2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
26 SOFTWARE IS DISCLAIMED.
29 /* Bluetooth L2CAP core. */
31 #include <linux/module.h>
33 #include <linux/debugfs.h>
34 #include <linux/crc16.h>
36 #include <net/bluetooth/bluetooth.h>
37 #include <net/bluetooth/hci_core.h>
38 #include <net/bluetooth/l2cap.h>
39 #include <net/bluetooth/smp.h>
40 #include <net/bluetooth/a2mp.h>
41 #include <net/bluetooth/amp.h>
45 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
46 static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
48 static LIST_HEAD(chan_list);
49 static DEFINE_RWLOCK(chan_list_lock);
51 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
52 u8 code, u8 ident, u16 dlen, void *data);
53 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
55 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
56 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err);
58 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
59 struct sk_buff_head *skbs, u8 event);
61 /* ---- L2CAP channels ---- */
63 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
68 list_for_each_entry(c, &conn->chan_l, list) {
75 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
80 list_for_each_entry(c, &conn->chan_l, list) {
87 /* Find channel with given SCID.
88 * Returns locked channel. */
89 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
94 mutex_lock(&conn->chan_lock);
95 c = __l2cap_get_chan_by_scid(conn, cid);
98 mutex_unlock(&conn->chan_lock);
103 /* Find channel with given DCID.
104 * Returns locked channel.
106 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
109 struct l2cap_chan *c;
111 mutex_lock(&conn->chan_lock);
112 c = __l2cap_get_chan_by_dcid(conn, cid);
115 mutex_unlock(&conn->chan_lock);
120 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
123 struct l2cap_chan *c;
125 list_for_each_entry(c, &conn->chan_l, list) {
126 if (c->ident == ident)
132 static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
135 struct l2cap_chan *c;
137 mutex_lock(&conn->chan_lock);
138 c = __l2cap_get_chan_by_ident(conn, ident);
141 mutex_unlock(&conn->chan_lock);
146 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
148 struct l2cap_chan *c;
150 list_for_each_entry(c, &chan_list, global_l) {
151 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
157 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
161 write_lock(&chan_list_lock);
163 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
176 for (p = 0x1001; p < 0x1100; p += 2)
177 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
178 chan->psm = cpu_to_le16(p);
179 chan->sport = cpu_to_le16(p);
186 write_unlock(&chan_list_lock);
190 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
192 write_lock(&chan_list_lock);
196 write_unlock(&chan_list_lock);
201 static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
203 u16 cid = L2CAP_CID_DYN_START;
205 for (; cid < L2CAP_CID_DYN_END; cid++) {
206 if (!__l2cap_get_chan_by_scid(conn, cid))
213 static void __l2cap_state_change(struct l2cap_chan *chan, int state)
215 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
216 state_to_string(state));
219 chan->ops->state_change(chan, state);
222 static void l2cap_state_change(struct l2cap_chan *chan, int state)
224 struct sock *sk = chan->sk;
227 __l2cap_state_change(chan, state);
231 static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
233 struct sock *sk = chan->sk;
238 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
240 struct sock *sk = chan->sk;
243 __l2cap_chan_set_err(chan, err);
247 static void __set_retrans_timer(struct l2cap_chan *chan)
249 if (!delayed_work_pending(&chan->monitor_timer) &&
250 chan->retrans_timeout) {
251 l2cap_set_timer(chan, &chan->retrans_timer,
252 msecs_to_jiffies(chan->retrans_timeout));
256 static void __set_monitor_timer(struct l2cap_chan *chan)
258 __clear_retrans_timer(chan);
259 if (chan->monitor_timeout) {
260 l2cap_set_timer(chan, &chan->monitor_timer,
261 msecs_to_jiffies(chan->monitor_timeout));
265 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
270 skb_queue_walk(head, skb) {
271 if (bt_cb(skb)->control.txseq == seq)
278 /* ---- L2CAP sequence number lists ---- */
280 /* For ERTM, ordered lists of sequence numbers must be tracked for
281 * SREJ requests that are received and for frames that are to be
282 * retransmitted. These seq_list functions implement a singly-linked
283 * list in an array, where membership in the list can also be checked
284 * in constant time. Items can also be added to the tail of the list
285 * and removed from the head in constant time, without further memory
289 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
291 size_t alloc_size, i;
293 /* Allocated size is a power of 2 to map sequence numbers
294 * (which may be up to 14 bits) in to a smaller array that is
295 * sized for the negotiated ERTM transmit windows.
297 alloc_size = roundup_pow_of_two(size);
299 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
303 seq_list->mask = alloc_size - 1;
304 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
305 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
306 for (i = 0; i < alloc_size; i++)
307 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
312 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
314 kfree(seq_list->list);
317 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
320 /* Constant-time check for list membership */
321 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
324 static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
326 u16 mask = seq_list->mask;
328 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
329 /* In case someone tries to pop the head of an empty list */
330 return L2CAP_SEQ_LIST_CLEAR;
331 } else if (seq_list->head == seq) {
332 /* Head can be removed in constant time */
333 seq_list->head = seq_list->list[seq & mask];
334 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
336 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
337 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
338 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
341 /* Walk the list to find the sequence number */
342 u16 prev = seq_list->head;
343 while (seq_list->list[prev & mask] != seq) {
344 prev = seq_list->list[prev & mask];
345 if (prev == L2CAP_SEQ_LIST_TAIL)
346 return L2CAP_SEQ_LIST_CLEAR;
349 /* Unlink the number from the list and clear it */
350 seq_list->list[prev & mask] = seq_list->list[seq & mask];
351 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
352 if (seq_list->tail == seq)
353 seq_list->tail = prev;
358 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
360 /* Remove the head in constant time */
361 return l2cap_seq_list_remove(seq_list, seq_list->head);
364 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
368 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
371 for (i = 0; i <= seq_list->mask; i++)
372 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
374 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
375 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
378 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
380 u16 mask = seq_list->mask;
382 /* All appends happen in constant time */
384 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
387 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
388 seq_list->head = seq;
390 seq_list->list[seq_list->tail & mask] = seq;
392 seq_list->tail = seq;
393 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
396 static void l2cap_chan_timeout(struct work_struct *work)
398 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
400 struct l2cap_conn *conn = chan->conn;
403 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
405 mutex_lock(&conn->chan_lock);
406 l2cap_chan_lock(chan);
408 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
409 reason = ECONNREFUSED;
410 else if (chan->state == BT_CONNECT &&
411 chan->sec_level != BT_SECURITY_SDP)
412 reason = ECONNREFUSED;
416 l2cap_chan_close(chan, reason);
418 l2cap_chan_unlock(chan);
420 chan->ops->close(chan);
421 mutex_unlock(&conn->chan_lock);
423 l2cap_chan_put(chan);
426 struct l2cap_chan *l2cap_chan_create(void)
428 struct l2cap_chan *chan;
430 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
434 mutex_init(&chan->lock);
436 write_lock(&chan_list_lock);
437 list_add(&chan->global_l, &chan_list);
438 write_unlock(&chan_list_lock);
440 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
442 chan->state = BT_OPEN;
444 kref_init(&chan->kref);
446 /* This flag is cleared in l2cap_chan_ready() */
447 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
449 BT_DBG("chan %p", chan);
454 static void l2cap_chan_destroy(struct kref *kref)
456 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
458 BT_DBG("chan %p", chan);
460 write_lock(&chan_list_lock);
461 list_del(&chan->global_l);
462 write_unlock(&chan_list_lock);
467 void l2cap_chan_hold(struct l2cap_chan *c)
469 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
474 void l2cap_chan_put(struct l2cap_chan *c)
476 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
478 kref_put(&c->kref, l2cap_chan_destroy);
481 void l2cap_chan_set_defaults(struct l2cap_chan *chan)
483 chan->fcs = L2CAP_FCS_CRC16;
484 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
485 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
486 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
487 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
488 chan->sec_level = BT_SECURITY_LOW;
490 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
493 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
495 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
496 __le16_to_cpu(chan->psm), chan->dcid);
498 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
502 switch (chan->chan_type) {
503 case L2CAP_CHAN_CONN_ORIENTED:
504 if (conn->hcon->type == LE_LINK) {
506 chan->omtu = L2CAP_DEFAULT_MTU;
507 if (chan->dcid == L2CAP_CID_ATT)
508 chan->scid = L2CAP_CID_ATT;
510 chan->scid = l2cap_alloc_cid(conn);
512 /* Alloc CID for connection-oriented socket */
513 chan->scid = l2cap_alloc_cid(conn);
514 chan->omtu = L2CAP_DEFAULT_MTU;
518 case L2CAP_CHAN_CONN_LESS:
519 /* Connectionless socket */
520 chan->scid = L2CAP_CID_CONN_LESS;
521 chan->dcid = L2CAP_CID_CONN_LESS;
522 chan->omtu = L2CAP_DEFAULT_MTU;
525 case L2CAP_CHAN_CONN_FIX_A2MP:
526 chan->scid = L2CAP_CID_A2MP;
527 chan->dcid = L2CAP_CID_A2MP;
528 chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
529 chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
533 /* Raw socket can send/recv signalling messages only */
534 chan->scid = L2CAP_CID_SIGNALING;
535 chan->dcid = L2CAP_CID_SIGNALING;
536 chan->omtu = L2CAP_DEFAULT_MTU;
539 chan->local_id = L2CAP_BESTEFFORT_ID;
540 chan->local_stype = L2CAP_SERV_BESTEFFORT;
541 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
542 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
543 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
544 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
546 l2cap_chan_hold(chan);
548 hci_conn_hold(conn->hcon);
550 list_add(&chan->list, &conn->chan_l);
553 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
555 mutex_lock(&conn->chan_lock);
556 __l2cap_chan_add(conn, chan);
557 mutex_unlock(&conn->chan_lock);
560 void l2cap_chan_del(struct l2cap_chan *chan, int err)
562 struct l2cap_conn *conn = chan->conn;
564 __clear_chan_timer(chan);
566 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
569 struct amp_mgr *mgr = conn->hcon->amp_mgr;
570 /* Delete from channel list */
571 list_del(&chan->list);
573 l2cap_chan_put(chan);
577 if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
578 hci_conn_drop(conn->hcon);
580 if (mgr && mgr->bredr_chan == chan)
581 mgr->bredr_chan = NULL;
584 if (chan->hs_hchan) {
585 struct hci_chan *hs_hchan = chan->hs_hchan;
587 BT_DBG("chan %p disconnect hs_hchan %p", chan, hs_hchan);
588 amp_disconnect_logical_link(hs_hchan);
591 chan->ops->teardown(chan, err);
593 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
597 case L2CAP_MODE_BASIC:
600 case L2CAP_MODE_ERTM:
601 __clear_retrans_timer(chan);
602 __clear_monitor_timer(chan);
603 __clear_ack_timer(chan);
605 skb_queue_purge(&chan->srej_q);
607 l2cap_seq_list_free(&chan->srej_list);
608 l2cap_seq_list_free(&chan->retrans_list);
612 case L2CAP_MODE_STREAMING:
613 skb_queue_purge(&chan->tx_q);
620 void l2cap_chan_close(struct l2cap_chan *chan, int reason)
622 struct l2cap_conn *conn = chan->conn;
623 struct sock *sk = chan->sk;
625 BT_DBG("chan %p state %s sk %p", chan, state_to_string(chan->state),
628 switch (chan->state) {
630 chan->ops->teardown(chan, 0);
635 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
636 conn->hcon->type == ACL_LINK) {
637 __set_chan_timer(chan, sk->sk_sndtimeo);
638 l2cap_send_disconn_req(chan, reason);
640 l2cap_chan_del(chan, reason);
644 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
645 conn->hcon->type == ACL_LINK) {
646 struct l2cap_conn_rsp rsp;
649 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
650 result = L2CAP_CR_SEC_BLOCK;
652 result = L2CAP_CR_BAD_PSM;
653 l2cap_state_change(chan, BT_DISCONN);
655 rsp.scid = cpu_to_le16(chan->dcid);
656 rsp.dcid = cpu_to_le16(chan->scid);
657 rsp.result = cpu_to_le16(result);
658 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
659 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
663 l2cap_chan_del(chan, reason);
668 l2cap_chan_del(chan, reason);
672 chan->ops->teardown(chan, 0);
677 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
679 if (chan->chan_type == L2CAP_CHAN_RAW) {
680 switch (chan->sec_level) {
681 case BT_SECURITY_HIGH:
682 return HCI_AT_DEDICATED_BONDING_MITM;
683 case BT_SECURITY_MEDIUM:
684 return HCI_AT_DEDICATED_BONDING;
686 return HCI_AT_NO_BONDING;
688 } else if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
689 if (chan->sec_level == BT_SECURITY_LOW)
690 chan->sec_level = BT_SECURITY_SDP;
692 if (chan->sec_level == BT_SECURITY_HIGH)
693 return HCI_AT_NO_BONDING_MITM;
695 return HCI_AT_NO_BONDING;
697 switch (chan->sec_level) {
698 case BT_SECURITY_HIGH:
699 return HCI_AT_GENERAL_BONDING_MITM;
700 case BT_SECURITY_MEDIUM:
701 return HCI_AT_GENERAL_BONDING;
703 return HCI_AT_NO_BONDING;
708 /* Service level security */
709 int l2cap_chan_check_security(struct l2cap_chan *chan)
711 struct l2cap_conn *conn = chan->conn;
714 auth_type = l2cap_get_auth_type(chan);
716 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
719 static u8 l2cap_get_ident(struct l2cap_conn *conn)
723 /* Get next available identificator.
724 * 1 - 128 are used by kernel.
725 * 129 - 199 are reserved.
726 * 200 - 254 are used by utilities like l2ping, etc.
729 spin_lock(&conn->lock);
731 if (++conn->tx_ident > 128)
736 spin_unlock(&conn->lock);
741 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
744 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
747 BT_DBG("code 0x%2.2x", code);
752 if (lmp_no_flush_capable(conn->hcon->hdev))
753 flags = ACL_START_NO_FLUSH;
757 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
758 skb->priority = HCI_PRIO_MAX;
760 hci_send_acl(conn->hchan, skb, flags);
763 static bool __chan_is_moving(struct l2cap_chan *chan)
765 return chan->move_state != L2CAP_MOVE_STABLE &&
766 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
769 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
771 struct hci_conn *hcon = chan->conn->hcon;
774 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
777 if (chan->hs_hcon && !__chan_is_moving(chan)) {
779 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
786 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
787 lmp_no_flush_capable(hcon->hdev))
788 flags = ACL_START_NO_FLUSH;
792 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
793 hci_send_acl(chan->conn->hchan, skb, flags);
796 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
798 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
799 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
801 if (enh & L2CAP_CTRL_FRAME_TYPE) {
804 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
805 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
812 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
813 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
820 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
822 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
823 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
825 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
828 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
829 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
836 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
837 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
844 static inline void __unpack_control(struct l2cap_chan *chan,
847 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
848 __unpack_extended_control(get_unaligned_le32(skb->data),
849 &bt_cb(skb)->control);
850 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
852 __unpack_enhanced_control(get_unaligned_le16(skb->data),
853 &bt_cb(skb)->control);
854 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
858 static u32 __pack_extended_control(struct l2cap_ctrl *control)
862 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
863 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
865 if (control->sframe) {
866 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
867 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
868 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
870 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
871 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
877 static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
881 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
882 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
884 if (control->sframe) {
885 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
886 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
887 packed |= L2CAP_CTRL_FRAME_TYPE;
889 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
890 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
896 static inline void __pack_control(struct l2cap_chan *chan,
897 struct l2cap_ctrl *control,
900 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
901 put_unaligned_le32(__pack_extended_control(control),
902 skb->data + L2CAP_HDR_SIZE);
904 put_unaligned_le16(__pack_enhanced_control(control),
905 skb->data + L2CAP_HDR_SIZE);
909 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
911 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
912 return L2CAP_EXT_HDR_SIZE;
914 return L2CAP_ENH_HDR_SIZE;
917 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
921 struct l2cap_hdr *lh;
922 int hlen = __ertm_hdr_size(chan);
924 if (chan->fcs == L2CAP_FCS_CRC16)
925 hlen += L2CAP_FCS_SIZE;
927 skb = bt_skb_alloc(hlen, GFP_KERNEL);
930 return ERR_PTR(-ENOMEM);
932 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
933 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
934 lh->cid = cpu_to_le16(chan->dcid);
936 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
937 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
939 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
941 if (chan->fcs == L2CAP_FCS_CRC16) {
942 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
943 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
946 skb->priority = HCI_PRIO_MAX;
950 static void l2cap_send_sframe(struct l2cap_chan *chan,
951 struct l2cap_ctrl *control)
956 BT_DBG("chan %p, control %p", chan, control);
958 if (!control->sframe)
961 if (__chan_is_moving(chan))
964 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
968 if (control->super == L2CAP_SUPER_RR)
969 clear_bit(CONN_RNR_SENT, &chan->conn_state);
970 else if (control->super == L2CAP_SUPER_RNR)
971 set_bit(CONN_RNR_SENT, &chan->conn_state);
973 if (control->super != L2CAP_SUPER_SREJ) {
974 chan->last_acked_seq = control->reqseq;
975 __clear_ack_timer(chan);
978 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
979 control->final, control->poll, control->super);
981 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
982 control_field = __pack_extended_control(control);
984 control_field = __pack_enhanced_control(control);
986 skb = l2cap_create_sframe_pdu(chan, control_field);
988 l2cap_do_send(chan, skb);
991 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
993 struct l2cap_ctrl control;
995 BT_DBG("chan %p, poll %d", chan, poll);
997 memset(&control, 0, sizeof(control));
1001 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1002 control.super = L2CAP_SUPER_RNR;
1004 control.super = L2CAP_SUPER_RR;
1006 control.reqseq = chan->buffer_seq;
1007 l2cap_send_sframe(chan, &control);
1010 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
1012 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
1015 static bool __amp_capable(struct l2cap_chan *chan)
1017 struct l2cap_conn *conn = chan->conn;
1020 hci_amp_capable() &&
1021 chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&
1022 conn->fixed_chan_mask & L2CAP_FC_A2MP)
1028 static bool l2cap_check_efs(struct l2cap_chan *chan)
1030 /* Check EFS parameters */
1034 void l2cap_send_conn_req(struct l2cap_chan *chan)
1036 struct l2cap_conn *conn = chan->conn;
1037 struct l2cap_conn_req req;
1039 req.scid = cpu_to_le16(chan->scid);
1040 req.psm = chan->psm;
1042 chan->ident = l2cap_get_ident(conn);
1044 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1046 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1049 static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1051 struct l2cap_create_chan_req req;
1052 req.scid = cpu_to_le16(chan->scid);
1053 req.psm = chan->psm;
1054 req.amp_id = amp_id;
1056 chan->ident = l2cap_get_ident(chan->conn);
1058 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1062 static void l2cap_move_setup(struct l2cap_chan *chan)
1064 struct sk_buff *skb;
1066 BT_DBG("chan %p", chan);
1068 if (chan->mode != L2CAP_MODE_ERTM)
1071 __clear_retrans_timer(chan);
1072 __clear_monitor_timer(chan);
1073 __clear_ack_timer(chan);
1075 chan->retry_count = 0;
1076 skb_queue_walk(&chan->tx_q, skb) {
1077 if (bt_cb(skb)->control.retries)
1078 bt_cb(skb)->control.retries = 1;
1083 chan->expected_tx_seq = chan->buffer_seq;
1085 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1086 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1087 l2cap_seq_list_clear(&chan->retrans_list);
1088 l2cap_seq_list_clear(&chan->srej_list);
1089 skb_queue_purge(&chan->srej_q);
1091 chan->tx_state = L2CAP_TX_STATE_XMIT;
1092 chan->rx_state = L2CAP_RX_STATE_MOVE;
1094 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1097 static void l2cap_move_done(struct l2cap_chan *chan)
1099 u8 move_role = chan->move_role;
1100 BT_DBG("chan %p", chan);
1102 chan->move_state = L2CAP_MOVE_STABLE;
1103 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1105 if (chan->mode != L2CAP_MODE_ERTM)
1108 switch (move_role) {
1109 case L2CAP_MOVE_ROLE_INITIATOR:
1110 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1111 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1113 case L2CAP_MOVE_ROLE_RESPONDER:
1114 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1119 static void l2cap_chan_ready(struct l2cap_chan *chan)
1121 /* This clears all conf flags, including CONF_NOT_COMPLETE */
1122 chan->conf_state = 0;
1123 __clear_chan_timer(chan);
1125 chan->state = BT_CONNECTED;
1127 chan->ops->ready(chan);
1130 static void l2cap_start_connection(struct l2cap_chan *chan)
1132 if (__amp_capable(chan)) {
1133 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1134 a2mp_discover_amp(chan);
1136 l2cap_send_conn_req(chan);
1140 static void l2cap_do_start(struct l2cap_chan *chan)
1142 struct l2cap_conn *conn = chan->conn;
1144 if (conn->hcon->type == LE_LINK) {
1145 l2cap_chan_ready(chan);
1149 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
1150 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1153 if (l2cap_chan_check_security(chan) &&
1154 __l2cap_no_conn_pending(chan)) {
1155 l2cap_start_connection(chan);
1158 struct l2cap_info_req req;
1159 req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
1161 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1162 conn->info_ident = l2cap_get_ident(conn);
1164 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
1166 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1171 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1173 u32 local_feat_mask = l2cap_feat_mask;
1175 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1178 case L2CAP_MODE_ERTM:
1179 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1180 case L2CAP_MODE_STREAMING:
1181 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1187 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err)
1189 struct sock *sk = chan->sk;
1190 struct l2cap_conn *conn = chan->conn;
1191 struct l2cap_disconn_req req;
1196 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1197 __clear_retrans_timer(chan);
1198 __clear_monitor_timer(chan);
1199 __clear_ack_timer(chan);
1202 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
1203 l2cap_state_change(chan, BT_DISCONN);
1207 req.dcid = cpu_to_le16(chan->dcid);
1208 req.scid = cpu_to_le16(chan->scid);
1209 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1213 __l2cap_state_change(chan, BT_DISCONN);
1214 __l2cap_chan_set_err(chan, err);
1218 /* ---- L2CAP connections ---- */
1219 static void l2cap_conn_start(struct l2cap_conn *conn)
1221 struct l2cap_chan *chan, *tmp;
1223 BT_DBG("conn %p", conn);
1225 mutex_lock(&conn->chan_lock);
1227 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
1228 struct sock *sk = chan->sk;
1230 l2cap_chan_lock(chan);
1232 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1233 l2cap_chan_unlock(chan);
1237 if (chan->state == BT_CONNECT) {
1238 if (!l2cap_chan_check_security(chan) ||
1239 !__l2cap_no_conn_pending(chan)) {
1240 l2cap_chan_unlock(chan);
1244 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1245 && test_bit(CONF_STATE2_DEVICE,
1246 &chan->conf_state)) {
1247 l2cap_chan_close(chan, ECONNRESET);
1248 l2cap_chan_unlock(chan);
1252 l2cap_start_connection(chan);
1254 } else if (chan->state == BT_CONNECT2) {
1255 struct l2cap_conn_rsp rsp;
1257 rsp.scid = cpu_to_le16(chan->dcid);
1258 rsp.dcid = cpu_to_le16(chan->scid);
1260 if (l2cap_chan_check_security(chan)) {
1262 if (test_bit(BT_SK_DEFER_SETUP,
1263 &bt_sk(sk)->flags)) {
1264 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1265 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
1266 chan->ops->defer(chan);
1269 __l2cap_state_change(chan, BT_CONFIG);
1270 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
1271 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
1275 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1276 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1279 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1282 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
1283 rsp.result != L2CAP_CR_SUCCESS) {
1284 l2cap_chan_unlock(chan);
1288 set_bit(CONF_REQ_SENT, &chan->conf_state);
1289 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1290 l2cap_build_conf_req(chan, buf), buf);
1291 chan->num_conf_req++;
1294 l2cap_chan_unlock(chan);
1297 mutex_unlock(&conn->chan_lock);
1300 /* Find socket with cid and source/destination bdaddr.
1301 * Returns closest match, locked.
1303 static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
1307 struct l2cap_chan *c, *c1 = NULL;
1309 read_lock(&chan_list_lock);
1311 list_for_each_entry(c, &chan_list, global_l) {
1312 struct sock *sk = c->sk;
1314 if (state && c->state != state)
1317 if (c->scid == cid) {
1318 int src_match, dst_match;
1319 int src_any, dst_any;
1322 src_match = !bacmp(&bt_sk(sk)->src, src);
1323 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1324 if (src_match && dst_match) {
1325 read_unlock(&chan_list_lock);
1330 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1331 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1332 if ((src_match && dst_any) || (src_any && dst_match) ||
1333 (src_any && dst_any))
1338 read_unlock(&chan_list_lock);
1343 static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1345 struct sock *parent;
1346 struct l2cap_chan *chan, *pchan;
1350 /* Check if we have socket listening on cid */
1351 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_ATT,
1352 conn->src, conn->dst);
1356 /* Client ATT sockets should override the server one */
1357 if (__l2cap_get_chan_by_dcid(conn, L2CAP_CID_ATT))
1364 chan = pchan->ops->new_connection(pchan);
1368 chan->dcid = L2CAP_CID_ATT;
1370 bacpy(&bt_sk(chan->sk)->src, conn->src);
1371 bacpy(&bt_sk(chan->sk)->dst, conn->dst);
1373 __l2cap_chan_add(conn, chan);
1376 release_sock(parent);
1379 static void l2cap_conn_ready(struct l2cap_conn *conn)
1381 struct l2cap_chan *chan;
1382 struct hci_conn *hcon = conn->hcon;
1384 BT_DBG("conn %p", conn);
1386 /* For outgoing pairing which doesn't necessarily have an
1387 * associated socket (e.g. mgmt_pair_device).
1389 if (hcon->out && hcon->type == LE_LINK)
1390 smp_conn_security(hcon, hcon->pending_sec_level);
1392 mutex_lock(&conn->chan_lock);
1394 if (hcon->type == LE_LINK)
1395 l2cap_le_conn_ready(conn);
1397 list_for_each_entry(chan, &conn->chan_l, list) {
1399 l2cap_chan_lock(chan);
1401 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
1402 l2cap_chan_unlock(chan);
1406 if (hcon->type == LE_LINK) {
1407 if (smp_conn_security(hcon, chan->sec_level))
1408 l2cap_chan_ready(chan);
1410 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1411 struct sock *sk = chan->sk;
1412 __clear_chan_timer(chan);
1414 __l2cap_state_change(chan, BT_CONNECTED);
1415 sk->sk_state_change(sk);
1418 } else if (chan->state == BT_CONNECT) {
1419 l2cap_do_start(chan);
1422 l2cap_chan_unlock(chan);
1425 mutex_unlock(&conn->chan_lock);
1428 /* Notify sockets that we cannot guaranty reliability anymore */
1429 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1431 struct l2cap_chan *chan;
1433 BT_DBG("conn %p", conn);
1435 mutex_lock(&conn->chan_lock);
1437 list_for_each_entry(chan, &conn->chan_l, list) {
1438 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1439 l2cap_chan_set_err(chan, err);
1442 mutex_unlock(&conn->chan_lock);
1445 static void l2cap_info_timeout(struct work_struct *work)
1447 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1450 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1451 conn->info_ident = 0;
1453 l2cap_conn_start(conn);
1458 * External modules can register l2cap_user objects on l2cap_conn. The ->probe
1459 * callback is called during registration. The ->remove callback is called
1460 * during unregistration.
1461 * An l2cap_user object can either be explicitly unregistered or when the
1462 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon,
1463 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called.
1464 * External modules must own a reference to the l2cap_conn object if they intend
1465 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at
1466 * any time if they don't.
1469 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user)
1471 struct hci_dev *hdev = conn->hcon->hdev;
1474 /* We need to check whether l2cap_conn is registered. If it is not, we
1475 * must not register the l2cap_user. l2cap_conn_del() is unregisters
1476 * l2cap_conn objects, but doesn't provide its own locking. Instead, it
1477 * relies on the parent hci_conn object to be locked. This itself relies
1478 * on the hci_dev object to be locked. So we must lock the hci device
1483 if (user->list.next || user->list.prev) {
1488 /* conn->hchan is NULL after l2cap_conn_del() was called */
1494 ret = user->probe(conn, user);
1498 list_add(&user->list, &conn->users);
1502 hci_dev_unlock(hdev);
1505 EXPORT_SYMBOL(l2cap_register_user);
1507 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user)
1509 struct hci_dev *hdev = conn->hcon->hdev;
1513 if (!user->list.next || !user->list.prev)
1516 list_del(&user->list);
1517 user->list.next = NULL;
1518 user->list.prev = NULL;
1519 user->remove(conn, user);
1522 hci_dev_unlock(hdev);
1524 EXPORT_SYMBOL(l2cap_unregister_user);
1526 static void l2cap_unregister_all_users(struct l2cap_conn *conn)
1528 struct l2cap_user *user;
1530 while (!list_empty(&conn->users)) {
1531 user = list_first_entry(&conn->users, struct l2cap_user, list);
1532 list_del(&user->list);
1533 user->list.next = NULL;
1534 user->list.prev = NULL;
1535 user->remove(conn, user);
1539 static void l2cap_conn_del(struct hci_conn *hcon, int err)
1541 struct l2cap_conn *conn = hcon->l2cap_data;
1542 struct l2cap_chan *chan, *l;
1547 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1549 kfree_skb(conn->rx_skb);
1551 l2cap_unregister_all_users(conn);
1553 mutex_lock(&conn->chan_lock);
1556 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1557 l2cap_chan_hold(chan);
1558 l2cap_chan_lock(chan);
1560 l2cap_chan_del(chan, err);
1562 l2cap_chan_unlock(chan);
1564 chan->ops->close(chan);
1565 l2cap_chan_put(chan);
1568 mutex_unlock(&conn->chan_lock);
1570 hci_chan_del(conn->hchan);
1572 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1573 cancel_delayed_work_sync(&conn->info_timer);
1575 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
1576 cancel_delayed_work_sync(&conn->security_timer);
1577 smp_chan_destroy(conn);
1580 hcon->l2cap_data = NULL;
1582 l2cap_conn_put(conn);
1585 static void security_timeout(struct work_struct *work)
1587 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1588 security_timer.work);
1590 BT_DBG("conn %p", conn);
1592 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1593 smp_chan_destroy(conn);
1594 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1598 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
1600 struct l2cap_conn *conn = hcon->l2cap_data;
1601 struct hci_chan *hchan;
1606 hchan = hci_chan_create(hcon);
1610 conn = kzalloc(sizeof(struct l2cap_conn), GFP_KERNEL);
1612 hci_chan_del(hchan);
1616 kref_init(&conn->ref);
1617 hcon->l2cap_data = conn;
1619 hci_conn_get(conn->hcon);
1620 conn->hchan = hchan;
1622 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
1624 switch (hcon->type) {
1626 if (hcon->hdev->le_mtu) {
1627 conn->mtu = hcon->hdev->le_mtu;
1632 conn->mtu = hcon->hdev->acl_mtu;
1636 conn->src = &hcon->hdev->bdaddr;
1637 conn->dst = &hcon->dst;
1639 conn->feat_mask = 0;
1641 spin_lock_init(&conn->lock);
1642 mutex_init(&conn->chan_lock);
1644 INIT_LIST_HEAD(&conn->chan_l);
1645 INIT_LIST_HEAD(&conn->users);
1647 if (hcon->type == LE_LINK)
1648 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
1650 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
1652 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
1657 static void l2cap_conn_free(struct kref *ref)
1659 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref);
1661 hci_conn_put(conn->hcon);
1665 void l2cap_conn_get(struct l2cap_conn *conn)
1667 kref_get(&conn->ref);
1669 EXPORT_SYMBOL(l2cap_conn_get);
1671 void l2cap_conn_put(struct l2cap_conn *conn)
1673 kref_put(&conn->ref, l2cap_conn_free);
1675 EXPORT_SYMBOL(l2cap_conn_put);
1677 /* ---- Socket interface ---- */
1679 /* Find socket with psm and source / destination bdaddr.
1680 * Returns closest match.
1682 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1686 struct l2cap_chan *c, *c1 = NULL;
1688 read_lock(&chan_list_lock);
1690 list_for_each_entry(c, &chan_list, global_l) {
1691 struct sock *sk = c->sk;
1693 if (state && c->state != state)
1696 if (c->psm == psm) {
1697 int src_match, dst_match;
1698 int src_any, dst_any;
1701 src_match = !bacmp(&bt_sk(sk)->src, src);
1702 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1703 if (src_match && dst_match) {
1704 read_unlock(&chan_list_lock);
1709 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1710 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1711 if ((src_match && dst_any) || (src_any && dst_match) ||
1712 (src_any && dst_any))
1717 read_unlock(&chan_list_lock);
1722 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1723 bdaddr_t *dst, u8 dst_type)
1725 struct sock *sk = chan->sk;
1726 bdaddr_t *src = &bt_sk(sk)->src;
1727 struct l2cap_conn *conn;
1728 struct hci_conn *hcon;
1729 struct hci_dev *hdev;
1733 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", src, dst,
1734 dst_type, __le16_to_cpu(psm));
1736 hdev = hci_get_route(dst, src);
1738 return -EHOSTUNREACH;
1742 l2cap_chan_lock(chan);
1744 /* PSM must be odd and lsb of upper byte must be 0 */
1745 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1746 chan->chan_type != L2CAP_CHAN_RAW) {
1751 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1756 switch (chan->mode) {
1757 case L2CAP_MODE_BASIC:
1759 case L2CAP_MODE_ERTM:
1760 case L2CAP_MODE_STREAMING:
1769 switch (chan->state) {
1773 /* Already connecting */
1778 /* Already connected */
1792 /* Set destination address and psm */
1794 bacpy(&bt_sk(sk)->dst, dst);
1800 auth_type = l2cap_get_auth_type(chan);
1802 if (bdaddr_type_is_le(dst_type))
1803 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
1804 chan->sec_level, auth_type);
1806 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
1807 chan->sec_level, auth_type);
1810 err = PTR_ERR(hcon);
1814 conn = l2cap_conn_add(hcon);
1816 hci_conn_drop(hcon);
1821 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) {
1822 hci_conn_drop(hcon);
1827 /* Update source addr of the socket */
1828 bacpy(src, conn->src);
1830 l2cap_chan_unlock(chan);
1831 l2cap_chan_add(conn, chan);
1832 l2cap_chan_lock(chan);
1834 /* l2cap_chan_add takes its own ref so we can drop this one */
1835 hci_conn_drop(hcon);
1837 l2cap_state_change(chan, BT_CONNECT);
1838 __set_chan_timer(chan, sk->sk_sndtimeo);
1840 if (hcon->state == BT_CONNECTED) {
1841 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
1842 __clear_chan_timer(chan);
1843 if (l2cap_chan_check_security(chan))
1844 l2cap_state_change(chan, BT_CONNECTED);
1846 l2cap_do_start(chan);
1852 l2cap_chan_unlock(chan);
1853 hci_dev_unlock(hdev);
1858 int __l2cap_wait_ack(struct sock *sk)
1860 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1861 DECLARE_WAITQUEUE(wait, current);
1865 add_wait_queue(sk_sleep(sk), &wait);
1866 set_current_state(TASK_INTERRUPTIBLE);
1867 while (chan->unacked_frames > 0 && chan->conn) {
1871 if (signal_pending(current)) {
1872 err = sock_intr_errno(timeo);
1877 timeo = schedule_timeout(timeo);
1879 set_current_state(TASK_INTERRUPTIBLE);
1881 err = sock_error(sk);
1885 set_current_state(TASK_RUNNING);
1886 remove_wait_queue(sk_sleep(sk), &wait);
1890 static void l2cap_monitor_timeout(struct work_struct *work)
1892 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1893 monitor_timer.work);
1895 BT_DBG("chan %p", chan);
1897 l2cap_chan_lock(chan);
1900 l2cap_chan_unlock(chan);
1901 l2cap_chan_put(chan);
1905 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
1907 l2cap_chan_unlock(chan);
1908 l2cap_chan_put(chan);
1911 static void l2cap_retrans_timeout(struct work_struct *work)
1913 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1914 retrans_timer.work);
1916 BT_DBG("chan %p", chan);
1918 l2cap_chan_lock(chan);
1921 l2cap_chan_unlock(chan);
1922 l2cap_chan_put(chan);
1926 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
1927 l2cap_chan_unlock(chan);
1928 l2cap_chan_put(chan);
1931 static void l2cap_streaming_send(struct l2cap_chan *chan,
1932 struct sk_buff_head *skbs)
1934 struct sk_buff *skb;
1935 struct l2cap_ctrl *control;
1937 BT_DBG("chan %p, skbs %p", chan, skbs);
1939 if (__chan_is_moving(chan))
1942 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1944 while (!skb_queue_empty(&chan->tx_q)) {
1946 skb = skb_dequeue(&chan->tx_q);
1948 bt_cb(skb)->control.retries = 1;
1949 control = &bt_cb(skb)->control;
1951 control->reqseq = 0;
1952 control->txseq = chan->next_tx_seq;
1954 __pack_control(chan, control, skb);
1956 if (chan->fcs == L2CAP_FCS_CRC16) {
1957 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1958 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
1961 l2cap_do_send(chan, skb);
1963 BT_DBG("Sent txseq %u", control->txseq);
1965 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1966 chan->frames_sent++;
1970 static int l2cap_ertm_send(struct l2cap_chan *chan)
1972 struct sk_buff *skb, *tx_skb;
1973 struct l2cap_ctrl *control;
1976 BT_DBG("chan %p", chan);
1978 if (chan->state != BT_CONNECTED)
1981 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1984 if (__chan_is_moving(chan))
1987 while (chan->tx_send_head &&
1988 chan->unacked_frames < chan->remote_tx_win &&
1989 chan->tx_state == L2CAP_TX_STATE_XMIT) {
1991 skb = chan->tx_send_head;
1993 bt_cb(skb)->control.retries = 1;
1994 control = &bt_cb(skb)->control;
1996 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1999 control->reqseq = chan->buffer_seq;
2000 chan->last_acked_seq = chan->buffer_seq;
2001 control->txseq = chan->next_tx_seq;
2003 __pack_control(chan, control, skb);
2005 if (chan->fcs == L2CAP_FCS_CRC16) {
2006 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
2007 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
2010 /* Clone after data has been modified. Data is assumed to be
2011 read-only (for locking purposes) on cloned sk_buffs.
2013 tx_skb = skb_clone(skb, GFP_KERNEL);
2018 __set_retrans_timer(chan);
2020 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
2021 chan->unacked_frames++;
2022 chan->frames_sent++;
2025 if (skb_queue_is_last(&chan->tx_q, skb))
2026 chan->tx_send_head = NULL;
2028 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
2030 l2cap_do_send(chan, tx_skb);
2031 BT_DBG("Sent txseq %u", control->txseq);
2034 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
2035 chan->unacked_frames, skb_queue_len(&chan->tx_q));
2040 static void l2cap_ertm_resend(struct l2cap_chan *chan)
2042 struct l2cap_ctrl control;
2043 struct sk_buff *skb;
2044 struct sk_buff *tx_skb;
2047 BT_DBG("chan %p", chan);
2049 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2052 if (__chan_is_moving(chan))
2055 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
2056 seq = l2cap_seq_list_pop(&chan->retrans_list);
2058 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
2060 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2065 bt_cb(skb)->control.retries++;
2066 control = bt_cb(skb)->control;
2068 if (chan->max_tx != 0 &&
2069 bt_cb(skb)->control.retries > chan->max_tx) {
2070 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
2071 l2cap_send_disconn_req(chan, ECONNRESET);
2072 l2cap_seq_list_clear(&chan->retrans_list);
2076 control.reqseq = chan->buffer_seq;
2077 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
2082 if (skb_cloned(skb)) {
2083 /* Cloned sk_buffs are read-only, so we need a
2086 tx_skb = skb_copy(skb, GFP_KERNEL);
2088 tx_skb = skb_clone(skb, GFP_KERNEL);
2092 l2cap_seq_list_clear(&chan->retrans_list);
2096 /* Update skb contents */
2097 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
2098 put_unaligned_le32(__pack_extended_control(&control),
2099 tx_skb->data + L2CAP_HDR_SIZE);
2101 put_unaligned_le16(__pack_enhanced_control(&control),
2102 tx_skb->data + L2CAP_HDR_SIZE);
2105 if (chan->fcs == L2CAP_FCS_CRC16) {
2106 u16 fcs = crc16(0, (u8 *) tx_skb->data, tx_skb->len);
2107 put_unaligned_le16(fcs, skb_put(tx_skb,
2111 l2cap_do_send(chan, tx_skb);
2113 BT_DBG("Resent txseq %d", control.txseq);
2115 chan->last_acked_seq = chan->buffer_seq;
2119 static void l2cap_retransmit(struct l2cap_chan *chan,
2120 struct l2cap_ctrl *control)
2122 BT_DBG("chan %p, control %p", chan, control);
2124 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2125 l2cap_ertm_resend(chan);
2128 static void l2cap_retransmit_all(struct l2cap_chan *chan,
2129 struct l2cap_ctrl *control)
2131 struct sk_buff *skb;
2133 BT_DBG("chan %p, control %p", chan, control);
2136 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2138 l2cap_seq_list_clear(&chan->retrans_list);
2140 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2143 if (chan->unacked_frames) {
2144 skb_queue_walk(&chan->tx_q, skb) {
2145 if (bt_cb(skb)->control.txseq == control->reqseq ||
2146 skb == chan->tx_send_head)
2150 skb_queue_walk_from(&chan->tx_q, skb) {
2151 if (skb == chan->tx_send_head)
2154 l2cap_seq_list_append(&chan->retrans_list,
2155 bt_cb(skb)->control.txseq);
2158 l2cap_ertm_resend(chan);
2162 static void l2cap_send_ack(struct l2cap_chan *chan)
2164 struct l2cap_ctrl control;
2165 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2166 chan->last_acked_seq);
2169 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2170 chan, chan->last_acked_seq, chan->buffer_seq);
2172 memset(&control, 0, sizeof(control));
2175 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2176 chan->rx_state == L2CAP_RX_STATE_RECV) {
2177 __clear_ack_timer(chan);
2178 control.super = L2CAP_SUPER_RNR;
2179 control.reqseq = chan->buffer_seq;
2180 l2cap_send_sframe(chan, &control);
2182 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2183 l2cap_ertm_send(chan);
2184 /* If any i-frames were sent, they included an ack */
2185 if (chan->buffer_seq == chan->last_acked_seq)
2189 /* Ack now if the window is 3/4ths full.
2190 * Calculate without mul or div
2192 threshold = chan->ack_win;
2193 threshold += threshold << 1;
2196 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
2199 if (frames_to_ack >= threshold) {
2200 __clear_ack_timer(chan);
2201 control.super = L2CAP_SUPER_RR;
2202 control.reqseq = chan->buffer_seq;
2203 l2cap_send_sframe(chan, &control);
2208 __set_ack_timer(chan);
2212 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2213 struct msghdr *msg, int len,
2214 int count, struct sk_buff *skb)
2216 struct l2cap_conn *conn = chan->conn;
2217 struct sk_buff **frag;
2220 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
2226 /* Continuation fragments (no L2CAP header) */
2227 frag = &skb_shinfo(skb)->frag_list;
2229 struct sk_buff *tmp;
2231 count = min_t(unsigned int, conn->mtu, len);
2233 tmp = chan->ops->alloc_skb(chan, count,
2234 msg->msg_flags & MSG_DONTWAIT);
2236 return PTR_ERR(tmp);
2240 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
2243 (*frag)->priority = skb->priority;
2248 skb->len += (*frag)->len;
2249 skb->data_len += (*frag)->len;
2251 frag = &(*frag)->next;
2257 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
2258 struct msghdr *msg, size_t len,
2261 struct l2cap_conn *conn = chan->conn;
2262 struct sk_buff *skb;
2263 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
2264 struct l2cap_hdr *lh;
2266 BT_DBG("chan %p len %zu priority %u", chan, len, priority);
2268 count = min_t(unsigned int, (conn->mtu - hlen), len);
2270 skb = chan->ops->alloc_skb(chan, count + hlen,
2271 msg->msg_flags & MSG_DONTWAIT);
2275 skb->priority = priority;
2277 /* Create L2CAP header */
2278 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2279 lh->cid = cpu_to_le16(chan->dcid);
2280 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2281 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
2283 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2284 if (unlikely(err < 0)) {
2286 return ERR_PTR(err);
2291 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2292 struct msghdr *msg, size_t len,
2295 struct l2cap_conn *conn = chan->conn;
2296 struct sk_buff *skb;
2298 struct l2cap_hdr *lh;
2300 BT_DBG("chan %p len %zu", chan, len);
2302 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2304 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
2305 msg->msg_flags & MSG_DONTWAIT);
2309 skb->priority = priority;
2311 /* Create L2CAP header */
2312 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2313 lh->cid = cpu_to_le16(chan->dcid);
2314 lh->len = cpu_to_le16(len);
2316 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2317 if (unlikely(err < 0)) {
2319 return ERR_PTR(err);
2324 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2325 struct msghdr *msg, size_t len,
2328 struct l2cap_conn *conn = chan->conn;
2329 struct sk_buff *skb;
2330 int err, count, hlen;
2331 struct l2cap_hdr *lh;
2333 BT_DBG("chan %p len %zu", chan, len);
2336 return ERR_PTR(-ENOTCONN);
2338 hlen = __ertm_hdr_size(chan);
2341 hlen += L2CAP_SDULEN_SIZE;
2343 if (chan->fcs == L2CAP_FCS_CRC16)
2344 hlen += L2CAP_FCS_SIZE;
2346 count = min_t(unsigned int, (conn->mtu - hlen), len);
2348 skb = chan->ops->alloc_skb(chan, count + hlen,
2349 msg->msg_flags & MSG_DONTWAIT);
2353 /* Create L2CAP header */
2354 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2355 lh->cid = cpu_to_le16(chan->dcid);
2356 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
2358 /* Control header is populated later */
2359 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2360 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2362 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
2365 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
2367 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
2368 if (unlikely(err < 0)) {
2370 return ERR_PTR(err);
2373 bt_cb(skb)->control.fcs = chan->fcs;
2374 bt_cb(skb)->control.retries = 0;
2378 static int l2cap_segment_sdu(struct l2cap_chan *chan,
2379 struct sk_buff_head *seg_queue,
2380 struct msghdr *msg, size_t len)
2382 struct sk_buff *skb;
2387 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
2389 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2390 * so fragmented skbs are not used. The HCI layer's handling
2391 * of fragmented skbs is not compatible with ERTM's queueing.
2394 /* PDU size is derived from the HCI MTU */
2395 pdu_len = chan->conn->mtu;
2397 /* Constrain PDU size for BR/EDR connections */
2399 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2401 /* Adjust for largest possible L2CAP overhead. */
2403 pdu_len -= L2CAP_FCS_SIZE;
2405 pdu_len -= __ertm_hdr_size(chan);
2407 /* Remote device may have requested smaller PDUs */
2408 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2410 if (len <= pdu_len) {
2411 sar = L2CAP_SAR_UNSEGMENTED;
2415 sar = L2CAP_SAR_START;
2417 pdu_len -= L2CAP_SDULEN_SIZE;
2421 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
2424 __skb_queue_purge(seg_queue);
2425 return PTR_ERR(skb);
2428 bt_cb(skb)->control.sar = sar;
2429 __skb_queue_tail(seg_queue, skb);
2434 pdu_len += L2CAP_SDULEN_SIZE;
2437 if (len <= pdu_len) {
2438 sar = L2CAP_SAR_END;
2441 sar = L2CAP_SAR_CONTINUE;
2448 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2451 struct sk_buff *skb;
2453 struct sk_buff_head seg_queue;
2455 /* Connectionless channel */
2456 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
2457 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
2459 return PTR_ERR(skb);
2461 l2cap_do_send(chan, skb);
2465 switch (chan->mode) {
2466 case L2CAP_MODE_BASIC:
2467 /* Check outgoing MTU */
2468 if (len > chan->omtu)
2471 /* Create a basic PDU */
2472 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
2474 return PTR_ERR(skb);
2476 l2cap_do_send(chan, skb);
2480 case L2CAP_MODE_ERTM:
2481 case L2CAP_MODE_STREAMING:
2482 /* Check outgoing MTU */
2483 if (len > chan->omtu) {
2488 __skb_queue_head_init(&seg_queue);
2490 /* Do segmentation before calling in to the state machine,
2491 * since it's possible to block while waiting for memory
2494 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
2496 /* The channel could have been closed while segmenting,
2497 * check that it is still connected.
2499 if (chan->state != BT_CONNECTED) {
2500 __skb_queue_purge(&seg_queue);
2507 if (chan->mode == L2CAP_MODE_ERTM)
2508 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
2510 l2cap_streaming_send(chan, &seg_queue);
2514 /* If the skbs were not queued for sending, they'll still be in
2515 * seg_queue and need to be purged.
2517 __skb_queue_purge(&seg_queue);
2521 BT_DBG("bad state %1.1x", chan->mode);
2528 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2530 struct l2cap_ctrl control;
2533 BT_DBG("chan %p, txseq %u", chan, txseq);
2535 memset(&control, 0, sizeof(control));
2537 control.super = L2CAP_SUPER_SREJ;
2539 for (seq = chan->expected_tx_seq; seq != txseq;
2540 seq = __next_seq(chan, seq)) {
2541 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2542 control.reqseq = seq;
2543 l2cap_send_sframe(chan, &control);
2544 l2cap_seq_list_append(&chan->srej_list, seq);
2548 chan->expected_tx_seq = __next_seq(chan, txseq);
2551 static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2553 struct l2cap_ctrl control;
2555 BT_DBG("chan %p", chan);
2557 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2560 memset(&control, 0, sizeof(control));
2562 control.super = L2CAP_SUPER_SREJ;
2563 control.reqseq = chan->srej_list.tail;
2564 l2cap_send_sframe(chan, &control);
2567 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2569 struct l2cap_ctrl control;
2573 BT_DBG("chan %p, txseq %u", chan, txseq);
2575 memset(&control, 0, sizeof(control));
2577 control.super = L2CAP_SUPER_SREJ;
2579 /* Capture initial list head to allow only one pass through the list. */
2580 initial_head = chan->srej_list.head;
2583 seq = l2cap_seq_list_pop(&chan->srej_list);
2584 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2587 control.reqseq = seq;
2588 l2cap_send_sframe(chan, &control);
2589 l2cap_seq_list_append(&chan->srej_list, seq);
2590 } while (chan->srej_list.head != initial_head);
2593 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2595 struct sk_buff *acked_skb;
2598 BT_DBG("chan %p, reqseq %u", chan, reqseq);
2600 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2603 BT_DBG("expected_ack_seq %u, unacked_frames %u",
2604 chan->expected_ack_seq, chan->unacked_frames);
2606 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2607 ackseq = __next_seq(chan, ackseq)) {
2609 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2611 skb_unlink(acked_skb, &chan->tx_q);
2612 kfree_skb(acked_skb);
2613 chan->unacked_frames--;
2617 chan->expected_ack_seq = reqseq;
2619 if (chan->unacked_frames == 0)
2620 __clear_retrans_timer(chan);
2622 BT_DBG("unacked_frames %u", chan->unacked_frames);
2625 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2627 BT_DBG("chan %p", chan);
2629 chan->expected_tx_seq = chan->buffer_seq;
2630 l2cap_seq_list_clear(&chan->srej_list);
2631 skb_queue_purge(&chan->srej_q);
2632 chan->rx_state = L2CAP_RX_STATE_RECV;
2635 static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2636 struct l2cap_ctrl *control,
2637 struct sk_buff_head *skbs, u8 event)
2639 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2643 case L2CAP_EV_DATA_REQUEST:
2644 if (chan->tx_send_head == NULL)
2645 chan->tx_send_head = skb_peek(skbs);
2647 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2648 l2cap_ertm_send(chan);
2650 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2651 BT_DBG("Enter LOCAL_BUSY");
2652 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2654 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2655 /* The SREJ_SENT state must be aborted if we are to
2656 * enter the LOCAL_BUSY state.
2658 l2cap_abort_rx_srej_sent(chan);
2661 l2cap_send_ack(chan);
2664 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2665 BT_DBG("Exit LOCAL_BUSY");
2666 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2668 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2669 struct l2cap_ctrl local_control;
2671 memset(&local_control, 0, sizeof(local_control));
2672 local_control.sframe = 1;
2673 local_control.super = L2CAP_SUPER_RR;
2674 local_control.poll = 1;
2675 local_control.reqseq = chan->buffer_seq;
2676 l2cap_send_sframe(chan, &local_control);
2678 chan->retry_count = 1;
2679 __set_monitor_timer(chan);
2680 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2683 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2684 l2cap_process_reqseq(chan, control->reqseq);
2686 case L2CAP_EV_EXPLICIT_POLL:
2687 l2cap_send_rr_or_rnr(chan, 1);
2688 chan->retry_count = 1;
2689 __set_monitor_timer(chan);
2690 __clear_ack_timer(chan);
2691 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2693 case L2CAP_EV_RETRANS_TO:
2694 l2cap_send_rr_or_rnr(chan, 1);
2695 chan->retry_count = 1;
2696 __set_monitor_timer(chan);
2697 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2699 case L2CAP_EV_RECV_FBIT:
2700 /* Nothing to process */
2707 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2708 struct l2cap_ctrl *control,
2709 struct sk_buff_head *skbs, u8 event)
2711 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2715 case L2CAP_EV_DATA_REQUEST:
2716 if (chan->tx_send_head == NULL)
2717 chan->tx_send_head = skb_peek(skbs);
2718 /* Queue data, but don't send. */
2719 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2721 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2722 BT_DBG("Enter LOCAL_BUSY");
2723 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2725 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2726 /* The SREJ_SENT state must be aborted if we are to
2727 * enter the LOCAL_BUSY state.
2729 l2cap_abort_rx_srej_sent(chan);
2732 l2cap_send_ack(chan);
2735 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2736 BT_DBG("Exit LOCAL_BUSY");
2737 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2739 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2740 struct l2cap_ctrl local_control;
2741 memset(&local_control, 0, sizeof(local_control));
2742 local_control.sframe = 1;
2743 local_control.super = L2CAP_SUPER_RR;
2744 local_control.poll = 1;
2745 local_control.reqseq = chan->buffer_seq;
2746 l2cap_send_sframe(chan, &local_control);
2748 chan->retry_count = 1;
2749 __set_monitor_timer(chan);
2750 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2753 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2754 l2cap_process_reqseq(chan, control->reqseq);
2758 case L2CAP_EV_RECV_FBIT:
2759 if (control && control->final) {
2760 __clear_monitor_timer(chan);
2761 if (chan->unacked_frames > 0)
2762 __set_retrans_timer(chan);
2763 chan->retry_count = 0;
2764 chan->tx_state = L2CAP_TX_STATE_XMIT;
2765 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2768 case L2CAP_EV_EXPLICIT_POLL:
2771 case L2CAP_EV_MONITOR_TO:
2772 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2773 l2cap_send_rr_or_rnr(chan, 1);
2774 __set_monitor_timer(chan);
2775 chan->retry_count++;
2777 l2cap_send_disconn_req(chan, ECONNABORTED);
2785 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2786 struct sk_buff_head *skbs, u8 event)
2788 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2789 chan, control, skbs, event, chan->tx_state);
2791 switch (chan->tx_state) {
2792 case L2CAP_TX_STATE_XMIT:
2793 l2cap_tx_state_xmit(chan, control, skbs, event);
2795 case L2CAP_TX_STATE_WAIT_F:
2796 l2cap_tx_state_wait_f(chan, control, skbs, event);
2804 static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2805 struct l2cap_ctrl *control)
2807 BT_DBG("chan %p, control %p", chan, control);
2808 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
2811 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2812 struct l2cap_ctrl *control)
2814 BT_DBG("chan %p, control %p", chan, control);
2815 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
2818 /* Copy frame to all raw sockets on that connection */
2819 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2821 struct sk_buff *nskb;
2822 struct l2cap_chan *chan;
2824 BT_DBG("conn %p", conn);
2826 mutex_lock(&conn->chan_lock);
2828 list_for_each_entry(chan, &conn->chan_l, list) {
2829 struct sock *sk = chan->sk;
2830 if (chan->chan_type != L2CAP_CHAN_RAW)
2833 /* Don't send frame to the socket it came from */
2836 nskb = skb_clone(skb, GFP_KERNEL);
2840 if (chan->ops->recv(chan, nskb))
2844 mutex_unlock(&conn->chan_lock);
2847 /* ---- L2CAP signalling commands ---- */
2848 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2849 u8 ident, u16 dlen, void *data)
2851 struct sk_buff *skb, **frag;
2852 struct l2cap_cmd_hdr *cmd;
2853 struct l2cap_hdr *lh;
2856 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2857 conn, code, ident, dlen);
2859 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE)
2862 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2863 count = min_t(unsigned int, conn->mtu, len);
2865 skb = bt_skb_alloc(count, GFP_KERNEL);
2869 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
2870 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
2872 if (conn->hcon->type == LE_LINK)
2873 lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2875 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
2877 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2880 cmd->len = cpu_to_le16(dlen);
2883 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2884 memcpy(skb_put(skb, count), data, count);
2890 /* Continuation fragments (no L2CAP header) */
2891 frag = &skb_shinfo(skb)->frag_list;
2893 count = min_t(unsigned int, conn->mtu, len);
2895 *frag = bt_skb_alloc(count, GFP_KERNEL);
2899 memcpy(skb_put(*frag, count), data, count);
2904 frag = &(*frag)->next;
2914 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2917 struct l2cap_conf_opt *opt = *ptr;
2920 len = L2CAP_CONF_OPT_SIZE + opt->len;
2928 *val = *((u8 *) opt->val);
2932 *val = get_unaligned_le16(opt->val);
2936 *val = get_unaligned_le32(opt->val);
2940 *val = (unsigned long) opt->val;
2944 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
2948 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2950 struct l2cap_conf_opt *opt = *ptr;
2952 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
2959 *((u8 *) opt->val) = val;
2963 put_unaligned_le16(val, opt->val);
2967 put_unaligned_le32(val, opt->val);
2971 memcpy(opt->val, (void *) val, len);
2975 *ptr += L2CAP_CONF_OPT_SIZE + len;
2978 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2980 struct l2cap_conf_efs efs;
2982 switch (chan->mode) {
2983 case L2CAP_MODE_ERTM:
2984 efs.id = chan->local_id;
2985 efs.stype = chan->local_stype;
2986 efs.msdu = cpu_to_le16(chan->local_msdu);
2987 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2988 efs.acc_lat = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2989 efs.flush_to = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
2992 case L2CAP_MODE_STREAMING:
2994 efs.stype = L2CAP_SERV_BESTEFFORT;
2995 efs.msdu = cpu_to_le16(chan->local_msdu);
2996 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
3005 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
3006 (unsigned long) &efs);
3009 static void l2cap_ack_timeout(struct work_struct *work)
3011 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
3015 BT_DBG("chan %p", chan);
3017 l2cap_chan_lock(chan);
3019 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
3020 chan->last_acked_seq);
3023 l2cap_send_rr_or_rnr(chan, 0);
3025 l2cap_chan_unlock(chan);
3026 l2cap_chan_put(chan);
3029 int l2cap_ertm_init(struct l2cap_chan *chan)
3033 chan->next_tx_seq = 0;
3034 chan->expected_tx_seq = 0;
3035 chan->expected_ack_seq = 0;
3036 chan->unacked_frames = 0;
3037 chan->buffer_seq = 0;
3038 chan->frames_sent = 0;
3039 chan->last_acked_seq = 0;
3041 chan->sdu_last_frag = NULL;
3044 skb_queue_head_init(&chan->tx_q);
3046 chan->local_amp_id = 0;
3048 chan->move_state = L2CAP_MOVE_STABLE;
3049 chan->move_role = L2CAP_MOVE_ROLE_NONE;
3051 if (chan->mode != L2CAP_MODE_ERTM)
3054 chan->rx_state = L2CAP_RX_STATE_RECV;
3055 chan->tx_state = L2CAP_TX_STATE_XMIT;
3057 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
3058 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
3059 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
3061 skb_queue_head_init(&chan->srej_q);
3063 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
3067 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
3069 l2cap_seq_list_free(&chan->srej_list);
3074 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
3077 case L2CAP_MODE_STREAMING:
3078 case L2CAP_MODE_ERTM:
3079 if (l2cap_mode_supported(mode, remote_feat_mask))
3083 return L2CAP_MODE_BASIC;
3087 static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
3089 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
3092 static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
3094 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
3097 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
3098 struct l2cap_conf_rfc *rfc)
3100 if (chan->local_amp_id && chan->hs_hcon) {
3101 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
3103 /* Class 1 devices have must have ERTM timeouts
3104 * exceeding the Link Supervision Timeout. The
3105 * default Link Supervision Timeout for AMP
3106 * controllers is 10 seconds.
3108 * Class 1 devices use 0xffffffff for their
3109 * best-effort flush timeout, so the clamping logic
3110 * will result in a timeout that meets the above
3111 * requirement. ERTM timeouts are 16-bit values, so
3112 * the maximum timeout is 65.535 seconds.
3115 /* Convert timeout to milliseconds and round */
3116 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
3118 /* This is the recommended formula for class 2 devices
3119 * that start ERTM timers when packets are sent to the
3122 ertm_to = 3 * ertm_to + 500;
3124 if (ertm_to > 0xffff)
3127 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3128 rfc->monitor_timeout = rfc->retrans_timeout;
3130 rfc->retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3131 rfc->monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3135 static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3137 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
3138 __l2cap_ews_supported(chan)) {
3139 /* use extended control field */
3140 set_bit(FLAG_EXT_CTRL, &chan->flags);
3141 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3143 chan->tx_win = min_t(u16, chan->tx_win,
3144 L2CAP_DEFAULT_TX_WINDOW);
3145 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3147 chan->ack_win = chan->tx_win;
3150 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
3152 struct l2cap_conf_req *req = data;
3153 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
3154 void *ptr = req->data;
3157 BT_DBG("chan %p", chan);
3159 if (chan->num_conf_req || chan->num_conf_rsp)
3162 switch (chan->mode) {
3163 case L2CAP_MODE_STREAMING:
3164 case L2CAP_MODE_ERTM:
3165 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
3168 if (__l2cap_efs_supported(chan))
3169 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3173 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
3178 if (chan->imtu != L2CAP_DEFAULT_MTU)
3179 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
3181 switch (chan->mode) {
3182 case L2CAP_MODE_BASIC:
3183 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
3184 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
3187 rfc.mode = L2CAP_MODE_BASIC;
3189 rfc.max_transmit = 0;
3190 rfc.retrans_timeout = 0;
3191 rfc.monitor_timeout = 0;
3192 rfc.max_pdu_size = 0;
3194 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3195 (unsigned long) &rfc);
3198 case L2CAP_MODE_ERTM:
3199 rfc.mode = L2CAP_MODE_ERTM;
3200 rfc.max_transmit = chan->max_tx;
3202 __l2cap_set_ertm_timeouts(chan, &rfc);
3204 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3205 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3207 rfc.max_pdu_size = cpu_to_le16(size);
3209 l2cap_txwin_setup(chan);
3211 rfc.txwin_size = min_t(u16, chan->tx_win,
3212 L2CAP_DEFAULT_TX_WINDOW);
3214 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3215 (unsigned long) &rfc);
3217 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3218 l2cap_add_opt_efs(&ptr, chan);
3220 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3221 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3224 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3225 if (chan->fcs == L2CAP_FCS_NONE ||
3226 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3227 chan->fcs = L2CAP_FCS_NONE;
3228 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3233 case L2CAP_MODE_STREAMING:
3234 l2cap_txwin_setup(chan);
3235 rfc.mode = L2CAP_MODE_STREAMING;
3237 rfc.max_transmit = 0;
3238 rfc.retrans_timeout = 0;
3239 rfc.monitor_timeout = 0;
3241 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
3242 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3244 rfc.max_pdu_size = cpu_to_le16(size);
3246 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3247 (unsigned long) &rfc);
3249 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3250 l2cap_add_opt_efs(&ptr, chan);
3252 if (chan->conn->feat_mask & L2CAP_FEAT_FCS)
3253 if (chan->fcs == L2CAP_FCS_NONE ||
3254 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) {
3255 chan->fcs = L2CAP_FCS_NONE;
3256 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1,
3262 req->dcid = cpu_to_le16(chan->dcid);
3263 req->flags = __constant_cpu_to_le16(0);
3268 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
3270 struct l2cap_conf_rsp *rsp = data;
3271 void *ptr = rsp->data;
3272 void *req = chan->conf_req;
3273 int len = chan->conf_len;
3274 int type, hint, olen;
3276 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3277 struct l2cap_conf_efs efs;
3279 u16 mtu = L2CAP_DEFAULT_MTU;
3280 u16 result = L2CAP_CONF_SUCCESS;
3283 BT_DBG("chan %p", chan);
3285 while (len >= L2CAP_CONF_OPT_SIZE) {
3286 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
3288 hint = type & L2CAP_CONF_HINT;
3289 type &= L2CAP_CONF_MASK;
3292 case L2CAP_CONF_MTU:
3296 case L2CAP_CONF_FLUSH_TO:
3297 chan->flush_to = val;
3300 case L2CAP_CONF_QOS:
3303 case L2CAP_CONF_RFC:
3304 if (olen == sizeof(rfc))
3305 memcpy(&rfc, (void *) val, olen);
3308 case L2CAP_CONF_FCS:
3309 if (val == L2CAP_FCS_NONE)
3310 set_bit(CONF_RECV_NO_FCS, &chan->conf_state);
3313 case L2CAP_CONF_EFS:
3315 if (olen == sizeof(efs))
3316 memcpy(&efs, (void *) val, olen);
3319 case L2CAP_CONF_EWS:
3321 return -ECONNREFUSED;
3323 set_bit(FLAG_EXT_CTRL, &chan->flags);
3324 set_bit(CONF_EWS_RECV, &chan->conf_state);
3325 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3326 chan->remote_tx_win = val;
3333 result = L2CAP_CONF_UNKNOWN;
3334 *((u8 *) ptr++) = type;
3339 if (chan->num_conf_rsp || chan->num_conf_req > 1)
3342 switch (chan->mode) {
3343 case L2CAP_MODE_STREAMING:
3344 case L2CAP_MODE_ERTM:
3345 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
3346 chan->mode = l2cap_select_mode(rfc.mode,
3347 chan->conn->feat_mask);
3352 if (__l2cap_efs_supported(chan))
3353 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3355 return -ECONNREFUSED;
3358 if (chan->mode != rfc.mode)
3359 return -ECONNREFUSED;
3365 if (chan->mode != rfc.mode) {
3366 result = L2CAP_CONF_UNACCEPT;
3367 rfc.mode = chan->mode;
3369 if (chan->num_conf_rsp == 1)
3370 return -ECONNREFUSED;
3372 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3373 (unsigned long) &rfc);
3376 if (result == L2CAP_CONF_SUCCESS) {
3377 /* Configure output options and let the other side know
3378 * which ones we don't like. */
3380 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3381 result = L2CAP_CONF_UNACCEPT;
3384 set_bit(CONF_MTU_DONE, &chan->conf_state);
3386 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
3389 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3390 efs.stype != L2CAP_SERV_NOTRAFIC &&
3391 efs.stype != chan->local_stype) {
3393 result = L2CAP_CONF_UNACCEPT;
3395 if (chan->num_conf_req >= 1)
3396 return -ECONNREFUSED;
3398 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3400 (unsigned long) &efs);
3402 /* Send PENDING Conf Rsp */
3403 result = L2CAP_CONF_PENDING;
3404 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3409 case L2CAP_MODE_BASIC:
3410 chan->fcs = L2CAP_FCS_NONE;
3411 set_bit(CONF_MODE_DONE, &chan->conf_state);
3414 case L2CAP_MODE_ERTM:
3415 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3416 chan->remote_tx_win = rfc.txwin_size;
3418 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
3420 chan->remote_max_tx = rfc.max_transmit;
3422 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3423 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3424 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3425 rfc.max_pdu_size = cpu_to_le16(size);
3426 chan->remote_mps = size;
3428 __l2cap_set_ertm_timeouts(chan, &rfc);
3430 set_bit(CONF_MODE_DONE, &chan->conf_state);
3432 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3433 sizeof(rfc), (unsigned long) &rfc);
3435 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3436 chan->remote_id = efs.id;
3437 chan->remote_stype = efs.stype;
3438 chan->remote_msdu = le16_to_cpu(efs.msdu);
3439 chan->remote_flush_to =
3440 le32_to_cpu(efs.flush_to);
3441 chan->remote_acc_lat =
3442 le32_to_cpu(efs.acc_lat);
3443 chan->remote_sdu_itime =
3444 le32_to_cpu(efs.sdu_itime);
3445 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3447 (unsigned long) &efs);
3451 case L2CAP_MODE_STREAMING:
3452 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3453 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3454 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
3455 rfc.max_pdu_size = cpu_to_le16(size);
3456 chan->remote_mps = size;
3458 set_bit(CONF_MODE_DONE, &chan->conf_state);
3460 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3461 (unsigned long) &rfc);
3466 result = L2CAP_CONF_UNACCEPT;
3468 memset(&rfc, 0, sizeof(rfc));
3469 rfc.mode = chan->mode;
3472 if (result == L2CAP_CONF_SUCCESS)
3473 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3475 rsp->scid = cpu_to_le16(chan->dcid);
3476 rsp->result = cpu_to_le16(result);
3477 rsp->flags = __constant_cpu_to_le16(0);
3482 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3483 void *data, u16 *result)
3485 struct l2cap_conf_req *req = data;
3486 void *ptr = req->data;
3489 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
3490 struct l2cap_conf_efs efs;
3492 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
3494 while (len >= L2CAP_CONF_OPT_SIZE) {
3495 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3498 case L2CAP_CONF_MTU:
3499 if (val < L2CAP_DEFAULT_MIN_MTU) {
3500 *result = L2CAP_CONF_UNACCEPT;
3501 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
3504 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
3507 case L2CAP_CONF_FLUSH_TO:
3508 chan->flush_to = val;
3509 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
3513 case L2CAP_CONF_RFC:
3514 if (olen == sizeof(rfc))
3515 memcpy(&rfc, (void *)val, olen);
3517 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
3518 rfc.mode != chan->mode)
3519 return -ECONNREFUSED;
3523 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3524 sizeof(rfc), (unsigned long) &rfc);
3527 case L2CAP_CONF_EWS:
3528 chan->ack_win = min_t(u16, val, chan->ack_win);
3529 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3533 case L2CAP_CONF_EFS:
3534 if (olen == sizeof(efs))
3535 memcpy(&efs, (void *)val, olen);
3537 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3538 efs.stype != L2CAP_SERV_NOTRAFIC &&
3539 efs.stype != chan->local_stype)
3540 return -ECONNREFUSED;
3542 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3543 (unsigned long) &efs);
3546 case L2CAP_CONF_FCS:
3547 if (*result == L2CAP_CONF_PENDING)
3548 if (val == L2CAP_FCS_NONE)
3549 set_bit(CONF_RECV_NO_FCS,
3555 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
3556 return -ECONNREFUSED;
3558 chan->mode = rfc.mode;
3560 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
3562 case L2CAP_MODE_ERTM:
3563 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3564 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3565 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3566 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3567 chan->ack_win = min_t(u16, chan->ack_win,
3570 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3571 chan->local_msdu = le16_to_cpu(efs.msdu);
3572 chan->local_sdu_itime =
3573 le32_to_cpu(efs.sdu_itime);
3574 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3575 chan->local_flush_to =
3576 le32_to_cpu(efs.flush_to);
3580 case L2CAP_MODE_STREAMING:
3581 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3585 req->dcid = cpu_to_le16(chan->dcid);
3586 req->flags = __constant_cpu_to_le16(0);
3591 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3592 u16 result, u16 flags)
3594 struct l2cap_conf_rsp *rsp = data;
3595 void *ptr = rsp->data;
3597 BT_DBG("chan %p", chan);
3599 rsp->scid = cpu_to_le16(chan->dcid);
3600 rsp->result = cpu_to_le16(result);
3601 rsp->flags = cpu_to_le16(flags);
3606 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
3608 struct l2cap_conn_rsp rsp;
3609 struct l2cap_conn *conn = chan->conn;
3613 rsp.scid = cpu_to_le16(chan->dcid);
3614 rsp.dcid = cpu_to_le16(chan->scid);
3615 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
3616 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
3619 rsp_code = L2CAP_CREATE_CHAN_RSP;
3621 rsp_code = L2CAP_CONN_RSP;
3623 BT_DBG("chan %p rsp_code %u", chan, rsp_code);
3625 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp);
3627 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3630 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3631 l2cap_build_conf_req(chan, buf), buf);
3632 chan->num_conf_req++;
3635 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
3639 /* Use sane default values in case a misbehaving remote device
3640 * did not send an RFC or extended window size option.
3642 u16 txwin_ext = chan->ack_win;
3643 struct l2cap_conf_rfc rfc = {
3645 .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3646 .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3647 .max_pdu_size = cpu_to_le16(chan->imtu),
3648 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3651 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
3653 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
3656 while (len >= L2CAP_CONF_OPT_SIZE) {
3657 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3660 case L2CAP_CONF_RFC:
3661 if (olen == sizeof(rfc))
3662 memcpy(&rfc, (void *)val, olen);
3664 case L2CAP_CONF_EWS:
3671 case L2CAP_MODE_ERTM:
3672 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3673 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3674 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3675 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3676 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3678 chan->ack_win = min_t(u16, chan->ack_win,
3681 case L2CAP_MODE_STREAMING:
3682 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3686 static inline int l2cap_command_rej(struct l2cap_conn *conn,
3687 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3690 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
3692 if (cmd_len < sizeof(*rej))
3695 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
3698 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3699 cmd->ident == conn->info_ident) {
3700 cancel_delayed_work(&conn->info_timer);
3702 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3703 conn->info_ident = 0;
3705 l2cap_conn_start(conn);
3711 static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3712 struct l2cap_cmd_hdr *cmd,
3713 u8 *data, u8 rsp_code, u8 amp_id)
3715 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3716 struct l2cap_conn_rsp rsp;
3717 struct l2cap_chan *chan = NULL, *pchan;
3718 struct sock *parent, *sk = NULL;
3719 int result, status = L2CAP_CS_NO_INFO;
3721 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
3722 __le16 psm = req->psm;
3724 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
3726 /* Check if we have socket listening on psm */
3727 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
3729 result = L2CAP_CR_BAD_PSM;
3735 mutex_lock(&conn->chan_lock);
3738 /* Check if the ACL is secure enough (if not SDP) */
3739 if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
3740 !hci_conn_check_link_mode(conn->hcon)) {
3741 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
3742 result = L2CAP_CR_SEC_BLOCK;
3746 result = L2CAP_CR_NO_MEM;
3748 /* Check if we already have channel with that dcid */
3749 if (__l2cap_get_chan_by_dcid(conn, scid))
3752 chan = pchan->ops->new_connection(pchan);
3758 bacpy(&bt_sk(sk)->src, conn->src);
3759 bacpy(&bt_sk(sk)->dst, conn->dst);
3762 chan->local_amp_id = amp_id;
3764 __l2cap_chan_add(conn, chan);
3768 __set_chan_timer(chan, sk->sk_sndtimeo);
3770 chan->ident = cmd->ident;
3772 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
3773 if (l2cap_chan_check_security(chan)) {
3774 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
3775 __l2cap_state_change(chan, BT_CONNECT2);
3776 result = L2CAP_CR_PEND;
3777 status = L2CAP_CS_AUTHOR_PEND;
3778 chan->ops->defer(chan);
3780 /* Force pending result for AMP controllers.
3781 * The connection will succeed after the
3782 * physical link is up.
3785 __l2cap_state_change(chan, BT_CONNECT2);
3786 result = L2CAP_CR_PEND;
3788 __l2cap_state_change(chan, BT_CONFIG);
3789 result = L2CAP_CR_SUCCESS;
3791 status = L2CAP_CS_NO_INFO;
3794 __l2cap_state_change(chan, BT_CONNECT2);
3795 result = L2CAP_CR_PEND;
3796 status = L2CAP_CS_AUTHEN_PEND;
3799 __l2cap_state_change(chan, BT_CONNECT2);
3800 result = L2CAP_CR_PEND;
3801 status = L2CAP_CS_NO_INFO;
3805 release_sock(parent);
3806 mutex_unlock(&conn->chan_lock);
3809 rsp.scid = cpu_to_le16(scid);
3810 rsp.dcid = cpu_to_le16(dcid);
3811 rsp.result = cpu_to_le16(result);
3812 rsp.status = cpu_to_le16(status);
3813 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
3815 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3816 struct l2cap_info_req info;
3817 info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
3819 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3820 conn->info_ident = l2cap_get_ident(conn);
3822 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
3824 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3825 sizeof(info), &info);
3828 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
3829 result == L2CAP_CR_SUCCESS) {
3831 set_bit(CONF_REQ_SENT, &chan->conf_state);
3832 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3833 l2cap_build_conf_req(chan, buf), buf);
3834 chan->num_conf_req++;
3840 static int l2cap_connect_req(struct l2cap_conn *conn,
3841 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3843 struct hci_dev *hdev = conn->hcon->hdev;
3844 struct hci_conn *hcon = conn->hcon;
3846 if (cmd_len < sizeof(struct l2cap_conn_req))
3850 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
3851 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
3852 mgmt_device_connected(hdev, &hcon->dst, hcon->type,
3853 hcon->dst_type, 0, NULL, 0,
3855 hci_dev_unlock(hdev);
3857 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
3861 static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
3862 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3865 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3866 u16 scid, dcid, result, status;
3867 struct l2cap_chan *chan;
3871 if (cmd_len < sizeof(*rsp))
3874 scid = __le16_to_cpu(rsp->scid);
3875 dcid = __le16_to_cpu(rsp->dcid);
3876 result = __le16_to_cpu(rsp->result);
3877 status = __le16_to_cpu(rsp->status);
3879 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3880 dcid, scid, result, status);
3882 mutex_lock(&conn->chan_lock);
3885 chan = __l2cap_get_chan_by_scid(conn, scid);
3891 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3900 l2cap_chan_lock(chan);
3903 case L2CAP_CR_SUCCESS:
3904 l2cap_state_change(chan, BT_CONFIG);
3907 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
3909 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
3912 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3913 l2cap_build_conf_req(chan, req), req);
3914 chan->num_conf_req++;
3918 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
3922 l2cap_chan_del(chan, ECONNREFUSED);
3926 l2cap_chan_unlock(chan);
3929 mutex_unlock(&conn->chan_lock);
3934 static inline void set_default_fcs(struct l2cap_chan *chan)
3936 /* FCS is enabled only in ERTM or streaming mode, if one or both
3939 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
3940 chan->fcs = L2CAP_FCS_NONE;
3941 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state))
3942 chan->fcs = L2CAP_FCS_CRC16;
3945 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
3946 u8 ident, u16 flags)
3948 struct l2cap_conn *conn = chan->conn;
3950 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
3953 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3954 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3956 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
3957 l2cap_build_conf_rsp(chan, data,
3958 L2CAP_CONF_SUCCESS, flags), data);
3961 static inline int l2cap_config_req(struct l2cap_conn *conn,
3962 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3965 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3968 struct l2cap_chan *chan;
3971 if (cmd_len < sizeof(*req))
3974 dcid = __le16_to_cpu(req->dcid);
3975 flags = __le16_to_cpu(req->flags);
3977 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3979 chan = l2cap_get_chan_by_scid(conn, dcid);
3983 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
3984 struct l2cap_cmd_rej_cid rej;
3986 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
3987 rej.scid = cpu_to_le16(chan->scid);
3988 rej.dcid = cpu_to_le16(chan->dcid);
3990 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3995 /* Reject if config buffer is too small. */
3996 len = cmd_len - sizeof(*req);
3997 if (chan->conf_len + len > sizeof(chan->conf_req)) {
3998 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3999 l2cap_build_conf_rsp(chan, rsp,
4000 L2CAP_CONF_REJECT, flags), rsp);
4005 memcpy(chan->conf_req + chan->conf_len, req->data, len);
4006 chan->conf_len += len;
4008 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
4009 /* Incomplete config. Send empty response. */
4010 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
4011 l2cap_build_conf_rsp(chan, rsp,
4012 L2CAP_CONF_SUCCESS, flags), rsp);
4016 /* Complete config. */
4017 len = l2cap_parse_conf_req(chan, rsp);
4019 l2cap_send_disconn_req(chan, ECONNRESET);
4023 chan->ident = cmd->ident;
4024 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
4025 chan->num_conf_rsp++;
4027 /* Reset config buffer. */
4030 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
4033 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4034 set_default_fcs(chan);
4036 if (chan->mode == L2CAP_MODE_ERTM ||
4037 chan->mode == L2CAP_MODE_STREAMING)
4038 err = l2cap_ertm_init(chan);
4041 l2cap_send_disconn_req(chan, -err);
4043 l2cap_chan_ready(chan);
4048 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
4050 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
4051 l2cap_build_conf_req(chan, buf), buf);
4052 chan->num_conf_req++;
4055 /* Got Conf Rsp PENDING from remote side and asume we sent
4056 Conf Rsp PENDING in the code above */
4057 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
4058 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4060 /* check compatibility */
4062 /* Send rsp for BR/EDR channel */
4064 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
4066 chan->ident = cmd->ident;
4070 l2cap_chan_unlock(chan);
4074 static inline int l2cap_config_rsp(struct l2cap_conn *conn,
4075 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4078 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
4079 u16 scid, flags, result;
4080 struct l2cap_chan *chan;
4081 int len = cmd_len - sizeof(*rsp);
4084 if (cmd_len < sizeof(*rsp))
4087 scid = __le16_to_cpu(rsp->scid);
4088 flags = __le16_to_cpu(rsp->flags);
4089 result = __le16_to_cpu(rsp->result);
4091 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
4094 chan = l2cap_get_chan_by_scid(conn, scid);
4099 case L2CAP_CONF_SUCCESS:
4100 l2cap_conf_rfc_get(chan, rsp->data, len);
4101 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4104 case L2CAP_CONF_PENDING:
4105 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
4107 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
4110 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4113 l2cap_send_disconn_req(chan, ECONNRESET);
4117 if (!chan->hs_hcon) {
4118 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
4121 if (l2cap_check_efs(chan)) {
4122 amp_create_logical_link(chan);
4123 chan->ident = cmd->ident;
4129 case L2CAP_CONF_UNACCEPT:
4130 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
4133 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
4134 l2cap_send_disconn_req(chan, ECONNRESET);
4138 /* throw out any old stored conf requests */
4139 result = L2CAP_CONF_SUCCESS;
4140 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
4143 l2cap_send_disconn_req(chan, ECONNRESET);
4147 l2cap_send_cmd(conn, l2cap_get_ident(conn),
4148 L2CAP_CONF_REQ, len, req);
4149 chan->num_conf_req++;
4150 if (result != L2CAP_CONF_SUCCESS)
4156 l2cap_chan_set_err(chan, ECONNRESET);
4158 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
4159 l2cap_send_disconn_req(chan, ECONNRESET);
4163 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
4166 set_bit(CONF_INPUT_DONE, &chan->conf_state);
4168 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
4169 set_default_fcs(chan);
4171 if (chan->mode == L2CAP_MODE_ERTM ||
4172 chan->mode == L2CAP_MODE_STREAMING)
4173 err = l2cap_ertm_init(chan);
4176 l2cap_send_disconn_req(chan, -err);
4178 l2cap_chan_ready(chan);
4182 l2cap_chan_unlock(chan);
4186 static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4187 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4190 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4191 struct l2cap_disconn_rsp rsp;
4193 struct l2cap_chan *chan;
4196 if (cmd_len != sizeof(*req))
4199 scid = __le16_to_cpu(req->scid);
4200 dcid = __le16_to_cpu(req->dcid);
4202 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4204 mutex_lock(&conn->chan_lock);
4206 chan = __l2cap_get_chan_by_scid(conn, dcid);
4208 mutex_unlock(&conn->chan_lock);
4212 l2cap_chan_lock(chan);
4216 rsp.dcid = cpu_to_le16(chan->scid);
4217 rsp.scid = cpu_to_le16(chan->dcid);
4218 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4221 sk->sk_shutdown = SHUTDOWN_MASK;
4224 l2cap_chan_hold(chan);
4225 l2cap_chan_del(chan, ECONNRESET);
4227 l2cap_chan_unlock(chan);
4229 chan->ops->close(chan);
4230 l2cap_chan_put(chan);
4232 mutex_unlock(&conn->chan_lock);
4237 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4238 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4241 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4243 struct l2cap_chan *chan;
4245 if (cmd_len != sizeof(*rsp))
4248 scid = __le16_to_cpu(rsp->scid);
4249 dcid = __le16_to_cpu(rsp->dcid);
4251 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4253 mutex_lock(&conn->chan_lock);
4255 chan = __l2cap_get_chan_by_scid(conn, scid);
4257 mutex_unlock(&conn->chan_lock);
4261 l2cap_chan_lock(chan);
4263 l2cap_chan_hold(chan);
4264 l2cap_chan_del(chan, 0);
4266 l2cap_chan_unlock(chan);
4268 chan->ops->close(chan);
4269 l2cap_chan_put(chan);
4271 mutex_unlock(&conn->chan_lock);
4276 static inline int l2cap_information_req(struct l2cap_conn *conn,
4277 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4280 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
4283 if (cmd_len != sizeof(*req))
4286 type = __le16_to_cpu(req->type);
4288 BT_DBG("type 0x%4.4x", type);
4290 if (type == L2CAP_IT_FEAT_MASK) {
4292 u32 feat_mask = l2cap_feat_mask;
4293 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4294 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
4295 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
4297 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
4300 feat_mask |= L2CAP_FEAT_EXT_FLOW
4301 | L2CAP_FEAT_EXT_WINDOW;
4303 put_unaligned_le32(feat_mask, rsp->data);
4304 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4306 } else if (type == L2CAP_IT_FIXED_CHAN) {
4308 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
4311 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
4313 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
4315 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4316 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
4317 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
4318 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4321 struct l2cap_info_rsp rsp;
4322 rsp.type = cpu_to_le16(type);
4323 rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
4324 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4331 static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4332 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4335 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4338 if (cmd_len < sizeof(*rsp))
4341 type = __le16_to_cpu(rsp->type);
4342 result = __le16_to_cpu(rsp->result);
4344 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4346 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4347 if (cmd->ident != conn->info_ident ||
4348 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
4351 cancel_delayed_work(&conn->info_timer);
4353 if (result != L2CAP_IR_SUCCESS) {
4354 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4355 conn->info_ident = 0;
4357 l2cap_conn_start(conn);
4363 case L2CAP_IT_FEAT_MASK:
4364 conn->feat_mask = get_unaligned_le32(rsp->data);
4366 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
4367 struct l2cap_info_req req;
4368 req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4370 conn->info_ident = l2cap_get_ident(conn);
4372 l2cap_send_cmd(conn, conn->info_ident,
4373 L2CAP_INFO_REQ, sizeof(req), &req);
4375 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4376 conn->info_ident = 0;
4378 l2cap_conn_start(conn);
4382 case L2CAP_IT_FIXED_CHAN:
4383 conn->fixed_chan_mask = rsp->data[0];
4384 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4385 conn->info_ident = 0;
4387 l2cap_conn_start(conn);
4394 static int l2cap_create_channel_req(struct l2cap_conn *conn,
4395 struct l2cap_cmd_hdr *cmd,
4396 u16 cmd_len, void *data)
4398 struct l2cap_create_chan_req *req = data;
4399 struct l2cap_create_chan_rsp rsp;
4400 struct l2cap_chan *chan;
4401 struct hci_dev *hdev;
4404 if (cmd_len != sizeof(*req))
4410 psm = le16_to_cpu(req->psm);
4411 scid = le16_to_cpu(req->scid);
4413 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
4415 /* For controller id 0 make BR/EDR connection */
4416 if (req->amp_id == HCI_BREDR_ID) {
4417 l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4422 /* Validate AMP controller id */
4423 hdev = hci_dev_get(req->amp_id);
4427 if (hdev->dev_type != HCI_AMP || !test_bit(HCI_UP, &hdev->flags)) {
4432 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4435 struct amp_mgr *mgr = conn->hcon->amp_mgr;
4436 struct hci_conn *hs_hcon;
4438 hs_hcon = hci_conn_hash_lookup_ba(hdev, AMP_LINK, conn->dst);
4444 BT_DBG("mgr %p bredr_chan %p hs_hcon %p", mgr, chan, hs_hcon);
4446 mgr->bredr_chan = chan;
4447 chan->hs_hcon = hs_hcon;
4448 chan->fcs = L2CAP_FCS_NONE;
4449 conn->mtu = hdev->block_mtu;
4458 rsp.scid = cpu_to_le16(scid);
4459 rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP);
4460 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4462 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4468 static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4470 struct l2cap_move_chan_req req;
4473 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4475 ident = l2cap_get_ident(chan->conn);
4476 chan->ident = ident;
4478 req.icid = cpu_to_le16(chan->scid);
4479 req.dest_amp_id = dest_amp_id;
4481 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4484 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4487 static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
4489 struct l2cap_move_chan_rsp rsp;
4491 BT_DBG("chan %p, result 0x%4.4x", chan, result);
4493 rsp.icid = cpu_to_le16(chan->dcid);
4494 rsp.result = cpu_to_le16(result);
4496 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4500 static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
4502 struct l2cap_move_chan_cfm cfm;
4504 BT_DBG("chan %p, result 0x%4.4x", chan, result);
4506 chan->ident = l2cap_get_ident(chan->conn);
4508 cfm.icid = cpu_to_le16(chan->scid);
4509 cfm.result = cpu_to_le16(result);
4511 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4514 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4517 static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4519 struct l2cap_move_chan_cfm cfm;
4521 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4523 cfm.icid = cpu_to_le16(icid);
4524 cfm.result = __constant_cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4526 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4530 static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
4533 struct l2cap_move_chan_cfm_rsp rsp;
4535 BT_DBG("icid 0x%4.4x", icid);
4537 rsp.icid = cpu_to_le16(icid);
4538 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4541 static void __release_logical_link(struct l2cap_chan *chan)
4543 chan->hs_hchan = NULL;
4544 chan->hs_hcon = NULL;
4546 /* Placeholder - release the logical link */
4549 static void l2cap_logical_fail(struct l2cap_chan *chan)
4551 /* Logical link setup failed */
4552 if (chan->state != BT_CONNECTED) {
4553 /* Create channel failure, disconnect */
4554 l2cap_send_disconn_req(chan, ECONNRESET);
4558 switch (chan->move_role) {
4559 case L2CAP_MOVE_ROLE_RESPONDER:
4560 l2cap_move_done(chan);
4561 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4563 case L2CAP_MOVE_ROLE_INITIATOR:
4564 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4565 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4566 /* Remote has only sent pending or
4567 * success responses, clean up
4569 l2cap_move_done(chan);
4572 /* Other amp move states imply that the move
4573 * has already aborted
4575 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4580 static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4581 struct hci_chan *hchan)
4583 struct l2cap_conf_rsp rsp;
4585 chan->hs_hchan = hchan;
4586 chan->hs_hcon->l2cap_data = chan->conn;
4588 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
4590 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4593 set_default_fcs(chan);
4595 err = l2cap_ertm_init(chan);
4597 l2cap_send_disconn_req(chan, -err);
4599 l2cap_chan_ready(chan);
4603 static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4604 struct hci_chan *hchan)
4606 chan->hs_hcon = hchan->conn;
4607 chan->hs_hcon->l2cap_data = chan->conn;
4609 BT_DBG("move_state %d", chan->move_state);
4611 switch (chan->move_state) {
4612 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4613 /* Move confirm will be sent after a success
4614 * response is received
4616 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4618 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4619 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4620 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4621 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4622 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4623 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4624 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4625 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4626 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4630 /* Move was not in expected state, free the channel */
4631 __release_logical_link(chan);
4633 chan->move_state = L2CAP_MOVE_STABLE;
4637 /* Call with chan locked */
4638 void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4641 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4644 l2cap_logical_fail(chan);
4645 __release_logical_link(chan);
4649 if (chan->state != BT_CONNECTED) {
4650 /* Ignore logical link if channel is on BR/EDR */
4651 if (chan->local_amp_id)
4652 l2cap_logical_finish_create(chan, hchan);
4654 l2cap_logical_finish_move(chan, hchan);
4658 void l2cap_move_start(struct l2cap_chan *chan)
4660 BT_DBG("chan %p", chan);
4662 if (chan->local_amp_id == HCI_BREDR_ID) {
4663 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
4665 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4666 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4667 /* Placeholder - start physical link setup */
4669 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4670 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4672 l2cap_move_setup(chan);
4673 l2cap_send_move_chan_req(chan, 0);
4677 static void l2cap_do_create(struct l2cap_chan *chan, int result,
4678 u8 local_amp_id, u8 remote_amp_id)
4680 BT_DBG("chan %p state %s %u -> %u", chan, state_to_string(chan->state),
4681 local_amp_id, remote_amp_id);
4683 chan->fcs = L2CAP_FCS_NONE;
4685 /* Outgoing channel on AMP */
4686 if (chan->state == BT_CONNECT) {
4687 if (result == L2CAP_CR_SUCCESS) {
4688 chan->local_amp_id = local_amp_id;
4689 l2cap_send_create_chan_req(chan, remote_amp_id);
4691 /* Revert to BR/EDR connect */
4692 l2cap_send_conn_req(chan);
4698 /* Incoming channel on AMP */
4699 if (__l2cap_no_conn_pending(chan)) {
4700 struct l2cap_conn_rsp rsp;
4702 rsp.scid = cpu_to_le16(chan->dcid);
4703 rsp.dcid = cpu_to_le16(chan->scid);
4705 if (result == L2CAP_CR_SUCCESS) {
4706 /* Send successful response */
4707 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
4708 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4710 /* Send negative response */
4711 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
4712 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4715 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4718 if (result == L2CAP_CR_SUCCESS) {
4719 __l2cap_state_change(chan, BT_CONFIG);
4720 set_bit(CONF_REQ_SENT, &chan->conf_state);
4721 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4723 l2cap_build_conf_req(chan, buf), buf);
4724 chan->num_conf_req++;
4729 static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4732 l2cap_move_setup(chan);
4733 chan->move_id = local_amp_id;
4734 chan->move_state = L2CAP_MOVE_WAIT_RSP;
4736 l2cap_send_move_chan_req(chan, remote_amp_id);
4739 static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4741 struct hci_chan *hchan = NULL;
4743 /* Placeholder - get hci_chan for logical link */
4746 if (hchan->state == BT_CONNECTED) {
4747 /* Logical link is ready to go */
4748 chan->hs_hcon = hchan->conn;
4749 chan->hs_hcon->l2cap_data = chan->conn;
4750 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4751 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4753 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4755 /* Wait for logical link to be ready */
4756 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4759 /* Logical link not available */
4760 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4764 static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4766 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4768 if (result == -EINVAL)
4769 rsp_result = L2CAP_MR_BAD_ID;
4771 rsp_result = L2CAP_MR_NOT_ALLOWED;
4773 l2cap_send_move_chan_rsp(chan, rsp_result);
4776 chan->move_role = L2CAP_MOVE_ROLE_NONE;
4777 chan->move_state = L2CAP_MOVE_STABLE;
4779 /* Restart data transmission */
4780 l2cap_ertm_send(chan);
4783 /* Invoke with locked chan */
4784 void __l2cap_physical_cfm(struct l2cap_chan *chan, int result)
4786 u8 local_amp_id = chan->local_amp_id;
4787 u8 remote_amp_id = chan->remote_amp_id;
4789 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4790 chan, result, local_amp_id, remote_amp_id);
4792 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4793 l2cap_chan_unlock(chan);
4797 if (chan->state != BT_CONNECTED) {
4798 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4799 } else if (result != L2CAP_MR_SUCCESS) {
4800 l2cap_do_move_cancel(chan, result);
4802 switch (chan->move_role) {
4803 case L2CAP_MOVE_ROLE_INITIATOR:
4804 l2cap_do_move_initiate(chan, local_amp_id,
4807 case L2CAP_MOVE_ROLE_RESPONDER:
4808 l2cap_do_move_respond(chan, result);
4811 l2cap_do_move_cancel(chan, result);
4817 static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
4818 struct l2cap_cmd_hdr *cmd,
4819 u16 cmd_len, void *data)
4821 struct l2cap_move_chan_req *req = data;
4822 struct l2cap_move_chan_rsp rsp;
4823 struct l2cap_chan *chan;
4825 u16 result = L2CAP_MR_NOT_ALLOWED;
4827 if (cmd_len != sizeof(*req))
4830 icid = le16_to_cpu(req->icid);
4832 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
4837 chan = l2cap_get_chan_by_dcid(conn, icid);
4839 rsp.icid = cpu_to_le16(icid);
4840 rsp.result = __constant_cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
4841 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4846 chan->ident = cmd->ident;
4848 if (chan->scid < L2CAP_CID_DYN_START ||
4849 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4850 (chan->mode != L2CAP_MODE_ERTM &&
4851 chan->mode != L2CAP_MODE_STREAMING)) {
4852 result = L2CAP_MR_NOT_ALLOWED;
4853 goto send_move_response;
4856 if (chan->local_amp_id == req->dest_amp_id) {
4857 result = L2CAP_MR_SAME_ID;
4858 goto send_move_response;
4861 if (req->dest_amp_id) {
4862 struct hci_dev *hdev;
4863 hdev = hci_dev_get(req->dest_amp_id);
4864 if (!hdev || hdev->dev_type != HCI_AMP ||
4865 !test_bit(HCI_UP, &hdev->flags)) {
4869 result = L2CAP_MR_BAD_ID;
4870 goto send_move_response;
4875 /* Detect a move collision. Only send a collision response
4876 * if this side has "lost", otherwise proceed with the move.
4877 * The winner has the larger bd_addr.
4879 if ((__chan_is_moving(chan) ||
4880 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
4881 bacmp(conn->src, conn->dst) > 0) {
4882 result = L2CAP_MR_COLLISION;
4883 goto send_move_response;
4886 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4887 l2cap_move_setup(chan);
4888 chan->move_id = req->dest_amp_id;
4891 if (!req->dest_amp_id) {
4892 /* Moving to BR/EDR */
4893 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4894 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4895 result = L2CAP_MR_PEND;
4897 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4898 result = L2CAP_MR_SUCCESS;
4901 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4902 /* Placeholder - uncomment when amp functions are available */
4903 /*amp_accept_physical(chan, req->dest_amp_id);*/
4904 result = L2CAP_MR_PEND;
4908 l2cap_send_move_chan_rsp(chan, result);
4910 l2cap_chan_unlock(chan);
4915 static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4917 struct l2cap_chan *chan;
4918 struct hci_chan *hchan = NULL;
4920 chan = l2cap_get_chan_by_scid(conn, icid);
4922 l2cap_send_move_chan_cfm_icid(conn, icid);
4926 __clear_chan_timer(chan);
4927 if (result == L2CAP_MR_PEND)
4928 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
4930 switch (chan->move_state) {
4931 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4932 /* Move confirm will be sent when logical link
4935 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4937 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
4938 if (result == L2CAP_MR_PEND) {
4940 } else if (test_bit(CONN_LOCAL_BUSY,
4941 &chan->conn_state)) {
4942 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4944 /* Logical link is up or moving to BR/EDR,
4947 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4948 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4951 case L2CAP_MOVE_WAIT_RSP:
4953 if (result == L2CAP_MR_SUCCESS) {
4954 /* Remote is ready, send confirm immediately
4955 * after logical link is ready
4957 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4959 /* Both logical link and move success
4960 * are required to confirm
4962 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
4965 /* Placeholder - get hci_chan for logical link */
4967 /* Logical link not available */
4968 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4972 /* If the logical link is not yet connected, do not
4973 * send confirmation.
4975 if (hchan->state != BT_CONNECTED)
4978 /* Logical link is already ready to go */
4980 chan->hs_hcon = hchan->conn;
4981 chan->hs_hcon->l2cap_data = chan->conn;
4983 if (result == L2CAP_MR_SUCCESS) {
4984 /* Can confirm now */
4985 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4987 /* Now only need move success
4990 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4993 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4996 /* Any other amp move state means the move failed. */
4997 chan->move_id = chan->local_amp_id;
4998 l2cap_move_done(chan);
4999 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5002 l2cap_chan_unlock(chan);
5005 static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
5008 struct l2cap_chan *chan;
5010 chan = l2cap_get_chan_by_ident(conn, ident);
5012 /* Could not locate channel, icid is best guess */
5013 l2cap_send_move_chan_cfm_icid(conn, icid);
5017 __clear_chan_timer(chan);
5019 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
5020 if (result == L2CAP_MR_COLLISION) {
5021 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
5023 /* Cleanup - cancel move */
5024 chan->move_id = chan->local_amp_id;
5025 l2cap_move_done(chan);
5029 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
5031 l2cap_chan_unlock(chan);
5034 static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
5035 struct l2cap_cmd_hdr *cmd,
5036 u16 cmd_len, void *data)
5038 struct l2cap_move_chan_rsp *rsp = data;
5041 if (cmd_len != sizeof(*rsp))
5044 icid = le16_to_cpu(rsp->icid);
5045 result = le16_to_cpu(rsp->result);
5047 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5049 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
5050 l2cap_move_continue(conn, icid, result);
5052 l2cap_move_fail(conn, cmd->ident, icid, result);
5057 static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
5058 struct l2cap_cmd_hdr *cmd,
5059 u16 cmd_len, void *data)
5061 struct l2cap_move_chan_cfm *cfm = data;
5062 struct l2cap_chan *chan;
5065 if (cmd_len != sizeof(*cfm))
5068 icid = le16_to_cpu(cfm->icid);
5069 result = le16_to_cpu(cfm->result);
5071 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
5073 chan = l2cap_get_chan_by_dcid(conn, icid);
5075 /* Spec requires a response even if the icid was not found */
5076 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5080 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
5081 if (result == L2CAP_MC_CONFIRMED) {
5082 chan->local_amp_id = chan->move_id;
5083 if (!chan->local_amp_id)
5084 __release_logical_link(chan);
5086 chan->move_id = chan->local_amp_id;
5089 l2cap_move_done(chan);
5092 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
5094 l2cap_chan_unlock(chan);
5099 static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
5100 struct l2cap_cmd_hdr *cmd,
5101 u16 cmd_len, void *data)
5103 struct l2cap_move_chan_cfm_rsp *rsp = data;
5104 struct l2cap_chan *chan;
5107 if (cmd_len != sizeof(*rsp))
5110 icid = le16_to_cpu(rsp->icid);
5112 BT_DBG("icid 0x%4.4x", icid);
5114 chan = l2cap_get_chan_by_scid(conn, icid);
5118 __clear_chan_timer(chan);
5120 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
5121 chan->local_amp_id = chan->move_id;
5123 if (!chan->local_amp_id && chan->hs_hchan)
5124 __release_logical_link(chan);
5126 l2cap_move_done(chan);
5129 l2cap_chan_unlock(chan);
5134 static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
5139 if (min > max || min < 6 || max > 3200)
5142 if (to_multiplier < 10 || to_multiplier > 3200)
5145 if (max >= to_multiplier * 8)
5148 max_latency = (to_multiplier * 8 / max) - 1;
5149 if (latency > 499 || latency > max_latency)
5155 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
5156 struct l2cap_cmd_hdr *cmd,
5159 struct hci_conn *hcon = conn->hcon;
5160 struct l2cap_conn_param_update_req *req;
5161 struct l2cap_conn_param_update_rsp rsp;
5162 u16 min, max, latency, to_multiplier, cmd_len;
5165 if (!(hcon->link_mode & HCI_LM_MASTER))
5168 cmd_len = __le16_to_cpu(cmd->len);
5169 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
5172 req = (struct l2cap_conn_param_update_req *) data;
5173 min = __le16_to_cpu(req->min);
5174 max = __le16_to_cpu(req->max);
5175 latency = __le16_to_cpu(req->latency);
5176 to_multiplier = __le16_to_cpu(req->to_multiplier);
5178 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
5179 min, max, latency, to_multiplier);
5181 memset(&rsp, 0, sizeof(rsp));
5183 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
5185 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
5187 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
5189 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
5193 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
5198 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
5199 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
5204 switch (cmd->code) {
5205 case L2CAP_COMMAND_REJ:
5206 l2cap_command_rej(conn, cmd, cmd_len, data);
5209 case L2CAP_CONN_REQ:
5210 err = l2cap_connect_req(conn, cmd, cmd_len, data);
5213 case L2CAP_CONN_RSP:
5214 case L2CAP_CREATE_CHAN_RSP:
5215 err = l2cap_connect_create_rsp(conn, cmd, cmd_len, data);
5218 case L2CAP_CONF_REQ:
5219 err = l2cap_config_req(conn, cmd, cmd_len, data);
5222 case L2CAP_CONF_RSP:
5223 err = l2cap_config_rsp(conn, cmd, cmd_len, data);
5226 case L2CAP_DISCONN_REQ:
5227 err = l2cap_disconnect_req(conn, cmd, cmd_len, data);
5230 case L2CAP_DISCONN_RSP:
5231 err = l2cap_disconnect_rsp(conn, cmd, cmd_len, data);
5234 case L2CAP_ECHO_REQ:
5235 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5238 case L2CAP_ECHO_RSP:
5241 case L2CAP_INFO_REQ:
5242 err = l2cap_information_req(conn, cmd, cmd_len, data);
5245 case L2CAP_INFO_RSP:
5246 err = l2cap_information_rsp(conn, cmd, cmd_len, data);
5249 case L2CAP_CREATE_CHAN_REQ:
5250 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5253 case L2CAP_MOVE_CHAN_REQ:
5254 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5257 case L2CAP_MOVE_CHAN_RSP:
5258 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
5261 case L2CAP_MOVE_CHAN_CFM:
5262 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5265 case L2CAP_MOVE_CHAN_CFM_RSP:
5266 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
5270 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5278 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
5279 struct l2cap_cmd_hdr *cmd, u8 *data)
5281 switch (cmd->code) {
5282 case L2CAP_COMMAND_REJ:
5285 case L2CAP_CONN_PARAM_UPDATE_REQ:
5286 return l2cap_conn_param_update_req(conn, cmd, data);
5288 case L2CAP_CONN_PARAM_UPDATE_RSP:
5292 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5297 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn,
5298 struct sk_buff *skb)
5300 u8 *data = skb->data;
5302 struct l2cap_cmd_hdr cmd;
5305 l2cap_raw_recv(conn, skb);
5307 while (len >= L2CAP_CMD_HDR_SIZE) {
5309 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5310 data += L2CAP_CMD_HDR_SIZE;
5311 len -= L2CAP_CMD_HDR_SIZE;
5313 cmd_len = le16_to_cpu(cmd.len);
5315 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5318 if (cmd_len > len || !cmd.ident) {
5319 BT_DBG("corrupted command");
5323 err = l2cap_le_sig_cmd(conn, &cmd, data);
5325 struct l2cap_cmd_rej_unk rej;
5327 BT_ERR("Wrong link type (%d)", err);
5329 /* FIXME: Map err to a valid reason */
5330 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5331 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5342 static inline void l2cap_sig_channel(struct l2cap_conn *conn,
5343 struct sk_buff *skb)
5345 u8 *data = skb->data;
5347 struct l2cap_cmd_hdr cmd;
5350 l2cap_raw_recv(conn, skb);
5352 while (len >= L2CAP_CMD_HDR_SIZE) {
5354 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5355 data += L2CAP_CMD_HDR_SIZE;
5356 len -= L2CAP_CMD_HDR_SIZE;
5358 cmd_len = le16_to_cpu(cmd.len);
5360 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5363 if (cmd_len > len || !cmd.ident) {
5364 BT_DBG("corrupted command");
5368 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
5370 struct l2cap_cmd_rej_unk rej;
5372 BT_ERR("Wrong link type (%d)", err);
5374 /* FIXME: Map err to a valid reason */
5375 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
5376 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5387 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
5389 u16 our_fcs, rcv_fcs;
5392 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5393 hdr_size = L2CAP_EXT_HDR_SIZE;
5395 hdr_size = L2CAP_ENH_HDR_SIZE;
5397 if (chan->fcs == L2CAP_FCS_CRC16) {
5398 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
5399 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5400 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5402 if (our_fcs != rcv_fcs)
5408 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
5410 struct l2cap_ctrl control;
5412 BT_DBG("chan %p", chan);
5414 memset(&control, 0, sizeof(control));
5417 control.reqseq = chan->buffer_seq;
5418 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5420 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5421 control.super = L2CAP_SUPER_RNR;
5422 l2cap_send_sframe(chan, &control);
5425 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5426 chan->unacked_frames > 0)
5427 __set_retrans_timer(chan);
5429 /* Send pending iframes */
5430 l2cap_ertm_send(chan);
5432 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
5433 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5434 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5437 control.super = L2CAP_SUPER_RR;
5438 l2cap_send_sframe(chan, &control);
5442 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5443 struct sk_buff **last_frag)
5445 /* skb->len reflects data in skb as well as all fragments
5446 * skb->data_len reflects only data in fragments
5448 if (!skb_has_frag_list(skb))
5449 skb_shinfo(skb)->frag_list = new_frag;
5451 new_frag->next = NULL;
5453 (*last_frag)->next = new_frag;
5454 *last_frag = new_frag;
5456 skb->len += new_frag->len;
5457 skb->data_len += new_frag->len;
5458 skb->truesize += new_frag->truesize;
5461 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5462 struct l2cap_ctrl *control)
5466 switch (control->sar) {
5467 case L2CAP_SAR_UNSEGMENTED:
5471 err = chan->ops->recv(chan, skb);
5474 case L2CAP_SAR_START:
5478 chan->sdu_len = get_unaligned_le16(skb->data);
5479 skb_pull(skb, L2CAP_SDULEN_SIZE);
5481 if (chan->sdu_len > chan->imtu) {
5486 if (skb->len >= chan->sdu_len)
5490 chan->sdu_last_frag = skb;
5496 case L2CAP_SAR_CONTINUE:
5500 append_skb_frag(chan->sdu, skb,
5501 &chan->sdu_last_frag);
5504 if (chan->sdu->len >= chan->sdu_len)
5514 append_skb_frag(chan->sdu, skb,
5515 &chan->sdu_last_frag);
5518 if (chan->sdu->len != chan->sdu_len)
5521 err = chan->ops->recv(chan, chan->sdu);
5524 /* Reassembly complete */
5526 chan->sdu_last_frag = NULL;
5534 kfree_skb(chan->sdu);
5536 chan->sdu_last_frag = NULL;
5543 static int l2cap_resegment(struct l2cap_chan *chan)
5549 void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
5553 if (chan->mode != L2CAP_MODE_ERTM)
5556 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
5557 l2cap_tx(chan, NULL, NULL, event);
5560 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5563 /* Pass sequential frames to l2cap_reassemble_sdu()
5564 * until a gap is encountered.
5567 BT_DBG("chan %p", chan);
5569 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5570 struct sk_buff *skb;
5571 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5572 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5574 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5579 skb_unlink(skb, &chan->srej_q);
5580 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5581 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
5586 if (skb_queue_empty(&chan->srej_q)) {
5587 chan->rx_state = L2CAP_RX_STATE_RECV;
5588 l2cap_send_ack(chan);
5594 static void l2cap_handle_srej(struct l2cap_chan *chan,
5595 struct l2cap_ctrl *control)
5597 struct sk_buff *skb;
5599 BT_DBG("chan %p, control %p", chan, control);
5601 if (control->reqseq == chan->next_tx_seq) {
5602 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5603 l2cap_send_disconn_req(chan, ECONNRESET);
5607 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5610 BT_DBG("Seq %d not available for retransmission",
5615 if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
5616 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5617 l2cap_send_disconn_req(chan, ECONNRESET);
5621 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5623 if (control->poll) {
5624 l2cap_pass_to_tx(chan, control);
5626 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5627 l2cap_retransmit(chan, control);
5628 l2cap_ertm_send(chan);
5630 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5631 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5632 chan->srej_save_reqseq = control->reqseq;
5635 l2cap_pass_to_tx_fbit(chan, control);
5637 if (control->final) {
5638 if (chan->srej_save_reqseq != control->reqseq ||
5639 !test_and_clear_bit(CONN_SREJ_ACT,
5641 l2cap_retransmit(chan, control);
5643 l2cap_retransmit(chan, control);
5644 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5645 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5646 chan->srej_save_reqseq = control->reqseq;
5652 static void l2cap_handle_rej(struct l2cap_chan *chan,
5653 struct l2cap_ctrl *control)
5655 struct sk_buff *skb;
5657 BT_DBG("chan %p, control %p", chan, control);
5659 if (control->reqseq == chan->next_tx_seq) {
5660 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5661 l2cap_send_disconn_req(chan, ECONNRESET);
5665 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5667 if (chan->max_tx && skb &&
5668 bt_cb(skb)->control.retries >= chan->max_tx) {
5669 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5670 l2cap_send_disconn_req(chan, ECONNRESET);
5674 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5676 l2cap_pass_to_tx(chan, control);
5678 if (control->final) {
5679 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5680 l2cap_retransmit_all(chan, control);
5682 l2cap_retransmit_all(chan, control);
5683 l2cap_ertm_send(chan);
5684 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5685 set_bit(CONN_REJ_ACT, &chan->conn_state);
5689 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5691 BT_DBG("chan %p, txseq %d", chan, txseq);
5693 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5694 chan->expected_tx_seq);
5696 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5697 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5699 /* See notes below regarding "double poll" and
5702 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5703 BT_DBG("Invalid/Ignore - after SREJ");
5704 return L2CAP_TXSEQ_INVALID_IGNORE;
5706 BT_DBG("Invalid - in window after SREJ sent");
5707 return L2CAP_TXSEQ_INVALID;
5711 if (chan->srej_list.head == txseq) {
5712 BT_DBG("Expected SREJ");
5713 return L2CAP_TXSEQ_EXPECTED_SREJ;
5716 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5717 BT_DBG("Duplicate SREJ - txseq already stored");
5718 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5721 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5722 BT_DBG("Unexpected SREJ - not requested");
5723 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5727 if (chan->expected_tx_seq == txseq) {
5728 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5730 BT_DBG("Invalid - txseq outside tx window");
5731 return L2CAP_TXSEQ_INVALID;
5734 return L2CAP_TXSEQ_EXPECTED;
5738 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
5739 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
5740 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5741 return L2CAP_TXSEQ_DUPLICATE;
5744 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5745 /* A source of invalid packets is a "double poll" condition,
5746 * where delays cause us to send multiple poll packets. If
5747 * the remote stack receives and processes both polls,
5748 * sequence numbers can wrap around in such a way that a
5749 * resent frame has a sequence number that looks like new data
5750 * with a sequence gap. This would trigger an erroneous SREJ
5753 * Fortunately, this is impossible with a tx window that's
5754 * less than half of the maximum sequence number, which allows
5755 * invalid frames to be safely ignored.
5757 * With tx window sizes greater than half of the tx window
5758 * maximum, the frame is invalid and cannot be ignored. This
5759 * causes a disconnect.
5762 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5763 BT_DBG("Invalid/Ignore - txseq outside tx window");
5764 return L2CAP_TXSEQ_INVALID_IGNORE;
5766 BT_DBG("Invalid - txseq outside tx window");
5767 return L2CAP_TXSEQ_INVALID;
5770 BT_DBG("Unexpected - txseq indicates missing frames");
5771 return L2CAP_TXSEQ_UNEXPECTED;
5775 static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5776 struct l2cap_ctrl *control,
5777 struct sk_buff *skb, u8 event)
5780 bool skb_in_use = 0;
5782 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5786 case L2CAP_EV_RECV_IFRAME:
5787 switch (l2cap_classify_txseq(chan, control->txseq)) {
5788 case L2CAP_TXSEQ_EXPECTED:
5789 l2cap_pass_to_tx(chan, control);
5791 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5792 BT_DBG("Busy, discarding expected seq %d",
5797 chan->expected_tx_seq = __next_seq(chan,
5800 chan->buffer_seq = chan->expected_tx_seq;
5803 err = l2cap_reassemble_sdu(chan, skb, control);
5807 if (control->final) {
5808 if (!test_and_clear_bit(CONN_REJ_ACT,
5809 &chan->conn_state)) {
5811 l2cap_retransmit_all(chan, control);
5812 l2cap_ertm_send(chan);
5816 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
5817 l2cap_send_ack(chan);
5819 case L2CAP_TXSEQ_UNEXPECTED:
5820 l2cap_pass_to_tx(chan, control);
5822 /* Can't issue SREJ frames in the local busy state.
5823 * Drop this frame, it will be seen as missing
5824 * when local busy is exited.
5826 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5827 BT_DBG("Busy, discarding unexpected seq %d",
5832 /* There was a gap in the sequence, so an SREJ
5833 * must be sent for each missing frame. The
5834 * current frame is stored for later use.
5836 skb_queue_tail(&chan->srej_q, skb);
5838 BT_DBG("Queued %p (queue len %d)", skb,
5839 skb_queue_len(&chan->srej_q));
5841 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
5842 l2cap_seq_list_clear(&chan->srej_list);
5843 l2cap_send_srej(chan, control->txseq);
5845 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
5847 case L2CAP_TXSEQ_DUPLICATE:
5848 l2cap_pass_to_tx(chan, control);
5850 case L2CAP_TXSEQ_INVALID_IGNORE:
5852 case L2CAP_TXSEQ_INVALID:
5854 l2cap_send_disconn_req(chan, ECONNRESET);
5858 case L2CAP_EV_RECV_RR:
5859 l2cap_pass_to_tx(chan, control);
5860 if (control->final) {
5861 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5863 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
5864 !__chan_is_moving(chan)) {
5866 l2cap_retransmit_all(chan, control);
5869 l2cap_ertm_send(chan);
5870 } else if (control->poll) {
5871 l2cap_send_i_or_rr_or_rnr(chan);
5873 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5874 &chan->conn_state) &&
5875 chan->unacked_frames)
5876 __set_retrans_timer(chan);
5878 l2cap_ertm_send(chan);
5881 case L2CAP_EV_RECV_RNR:
5882 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5883 l2cap_pass_to_tx(chan, control);
5884 if (control && control->poll) {
5885 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5886 l2cap_send_rr_or_rnr(chan, 0);
5888 __clear_retrans_timer(chan);
5889 l2cap_seq_list_clear(&chan->retrans_list);
5891 case L2CAP_EV_RECV_REJ:
5892 l2cap_handle_rej(chan, control);
5894 case L2CAP_EV_RECV_SREJ:
5895 l2cap_handle_srej(chan, control);
5901 if (skb && !skb_in_use) {
5902 BT_DBG("Freeing %p", skb);
5909 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
5910 struct l2cap_ctrl *control,
5911 struct sk_buff *skb, u8 event)
5914 u16 txseq = control->txseq;
5915 bool skb_in_use = 0;
5917 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5921 case L2CAP_EV_RECV_IFRAME:
5922 switch (l2cap_classify_txseq(chan, txseq)) {
5923 case L2CAP_TXSEQ_EXPECTED:
5924 /* Keep frame for reassembly later */
5925 l2cap_pass_to_tx(chan, control);
5926 skb_queue_tail(&chan->srej_q, skb);
5928 BT_DBG("Queued %p (queue len %d)", skb,
5929 skb_queue_len(&chan->srej_q));
5931 chan->expected_tx_seq = __next_seq(chan, txseq);
5933 case L2CAP_TXSEQ_EXPECTED_SREJ:
5934 l2cap_seq_list_pop(&chan->srej_list);
5936 l2cap_pass_to_tx(chan, control);
5937 skb_queue_tail(&chan->srej_q, skb);
5939 BT_DBG("Queued %p (queue len %d)", skb,
5940 skb_queue_len(&chan->srej_q));
5942 err = l2cap_rx_queued_iframes(chan);
5947 case L2CAP_TXSEQ_UNEXPECTED:
5948 /* Got a frame that can't be reassembled yet.
5949 * Save it for later, and send SREJs to cover
5950 * the missing frames.
5952 skb_queue_tail(&chan->srej_q, skb);
5954 BT_DBG("Queued %p (queue len %d)", skb,
5955 skb_queue_len(&chan->srej_q));
5957 l2cap_pass_to_tx(chan, control);
5958 l2cap_send_srej(chan, control->txseq);
5960 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
5961 /* This frame was requested with an SREJ, but
5962 * some expected retransmitted frames are
5963 * missing. Request retransmission of missing
5966 skb_queue_tail(&chan->srej_q, skb);
5968 BT_DBG("Queued %p (queue len %d)", skb,
5969 skb_queue_len(&chan->srej_q));
5971 l2cap_pass_to_tx(chan, control);
5972 l2cap_send_srej_list(chan, control->txseq);
5974 case L2CAP_TXSEQ_DUPLICATE_SREJ:
5975 /* We've already queued this frame. Drop this copy. */
5976 l2cap_pass_to_tx(chan, control);
5978 case L2CAP_TXSEQ_DUPLICATE:
5979 /* Expecting a later sequence number, so this frame
5980 * was already received. Ignore it completely.
5983 case L2CAP_TXSEQ_INVALID_IGNORE:
5985 case L2CAP_TXSEQ_INVALID:
5987 l2cap_send_disconn_req(chan, ECONNRESET);
5991 case L2CAP_EV_RECV_RR:
5992 l2cap_pass_to_tx(chan, control);
5993 if (control->final) {
5994 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5996 if (!test_and_clear_bit(CONN_REJ_ACT,
5997 &chan->conn_state)) {
5999 l2cap_retransmit_all(chan, control);
6002 l2cap_ertm_send(chan);
6003 } else if (control->poll) {
6004 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6005 &chan->conn_state) &&
6006 chan->unacked_frames) {
6007 __set_retrans_timer(chan);
6010 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6011 l2cap_send_srej_tail(chan);
6013 if (test_and_clear_bit(CONN_REMOTE_BUSY,
6014 &chan->conn_state) &&
6015 chan->unacked_frames)
6016 __set_retrans_timer(chan);
6018 l2cap_send_ack(chan);
6021 case L2CAP_EV_RECV_RNR:
6022 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6023 l2cap_pass_to_tx(chan, control);
6024 if (control->poll) {
6025 l2cap_send_srej_tail(chan);
6027 struct l2cap_ctrl rr_control;
6028 memset(&rr_control, 0, sizeof(rr_control));
6029 rr_control.sframe = 1;
6030 rr_control.super = L2CAP_SUPER_RR;
6031 rr_control.reqseq = chan->buffer_seq;
6032 l2cap_send_sframe(chan, &rr_control);
6036 case L2CAP_EV_RECV_REJ:
6037 l2cap_handle_rej(chan, control);
6039 case L2CAP_EV_RECV_SREJ:
6040 l2cap_handle_srej(chan, control);
6044 if (skb && !skb_in_use) {
6045 BT_DBG("Freeing %p", skb);
6052 static int l2cap_finish_move(struct l2cap_chan *chan)
6054 BT_DBG("chan %p", chan);
6056 chan->rx_state = L2CAP_RX_STATE_RECV;
6059 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6061 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6063 return l2cap_resegment(chan);
6066 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
6067 struct l2cap_ctrl *control,
6068 struct sk_buff *skb, u8 event)
6072 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
6078 l2cap_process_reqseq(chan, control->reqseq);
6080 if (!skb_queue_empty(&chan->tx_q))
6081 chan->tx_send_head = skb_peek(&chan->tx_q);
6083 chan->tx_send_head = NULL;
6085 /* Rewind next_tx_seq to the point expected
6088 chan->next_tx_seq = control->reqseq;
6089 chan->unacked_frames = 0;
6091 err = l2cap_finish_move(chan);
6095 set_bit(CONN_SEND_FBIT, &chan->conn_state);
6096 l2cap_send_i_or_rr_or_rnr(chan);
6098 if (event == L2CAP_EV_RECV_IFRAME)
6101 return l2cap_rx_state_recv(chan, control, NULL, event);
6104 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
6105 struct l2cap_ctrl *control,
6106 struct sk_buff *skb, u8 event)
6110 if (!control->final)
6113 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
6115 chan->rx_state = L2CAP_RX_STATE_RECV;
6116 l2cap_process_reqseq(chan, control->reqseq);
6118 if (!skb_queue_empty(&chan->tx_q))
6119 chan->tx_send_head = skb_peek(&chan->tx_q);
6121 chan->tx_send_head = NULL;
6123 /* Rewind next_tx_seq to the point expected
6126 chan->next_tx_seq = control->reqseq;
6127 chan->unacked_frames = 0;
6130 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
6132 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
6134 err = l2cap_resegment(chan);
6137 err = l2cap_rx_state_recv(chan, control, skb, event);
6142 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
6144 /* Make sure reqseq is for a packet that has been sent but not acked */
6147 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
6148 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
6151 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6152 struct sk_buff *skb, u8 event)
6156 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
6157 control, skb, event, chan->rx_state);
6159 if (__valid_reqseq(chan, control->reqseq)) {
6160 switch (chan->rx_state) {
6161 case L2CAP_RX_STATE_RECV:
6162 err = l2cap_rx_state_recv(chan, control, skb, event);
6164 case L2CAP_RX_STATE_SREJ_SENT:
6165 err = l2cap_rx_state_srej_sent(chan, control, skb,
6168 case L2CAP_RX_STATE_WAIT_P:
6169 err = l2cap_rx_state_wait_p(chan, control, skb, event);
6171 case L2CAP_RX_STATE_WAIT_F:
6172 err = l2cap_rx_state_wait_f(chan, control, skb, event);
6179 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
6180 control->reqseq, chan->next_tx_seq,
6181 chan->expected_ack_seq);
6182 l2cap_send_disconn_req(chan, ECONNRESET);
6188 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
6189 struct sk_buff *skb)
6193 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
6196 if (l2cap_classify_txseq(chan, control->txseq) ==
6197 L2CAP_TXSEQ_EXPECTED) {
6198 l2cap_pass_to_tx(chan, control);
6200 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
6201 __next_seq(chan, chan->buffer_seq));
6203 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
6205 l2cap_reassemble_sdu(chan, skb, control);
6208 kfree_skb(chan->sdu);
6211 chan->sdu_last_frag = NULL;
6215 BT_DBG("Freeing %p", skb);
6220 chan->last_acked_seq = control->txseq;
6221 chan->expected_tx_seq = __next_seq(chan, control->txseq);
6226 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
6228 struct l2cap_ctrl *control = &bt_cb(skb)->control;
6232 __unpack_control(chan, skb);
6237 * We can just drop the corrupted I-frame here.
6238 * Receiver will miss it and start proper recovery
6239 * procedures and ask for retransmission.
6241 if (l2cap_check_fcs(chan, skb))
6244 if (!control->sframe && control->sar == L2CAP_SAR_START)
6245 len -= L2CAP_SDULEN_SIZE;
6247 if (chan->fcs == L2CAP_FCS_CRC16)
6248 len -= L2CAP_FCS_SIZE;
6250 if (len > chan->mps) {
6251 l2cap_send_disconn_req(chan, ECONNRESET);
6255 if (!control->sframe) {
6258 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6259 control->sar, control->reqseq, control->final,
6262 /* Validate F-bit - F=0 always valid, F=1 only
6263 * valid in TX WAIT_F
6265 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
6268 if (chan->mode != L2CAP_MODE_STREAMING) {
6269 event = L2CAP_EV_RECV_IFRAME;
6270 err = l2cap_rx(chan, control, skb, event);
6272 err = l2cap_stream_rx(chan, control, skb);
6276 l2cap_send_disconn_req(chan, ECONNRESET);
6278 const u8 rx_func_to_event[4] = {
6279 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6280 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6283 /* Only I-frames are expected in streaming mode */
6284 if (chan->mode == L2CAP_MODE_STREAMING)
6287 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6288 control->reqseq, control->final, control->poll,
6292 BT_ERR("Trailing bytes: %d in sframe", len);
6293 l2cap_send_disconn_req(chan, ECONNRESET);
6297 /* Validate F and P bits */
6298 if (control->final && (control->poll ||
6299 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6302 event = rx_func_to_event[control->super];
6303 if (l2cap_rx(chan, control, skb, event))
6304 l2cap_send_disconn_req(chan, ECONNRESET);
6314 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6315 struct sk_buff *skb)
6317 struct l2cap_chan *chan;
6319 chan = l2cap_get_chan_by_scid(conn, cid);
6321 if (cid == L2CAP_CID_A2MP) {
6322 chan = a2mp_channel_create(conn, skb);
6328 l2cap_chan_lock(chan);
6330 BT_DBG("unknown cid 0x%4.4x", cid);
6331 /* Drop packet and return */
6337 BT_DBG("chan %p, len %d", chan, skb->len);
6339 if (chan->state != BT_CONNECTED)
6342 switch (chan->mode) {
6343 case L2CAP_MODE_BASIC:
6344 /* If socket recv buffers overflows we drop data here
6345 * which is *bad* because L2CAP has to be reliable.
6346 * But we don't have any other choice. L2CAP doesn't
6347 * provide flow control mechanism. */
6349 if (chan->imtu < skb->len)
6352 if (!chan->ops->recv(chan, skb))
6356 case L2CAP_MODE_ERTM:
6357 case L2CAP_MODE_STREAMING:
6358 l2cap_data_rcv(chan, skb);
6362 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
6370 l2cap_chan_unlock(chan);
6373 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6374 struct sk_buff *skb)
6376 struct l2cap_chan *chan;
6378 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
6382 BT_DBG("chan %p, len %d", chan, skb->len);
6384 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
6387 if (chan->imtu < skb->len)
6390 if (!chan->ops->recv(chan, skb))
6397 static void l2cap_att_channel(struct l2cap_conn *conn,
6398 struct sk_buff *skb)
6400 struct l2cap_chan *chan;
6402 chan = l2cap_global_chan_by_scid(BT_CONNECTED, L2CAP_CID_ATT,
6403 conn->src, conn->dst);
6407 BT_DBG("chan %p, len %d", chan, skb->len);
6409 if (chan->imtu < skb->len)
6412 if (!chan->ops->recv(chan, skb))
6419 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6421 struct l2cap_hdr *lh = (void *) skb->data;
6425 skb_pull(skb, L2CAP_HDR_SIZE);
6426 cid = __le16_to_cpu(lh->cid);
6427 len = __le16_to_cpu(lh->len);
6429 if (len != skb->len) {
6434 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6437 case L2CAP_CID_LE_SIGNALING:
6438 l2cap_le_sig_channel(conn, skb);
6440 case L2CAP_CID_SIGNALING:
6441 l2cap_sig_channel(conn, skb);
6444 case L2CAP_CID_CONN_LESS:
6445 psm = get_unaligned((__le16 *) skb->data);
6446 skb_pull(skb, L2CAP_PSMLEN_SIZE);
6447 l2cap_conless_channel(conn, psm, skb);
6451 l2cap_att_channel(conn, skb);
6455 if (smp_sig_channel(conn, skb))
6456 l2cap_conn_del(conn->hcon, EACCES);
6460 l2cap_data_channel(conn, cid, skb);
6465 /* ---- L2CAP interface with lower layer (HCI) ---- */
6467 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
6469 int exact = 0, lm1 = 0, lm2 = 0;
6470 struct l2cap_chan *c;
6472 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
6474 /* Find listening sockets and check their link_mode */
6475 read_lock(&chan_list_lock);
6476 list_for_each_entry(c, &chan_list, global_l) {
6477 struct sock *sk = c->sk;
6479 if (c->state != BT_LISTEN)
6482 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
6483 lm1 |= HCI_LM_ACCEPT;
6484 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
6485 lm1 |= HCI_LM_MASTER;
6487 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
6488 lm2 |= HCI_LM_ACCEPT;
6489 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
6490 lm2 |= HCI_LM_MASTER;
6493 read_unlock(&chan_list_lock);
6495 return exact ? lm1 : lm2;
6498 void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
6500 struct l2cap_conn *conn;
6502 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
6505 conn = l2cap_conn_add(hcon);
6507 l2cap_conn_ready(conn);
6509 l2cap_conn_del(hcon, bt_to_errno(status));
6513 int l2cap_disconn_ind(struct hci_conn *hcon)
6515 struct l2cap_conn *conn = hcon->l2cap_data;
6517 BT_DBG("hcon %p", hcon);
6520 return HCI_ERROR_REMOTE_USER_TERM;
6521 return conn->disc_reason;
6524 void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
6526 BT_DBG("hcon %p reason %d", hcon, reason);
6528 l2cap_conn_del(hcon, bt_to_errno(reason));
6531 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
6533 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
6536 if (encrypt == 0x00) {
6537 if (chan->sec_level == BT_SECURITY_MEDIUM) {
6538 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
6539 } else if (chan->sec_level == BT_SECURITY_HIGH)
6540 l2cap_chan_close(chan, ECONNREFUSED);
6542 if (chan->sec_level == BT_SECURITY_MEDIUM)
6543 __clear_chan_timer(chan);
6547 int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
6549 struct l2cap_conn *conn = hcon->l2cap_data;
6550 struct l2cap_chan *chan;
6555 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
6557 if (hcon->type == LE_LINK) {
6558 if (!status && encrypt)
6559 smp_distribute_keys(conn, 0);
6560 cancel_delayed_work(&conn->security_timer);
6563 mutex_lock(&conn->chan_lock);
6565 list_for_each_entry(chan, &conn->chan_l, list) {
6566 l2cap_chan_lock(chan);
6568 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
6569 state_to_string(chan->state));
6571 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
6572 l2cap_chan_unlock(chan);
6576 if (chan->scid == L2CAP_CID_ATT) {
6577 if (!status && encrypt) {
6578 chan->sec_level = hcon->sec_level;
6579 l2cap_chan_ready(chan);
6582 l2cap_chan_unlock(chan);
6586 if (!__l2cap_no_conn_pending(chan)) {
6587 l2cap_chan_unlock(chan);
6591 if (!status && (chan->state == BT_CONNECTED ||
6592 chan->state == BT_CONFIG)) {
6593 struct sock *sk = chan->sk;
6595 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
6596 sk->sk_state_change(sk);
6598 l2cap_check_encryption(chan, encrypt);
6599 l2cap_chan_unlock(chan);
6603 if (chan->state == BT_CONNECT) {
6605 l2cap_start_connection(chan);
6607 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
6609 } else if (chan->state == BT_CONNECT2) {
6610 struct sock *sk = chan->sk;
6611 struct l2cap_conn_rsp rsp;
6617 if (test_bit(BT_SK_DEFER_SETUP,
6618 &bt_sk(sk)->flags)) {
6619 res = L2CAP_CR_PEND;
6620 stat = L2CAP_CS_AUTHOR_PEND;
6621 chan->ops->defer(chan);
6623 __l2cap_state_change(chan, BT_CONFIG);
6624 res = L2CAP_CR_SUCCESS;
6625 stat = L2CAP_CS_NO_INFO;
6628 __l2cap_state_change(chan, BT_DISCONN);
6629 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
6630 res = L2CAP_CR_SEC_BLOCK;
6631 stat = L2CAP_CS_NO_INFO;
6636 rsp.scid = cpu_to_le16(chan->dcid);
6637 rsp.dcid = cpu_to_le16(chan->scid);
6638 rsp.result = cpu_to_le16(res);
6639 rsp.status = cpu_to_le16(stat);
6640 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
6643 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
6644 res == L2CAP_CR_SUCCESS) {
6646 set_bit(CONF_REQ_SENT, &chan->conf_state);
6647 l2cap_send_cmd(conn, l2cap_get_ident(conn),
6649 l2cap_build_conf_req(chan, buf),
6651 chan->num_conf_req++;
6655 l2cap_chan_unlock(chan);
6658 mutex_unlock(&conn->chan_lock);
6663 int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
6665 struct l2cap_conn *conn = hcon->l2cap_data;
6666 struct l2cap_hdr *hdr;
6669 /* For AMP controller do not create l2cap conn */
6670 if (!conn && hcon->hdev->dev_type != HCI_BREDR)
6674 conn = l2cap_conn_add(hcon);
6679 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
6683 case ACL_START_NO_FLUSH:
6686 BT_ERR("Unexpected start frame (len %d)", skb->len);
6687 kfree_skb(conn->rx_skb);
6688 conn->rx_skb = NULL;
6690 l2cap_conn_unreliable(conn, ECOMM);
6693 /* Start fragment always begin with Basic L2CAP header */
6694 if (skb->len < L2CAP_HDR_SIZE) {
6695 BT_ERR("Frame is too short (len %d)", skb->len);
6696 l2cap_conn_unreliable(conn, ECOMM);
6700 hdr = (struct l2cap_hdr *) skb->data;
6701 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
6703 if (len == skb->len) {
6704 /* Complete frame received */
6705 l2cap_recv_frame(conn, skb);
6709 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
6711 if (skb->len > len) {
6712 BT_ERR("Frame is too long (len %d, expected len %d)",
6714 l2cap_conn_unreliable(conn, ECOMM);
6718 /* Allocate skb for the complete frame (with header) */
6719 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
6723 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
6725 conn->rx_len = len - skb->len;
6729 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
6731 if (!conn->rx_len) {
6732 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
6733 l2cap_conn_unreliable(conn, ECOMM);
6737 if (skb->len > conn->rx_len) {
6738 BT_ERR("Fragment is too long (len %d, expected %d)",
6739 skb->len, conn->rx_len);
6740 kfree_skb(conn->rx_skb);
6741 conn->rx_skb = NULL;
6743 l2cap_conn_unreliable(conn, ECOMM);
6747 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
6749 conn->rx_len -= skb->len;
6751 if (!conn->rx_len) {
6752 /* Complete frame received */
6753 l2cap_recv_frame(conn, conn->rx_skb);
6754 conn->rx_skb = NULL;
6764 static int l2cap_debugfs_show(struct seq_file *f, void *p)
6766 struct l2cap_chan *c;
6768 read_lock(&chan_list_lock);
6770 list_for_each_entry(c, &chan_list, global_l) {
6771 struct sock *sk = c->sk;
6773 seq_printf(f, "%pMR %pMR %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
6774 &bt_sk(sk)->src, &bt_sk(sk)->dst,
6775 c->state, __le16_to_cpu(c->psm),
6776 c->scid, c->dcid, c->imtu, c->omtu,
6777 c->sec_level, c->mode);
6780 read_unlock(&chan_list_lock);
6785 static int l2cap_debugfs_open(struct inode *inode, struct file *file)
6787 return single_open(file, l2cap_debugfs_show, inode->i_private);
6790 static const struct file_operations l2cap_debugfs_fops = {
6791 .open = l2cap_debugfs_open,
6793 .llseek = seq_lseek,
6794 .release = single_release,
6797 static struct dentry *l2cap_debugfs;
6799 int __init l2cap_init(void)
6803 err = l2cap_init_sockets();
6808 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
6809 NULL, &l2cap_debugfs_fops);
6811 BT_ERR("Failed to create L2CAP debug file");
6817 void l2cap_exit(void)
6819 debugfs_remove(l2cap_debugfs);
6820 l2cap_cleanup_sockets();
6823 module_param(disable_ertm, bool, 0644);
6824 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");