 
6413 	if (hcon->type != ACL_LINK)
6414 		goto drop;
6415 
6416 	while (skb->len >= L2CAP_CMD_HDR_SIZE) {
6417 		u16 len;
6418 
6419 		cmd = (void *) skb->data;
6420 		skb_pull(skb, L2CAP_CMD_HDR_SIZE);
6421 
6422 		len = le16_to_cpu(cmd->len);
6423 
6424 		BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
6425 		       cmd->ident);
6426 
6427 		if (len > skb->len || !cmd->ident) {
6428 			BT_DBG("corrupted command");
6429 			break;
6430 		}
6431 
6432 		err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
6433 		if (err) {
6434 			struct l2cap_cmd_rej_unk rej;
6435 
6436 			BT_ERR("Wrong link type (%d)", err);
6437 
6438 			rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
6439 			l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
6440 				       sizeof(rej), &rej);
6441 		}
6442 
6443 		skb_pull(skb, len);
6444 	}
6445 
6446 drop:
6447 	kfree_skb(skb);
6448 }
6449 
6450 static int l2cap_check_fcs(struct l2cap_chan *chan,  struct sk_buff *skb)
6451 {
6452 	u16 our_fcs, rcv_fcs;
6453 	int hdr_size;
6454 
6455 	if (test_bit(FLAG_EXT_CTRL, &chan->flags))
6456 		hdr_size = L2CAP_EXT_HDR_SIZE;
6457 	else
6458 		hdr_size = L2CAP_ENH_HDR_SIZE;
6459 
6460 	if (chan->fcs == L2CAP_FCS_CRC16) {
6461 		skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
6462 		rcv_fcs = get_unaligned_le16(skb->data + skb->len);
6463 		our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
6464 
6465 		if (our_fcs != rcv_fcs)
6466 			return -EBADMSG;
6467 	}
6468 	return 0;
6469 }
6470 
6471 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
6472 {
6473 	struct l2cap_ctrl control;
6474 
6475 	BT_DBG("chan %p", chan);
6476 
6477 	memset(&control, 0, sizeof(control));
6478 	control.sframe = 1;
6479 	control.final = 1;
6480 	control.reqseq = chan->buffer_seq;
6481 	set_bit(CONN_SEND_FBIT, &chan->conn_state);
6482 
6483 	if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6484 		control.super = L2CAP_SUPER_RNR;
6485 		l2cap_send_sframe(chan, &control);
6486 	}
6487 
6488 	if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6489 	    chan->unacked_frames > 0)
6490 		__set_retrans_timer(chan);
6491 
6492 	/* Send pending iframes */
6493 	l2cap_ertm_send(chan);
6494 
6495 	if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6496 	    test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
6497 		/* F-bit wasn't sent in an s-frame or i-frame yet, so
6498 		 * send it now.
6499 		 */
6500 		control.super = L2CAP_SUPER_RR;
6501 		l2cap_send_sframe(chan, &control);
6502 	}
6503 }
6504 
6505 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
6506 			    struct sk_buff **last_frag)
6507 {
6508 	/* skb->len reflects data in skb as well as all fragments
6509 	 * skb->data_len reflects only data in fragments
6510 	 */
6511 	if (!skb_has_frag_list(skb))
6512 		skb_shinfo(skb)->frag_list = new_frag;
6513 
6514 	new_frag->next = NULL;
6515 
6516 	(*last_frag)->next = new_frag;
6517 	*last_frag = new_frag;
6518 
6519 	skb->len += new_frag->len;
6520 	skb->data_len += new_frag->len;
6521 	skb->truesize += new_frag->truesize;
6522 }
6523 
6524 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
6525 				struct l2cap_ctrl *control)
6526 {
6527 	int err = -EINVAL;
6528 
6529 	switch (control->sar) {
6530 	case L2CAP_SAR_UNSEGMENTED:
6531 		if (chan->sdu)
6532 			break;
6533 
6534 		err = chan->ops->recv(chan, skb);
6535 		break;
6536 
6537 	case L2CAP_SAR_START:
6538 		if (chan->sdu)
6539 			break;
6540 
6541 		if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
6542 			break;
6543 
6544 		chan->sdu_len = get_unaligned_le16(skb->data);
6545 		skb_pull(skb, L2CAP_SDULEN_SIZE);
6546 
6547 		if (chan->sdu_len > chan->imtu) {
6548 			err = -EMSGSIZE;
6549 			break;
6550 		}
6551 
6552 		if (skb->len >= chan->sdu_len)
6553 			break;
6554 
6555 		chan->sdu = skb;
6556 		chan->sdu_last_frag = skb;
6557 
6558 		skb = NULL;
6559 		err = 0;
6560 		break;
6561 
6562 	case L2CAP_SAR_CONTINUE:
6563 		if (!chan->sdu)
6564 			break;
6565 
6566 		append_skb_frag(chan->sdu, skb,
6567 				&chan->sdu_last_frag);
6568 		skb = NULL;
6569 
6570 		if (chan->sdu->len >= chan->sdu_len)
6571 			break;
6572 
6573 		err = 0;
6574 		break;
6575 
6576 	case L2CAP_SAR_END:
6577 		if (!chan->sdu)
6578 			break;
6579 
6580 		append_skb_frag(chan->sdu, skb,
6581 				&chan->sdu_last_frag);
6582 		skb = NULL;
6583 
6584 		if (chan->sdu->len != chan->sdu_len)
6585 			break;
6586 
6587 		err = chan->ops->recv(chan, chan->sdu);
6588 
6589 		if (!err) {
6590 			/* Reassembly complete */
6591 			chan->sdu = NULL;
6592 			chan->sdu_last_frag = NULL;
6593 			chan->sdu_len = 0;
6594 		}
6595 		break;
6596 	}
6597 
6598 	if (err) {
6599 		kfree_skb(skb);
6600 		kfree_skb(chan->sdu);
6601 		chan->sdu = NULL;
6602 		chan->sdu_last_frag = NULL;
6603 		chan->sdu_len = 0;
6604 	}
6605 
6606 	return err;
6607 }
6608 
6609 static int l2cap_resegment(struct l2cap_chan *chan)
6610 {
6611 	/* Placeholder */
6612 	return 0;
6613 }
6614 
6615 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
6616 {
6617 	u8 event;
6618 
6619 	if (chan->mode != L2CAP_MODE_ERTM)
6620 		return;
6621 
6622 	event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
6623 	l2cap_tx(chan, NULL, NULL, event);
6624 }
6625 
6626 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
6627 {
6628 	int err = 0;
6629 	/* Pass sequential frames to l2cap_reassemble_sdu()
6630 	 * until a gap is encountered.
6631 	 */
6632 
6633 	BT_DBG("chan %p", chan);
6634 
6635 	while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6636 		struct sk_buff *skb;
6637 		BT_DBG("Searching for skb with txseq %d (queue len %d)",
6638 		       chan->buffer_seq, skb_queue_len(&chan->srej_q));
6639 
6640 		skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
6641 
6642 		if (!skb)
6643 			break;
6644 
6645 		skb_unlink(skb, &chan->srej_q);
6646 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6647 		err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
6648 		if (err)
6649 			break;
6650 	}
6651 
6652 	if (skb_queue_empty(&chan->srej_q)) {
6653 		chan->rx_state = L2CAP_RX_STATE_RECV;
6654 		l2cap_send_ack(chan);
6655 	}
6656 
6657 	return err;
6658 }
6659 
6660 static void l2cap_handle_srej(struct l2cap_chan *chan,
6661 			      struct l2cap_ctrl *control)
6662 {
6663 	struct sk_buff *skb;
6664 
6665 	BT_DBG("chan %p, control %p", chan, control);
6666 
6667 	if (control->reqseq == chan->next_tx_seq) {
6668 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6669 		l2cap_send_disconn_req(chan, ECONNRESET);
6670 		return;
6671 	}
6672 
6673 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6674 
6675 	if (skb == NULL) {
6676 		BT_DBG("Seq %d not available for retransmission",
6677 		       control->reqseq);
6678 		return;
6679 	}
6680 
6681 	if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6682 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6683 		l2cap_send_disconn_req(chan, ECONNRESET);
6684 		return;
6685 	}
6686 
6687 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6688 
6689 	if (control->poll) {
6690 		l2cap_pass_to_tx(chan, control);
6691 
6692 		set_bit(CONN_SEND_FBIT, &chan->conn_state);
6693 		l2cap_retransmit(chan, control);
6694 		l2cap_ertm_send(chan);
6695 
6696 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6697 			set_bit(CONN_SREJ_ACT, &chan->conn_state);
6698 			chan->srej_save_reqseq = control->reqseq;
6699 		}
6700 	} else {
6701 		l2cap_pass_to_tx_fbit(chan, control);
6702 
6703 		if (control->final) {
6704 			if (chan->srej_save_reqseq != control->reqseq ||
6705 			    !test_and_clear_bit(CONN_SREJ_ACT,
6706 						&chan->conn_state))
6707 				l2cap_retransmit(chan, control);
6708 		} else {
6709 			l2cap_retransmit(chan, control);
6710 			if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
6711 				set_bit(CONN_SREJ_ACT, &chan->conn_state);
6712 				chan->srej_save_reqseq = control->reqseq;
6713 			}
6714 		}
6715 	}
6716 }
6717 
6718 static void l2cap_handle_rej(struct l2cap_chan *chan,
6719 			     struct l2cap_ctrl *control)
6720 {
6721 	struct sk_buff *skb;
6722 
6723 	BT_DBG("chan %p, control %p", chan, control);
6724 
6725 	if (control->reqseq == chan->next_tx_seq) {
6726 		BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
6727 		l2cap_send_disconn_req(chan, ECONNRESET);
6728 		return;
6729 	}
6730 
6731 	skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
6732 
6733 	if (chan->max_tx && skb &&
6734 	    bt_cb(skb)->l2cap.retries >= chan->max_tx) {
6735 		BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
6736 		l2cap_send_disconn_req(chan, ECONNRESET);
6737 		return;
6738 	}
6739 
6740 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6741 
6742 	l2cap_pass_to_tx(chan, control);
6743 
6744 	if (control->final) {
6745 		if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
6746 			l2cap_retransmit_all(chan, control);
6747 	} else {
6748 		l2cap_retransmit_all(chan, control);
6749 		l2cap_ertm_send(chan);
6750 		if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
6751 			set_bit(CONN_REJ_ACT, &chan->conn_state);
6752 	}
6753 }
6754 
6755 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
6756 {
6757 	BT_DBG("chan %p, txseq %d", chan, txseq);
6758 
6759 	BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
6760 	       chan->expected_tx_seq);
6761 
6762 	if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
6763 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6764 		    chan->tx_win) {
6765 			/* See notes below regarding "double poll" and
6766 			 * invalid packets.
6767 			 */
6768 			if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6769 				BT_DBG("Invalid/Ignore - after SREJ");
6770 				return L2CAP_TXSEQ_INVALID_IGNORE;
6771 			} else {
6772 				BT_DBG("Invalid - in window after SREJ sent");
6773 				return L2CAP_TXSEQ_INVALID;
6774 			}
6775 		}
6776 
6777 		if (chan->srej_list.head == txseq) {
6778 			BT_DBG("Expected SREJ");
6779 			return L2CAP_TXSEQ_EXPECTED_SREJ;
6780 		}
6781 
6782 		if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
6783 			BT_DBG("Duplicate SREJ - txseq already stored");
6784 			return L2CAP_TXSEQ_DUPLICATE_SREJ;
6785 		}
6786 
6787 		if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
6788 			BT_DBG("Unexpected SREJ - not requested");
6789 			return L2CAP_TXSEQ_UNEXPECTED_SREJ;
6790 		}
6791 	}
6792 
6793 	if (chan->expected_tx_seq == txseq) {
6794 		if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
6795 		    chan->tx_win) {
6796 			BT_DBG("Invalid - txseq outside tx window");
6797 			return L2CAP_TXSEQ_INVALID;
6798 		} else {
6799 			BT_DBG("Expected");
6800 			return L2CAP_TXSEQ_EXPECTED;
6801 		}
6802 	}
6803 
6804 	if (__seq_offset(chan, txseq, chan->last_acked_seq) <
6805 	    __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
6806 		BT_DBG("Duplicate - expected_tx_seq later than txseq");
6807 		return L2CAP_TXSEQ_DUPLICATE;
6808 	}
6809 
6810 	if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
6811 		/* A source of invalid packets is a "double poll" condition,
6812 		 * where delays cause us to send multiple poll packets.  If
6813 		 * the remote stack receives and processes both polls,
6814 		 * sequence numbers can wrap around in such a way that a
6815 		 * resent frame has a sequence number that looks like new data
6816 		 * with a sequence gap.  This would trigger an erroneous SREJ
6817 		 * request.
6818 		 *
6819 		 * Fortunately, this is impossible with a tx window that's
6820 		 * less than half of the maximum sequence number, which allows
6821 		 * invalid frames to be safely ignored.
6822 		 *
6823 		 * With tx window sizes greater than half of the tx window
6824 		 * maximum, the frame is invalid and cannot be ignored.  This
6825 		 * causes a disconnect.
6826 		 */
6827 
6828 		if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
6829 			BT_DBG("Invalid/Ignore - txseq outside tx window");
6830 			return L2CAP_TXSEQ_INVALID_IGNORE;
6831 		} else {
6832 			BT_DBG("Invalid - txseq outside tx window");
6833 			return L2CAP_TXSEQ_INVALID;
6834 		}
6835 	} else {
6836 		BT_DBG("Unexpected - txseq indicates missing frames");
6837 		return L2CAP_TXSEQ_UNEXPECTED;
6838 	}
6839 }
6840 
6841 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
6842 			       struct l2cap_ctrl *control,
6843 			       struct sk_buff *skb, u8 event)
6844 {
6845 	int err = 0;
6846 	bool skb_in_use = false;
6847 
6848 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6849 	       event);
6850 
6851 	switch (event) {
6852 	case L2CAP_EV_RECV_IFRAME:
6853 		switch (l2cap_classify_txseq(chan, control->txseq)) {
6854 		case L2CAP_TXSEQ_EXPECTED:
6855 			l2cap_pass_to_tx(chan, control);
6856 
6857 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6858 				BT_DBG("Busy, discarding expected seq %d",
6859 				       control->txseq);
6860 				break;
6861 			}
6862 
6863 			chan->expected_tx_seq = __next_seq(chan,
6864 							   control->txseq);
6865 
6866 			chan->buffer_seq = chan->expected_tx_seq;
6867 			skb_in_use = true;
6868 
6869 			err = l2cap_reassemble_sdu(chan, skb, control);
6870 			if (err)
6871 				break;
6872 
6873 			if (control->final) {
6874 				if (!test_and_clear_bit(CONN_REJ_ACT,
6875 							&chan->conn_state)) {
6876 					control->final = 0;
6877 					l2cap_retransmit_all(chan, control);
6878 					l2cap_ertm_send(chan);
6879 				}
6880 			}
6881 
6882 			if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6883 				l2cap_send_ack(chan);
6884 			break;
6885 		case L2CAP_TXSEQ_UNEXPECTED:
6886 			l2cap_pass_to_tx(chan, control);
6887 
6888 			/* Can't issue SREJ frames in the local busy state.
6889 			 * Drop this frame, it will be seen as missing
6890 			 * when local busy is exited.
6891 			 */
6892 			if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6893 				BT_DBG("Busy, discarding unexpected seq %d",
6894 				       control->txseq);
6895 				break;
6896 			}
6897 
6898 			/* There was a gap in the sequence, so an SREJ
6899 			 * must be sent for each missing frame.  The
6900 			 * current frame is stored for later use.
6901 			 */
6902 			skb_queue_tail(&chan->srej_q, skb);
6903 			skb_in_use = true;
6904 			BT_DBG("Queued %p (queue len %d)", skb,
6905 			       skb_queue_len(&chan->srej_q));
6906 
6907 			clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6908 			l2cap_seq_list_clear(&chan->srej_list);
6909 			l2cap_send_srej(chan, control->txseq);
6910 
6911 			chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6912 			break;
6913 		case L2CAP_TXSEQ_DUPLICATE:
6914 			l2cap_pass_to_tx(chan, control);
6915 			break;
6916 		case L2CAP_TXSEQ_INVALID_IGNORE:
6917 			break;
6918 		case L2CAP_TXSEQ_INVALID:
6919 		default:
6920 			l2cap_send_disconn_req(chan, ECONNRESET);
6921 			break;
6922 		}
6923 		break;
6924 	case L2CAP_EV_RECV_RR:
6925 		l2cap_pass_to_tx(chan, control);
6926 		if (control->final) {
6927 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6928 
6929 			if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
6930 			    !__chan_is_moving(chan)) {
6931 				control->final = 0;
6932 				l2cap_retransmit_all(chan, control);
6933 			}
6934 
6935 			l2cap_ertm_send(chan);
6936 		} else if (control->poll) {
6937 			l2cap_send_i_or_rr_or_rnr(chan);
6938 		} else {
6939 			if (test_and_clear_bit(CONN_REMOTE_BUSY,
6940 					       &chan->conn_state) &&
6941 			    chan->unacked_frames)
6942 				__set_retrans_timer(chan);
6943 
6944 			l2cap_ertm_send(chan);
6945 		}
6946 		break;
6947 	case L2CAP_EV_RECV_RNR:
6948 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6949 		l2cap_pass_to_tx(chan, control);
6950 		if (control && control->poll) {
6951 			set_bit(CONN_SEND_FBIT, &chan->conn_state);
6952 			l2cap_send_rr_or_rnr(chan, 0);
6953 		}
6954 		__clear_retrans_timer(chan);
6955 		l2cap_seq_list_clear(&chan->retrans_list);
6956 		break;
6957 	case L2CAP_EV_RECV_REJ:
6958 		l2cap_handle_rej(chan, control);
6959 		break;
6960 	case L2CAP_EV_RECV_SREJ:
6961 		l2cap_handle_srej(chan, control);
6962 		break;
6963 	default:
6964 		break;
6965 	}
6966 
6967 	if (skb && !skb_in_use) {
6968 		BT_DBG("Freeing %p", skb);
6969 		kfree_skb(skb);
6970 	}
6971 
6972 	return err;
6973 }
6974 
6975 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6976 				    struct l2cap_ctrl *control,
6977 				    struct sk_buff *skb, u8 event)
6978 {
6979 	int err = 0;
6980 	u16 txseq = control->txseq;
6981 	bool skb_in_use = false;
6982 
6983 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6984 	       event);
6985 
6986 	switch (event) {
6987 	case L2CAP_EV_RECV_IFRAME:
6988 		switch (l2cap_classify_txseq(chan, txseq)) {
6989 		case L2CAP_TXSEQ_EXPECTED:
6990 			/* Keep frame for reassembly later */
6991 			l2cap_pass_to_tx(chan, control);
6992 			skb_queue_tail(&chan->srej_q, skb);
6993 			skb_in_use = true;
6994 			BT_DBG("Queued %p (queue len %d)", skb,
6995 			       skb_queue_len(&chan->srej_q));
6996 
6997 			chan->expected_tx_seq = __next_seq(chan, txseq);
6998 			break;
6999 		case L2CAP_TXSEQ_EXPECTED_SREJ:
7000 			l2cap_seq_list_pop(&chan->srej_list);
7001 
7002 			l2cap_pass_to_tx(chan, control);
7003 			skb_queue_tail(&chan->srej_q, skb);
7004 			skb_in_use = true;
7005 			BT_DBG("Queued %p (queue len %d)", skb,
7006 			       skb_queue_len(&chan->srej_q));
7007 
7008 			err = l2cap_rx_queued_iframes(chan);
7009 			if (err)
7010 				break;
7011 
7012 			break;
7013 		case L2CAP_TXSEQ_UNEXPECTED:
7014 			/* Got a frame that can't be reassembled yet.
7015 			 * Save it for later, and send SREJs to cover
7016 			 * the missing frames.
7017 			 */
7018 			skb_queue_tail(&chan->srej_q, skb);
7019 			skb_in_use = true;
7020 			BT_DBG("Queued %p (queue len %d)", skb,
7021 			       skb_queue_len(&chan->srej_q));
7022 
7023 			l2cap_pass_to_tx(chan, control);
7024 			l2cap_send_srej(chan, control->txseq);
7025 			break;
7026 		case L2CAP_TXSEQ_UNEXPECTED_SREJ:
7027 			/* This frame was requested with an SREJ, but
7028 			 * some expected retransmitted frames are
7029 			 * missing.  Request retransmission of missing
7030 			 * SREJ'd frames.
7031 			 */
7032 			skb_queue_tail(&chan->srej_q, skb);
7033 			skb_in_use = true;
7034 			BT_DBG("Queued %p (queue len %d)", skb,
7035 			       skb_queue_len(&chan->srej_q));
7036 
7037 			l2cap_pass_to_tx(chan, control);
7038 			l2cap_send_srej_list(chan, control->txseq);
7039 			break;
7040 		case L2CAP_TXSEQ_DUPLICATE_SREJ:
7041 			/* We've already queued this frame.  Drop this copy. */
7042 			l2cap_pass_to_tx(chan, control);
7043 			break;
7044 		case L2CAP_TXSEQ_DUPLICATE:
7045 			/* Expecting a later sequence number, so this frame
7046 			 * was already received.  Ignore it completely.
7047 			 */
7048 			break;
7049 		case L2CAP_TXSEQ_INVALID_IGNORE:
7050 			break;
7051 		case L2CAP_TXSEQ_INVALID:
7052 		default:
7053 			l2cap_send_disconn_req(chan, ECONNRESET);
7054 			break;
7055 		}
7056 		break;
7057 	case L2CAP_EV_RECV_RR:
7058 		l2cap_pass_to_tx(chan, control);
7059 		if (control->final) {
7060 			clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7061 
7062 			if (!test_and_clear_bit(CONN_REJ_ACT,
7063 						&chan->conn_state)) {
7064 				control->final = 0;
7065 				l2cap_retransmit_all(chan, control);
7066 			}
7067 
7068 			l2cap_ertm_send(chan);
7069 		} else if (control->poll) {
7070 			if (test_and_clear_bit(CONN_REMOTE_BUSY,
7071 					       &chan->conn_state) &&
7072 			    chan->unacked_frames) {
7073 				__set_retrans_timer(chan);
7074 			}
7075 
7076 			set_bit(CONN_SEND_FBIT, &chan->conn_state);
7077 			l2cap_send_srej_tail(chan);
7078 		} else {
7079 			if (test_and_clear_bit(CONN_REMOTE_BUSY,
7080 					       &chan->conn_state) &&
7081 			    chan->unacked_frames)
7082 				__set_retrans_timer(chan);
7083 
7084 			l2cap_send_ack(chan);
7085 		}
7086 		break;
7087 	case L2CAP_EV_RECV_RNR:
7088 		set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7089 		l2cap_pass_to_tx(chan, control);
7090 		if (control->poll) {
7091 			l2cap_send_srej_tail(chan);
7092 		} else {
7093 			struct l2cap_ctrl rr_control;
7094 			memset(&rr_control, 0, sizeof(rr_control));
7095 			rr_control.sframe = 1;
7096 			rr_control.super = L2CAP_SUPER_RR;
7097 			rr_control.reqseq = chan->buffer_seq;
7098 			l2cap_send_sframe(chan, &rr_control);
7099 		}
7100 
7101 		break;
7102 	case L2CAP_EV_RECV_REJ:
7103 		l2cap_handle_rej(chan, control);
7104 		break;
7105 	case L2CAP_EV_RECV_SREJ:
7106 		l2cap_handle_srej(chan, control);
7107 		break;
7108 	}
7109 
7110 	if (skb && !skb_in_use) {
7111 		BT_DBG("Freeing %p", skb);
7112 		kfree_skb(skb);
7113 	}
7114 
7115 	return err;
7116 }
7117 
7118 static int l2cap_finish_move(struct l2cap_chan *chan)
7119 {
7120 	BT_DBG("chan %p", chan);
7121 
7122 	chan->rx_state = L2CAP_RX_STATE_RECV;
7123 
7124 	if (chan->hs_hcon)
7125 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
7126 	else
7127 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
7128 
7129 	return l2cap_resegment(chan);
7130 }
7131 
7132 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
7133 				 struct l2cap_ctrl *control,
7134 				 struct sk_buff *skb, u8 event)
7135 {
7136 	int err;
7137 
7138 	BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
7139 	       event);
7140 
7141 	if (!control->poll)
7142 		return -EPROTO;
7143 
7144 	l2cap_process_reqseq(chan, control->reqseq);
7145 
7146 	if (!skb_queue_empty(&chan->tx_q))
7147 		chan->tx_send_head = skb_peek(&chan->tx_q);
7148 	else
7149 		chan->tx_send_head = NULL;
7150 
7151 	/* Rewind next_tx_seq to the point expected
7152 	 * by the receiver.
7153 	 */
7154 	chan->next_tx_seq = control->reqseq;
7155 	chan->unacked_frames = 0;
7156 
7157 	err = l2cap_finish_move(chan);
7158 	if (err)
7159 		return err;
7160 
7161 	set_bit(CONN_SEND_FBIT, &chan->conn_state);
7162 	l2cap_send_i_or_rr_or_rnr(chan);
7163 
7164 	if (event == L2CAP_EV_RECV_IFRAME)
7165 		return -EPROTO;
7166 
7167 	return l2cap_rx_state_recv(chan, control, NULL, event);
7168 }
7169 
7170 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
7171 				 struct l2cap_ctrl *control,
7172 				 struct sk_buff *skb, u8 event)
7173 {
7174 	int err;
7175 
7176 	if (!control->final)
7177 		return -EPROTO;
7178 
7179 	clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
7180 
7181 	chan->rx_state = L2CAP_RX_STATE_RECV;
7182 	l2cap_process_reqseq(chan, control->reqseq);
7183 
7184 	if (!skb_queue_empty(&chan->tx_q))
7185 		chan->tx_send_head = skb_peek(&chan->tx_q);
7186 	else
7187 		chan->tx_send_head = NULL;
7188 
7189 	/* Rewind next_tx_seq to the point expected
7190 	 * by the receiver.
7191 	 */
7192 	chan->next_tx_seq = control->reqseq;
7193 	chan->unacked_frames = 0;
7194 
7195 	if (chan->hs_hcon)
7196 		chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
7197 	else
7198 		chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
7199 
7200 	err = l2cap_resegment(chan);
7201 
7202 	if (!err)
7203 		err = l2cap_rx_state_recv(chan, control, skb, event);
7204 
7205 	return err;
7206 }
7207 
7208 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
7209 {
7210 	/* Make sure reqseq is for a packet that has been sent but not acked */
7211 	u16 unacked;
7212 
7213 	unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
7214 	return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
7215 }
7216 
7217 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
7218 		    struct sk_buff *skb, u8 event)
7219 {
7220 	int err = 0;
7221 
7222 	BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
7223 	       control, skb, event, chan->rx_state);
7224 
7225 	if (__valid_reqseq(chan, control->reqseq)) {
7226 		switch (chan->rx_state) {
7227 		case L2CAP_RX_STATE_RECV:
7228 			err = l2cap_rx_state_recv(chan, control, skb, event);
7229 			break;
7230 		case L2CAP_RX_STATE_SREJ_SENT:
7231 			err = l2cap_rx_state_srej_sent(chan, control, skb,
7232 						       event);
7233 			break;
7234 		case L2CAP_RX_STATE_WAIT_P:
7235 			err = l2cap_rx_state_wait_p(chan, control, skb, event);
7236 			break;
7237 		case L2CAP_RX_STATE_WAIT_F:
7238 			err = l2cap_rx_state_wait_f(chan, control, skb, event);
7239 			break;
7240 		default:
7241 			/* shut it down */
7242 			break;
7243 		}
7244 	} else {
7245 		BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
7246 		       control->reqseq, chan->next_tx_seq,
7247 		       chan->expected_ack_seq);
7248 		l2cap_send_disconn_req(chan, ECONNRESET);
7249 	}
7250 
7251 	return err;
7252 }
7253 
7254 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
7255 			   struct sk_buff *skb)
7256 {
7257 	BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
7258 	       chan->rx_state);
7259 
7260 	if (l2cap_classify_txseq(chan, control->txseq) ==
7261 	    L2CAP_TXSEQ_EXPECTED) {
7262 		l2cap_pass_to_tx(chan, control);
7263 
7264 		BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
7265 		       __next_seq(chan, chan->buffer_seq));
7266 
7267 		chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
7268 
7269 		l2cap_reassemble_sdu(chan, skb, control);
7270 	} else {
7271 		if (chan->sdu) {
7272 			kfree_skb(chan->sdu);
7273 			chan->sdu = NULL;
7274 		}
7275 		chan->sdu_last_frag = NULL;
7276 		chan->sdu_len = 0;
7277 
7278 		if (skb) {
7279 			BT_DBG("Freeing %p", skb);
7280 			kfree_skb(skb);
7281 		}
7282 	}
7283 
7284 	chan->last_acked_seq = control->txseq;
7285 	chan->expected_tx_seq = __next_seq(chan, control->txseq);
7286 
7287 	return 0;
7288 }
7289 
7290 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
7291 {
7292 	struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
7293 	u16 len;
7294 	u8 event;
7295 
7296 	__unpack_control(chan, skb);
7297 
7298 	len = skb->len;
7299 
7300 	/*
7301 	 * We can just drop the corrupted I-frame here.
7302 	 * Receiver will miss it and start proper recovery
7303 	 * procedures and ask for retransmission.
7304 	 */
7305 	if (l2cap_check_fcs(chan, skb))
7306 		goto drop;
7307 
7308 	if (!control->sframe && control->sar == L2CAP_SAR_START)
7309 		len -= L2CAP_SDULEN_SIZE;
7310 
7311 	if (chan->fcs == L2CAP_FCS_CRC16)
7312 		len -= L2CAP_FCS_SIZE;
7313 
7314 	if (len > chan->mps) {
7315 		l2cap_send_disconn_req(chan, ECONNRESET);
7316 		goto drop;
7317 	}
7318 
7319 	if (chan->ops->filter) {
7320 		if (chan->ops->filter(chan, skb))
7321 			goto drop;
7322 	}
7323 
7324 	if (!control->sframe) {
7325 		int err;
7326 
7327 		BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
7328 		       control->sar, control->reqseq, control->final,
7329 		       control->txseq);
7330 
7331 		/* Validate F-bit - F=0 always valid, F=1 only
7332 		 * valid in TX WAIT_F
7333 		 */
7334 		if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
7335 			goto drop;
7336 
7337 		if (chan->mode != L2CAP_MODE_STREAMING) {
7338 			event = L2CAP_EV_RECV_IFRAME;
7339 			err = l2cap_rx(chan, control, skb, event);
7340 		} else {
7341 			err = l2cap_stream_rx(chan, control, skb);
7342 		}
7343 
7344 		if (err)
7345 			l2cap_send_disconn_req(chan, ECONNRESET);
7346 	} else {
7347 		const u8 rx_func_to_event[4] = {
7348 			L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
7349 			L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
7350 		};
7351 
7352 		/* Only I-frames are expected in streaming mode */
7353 		if (chan->mode == L2CAP_MODE_STREAMING)
7354 			goto drop;
7355 
7356 		BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
7357 		       control->reqseq, control->final, control->poll,
7358 		       control->super);
7359 
7360 		if (len != 0) {
7361 			BT_ERR("Trailing bytes: %d in sframe", len);
7362 			l2cap_send_disconn_req(chan, ECONNRESET);
7363 			goto drop;
7364 		}
7365 
7366 		/* Validate F and P bits */
7367 		if (control->final && (control->poll ||
7368 				       chan->tx_state != L2CAP_TX_STATE_WAIT_F))
7369 			goto drop;
7370 
7371 		event = rx_func_to_event[control->super];
7372 		if (l2cap_rx(chan, control, skb, event))
7373 			l2cap_send_disconn_req(chan, ECONNRESET);
7374 	}
7375 
7376 	return 0;
7377 
7378 drop:
7379 	kfree_skb(skb);
7380 	return 0;
7381 }
7382 
7383 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
7384 {
7385 	struct l2cap_conn *conn = chan->conn;
7386 	struct l2cap_le_credits pkt;
7387 	u16 return_credits;
7388 
7389 	return_credits = (chan->imtu / chan->mps) + 1;
7390 
7391 	if (chan->rx_credits >= return_credits)
7392 		return;
7393 
7394 	return_credits -= chan->rx_credits;
7395 
7396 	BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
7397 
7398 	chan->rx_credits += return_credits;
7399 
7400 	pkt.cid     = cpu_to_le16(chan->scid);
7401 	pkt.credits = cpu_to_le16(return_credits);
7402 
7403 	chan->ident = l2cap_get_ident(conn);
7404 
7405 	l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
7406 }
7407 
7408 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
7409 {
7410 	int err;
7411 
7412 	BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
7413 
7414 	/* Wait recv to confirm reception before updating the credits */
7415 	err = chan->ops->recv(chan, skb);
7416 
7417 	/* Update credits whenever an SDU is received */
7418 	l2cap_chan_le_send_credits(chan);
7419 
7420 	return err;
7421 }
7422 
7423 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
7424 {
7425 	int err;
7426 
7427 	if (!chan->rx_credits) {
7428 		BT_ERR("No credits to receive LE L2CAP data");
7429 		l2cap_send_disconn_req(chan, ECONNRESET);
7430 		return -ENOBUFS;
7431 	}
7432 
7433 	if (chan->imtu < skb->len) {
7434 		BT_ERR("Too big LE L2CAP PDU");
7435 		return -ENOBUFS;
7436 	}
7437 
7438 	chan->rx_credits--;
7439 	BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
7440 
7441 	/* Update if remote had run out of credits, this should only happens
7442 	 * if the remote is not using the entire MPS.
7443 	 */
7444 	if (!chan->rx_credits)
7445 		l2cap_chan_le_send_credits(chan);
7446 
7447 	err = 0;
7448 
7449 	if (!chan->sdu) {
7450 		u16 sdu_len;
7451 
7452 		sdu_len = get_unaligned_le16(skb->data);
7453 		skb_pull(skb, L2CAP_SDULEN_SIZE);
7454 
7455 		BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
7456 		       sdu_len, skb->len, chan->imtu);
7457 
7458 		if (sdu_len > chan->imtu) {
7459 			BT_ERR("Too big LE L2CAP SDU length received");
7460 			err = -EMSGSIZE;
7461 			goto failed;
7462 		}
7463 
7464 		if (skb->len > sdu_len) {
7465 			BT_ERR("Too much LE L2CAP data received");
7466 			err = -EINVAL;
7467 			goto failed;
7468 		}
7469 
7470 		if (skb->len == sdu_len)
7471 			return l2cap_ecred_recv(chan, skb);
7472 
7473 		chan->sdu = skb;
7474 		chan->sdu_len = sdu_len;
7475 		chan->sdu_last_frag = skb;
7476 
7477 		/* Detect if remote is not able to use the selected MPS */
7478 		if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
7479 			u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
7480 
7481 			/* Adjust the number of credits */
7482 			BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
7483 			chan->mps = mps_len;
7484 			l2cap_chan_le_send_credits(chan);
7485 		}
7486 
7487 		return 0;
7488 	}
7489 
7490 	BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
7491 	       chan->sdu->len, skb->len, chan->sdu_len);
7492 
7493 	if (chan->sdu->len + skb->len > chan->sdu_len) {
7494 		BT_ERR("Too much LE L2CAP data received");
7495 		err = -EINVAL;
7496 		goto failed;
7497 	}
7498 
7499 	append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
7500 	skb = NULL;
7501 
7502 	if (chan->sdu->len == chan->sdu_len) {
7503 		err = l2cap_ecred_recv(chan, chan->sdu);
7504 		if (!err) {
7505 			chan->sdu = NULL;
7506 			chan->sdu_last_frag = NULL;
7507 			chan->sdu_len = 0;
7508 		}
7509 	}
7510 
7511 failed:
7512 	if (err) {
7513 		kfree_skb(skb);
7514 		kfree_skb(chan->sdu);
7515 		chan->sdu = NULL;
7516 		chan->sdu_last_frag = NULL;
7517 		chan->sdu_len = 0;
7518 	}
7519 
7520 	/* We can't return an error here since we took care of the skb
7521 	 * freeing internally. An error return would cause the caller to
7522 	 * do a double-free of the skb.
7523 	 */
7524 	return 0;
7525 }
7526 
7527 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
7528 			       struct sk_buff *skb)
7529 {
7530 	struct l2cap_chan *chan;
7531 
7532 	chan = l2cap_get_chan_by_scid(conn, cid);
7533 	if (!chan) {
7534 		if (cid == L2CAP_CID_A2MP) {
7535 			chan = a2mp_channel_create(conn, skb);
7536 			if (!chan) {
7537 				kfree_skb(skb);
7538 				return;
7539 			}
7540 
7541 			l2cap_chan_lock(chan);
7542 		} else {
7543 			BT_DBG("unknown cid 0x%4.4x", cid);
7544 			/* Drop packet and return */
7545 			kfree_skb(skb);
7546 			return;
7547 		}
7548 	}
7549 
7550 	BT_DBG("chan %p, len %d", chan, skb->len);
7551 
7552 	/* If we receive data on a fixed channel before the info req/rsp
7553 	 * procedure is done simply assume that the channel is supported
7554 	 * and mark it as ready.
7555 	 */
7556 	if (chan->chan_type == L2CAP_CHAN_FIXED)
7557 		l2cap_chan_ready(chan);
7558 
7559 	if (chan->state != BT_CONNECTED)
7560 		goto drop;
7561 
7562 	switch (chan->mode) {
7563 	case L2CAP_MODE_LE_FLOWCTL:
7564 	case L2CAP_MODE_EXT_FLOWCTL:
7565 		if (l2cap_ecred_data_rcv(chan, skb) < 0)
7566 			goto drop;
7567 
7568 		goto done;
7569 
7570 	case L2CAP_MODE_BASIC:
7571 		/* If socket recv buffers overflows we drop data here
7572 		 * which is *bad* because L2CAP has to be reliable.
7573 		 * But we don't have any other choice. L2CAP doesn't
7574 		 * provide flow control mechanism. */
7575 
7576 		if (chan->imtu < skb->len) {
7577 			BT_ERR("Dropping L2CAP data: receive buffer overflow");
7578 			goto drop;
7579 		}
7580 
7581 		if (!chan->ops->recv(chan, skb))
7582 			goto done;
7583 		break;
7584 
7585 	case L2CAP_MODE_ERTM:
7586 	case L2CAP_MODE_STREAMING:
7587 		l2cap_data_rcv(chan, skb);
7588 		goto done;
7589 
7590 	default:
7591 		BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
7592 		break;
7593 	}
7594 
7595 drop:
7596 	kfree_skb(skb);
7597 
7598 done:
7599 	l2cap_chan_unlock(chan);
7600 }
7601 
7602 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
7603 				  struct sk_buff *skb)
7604 {
7605 	struct hci_conn *hcon = conn->hcon;
7606 	struct l2cap_chan *chan;
7607 
7608 	if (hcon->type != ACL_LINK)
7609 		goto free_skb;
7610 
7611 	chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
7612 					ACL_LINK);
7613 	if (!chan)
7614 		goto free_skb;
7615 
7616 	BT_DBG("chan %p, len %d", chan, skb->len);
7617 
7618 	if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
7619 		goto drop;
7620 
7621 	if (chan->imtu < skb->len)
7622 		goto drop;
7623 
7624 	/* Store remote BD_ADDR and PSM for msg_name */
7625 	bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
7626 	bt_cb(skb)->l2cap.psm = psm;
7627 
7628 	if (!chan->ops->recv(chan, skb)) {
7629 		l2cap_chan_put(chan);
7630 		return;
7631 	}
7632 
7633 drop:
7634 	l2cap_chan_put(chan);
7635 free_skb:
7636 	kfree_skb(skb);
7637 }
7638 
7639 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
7640 {
7641 	struct l2cap_hdr *lh = (void *) skb->data;
7642 	struct hci_conn *hcon = conn->hcon;
7643 	u16 cid, len;
7644 	__le16 psm;
7645 
7646 	if (hcon->state != BT_CONNECTED) {
7647 		BT_DBG("queueing pending rx skb");
7648 		skb_queue_tail(&conn->pending_rx, skb);
7649 		return;
7650 	}
7651 
7652 	skb_pull(skb, L2CAP_HDR_SIZE);
7653 	cid = __le16_to_cpu(lh->cid);
7654 	len = __le16_to_cpu(lh->len);
7655 
7656 	if (len != skb->len) {
7657 		kfree_skb(skb);
7658 		return;
7659 	}
7660 
7661 	/* Since we can't actively block incoming LE connections we must
7662 	 * at least ensure that we ignore incoming data from them.
7663 	 */
7664 	if (hcon->type == LE_LINK &&
7665 	    hci_bdaddr_list_lookup(&hcon->hdev->blacklist, &hcon->dst,
7666 				   bdaddr_dst_type(hcon))) {
7667 		kfree_skb(skb);
7668 		return;
7669 	}
7670 
7671 	BT_DBG("len %d, cid 0x%4.4x", len, cid);
7672 
7673 	switch (cid) {
7674 	case L2CAP_CID_SIGNALING:
7675 		l2cap_sig_channel(conn, skb);
7676 		break;
7677 
7678 	case L2CAP_CID_CONN_LESS:
7679 		psm = get_unaligned((__le16 *) skb->data);
7680 		skb_pull(skb, L2CAP_PSMLEN_SIZE);
7681 		l2cap_conless_channel(conn, psm, skb);
7682 		break;
7683 
7684 	case L2CAP_CID_LE_SIGNALING:
7685 		l2cap_le_sig_channel(conn, skb);
7686 		break;
7687 
7688 	default:
7689 		l2cap_data_channel(conn, cid, skb);
7690 		break;
7691 	}
7692 }
7693 
7694 static void process_pending_rx(struct work_struct *work)
7695 {
7696 	struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
7697 					       pending_rx_work);
7698 	struct sk_buff *skb;
7699 
7700 	BT_DBG("");
7701 
7702 	while ((skb = skb_dequeue(&conn->pending_rx)))
7703 		l2cap_recv_frame(conn, skb);
7704 }
7705 
7706 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
7707 {
7708 	struct l2cap_conn *conn = hcon->l2cap_data;
7709 	struct hci_chan *hchan;
7710 
7711 	if (conn)
7712 		return conn;
7713 
7714 	hchan = hci_chan_create(hcon);
7715 	if (!hchan)
7716 		return NULL;
7717 
7718 	conn = kzalloc(sizeof(*conn), GFP_KERNEL);
7719 	if (!conn) {
7720 		hci_chan_del(hchan);
7721 		return NULL;
7722 	}
7723 
7724 	kref_init(&conn->ref);
7725 	hcon->l2cap_data = conn;
7726 	conn->hcon = hci_conn_get(hcon);
7727 	conn->hchan = hchan;
7728 
7729 	BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
7730 
7731 	switch (hcon->type) {
7732 	case LE_LINK:
7733 		if (hcon->hdev->le_mtu) {
7734 			conn->mtu = hcon->hdev->le_mtu;
7735 			break;
7736 		}
7737 		fallthrough;
7738 	default:
7739 		conn->mtu = hcon->hdev->acl_mtu;
7740 		break;
7741 	}
7742 
7743 	conn->feat_mask = 0;
7744 
7745 	conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
7746 
7747 	if (hcon->type == ACL_LINK &&
7748 	    hci_dev_test_flag(hcon->hdev, HCI_HS_ENABLED))
7749 		conn->local_fixed_chan |= L2CAP_FC_A2MP;
7750 
7751 	if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
7752 	    (bredr_sc_enabled(hcon->hdev) ||
7753 	     hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
7754 		conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
7755 
7756 	mutex_init(&conn->ident_lock);
7757 	mutex_init(&conn->chan_lock);
7758 
7759 	INIT_LIST_HEAD(&conn->chan_l);
7760 	INIT_LIST_HEAD(&conn->users);
7761 
7762 	INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
7763 
7764 	skb_queue_head_init(&conn->pending_rx);
7765 	INIT_WORK(&conn->pending_rx_work, process_pending_rx);
7766 	INIT_WORK(&conn->id_addr_update_work, l2cap_conn_update_id_addr);
7767 
7768 	conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
7769 
7770 	return conn;
7771 }
7772 
7773 static bool is_valid_psm(u16 psm, u8 dst_type)
7774 {
7775 	if (!psm)
7776 		return false;
7777 
7778 	if (bdaddr_type_is_le(dst_type))
7779 		return (psm <= 0x00ff);
7780 
7781 	/* PSM must be odd and lsb of upper byte must be 0 */
7782 	return ((psm & 0x0101) == 0x0001);
7783 }
7784 
7785 struct l2cap_chan_data {
7786 	struct l2cap_chan *chan;
7787 	struct pid *pid;
7788 	int count;
7789 };
7790 
7791 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
7792 {
7793 	struct l2cap_chan_data *d = data;
7794 	struct pid *pid;
7795 
7796 	if (chan == d->chan)
7797 		return;
7798 
7799 	if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
7800 		return;
7801 
7802 	pid = chan->ops->get_peer_pid(chan);
7803 
7804 	/* Only count deferred channels with the same PID/PSM */
7805 	if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
7806 	    chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
7807 		return;
7808 
7809 	d->count++;
7810 }
7811 
7812 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
7813 		       bdaddr_t *dst, u8 dst_type)
7814 {
7815 	struct l2cap_conn *conn;
7816 	struct hci_conn *hcon;
7817 	struct hci_dev *hdev;
7818 	int err;
7819 
7820 	BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
7821 	       dst, dst_type, __le16_to_cpu(psm), chan->mode);
7822 
7823 	hdev = hci_get_route(dst, &chan->src, chan->src_type);
7824 	if (!hdev)
7825 		return -EHOSTUNREACH;
7826 
7827 	hci_dev_lock(hdev);
7828 
7829 	if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
7830 	    chan->chan_type != L2CAP_CHAN_RAW) {
7831 		err = -EINVAL;
7832 		goto done;
7833 	}
7834 
7835 	if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
7836 		err = -EINVAL;
7837 		goto done;
7838 	}
7839 
7840 	if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
7841 		err = -EINVAL;
7842 		goto done;
7843 	}
7844 
7845 	switch (chan->mode) {
7846 	case L2CAP_MODE_BASIC:
7847 		break;
7848 	case L2CAP_MODE_LE_FLOWCTL:
7849 		break;
7850 	case L2CAP_MODE_EXT_FLOWCTL:
7851 		if (!enable_ecred) {
7852 			err = -EOPNOTSUPP;
7853 			goto done;
7854 		}
7855 		break;
7856 	case L2CAP_MODE_ERTM:
7857 	case L2CAP_MODE_STREAMING:
7858 		if (!disable_ertm)
7859 			break;
7860 		fallthrough;
7861 	default:
7862 		err = -EOPNOTSUPP;
7863 		goto done;
7864 	}
7865 
7866 	switch (chan->state) {
7867 	case BT_CONNECT:
7868 	case BT_CONNECT2:
7869 	case BT_CONFIG:
7870 		/* Already connecting */
7871 		err = 0;
7872 		goto done;
7873 
7874 	case BT_CONNECTED:
7875 		/* Already connected */
7876 		err = -EISCONN;
7877 		goto done;
7878 
7879 	case BT_OPEN:
7880 	case BT_BOUND:
7881 		/* Can connect */
7882 		break;
7883 
7884 	default:
7885 		err = -EBADFD;
7886 		goto done;
7887 	}
7888 
7889 	/* Set destination address and psm */
7890 	bacpy(&chan->dst, dst);
7891 	chan->dst_type = dst_type;
7892 
7893 	chan->psm = psm;
7894 	chan->dcid = cid;
7895 
7896 	if (bdaddr_type_is_le(dst_type)) {
7897 		/* Convert from L2CAP channel address type to HCI address type
7898 		 */
7899 		if (dst_type == BDADDR_LE_PUBLIC)
7900 			dst_type = ADDR_LE_DEV_PUBLIC;
7901 		else
7902 			dst_type = ADDR_LE_DEV_RANDOM;
7903 
7904 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7905 			hcon = hci_connect_le(hdev, dst, dst_type,
7906 					      chan->sec_level,
7907 					      HCI_LE_CONN_TIMEOUT,
7908 					      HCI_ROLE_SLAVE, NULL);
7909 		else
7910 			hcon = hci_connect_le_scan(hdev, dst, dst_type,
7911 						   chan->sec_level,
7912 						   HCI_LE_CONN_TIMEOUT,
7913 						   CONN_REASON_L2CAP_CHAN);
7914 
7915 	} else {
7916 		u8 auth_type = l2cap_get_auth_type(chan);
7917 		hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7918 				       CONN_REASON_L2CAP_CHAN);
7919 	}
7920 
7921 	if (IS_ERR(hcon)) {
7922 		err = PTR_ERR(hcon);
7923 		goto done;
7924 	}
7925 
7926 	conn = l2cap_conn_add(hcon);
7927 	if (!conn) {
7928 		hci_conn_drop(hcon);
7929 		err = -ENOMEM;
7930 		goto done;
7931 	}
7932 
7933 	if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7934 		struct l2cap_chan_data data;
7935 
7936 		data.chan = chan;
7937 		data.pid = chan->ops->get_peer_pid(chan);
7938 		data.count = 1;
7939 
7940 		l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7941 
7942 		/* Check if there isn't too many channels being connected */
7943 		if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7944 			hci_conn_drop(hcon);
7945 			err = -EPROTO;
7946 			goto done;
7947 		}
7948 	}
7949 
7950 	mutex_lock(&conn->chan_lock);
7951 	l2cap_chan_lock(chan);
7952 
7953 	if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7954 		hci_conn_drop(hcon);
7955 		err = -EBUSY;
7956 		goto chan_unlock;
7957 	}
7958 
7959 	/* Update source addr of the socket */
7960 	bacpy(&chan->src, &hcon->src);
7961 	chan->src_type = bdaddr_src_type(hcon);
7962 
7963 	__l2cap_chan_add(conn, chan);
7964 
7965 	/* l2cap_chan_add takes its own ref so we can drop this one */
7966 	hci_conn_drop(hcon);
7967 
7968 	l2cap_state_change(chan, BT_CONNECT);
7969 	__set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7970 
7971 	/* Release chan->sport so that it can be reused by other
7972 	 * sockets (as it's only used for listening sockets).
7973 	 */
7974 	write_lock(&chan_list_lock);
7975 	chan->sport = 0;
7976 	write_unlock(&chan_list_lock);
7977 
7978 	if (hcon->state == BT_CONNECTED) {
7979 		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7980 			__clear_chan_timer(chan);
7981 			if (l2cap_chan_check_security(chan, true))
7982 				l2cap_state_change(chan, BT_CONNECTED);
7983 		} else
7984 			l2cap_do_start(chan);
7985 	}
7986 
7987 	err = 0;
7988 
7989 chan_unlock:
7990 	l2cap_chan_unlock(chan);
7991 	mutex_unlock(&conn->chan_lock);
7992 done:
7993 	hci_dev_unlock(hdev);
7994 	hci_dev_put(hdev);
7995 	return err;
7996 }
7997 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7998 
7999 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
8000 {
8001 	struct l2cap_conn *conn = chan->conn;
8002 	struct {
8003 		struct l2cap_ecred_reconf_req req;
8004 		__le16 scid;
8005 	} pdu;
8006 
8007 	pdu.req.mtu = cpu_to_le16(chan->imtu);
8008 	pdu.req.mps = cpu_to_le16(chan->mps);
8009 	pdu.scid    = cpu_to_le16(chan->scid);
8010 
8011 	chan->ident = l2cap_get_ident(conn);
8012 
8013 	l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
8014 		       sizeof(pdu), &pdu);
8015 }
8016 
8017 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
8018 {
8019 	if (chan->imtu > mtu)
8020 		return -EINVAL;
8021 
8022 	BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
8023 
8024 	chan->imtu = mtu;
8025 
8026 	l2cap_ecred_reconfigure(chan);
8027 
8028 	return 0;
8029 }
8030 
8031 /* ---- L2CAP interface with lower layer (HCI) ---- */
8032 
8033 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
8034 {
8035 	int exact = 0, lm1 = 0, lm2 = 0;
8036 	struct l2cap_chan *c;
8037 
8038 	BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
8039 
8040 	/* Find listening sockets and check their link_mode */
8041 	read_lock(&chan_list_lock);
8042 	list_for_each_entry(c, &chan_list, global_l) {
8043 		if (c->state != BT_LISTEN)
8044 			continue;
8045 
8046 		if (!bacmp(&c->src, &hdev->bdaddr)) {
8047 			lm1 |= HCI_LM_ACCEPT;
8048 			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
8049 				lm1 |= HCI_LM_MASTER;
8050 			exact++;
8051 		} else if (!bacmp(&c->src, BDADDR_ANY)) {
8052 			lm2 |= HCI_LM_ACCEPT;
8053 			if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
8054 				lm2 |= HCI_LM_MASTER;
8055 		}
8056 	}
8057 	read_unlock(&chan_list_lock);
8058 
8059 	return exact ? lm1 : lm2;
8060 }
8061 
8062 /* Find the next fixed channel in BT_LISTEN state, continue iteration
8063  * from an existing channel in the list or from the beginning of the
8064  * global list (by passing NULL as first parameter).
8065  */
8066 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
8067 						  struct hci_conn *hcon)
8068 {
8069 	u8 src_type = bdaddr_src_type(hcon);
8070 
8071 	read_lock(&chan_list_lock);
8072 
8073 	if (c)
8074 		c = list_next_entry(c, global_l);
8075 	else
8076 		c = list_entry(chan_list.next, typeof(*c), global_l);
8077 
8078 	list_for_each_entry_from(c, &chan_list, global_l) {
8079 		if (c->chan_type != L2CAP_CHAN_FIXED)
8080 			continue;
8081 		if (c->state != BT_LISTEN)
8082 			continue;
8083 		if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
8084 			continue;
8085 		if (src_type != c->src_type)
8086 			continue;
8087 
8088 		l2cap_chan_hold(c);
8089 		read_unlock(&chan_list_lock);
8090 		return c;
8091 	}
8092 
8093 	read_unlock(&chan_list_lock);
8094 
8095 	return NULL;
8096 }
8097 
8098 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
8099 {
8100 	struct hci_dev *hdev = hcon->hdev;
8101 	struct l2cap_conn *conn;
8102 	struct l2cap_chan *pchan;
8103 	u8 dst_type;
8104 
8105 	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
8106 		return;
8107 
8108 	BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
8109 
8110 	if (status) {
8111 		l2cap_conn_del(hcon, bt_to_errno(status));
8112 		return;
8113 	}
8114 
8115 	conn = l2cap_conn_add(hcon);
8116 	if (!conn)
8117 		return;
8118 
8119 	dst_type = bdaddr_dst_type(hcon);
8120 
8121 	/* If device is blocked, do not create channels for it */
8122 	if (hci_bdaddr_list_lookup(&hdev->blacklist, &hcon->dst, dst_type))
8123 		return;
8124 
8125 	/* Find fixed channels and notify them of the new connection. We
8126 	 * use multiple individual lookups, continuing each time where
8127 	 * we left off, because the list lock would prevent calling the
8128 	 * potentially sleeping l2cap_chan_lock() function.
8129 	 */
8130 	pchan = l2cap_global_fixed_chan(NULL, hcon);
8131 	while (pchan) {
8132 		struct l2cap_chan *chan, *next;
8133 
8134 		/* Client fixed channels should override server ones */
8135 		if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
8136 			goto next;
8137 
8138 		l2cap_chan_lock(pchan);
8139 		chan = pchan->ops->new_connection(pchan);
8140 		if (chan) {
8141 			bacpy(&chan->src, &hcon->src);
8142 			bacpy(&chan->dst, &hcon->dst);
8143 			chan->src_type = bdaddr_src_type(hcon);
8144 			chan->dst_type = dst_type;
8145 
8146 			__l2cap_chan_add(conn, chan);
8147 		}
8148 
8149 		l2cap_chan_unlock(pchan);
8150 next:
8151 		next = l2cap_global_fixed_chan(pchan, hcon);
8152 		l2cap_chan_put(pchan);
8153 		pchan = next;
8154 	}
8155 
8156 	l2cap_conn_ready(conn);
8157 }
8158 
8159 int l2cap_disconn_ind(struct hci_conn *hcon)
8160 {
8161 	struct l2cap_conn *conn = hcon->l2cap_data;
8162 
8163 	BT_DBG("hcon %p", hcon);
8164 
8165 	if (!conn)
8166 		return HCI_ERROR_REMOTE_USER_TERM;
8167 	return conn->disc_reason;
8168 }
8169 
8170 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
8171 {
8172 	if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
8173 		return;
8174 
8175 	BT_DBG("hcon %p reason %d", hcon, reason);
8176 
8177 	l2cap_conn_del(hcon, bt_to_errno(reason));
8178 }
8179 
8180 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
8181 {
8182 	if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
8183 		return;
8184 
8185 	if (encrypt == 0x00) {
8186 		if (chan->sec_level == BT_SECURITY_MEDIUM) {
8187 			__set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
8188 		} else if (chan->sec_level == BT_SECURITY_HIGH ||
8189 			   chan->sec_level == BT_SECURITY_FIPS)
8190 			l2cap_chan_close(chan, ECONNREFUSED);
8191 	} else {
8192 		if (chan->sec_level == BT_SECURITY_MEDIUM)
8193 			__clear_chan_timer(chan);
8194 	}
8195 }
8196 
8197 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
8198 {
8199 	struct l2cap_conn *conn = hcon->l2cap_data;
8200 	struct l2cap_chan *chan;
8201 
8202 	if (!conn)
8203 		return;
8204 
8205 	BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
8206 
8207 	mutex_lock(&conn->chan_lock);
8208 
8209 	list_for_each_entry(chan, &conn->chan_l, list) {
8210 		l2cap_chan_lock(chan);
8211 
8212 		BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
8213 		       state_to_string(chan->state));
8214 
8215 		if (chan->scid == L2CAP_CID_A2MP) {
8216 			l2cap_chan_unlock(chan);
8217 			continue;
8218 		}
8219 
8220 		if (!status && encrypt)
8221 			chan->sec_level = hcon->sec_level;
8222 
8223 		if (!__l2cap_no_conn_pending(chan)) {
8224 			l2cap_chan_unlock(chan);
8225 			continue;
8226 		}
8227 
8228 		if (!status && (chan->state == BT_CONNECTED ||
8229 				chan->state == BT_CONFIG)) {
8230 			chan->ops->resume(chan);
8231 			l2cap_check_encryption(chan, encrypt);
8232 			l2cap_chan_unlock(chan);
8233 			continue;
8234 		}
8235 
8236 		if (chan->state == BT_CONNECT) {
8237 			if (!status && l2cap_check_enc_key_size(hcon))
8238 				l2cap_start_connection(chan);
8239 			else
8240 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
8241 		} else if (chan->state == BT_CONNECT2 &&
8242 			   !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
8243 			     chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
8244 			struct l2cap_conn_rsp rsp;
8245 			__u16 res, stat;
8246 
8247 			if (!status && l2cap_check_enc_key_size(hcon)) {
8248 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
8249 					res = L2CAP_CR_PEND;
8250 					stat = L2CAP_CS_AUTHOR_PEND;
8251 					chan->ops->defer(chan);
8252 				} else {
8253 					l2cap_state_change(chan, BT_CONFIG);
8254 					res = L2CAP_CR_SUCCESS;
8255 					stat = L2CAP_CS_NO_INFO;
8256 				}
8257 			} else {
8258 				l2cap_state_change(chan, BT_DISCONN);
8259 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
8260 				res = L2CAP_CR_SEC_BLOCK;
8261 				stat = L2CAP_CS_NO_INFO;
8262 			}
8263 
8264 			rsp.scid   = cpu_to_le16(chan->dcid);
8265 			rsp.dcid   = cpu_to_le16(chan->scid);
8266 			rsp.result = cpu_to_le16(res);
8267 			rsp.status = cpu_to_le16(stat);
8268 			l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
8269 				       sizeof(rsp), &rsp);
8270 
8271 			if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
8272 			    res == L2CAP_CR_SUCCESS) {
8273 				char buf[128];
8274 				set_bit(CONF_REQ_SENT, &chan->conf_state);
8275 				l2cap_send_cmd(conn, l2cap_get_ident(conn),
8276 					       L2CAP_CONF_REQ,
8277 					       l2cap_build_conf_req(chan, buf, sizeof(buf)),
8278 					       buf);
8279 				chan->num_conf_req++;
8280 			}
8281 		}
8282 
8283 		l2cap_chan_unlock(chan);
8284 	}
8285 
8286 	mutex_unlock(&conn->chan_lock);
8287 }
8288 
8289 /* Append fragment into frame respecting the maximum len of rx_skb */
8290 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
8291 			   u16 len)
8292 {
8293 	if (!conn->rx_skb) {
8294 		/* Allocate skb for the complete frame (with header) */
8295 		conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
8296 		if (!conn->rx_skb)
8297 			return -ENOMEM;
8298 		/* Init rx_len */
8299 		conn->rx_len = len;
8300 	}
8301 
8302 	/* Copy as much as the rx_skb can hold */
8303 	len = min_t(u16, len, skb->len);
8304 	skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
8305 	skb_pull(skb, len);
8306 	conn->rx_len -= len;
8307 
8308 	return len;
8309 }
8310 
8311 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
8312 {
8313 	struct sk_buff *rx_skb;
8314 	int len;
8315 
8316 	/* Append just enough to complete the header */
8317 	len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
8318 
8319 	/* If header could not be read just continue */
8320 	if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
8321 		return len;
8322 
8323 	rx_skb = conn->rx_skb;
8324 	len = get_unaligned_le16(rx_skb->data);
8325 
8326 	/* Check if rx_skb has enough space to received all fragments */
8327 	if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
8328 		/* Update expected len */
8329 		conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
8330 		return L2CAP_LEN_SIZE;
8331 	}
8332 
8333 	/* Reset conn->rx_skb since it will need to be reallocated in order to
8334 	 * fit all fragments.
8335 	 */
8336 	conn->rx_skb = NULL;
8337 
8338 	/* Reallocates rx_skb using the exact expected length */
8339 	len = l2cap_recv_frag(conn, rx_skb,
8340 			      len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
8341 	kfree_skb(rx_skb);
8342 
8343 	return len;
8344 }
8345 
8346 static void l2cap_recv_reset(struct l2cap_conn *conn)
8347 {
8348 	kfree_skb(conn->rx_skb);
8349 	conn->rx_skb = NULL;
8350 	conn->rx_len = 0;
8351 }
8352 
8353 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
8354 {
8355 	struct l2cap_conn *conn = hcon->l2cap_data;
8356 	int len;
8357 
8358 	/* For AMP controller do not create l2cap conn */
8359 	if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
8360 		goto drop;
8361 
8362 	if (!conn)
8363 		conn = l2cap_conn_add(hcon);
8364 
8365 	if (!conn)
8366 		goto drop;
8367 
8368 	BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
8369 
8370 	switch (flags) {
8371 	case ACL_START:
8372 	case ACL_START_NO_FLUSH:
8373 	case ACL_COMPLETE:
8374 		if (conn->rx_skb) {
8375 			BT_ERR("Unexpected start frame (len %d)", skb->len);
8376 			l2cap_recv_reset(conn);
8377 			l2cap_conn_unreliable(conn, ECOMM);
8378 		}
8379 
8380 		/* Start fragment may not contain the L2CAP length so just
8381 		 * copy the initial byte when that happens and use conn->mtu as
8382 		 * expected length.
8383 		 */
8384 		if (skb->len < L2CAP_LEN_SIZE) {
8385 			if (l2cap_recv_frag(conn, skb, conn->mtu) < 0)
8386 				goto drop;
8387 			return;
8388 		}
8389 
8390 		len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
8391 
8392 		if (len == skb->len) {
8393 			/* Complete frame received */
8394 			l2cap_recv_frame(conn, skb);
8395 			return;
8396 		}
8397 
8398 		BT_DBG("Start: total len %d, frag len %u", len, skb->len);
8399 
8400 		if (skb->len > len) {
8401 			BT_ERR("Frame is too long (len %u, expected len %d)",
8402 			       skb->len, len);
8403 			l2cap_conn_unreliable(conn, ECOMM);
8404 			goto drop;
8405 		}
8406 
8407 		/* Append fragment into frame (with header) */
8408 		if (l2cap_recv_frag(conn, skb, len) < 0)
8409 			goto drop;
8410 
8411 		break;
8412 
8413 	case ACL_CONT:
8414 		BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
8415 
8416 		if (!conn->rx_skb) {
8417 			BT_ERR("Unexpected continuation frame (len %d)", skb->len);
8418 			l2cap_conn_unreliable(conn, ECOMM);
8419 			goto drop;
8420 		}
8421 
8422 		/* Complete the L2CAP length if it has not been read */
8423 		if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
8424 			if (l2cap_recv_len(conn, skb) < 0) {
8425 				l2cap_conn_unreliable(conn, ECOMM);
8426 				goto drop;
8427 			}
8428 
8429 			/* Header still could not be read just continue */
8430 			if (conn->rx_skb->len < L2CAP_LEN_SIZE)
8431 				return;
8432 		}
8433 
8434 		if (skb->len > conn->rx_len) {
8435 			BT_ERR("Fragment is too long (len %u, expected %u)",
8436 			       skb->len, conn->rx_len);
8437 			l2cap_recv_reset(conn);
8438 			l2cap_conn_unreliable(conn, ECOMM);
8439 			goto drop;
8440 		}
8441 
8442 		/* Append fragment into frame (with header) */
8443 		l2cap_recv_frag(conn, skb, skb->len);
8444 
8445 		if (!conn->rx_len) {
8446 			/* Complete frame received. l2cap_recv_frame
8447 			 * takes ownership of the skb so set the global
8448 			 * rx_skb pointer to NULL first.
8449 			 */
8450 			struct sk_buff *rx_skb = conn->rx_skb;
8451 			conn->rx_skb = NULL;
8452 			l2cap_recv_frame(conn, rx_skb);
8453 		}
8454 		break;
8455 	}
8456 
8457 drop:
8458 	kfree_skb(skb);
8459 }
8460 
8461 static struct hci_cb l2cap_cb = {
8462 	.name		= "L2CAP",
8463 	.connect_cfm	= l2cap_connect_cfm,
8464 	.disconn_cfm	= l2cap_disconn_cfm,
8465 	.security_cfm	= l2cap_security_cfm,
8466 };
8467 
8468 static int l2cap_debugfs_show(struct seq_file *f, void *p)
8469 {
8470 	struct l2cap_chan *c;
8471 
8472 	read_lock(&chan_list_lock);
8473 
8474 	list_for_each_entry(c, &chan_list, global_l) {
8475 		seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
8476 			   &c->src, c->src_type, &c->dst, c->dst_type,
8477 			   c->state, __le16_to_cpu(c->psm),
8478 			   c->scid, c->dcid, c->imtu, c->omtu,
8479 			   c->sec_level, c->mode);
8480 	}
8481 
8482 	read_unlock(&chan_list_lock);
8483 
8484 	return 0;
8485 }
8486 
8487 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
8488 
8489 static struct dentry *l2cap_debugfs;
8490 
8491 int __init l2cap_init(void)
8492 {
8493 	int err;
8494 
8495 	err = l2cap_init_sockets();
8496 	if (err < 0)
8497 		return err;
8498 
8499 	hci_register_cb(&l2cap_cb);
8500 
8501 	if (IS_ERR_OR_NULL(bt_debugfs))
8502 		return 0;
8503 
8504 	l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
8505 					    NULL, &l2cap_debugfs_fops);
8506 
8507 	return 0;
8508 }
8509 
8510 void l2cap_exit(void)
8511 {
8512 	debugfs_remove(l2cap_debugfs);
8513 	hci_unregister_cb(&l2cap_cb);
8514 	l2cap_cleanup_sockets();
8515 }
8516 
8517 module_param(disable_ertm, bool, 0644);
8518 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
8519 
8520 module_param(enable_ecred, bool, 0644);
8521 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");
8522