2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26 SOFTWARE IS DISCLAIMED.
29 /* Bluetooth L2CAP core. */
31 #include <linux/module.h>
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
35 #include <linux/filter.h>
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
43 #define LE_FLOWCTL_MAX_CREDITS 65535
46 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED);
48 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD;
50 static LIST_HEAD(chan_list);
51 static DEFINE_RWLOCK(chan_list_lock);
53 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
54 u8 code, u8 ident, u16 dlen, void *data);
55 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
57 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size);
58 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
61 struct sk_buff_head *skbs, u8 event);
62 static void l2cap_retrans_timeout(struct work_struct *work);
63 static void l2cap_monitor_timeout(struct work_struct *work);
64 static void l2cap_ack_timeout(struct work_struct *work);
66 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type)
68 if (link_type == LE_LINK) {
69 if (bdaddr_type == ADDR_LE_DEV_PUBLIC)
70 return BDADDR_LE_PUBLIC;
72 return BDADDR_LE_RANDOM;
78 static inline u8 bdaddr_src_type(struct hci_conn *hcon)
80 return bdaddr_type(hcon->type, hcon->src_type);
83 static inline u8 bdaddr_dst_type(struct hci_conn *hcon)
85 return bdaddr_type(hcon->type, hcon->dst_type);
88 /* ---- L2CAP channels ---- */
90 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
95 list_for_each_entry(c, &conn->chan_l, list) {
102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
105 struct l2cap_chan *c;
107 list_for_each_entry(c, &conn->chan_l, list) {
114 /* Find channel with given SCID.
115 * Returns a reference locked channel.
117 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
120 struct l2cap_chan *c;
122 mutex_lock(&conn->chan_lock);
123 c = __l2cap_get_chan_by_scid(conn, cid);
125 /* Only lock if chan reference is not 0 */
126 c = l2cap_chan_hold_unless_zero(c);
130 mutex_unlock(&conn->chan_lock);
135 /* Find channel with given DCID.
136 * Returns a reference locked channel.
138 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
141 struct l2cap_chan *c;
143 mutex_lock(&conn->chan_lock);
144 c = __l2cap_get_chan_by_dcid(conn, cid);
146 /* Only lock if chan reference is not 0 */
147 c = l2cap_chan_hold_unless_zero(c);
151 mutex_unlock(&conn->chan_lock);
156 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
159 struct l2cap_chan *c;
161 list_for_each_entry(c, &conn->chan_l, list) {
162 if (c->ident == ident)
168 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src,
171 struct l2cap_chan *c;
173 list_for_each_entry(c, &chan_list, global_l) {
174 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR)
177 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR)
180 if (c->sport == psm && !bacmp(&c->src, src))
186 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
190 write_lock(&chan_list_lock);
192 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) {
202 u16 p, start, end, incr;
204 if (chan->src_type == BDADDR_BREDR) {
205 start = L2CAP_PSM_DYN_START;
206 end = L2CAP_PSM_AUTO_END;
209 start = L2CAP_PSM_LE_DYN_START;
210 end = L2CAP_PSM_LE_DYN_END;
215 for (p = start; p <= end; p += incr)
216 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src,
218 chan->psm = cpu_to_le16(p);
219 chan->sport = cpu_to_le16(p);
226 write_unlock(&chan_list_lock);
229 EXPORT_SYMBOL_GPL(l2cap_add_psm);
231 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
233 write_lock(&chan_list_lock);
235 /* Override the defaults (which are for conn-oriented) */
236 chan->omtu = L2CAP_DEFAULT_MTU;
237 chan->chan_type = L2CAP_CHAN_FIXED;
241 write_unlock(&chan_list_lock);
246 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
250 if (conn->hcon->type == LE_LINK)
251 dyn_end = L2CAP_CID_LE_DYN_END;
253 dyn_end = L2CAP_CID_DYN_END;
255 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) {
256 if (!__l2cap_get_chan_by_scid(conn, cid))
263 static void l2cap_state_change(struct l2cap_chan *chan, int state)
265 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
266 state_to_string(state));
269 chan->ops->state_change(chan, state, 0);
272 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan,
276 chan->ops->state_change(chan, chan->state, err);
279 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
281 chan->ops->state_change(chan, chan->state, err);
284 static void __set_retrans_timer(struct l2cap_chan *chan)
286 if (!delayed_work_pending(&chan->monitor_timer) &&
287 chan->retrans_timeout) {
288 l2cap_set_timer(chan, &chan->retrans_timer,
289 msecs_to_jiffies(chan->retrans_timeout));
293 static void __set_monitor_timer(struct l2cap_chan *chan)
295 __clear_retrans_timer(chan);
296 if (chan->monitor_timeout) {
297 l2cap_set_timer(chan, &chan->monitor_timer,
298 msecs_to_jiffies(chan->monitor_timeout));
302 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
307 skb_queue_walk(head, skb) {
308 if (bt_cb(skb)->l2cap.txseq == seq)
315 /* ---- L2CAP sequence number lists ---- */
317 /* For ERTM, ordered lists of sequence numbers must be tracked for
318 * SREJ requests that are received and for frames that are to be
319 * retransmitted. These seq_list functions implement a singly-linked
320 * list in an array, where membership in the list can also be checked
321 * in constant time. Items can also be added to the tail of the list
322 * and removed from the head in constant time, without further memory
326 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
328 size_t alloc_size, i;
330 /* Allocated size is a power of 2 to map sequence numbers
331 * (which may be up to 14 bits) in to a smaller array that is
332 * sized for the negotiated ERTM transmit windows.
334 alloc_size = roundup_pow_of_two(size);
336 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL);
340 seq_list->mask = alloc_size - 1;
341 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
342 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
343 for (i = 0; i < alloc_size; i++)
344 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
349 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
351 kfree(seq_list->list);
354 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
357 /* Constant-time check for list membership */
358 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
361 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
363 u16 seq = seq_list->head;
364 u16 mask = seq_list->mask;
366 seq_list->head = seq_list->list[seq & mask];
367 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
369 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
370 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
371 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
377 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
381 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
384 for (i = 0; i <= seq_list->mask; i++)
385 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
387 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
388 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
391 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
393 u16 mask = seq_list->mask;
395 /* All appends happen in constant time */
397 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
400 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
401 seq_list->head = seq;
403 seq_list->list[seq_list->tail & mask] = seq;
405 seq_list->tail = seq;
406 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
409 static void l2cap_chan_timeout(struct work_struct *work)
411 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
413 struct l2cap_conn *conn = chan->conn;
416 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
418 mutex_lock(&conn->chan_lock);
419 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
420 * this work. No need to call l2cap_chan_hold(chan) here again.
422 l2cap_chan_lock(chan);
424 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
425 reason = ECONNREFUSED;
426 else if (chan->state == BT_CONNECT &&
427 chan->sec_level != BT_SECURITY_SDP)
428 reason = ECONNREFUSED;
432 l2cap_chan_close(chan, reason);
434 chan->ops->close(chan);
436 l2cap_chan_unlock(chan);
437 l2cap_chan_put(chan);
439 mutex_unlock(&conn->chan_lock);
442 struct l2cap_chan *l2cap_chan_create(void)
444 struct l2cap_chan *chan;
446 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
450 skb_queue_head_init(&chan->tx_q);
451 skb_queue_head_init(&chan->srej_q);
452 mutex_init(&chan->lock);
454 /* Set default lock nesting level */
455 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL);
457 write_lock(&chan_list_lock);
458 list_add(&chan->global_l, &chan_list);
459 write_unlock(&chan_list_lock);
461 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
462 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
463 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
464 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
466 chan->state = BT_OPEN;
468 kref_init(&chan->kref);
470 /* This flag is cleared in l2cap_chan_ready() */
471 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
473 BT_DBG("chan %p", chan);
477 EXPORT_SYMBOL_GPL(l2cap_chan_create);
479 static void l2cap_chan_destroy(struct kref *kref)
481 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
483 BT_DBG("chan %p", chan);
485 write_lock(&chan_list_lock);
486 list_del(&chan->global_l);
487 write_unlock(&chan_list_lock);
492 void l2cap_chan_hold(struct l2cap_chan *c)
494 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
499 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
501 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
503 if (!kref_get_unless_zero(&c->kref))
509 void l2cap_chan_put(struct l2cap_chan *c)
511 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref));
513 kref_put(&c->kref, l2cap_chan_destroy);
515 EXPORT_SYMBOL_GPL(l2cap_chan_put);
517 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
519 chan->fcs = L2CAP_FCS_CRC16;
520 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
521 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
522 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
523 chan->remote_max_tx = chan->max_tx;
524 chan->remote_tx_win = chan->tx_win;
525 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
526 chan->sec_level = BT_SECURITY_LOW;
527 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
528 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
529 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
531 chan->conf_state = 0;
532 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
534 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
536 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults);
538 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits)
541 chan->sdu_last_frag = NULL;
543 chan->tx_credits = tx_credits;
544 /* Derive MPS from connection MTU to stop HCI fragmentation */
545 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE);
546 /* Give enough credits for a full packet */
547 chan->rx_credits = (chan->imtu / chan->mps) + 1;
549 skb_queue_head_init(&chan->tx_q);
552 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits)
554 l2cap_le_flowctl_init(chan, tx_credits);
556 /* L2CAP implementations shall support a minimum MPS of 64 octets */
557 if (chan->mps < L2CAP_ECRED_MIN_MPS) {
558 chan->mps = L2CAP_ECRED_MIN_MPS;
559 chan->rx_credits = (chan->imtu / chan->mps) + 1;
563 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
565 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
566 __le16_to_cpu(chan->psm), chan->dcid);
568 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
572 switch (chan->chan_type) {
573 case L2CAP_CHAN_CONN_ORIENTED:
574 /* Alloc CID for connection-oriented socket */
575 chan->scid = l2cap_alloc_cid(conn);
576 if (conn->hcon->type == ACL_LINK)
577 chan->omtu = L2CAP_DEFAULT_MTU;
580 case L2CAP_CHAN_CONN_LESS:
581 /* Connectionless socket */
582 chan->scid = L2CAP_CID_CONN_LESS;
583 chan->dcid = L2CAP_CID_CONN_LESS;
584 chan->omtu = L2CAP_DEFAULT_MTU;
587 case L2CAP_CHAN_FIXED:
588 /* Caller will set CID and CID specific MTU values */
592 /* Raw socket can send/recv signalling messages only */
593 chan->scid = L2CAP_CID_SIGNALING;
594 chan->dcid = L2CAP_CID_SIGNALING;
595 chan->omtu = L2CAP_DEFAULT_MTU;
598 chan->local_id = L2CAP_BESTEFFORT_ID;
599 chan->local_stype = L2CAP_SERV_BESTEFFORT;
600 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
601 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
602 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
603 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
605 l2cap_chan_hold(chan);
607 /* Only keep a reference for fixed channels if they requested it */
608 if (chan->chan_type != L2CAP_CHAN_FIXED ||
609 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
610 hci_conn_hold(conn->hcon);
612 list_add(&chan->list, &conn->chan_l);
615 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
617 mutex_lock(&conn->chan_lock);
618 __l2cap_chan_add(conn, chan);
619 mutex_unlock(&conn->chan_lock);
622 void l2cap_chan_del(struct l2cap_chan *chan, int err)
624 struct l2cap_conn *conn = chan->conn;
626 __clear_chan_timer(chan);
628 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err,
629 state_to_string(chan->state));
631 chan->ops->teardown(chan, err);
634 /* Delete from channel list */
635 list_del(&chan->list);
637 l2cap_chan_put(chan);
641 /* Reference was only held for non-fixed channels or
642 * fixed channels that explicitly requested it using the
643 * FLAG_HOLD_HCI_CONN flag.
645 if (chan->chan_type != L2CAP_CHAN_FIXED ||
646 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags))
647 hci_conn_drop(conn->hcon);
650 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
653 switch (chan->mode) {
654 case L2CAP_MODE_BASIC:
657 case L2CAP_MODE_LE_FLOWCTL:
658 case L2CAP_MODE_EXT_FLOWCTL:
659 skb_queue_purge(&chan->tx_q);
662 case L2CAP_MODE_ERTM:
663 __clear_retrans_timer(chan);
664 __clear_monitor_timer(chan);
665 __clear_ack_timer(chan);
667 skb_queue_purge(&chan->srej_q);
669 l2cap_seq_list_free(&chan->srej_list);
670 l2cap_seq_list_free(&chan->retrans_list);
673 case L2CAP_MODE_STREAMING:
674 skb_queue_purge(&chan->tx_q);
678 EXPORT_SYMBOL_GPL(l2cap_chan_del);
680 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id,
681 l2cap_chan_func_t func, void *data)
683 struct l2cap_chan *chan, *l;
685 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
686 if (chan->ident == id)
691 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
694 struct l2cap_chan *chan;
696 list_for_each_entry(chan, &conn->chan_l, list) {
701 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func,
707 mutex_lock(&conn->chan_lock);
708 __l2cap_chan_list(conn, func, data);
709 mutex_unlock(&conn->chan_lock);
712 EXPORT_SYMBOL_GPL(l2cap_chan_list);
714 static void l2cap_conn_update_id_addr(struct work_struct *work)
716 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
718 struct hci_conn *hcon = conn->hcon;
719 struct l2cap_chan *chan;
721 mutex_lock(&conn->chan_lock);
723 list_for_each_entry(chan, &conn->chan_l, list) {
724 l2cap_chan_lock(chan);
725 bacpy(&chan->dst, &hcon->dst);
726 chan->dst_type = bdaddr_dst_type(hcon);
727 l2cap_chan_unlock(chan);
730 mutex_unlock(&conn->chan_lock);
733 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan)
735 struct l2cap_conn *conn = chan->conn;
736 struct l2cap_le_conn_rsp rsp;
739 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
740 result = L2CAP_CR_LE_AUTHORIZATION;
742 result = L2CAP_CR_LE_BAD_PSM;
744 l2cap_state_change(chan, BT_DISCONN);
746 rsp.dcid = cpu_to_le16(chan->scid);
747 rsp.mtu = cpu_to_le16(chan->imtu);
748 rsp.mps = cpu_to_le16(chan->mps);
749 rsp.credits = cpu_to_le16(chan->rx_credits);
750 rsp.result = cpu_to_le16(result);
752 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
756 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan)
758 l2cap_state_change(chan, BT_DISCONN);
760 __l2cap_ecred_conn_rsp_defer(chan);
763 static void l2cap_chan_connect_reject(struct l2cap_chan *chan)
765 struct l2cap_conn *conn = chan->conn;
766 struct l2cap_conn_rsp rsp;
769 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
770 result = L2CAP_CR_SEC_BLOCK;
772 result = L2CAP_CR_BAD_PSM;
774 l2cap_state_change(chan, BT_DISCONN);
776 rsp.scid = cpu_to_le16(chan->dcid);
777 rsp.dcid = cpu_to_le16(chan->scid);
778 rsp.result = cpu_to_le16(result);
779 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
781 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
784 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
786 struct l2cap_conn *conn = chan->conn;
788 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
790 switch (chan->state) {
792 chan->ops->teardown(chan, 0);
797 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
798 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
799 l2cap_send_disconn_req(chan, reason);
801 l2cap_chan_del(chan, reason);
805 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
806 if (conn->hcon->type == ACL_LINK)
807 l2cap_chan_connect_reject(chan);
808 else if (conn->hcon->type == LE_LINK) {
809 switch (chan->mode) {
810 case L2CAP_MODE_LE_FLOWCTL:
811 l2cap_chan_le_connect_reject(chan);
813 case L2CAP_MODE_EXT_FLOWCTL:
814 l2cap_chan_ecred_connect_reject(chan);
820 l2cap_chan_del(chan, reason);
825 l2cap_chan_del(chan, reason);
829 chan->ops->teardown(chan, 0);
833 EXPORT_SYMBOL(l2cap_chan_close);
835 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
837 switch (chan->chan_type) {
839 switch (chan->sec_level) {
840 case BT_SECURITY_HIGH:
841 case BT_SECURITY_FIPS:
842 return HCI_AT_DEDICATED_BONDING_MITM;
843 case BT_SECURITY_MEDIUM:
844 return HCI_AT_DEDICATED_BONDING;
846 return HCI_AT_NO_BONDING;
849 case L2CAP_CHAN_CONN_LESS:
850 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) {
851 if (chan->sec_level == BT_SECURITY_LOW)
852 chan->sec_level = BT_SECURITY_SDP;
854 if (chan->sec_level == BT_SECURITY_HIGH ||
855 chan->sec_level == BT_SECURITY_FIPS)
856 return HCI_AT_NO_BONDING_MITM;
858 return HCI_AT_NO_BONDING;
860 case L2CAP_CHAN_CONN_ORIENTED:
861 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) {
862 if (chan->sec_level == BT_SECURITY_LOW)
863 chan->sec_level = BT_SECURITY_SDP;
865 if (chan->sec_level == BT_SECURITY_HIGH ||
866 chan->sec_level == BT_SECURITY_FIPS)
867 return HCI_AT_NO_BONDING_MITM;
869 return HCI_AT_NO_BONDING;
874 switch (chan->sec_level) {
875 case BT_SECURITY_HIGH:
876 case BT_SECURITY_FIPS:
877 return HCI_AT_GENERAL_BONDING_MITM;
878 case BT_SECURITY_MEDIUM:
879 return HCI_AT_GENERAL_BONDING;
881 return HCI_AT_NO_BONDING;
887 /* Service level security */
888 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator)
890 struct l2cap_conn *conn = chan->conn;
893 if (conn->hcon->type == LE_LINK)
894 return smp_conn_security(conn->hcon, chan->sec_level);
896 auth_type = l2cap_get_auth_type(chan);
898 return hci_conn_security(conn->hcon, chan->sec_level, auth_type,
902 static u8 l2cap_get_ident(struct l2cap_conn *conn)
906 /* Get next available identificator.
907 * 1 - 128 are used by kernel.
908 * 129 - 199 are reserved.
909 * 200 - 254 are used by utilities like l2ping, etc.
912 mutex_lock(&conn->ident_lock);
914 if (++conn->tx_ident > 128)
919 mutex_unlock(&conn->ident_lock);
924 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
927 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
930 BT_DBG("code 0x%2.2x", code);
935 /* Use NO_FLUSH if supported or we have an LE link (which does
936 * not support auto-flushing packets) */
937 if (lmp_no_flush_capable(conn->hcon->hdev) ||
938 conn->hcon->type == LE_LINK)
939 flags = ACL_START_NO_FLUSH;
943 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
944 skb->priority = HCI_PRIO_MAX;
946 hci_send_acl(conn->hchan, skb, flags);
949 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
951 struct hci_conn *hcon = chan->conn->hcon;
954 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
957 /* Use NO_FLUSH for LE links (where this is the only option) or
958 * if the BR/EDR link supports it and flushing has not been
959 * explicitly requested (through FLAG_FLUSHABLE).
961 if (hcon->type == LE_LINK ||
962 (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
963 lmp_no_flush_capable(hcon->hdev)))
964 flags = ACL_START_NO_FLUSH;
968 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
969 hci_send_acl(chan->conn->hchan, skb, flags);
972 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
974 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
975 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
977 if (enh & L2CAP_CTRL_FRAME_TYPE) {
980 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
981 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
988 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
989 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
996 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
998 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
999 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
1001 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
1003 control->sframe = 1;
1004 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
1005 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
1011 control->sframe = 0;
1012 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
1013 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1020 static inline void __unpack_control(struct l2cap_chan *chan,
1021 struct sk_buff *skb)
1023 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1024 __unpack_extended_control(get_unaligned_le32(skb->data),
1025 &bt_cb(skb)->l2cap);
1026 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
1028 __unpack_enhanced_control(get_unaligned_le16(skb->data),
1029 &bt_cb(skb)->l2cap);
1030 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
1034 static u32 __pack_extended_control(struct l2cap_ctrl *control)
1038 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
1039 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
1041 if (control->sframe) {
1042 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
1043 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
1044 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
1046 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
1047 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
1053 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
1057 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
1058 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
1060 if (control->sframe) {
1061 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
1062 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
1063 packed |= L2CAP_CTRL_FRAME_TYPE;
1065 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
1066 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
1072 static inline void __pack_control(struct l2cap_chan *chan,
1073 struct l2cap_ctrl *control,
1074 struct sk_buff *skb)
1076 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1077 put_unaligned_le32(__pack_extended_control(control),
1078 skb->data + L2CAP_HDR_SIZE);
1080 put_unaligned_le16(__pack_enhanced_control(control),
1081 skb->data + L2CAP_HDR_SIZE);
1085 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
1087 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1088 return L2CAP_EXT_HDR_SIZE;
1090 return L2CAP_ENH_HDR_SIZE;
1093 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
1096 struct sk_buff *skb;
1097 struct l2cap_hdr *lh;
1098 int hlen = __ertm_hdr_size(chan);
1100 if (chan->fcs == L2CAP_FCS_CRC16)
1101 hlen += L2CAP_FCS_SIZE;
1103 skb = bt_skb_alloc(hlen, GFP_KERNEL);
1106 return ERR_PTR(-ENOMEM);
1108 lh = skb_put(skb, L2CAP_HDR_SIZE);
1109 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1110 lh->cid = cpu_to_le16(chan->dcid);
1112 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1113 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
1115 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
1117 if (chan->fcs == L2CAP_FCS_CRC16) {
1118 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
1119 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1122 skb->priority = HCI_PRIO_MAX;
1126 static void l2cap_send_sframe(struct l2cap_chan *chan,
1127 struct l2cap_ctrl *control)
1129 struct sk_buff *skb;
1132 BT_DBG("chan %p, control %p", chan, control);
1134 if (!control->sframe)
1137 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
1141 if (control->super == L2CAP_SUPER_RR)
1142 clear_bit(CONN_RNR_SENT, &chan->conn_state);
1143 else if (control->super == L2CAP_SUPER_RNR)
1144 set_bit(CONN_RNR_SENT, &chan->conn_state);
1146 if (control->super != L2CAP_SUPER_SREJ) {
1147 chan->last_acked_seq = control->reqseq;
1148 __clear_ack_timer(chan);
1151 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
1152 control->final, control->poll, control->super);
1154 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1155 control_field = __pack_extended_control(control);
1157 control_field = __pack_enhanced_control(control);
1159 skb = l2cap_create_sframe_pdu(chan, control_field);
1161 l2cap_do_send(chan, skb);
1164 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
1166 struct l2cap_ctrl control;
1168 BT_DBG("chan %p, poll %d", chan, poll);
1170 memset(&control, 0, sizeof(control));
1172 control.poll = poll;
1174 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1175 control.super = L2CAP_SUPER_RNR;
1177 control.super = L2CAP_SUPER_RR;
1179 control.reqseq = chan->buffer_seq;
1180 l2cap_send_sframe(chan, &control);
1183 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1185 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
1188 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1191 void l2cap_send_conn_req(struct l2cap_chan *chan)
1193 struct l2cap_conn *conn = chan->conn;
1194 struct l2cap_conn_req req;
1196 req.scid = cpu_to_le16(chan->scid);
1197 req.psm = chan->psm;
1199 chan->ident = l2cap_get_ident(conn);
1201 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1203 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1206 static void l2cap_chan_ready(struct l2cap_chan *chan)
1208 /* The channel may have already been flagged as connected in
1209 * case of receiving data before the L2CAP info req/rsp
1210 * procedure is complete.
1212 if (chan->state == BT_CONNECTED)
1215 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1216 chan->conf_state = 0;
1217 __clear_chan_timer(chan);
1219 switch (chan->mode) {
1220 case L2CAP_MODE_LE_FLOWCTL:
1221 case L2CAP_MODE_EXT_FLOWCTL:
1222 if (!chan->tx_credits)
1223 chan->ops->suspend(chan);
1227 chan->state = BT_CONNECTED;
1229 chan->ops->ready(chan);
1232 static void l2cap_le_connect(struct l2cap_chan *chan)
1234 struct l2cap_conn *conn = chan->conn;
1235 struct l2cap_le_conn_req req;
1237 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags))
1241 chan->imtu = chan->conn->mtu;
1243 l2cap_le_flowctl_init(chan, 0);
1245 memset(&req, 0, sizeof(req));
1246 req.psm = chan->psm;
1247 req.scid = cpu_to_le16(chan->scid);
1248 req.mtu = cpu_to_le16(chan->imtu);
1249 req.mps = cpu_to_le16(chan->mps);
1250 req.credits = cpu_to_le16(chan->rx_credits);
1252 chan->ident = l2cap_get_ident(conn);
1254 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ,
1258 struct l2cap_ecred_conn_data {
1260 struct l2cap_ecred_conn_req req;
1263 struct l2cap_chan *chan;
1268 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data)
1270 struct l2cap_ecred_conn_data *conn = data;
1273 if (chan == conn->chan)
1276 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags))
1279 pid = chan->ops->get_peer_pid(chan);
1281 /* Only add deferred channels with the same PID/PSM */
1282 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident ||
1283 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
1286 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1289 l2cap_ecred_init(chan, 0);
1291 /* Set the same ident so we can match on the rsp */
1292 chan->ident = conn->chan->ident;
1294 /* Include all channels deferred */
1295 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid);
1300 static void l2cap_ecred_connect(struct l2cap_chan *chan)
1302 struct l2cap_conn *conn = chan->conn;
1303 struct l2cap_ecred_conn_data data;
1305 if (test_bit(FLAG_DEFER_SETUP, &chan->flags))
1308 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
1311 l2cap_ecred_init(chan, 0);
1313 memset(&data, 0, sizeof(data));
1314 data.pdu.req.psm = chan->psm;
1315 data.pdu.req.mtu = cpu_to_le16(chan->imtu);
1316 data.pdu.req.mps = cpu_to_le16(chan->mps);
1317 data.pdu.req.credits = cpu_to_le16(chan->rx_credits);
1318 data.pdu.scid[0] = cpu_to_le16(chan->scid);
1320 chan->ident = l2cap_get_ident(conn);
1324 data.pid = chan->ops->get_peer_pid(chan);
1326 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data);
1328 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ,
1329 sizeof(data.pdu.req) + data.count * sizeof(__le16),
1333 static void l2cap_le_start(struct l2cap_chan *chan)
1335 struct l2cap_conn *conn = chan->conn;
1337 if (!smp_conn_security(conn->hcon, chan->sec_level))
1341 l2cap_chan_ready(chan);
1345 if (chan->state == BT_CONNECT) {
1346 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL)
1347 l2cap_ecred_connect(chan);
1349 l2cap_le_connect(chan);
1353 static void l2cap_start_connection(struct l2cap_chan *chan)
1355 if (chan->conn->hcon->type == LE_LINK) {
1356 l2cap_le_start(chan);
1358 l2cap_send_conn_req(chan);
1362 static void l2cap_request_info(struct l2cap_conn *conn)
1364 struct l2cap_info_req req;
1366 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1369 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1371 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1372 conn->info_ident = l2cap_get_ident(conn);
1374 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1376 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1380 static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
1382 /* The minimum encryption key size needs to be enforced by the
1383 * host stack before establishing any L2CAP connections. The
1384 * specification in theory allows a minimum of 1, but to align
1385 * BR/EDR and LE transports, a minimum of 7 is chosen.
1387 * This check might also be called for unencrypted connections
1388 * that have no key size requirements. Ensure that the link is
1389 * actually encrypted before enforcing a key size.
1391 int min_key_size = hcon->hdev->min_enc_key_size;
1393 /* On FIPS security level, key size must be 16 bytes */
1394 if (hcon->sec_level == BT_SECURITY_FIPS)
1397 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) ||
1398 hcon->enc_key_size >= min_key_size);
1401 static void l2cap_do_start(struct l2cap_chan *chan)
1403 struct l2cap_conn *conn = chan->conn;
1405 if (conn->hcon->type == LE_LINK) {
1406 l2cap_le_start(chan);
1410 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) {
1411 l2cap_request_info(conn);
1415 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1418 if (!l2cap_chan_check_security(chan, true) ||
1419 !__l2cap_no_conn_pending(chan))
1422 if (l2cap_check_enc_key_size(conn->hcon))
1423 l2cap_start_connection(chan);
1425 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
1428 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1430 u32 local_feat_mask = l2cap_feat_mask;
1432 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1435 case L2CAP_MODE_ERTM:
1436 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1437 case L2CAP_MODE_STREAMING:
1438 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1444 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1446 struct l2cap_conn *conn = chan->conn;
1447 struct l2cap_disconn_req req;
1452 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1453 __clear_retrans_timer(chan);
1454 __clear_monitor_timer(chan);
1455 __clear_ack_timer(chan);
1458 req.dcid = cpu_to_le16(chan->dcid);
1459 req.scid = cpu_to_le16(chan->scid);
1460 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1463 l2cap_state_change_and_error(chan, BT_DISCONN, err);
1466 /* ---- L2CAP connections ---- */
1467 static void l2cap_conn_start(struct l2cap_conn *conn)
1469 struct l2cap_chan *chan, *tmp;
1471 BT_DBG("conn %p", conn);
1473 mutex_lock(&conn->chan_lock);
1475 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1476 l2cap_chan_lock(chan);
1478 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1479 l2cap_chan_ready(chan);
1480 l2cap_chan_unlock(chan);
1484 if (chan->state == BT_CONNECT) {
1485 if (!l2cap_chan_check_security(chan, true) ||
1486 !__l2cap_no_conn_pending(chan)) {
1487 l2cap_chan_unlock(chan);
1491 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1492 && test_bit(CONF_STATE2_DEVICE,
1493 &chan->conf_state)) {
1494 l2cap_chan_close(chan, ECONNRESET);
1495 l2cap_chan_unlock(chan);
1499 if (l2cap_check_enc_key_size(conn->hcon))
1500 l2cap_start_connection(chan);
1502 l2cap_chan_close(chan, ECONNREFUSED);
1504 } else if (chan->state == BT_CONNECT2) {
1505 struct l2cap_conn_rsp rsp;
1507 rsp.scid = cpu_to_le16(chan->dcid);
1508 rsp.dcid = cpu_to_le16(chan->scid);
1510 if (l2cap_chan_check_security(chan, false)) {
1511 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
1512 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1513 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1514 chan->ops->defer(chan);
1517 l2cap_state_change(chan, BT_CONFIG);
1518 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1519 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1522 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1523 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1526 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1529 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1530 rsp.result != L2CAP_CR_SUCCESS) {
1531 l2cap_chan_unlock(chan);
1535 set_bit(CONF_REQ_SENT, &chan->conf_state);
1536 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1537 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
1538 chan->num_conf_req++;
1541 l2cap_chan_unlock(chan);
1544 mutex_unlock(&conn->chan_lock);
1547 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1549 struct hci_conn *hcon = conn->hcon;
1550 struct hci_dev *hdev = hcon->hdev;
1552 BT_DBG("%s conn %p", hdev->name, conn);
1554 /* For outgoing pairing which doesn't necessarily have an
1555 * associated socket (e.g. mgmt_pair_device).
1558 smp_conn_security(hcon, hcon->pending_sec_level);
1560 /* For LE peripheral connections, make sure the connection interval
1561 * is in the range of the minimum and maximum interval that has
1562 * been configured for this connection. If not, then trigger
1563 * the connection update procedure.
1565 if (hcon->role == HCI_ROLE_SLAVE &&
1566 (hcon->le_conn_interval < hcon->le_conn_min_interval ||
1567 hcon->le_conn_interval > hcon->le_conn_max_interval)) {
1568 struct l2cap_conn_param_update_req req;
1570 req.min = cpu_to_le16(hcon->le_conn_min_interval);
1571 req.max = cpu_to_le16(hcon->le_conn_max_interval);
1572 req.latency = cpu_to_le16(hcon->le_conn_latency);
1573 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout);
1575 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1576 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req);
1580 static void l2cap_conn_ready(struct l2cap_conn *conn)
1582 struct l2cap_chan *chan;
1583 struct hci_conn *hcon = conn->hcon;
1585 BT_DBG("conn %p", conn);
1587 if (hcon->type == ACL_LINK)
1588 l2cap_request_info(conn);
1590 mutex_lock(&conn->chan_lock);
1592 list_for_each_entry(chan, &conn->chan_l, list) {
1594 l2cap_chan_lock(chan);
1596 if (hcon->type == LE_LINK) {
1597 l2cap_le_start(chan);
1598 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1599 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
1600 l2cap_chan_ready(chan);
1601 } else if (chan->state == BT_CONNECT) {
1602 l2cap_do_start(chan);
1605 l2cap_chan_unlock(chan);
1608 mutex_unlock(&conn->chan_lock);
1610 if (hcon->type == LE_LINK)
1611 l2cap_le_conn_ready(conn);
1613 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work);
1616 /* Notify sockets that we cannot guaranty reliability anymore */
1617 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1619 struct l2cap_chan *chan;
1621 BT_DBG("conn %p", conn);
1623 mutex_lock(&conn->chan_lock);
1625 list_for_each_entry(chan, &conn->chan_l, list) {
1626 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1627 l2cap_chan_set_err(chan, err);
1630 mutex_unlock(&conn->chan_lock);
1633 static void l2cap_info_timeout(struct work_struct *work)
1635 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1638 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1639 conn->info_ident = 0;
1641 l2cap_conn_start(conn);
1646 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1647 * callback is called during registration. The ->remove callback is called
1648 * during unregistration.
1649 * An l2cap_user object can either be explicitly unregistered or when the
1650 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1651 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1652 * External modules must own a reference to the l2cap_conn object if they intend
1653 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1654 * any time if they don't.
1657 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1659 struct hci_dev *hdev = conn->hcon->hdev;
1662 /* We need to check whether l2cap_conn is registered. If it is not, we
1663 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1664 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1665 * relies on the parent hci_conn object to be locked. This itself relies
1666 * on the hci_dev object to be locked. So we must lock the hci device
1671 if (!list_empty(&user->list)) {
1676 /* conn->hchan is NULL after l2cap_conn_del() was called */
1682 ret = user->probe(conn, user);
1686 list_add(&user->list, &conn->users);
1690 hci_dev_unlock(hdev);
1693 EXPORT_SYMBOL(l2cap_register_user);
1695 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1697 struct hci_dev *hdev = conn->hcon->hdev;
1701 if (list_empty(&user->list))
1704 list_del_init(&user->list);
1705 user->remove(conn, user);
1708 hci_dev_unlock(hdev);
1710 EXPORT_SYMBOL(l2cap_unregister_user);
1712 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1714 struct l2cap_user *user;
1716 while (!list_empty(&conn->users)) {
1717 user = list_first_entry(&conn->users, struct l2cap_user, list);
1718 list_del_init(&user->list);
1719 user->remove(conn, user);
1723 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1725 struct l2cap_conn *conn = hcon->l2cap_data;
1726 struct l2cap_chan *chan, *l;
1731 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1733 kfree_skb(conn->rx_skb);
1735 skb_queue_purge(&conn->pending_rx);
1737 /* We can not call flush_work(&conn->pending_rx_work) here since we
1738 * might block if we are running on a worker from the same workqueue
1739 * pending_rx_work is waiting on.
1741 if (work_pending(&conn->pending_rx_work))
1742 cancel_work_sync(&conn->pending_rx_work);
1744 cancel_delayed_work_sync(&conn->id_addr_timer);
1746 l2cap_unregister_all_users(conn);
1748 /* Force the connection to be immediately dropped */
1749 hcon->disc_timeout = 0;
1751 mutex_lock(&conn->chan_lock);
1754 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1755 l2cap_chan_hold(chan);
1756 l2cap_chan_lock(chan);
1758 l2cap_chan_del(chan, err);
1760 chan->ops->close(chan);
1762 l2cap_chan_unlock(chan);
1763 l2cap_chan_put(chan);
1766 mutex_unlock(&conn->chan_lock);
1768 hci_chan_del(conn->hchan);
1770 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1771 cancel_delayed_work_sync(&conn->info_timer);
1773 hcon->l2cap_data = NULL;
1775 l2cap_conn_put(conn);
1778 static void l2cap_conn_free(struct kref *ref)
1780 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1782 hci_conn_put(conn->hcon);
1786 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn)
1788 kref_get(&conn->ref);
1791 EXPORT_SYMBOL(l2cap_conn_get);
1793 void l2cap_conn_put(struct l2cap_conn *conn)
1795 kref_put(&conn->ref, l2cap_conn_free);
1797 EXPORT_SYMBOL(l2cap_conn_put);
1799 /* ---- Socket interface ---- */
1801 /* Find socket with psm and source / destination bdaddr.
1802 * Returns closest match.
1804 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1809 struct l2cap_chan *c, *tmp, *c1 = NULL;
1811 read_lock(&chan_list_lock);
1813 list_for_each_entry_safe(c, tmp, &chan_list, global_l) {
1814 if (state && c->state != state)
1817 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR)
1820 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR)
1823 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) {
1824 int src_match, dst_match;
1825 int src_any, dst_any;
1828 src_match = !bacmp(&c->src, src);
1829 dst_match = !bacmp(&c->dst, dst);
1830 if (src_match && dst_match) {
1831 if (!l2cap_chan_hold_unless_zero(c))
1834 read_unlock(&chan_list_lock);
1839 src_any = !bacmp(&c->src, BDADDR_ANY);
1840 dst_any = !bacmp(&c->dst, BDADDR_ANY);
1841 if ((src_match && dst_any) || (src_any && dst_match) ||
1842 (src_any && dst_any))
1848 c1 = l2cap_chan_hold_unless_zero(c1);
1850 read_unlock(&chan_list_lock);
1855 static void l2cap_monitor_timeout(struct work_struct *work)
1857 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1858 monitor_timer.work);
1860 BT_DBG("chan %p", chan);
1862 l2cap_chan_lock(chan);
1865 l2cap_chan_unlock(chan);
1866 l2cap_chan_put(chan);
1870 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1872 l2cap_chan_unlock(chan);
1873 l2cap_chan_put(chan);
1876 static void l2cap_retrans_timeout(struct work_struct *work)
1878 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1879 retrans_timer.work);
1881 BT_DBG("chan %p", chan);
1883 l2cap_chan_lock(chan);
1886 l2cap_chan_unlock(chan);
1887 l2cap_chan_put(chan);
1891 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1892 l2cap_chan_unlock(chan);
1893 l2cap_chan_put(chan);
1896 static void l2cap_streaming_send(struct l2cap_chan *chan,
1897 struct sk_buff_head *skbs)
1899 struct sk_buff *skb;
1900 struct l2cap_ctrl *control;
1902 BT_DBG("chan %p, skbs %p", chan, skbs);
1904 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1906 while (!skb_queue_empty(&chan->tx_q)) {
1908 skb = skb_dequeue(&chan->tx_q);
1910 bt_cb(skb)->l2cap.retries = 1;
1911 control = &bt_cb(skb)->l2cap;
1913 control->reqseq = 0;
1914 control->txseq = chan->next_tx_seq;
1916 __pack_control(chan, control, skb);
1918 if (chan->fcs == L2CAP_FCS_CRC16) {
1919 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1920 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1923 l2cap_do_send(chan, skb);
1925 BT_DBG("Sent txseq %u", control->txseq);
1927 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1928 chan->frames_sent++;
1932 static int l2cap_ertm_send(struct l2cap_chan *chan)
1934 struct sk_buff *skb, *tx_skb;
1935 struct l2cap_ctrl *control;
1938 BT_DBG("chan %p", chan);
1940 if (chan->state != BT_CONNECTED)
1943 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1946 while (chan->tx_send_head &&
1947 chan->unacked_frames < chan->remote_tx_win &&
1948 chan->tx_state == L2CAP_TX_STATE_XMIT) {
1950 skb = chan->tx_send_head;
1952 bt_cb(skb)->l2cap.retries = 1;
1953 control = &bt_cb(skb)->l2cap;
1955 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1958 control->reqseq = chan->buffer_seq;
1959 chan->last_acked_seq = chan->buffer_seq;
1960 control->txseq = chan->next_tx_seq;
1962 __pack_control(chan, control, skb);
1964 if (chan->fcs == L2CAP_FCS_CRC16) {
1965 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1966 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1969 /* Clone after data has been modified. Data is assumed to be
1970 read-only (for locking purposes) on cloned sk_buffs.
1972 tx_skb = skb_clone(skb, GFP_KERNEL);
1977 __set_retrans_timer(chan);
1979 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1980 chan->unacked_frames++;
1981 chan->frames_sent++;
1984 if (skb_queue_is_last(&chan->tx_q, skb))
1985 chan->tx_send_head = NULL;
1987 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1989 l2cap_do_send(chan, tx_skb);
1990 BT_DBG("Sent txseq %u", control->txseq);
1993 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1994 chan->unacked_frames, skb_queue_len(&chan->tx_q));
1999 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2001 struct l2cap_ctrl control;
2002 struct sk_buff *skb;
2003 struct sk_buff *tx_skb;
2006 BT_DBG("chan %p", chan);
2008 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2011 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2012 seq = l2cap_seq_list_pop(&chan->retrans_list);
2014 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2016 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2021 bt_cb(skb)->l2cap.retries++;
2022 control = bt_cb(skb)->l2cap;
2024 if (chan->max_tx != 0 &&
2025 bt_cb(skb)->l2cap.retries > chan->max_tx) {
2026 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2027 l2cap_send_disconn_req(chan, ECONNRESET);
2028 l2cap_seq_list_clear(&chan->retrans_list);
2032 control.reqseq = chan->buffer_seq;
2033 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2038 if (skb_cloned(skb)) {
2039 /* Cloned sk_buffs are read-only, so we need a
2042 tx_skb = skb_copy(skb, GFP_KERNEL);
2044 tx_skb = skb_clone(skb, GFP_KERNEL);
2048 l2cap_seq_list_clear(&chan->retrans_list);
2052 /* Update skb contents */
2053 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2054 put_unaligned_le32(__pack_extended_control(&control),
2055 tx_skb->data + L2CAP_HDR_SIZE);
2057 put_unaligned_le16(__pack_enhanced_control(&control),
2058 tx_skb->data + L2CAP_HDR_SIZE);
2062 if (chan->fcs == L2CAP_FCS_CRC16) {
2063 u16 fcs = crc16(0, (u8 *) tx_skb->data,
2064 tx_skb->len - L2CAP_FCS_SIZE);
2065 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) -
2069 l2cap_do_send(chan, tx_skb);
2071 BT_DBG("Resent txseq %d", control.txseq);
2073 chan->last_acked_seq = chan->buffer_seq;
2077 static void l2cap_retransmit(struct l2cap_chan *chan,
2078 struct l2cap_ctrl *control)
2080 BT_DBG("chan %p, control %p", chan, control);
2082 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2083 l2cap_ertm_resend(chan);
2086 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2087 struct l2cap_ctrl *control)
2089 struct sk_buff *skb;
2091 BT_DBG("chan %p, control %p", chan, control);
2094 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2096 l2cap_seq_list_clear(&chan->retrans_list);
2098 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2101 if (chan->unacked_frames) {
2102 skb_queue_walk(&chan->tx_q, skb) {
2103 if (bt_cb(skb)->l2cap.txseq == control->reqseq ||
2104 skb == chan->tx_send_head)
2108 skb_queue_walk_from(&chan->tx_q, skb) {
2109 if (skb == chan->tx_send_head)
2112 l2cap_seq_list_append(&chan->retrans_list,
2113 bt_cb(skb)->l2cap.txseq);
2116 l2cap_ertm_resend(chan);
2120 static void l2cap_send_ack(struct l2cap_chan *chan)
2122 struct l2cap_ctrl control;
2123 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2124 chan->last_acked_seq);
2127 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2128 chan, chan->last_acked_seq, chan->buffer_seq);
2130 memset(&control, 0, sizeof(control));
2133 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2134 chan->rx_state == L2CAP_RX_STATE_RECV) {
2135 __clear_ack_timer(chan);
2136 control.super = L2CAP_SUPER_RNR;
2137 control.reqseq = chan->buffer_seq;
2138 l2cap_send_sframe(chan, &control);
2140 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2141 l2cap_ertm_send(chan);
2142 /* If any i-frames were sent, they included an ack */
2143 if (chan->buffer_seq == chan->last_acked_seq)
2147 /* Ack now if the window is 3/4ths full.
2148 * Calculate without mul or div
2150 threshold = chan->ack_win;
2151 threshold += threshold << 1;
2154 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2157 if (frames_to_ack >= threshold) {
2158 __clear_ack_timer(chan);
2159 control.super = L2CAP_SUPER_RR;
2160 control.reqseq = chan->buffer_seq;
2161 l2cap_send_sframe(chan, &control);
2166 __set_ack_timer(chan);
2170 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2171 struct msghdr *msg, int len,
2172 int count, struct sk_buff *skb)
2174 struct l2cap_conn *conn = chan->conn;
2175 struct sk_buff **frag;
2178 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter))
2184 /* Continuation fragments (no L2CAP header) */
2185 frag = &skb_shinfo(skb)->frag_list;
2187 struct sk_buff *tmp;
2189 count = min_t(unsigned int, conn->mtu, len);
2191 tmp = chan->ops->alloc_skb(chan, 0, count,
2192 msg->msg_flags & MSG_DONTWAIT);
2194 return PTR_ERR(tmp);
2198 if (!copy_from_iter_full(skb_put(*frag, count), count,
2205 skb->len += (*frag)->len;
2206 skb->data_len += (*frag)->len;
2208 frag = &(*frag)->next;
2214 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2215 struct msghdr *msg, size_t len)
2217 struct l2cap_conn *conn = chan->conn;
2218 struct sk_buff *skb;
2219 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2220 struct l2cap_hdr *lh;
2222 BT_DBG("chan %p psm 0x%2.2x len %zu", chan,
2223 __le16_to_cpu(chan->psm), len);
2225 count = min_t(unsigned int, (conn->mtu - hlen), len);
2227 skb = chan->ops->alloc_skb(chan, hlen, count,
2228 msg->msg_flags & MSG_DONTWAIT);
2232 /* Create L2CAP header */
2233 lh = skb_put(skb, L2CAP_HDR_SIZE);
2234 lh->cid = cpu_to_le16(chan->dcid);
2235 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2236 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE));
2238 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2239 if (unlikely(err < 0)) {
2241 return ERR_PTR(err);
2246 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2247 struct msghdr *msg, size_t len)
2249 struct l2cap_conn *conn = chan->conn;
2250 struct sk_buff *skb;
2252 struct l2cap_hdr *lh;
2254 BT_DBG("chan %p len %zu", chan, len);
2256 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2258 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count,
2259 msg->msg_flags & MSG_DONTWAIT);
2263 /* Create L2CAP header */
2264 lh = skb_put(skb, L2CAP_HDR_SIZE);
2265 lh->cid = cpu_to_le16(chan->dcid);
2266 lh->len = cpu_to_le16(len);
2268 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2269 if (unlikely(err < 0)) {
2271 return ERR_PTR(err);
2276 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2277 struct msghdr *msg, size_t len,
2280 struct l2cap_conn *conn = chan->conn;
2281 struct sk_buff *skb;
2282 int err, count, hlen;
2283 struct l2cap_hdr *lh;
2285 BT_DBG("chan %p len %zu", chan, len);
2288 return ERR_PTR(-ENOTCONN);
2290 hlen = __ertm_hdr_size(chan);
2293 hlen += L2CAP_SDULEN_SIZE;
2295 if (chan->fcs == L2CAP_FCS_CRC16)
2296 hlen += L2CAP_FCS_SIZE;
2298 count = min_t(unsigned int, (conn->mtu - hlen), len);
2300 skb = chan->ops->alloc_skb(chan, hlen, count,
2301 msg->msg_flags & MSG_DONTWAIT);
2305 /* Create L2CAP header */
2306 lh = skb_put(skb, L2CAP_HDR_SIZE);
2307 lh->cid = cpu_to_le16(chan->dcid);
2308 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2310 /* Control header is populated later */
2311 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2312 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2314 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2317 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2319 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2320 if (unlikely(err < 0)) {
2322 return ERR_PTR(err);
2325 bt_cb(skb)->l2cap.fcs = chan->fcs;
2326 bt_cb(skb)->l2cap.retries = 0;
2330 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2331 struct sk_buff_head *seg_queue,
2332 struct msghdr *msg, size_t len)
2334 struct sk_buff *skb;
2339 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2341 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2342 * so fragmented skbs are not used. The HCI layer's handling
2343 * of fragmented skbs is not compatible with ERTM's queueing.
2346 /* PDU size is derived from the HCI MTU */
2347 pdu_len = chan->conn->mtu;
2349 /* Constrain PDU size for BR/EDR connections */
2350 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2352 /* Adjust for largest possible L2CAP overhead. */
2354 pdu_len -= L2CAP_FCS_SIZE;
2356 pdu_len -= __ertm_hdr_size(chan);
2358 /* Remote device may have requested smaller PDUs */
2359 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2361 if (len <= pdu_len) {
2362 sar = L2CAP_SAR_UNSEGMENTED;
2366 sar = L2CAP_SAR_START;
2371 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2374 __skb_queue_purge(seg_queue);
2375 return PTR_ERR(skb);
2378 bt_cb(skb)->l2cap.sar = sar;
2379 __skb_queue_tail(seg_queue, skb);
2385 if (len <= pdu_len) {
2386 sar = L2CAP_SAR_END;
2389 sar = L2CAP_SAR_CONTINUE;
2396 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan,
2398 size_t len, u16 sdulen)
2400 struct l2cap_conn *conn = chan->conn;
2401 struct sk_buff *skb;
2402 int err, count, hlen;
2403 struct l2cap_hdr *lh;
2405 BT_DBG("chan %p len %zu", chan, len);
2408 return ERR_PTR(-ENOTCONN);
2410 hlen = L2CAP_HDR_SIZE;
2413 hlen += L2CAP_SDULEN_SIZE;
2415 count = min_t(unsigned int, (conn->mtu - hlen), len);
2417 skb = chan->ops->alloc_skb(chan, hlen, count,
2418 msg->msg_flags & MSG_DONTWAIT);
2422 /* Create L2CAP header */
2423 lh = skb_put(skb, L2CAP_HDR_SIZE);
2424 lh->cid = cpu_to_le16(chan->dcid);
2425 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2428 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2430 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2431 if (unlikely(err < 0)) {
2433 return ERR_PTR(err);
2439 static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
2440 struct sk_buff_head *seg_queue,
2441 struct msghdr *msg, size_t len)
2443 struct sk_buff *skb;
2447 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2450 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
2456 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len);
2458 __skb_queue_purge(seg_queue);
2459 return PTR_ERR(skb);
2462 __skb_queue_tail(seg_queue, skb);
2468 pdu_len += L2CAP_SDULEN_SIZE;
2475 static void l2cap_le_flowctl_send(struct l2cap_chan *chan)
2479 BT_DBG("chan %p", chan);
2481 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) {
2482 l2cap_do_send(chan, skb_dequeue(&chan->tx_q));
2487 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits,
2488 skb_queue_len(&chan->tx_q));
2491 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
2493 struct sk_buff *skb;
2495 struct sk_buff_head seg_queue;
2500 /* Connectionless channel */
2501 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2502 skb = l2cap_create_connless_pdu(chan, msg, len);
2504 return PTR_ERR(skb);
2506 l2cap_do_send(chan, skb);
2510 switch (chan->mode) {
2511 case L2CAP_MODE_LE_FLOWCTL:
2512 case L2CAP_MODE_EXT_FLOWCTL:
2513 /* Check outgoing MTU */
2514 if (len > chan->omtu)
2517 __skb_queue_head_init(&seg_queue);
2519 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len);
2521 if (chan->state != BT_CONNECTED) {
2522 __skb_queue_purge(&seg_queue);
2529 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
2531 l2cap_le_flowctl_send(chan);
2533 if (!chan->tx_credits)
2534 chan->ops->suspend(chan);
2540 case L2CAP_MODE_BASIC:
2541 /* Check outgoing MTU */
2542 if (len > chan->omtu)
2545 /* Create a basic PDU */
2546 skb = l2cap_create_basic_pdu(chan, msg, len);
2548 return PTR_ERR(skb);
2550 l2cap_do_send(chan, skb);
2554 case L2CAP_MODE_ERTM:
2555 case L2CAP_MODE_STREAMING:
2556 /* Check outgoing MTU */
2557 if (len > chan->omtu) {
2562 __skb_queue_head_init(&seg_queue);
2564 /* Do segmentation before calling in to the state machine,
2565 * since it's possible to block while waiting for memory
2568 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2573 if (chan->mode == L2CAP_MODE_ERTM)
2574 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2576 l2cap_streaming_send(chan, &seg_queue);
2580 /* If the skbs were not queued for sending, they'll still be in
2581 * seg_queue and need to be purged.
2583 __skb_queue_purge(&seg_queue);
2587 BT_DBG("bad state %1.1x", chan->mode);
2593 EXPORT_SYMBOL_GPL(l2cap_chan_send);
2595 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2597 struct l2cap_ctrl control;
2600 BT_DBG("chan %p, txseq %u", chan, txseq);
2602 memset(&control, 0, sizeof(control));
2604 control.super = L2CAP_SUPER_SREJ;
2606 for (seq = chan->expected_tx_seq; seq != txseq;
2607 seq = __next_seq(chan, seq)) {
2608 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2609 control.reqseq = seq;
2610 l2cap_send_sframe(chan, &control);
2611 l2cap_seq_list_append(&chan->srej_list, seq);
2615 chan->expected_tx_seq = __next_seq(chan, txseq);
2618 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2620 struct l2cap_ctrl control;
2622 BT_DBG("chan %p", chan);
2624 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2627 memset(&control, 0, sizeof(control));
2629 control.super = L2CAP_SUPER_SREJ;
2630 control.reqseq = chan->srej_list.tail;
2631 l2cap_send_sframe(chan, &control);
2634 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2636 struct l2cap_ctrl control;
2640 BT_DBG("chan %p, txseq %u", chan, txseq);
2642 memset(&control, 0, sizeof(control));
2644 control.super = L2CAP_SUPER_SREJ;
2646 /* Capture initial list head to allow only one pass through the list. */
2647 initial_head = chan->srej_list.head;
2650 seq = l2cap_seq_list_pop(&chan->srej_list);
2651 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2654 control.reqseq = seq;
2655 l2cap_send_sframe(chan, &control);
2656 l2cap_seq_list_append(&chan->srej_list, seq);
2657 } while (chan->srej_list.head != initial_head);
2660 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2662 struct sk_buff *acked_skb;
2665 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2667 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2670 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2671 chan->expected_ack_seq, chan->unacked_frames);
2673 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2674 ackseq = __next_seq(chan, ackseq)) {
2676 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2678 skb_unlink(acked_skb, &chan->tx_q);
2679 kfree_skb(acked_skb);
2680 chan->unacked_frames--;
2684 chan->expected_ack_seq = reqseq;
2686 if (chan->unacked_frames == 0)
2687 __clear_retrans_timer(chan);
2689 BT_DBG("unacked_frames %u", chan->unacked_frames);
2692 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2694 BT_DBG("chan %p", chan);
2696 chan->expected_tx_seq = chan->buffer_seq;
2697 l2cap_seq_list_clear(&chan->srej_list);
2698 skb_queue_purge(&chan->srej_q);
2699 chan->rx_state = L2CAP_RX_STATE_RECV;
2702 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2703 struct l2cap_ctrl *control,
2704 struct sk_buff_head *skbs, u8 event)
2706 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2710 case L2CAP_EV_DATA_REQUEST:
2711 if (chan->tx_send_head == NULL)
2712 chan->tx_send_head = skb_peek(skbs);
2714 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2715 l2cap_ertm_send(chan);
2717 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2718 BT_DBG("Enter LOCAL_BUSY");
2719 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2721 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2722 /* The SREJ_SENT state must be aborted if we are to
2723 * enter the LOCAL_BUSY state.
2725 l2cap_abort_rx_srej_sent(chan);
2728 l2cap_send_ack(chan);
2731 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2732 BT_DBG("Exit LOCAL_BUSY");
2733 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2735 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2736 struct l2cap_ctrl local_control;
2738 memset(&local_control, 0, sizeof(local_control));
2739 local_control.sframe = 1;
2740 local_control.super = L2CAP_SUPER_RR;
2741 local_control.poll = 1;
2742 local_control.reqseq = chan->buffer_seq;
2743 l2cap_send_sframe(chan, &local_control);
2745 chan->retry_count = 1;
2746 __set_monitor_timer(chan);
2747 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2750 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2751 l2cap_process_reqseq(chan, control->reqseq);
2753 case L2CAP_EV_EXPLICIT_POLL:
2754 l2cap_send_rr_or_rnr(chan, 1);
2755 chan->retry_count = 1;
2756 __set_monitor_timer(chan);
2757 __clear_ack_timer(chan);
2758 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2760 case L2CAP_EV_RETRANS_TO:
2761 l2cap_send_rr_or_rnr(chan, 1);
2762 chan->retry_count = 1;
2763 __set_monitor_timer(chan);
2764 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2766 case L2CAP_EV_RECV_FBIT:
2767 /* Nothing to process */
2774 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2775 struct l2cap_ctrl *control,
2776 struct sk_buff_head *skbs, u8 event)
2778 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2782 case L2CAP_EV_DATA_REQUEST:
2783 if (chan->tx_send_head == NULL)
2784 chan->tx_send_head = skb_peek(skbs);
2785 /* Queue data, but don't send. */
2786 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2788 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2789 BT_DBG("Enter LOCAL_BUSY");
2790 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2792 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2793 /* The SREJ_SENT state must be aborted if we are to
2794 * enter the LOCAL_BUSY state.
2796 l2cap_abort_rx_srej_sent(chan);
2799 l2cap_send_ack(chan);
2802 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2803 BT_DBG("Exit LOCAL_BUSY");
2804 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2806 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2807 struct l2cap_ctrl local_control;
2808 memset(&local_control, 0, sizeof(local_control));
2809 local_control.sframe = 1;
2810 local_control.super = L2CAP_SUPER_RR;
2811 local_control.poll = 1;
2812 local_control.reqseq = chan->buffer_seq;
2813 l2cap_send_sframe(chan, &local_control);
2815 chan->retry_count = 1;
2816 __set_monitor_timer(chan);
2817 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2820 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2821 l2cap_process_reqseq(chan, control->reqseq);
2824 case L2CAP_EV_RECV_FBIT:
2825 if (control && control->final) {
2826 __clear_monitor_timer(chan);
2827 if (chan->unacked_frames > 0)
2828 __set_retrans_timer(chan);
2829 chan->retry_count = 0;
2830 chan->tx_state = L2CAP_TX_STATE_XMIT;
2831 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2834 case L2CAP_EV_EXPLICIT_POLL:
2837 case L2CAP_EV_MONITOR_TO:
2838 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2839 l2cap_send_rr_or_rnr(chan, 1);
2840 __set_monitor_timer(chan);
2841 chan->retry_count++;
2843 l2cap_send_disconn_req(chan, ECONNABORTED);
2851 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2852 struct sk_buff_head *skbs, u8 event)
2854 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2855 chan, control, skbs, event, chan->tx_state);
2857 switch (chan->tx_state) {
2858 case L2CAP_TX_STATE_XMIT:
2859 l2cap_tx_state_xmit(chan, control, skbs, event);
2861 case L2CAP_TX_STATE_WAIT_F:
2862 l2cap_tx_state_wait_f(chan, control, skbs, event);
2870 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2871 struct l2cap_ctrl *control)
2873 BT_DBG("chan %p, control %p", chan, control);
2874 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2877 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2878 struct l2cap_ctrl *control)
2880 BT_DBG("chan %p, control %p", chan, control);
2881 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2884 /* Copy frame to all raw sockets on that connection */
2885 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2887 struct sk_buff *nskb;
2888 struct l2cap_chan *chan;
2890 BT_DBG("conn %p", conn);
2892 mutex_lock(&conn->chan_lock);
2894 list_for_each_entry(chan, &conn->chan_l, list) {
2895 if (chan->chan_type != L2CAP_CHAN_RAW)
2898 /* Don't send frame to the channel it came from */
2899 if (bt_cb(skb)->l2cap.chan == chan)
2902 nskb = skb_clone(skb, GFP_KERNEL);
2905 if (chan->ops->recv(chan, nskb))
2909 mutex_unlock(&conn->chan_lock);
2912 /* ---- L2CAP signalling commands ---- */
2913 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2914 u8 ident, u16 dlen, void *data)
2916 struct sk_buff *skb, **frag;
2917 struct l2cap_cmd_hdr *cmd;
2918 struct l2cap_hdr *lh;
2921 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2922 conn, code, ident, dlen);
2924 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2927 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2928 count = min_t(unsigned int, conn->mtu, len);
2930 skb = bt_skb_alloc(count, GFP_KERNEL);
2934 lh = skb_put(skb, L2CAP_HDR_SIZE);
2935 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2937 if (conn->hcon->type == LE_LINK)
2938 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2940 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
2942 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE);
2945 cmd->len = cpu_to_le16(dlen);
2948 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2949 skb_put_data(skb, data, count);
2955 /* Continuation fragments (no L2CAP header) */
2956 frag = &skb_shinfo(skb)->frag_list;
2958 count = min_t(unsigned int, conn->mtu, len);
2960 *frag = bt_skb_alloc(count, GFP_KERNEL);
2964 skb_put_data(*frag, data, count);
2969 frag = &(*frag)->next;
2979 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2982 struct l2cap_conf_opt *opt = *ptr;
2985 len = L2CAP_CONF_OPT_SIZE + opt->len;
2993 *val = *((u8 *) opt->val);
2997 *val = get_unaligned_le16(opt->val);
3001 *val = get_unaligned_le32(opt->val);
3005 *val = (unsigned long) opt->val;
3009 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
3013 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size)
3015 struct l2cap_conf_opt *opt = *ptr;
3017 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
3019 if (size < L2CAP_CONF_OPT_SIZE + len)
3027 *((u8 *) opt->val) = val;
3031 put_unaligned_le16(val, opt->val);
3035 put_unaligned_le32(val, opt->val);
3039 memcpy(opt->val, (void *) val, len);
3043 *ptr += L2CAP_CONF_OPT_SIZE + len;
3046 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size)
3048 struct l2cap_conf_efs efs;
3050 switch (chan->mode) {
3051 case L2CAP_MODE_ERTM:
3052 efs.id = chan->local_id;
3053 efs.stype = chan->local_stype;
3054 efs.msdu = cpu_to_le16(chan->local_msdu);
3055 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3056 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
3057 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
3060 case L2CAP_MODE_STREAMING:
3062 efs.stype = L2CAP_SERV_BESTEFFORT;
3063 efs.msdu = cpu_to_le16(chan->local_msdu);
3064 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3073 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3074 (unsigned long) &efs, size);
3077 static void l2cap_ack_timeout(struct work_struct *work)
3079 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3083 BT_DBG("chan %p", chan);
3085 l2cap_chan_lock(chan);
3087 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3088 chan->last_acked_seq);
3091 l2cap_send_rr_or_rnr(chan, 0);
3093 l2cap_chan_unlock(chan);
3094 l2cap_chan_put(chan);
3097 int l2cap_ertm_init(struct l2cap_chan *chan)
3101 chan->next_tx_seq = 0;
3102 chan->expected_tx_seq = 0;
3103 chan->expected_ack_seq = 0;
3104 chan->unacked_frames = 0;
3105 chan->buffer_seq = 0;
3106 chan->frames_sent = 0;
3107 chan->last_acked_seq = 0;
3109 chan->sdu_last_frag = NULL;
3112 skb_queue_head_init(&chan->tx_q);
3114 if (chan->mode != L2CAP_MODE_ERTM)
3117 chan->rx_state = L2CAP_RX_STATE_RECV;
3118 chan->tx_state = L2CAP_TX_STATE_XMIT;
3120 skb_queue_head_init(&chan->srej_q);
3122 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3126 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3128 l2cap_seq_list_free(&chan->srej_list);
3133 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3136 case L2CAP_MODE_STREAMING:
3137 case L2CAP_MODE_ERTM:
3138 if (l2cap_mode_supported(mode, remote_feat_mask))
3142 return L2CAP_MODE_BASIC;
3146 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn)
3148 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW);
3151 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn)
3153 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW);
3156 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3157 struct l2cap_conf_rfc *rfc)
3159 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3160 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3163 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3165 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3166 __l2cap_ews_supported(chan->conn)) {
3167 /* use extended control field */
3168 set_bit(FLAG_EXT_CTRL, &chan->flags);
3169 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3171 chan->tx_win = min_t(u16, chan->tx_win,
3172 L2CAP_DEFAULT_TX_WINDOW);
3173 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3175 chan->ack_win = chan->tx_win;
3178 static void l2cap_mtu_auto(struct l2cap_chan *chan)
3180 struct hci_conn *conn = chan->conn->hcon;
3182 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3184 /* The 2-DH1 packet has between 2 and 56 information bytes
3185 * (including the 2-byte payload header)
3187 if (!(conn->pkt_type & HCI_2DH1))
3190 /* The 3-DH1 packet has between 2 and 85 information bytes
3191 * (including the 2-byte payload header)
3193 if (!(conn->pkt_type & HCI_3DH1))
3196 /* The 2-DH3 packet has between 2 and 369 information bytes
3197 * (including the 2-byte payload header)
3199 if (!(conn->pkt_type & HCI_2DH3))
3202 /* The 3-DH3 packet has between 2 and 554 information bytes
3203 * (including the 2-byte payload header)
3205 if (!(conn->pkt_type & HCI_3DH3))
3208 /* The 2-DH5 packet has between 2 and 681 information bytes
3209 * (including the 2-byte payload header)
3211 if (!(conn->pkt_type & HCI_2DH5))
3214 /* The 3-DH5 packet has between 2 and 1023 information bytes
3215 * (including the 2-byte payload header)
3217 if (!(conn->pkt_type & HCI_3DH5))
3221 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3223 struct l2cap_conf_req *req = data;
3224 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3225 void *ptr = req->data;
3226 void *endptr = data + data_size;
3229 BT_DBG("chan %p", chan);
3231 if (chan->num_conf_req || chan->num_conf_rsp)
3234 switch (chan->mode) {
3235 case L2CAP_MODE_STREAMING:
3236 case L2CAP_MODE_ERTM:
3237 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3240 if (__l2cap_efs_supported(chan->conn))
3241 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3245 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3250 if (chan->imtu != L2CAP_DEFAULT_MTU) {
3252 l2cap_mtu_auto(chan);
3253 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3257 switch (chan->mode) {
3258 case L2CAP_MODE_BASIC:
3262 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3263 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3266 rfc.mode = L2CAP_MODE_BASIC;
3268 rfc.max_transmit = 0;
3269 rfc.retrans_timeout = 0;
3270 rfc.monitor_timeout = 0;
3271 rfc.max_pdu_size = 0;
3273 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3274 (unsigned long) &rfc, endptr - ptr);
3277 case L2CAP_MODE_ERTM:
3278 rfc.mode = L2CAP_MODE_ERTM;
3279 rfc.max_transmit = chan->max_tx;
3281 __l2cap_set_ertm_timeouts(chan, &rfc);
3283 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3284 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3286 rfc.max_pdu_size = cpu_to_le16(size);
3288 l2cap_txwin_setup(chan);
3290 rfc.txwin_size = min_t(u16, chan->tx_win,
3291 L2CAP_DEFAULT_TX_WINDOW);
3293 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3294 (unsigned long) &rfc, endptr - ptr);
3296 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3297 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3299 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3300 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3301 chan->tx_win, endptr - ptr);
3303 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3304 if (chan->fcs == L2CAP_FCS_NONE ||
3305 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3306 chan->fcs = L2CAP_FCS_NONE;
3307 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3308 chan->fcs, endptr - ptr);
3312 case L2CAP_MODE_STREAMING:
3313 l2cap_txwin_setup(chan);
3314 rfc.mode = L2CAP_MODE_STREAMING;
3316 rfc.max_transmit = 0;
3317 rfc.retrans_timeout = 0;
3318 rfc.monitor_timeout = 0;
3320 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3321 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3323 rfc.max_pdu_size = cpu_to_le16(size);
3325 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3326 (unsigned long) &rfc, endptr - ptr);
3328 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3329 l2cap_add_opt_efs(&ptr, chan, endptr - ptr);
3331 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3332 if (chan->fcs == L2CAP_FCS_NONE ||
3333 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3334 chan->fcs = L2CAP_FCS_NONE;
3335 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3336 chan->fcs, endptr - ptr);
3341 req->dcid = cpu_to_le16(chan->dcid);
3342 req->flags = cpu_to_le16(0);
3347 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size)
3349 struct l2cap_conf_rsp *rsp = data;
3350 void *ptr = rsp->data;
3351 void *endptr = data + data_size;
3352 void *req = chan->conf_req;
3353 int len = chan->conf_len;
3354 int type, hint, olen;
3356 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3357 struct l2cap_conf_efs efs;
3359 u16 mtu = L2CAP_DEFAULT_MTU;
3360 u16 result = L2CAP_CONF_SUCCESS;
3363 BT_DBG("chan %p", chan);
3365 while (len >= L2CAP_CONF_OPT_SIZE) {
3366 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3370 hint = type & L2CAP_CONF_HINT;
3371 type &= L2CAP_CONF_MASK;
3374 case L2CAP_CONF_MTU:
3380 case L2CAP_CONF_FLUSH_TO:
3383 chan->flush_to = val;
3386 case L2CAP_CONF_QOS:
3389 case L2CAP_CONF_RFC:
3390 if (olen != sizeof(rfc))
3392 memcpy(&rfc, (void *) val, olen);
3395 case L2CAP_CONF_FCS:
3398 if (val == L2CAP_FCS_NONE)
3399 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3402 case L2CAP_CONF_EFS:
3403 if (olen != sizeof(efs))
3406 memcpy(&efs, (void *) val, olen);
3409 case L2CAP_CONF_EWS:
3412 return -ECONNREFUSED;
3417 result = L2CAP_CONF_UNKNOWN;
3418 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr);
3423 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3426 switch (chan->mode) {
3427 case L2CAP_MODE_STREAMING:
3428 case L2CAP_MODE_ERTM:
3429 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3430 chan->mode = l2cap_select_mode(rfc.mode,
3431 chan->conn->feat_mask);
3436 if (__l2cap_efs_supported(chan->conn))
3437 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3439 return -ECONNREFUSED;
3442 if (chan->mode != rfc.mode)
3443 return -ECONNREFUSED;
3449 if (chan->mode != rfc.mode) {
3450 result = L2CAP_CONF_UNACCEPT;
3451 rfc.mode = chan->mode;
3453 if (chan->num_conf_rsp == 1)
3454 return -ECONNREFUSED;
3456 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3457 (unsigned long) &rfc, endptr - ptr);
3460 if (result == L2CAP_CONF_SUCCESS) {
3461 /* Configure output options and let the other side know
3462 * which ones we don't like. */
3464 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3465 result = L2CAP_CONF_UNACCEPT;
3468 set_bit(CONF_MTU_DONE, &chan->conf_state);
3470 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr);
3473 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3474 efs.stype != L2CAP_SERV_NOTRAFIC &&
3475 efs.stype != chan->local_stype) {
3477 result = L2CAP_CONF_UNACCEPT;
3479 if (chan->num_conf_req >= 1)
3480 return -ECONNREFUSED;
3482 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3484 (unsigned long) &efs, endptr - ptr);
3486 /* Send PENDING Conf Rsp */
3487 result = L2CAP_CONF_PENDING;
3488 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3493 case L2CAP_MODE_BASIC:
3494 chan->fcs = L2CAP_FCS_NONE;
3495 set_bit(CONF_MODE_DONE, &chan->conf_state);
3498 case L2CAP_MODE_ERTM:
3499 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3500 chan->remote_tx_win = rfc.txwin_size;
3502 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3504 chan->remote_max_tx = rfc.max_transmit;
3506 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3507 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3508 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3509 rfc.max_pdu_size = cpu_to_le16(size);
3510 chan->remote_mps = size;
3512 __l2cap_set_ertm_timeouts(chan, &rfc);
3514 set_bit(CONF_MODE_DONE, &chan->conf_state);
3516 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3517 sizeof(rfc), (unsigned long) &rfc, endptr - ptr);
3520 test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3521 chan->remote_id = efs.id;
3522 chan->remote_stype = efs.stype;
3523 chan->remote_msdu = le16_to_cpu(efs.msdu);
3524 chan->remote_flush_to =
3525 le32_to_cpu(efs.flush_to);
3526 chan->remote_acc_lat =
3527 le32_to_cpu(efs.acc_lat);
3528 chan->remote_sdu_itime =
3529 le32_to_cpu(efs.sdu_itime);
3530 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3532 (unsigned long) &efs, endptr - ptr);
3536 case L2CAP_MODE_STREAMING:
3537 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3538 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3539 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3540 rfc.max_pdu_size = cpu_to_le16(size);
3541 chan->remote_mps = size;
3543 set_bit(CONF_MODE_DONE, &chan->conf_state);
3545 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3546 (unsigned long) &rfc, endptr - ptr);
3551 result = L2CAP_CONF_UNACCEPT;
3553 memset(&rfc, 0, sizeof(rfc));
3554 rfc.mode = chan->mode;
3557 if (result == L2CAP_CONF_SUCCESS)
3558 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3560 rsp->scid = cpu_to_le16(chan->dcid);
3561 rsp->result = cpu_to_le16(result);
3562 rsp->flags = cpu_to_le16(0);
3567 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3568 void *data, size_t size, u16 *result)
3570 struct l2cap_conf_req *req = data;
3571 void *ptr = req->data;
3572 void *endptr = data + size;
3575 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3576 struct l2cap_conf_efs efs;
3578 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3580 while (len >= L2CAP_CONF_OPT_SIZE) {
3581 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3586 case L2CAP_CONF_MTU:
3589 if (val < L2CAP_DEFAULT_MIN_MTU) {
3590 *result = L2CAP_CONF_UNACCEPT;
3591 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3594 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu,
3598 case L2CAP_CONF_FLUSH_TO:
3601 chan->flush_to = val;
3602 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2,
3603 chan->flush_to, endptr - ptr);
3606 case L2CAP_CONF_RFC:
3607 if (olen != sizeof(rfc))
3609 memcpy(&rfc, (void *)val, olen);
3610 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3611 rfc.mode != chan->mode)
3612 return -ECONNREFUSED;
3614 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3615 (unsigned long) &rfc, endptr - ptr);
3618 case L2CAP_CONF_EWS:
3621 chan->ack_win = min_t(u16, val, chan->ack_win);
3622 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3623 chan->tx_win, endptr - ptr);
3626 case L2CAP_CONF_EFS:
3627 if (olen != sizeof(efs))
3629 memcpy(&efs, (void *)val, olen);
3630 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3631 efs.stype != L2CAP_SERV_NOTRAFIC &&
3632 efs.stype != chan->local_stype)
3633 return -ECONNREFUSED;
3634 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3635 (unsigned long) &efs, endptr - ptr);
3638 case L2CAP_CONF_FCS:
3641 if (*result == L2CAP_CONF_PENDING)
3642 if (val == L2CAP_FCS_NONE)
3643 set_bit(CONF_RECV_NO_FCS,
3649 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3650 return -ECONNREFUSED;
3652 chan->mode = rfc.mode;
3654 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3656 case L2CAP_MODE_ERTM:
3657 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3658 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3659 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3660 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3661 chan->ack_win = min_t(u16, chan->ack_win,
3664 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3665 chan->local_msdu = le16_to_cpu(efs.msdu);
3666 chan->local_sdu_itime =
3667 le32_to_cpu(efs.sdu_itime);
3668 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3669 chan->local_flush_to =
3670 le32_to_cpu(efs.flush_to);
3674 case L2CAP_MODE_STREAMING:
3675 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3679 req->dcid = cpu_to_le16(chan->dcid);
3680 req->flags = cpu_to_le16(0);
3685 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3686 u16 result, u16 flags)
3688 struct l2cap_conf_rsp *rsp = data;
3689 void *ptr = rsp->data;
3691 BT_DBG("chan %p", chan);
3693 rsp->scid = cpu_to_le16(chan->dcid);
3694 rsp->result = cpu_to_le16(result);
3695 rsp->flags = cpu_to_le16(flags);
3700 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan)
3702 struct l2cap_le_conn_rsp rsp;
3703 struct l2cap_conn *conn = chan->conn;
3705 BT_DBG("chan %p", chan);
3707 rsp.dcid = cpu_to_le16(chan->scid);
3708 rsp.mtu = cpu_to_le16(chan->imtu);
3709 rsp.mps = cpu_to_le16(chan->mps);
3710 rsp.credits = cpu_to_le16(chan->rx_credits);
3711 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3713 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp),
3717 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data)
3721 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3724 switch (chan->state) {
3726 /* If channel still pending accept add to result */
3732 /* If not connected or pending accept it has been refused */
3733 *result = -ECONNREFUSED;
3738 struct l2cap_ecred_rsp_data {
3740 struct l2cap_ecred_conn_rsp rsp;
3741 __le16 scid[L2CAP_ECRED_MAX_CID];
3746 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data)
3748 struct l2cap_ecred_rsp_data *rsp = data;
3750 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags))
3753 /* Reset ident so only one response is sent */
3756 /* Include all channels pending with the same ident */
3757 if (!rsp->pdu.rsp.result)
3758 rsp->pdu.rsp.dcid[rsp->count++] = cpu_to_le16(chan->scid);
3760 l2cap_chan_del(chan, ECONNRESET);
3763 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan)
3765 struct l2cap_conn *conn = chan->conn;
3766 struct l2cap_ecred_rsp_data data;
3767 u16 id = chan->ident;
3773 BT_DBG("chan %p id %d", chan, id);
3775 memset(&data, 0, sizeof(data));
3777 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu);
3778 data.pdu.rsp.mps = cpu_to_le16(chan->mps);
3779 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
3780 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS);
3782 /* Verify that all channels are ready */
3783 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result);
3789 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION);
3791 /* Build response */
3792 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data);
3794 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP,
3795 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)),
3799 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3801 struct l2cap_conn_rsp rsp;
3802 struct l2cap_conn *conn = chan->conn;
3806 rsp.scid = cpu_to_le16(chan->dcid);
3807 rsp.dcid = cpu_to_le16(chan->scid);
3808 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3809 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3810 rsp_code = L2CAP_CONN_RSP;
3812 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3814 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3816 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3819 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3820 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
3821 chan->num_conf_req++;
3824 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3828 /* Use sane default values in case a misbehaving remote device
3829 * did not send an RFC or extended window size option.
3831 u16 txwin_ext = chan->ack_win;
3832 struct l2cap_conf_rfc rfc = {
3834 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3835 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3836 .max_pdu_size = cpu_to_le16(chan->imtu),
3837 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3840 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3842 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3845 while (len >= L2CAP_CONF_OPT_SIZE) {
3846 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3851 case L2CAP_CONF_RFC:
3852 if (olen != sizeof(rfc))
3854 memcpy(&rfc, (void *)val, olen);
3856 case L2CAP_CONF_EWS:
3865 case L2CAP_MODE_ERTM:
3866 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3867 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3868 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3869 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3870 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3872 chan->ack_win = min_t(u16, chan->ack_win,
3875 case L2CAP_MODE_STREAMING:
3876 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3880 static inline int l2cap_command_rej(struct l2cap_conn *conn,
3881 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3884 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3886 if (cmd_len < sizeof(*rej))
3889 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3892 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3893 cmd->ident == conn->info_ident) {
3894 cancel_delayed_work(&conn->info_timer);
3896 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3897 conn->info_ident = 0;
3899 l2cap_conn_start(conn);
3905 static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3906 struct l2cap_cmd_hdr *cmd,
3907 u8 *data, u8 rsp_code, u8 amp_id)
3909 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3910 struct l2cap_conn_rsp rsp;
3911 struct l2cap_chan *chan = NULL, *pchan;
3912 int result, status = L2CAP_CS_NO_INFO;
3914 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3915 __le16 psm = req->psm;
3917 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3919 /* Check if we have socket listening on psm */
3920 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
3921 &conn->hcon->dst, ACL_LINK);
3923 result = L2CAP_CR_BAD_PSM;
3927 mutex_lock(&conn->chan_lock);
3928 l2cap_chan_lock(pchan);
3930 /* Check if the ACL is secure enough (if not SDP) */
3931 if (psm != cpu_to_le16(L2CAP_PSM_SDP) &&
3932 !hci_conn_check_link_mode(conn->hcon)) {
3933 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3934 result = L2CAP_CR_SEC_BLOCK;
3938 result = L2CAP_CR_NO_MEM;
3940 /* Check for valid dynamic CID range (as per Erratum 3253) */
3941 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) {
3942 result = L2CAP_CR_INVALID_SCID;
3946 /* Check if we already have channel with that dcid */
3947 if (__l2cap_get_chan_by_dcid(conn, scid)) {
3948 result = L2CAP_CR_SCID_IN_USE;
3952 chan = pchan->ops->new_connection(pchan);
3956 /* For certain devices (ex: HID mouse), support for authentication,
3957 * pairing and bonding is optional. For such devices, inorder to avoid
3958 * the ACL alive for too long after L2CAP disconnection, reset the ACL
3959 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect.
3961 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3963 bacpy(&chan->src, &conn->hcon->src);
3964 bacpy(&chan->dst, &conn->hcon->dst);
3965 chan->src_type = bdaddr_src_type(conn->hcon);
3966 chan->dst_type = bdaddr_dst_type(conn->hcon);
3970 __l2cap_chan_add(conn, chan);
3974 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
3976 chan->ident = cmd->ident;
3978 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
3979 if (l2cap_chan_check_security(chan, false)) {
3980 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
3981 l2cap_state_change(chan, BT_CONNECT2);
3982 result = L2CAP_CR_PEND;
3983 status = L2CAP_CS_AUTHOR_PEND;
3984 chan->ops->defer(chan);
3986 /* Force pending result for AMP controllers.
3987 * The connection will succeed after the
3988 * physical link is up.
3990 if (amp_id == AMP_ID_BREDR) {
3991 l2cap_state_change(chan, BT_CONFIG);
3992 result = L2CAP_CR_SUCCESS;
3994 l2cap_state_change(chan, BT_CONNECT2);
3995 result = L2CAP_CR_PEND;
3997 status = L2CAP_CS_NO_INFO;
4000 l2cap_state_change(chan, BT_CONNECT2);
4001 result = L2CAP_CR_PEND;
4002 status = L2CAP_CS_AUTHEN_PEND;
4005 l2cap_state_change(chan, BT_CONNECT2);
4006 result = L2CAP_CR_PEND;
4007 status = L2CAP_CS_NO_INFO;
4011 l2cap_chan_unlock(pchan);
4012 mutex_unlock(&conn->chan_lock);
4013 l2cap_chan_put(pchan);
4016 rsp.scid = cpu_to_le16(scid);
4017 rsp.dcid = cpu_to_le16(dcid);
4018 rsp.result = cpu_to_le16(result);
4019 rsp.status = cpu_to_le16(status);
4020 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
4022 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
4023 struct l2cap_info_req info;
4024 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4026 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
4027 conn->info_ident = l2cap_get_ident(conn);
4029 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
4031 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
4032 sizeof(info), &info);
4035 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
4036 result == L2CAP_CR_SUCCESS) {
4038 set_bit(CONF_REQ_SENT, &chan->conf_state);
4039 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4040 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4041 chan->num_conf_req++;
4047 static int l2cap_connect_req(struct l2cap_conn *conn,
4048 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4050 struct hci_dev *hdev = conn->hcon->hdev;
4051 struct hci_conn *hcon = conn->hcon;
4053 if (cmd_len < sizeof(struct l2cap_conn_req))
4057 if (hci_dev_test_flag(hdev, HCI_MGMT))
4058 mgmt_device_connected(hdev, hcon, NULL, 0);
4059 hci_dev_unlock(hdev);
4061 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
4065 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
4066 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4069 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
4070 u16 scid, dcid, result, status;
4071 struct l2cap_chan *chan;
4075 if (cmd_len < sizeof(*rsp))
4078 scid = __le16_to_cpu(rsp->scid);
4079 dcid = __le16_to_cpu(rsp->dcid);
4080 result = __le16_to_cpu(rsp->result);
4081 status = __le16_to_cpu(rsp->status);
4083 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START ||
4084 dcid > L2CAP_CID_DYN_END))
4087 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
4088 dcid, scid, result, status);
4090 mutex_lock(&conn->chan_lock);
4093 chan = __l2cap_get_chan_by_scid(conn, scid);
4099 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4106 chan = l2cap_chan_hold_unless_zero(chan);
4114 l2cap_chan_lock(chan);
4117 case L2CAP_CR_SUCCESS:
4118 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4123 l2cap_state_change(chan, BT_CONFIG);
4126 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
4128 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
4131 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4132 l2cap_build_conf_req(chan, req, sizeof(req)), req);
4133 chan->num_conf_req++;
4137 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
4141 l2cap_chan_del(chan, ECONNREFUSED);
4145 l2cap_chan_unlock(chan);
4146 l2cap_chan_put(chan);
4149 mutex_unlock(&conn->chan_lock);
4154 static inline void set_default_fcs(struct l2cap_chan *chan)
4156 /* FCS is enabled only in ERTM or streaming mode, if one or both
4159 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
4160 chan->fcs = L2CAP_FCS_NONE;
4161 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
4162 chan->fcs = L2CAP_FCS_CRC16;
4165 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
4166 u8 ident, u16 flags)
4168 struct l2cap_conn *conn = chan->conn;
4170 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
4173 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
4174 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4176 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
4177 l2cap_build_conf_rsp(chan, data,
4178 L2CAP_CONF_SUCCESS, flags), data);
4181 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident,
4184 struct l2cap_cmd_rej_cid rej;
4186 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
4187 rej.scid = __cpu_to_le16(scid);
4188 rej.dcid = __cpu_to_le16(dcid);
4190 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4193 static inline int l2cap_config_req(struct l2cap_conn *conn,
4194 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4197 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
4200 struct l2cap_chan *chan;
4203 if (cmd_len < sizeof(*req))
4206 dcid = __le16_to_cpu(req->dcid);
4207 flags = __le16_to_cpu(req->flags);
4209 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
4211 chan = l2cap_get_chan_by_scid(conn, dcid);
4213 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0);
4217 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
4218 chan->state != BT_CONNECTED) {
4219 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
4224 /* Reject if config buffer is too small. */
4225 len = cmd_len - sizeof(*req);
4226 if (chan->conf_len + len > sizeof(chan->conf_req)) {
4227 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4228 l2cap_build_conf_rsp(chan, rsp,
4229 L2CAP_CONF_REJECT, flags), rsp);
4234 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4235 chan->conf_len += len;
4237 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4238 /* Incomplete config. Send empty response. */
4239 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4240 l2cap_build_conf_rsp(chan, rsp,
4241 L2CAP_CONF_SUCCESS, flags), rsp);
4245 /* Complete config. */
4246 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp));
4248 l2cap_send_disconn_req(chan, ECONNRESET);
4252 chan->ident = cmd->ident;
4253 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4254 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP)
4255 chan->num_conf_rsp++;
4257 /* Reset config buffer. */
4260 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4263 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4264 set_default_fcs(chan);
4266 if (chan->mode == L2CAP_MODE_ERTM ||
4267 chan->mode == L2CAP_MODE_STREAMING)
4268 err = l2cap_ertm_init(chan);
4271 l2cap_send_disconn_req(chan, -err);
4273 l2cap_chan_ready(chan);
4278 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4280 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4281 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf);
4282 chan->num_conf_req++;
4285 /* Got Conf Rsp PENDING from remote side and assume we sent
4286 Conf Rsp PENDING in the code above */
4287 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4288 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4290 /* check compatibility */
4292 /* Send rsp for BR/EDR channel */
4293 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4297 l2cap_chan_unlock(chan);
4298 l2cap_chan_put(chan);
4302 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4303 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4306 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4307 u16 scid, flags, result;
4308 struct l2cap_chan *chan;
4309 int len = cmd_len - sizeof(*rsp);
4312 if (cmd_len < sizeof(*rsp))
4315 scid = __le16_to_cpu(rsp->scid);
4316 flags = __le16_to_cpu(rsp->flags);
4317 result = __le16_to_cpu(rsp->result);
4319 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4322 chan = l2cap_get_chan_by_scid(conn, scid);
4327 case L2CAP_CONF_SUCCESS:
4328 l2cap_conf_rfc_get(chan, rsp->data, len);
4329 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4332 case L2CAP_CONF_PENDING:
4333 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4335 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4338 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4339 buf, sizeof(buf), &result);
4341 l2cap_send_disconn_req(chan, ECONNRESET);
4345 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0);
4349 case L2CAP_CONF_UNKNOWN:
4350 case L2CAP_CONF_UNACCEPT:
4351 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4354 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4355 l2cap_send_disconn_req(chan, ECONNRESET);
4359 /* throw out any old stored conf requests */
4360 result = L2CAP_CONF_SUCCESS;
4361 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4362 req, sizeof(req), &result);
4364 l2cap_send_disconn_req(chan, ECONNRESET);
4368 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4369 L2CAP_CONF_REQ, len, req);
4370 chan->num_conf_req++;
4371 if (result != L2CAP_CONF_SUCCESS)
4378 l2cap_chan_set_err(chan, ECONNRESET);
4380 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4381 l2cap_send_disconn_req(chan, ECONNRESET);
4385 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4388 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4390 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4391 set_default_fcs(chan);
4393 if (chan->mode == L2CAP_MODE_ERTM ||
4394 chan->mode == L2CAP_MODE_STREAMING)
4395 err = l2cap_ertm_init(chan);
4398 l2cap_send_disconn_req(chan, -err);
4400 l2cap_chan_ready(chan);
4404 l2cap_chan_unlock(chan);
4405 l2cap_chan_put(chan);
4409 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4410 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4413 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4414 struct l2cap_disconn_rsp rsp;
4416 struct l2cap_chan *chan;
4418 if (cmd_len != sizeof(*req))
4421 scid = __le16_to_cpu(req->scid);
4422 dcid = __le16_to_cpu(req->dcid);
4424 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4426 chan = l2cap_get_chan_by_scid(conn, dcid);
4428 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid);
4432 rsp.dcid = cpu_to_le16(chan->scid);
4433 rsp.scid = cpu_to_le16(chan->dcid);
4434 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4436 chan->ops->set_shutdown(chan);
4438 l2cap_chan_unlock(chan);
4439 mutex_lock(&conn->chan_lock);
4440 l2cap_chan_lock(chan);
4441 l2cap_chan_del(chan, ECONNRESET);
4442 mutex_unlock(&conn->chan_lock);
4444 chan->ops->close(chan);
4446 l2cap_chan_unlock(chan);
4447 l2cap_chan_put(chan);
4452 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4453 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4456 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4458 struct l2cap_chan *chan;
4460 if (cmd_len != sizeof(*rsp))
4463 scid = __le16_to_cpu(rsp->scid);
4464 dcid = __le16_to_cpu(rsp->dcid);
4466 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4468 chan = l2cap_get_chan_by_scid(conn, scid);
4473 if (chan->state != BT_DISCONN) {
4474 l2cap_chan_unlock(chan);
4475 l2cap_chan_put(chan);
4479 l2cap_chan_unlock(chan);
4480 mutex_lock(&conn->chan_lock);
4481 l2cap_chan_lock(chan);
4482 l2cap_chan_del(chan, 0);
4483 mutex_unlock(&conn->chan_lock);
4485 chan->ops->close(chan);
4487 l2cap_chan_unlock(chan);
4488 l2cap_chan_put(chan);
4493 static inline int l2cap_information_req(struct l2cap_conn *conn,
4494 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4497 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4500 if (cmd_len != sizeof(*req))
4503 type = __le16_to_cpu(req->type);
4505 BT_DBG("type 0x%4.4x", type);
4507 if (type == L2CAP_IT_FEAT_MASK) {
4509 u32 feat_mask = l2cap_feat_mask;
4510 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4511 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
4512 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4514 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4517 put_unaligned_le32(feat_mask, rsp->data);
4518 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4520 } else if (type == L2CAP_IT_FIXED_CHAN) {
4522 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4524 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4525 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
4526 rsp->data[0] = conn->local_fixed_chan;
4527 memset(rsp->data + 1, 0, 7);
4528 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4531 struct l2cap_info_rsp rsp;
4532 rsp.type = cpu_to_le16(type);
4533 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
4534 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4541 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4542 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4545 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4548 if (cmd_len < sizeof(*rsp))
4551 type = __le16_to_cpu(rsp->type);
4552 result = __le16_to_cpu(rsp->result);
4554 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4556 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4557 if (cmd->ident != conn->info_ident ||
4558 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4561 cancel_delayed_work(&conn->info_timer);
4563 if (result != L2CAP_IR_SUCCESS) {
4564 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4565 conn->info_ident = 0;
4567 l2cap_conn_start(conn);
4573 case L2CAP_IT_FEAT_MASK:
4574 conn->feat_mask = get_unaligned_le32(rsp->data);
4576 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4577 struct l2cap_info_req req;
4578 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4580 conn->info_ident = l2cap_get_ident(conn);
4582 l2cap_send_cmd(conn, conn->info_ident,
4583 L2CAP_INFO_REQ, sizeof(req), &req);
4585 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4586 conn->info_ident = 0;
4588 l2cap_conn_start(conn);
4592 case L2CAP_IT_FIXED_CHAN:
4593 conn->remote_fixed_chan = rsp->data[0];
4594 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4595 conn->info_ident = 0;
4597 l2cap_conn_start(conn);
4604 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4605 struct l2cap_cmd_hdr *cmd,
4606 u16 cmd_len, u8 *data)
4608 struct hci_conn *hcon = conn->hcon;
4609 struct l2cap_conn_param_update_req *req;
4610 struct l2cap_conn_param_update_rsp rsp;
4611 u16 min, max, latency, to_multiplier;
4614 if (hcon->role != HCI_ROLE_MASTER)
4617 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4620 req = (struct l2cap_conn_param_update_req *) data;
4621 min = __le16_to_cpu(req->min);
4622 max = __le16_to_cpu(req->max);
4623 latency = __le16_to_cpu(req->latency);
4624 to_multiplier = __le16_to_cpu(req->to_multiplier);
4626 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4627 min, max, latency, to_multiplier);
4629 memset(&rsp, 0, sizeof(rsp));
4631 if (max > hcon->le_conn_max_interval) {
4632 BT_DBG("requested connection interval exceeds current bounds.");
4635 err = hci_check_conn_params(min, max, latency, to_multiplier);
4639 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4641 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4643 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4649 store_hint = hci_le_conn_update(hcon, min, max, latency,
4651 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type,
4652 store_hint, min, max, latency,
4660 static int l2cap_le_connect_rsp(struct l2cap_conn *conn,
4661 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4664 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data;
4665 struct hci_conn *hcon = conn->hcon;
4666 u16 dcid, mtu, mps, credits, result;
4667 struct l2cap_chan *chan;
4670 if (cmd_len < sizeof(*rsp))
4673 dcid = __le16_to_cpu(rsp->dcid);
4674 mtu = __le16_to_cpu(rsp->mtu);
4675 mps = __le16_to_cpu(rsp->mps);
4676 credits = __le16_to_cpu(rsp->credits);
4677 result = __le16_to_cpu(rsp->result);
4679 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 ||
4680 dcid < L2CAP_CID_DYN_START ||
4681 dcid > L2CAP_CID_LE_DYN_END))
4684 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x",
4685 dcid, mtu, mps, credits, result);
4687 mutex_lock(&conn->chan_lock);
4689 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
4697 l2cap_chan_lock(chan);
4700 case L2CAP_CR_LE_SUCCESS:
4701 if (__l2cap_get_chan_by_dcid(conn, dcid)) {
4709 chan->remote_mps = mps;
4710 chan->tx_credits = credits;
4711 l2cap_chan_ready(chan);
4714 case L2CAP_CR_LE_AUTHENTICATION:
4715 case L2CAP_CR_LE_ENCRYPTION:
4716 /* If we already have MITM protection we can't do
4719 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
4720 l2cap_chan_del(chan, ECONNREFUSED);
4724 sec_level = hcon->sec_level + 1;
4725 if (chan->sec_level < sec_level)
4726 chan->sec_level = sec_level;
4728 /* We'll need to send a new Connect Request */
4729 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags);
4731 smp_conn_security(hcon, chan->sec_level);
4735 l2cap_chan_del(chan, ECONNREFUSED);
4739 l2cap_chan_unlock(chan);
4742 mutex_unlock(&conn->chan_lock);
4747 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4748 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4753 switch (cmd->code) {
4754 case L2CAP_COMMAND_REJ:
4755 l2cap_command_rej(conn, cmd, cmd_len, data);
4758 case L2CAP_CONN_REQ:
4759 err = l2cap_connect_req(conn, cmd, cmd_len, data);
4762 case L2CAP_CONN_RSP:
4763 l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
4766 case L2CAP_CONF_REQ:
4767 err = l2cap_config_req(conn, cmd, cmd_len, data);
4770 case L2CAP_CONF_RSP:
4771 l2cap_config_rsp(conn, cmd, cmd_len, data);
4774 case L2CAP_DISCONN_REQ:
4775 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
4778 case L2CAP_DISCONN_RSP:
4779 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
4782 case L2CAP_ECHO_REQ:
4783 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4786 case L2CAP_ECHO_RSP:
4789 case L2CAP_INFO_REQ:
4790 err = l2cap_information_req(conn, cmd, cmd_len, data);
4793 case L2CAP_INFO_RSP:
4794 l2cap_information_rsp(conn, cmd, cmd_len, data);
4798 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4806 static int l2cap_le_connect_req(struct l2cap_conn *conn,
4807 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4810 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data;
4811 struct l2cap_le_conn_rsp rsp;
4812 struct l2cap_chan *chan, *pchan;
4813 u16 dcid, scid, credits, mtu, mps;
4817 if (cmd_len != sizeof(*req))
4820 scid = __le16_to_cpu(req->scid);
4821 mtu = __le16_to_cpu(req->mtu);
4822 mps = __le16_to_cpu(req->mps);
4827 if (mtu < 23 || mps < 23)
4830 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
4833 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
4836 * Valid range: 0x0001-0x00ff
4838 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
4840 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
4841 result = L2CAP_CR_LE_BAD_PSM;
4846 /* Check if we have socket listening on psm */
4847 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
4848 &conn->hcon->dst, LE_LINK);
4850 result = L2CAP_CR_LE_BAD_PSM;
4855 mutex_lock(&conn->chan_lock);
4856 l2cap_chan_lock(pchan);
4858 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
4860 result = L2CAP_CR_LE_AUTHENTICATION;
4862 goto response_unlock;
4865 /* Check for valid dynamic CID range */
4866 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
4867 result = L2CAP_CR_LE_INVALID_SCID;
4869 goto response_unlock;
4872 /* Check if we already have channel with that dcid */
4873 if (__l2cap_get_chan_by_dcid(conn, scid)) {
4874 result = L2CAP_CR_LE_SCID_IN_USE;
4876 goto response_unlock;
4879 chan = pchan->ops->new_connection(pchan);
4881 result = L2CAP_CR_LE_NO_MEM;
4882 goto response_unlock;
4885 bacpy(&chan->src, &conn->hcon->src);
4886 bacpy(&chan->dst, &conn->hcon->dst);
4887 chan->src_type = bdaddr_src_type(conn->hcon);
4888 chan->dst_type = bdaddr_dst_type(conn->hcon);
4892 chan->remote_mps = mps;
4894 __l2cap_chan_add(conn, chan);
4896 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits));
4899 credits = chan->rx_credits;
4901 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
4903 chan->ident = cmd->ident;
4905 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
4906 l2cap_state_change(chan, BT_CONNECT2);
4907 /* The following result value is actually not defined
4908 * for LE CoC but we use it to let the function know
4909 * that it should bail out after doing its cleanup
4910 * instead of sending a response.
4912 result = L2CAP_CR_PEND;
4913 chan->ops->defer(chan);
4915 l2cap_chan_ready(chan);
4916 result = L2CAP_CR_LE_SUCCESS;
4920 l2cap_chan_unlock(pchan);
4921 mutex_unlock(&conn->chan_lock);
4922 l2cap_chan_put(pchan);
4924 if (result == L2CAP_CR_PEND)
4929 rsp.mtu = cpu_to_le16(chan->imtu);
4930 rsp.mps = cpu_to_le16(chan->mps);
4936 rsp.dcid = cpu_to_le16(dcid);
4937 rsp.credits = cpu_to_le16(credits);
4938 rsp.result = cpu_to_le16(result);
4940 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp);
4945 static inline int l2cap_le_credits(struct l2cap_conn *conn,
4946 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4949 struct l2cap_le_credits *pkt;
4950 struct l2cap_chan *chan;
4951 u16 cid, credits, max_credits;
4953 if (cmd_len != sizeof(*pkt))
4956 pkt = (struct l2cap_le_credits *) data;
4957 cid = __le16_to_cpu(pkt->cid);
4958 credits = __le16_to_cpu(pkt->credits);
4960 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits);
4962 chan = l2cap_get_chan_by_dcid(conn, cid);
4966 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits;
4967 if (credits > max_credits) {
4968 BT_ERR("LE credits overflow");
4969 l2cap_send_disconn_req(chan, ECONNRESET);
4971 /* Return 0 so that we don't trigger an unnecessary
4972 * command reject packet.
4977 chan->tx_credits += credits;
4979 /* Resume sending */
4980 l2cap_le_flowctl_send(chan);
4982 if (chan->tx_credits)
4983 chan->ops->resume(chan);
4986 l2cap_chan_unlock(chan);
4987 l2cap_chan_put(chan);
4992 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn,
4993 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4996 struct l2cap_ecred_conn_req *req = (void *) data;
4998 struct l2cap_ecred_conn_rsp rsp;
4999 __le16 dcid[L2CAP_ECRED_MAX_CID];
5001 struct l2cap_chan *chan, *pchan;
5011 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) {
5012 result = L2CAP_CR_LE_INVALID_PARAMS;
5016 cmd_len -= sizeof(*req);
5017 num_scid = cmd_len / sizeof(u16);
5019 if (num_scid > ARRAY_SIZE(pdu.dcid)) {
5020 result = L2CAP_CR_LE_INVALID_PARAMS;
5024 mtu = __le16_to_cpu(req->mtu);
5025 mps = __le16_to_cpu(req->mps);
5027 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) {
5028 result = L2CAP_CR_LE_UNACCEPT_PARAMS;
5034 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
5037 * Valid range: 0x0001-0x00ff
5039 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
5041 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
5042 result = L2CAP_CR_LE_BAD_PSM;
5046 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps);
5048 memset(&pdu, 0, sizeof(pdu));
5050 /* Check if we have socket listening on psm */
5051 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
5052 &conn->hcon->dst, LE_LINK);
5054 result = L2CAP_CR_LE_BAD_PSM;
5058 mutex_lock(&conn->chan_lock);
5059 l2cap_chan_lock(pchan);
5061 if (!smp_sufficient_security(conn->hcon, pchan->sec_level,
5063 result = L2CAP_CR_LE_AUTHENTICATION;
5067 result = L2CAP_CR_LE_SUCCESS;
5069 for (i = 0; i < num_scid; i++) {
5070 u16 scid = __le16_to_cpu(req->scid[i]);
5072 BT_DBG("scid[%d] 0x%4.4x", i, scid);
5074 pdu.dcid[i] = 0x0000;
5075 len += sizeof(*pdu.dcid);
5077 /* Check for valid dynamic CID range */
5078 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) {
5079 result = L2CAP_CR_LE_INVALID_SCID;
5083 /* Check if we already have channel with that dcid */
5084 if (__l2cap_get_chan_by_dcid(conn, scid)) {
5085 result = L2CAP_CR_LE_SCID_IN_USE;
5089 chan = pchan->ops->new_connection(pchan);
5091 result = L2CAP_CR_LE_NO_MEM;
5095 bacpy(&chan->src, &conn->hcon->src);
5096 bacpy(&chan->dst, &conn->hcon->dst);
5097 chan->src_type = bdaddr_src_type(conn->hcon);
5098 chan->dst_type = bdaddr_dst_type(conn->hcon);
5102 chan->remote_mps = mps;
5104 __l2cap_chan_add(conn, chan);
5106 l2cap_ecred_init(chan, __le16_to_cpu(req->credits));
5109 if (!pdu.rsp.credits) {
5110 pdu.rsp.mtu = cpu_to_le16(chan->imtu);
5111 pdu.rsp.mps = cpu_to_le16(chan->mps);
5112 pdu.rsp.credits = cpu_to_le16(chan->rx_credits);
5115 pdu.dcid[i] = cpu_to_le16(chan->scid);
5117 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
5119 chan->ident = cmd->ident;
5120 chan->mode = L2CAP_MODE_EXT_FLOWCTL;
5122 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
5123 l2cap_state_change(chan, BT_CONNECT2);
5125 chan->ops->defer(chan);
5127 l2cap_chan_ready(chan);
5132 l2cap_chan_unlock(pchan);
5133 mutex_unlock(&conn->chan_lock);
5134 l2cap_chan_put(pchan);
5137 pdu.rsp.result = cpu_to_le16(result);
5142 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP,
5143 sizeof(pdu.rsp) + len, &pdu);
5148 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn,
5149 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5152 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5153 struct hci_conn *hcon = conn->hcon;
5154 u16 mtu, mps, credits, result;
5155 struct l2cap_chan *chan, *tmp;
5156 int err = 0, sec_level;
5159 if (cmd_len < sizeof(*rsp))
5162 mtu = __le16_to_cpu(rsp->mtu);
5163 mps = __le16_to_cpu(rsp->mps);
5164 credits = __le16_to_cpu(rsp->credits);
5165 result = __le16_to_cpu(rsp->result);
5167 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits,
5170 mutex_lock(&conn->chan_lock);
5172 cmd_len -= sizeof(*rsp);
5174 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5177 if (chan->ident != cmd->ident ||
5178 chan->mode != L2CAP_MODE_EXT_FLOWCTL ||
5179 chan->state == BT_CONNECTED)
5182 l2cap_chan_lock(chan);
5184 /* Check that there is a dcid for each pending channel */
5185 if (cmd_len < sizeof(dcid)) {
5186 l2cap_chan_del(chan, ECONNREFUSED);
5187 l2cap_chan_unlock(chan);
5191 dcid = __le16_to_cpu(rsp->dcid[i++]);
5192 cmd_len -= sizeof(u16);
5194 BT_DBG("dcid[%d] 0x%4.4x", i, dcid);
5196 /* Check if dcid is already in use */
5197 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) {
5198 /* If a device receives a
5199 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an
5200 * already-assigned Destination CID, then both the
5201 * original channel and the new channel shall be
5202 * immediately discarded and not used.
5204 l2cap_chan_del(chan, ECONNREFUSED);
5205 l2cap_chan_unlock(chan);
5206 chan = __l2cap_get_chan_by_dcid(conn, dcid);
5207 l2cap_chan_lock(chan);
5208 l2cap_chan_del(chan, ECONNRESET);
5209 l2cap_chan_unlock(chan);
5214 case L2CAP_CR_LE_AUTHENTICATION:
5215 case L2CAP_CR_LE_ENCRYPTION:
5216 /* If we already have MITM protection we can't do
5219 if (hcon->sec_level > BT_SECURITY_MEDIUM) {
5220 l2cap_chan_del(chan, ECONNREFUSED);
5224 sec_level = hcon->sec_level + 1;
5225 if (chan->sec_level < sec_level)
5226 chan->sec_level = sec_level;
5228 /* We'll need to send a new Connect Request */
5229 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags);
5231 smp_conn_security(hcon, chan->sec_level);
5234 case L2CAP_CR_LE_BAD_PSM:
5235 l2cap_chan_del(chan, ECONNREFUSED);
5239 /* If dcid was not set it means channels was refused */
5241 l2cap_chan_del(chan, ECONNREFUSED);
5248 chan->remote_mps = mps;
5249 chan->tx_credits = credits;
5250 l2cap_chan_ready(chan);
5254 l2cap_chan_unlock(chan);
5257 mutex_unlock(&conn->chan_lock);
5262 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn,
5263 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5266 struct l2cap_ecred_reconf_req *req = (void *) data;
5267 struct l2cap_ecred_reconf_rsp rsp;
5268 u16 mtu, mps, result;
5269 struct l2cap_chan *chan;
5275 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) {
5276 result = L2CAP_CR_LE_INVALID_PARAMS;
5280 mtu = __le16_to_cpu(req->mtu);
5281 mps = __le16_to_cpu(req->mps);
5283 BT_DBG("mtu %u mps %u", mtu, mps);
5285 if (mtu < L2CAP_ECRED_MIN_MTU) {
5286 result = L2CAP_RECONF_INVALID_MTU;
5290 if (mps < L2CAP_ECRED_MIN_MPS) {
5291 result = L2CAP_RECONF_INVALID_MPS;
5295 cmd_len -= sizeof(*req);
5296 num_scid = cmd_len / sizeof(u16);
5297 result = L2CAP_RECONF_SUCCESS;
5299 for (i = 0; i < num_scid; i++) {
5302 scid = __le16_to_cpu(req->scid[i]);
5306 chan = __l2cap_get_chan_by_dcid(conn, scid);
5310 /* If the MTU value is decreased for any of the included
5311 * channels, then the receiver shall disconnect all
5312 * included channels.
5314 if (chan->omtu > mtu) {
5315 BT_ERR("chan %p decreased MTU %u -> %u", chan,
5317 result = L2CAP_RECONF_INVALID_MTU;
5321 chan->remote_mps = mps;
5325 rsp.result = cpu_to_le16(result);
5327 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp),
5333 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn,
5334 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5337 struct l2cap_chan *chan, *tmp;
5338 struct l2cap_ecred_conn_rsp *rsp = (void *) data;
5341 if (cmd_len < sizeof(*rsp))
5344 result = __le16_to_cpu(rsp->result);
5346 BT_DBG("result 0x%4.4x", rsp->result);
5351 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
5352 if (chan->ident != cmd->ident)
5355 l2cap_chan_del(chan, ECONNRESET);
5361 static inline int l2cap_le_command_rej(struct l2cap_conn *conn,
5362 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5365 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
5366 struct l2cap_chan *chan;
5368 if (cmd_len < sizeof(*rej))
5371 mutex_lock(&conn->chan_lock);
5373 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
5377 chan = l2cap_chan_hold_unless_zero(chan);
5381 l2cap_chan_lock(chan);
5382 l2cap_chan_del(chan, ECONNREFUSED);
5383 l2cap_chan_unlock(chan);
5384 l2cap_chan_put(chan);
5387 mutex_unlock(&conn->chan_lock);
5391 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5392 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5397 switch (cmd->code) {
5398 case L2CAP_COMMAND_REJ:
5399 l2cap_le_command_rej(conn, cmd, cmd_len, data);
5402 case L2CAP_CONN_PARAM_UPDATE_REQ:
5403 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data);
5406 case L2CAP_CONN_PARAM_UPDATE_RSP:
5409 case L2CAP_LE_CONN_RSP:
5410 l2cap_le_connect_rsp(conn, cmd, cmd_len, data);
5413 case L2CAP_LE_CONN_REQ:
5414 err = l2cap_le_connect_req(conn, cmd, cmd_len, data);
5417 case L2CAP_LE_CREDITS:
5418 err = l2cap_le_credits(conn, cmd, cmd_len, data);
5421 case L2CAP_ECRED_CONN_REQ:
5422 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data);
5425 case L2CAP_ECRED_CONN_RSP:
5426 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data);
5429 case L2CAP_ECRED_RECONF_REQ:
5430 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data);
5433 case L2CAP_ECRED_RECONF_RSP:
5434 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data);
5437 case L2CAP_DISCONN_REQ:
5438 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5441 case L2CAP_DISCONN_RSP:
5442 l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5446 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5454 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5455 struct sk_buff *skb)
5457 struct hci_conn *hcon = conn->hcon;
5458 struct l2cap_cmd_hdr *cmd;
5462 if (hcon->type != LE_LINK)
5465 if (skb->len < L2CAP_CMD_HDR_SIZE)
5468 cmd = (void *) skb->data;
5469 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5471 len = le16_to_cpu(cmd->len);
5473 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident);
5475 if (len != skb->len || !cmd->ident) {
5476 BT_DBG("corrupted command");
5480 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data);
5482 struct l2cap_cmd_rej_unk rej;
5484 BT_ERR("Wrong link type (%d)", err);
5486 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5487 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
5495 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
5497 struct l2cap_cmd_rej_unk rej;
5499 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5500 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
5503 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5504 struct sk_buff *skb)
5506 struct hci_conn *hcon = conn->hcon;
5507 struct l2cap_cmd_hdr *cmd;
5510 l2cap_raw_recv(conn, skb);
5512 if (hcon->type != ACL_LINK)
5515 while (skb->len >= L2CAP_CMD_HDR_SIZE) {
5518 cmd = (void *) skb->data;
5519 skb_pull(skb, L2CAP_CMD_HDR_SIZE);
5521 len = le16_to_cpu(cmd->len);
5523 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len,
5526 if (len > skb->len || !cmd->ident) {
5527 BT_DBG("corrupted command");
5528 l2cap_sig_send_rej(conn, cmd->ident);
5529 skb_pull(skb, len > skb->len ? skb->len : len);
5533 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
5535 BT_ERR("Wrong link type (%d)", err);
5536 l2cap_sig_send_rej(conn, cmd->ident);
5543 BT_DBG("corrupted command");
5544 l2cap_sig_send_rej(conn, 0);
5551 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
5553 u16 our_fcs, rcv_fcs;
5556 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5557 hdr_size = L2CAP_EXT_HDR_SIZE;
5559 hdr_size = L2CAP_ENH_HDR_SIZE;
5561 if (chan->fcs == L2CAP_FCS_CRC16) {
5562 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5563 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5564 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5566 if (our_fcs != rcv_fcs)
5572 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5574 struct l2cap_ctrl control;
5576 BT_DBG("chan %p", chan);
5578 memset(&control, 0, sizeof(control));
5581 control.reqseq = chan->buffer_seq;
5582 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5584 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5585 control.super = L2CAP_SUPER_RNR;
5586 l2cap_send_sframe(chan, &control);
5589 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5590 chan->unacked_frames > 0)
5591 __set_retrans_timer(chan);
5593 /* Send pending iframes */
5594 l2cap_ertm_send(chan);
5596 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5597 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5598 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5601 control.super = L2CAP_SUPER_RR;
5602 l2cap_send_sframe(chan, &control);
5606 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5607 struct sk_buff **last_frag)
5609 /* skb->len reflects data in skb as well as all fragments
5610 * skb->data_len reflects only data in fragments
5612 if (!skb_has_frag_list(skb))
5613 skb_shinfo(skb)->frag_list = new_frag;
5615 new_frag->next = NULL;
5617 (*last_frag)->next = new_frag;
5618 *last_frag = new_frag;
5620 skb->len += new_frag->len;
5621 skb->data_len += new_frag->len;
5622 skb->truesize += new_frag->truesize;
5625 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5626 struct l2cap_ctrl *control)
5630 switch (control->sar) {
5631 case L2CAP_SAR_UNSEGMENTED:
5635 err = chan->ops->recv(chan, skb);
5638 case L2CAP_SAR_START:
5642 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE))
5645 chan->sdu_len = get_unaligned_le16(skb->data);
5646 skb_pull(skb, L2CAP_SDULEN_SIZE);
5648 if (chan->sdu_len > chan->imtu) {
5653 if (skb->len >= chan->sdu_len)
5657 chan->sdu_last_frag = skb;
5663 case L2CAP_SAR_CONTINUE:
5667 append_skb_frag(chan->sdu, skb,
5668 &chan->sdu_last_frag);
5671 if (chan->sdu->len >= chan->sdu_len)
5681 append_skb_frag(chan->sdu, skb,
5682 &chan->sdu_last_frag);
5685 if (chan->sdu->len != chan->sdu_len)
5688 err = chan->ops->recv(chan, chan->sdu);
5691 /* Reassembly complete */
5693 chan->sdu_last_frag = NULL;
5701 kfree_skb(chan->sdu);
5703 chan->sdu_last_frag = NULL;
5710 static int l2cap_resegment(struct l2cap_chan *chan)
5716 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5720 if (chan->mode != L2CAP_MODE_ERTM)
5723 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5724 l2cap_tx(chan, NULL, NULL, event);
5727 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5730 /* Pass sequential frames to l2cap_reassemble_sdu()
5731 * until a gap is encountered.
5734 BT_DBG("chan %p", chan);
5736 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5737 struct sk_buff *skb;
5738 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5739 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5741 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5746 skb_unlink(skb, &chan->srej_q);
5747 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5748 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap);
5753 if (skb_queue_empty(&chan->srej_q)) {
5754 chan->rx_state = L2CAP_RX_STATE_RECV;
5755 l2cap_send_ack(chan);
5761 static void l2cap_handle_srej(struct l2cap_chan *chan,
5762 struct l2cap_ctrl *control)
5764 struct sk_buff *skb;
5766 BT_DBG("chan %p, control %p", chan, control);
5768 if (control->reqseq == chan->next_tx_seq) {
5769 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5770 l2cap_send_disconn_req(chan, ECONNRESET);
5774 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5777 BT_DBG("Seq %d not available for retransmission",
5782 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5783 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5784 l2cap_send_disconn_req(chan, ECONNRESET);
5788 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5790 if (control->poll) {
5791 l2cap_pass_to_tx(chan, control);
5793 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5794 l2cap_retransmit(chan, control);
5795 l2cap_ertm_send(chan);
5797 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5798 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5799 chan->srej_save_reqseq = control->reqseq;
5802 l2cap_pass_to_tx_fbit(chan, control);
5804 if (control->final) {
5805 if (chan->srej_save_reqseq != control->reqseq ||
5806 !test_and_clear_bit(CONN_SREJ_ACT,
5808 l2cap_retransmit(chan, control);
5810 l2cap_retransmit(chan, control);
5811 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5812 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5813 chan->srej_save_reqseq = control->reqseq;
5819 static void l2cap_handle_rej(struct l2cap_chan *chan,
5820 struct l2cap_ctrl *control)
5822 struct sk_buff *skb;
5824 BT_DBG("chan %p, control %p", chan, control);
5826 if (control->reqseq == chan->next_tx_seq) {
5827 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5828 l2cap_send_disconn_req(chan, ECONNRESET);
5832 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5834 if (chan->max_tx && skb &&
5835 bt_cb(skb)->l2cap.retries >= chan->max_tx) {
5836 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5837 l2cap_send_disconn_req(chan, ECONNRESET);
5841 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5843 l2cap_pass_to_tx(chan, control);
5845 if (control->final) {
5846 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5847 l2cap_retransmit_all(chan, control);
5849 l2cap_retransmit_all(chan, control);
5850 l2cap_ertm_send(chan);
5851 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5852 set_bit(CONN_REJ_ACT, &chan->conn_state);
5856 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5858 BT_DBG("chan %p, txseq %d", chan, txseq);
5860 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5861 chan->expected_tx_seq);
5863 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5864 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5866 /* See notes below regarding "double poll" and
5869 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5870 BT_DBG("Invalid/Ignore - after SREJ");
5871 return L2CAP_TXSEQ_INVALID_IGNORE;
5873 BT_DBG("Invalid - in window after SREJ sent");
5874 return L2CAP_TXSEQ_INVALID;
5878 if (chan->srej_list.head == txseq) {
5879 BT_DBG("Expected SREJ");
5880 return L2CAP_TXSEQ_EXPECTED_SREJ;
5883 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5884 BT_DBG("Duplicate SREJ - txseq already stored");
5885 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5888 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5889 BT_DBG("Unexpected SREJ - not requested");
5890 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5894 if (chan->expected_tx_seq == txseq) {
5895 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5897 BT_DBG("Invalid - txseq outside tx window");
5898 return L2CAP_TXSEQ_INVALID;
5901 return L2CAP_TXSEQ_EXPECTED;
5905 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5906 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5907 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5908 return L2CAP_TXSEQ_DUPLICATE;
5911 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5912 /* A source of invalid packets is a "double poll" condition,
5913 * where delays cause us to send multiple poll packets. If
5914 * the remote stack receives and processes both polls,
5915 * sequence numbers can wrap around in such a way that a
5916 * resent frame has a sequence number that looks like new data
5917 * with a sequence gap. This would trigger an erroneous SREJ
5920 * Fortunately, this is impossible with a tx window that's
5921 * less than half of the maximum sequence number, which allows
5922 * invalid frames to be safely ignored.
5924 * With tx window sizes greater than half of the tx window
5925 * maximum, the frame is invalid and cannot be ignored. This
5926 * causes a disconnect.
5929 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5930 BT_DBG("Invalid/Ignore - txseq outside tx window");
5931 return L2CAP_TXSEQ_INVALID_IGNORE;
5933 BT_DBG("Invalid - txseq outside tx window");
5934 return L2CAP_TXSEQ_INVALID;
5937 BT_DBG("Unexpected - txseq indicates missing frames");
5938 return L2CAP_TXSEQ_UNEXPECTED;
5942 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5943 struct l2cap_ctrl *control,
5944 struct sk_buff *skb, u8 event)
5946 struct l2cap_ctrl local_control;
5948 bool skb_in_use = false;
5950 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5954 case L2CAP_EV_RECV_IFRAME:
5955 switch (l2cap_classify_txseq(chan, control->txseq)) {
5956 case L2CAP_TXSEQ_EXPECTED:
5957 l2cap_pass_to_tx(chan, control);
5959 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5960 BT_DBG("Busy, discarding expected seq %d",
5965 chan->expected_tx_seq = __next_seq(chan,
5968 chan->buffer_seq = chan->expected_tx_seq;
5971 /* l2cap_reassemble_sdu may free skb, hence invalidate
5972 * control, so make a copy in advance to use it after
5973 * l2cap_reassemble_sdu returns and to avoid the race
5974 * condition, for example:
5976 * The current thread calls:
5977 * l2cap_reassemble_sdu
5978 * chan->ops->recv == l2cap_sock_recv_cb
5979 * __sock_queue_rcv_skb
5980 * Another thread calls:
5984 * Then the current thread tries to access control, but
5985 * it was freed by skb_free_datagram.
5987 local_control = *control;
5988 err = l2cap_reassemble_sdu(chan, skb, control);
5992 if (local_control.final) {
5993 if (!test_and_clear_bit(CONN_REJ_ACT,
5994 &chan->conn_state)) {
5995 local_control.final = 0;
5996 l2cap_retransmit_all(chan, &local_control);
5997 l2cap_ertm_send(chan);
6001 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
6002 l2cap_send_ack(chan);
6004 case L2CAP_TXSEQ_UNEXPECTED:
6005 l2cap_pass_to_tx(chan, control);
6007 /* Can't issue SREJ frames in the local busy state.
6008 * Drop this frame, it will be seen as missing
6009 * when local busy is exited.
6011 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
6012 BT_DBG("Busy, discarding unexpected seq %d",
6017 /* There was a gap in the sequence, so an SREJ
6018 * must be sent for each missing frame. The
6019 * current frame is stored for later use.
6021 skb_queue_tail(&chan->srej_q, skb);
6023 BT_DBG("Queued %p (queue len %d)", skb,
6024 skb_queue_len(&chan->srej_q));
6026 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
6027 l2cap_seq_list_clear(&chan->srej_list);
6028 l2cap_send_srej(chan, control->txseq);
6030 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
6032 case L2CAP_TXSEQ_DUPLICATE:
6033 l2cap_pass_to_tx(chan, control);
6035 case L2CAP_TXSEQ_INVALID_IGNORE:
6037 case L2CAP_TXSEQ_INVALID:
6039 l2cap_send_disconn_req(chan, ECONNRESET);
6043 case L2CAP_EV_RECV_RR:
6044 l2cap_pass_to_tx(chan, control);
6045 if (control->final) {
6046 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6048 if (!test_and_clear_bit(CONN_REJ_ACT,
6049 &chan->conn_state)) {
6051 l2cap_retransmit_all(chan, control);
6054 l2cap_ertm_send(chan);
6055 } else if (control->poll) {
6056 l2cap_send_i_or_rr_or_rnr(chan);
6058 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6059 &chan->conn_state) &&
6060 chan->unacked_frames)
6061 __set_retrans_timer(chan);
6063 l2cap_ertm_send(chan);
6066 case L2CAP_EV_RECV_RNR:
6067 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6068 l2cap_pass_to_tx(chan, control);
6069 if (control && control->poll) {
6070 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6071 l2cap_send_rr_or_rnr(chan, 0);
6073 __clear_retrans_timer(chan);
6074 l2cap_seq_list_clear(&chan->retrans_list);
6076 case L2CAP_EV_RECV_REJ:
6077 l2cap_handle_rej(chan, control);
6079 case L2CAP_EV_RECV_SREJ:
6080 l2cap_handle_srej(chan, control);
6086 if (skb && !skb_in_use) {
6087 BT_DBG("Freeing %p", skb);
6094 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
6095 struct l2cap_ctrl *control,
6096 struct sk_buff *skb, u8 event)
6099 u16 txseq = control->txseq;
6100 bool skb_in_use = false;
6102 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6106 case L2CAP_EV_RECV_IFRAME:
6107 switch (l2cap_classify_txseq(chan, txseq)) {
6108 case L2CAP_TXSEQ_EXPECTED:
6109 /* Keep frame for reassembly later */
6110 l2cap_pass_to_tx(chan, control);
6111 skb_queue_tail(&chan->srej_q, skb);
6113 BT_DBG("Queued %p (queue len %d)", skb,
6114 skb_queue_len(&chan->srej_q));
6116 chan->expected_tx_seq = __next_seq(chan, txseq);
6118 case L2CAP_TXSEQ_EXPECTED_SREJ:
6119 l2cap_seq_list_pop(&chan->srej_list);
6121 l2cap_pass_to_tx(chan, control);
6122 skb_queue_tail(&chan->srej_q, skb);
6124 BT_DBG("Queued %p (queue len %d)", skb,
6125 skb_queue_len(&chan->srej_q));
6127 err = l2cap_rx_queued_iframes(chan);
6132 case L2CAP_TXSEQ_UNEXPECTED:
6133 /* Got a frame that can't be reassembled yet.
6134 * Save it for later, and send SREJs to cover
6135 * the missing frames.
6137 skb_queue_tail(&chan->srej_q, skb);
6139 BT_DBG("Queued %p (queue len %d)", skb,
6140 skb_queue_len(&chan->srej_q));
6142 l2cap_pass_to_tx(chan, control);
6143 l2cap_send_srej(chan, control->txseq);
6145 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
6146 /* This frame was requested with an SREJ, but
6147 * some expected retransmitted frames are
6148 * missing. Request retransmission of missing
6151 skb_queue_tail(&chan->srej_q, skb);
6153 BT_DBG("Queued %p (queue len %d)", skb,
6154 skb_queue_len(&chan->srej_q));
6156 l2cap_pass_to_tx(chan, control);
6157 l2cap_send_srej_list(chan, control->txseq);
6159 case L2CAP_TXSEQ_DUPLICATE_SREJ:
6160 /* We've already queued this frame. Drop this copy. */
6161 l2cap_pass_to_tx(chan, control);
6163 case L2CAP_TXSEQ_DUPLICATE:
6164 /* Expecting a later sequence number, so this frame
6165 * was already received. Ignore it completely.
6168 case L2CAP_TXSEQ_INVALID_IGNORE:
6170 case L2CAP_TXSEQ_INVALID:
6172 l2cap_send_disconn_req(chan, ECONNRESET);
6176 case L2CAP_EV_RECV_RR:
6177 l2cap_pass_to_tx(chan, control);
6178 if (control->final) {
6179 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6181 if (!test_and_clear_bit(CONN_REJ_ACT,
6182 &chan->conn_state)) {
6184 l2cap_retransmit_all(chan, control);
6187 l2cap_ertm_send(chan);
6188 } else if (control->poll) {
6189 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6190 &chan->conn_state) &&
6191 chan->unacked_frames) {
6192 __set_retrans_timer(chan);
6195 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6196 l2cap_send_srej_tail(chan);
6198 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6199 &chan->conn_state) &&
6200 chan->unacked_frames)
6201 __set_retrans_timer(chan);
6203 l2cap_send_ack(chan);
6206 case L2CAP_EV_RECV_RNR:
6207 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6208 l2cap_pass_to_tx(chan, control);
6209 if (control->poll) {
6210 l2cap_send_srej_tail(chan);
6212 struct l2cap_ctrl rr_control;
6213 memset(&rr_control, 0, sizeof(rr_control));
6214 rr_control.sframe = 1;
6215 rr_control.super = L2CAP_SUPER_RR;
6216 rr_control.reqseq = chan->buffer_seq;
6217 l2cap_send_sframe(chan, &rr_control);
6221 case L2CAP_EV_RECV_REJ:
6222 l2cap_handle_rej(chan, control);
6224 case L2CAP_EV_RECV_SREJ:
6225 l2cap_handle_srej(chan, control);
6229 if (skb && !skb_in_use) {
6230 BT_DBG("Freeing %p", skb);
6237 static int l2cap_finish_move(struct l2cap_chan *chan)
6239 BT_DBG("chan %p", chan);
6241 chan->rx_state = L2CAP_RX_STATE_RECV;
6242 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6244 return l2cap_resegment(chan);
6247 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6248 struct l2cap_ctrl *control,
6249 struct sk_buff *skb, u8 event)
6253 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6259 l2cap_process_reqseq(chan, control->reqseq);
6261 if (!skb_queue_empty(&chan->tx_q))
6262 chan->tx_send_head = skb_peek(&chan->tx_q);
6264 chan->tx_send_head = NULL;
6266 /* Rewind next_tx_seq to the point expected
6269 chan->next_tx_seq = control->reqseq;
6270 chan->unacked_frames = 0;
6272 err = l2cap_finish_move(chan);
6276 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6277 l2cap_send_i_or_rr_or_rnr(chan);
6279 if (event == L2CAP_EV_RECV_IFRAME)
6282 return l2cap_rx_state_recv(chan, control, NULL, event);
6285 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6286 struct l2cap_ctrl *control,
6287 struct sk_buff *skb, u8 event)
6291 if (!control->final)
6294 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6296 chan->rx_state = L2CAP_RX_STATE_RECV;
6297 l2cap_process_reqseq(chan, control->reqseq);
6299 if (!skb_queue_empty(&chan->tx_q))
6300 chan->tx_send_head = skb_peek(&chan->tx_q);
6302 chan->tx_send_head = NULL;
6304 /* Rewind next_tx_seq to the point expected
6307 chan->next_tx_seq = control->reqseq;
6308 chan->unacked_frames = 0;
6309 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6311 err = l2cap_resegment(chan);
6314 err = l2cap_rx_state_recv(chan, control, skb, event);
6319 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6321 /* Make sure reqseq is for a packet that has been sent but not acked */
6324 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6325 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6328 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6329 struct sk_buff *skb, u8 event)
6333 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6334 control, skb, event, chan->rx_state);
6336 if (__valid_reqseq(chan, control->reqseq)) {
6337 switch (chan->rx_state) {
6338 case L2CAP_RX_STATE_RECV:
6339 err = l2cap_rx_state_recv(chan, control, skb, event);
6341 case L2CAP_RX_STATE_SREJ_SENT:
6342 err = l2cap_rx_state_srej_sent(chan, control, skb,
6345 case L2CAP_RX_STATE_WAIT_P:
6346 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6348 case L2CAP_RX_STATE_WAIT_F:
6349 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6356 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6357 control->reqseq, chan->next_tx_seq,
6358 chan->expected_ack_seq);
6359 l2cap_send_disconn_req(chan, ECONNRESET);
6365 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6366 struct sk_buff *skb)
6368 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store
6369 * the txseq field in advance to use it after l2cap_reassemble_sdu
6370 * returns and to avoid the race condition, for example:
6372 * The current thread calls:
6373 * l2cap_reassemble_sdu
6374 * chan->ops->recv == l2cap_sock_recv_cb
6375 * __sock_queue_rcv_skb
6376 * Another thread calls:
6380 * Then the current thread tries to access control, but it was freed by
6381 * skb_free_datagram.
6383 u16 txseq = control->txseq;
6385 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6388 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) {
6389 l2cap_pass_to_tx(chan, control);
6391 BT_DBG("buffer_seq %u->%u", chan->buffer_seq,
6392 __next_seq(chan, chan->buffer_seq));
6394 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6396 l2cap_reassemble_sdu(chan, skb, control);
6399 kfree_skb(chan->sdu);
6402 chan->sdu_last_frag = NULL;
6406 BT_DBG("Freeing %p", skb);
6411 chan->last_acked_seq = txseq;
6412 chan->expected_tx_seq = __next_seq(chan, txseq);
6417 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6419 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap;
6423 __unpack_control(chan, skb);
6428 * We can just drop the corrupted I-frame here.
6429 * Receiver will miss it and start proper recovery
6430 * procedures and ask for retransmission.
6432 if (l2cap_check_fcs(chan, skb))
6435 if (!control->sframe && control->sar == L2CAP_SAR_START)
6436 len -= L2CAP_SDULEN_SIZE;
6438 if (chan->fcs == L2CAP_FCS_CRC16)
6439 len -= L2CAP_FCS_SIZE;
6441 if (len > chan->mps) {
6442 l2cap_send_disconn_req(chan, ECONNRESET);
6446 if (chan->ops->filter) {
6447 if (chan->ops->filter(chan, skb))
6451 if (!control->sframe) {
6454 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6455 control->sar, control->reqseq, control->final,
6458 /* Validate F-bit - F=0 always valid, F=1 only
6459 * valid in TX WAIT_F
6461 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6464 if (chan->mode != L2CAP_MODE_STREAMING) {
6465 event = L2CAP_EV_RECV_IFRAME;
6466 err = l2cap_rx(chan, control, skb, event);
6468 err = l2cap_stream_rx(chan, control, skb);
6472 l2cap_send_disconn_req(chan, ECONNRESET);
6474 const u8 rx_func_to_event[4] = {
6475 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6476 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6479 /* Only I-frames are expected in streaming mode */
6480 if (chan->mode == L2CAP_MODE_STREAMING)
6483 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6484 control->reqseq, control->final, control->poll,
6488 BT_ERR("Trailing bytes: %d in sframe", len);
6489 l2cap_send_disconn_req(chan, ECONNRESET);
6493 /* Validate F and P bits */
6494 if (control->final && (control->poll ||
6495 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6498 event = rx_func_to_event[control->super];
6499 if (l2cap_rx(chan, control, skb, event))
6500 l2cap_send_disconn_req(chan, ECONNRESET);
6510 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan)
6512 struct l2cap_conn *conn = chan->conn;
6513 struct l2cap_le_credits pkt;
6516 return_credits = (chan->imtu / chan->mps) + 1;
6518 if (chan->rx_credits >= return_credits)
6521 return_credits -= chan->rx_credits;
6523 BT_DBG("chan %p returning %u credits to sender", chan, return_credits);
6525 chan->rx_credits += return_credits;
6527 pkt.cid = cpu_to_le16(chan->scid);
6528 pkt.credits = cpu_to_le16(return_credits);
6530 chan->ident = l2cap_get_ident(conn);
6532 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt);
6535 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb)
6539 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len);
6541 /* Wait recv to confirm reception before updating the credits */
6542 err = chan->ops->recv(chan, skb);
6544 /* Update credits whenever an SDU is received */
6545 l2cap_chan_le_send_credits(chan);
6550 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6554 if (!chan->rx_credits) {
6555 BT_ERR("No credits to receive LE L2CAP data");
6556 l2cap_send_disconn_req(chan, ECONNRESET);
6560 if (chan->imtu < skb->len) {
6561 BT_ERR("Too big LE L2CAP PDU");
6566 BT_DBG("rx_credits %u -> %u", chan->rx_credits + 1, chan->rx_credits);
6568 /* Update if remote had run out of credits, this should only happens
6569 * if the remote is not using the entire MPS.
6571 if (!chan->rx_credits)
6572 l2cap_chan_le_send_credits(chan);
6579 sdu_len = get_unaligned_le16(skb->data);
6580 skb_pull(skb, L2CAP_SDULEN_SIZE);
6582 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u",
6583 sdu_len, skb->len, chan->imtu);
6585 if (sdu_len > chan->imtu) {
6586 BT_ERR("Too big LE L2CAP SDU length received");
6591 if (skb->len > sdu_len) {
6592 BT_ERR("Too much LE L2CAP data received");
6597 if (skb->len == sdu_len)
6598 return l2cap_ecred_recv(chan, skb);
6601 chan->sdu_len = sdu_len;
6602 chan->sdu_last_frag = skb;
6604 /* Detect if remote is not able to use the selected MPS */
6605 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) {
6606 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE;
6608 /* Adjust the number of credits */
6609 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len);
6610 chan->mps = mps_len;
6611 l2cap_chan_le_send_credits(chan);
6617 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u",
6618 chan->sdu->len, skb->len, chan->sdu_len);
6620 if (chan->sdu->len + skb->len > chan->sdu_len) {
6621 BT_ERR("Too much LE L2CAP data received");
6626 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag);
6629 if (chan->sdu->len == chan->sdu_len) {
6630 err = l2cap_ecred_recv(chan, chan->sdu);
6633 chan->sdu_last_frag = NULL;
6641 kfree_skb(chan->sdu);
6643 chan->sdu_last_frag = NULL;
6647 /* We can't return an error here since we took care of the skb
6648 * freeing internally. An error return would cause the caller to
6649 * do a double-free of the skb.
6654 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6655 struct sk_buff *skb)
6657 struct l2cap_chan *chan;
6659 chan = l2cap_get_chan_by_scid(conn, cid);
6661 BT_DBG("unknown cid 0x%4.4x", cid);
6662 /* Drop packet and return */
6667 BT_DBG("chan %p, len %d", chan, skb->len);
6669 /* If we receive data on a fixed channel before the info req/rsp
6670 * procedure is done simply assume that the channel is supported
6671 * and mark it as ready.
6673 if (chan->chan_type == L2CAP_CHAN_FIXED)
6674 l2cap_chan_ready(chan);
6676 if (chan->state != BT_CONNECTED)
6679 switch (chan->mode) {
6680 case L2CAP_MODE_LE_FLOWCTL:
6681 case L2CAP_MODE_EXT_FLOWCTL:
6682 if (l2cap_ecred_data_rcv(chan, skb) < 0)
6687 case L2CAP_MODE_BASIC:
6688 /* If socket recv buffers overflows we drop data here
6689 * which is *bad* because L2CAP has to be reliable.
6690 * But we don't have any other choice. L2CAP doesn't
6691 * provide flow control mechanism. */
6693 if (chan->imtu < skb->len) {
6694 BT_ERR("Dropping L2CAP data: receive buffer overflow");
6698 if (!chan->ops->recv(chan, skb))
6702 case L2CAP_MODE_ERTM:
6703 case L2CAP_MODE_STREAMING:
6704 l2cap_data_rcv(chan, skb);
6708 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6716 l2cap_chan_unlock(chan);
6717 l2cap_chan_put(chan);
6720 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6721 struct sk_buff *skb)
6723 struct hci_conn *hcon = conn->hcon;
6724 struct l2cap_chan *chan;
6726 if (hcon->type != ACL_LINK)
6729 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst,
6734 BT_DBG("chan %p, len %d", chan, skb->len);
6736 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6739 if (chan->imtu < skb->len)
6742 /* Store remote BD_ADDR and PSM for msg_name */
6743 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst);
6744 bt_cb(skb)->l2cap.psm = psm;
6746 if (!chan->ops->recv(chan, skb)) {
6747 l2cap_chan_put(chan);
6752 l2cap_chan_put(chan);
6757 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6759 struct l2cap_hdr *lh = (void *) skb->data;
6760 struct hci_conn *hcon = conn->hcon;
6764 if (hcon->state != BT_CONNECTED) {
6765 BT_DBG("queueing pending rx skb");
6766 skb_queue_tail(&conn->pending_rx, skb);
6770 skb_pull(skb, L2CAP_HDR_SIZE);
6771 cid = __le16_to_cpu(lh->cid);
6772 len = __le16_to_cpu(lh->len);
6774 if (len != skb->len) {
6779 /* Since we can't actively block incoming LE connections we must
6780 * at least ensure that we ignore incoming data from them.
6782 if (hcon->type == LE_LINK &&
6783 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst,
6784 bdaddr_dst_type(hcon))) {
6789 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6792 case L2CAP_CID_SIGNALING:
6793 l2cap_sig_channel(conn, skb);
6796 case L2CAP_CID_CONN_LESS:
6797 psm = get_unaligned((__le16 *) skb->data);
6798 skb_pull(skb, L2CAP_PSMLEN_SIZE);
6799 l2cap_conless_channel(conn, psm, skb);
6802 case L2CAP_CID_LE_SIGNALING:
6803 l2cap_le_sig_channel(conn, skb);
6807 l2cap_data_channel(conn, cid, skb);
6812 static void process_pending_rx(struct work_struct *work)
6814 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
6816 struct sk_buff *skb;
6820 while ((skb = skb_dequeue(&conn->pending_rx)))
6821 l2cap_recv_frame(conn, skb);
6824 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
6826 struct l2cap_conn *conn = hcon->l2cap_data;
6827 struct hci_chan *hchan;
6832 hchan = hci_chan_create(hcon);
6836 conn = kzalloc(sizeof(*conn), GFP_KERNEL);
6838 hci_chan_del(hchan);
6842 kref_init(&conn->ref);
6843 hcon->l2cap_data = conn;
6844 conn->hcon = hci_conn_get(hcon);
6845 conn->hchan = hchan;
6847 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
6849 switch (hcon->type) {
6851 if (hcon->hdev->le_mtu) {
6852 conn->mtu = hcon->hdev->le_mtu;
6857 conn->mtu = hcon->hdev->acl_mtu;
6861 conn->feat_mask = 0;
6863 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS;
6865 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) &&
6866 (bredr_sc_enabled(hcon->hdev) ||
6867 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP)))
6868 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
6870 mutex_init(&conn->ident_lock);
6871 mutex_init(&conn->chan_lock);
6873 INIT_LIST_HEAD(&conn->chan_l);
6874 INIT_LIST_HEAD(&conn->users);
6876 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
6878 skb_queue_head_init(&conn->pending_rx);
6879 INIT_WORK(&conn->pending_rx_work, process_pending_rx);
6880 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr);
6882 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
6887 static bool is_valid_psm(u16 psm, u8 dst_type)
6892 if (bdaddr_type_is_le(dst_type))
6893 return (psm <= 0x00ff);
6895 /* PSM must be odd and lsb of upper byte must be 0 */
6896 return ((psm & 0x0101) == 0x0001);
6899 struct l2cap_chan_data {
6900 struct l2cap_chan *chan;
6905 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data)
6907 struct l2cap_chan_data *d = data;
6910 if (chan == d->chan)
6913 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags))
6916 pid = chan->ops->get_peer_pid(chan);
6918 /* Only count deferred channels with the same PID/PSM */
6919 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident ||
6920 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT)
6926 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
6927 bdaddr_t *dst, u8 dst_type, u16 timeout)
6929 struct l2cap_conn *conn;
6930 struct hci_conn *hcon;
6931 struct hci_dev *hdev;
6934 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src,
6935 dst, dst_type, __le16_to_cpu(psm), chan->mode);
6937 hdev = hci_get_route(dst, &chan->src, chan->src_type);
6939 return -EHOSTUNREACH;
6943 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid &&
6944 chan->chan_type != L2CAP_CHAN_RAW) {
6949 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) {
6954 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) {
6959 switch (chan->mode) {
6960 case L2CAP_MODE_BASIC:
6962 case L2CAP_MODE_LE_FLOWCTL:
6964 case L2CAP_MODE_EXT_FLOWCTL:
6965 if (!enable_ecred) {
6970 case L2CAP_MODE_ERTM:
6971 case L2CAP_MODE_STREAMING:
6980 switch (chan->state) {
6984 /* Already connecting */
6989 /* Already connected */
7003 /* Set destination address and psm */
7004 bacpy(&chan->dst, dst);
7005 chan->dst_type = dst_type;
7010 if (bdaddr_type_is_le(dst_type)) {
7011 /* Convert from L2CAP channel address type to HCI address type
7013 if (dst_type == BDADDR_LE_PUBLIC)
7014 dst_type = ADDR_LE_DEV_PUBLIC;
7016 dst_type = ADDR_LE_DEV_RANDOM;
7018 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
7019 hcon = hci_connect_le(hdev, dst, dst_type, false,
7020 chan->sec_level, timeout,
7021 HCI_ROLE_SLAVE, 0, 0);
7023 hcon = hci_connect_le_scan(hdev, dst, dst_type,
7024 chan->sec_level, timeout,
7025 CONN_REASON_L2CAP_CHAN);
7028 u8 auth_type = l2cap_get_auth_type(chan);
7029 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type,
7030 CONN_REASON_L2CAP_CHAN, timeout);
7034 err = PTR_ERR(hcon);
7038 conn = l2cap_conn_add(hcon);
7040 hci_conn_drop(hcon);
7045 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) {
7046 struct l2cap_chan_data data;
7049 data.pid = chan->ops->get_peer_pid(chan);
7052 l2cap_chan_list(conn, l2cap_chan_by_pid, &data);
7054 /* Check if there isn't too many channels being connected */
7055 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) {
7056 hci_conn_drop(hcon);
7062 mutex_lock(&conn->chan_lock);
7063 l2cap_chan_lock(chan);
7065 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
7066 hci_conn_drop(hcon);
7071 /* Update source addr of the socket */
7072 bacpy(&chan->src, &hcon->src);
7073 chan->src_type = bdaddr_src_type(hcon);
7075 __l2cap_chan_add(conn, chan);
7077 /* l2cap_chan_add takes its own ref so we can drop this one */
7078 hci_conn_drop(hcon);
7080 l2cap_state_change(chan, BT_CONNECT);
7081 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan));
7083 /* Release chan->sport so that it can be reused by other
7084 * sockets (as it's only used for listening sockets).
7086 write_lock(&chan_list_lock);
7088 write_unlock(&chan_list_lock);
7090 if (hcon->state == BT_CONNECTED) {
7091 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
7092 __clear_chan_timer(chan);
7093 if (l2cap_chan_check_security(chan, true))
7094 l2cap_state_change(chan, BT_CONNECTED);
7096 l2cap_do_start(chan);
7102 l2cap_chan_unlock(chan);
7103 mutex_unlock(&conn->chan_lock);
7105 hci_dev_unlock(hdev);
7109 EXPORT_SYMBOL_GPL(l2cap_chan_connect);
7111 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan)
7113 struct l2cap_conn *conn = chan->conn;
7115 struct l2cap_ecred_reconf_req req;
7119 pdu.req.mtu = cpu_to_le16(chan->imtu);
7120 pdu.req.mps = cpu_to_le16(chan->mps);
7121 pdu.scid = cpu_to_le16(chan->scid);
7123 chan->ident = l2cap_get_ident(conn);
7125 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ,
7129 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu)
7131 if (chan->imtu > mtu)
7134 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu);
7138 l2cap_ecred_reconfigure(chan);
7143 /* ---- L2CAP interface with lower layer (HCI) ---- */
7145 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
7147 int exact = 0, lm1 = 0, lm2 = 0;
7148 struct l2cap_chan *c;
7150 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
7152 /* Find listening sockets and check their link_mode */
7153 read_lock(&chan_list_lock);
7154 list_for_each_entry(c, &chan_list, global_l) {
7155 if (c->state != BT_LISTEN)
7158 if (!bacmp(&c->src, &hdev->bdaddr)) {
7159 lm1 |= HCI_LM_ACCEPT;
7160 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7161 lm1 |= HCI_LM_MASTER;
7163 } else if (!bacmp(&c->src, BDADDR_ANY)) {
7164 lm2 |= HCI_LM_ACCEPT;
7165 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
7166 lm2 |= HCI_LM_MASTER;
7169 read_unlock(&chan_list_lock);
7171 return exact ? lm1 : lm2;
7174 /* Find the next fixed channel in BT_LISTEN state, continue iteration
7175 * from an existing channel in the list or from the beginning of the
7176 * global list (by passing NULL as first parameter).
7178 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c,
7179 struct hci_conn *hcon)
7181 u8 src_type = bdaddr_src_type(hcon);
7183 read_lock(&chan_list_lock);
7186 c = list_next_entry(c, global_l);
7188 c = list_entry(chan_list.next, typeof(*c), global_l);
7190 list_for_each_entry_from(c, &chan_list, global_l) {
7191 if (c->chan_type != L2CAP_CHAN_FIXED)
7193 if (c->state != BT_LISTEN)
7195 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY))
7197 if (src_type != c->src_type)
7200 c = l2cap_chan_hold_unless_zero(c);
7201 read_unlock(&chan_list_lock);
7205 read_unlock(&chan_list_lock);
7210 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
7212 struct hci_dev *hdev = hcon->hdev;
7213 struct l2cap_conn *conn;
7214 struct l2cap_chan *pchan;
7217 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7220 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
7223 l2cap_conn_del(hcon, bt_to_errno(status));
7227 conn = l2cap_conn_add(hcon);
7231 dst_type = bdaddr_dst_type(hcon);
7233 /* If device is blocked, do not create channels for it */
7234 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type))
7237 /* Find fixed channels and notify them of the new connection. We
7238 * use multiple individual lookups, continuing each time where
7239 * we left off, because the list lock would prevent calling the
7240 * potentially sleeping l2cap_chan_lock() function.
7242 pchan = l2cap_global_fixed_chan(NULL, hcon);
7244 struct l2cap_chan *chan, *next;
7246 /* Client fixed channels should override server ones */
7247 if (__l2cap_get_chan_by_dcid(conn, pchan->scid))
7250 l2cap_chan_lock(pchan);
7251 chan = pchan->ops->new_connection(pchan);
7253 bacpy(&chan->src, &hcon->src);
7254 bacpy(&chan->dst, &hcon->dst);
7255 chan->src_type = bdaddr_src_type(hcon);
7256 chan->dst_type = dst_type;
7258 __l2cap_chan_add(conn, chan);
7261 l2cap_chan_unlock(pchan);
7263 next = l2cap_global_fixed_chan(pchan, hcon);
7264 l2cap_chan_put(pchan);
7268 l2cap_conn_ready(conn);
7271 int l2cap_disconn_ind(struct hci_conn *hcon)
7273 struct l2cap_conn *conn = hcon->l2cap_data;
7275 BT_DBG("hcon %p", hcon);
7278 return HCI_ERROR_REMOTE_USER_TERM;
7279 return conn->disc_reason;
7282 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
7284 if (hcon->type != ACL_LINK && hcon->type != LE_LINK)
7287 BT_DBG("hcon %p reason %d", hcon, reason);
7289 l2cap_conn_del(hcon, bt_to_errno(reason));
7292 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
7294 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
7297 if (encrypt == 0x00) {
7298 if (chan->sec_level == BT_SECURITY_MEDIUM) {
7299 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
7300 } else if (chan->sec_level == BT_SECURITY_HIGH ||
7301 chan->sec_level == BT_SECURITY_FIPS)
7302 l2cap_chan_close(chan, ECONNREFUSED);
7304 if (chan->sec_level == BT_SECURITY_MEDIUM)
7305 __clear_chan_timer(chan);
7309 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
7311 struct l2cap_conn *conn = hcon->l2cap_data;
7312 struct l2cap_chan *chan;
7317 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
7319 mutex_lock(&conn->chan_lock);
7321 list_for_each_entry(chan, &conn->chan_l, list) {
7322 l2cap_chan_lock(chan);
7324 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
7325 state_to_string(chan->state));
7327 if (!status && encrypt)
7328 chan->sec_level = hcon->sec_level;
7330 if (!__l2cap_no_conn_pending(chan)) {
7331 l2cap_chan_unlock(chan);
7335 if (!status && (chan->state == BT_CONNECTED ||
7336 chan->state == BT_CONFIG)) {
7337 chan->ops->resume(chan);
7338 l2cap_check_encryption(chan, encrypt);
7339 l2cap_chan_unlock(chan);
7343 if (chan->state == BT_CONNECT) {
7344 if (!status && l2cap_check_enc_key_size(hcon))
7345 l2cap_start_connection(chan);
7347 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7348 } else if (chan->state == BT_CONNECT2 &&
7349 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL ||
7350 chan->mode == L2CAP_MODE_LE_FLOWCTL)) {
7351 struct l2cap_conn_rsp rsp;
7354 if (!status && l2cap_check_enc_key_size(hcon)) {
7355 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
7356 res = L2CAP_CR_PEND;
7357 stat = L2CAP_CS_AUTHOR_PEND;
7358 chan->ops->defer(chan);
7360 l2cap_state_change(chan, BT_CONFIG);
7361 res = L2CAP_CR_SUCCESS;
7362 stat = L2CAP_CS_NO_INFO;
7365 l2cap_state_change(chan, BT_DISCONN);
7366 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
7367 res = L2CAP_CR_SEC_BLOCK;
7368 stat = L2CAP_CS_NO_INFO;
7371 rsp.scid = cpu_to_le16(chan->dcid);
7372 rsp.dcid = cpu_to_le16(chan->scid);
7373 rsp.result = cpu_to_le16(res);
7374 rsp.status = cpu_to_le16(stat);
7375 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
7378 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
7379 res == L2CAP_CR_SUCCESS) {
7381 set_bit(CONF_REQ_SENT, &chan->conf_state);
7382 l2cap_send_cmd(conn, l2cap_get_ident(conn),
7384 l2cap_build_conf_req(chan, buf, sizeof(buf)),
7386 chan->num_conf_req++;
7390 l2cap_chan_unlock(chan);
7393 mutex_unlock(&conn->chan_lock);
7396 /* Append fragment into frame respecting the maximum len of rx_skb */
7397 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb,
7400 if (!conn->rx_skb) {
7401 /* Allocate skb for the complete frame (with header) */
7402 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
7409 /* Copy as much as the rx_skb can hold */
7410 len = min_t(u16, len, skb->len);
7411 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len);
7413 conn->rx_len -= len;
7418 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb)
7420 struct sk_buff *rx_skb;
7423 /* Append just enough to complete the header */
7424 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len);
7426 /* If header could not be read just continue */
7427 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE)
7430 rx_skb = conn->rx_skb;
7431 len = get_unaligned_le16(rx_skb->data);
7433 /* Check if rx_skb has enough space to received all fragments */
7434 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) {
7435 /* Update expected len */
7436 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE);
7437 return L2CAP_LEN_SIZE;
7440 /* Reset conn->rx_skb since it will need to be reallocated in order to
7441 * fit all fragments.
7443 conn->rx_skb = NULL;
7445 /* Reallocates rx_skb using the exact expected length */
7446 len = l2cap_recv_frag(conn, rx_skb,
7447 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE));
7453 static void l2cap_recv_reset(struct l2cap_conn *conn)
7455 kfree_skb(conn->rx_skb);
7456 conn->rx_skb = NULL;
7460 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
7462 struct l2cap_conn *conn = hcon->l2cap_data;
7465 /* For AMP controller do not create l2cap conn */
7466 if (!conn && hcon->hdev->dev_type != HCI_PRIMARY)
7470 conn = l2cap_conn_add(hcon);
7475 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags);
7479 case ACL_START_NO_FLUSH:
7482 BT_ERR("Unexpected start frame (len %d)", skb->len);
7483 l2cap_recv_reset(conn);
7484 l2cap_conn_unreliable(conn, ECOMM);
7487 /* Start fragment may not contain the L2CAP length so just
7488 * copy the initial byte when that happens and use conn->mtu as
7491 if (skb->len < L2CAP_LEN_SIZE) {
7492 l2cap_recv_frag(conn, skb, conn->mtu);
7496 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE;
7498 if (len == skb->len) {
7499 /* Complete frame received */
7500 l2cap_recv_frame(conn, skb);
7504 BT_DBG("Start: total len %d, frag len %u", len, skb->len);
7506 if (skb->len > len) {
7507 BT_ERR("Frame is too long (len %u, expected len %d)",
7509 l2cap_conn_unreliable(conn, ECOMM);
7513 /* Append fragment into frame (with header) */
7514 if (l2cap_recv_frag(conn, skb, len) < 0)
7520 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len);
7522 if (!conn->rx_skb) {
7523 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
7524 l2cap_conn_unreliable(conn, ECOMM);
7528 /* Complete the L2CAP length if it has not been read */
7529 if (conn->rx_skb->len < L2CAP_LEN_SIZE) {
7530 if (l2cap_recv_len(conn, skb) < 0) {
7531 l2cap_conn_unreliable(conn, ECOMM);
7535 /* Header still could not be read just continue */
7536 if (conn->rx_skb->len < L2CAP_LEN_SIZE)
7540 if (skb->len > conn->rx_len) {
7541 BT_ERR("Fragment is too long (len %u, expected %u)",
7542 skb->len, conn->rx_len);
7543 l2cap_recv_reset(conn);
7544 l2cap_conn_unreliable(conn, ECOMM);
7548 /* Append fragment into frame (with header) */
7549 l2cap_recv_frag(conn, skb, skb->len);
7551 if (!conn->rx_len) {
7552 /* Complete frame received. l2cap_recv_frame
7553 * takes ownership of the skb so set the global
7554 * rx_skb pointer to NULL first.
7556 struct sk_buff *rx_skb = conn->rx_skb;
7557 conn->rx_skb = NULL;
7558 l2cap_recv_frame(conn, rx_skb);
7567 static struct hci_cb l2cap_cb = {
7569 .connect_cfm = l2cap_connect_cfm,
7570 .disconn_cfm = l2cap_disconn_cfm,
7571 .security_cfm = l2cap_security_cfm,
7574 static int l2cap_debugfs_show(struct seq_file *f, void *p)
7576 struct l2cap_chan *c;
7578 read_lock(&chan_list_lock);
7580 list_for_each_entry(c, &chan_list, global_l) {
7581 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
7582 &c->src, c->src_type, &c->dst, c->dst_type,
7583 c->state, __le16_to_cpu(c->psm),
7584 c->scid, c->dcid, c->imtu, c->omtu,
7585 c->sec_level, c->mode);
7588 read_unlock(&chan_list_lock);
7593 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs);
7595 static struct dentry *l2cap_debugfs;
7597 int __init l2cap_init(void)
7601 err = l2cap_init_sockets();
7605 hci_register_cb(&l2cap_cb);
7607 if (IS_ERR_OR_NULL(bt_debugfs))
7610 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
7611 NULL, &l2cap_debugfs_fops);
7616 void l2cap_exit(void)
7618 debugfs_remove(l2cap_debugfs);
7619 hci_unregister_cb(&l2cap_cb);
7620 l2cap_cleanup_sockets();
7623 module_param(disable_ertm, bool, 0644);
7624 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
7626 module_param(enable_ecred, bool, 0644);
7627 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode");