1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 5 Copyright (C) 2010 Google Inc. 6 Copyright (C) 2011 ProFUSION Embedded Systems 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved. 8 9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 10 11 This program is free software; you can redistribute it and/or modify 12 it under the terms of the GNU General Public License version 2 as 13 published by the Free Software Foundation; 14 15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 23 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 26 SOFTWARE IS DISCLAIMED. 27 */ 28 29 /* Bluetooth L2CAP core. */ 30 31 #include <linux/module.h> 32 33 #include <linux/debugfs.h> 34 #include <linux/crc16.h> 35 #include <linux/filter.h> 36 37 #include <net/bluetooth/bluetooth.h> 38 #include <net/bluetooth/hci_core.h> 39 #include <net/bluetooth/l2cap.h> 40 41 #include "smp.h" 42 43 #define LE_FLOWCTL_MAX_CREDITS 65535 44 45 bool disable_ertm; 46 bool enable_ecred = IS_ENABLED(CONFIG_BT_LE_L2CAP_ECRED); 47 48 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN | L2CAP_FEAT_UCD; 49 50 static LIST_HEAD(chan_list); 51 static DEFINE_RWLOCK(chan_list_lock); 52 53 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 54 u8 code, u8 ident, u16 dlen, void *data); 55 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 56 void *data); 57 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); 58 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); 59 60 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 61 struct sk_buff_head *skbs, u8 event); 62 static void l2cap_retrans_timeout(struct work_struct *work); 63 static void l2cap_monitor_timeout(struct work_struct *work); 64 static void l2cap_ack_timeout(struct work_struct *work); 65 66 static inline u8 bdaddr_type(u8 link_type, u8 bdaddr_type) 67 { 68 if (link_type == LE_LINK) { 69 if (bdaddr_type == ADDR_LE_DEV_PUBLIC) 70 return BDADDR_LE_PUBLIC; 71 else 72 return BDADDR_LE_RANDOM; 73 } 74 75 return BDADDR_BREDR; 76 } 77 78 static inline u8 bdaddr_src_type(struct hci_conn *hcon) 79 { 80 return bdaddr_type(hcon->type, hcon->src_type); 81 } 82 83 static inline u8 bdaddr_dst_type(struct hci_conn *hcon) 84 { 85 return bdaddr_type(hcon->type, hcon->dst_type); 86 } 87 88 /* ---- L2CAP channels ---- */ 89 90 static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 91 u16 cid) 92 { 93 struct l2cap_chan *c; 94 95 list_for_each_entry(c, &conn->chan_l, list) { 96 if (c->dcid == cid) 97 return c; 98 } 99 return NULL; 100 } 101 102 static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, 103 u16 cid) 104 { 105 struct l2cap_chan *c; 106 107 list_for_each_entry(c, &conn->chan_l, list) { 108 if (c->scid == cid) 109 return c; 110 } 111 return NULL; 112 } 113 114 /* Find channel with given SCID. 115 * Returns a reference locked channel. 116 */ 117 static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, 118 u16 cid) 119 { 120 struct l2cap_chan *c; 121 122 c = __l2cap_get_chan_by_scid(conn, cid); 123 if (c) { 124 /* Only lock if chan reference is not 0 */ 125 c = l2cap_chan_hold_unless_zero(c); 126 if (c) 127 l2cap_chan_lock(c); 128 } 129 130 return c; 131 } 132 133 /* Find channel with given DCID. 134 * Returns a reference locked channel. 135 */ 136 static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn, 137 u16 cid) 138 { 139 struct l2cap_chan *c; 140 141 c = __l2cap_get_chan_by_dcid(conn, cid); 142 if (c) { 143 /* Only lock if chan reference is not 0 */ 144 c = l2cap_chan_hold_unless_zero(c); 145 if (c) 146 l2cap_chan_lock(c); 147 } 148 149 return c; 150 } 151 152 static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, 153 u8 ident) 154 { 155 struct l2cap_chan *c; 156 157 list_for_each_entry(c, &conn->chan_l, list) { 158 if (c->ident == ident) 159 return c; 160 } 161 return NULL; 162 } 163 164 static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src, 165 u8 src_type) 166 { 167 struct l2cap_chan *c; 168 169 list_for_each_entry(c, &chan_list, global_l) { 170 if (src_type == BDADDR_BREDR && c->src_type != BDADDR_BREDR) 171 continue; 172 173 if (src_type != BDADDR_BREDR && c->src_type == BDADDR_BREDR) 174 continue; 175 176 if (c->sport == psm && !bacmp(&c->src, src)) 177 return c; 178 } 179 return NULL; 180 } 181 182 int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 183 { 184 int err; 185 186 write_lock(&chan_list_lock); 187 188 if (psm && __l2cap_global_chan_by_addr(psm, src, chan->src_type)) { 189 err = -EADDRINUSE; 190 goto done; 191 } 192 193 if (psm) { 194 chan->psm = psm; 195 chan->sport = psm; 196 err = 0; 197 } else { 198 u16 p, start, end, incr; 199 200 if (chan->src_type == BDADDR_BREDR) { 201 start = L2CAP_PSM_DYN_START; 202 end = L2CAP_PSM_AUTO_END; 203 incr = 2; 204 } else { 205 start = L2CAP_PSM_LE_DYN_START; 206 end = L2CAP_PSM_LE_DYN_END; 207 incr = 1; 208 } 209 210 err = -EINVAL; 211 for (p = start; p <= end; p += incr) 212 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src, 213 chan->src_type)) { 214 chan->psm = cpu_to_le16(p); 215 chan->sport = cpu_to_le16(p); 216 err = 0; 217 break; 218 } 219 } 220 221 done: 222 write_unlock(&chan_list_lock); 223 return err; 224 } 225 EXPORT_SYMBOL_GPL(l2cap_add_psm); 226 227 int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 228 { 229 write_lock(&chan_list_lock); 230 231 /* Override the defaults (which are for conn-oriented) */ 232 chan->omtu = L2CAP_DEFAULT_MTU; 233 chan->chan_type = L2CAP_CHAN_FIXED; 234 235 chan->scid = scid; 236 237 write_unlock(&chan_list_lock); 238 239 return 0; 240 } 241 242 static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 243 { 244 u16 cid, dyn_end; 245 246 if (conn->hcon->type == LE_LINK) 247 dyn_end = L2CAP_CID_LE_DYN_END; 248 else 249 dyn_end = L2CAP_CID_DYN_END; 250 251 for (cid = L2CAP_CID_DYN_START; cid <= dyn_end; cid++) { 252 if (!__l2cap_get_chan_by_scid(conn, cid)) 253 return cid; 254 } 255 256 return 0; 257 } 258 259 static void l2cap_state_change(struct l2cap_chan *chan, int state) 260 { 261 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state), 262 state_to_string(state)); 263 264 chan->state = state; 265 chan->ops->state_change(chan, state, 0); 266 } 267 268 static inline void l2cap_state_change_and_error(struct l2cap_chan *chan, 269 int state, int err) 270 { 271 chan->state = state; 272 chan->ops->state_change(chan, chan->state, err); 273 } 274 275 static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err) 276 { 277 chan->ops->state_change(chan, chan->state, err); 278 } 279 280 static void __set_retrans_timer(struct l2cap_chan *chan) 281 { 282 if (!delayed_work_pending(&chan->monitor_timer) && 283 chan->retrans_timeout) { 284 l2cap_set_timer(chan, &chan->retrans_timer, 285 secs_to_jiffies(chan->retrans_timeout)); 286 } 287 } 288 289 static void __set_monitor_timer(struct l2cap_chan *chan) 290 { 291 __clear_retrans_timer(chan); 292 if (chan->monitor_timeout) { 293 l2cap_set_timer(chan, &chan->monitor_timer, 294 secs_to_jiffies(chan->monitor_timeout)); 295 } 296 } 297 298 static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head, 299 u16 seq) 300 { 301 struct sk_buff *skb; 302 303 skb_queue_walk(head, skb) { 304 if (bt_cb(skb)->l2cap.txseq == seq) 305 return skb; 306 } 307 308 return NULL; 309 } 310 311 /* ---- L2CAP sequence number lists ---- */ 312 313 /* For ERTM, ordered lists of sequence numbers must be tracked for 314 * SREJ requests that are received and for frames that are to be 315 * retransmitted. These seq_list functions implement a singly-linked 316 * list in an array, where membership in the list can also be checked 317 * in constant time. Items can also be added to the tail of the list 318 * and removed from the head in constant time, without further memory 319 * allocs or frees. 320 */ 321 322 static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size) 323 { 324 size_t alloc_size, i; 325 326 /* Allocated size is a power of 2 to map sequence numbers 327 * (which may be up to 14 bits) in to a smaller array that is 328 * sized for the negotiated ERTM transmit windows. 329 */ 330 alloc_size = roundup_pow_of_two(size); 331 332 seq_list->list = kmalloc_array(alloc_size, sizeof(u16), GFP_KERNEL); 333 if (!seq_list->list) 334 return -ENOMEM; 335 336 seq_list->mask = alloc_size - 1; 337 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 338 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 339 for (i = 0; i < alloc_size; i++) 340 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 341 342 return 0; 343 } 344 345 static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list) 346 { 347 kfree(seq_list->list); 348 } 349 350 static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list, 351 u16 seq) 352 { 353 /* Constant-time check for list membership */ 354 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR; 355 } 356 357 static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list) 358 { 359 u16 seq = seq_list->head; 360 u16 mask = seq_list->mask; 361 362 seq_list->head = seq_list->list[seq & mask]; 363 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR; 364 365 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) { 366 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 367 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 368 } 369 370 return seq; 371 } 372 373 static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list) 374 { 375 u16 i; 376 377 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) 378 return; 379 380 for (i = 0; i <= seq_list->mask; i++) 381 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR; 382 383 seq_list->head = L2CAP_SEQ_LIST_CLEAR; 384 seq_list->tail = L2CAP_SEQ_LIST_CLEAR; 385 } 386 387 static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq) 388 { 389 u16 mask = seq_list->mask; 390 391 /* All appends happen in constant time */ 392 393 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR) 394 return; 395 396 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR) 397 seq_list->head = seq; 398 else 399 seq_list->list[seq_list->tail & mask] = seq; 400 401 seq_list->tail = seq; 402 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL; 403 } 404 405 static void l2cap_chan_timeout(struct work_struct *work) 406 { 407 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 408 chan_timer.work); 409 struct l2cap_conn *conn = chan->conn; 410 int reason; 411 412 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 413 414 if (!conn) 415 return; 416 417 mutex_lock(&conn->lock); 418 /* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling 419 * this work. No need to call l2cap_chan_hold(chan) here again. 420 */ 421 l2cap_chan_lock(chan); 422 423 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 424 reason = ECONNREFUSED; 425 else if (chan->state == BT_CONNECT && 426 chan->sec_level != BT_SECURITY_SDP) 427 reason = ECONNREFUSED; 428 else 429 reason = ETIMEDOUT; 430 431 l2cap_chan_close(chan, reason); 432 433 chan->ops->close(chan); 434 435 l2cap_chan_unlock(chan); 436 l2cap_chan_put(chan); 437 438 mutex_unlock(&conn->lock); 439 } 440 441 struct l2cap_chan *l2cap_chan_create(void) 442 { 443 struct l2cap_chan *chan; 444 445 chan = kzalloc(sizeof(*chan), GFP_ATOMIC); 446 if (!chan) 447 return NULL; 448 449 skb_queue_head_init(&chan->tx_q); 450 skb_queue_head_init(&chan->srej_q); 451 mutex_init(&chan->lock); 452 453 /* Set default lock nesting level */ 454 atomic_set(&chan->nesting, L2CAP_NESTING_NORMAL); 455 456 /* Available receive buffer space is initially unknown */ 457 chan->rx_avail = -1; 458 459 write_lock(&chan_list_lock); 460 list_add(&chan->global_l, &chan_list); 461 write_unlock(&chan_list_lock); 462 463 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout); 464 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout); 465 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout); 466 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout); 467 468 chan->state = BT_OPEN; 469 470 kref_init(&chan->kref); 471 472 /* This flag is cleared in l2cap_chan_ready() */ 473 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 474 475 BT_DBG("chan %p", chan); 476 477 return chan; 478 } 479 EXPORT_SYMBOL_GPL(l2cap_chan_create); 480 481 static void l2cap_chan_destroy(struct kref *kref) 482 { 483 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref); 484 485 BT_DBG("chan %p", chan); 486 487 write_lock(&chan_list_lock); 488 list_del(&chan->global_l); 489 write_unlock(&chan_list_lock); 490 491 kfree(chan); 492 } 493 494 void l2cap_chan_hold(struct l2cap_chan *c) 495 { 496 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 497 498 kref_get(&c->kref); 499 } 500 501 struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c) 502 { 503 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 504 505 if (!kref_get_unless_zero(&c->kref)) 506 return NULL; 507 508 return c; 509 } 510 511 void l2cap_chan_put(struct l2cap_chan *c) 512 { 513 BT_DBG("chan %p orig refcnt %u", c, kref_read(&c->kref)); 514 515 kref_put(&c->kref, l2cap_chan_destroy); 516 } 517 EXPORT_SYMBOL_GPL(l2cap_chan_put); 518 519 void l2cap_chan_set_defaults(struct l2cap_chan *chan) 520 { 521 chan->fcs = L2CAP_FCS_CRC16; 522 chan->max_tx = L2CAP_DEFAULT_MAX_TX; 523 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW; 524 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 525 chan->remote_max_tx = chan->max_tx; 526 chan->remote_tx_win = chan->tx_win; 527 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW; 528 chan->sec_level = BT_SECURITY_LOW; 529 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO; 530 chan->retrans_timeout = L2CAP_DEFAULT_RETRANS_TO; 531 chan->monitor_timeout = L2CAP_DEFAULT_MONITOR_TO; 532 533 chan->conf_state = 0; 534 set_bit(CONF_NOT_COMPLETE, &chan->conf_state); 535 536 set_bit(FLAG_FORCE_ACTIVE, &chan->flags); 537 } 538 EXPORT_SYMBOL_GPL(l2cap_chan_set_defaults); 539 540 static __u16 l2cap_le_rx_credits(struct l2cap_chan *chan) 541 { 542 size_t sdu_len = chan->sdu ? chan->sdu->len : 0; 543 544 if (chan->mps == 0) 545 return 0; 546 547 /* If we don't know the available space in the receiver buffer, give 548 * enough credits for a full packet. 549 */ 550 if (chan->rx_avail == -1) 551 return (chan->imtu / chan->mps) + 1; 552 553 /* If we know how much space is available in the receive buffer, give 554 * out as many credits as would fill the buffer. 555 */ 556 if (chan->rx_avail <= sdu_len) 557 return 0; 558 559 return DIV_ROUND_UP(chan->rx_avail - sdu_len, chan->mps); 560 } 561 562 static void l2cap_le_flowctl_init(struct l2cap_chan *chan, u16 tx_credits) 563 { 564 chan->sdu = NULL; 565 chan->sdu_last_frag = NULL; 566 chan->sdu_len = 0; 567 chan->tx_credits = tx_credits; 568 /* Derive MPS from connection MTU to stop HCI fragmentation */ 569 chan->mps = min_t(u16, chan->imtu, chan->conn->mtu - L2CAP_HDR_SIZE); 570 chan->rx_credits = l2cap_le_rx_credits(chan); 571 572 skb_queue_head_init(&chan->tx_q); 573 } 574 575 static void l2cap_ecred_init(struct l2cap_chan *chan, u16 tx_credits) 576 { 577 l2cap_le_flowctl_init(chan, tx_credits); 578 579 /* L2CAP implementations shall support a minimum MPS of 64 octets */ 580 if (chan->mps < L2CAP_ECRED_MIN_MPS) { 581 chan->mps = L2CAP_ECRED_MIN_MPS; 582 chan->rx_credits = l2cap_le_rx_credits(chan); 583 } 584 } 585 586 void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 587 { 588 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 589 __le16_to_cpu(chan->psm), chan->dcid); 590 591 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 592 593 chan->conn = conn; 594 595 switch (chan->chan_type) { 596 case L2CAP_CHAN_CONN_ORIENTED: 597 /* Alloc CID for connection-oriented socket */ 598 chan->scid = l2cap_alloc_cid(conn); 599 if (conn->hcon->type == ACL_LINK) 600 chan->omtu = L2CAP_DEFAULT_MTU; 601 break; 602 603 case L2CAP_CHAN_CONN_LESS: 604 /* Connectionless socket */ 605 chan->scid = L2CAP_CID_CONN_LESS; 606 chan->dcid = L2CAP_CID_CONN_LESS; 607 chan->omtu = L2CAP_DEFAULT_MTU; 608 break; 609 610 case L2CAP_CHAN_FIXED: 611 /* Caller will set CID and CID specific MTU values */ 612 break; 613 614 default: 615 /* Raw socket can send/recv signalling messages only */ 616 chan->scid = L2CAP_CID_SIGNALING; 617 chan->dcid = L2CAP_CID_SIGNALING; 618 chan->omtu = L2CAP_DEFAULT_MTU; 619 } 620 621 chan->local_id = L2CAP_BESTEFFORT_ID; 622 chan->local_stype = L2CAP_SERV_BESTEFFORT; 623 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE; 624 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME; 625 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT; 626 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO; 627 628 l2cap_chan_hold(chan); 629 630 /* Only keep a reference for fixed channels if they requested it */ 631 if (chan->chan_type != L2CAP_CHAN_FIXED || 632 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 633 hci_conn_hold(conn->hcon); 634 635 /* Append to the list since the order matters for ECRED */ 636 list_add_tail(&chan->list, &conn->chan_l); 637 } 638 639 void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 640 { 641 mutex_lock(&conn->lock); 642 __l2cap_chan_add(conn, chan); 643 mutex_unlock(&conn->lock); 644 } 645 646 void l2cap_chan_del(struct l2cap_chan *chan, int err) 647 { 648 struct l2cap_conn *conn = chan->conn; 649 650 __clear_chan_timer(chan); 651 652 BT_DBG("chan %p, conn %p, err %d, state %s", chan, conn, err, 653 state_to_string(chan->state)); 654 655 chan->ops->teardown(chan, err); 656 657 if (conn) { 658 /* Delete from channel list */ 659 list_del(&chan->list); 660 661 l2cap_chan_put(chan); 662 663 chan->conn = NULL; 664 665 /* Reference was only held for non-fixed channels or 666 * fixed channels that explicitly requested it using the 667 * FLAG_HOLD_HCI_CONN flag. 668 */ 669 if (chan->chan_type != L2CAP_CHAN_FIXED || 670 test_bit(FLAG_HOLD_HCI_CONN, &chan->flags)) 671 hci_conn_drop(conn->hcon); 672 } 673 674 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state)) 675 return; 676 677 switch (chan->mode) { 678 case L2CAP_MODE_BASIC: 679 break; 680 681 case L2CAP_MODE_LE_FLOWCTL: 682 case L2CAP_MODE_EXT_FLOWCTL: 683 skb_queue_purge(&chan->tx_q); 684 break; 685 686 case L2CAP_MODE_ERTM: 687 __clear_retrans_timer(chan); 688 __clear_monitor_timer(chan); 689 __clear_ack_timer(chan); 690 691 skb_queue_purge(&chan->srej_q); 692 693 l2cap_seq_list_free(&chan->srej_list); 694 l2cap_seq_list_free(&chan->retrans_list); 695 fallthrough; 696 697 case L2CAP_MODE_STREAMING: 698 skb_queue_purge(&chan->tx_q); 699 break; 700 } 701 } 702 EXPORT_SYMBOL_GPL(l2cap_chan_del); 703 704 static void __l2cap_chan_list_id(struct l2cap_conn *conn, u16 id, 705 l2cap_chan_func_t func, void *data) 706 { 707 struct l2cap_chan *chan, *l; 708 709 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 710 if (chan->ident == id) 711 func(chan, data); 712 } 713 } 714 715 static void __l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 716 void *data) 717 { 718 struct l2cap_chan *chan; 719 720 list_for_each_entry(chan, &conn->chan_l, list) { 721 func(chan, data); 722 } 723 } 724 725 void l2cap_chan_list(struct l2cap_conn *conn, l2cap_chan_func_t func, 726 void *data) 727 { 728 if (!conn) 729 return; 730 731 mutex_lock(&conn->lock); 732 __l2cap_chan_list(conn, func, data); 733 mutex_unlock(&conn->lock); 734 } 735 736 EXPORT_SYMBOL_GPL(l2cap_chan_list); 737 738 static void l2cap_conn_update_id_addr(struct work_struct *work) 739 { 740 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 741 id_addr_timer.work); 742 struct hci_conn *hcon = conn->hcon; 743 struct l2cap_chan *chan; 744 745 mutex_lock(&conn->lock); 746 747 list_for_each_entry(chan, &conn->chan_l, list) { 748 l2cap_chan_lock(chan); 749 bacpy(&chan->dst, &hcon->dst); 750 chan->dst_type = bdaddr_dst_type(hcon); 751 l2cap_chan_unlock(chan); 752 } 753 754 mutex_unlock(&conn->lock); 755 } 756 757 static void l2cap_chan_le_connect_reject(struct l2cap_chan *chan) 758 { 759 struct l2cap_conn *conn = chan->conn; 760 struct l2cap_le_conn_rsp rsp; 761 u16 result; 762 763 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 764 result = L2CAP_CR_LE_AUTHORIZATION; 765 else 766 result = L2CAP_CR_LE_BAD_PSM; 767 768 l2cap_state_change(chan, BT_DISCONN); 769 770 rsp.dcid = cpu_to_le16(chan->scid); 771 rsp.mtu = cpu_to_le16(chan->imtu); 772 rsp.mps = cpu_to_le16(chan->mps); 773 rsp.credits = cpu_to_le16(chan->rx_credits); 774 rsp.result = cpu_to_le16(result); 775 776 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 777 &rsp); 778 } 779 780 static void l2cap_chan_ecred_connect_reject(struct l2cap_chan *chan) 781 { 782 l2cap_state_change(chan, BT_DISCONN); 783 784 __l2cap_ecred_conn_rsp_defer(chan); 785 } 786 787 static void l2cap_chan_connect_reject(struct l2cap_chan *chan) 788 { 789 struct l2cap_conn *conn = chan->conn; 790 struct l2cap_conn_rsp rsp; 791 u16 result; 792 793 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 794 result = L2CAP_CR_SEC_BLOCK; 795 else 796 result = L2CAP_CR_BAD_PSM; 797 798 l2cap_state_change(chan, BT_DISCONN); 799 800 rsp.scid = cpu_to_le16(chan->dcid); 801 rsp.dcid = cpu_to_le16(chan->scid); 802 rsp.result = cpu_to_le16(result); 803 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 804 805 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 806 } 807 808 void l2cap_chan_close(struct l2cap_chan *chan, int reason) 809 { 810 struct l2cap_conn *conn = chan->conn; 811 812 BT_DBG("chan %p state %s", chan, state_to_string(chan->state)); 813 814 switch (chan->state) { 815 case BT_LISTEN: 816 chan->ops->teardown(chan, 0); 817 break; 818 819 case BT_CONNECTED: 820 case BT_CONFIG: 821 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 822 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 823 l2cap_send_disconn_req(chan, reason); 824 } else 825 l2cap_chan_del(chan, reason); 826 break; 827 828 case BT_CONNECT2: 829 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 830 if (conn->hcon->type == ACL_LINK) 831 l2cap_chan_connect_reject(chan); 832 else if (conn->hcon->type == LE_LINK) { 833 switch (chan->mode) { 834 case L2CAP_MODE_LE_FLOWCTL: 835 l2cap_chan_le_connect_reject(chan); 836 break; 837 case L2CAP_MODE_EXT_FLOWCTL: 838 l2cap_chan_ecred_connect_reject(chan); 839 return; 840 } 841 } 842 } 843 844 l2cap_chan_del(chan, reason); 845 break; 846 847 case BT_CONNECT: 848 case BT_DISCONN: 849 l2cap_chan_del(chan, reason); 850 break; 851 852 default: 853 chan->ops->teardown(chan, 0); 854 break; 855 } 856 } 857 EXPORT_SYMBOL(l2cap_chan_close); 858 859 static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 860 { 861 switch (chan->chan_type) { 862 case L2CAP_CHAN_RAW: 863 switch (chan->sec_level) { 864 case BT_SECURITY_HIGH: 865 case BT_SECURITY_FIPS: 866 return HCI_AT_DEDICATED_BONDING_MITM; 867 case BT_SECURITY_MEDIUM: 868 return HCI_AT_DEDICATED_BONDING; 869 default: 870 return HCI_AT_NO_BONDING; 871 } 872 break; 873 case L2CAP_CHAN_CONN_LESS: 874 if (chan->psm == cpu_to_le16(L2CAP_PSM_3DSP)) { 875 if (chan->sec_level == BT_SECURITY_LOW) 876 chan->sec_level = BT_SECURITY_SDP; 877 } 878 if (chan->sec_level == BT_SECURITY_HIGH || 879 chan->sec_level == BT_SECURITY_FIPS) 880 return HCI_AT_NO_BONDING_MITM; 881 else 882 return HCI_AT_NO_BONDING; 883 break; 884 case L2CAP_CHAN_CONN_ORIENTED: 885 if (chan->psm == cpu_to_le16(L2CAP_PSM_SDP)) { 886 if (chan->sec_level == BT_SECURITY_LOW) 887 chan->sec_level = BT_SECURITY_SDP; 888 889 if (chan->sec_level == BT_SECURITY_HIGH || 890 chan->sec_level == BT_SECURITY_FIPS) 891 return HCI_AT_NO_BONDING_MITM; 892 else 893 return HCI_AT_NO_BONDING; 894 } 895 fallthrough; 896 897 default: 898 switch (chan->sec_level) { 899 case BT_SECURITY_HIGH: 900 case BT_SECURITY_FIPS: 901 return HCI_AT_GENERAL_BONDING_MITM; 902 case BT_SECURITY_MEDIUM: 903 return HCI_AT_GENERAL_BONDING; 904 default: 905 return HCI_AT_NO_BONDING; 906 } 907 break; 908 } 909 } 910 911 /* Service level security */ 912 int l2cap_chan_check_security(struct l2cap_chan *chan, bool initiator) 913 { 914 struct l2cap_conn *conn = chan->conn; 915 __u8 auth_type; 916 917 if (conn->hcon->type == LE_LINK) 918 return smp_conn_security(conn->hcon, chan->sec_level); 919 920 auth_type = l2cap_get_auth_type(chan); 921 922 return hci_conn_security(conn->hcon, chan->sec_level, auth_type, 923 initiator); 924 } 925 926 static u8 l2cap_get_ident(struct l2cap_conn *conn) 927 { 928 u8 id; 929 930 /* Get next available identificator. 931 * 1 - 128 are used by kernel. 932 * 129 - 199 are reserved. 933 * 200 - 254 are used by utilities like l2ping, etc. 934 */ 935 936 mutex_lock(&conn->ident_lock); 937 938 if (++conn->tx_ident > 128) 939 conn->tx_ident = 1; 940 941 id = conn->tx_ident; 942 943 mutex_unlock(&conn->ident_lock); 944 945 return id; 946 } 947 948 static void l2cap_send_acl(struct l2cap_conn *conn, struct sk_buff *skb, 949 u8 flags) 950 { 951 /* Check if the hcon still valid before attempting to send */ 952 if (hci_conn_valid(conn->hcon->hdev, conn->hcon)) 953 hci_send_acl(conn->hchan, skb, flags); 954 else 955 kfree_skb(skb); 956 } 957 958 static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 959 void *data) 960 { 961 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 962 u8 flags; 963 964 BT_DBG("code 0x%2.2x", code); 965 966 if (!skb) 967 return; 968 969 /* Use NO_FLUSH if supported or we have an LE link (which does 970 * not support auto-flushing packets) */ 971 if (lmp_no_flush_capable(conn->hcon->hdev) || 972 conn->hcon->type == LE_LINK) 973 flags = ACL_START_NO_FLUSH; 974 else 975 flags = ACL_START; 976 977 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 978 skb->priority = HCI_PRIO_MAX; 979 980 l2cap_send_acl(conn, skb, flags); 981 } 982 983 static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 984 { 985 struct hci_conn *hcon = chan->conn->hcon; 986 u16 flags; 987 988 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len, 989 skb->priority); 990 991 /* Use NO_FLUSH for LE links (where this is the only option) or 992 * if the BR/EDR link supports it and flushing has not been 993 * explicitly requested (through FLAG_FLUSHABLE). 994 */ 995 if (hcon->type == LE_LINK || 996 (!test_bit(FLAG_FLUSHABLE, &chan->flags) && 997 lmp_no_flush_capable(hcon->hdev))) 998 flags = ACL_START_NO_FLUSH; 999 else 1000 flags = ACL_START; 1001 1002 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 1003 hci_send_acl(chan->conn->hchan, skb, flags); 1004 } 1005 1006 static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control) 1007 { 1008 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT; 1009 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT; 1010 1011 if (enh & L2CAP_CTRL_FRAME_TYPE) { 1012 /* S-Frame */ 1013 control->sframe = 1; 1014 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT; 1015 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT; 1016 1017 control->sar = 0; 1018 control->txseq = 0; 1019 } else { 1020 /* I-Frame */ 1021 control->sframe = 0; 1022 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT; 1023 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT; 1024 1025 control->poll = 0; 1026 control->super = 0; 1027 } 1028 } 1029 1030 static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control) 1031 { 1032 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1033 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT; 1034 1035 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) { 1036 /* S-Frame */ 1037 control->sframe = 1; 1038 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT; 1039 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT; 1040 1041 control->sar = 0; 1042 control->txseq = 0; 1043 } else { 1044 /* I-Frame */ 1045 control->sframe = 0; 1046 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT; 1047 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1048 1049 control->poll = 0; 1050 control->super = 0; 1051 } 1052 } 1053 1054 static inline void __unpack_control(struct l2cap_chan *chan, 1055 struct sk_buff *skb) 1056 { 1057 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1058 __unpack_extended_control(get_unaligned_le32(skb->data), 1059 &bt_cb(skb)->l2cap); 1060 skb_pull(skb, L2CAP_EXT_CTRL_SIZE); 1061 } else { 1062 __unpack_enhanced_control(get_unaligned_le16(skb->data), 1063 &bt_cb(skb)->l2cap); 1064 skb_pull(skb, L2CAP_ENH_CTRL_SIZE); 1065 } 1066 } 1067 1068 static u32 __pack_extended_control(struct l2cap_ctrl *control) 1069 { 1070 u32 packed; 1071 1072 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT; 1073 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT; 1074 1075 if (control->sframe) { 1076 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT; 1077 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT; 1078 packed |= L2CAP_EXT_CTRL_FRAME_TYPE; 1079 } else { 1080 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT; 1081 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT; 1082 } 1083 1084 return packed; 1085 } 1086 1087 static u16 __pack_enhanced_control(struct l2cap_ctrl *control) 1088 { 1089 u16 packed; 1090 1091 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT; 1092 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT; 1093 1094 if (control->sframe) { 1095 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT; 1096 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT; 1097 packed |= L2CAP_CTRL_FRAME_TYPE; 1098 } else { 1099 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT; 1100 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT; 1101 } 1102 1103 return packed; 1104 } 1105 1106 static inline void __pack_control(struct l2cap_chan *chan, 1107 struct l2cap_ctrl *control, 1108 struct sk_buff *skb) 1109 { 1110 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 1111 put_unaligned_le32(__pack_extended_control(control), 1112 skb->data + L2CAP_HDR_SIZE); 1113 } else { 1114 put_unaligned_le16(__pack_enhanced_control(control), 1115 skb->data + L2CAP_HDR_SIZE); 1116 } 1117 } 1118 1119 static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan) 1120 { 1121 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1122 return L2CAP_EXT_HDR_SIZE; 1123 else 1124 return L2CAP_ENH_HDR_SIZE; 1125 } 1126 1127 static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan, 1128 u32 control) 1129 { 1130 struct sk_buff *skb; 1131 struct l2cap_hdr *lh; 1132 int hlen = __ertm_hdr_size(chan); 1133 1134 if (chan->fcs == L2CAP_FCS_CRC16) 1135 hlen += L2CAP_FCS_SIZE; 1136 1137 skb = bt_skb_alloc(hlen, GFP_KERNEL); 1138 1139 if (!skb) 1140 return ERR_PTR(-ENOMEM); 1141 1142 lh = skb_put(skb, L2CAP_HDR_SIZE); 1143 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 1144 lh->cid = cpu_to_le16(chan->dcid); 1145 1146 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1147 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 1148 else 1149 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 1150 1151 if (chan->fcs == L2CAP_FCS_CRC16) { 1152 u16 fcs = crc16(0, (u8 *)skb->data, skb->len); 1153 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1154 } 1155 1156 skb->priority = HCI_PRIO_MAX; 1157 return skb; 1158 } 1159 1160 static void l2cap_send_sframe(struct l2cap_chan *chan, 1161 struct l2cap_ctrl *control) 1162 { 1163 struct sk_buff *skb; 1164 u32 control_field; 1165 1166 BT_DBG("chan %p, control %p", chan, control); 1167 1168 if (!control->sframe) 1169 return; 1170 1171 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) && 1172 !control->poll) 1173 control->final = 1; 1174 1175 if (control->super == L2CAP_SUPER_RR) 1176 clear_bit(CONN_RNR_SENT, &chan->conn_state); 1177 else if (control->super == L2CAP_SUPER_RNR) 1178 set_bit(CONN_RNR_SENT, &chan->conn_state); 1179 1180 if (control->super != L2CAP_SUPER_SREJ) { 1181 chan->last_acked_seq = control->reqseq; 1182 __clear_ack_timer(chan); 1183 } 1184 1185 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq, 1186 control->final, control->poll, control->super); 1187 1188 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1189 control_field = __pack_extended_control(control); 1190 else 1191 control_field = __pack_enhanced_control(control); 1192 1193 skb = l2cap_create_sframe_pdu(chan, control_field); 1194 if (!IS_ERR(skb)) 1195 l2cap_do_send(chan, skb); 1196 } 1197 1198 static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll) 1199 { 1200 struct l2cap_ctrl control; 1201 1202 BT_DBG("chan %p, poll %d", chan, poll); 1203 1204 memset(&control, 0, sizeof(control)); 1205 control.sframe = 1; 1206 control.poll = poll; 1207 1208 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 1209 control.super = L2CAP_SUPER_RNR; 1210 else 1211 control.super = L2CAP_SUPER_RR; 1212 1213 control.reqseq = chan->buffer_seq; 1214 l2cap_send_sframe(chan, &control); 1215 } 1216 1217 static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 1218 { 1219 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 1220 return true; 1221 1222 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 1223 } 1224 1225 void l2cap_send_conn_req(struct l2cap_chan *chan) 1226 { 1227 struct l2cap_conn *conn = chan->conn; 1228 struct l2cap_conn_req req; 1229 1230 req.scid = cpu_to_le16(chan->scid); 1231 req.psm = chan->psm; 1232 1233 chan->ident = l2cap_get_ident(conn); 1234 1235 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 1236 1237 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req); 1238 } 1239 1240 static void l2cap_chan_ready(struct l2cap_chan *chan) 1241 { 1242 /* The channel may have already been flagged as connected in 1243 * case of receiving data before the L2CAP info req/rsp 1244 * procedure is complete. 1245 */ 1246 if (chan->state == BT_CONNECTED) 1247 return; 1248 1249 /* This clears all conf flags, including CONF_NOT_COMPLETE */ 1250 chan->conf_state = 0; 1251 __clear_chan_timer(chan); 1252 1253 switch (chan->mode) { 1254 case L2CAP_MODE_LE_FLOWCTL: 1255 case L2CAP_MODE_EXT_FLOWCTL: 1256 if (!chan->tx_credits) 1257 chan->ops->suspend(chan); 1258 break; 1259 } 1260 1261 chan->state = BT_CONNECTED; 1262 1263 chan->ops->ready(chan); 1264 } 1265 1266 static void l2cap_le_connect(struct l2cap_chan *chan) 1267 { 1268 struct l2cap_conn *conn = chan->conn; 1269 struct l2cap_le_conn_req req; 1270 1271 if (test_and_set_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags)) 1272 return; 1273 1274 if (!chan->imtu) 1275 chan->imtu = chan->conn->mtu; 1276 1277 l2cap_le_flowctl_init(chan, 0); 1278 1279 memset(&req, 0, sizeof(req)); 1280 req.psm = chan->psm; 1281 req.scid = cpu_to_le16(chan->scid); 1282 req.mtu = cpu_to_le16(chan->imtu); 1283 req.mps = cpu_to_le16(chan->mps); 1284 req.credits = cpu_to_le16(chan->rx_credits); 1285 1286 chan->ident = l2cap_get_ident(conn); 1287 1288 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_REQ, 1289 sizeof(req), &req); 1290 } 1291 1292 struct l2cap_ecred_conn_data { 1293 struct { 1294 struct l2cap_ecred_conn_req_hdr req; 1295 __le16 scid[5]; 1296 } __packed pdu; 1297 struct l2cap_chan *chan; 1298 struct pid *pid; 1299 int count; 1300 }; 1301 1302 static void l2cap_ecred_defer_connect(struct l2cap_chan *chan, void *data) 1303 { 1304 struct l2cap_ecred_conn_data *conn = data; 1305 struct pid *pid; 1306 1307 if (chan == conn->chan) 1308 return; 1309 1310 if (!test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 1311 return; 1312 1313 pid = chan->ops->get_peer_pid(chan); 1314 1315 /* Only add deferred channels with the same PID/PSM */ 1316 if (conn->pid != pid || chan->psm != conn->chan->psm || chan->ident || 1317 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 1318 return; 1319 1320 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1321 return; 1322 1323 l2cap_ecred_init(chan, 0); 1324 1325 /* Set the same ident so we can match on the rsp */ 1326 chan->ident = conn->chan->ident; 1327 1328 /* Include all channels deferred */ 1329 conn->pdu.scid[conn->count] = cpu_to_le16(chan->scid); 1330 1331 conn->count++; 1332 } 1333 1334 static void l2cap_ecred_connect(struct l2cap_chan *chan) 1335 { 1336 struct l2cap_conn *conn = chan->conn; 1337 struct l2cap_ecred_conn_data data; 1338 1339 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) 1340 return; 1341 1342 if (test_and_set_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 1343 return; 1344 1345 l2cap_ecred_init(chan, 0); 1346 1347 memset(&data, 0, sizeof(data)); 1348 data.pdu.req.psm = chan->psm; 1349 data.pdu.req.mtu = cpu_to_le16(chan->imtu); 1350 data.pdu.req.mps = cpu_to_le16(chan->mps); 1351 data.pdu.req.credits = cpu_to_le16(chan->rx_credits); 1352 data.pdu.scid[0] = cpu_to_le16(chan->scid); 1353 1354 chan->ident = l2cap_get_ident(conn); 1355 1356 data.count = 1; 1357 data.chan = chan; 1358 data.pid = chan->ops->get_peer_pid(chan); 1359 1360 __l2cap_chan_list(conn, l2cap_ecred_defer_connect, &data); 1361 1362 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_CONN_REQ, 1363 sizeof(data.pdu.req) + data.count * sizeof(__le16), 1364 &data.pdu); 1365 } 1366 1367 static void l2cap_le_start(struct l2cap_chan *chan) 1368 { 1369 struct l2cap_conn *conn = chan->conn; 1370 1371 if (!smp_conn_security(conn->hcon, chan->sec_level)) 1372 return; 1373 1374 if (!chan->psm) { 1375 l2cap_chan_ready(chan); 1376 return; 1377 } 1378 1379 if (chan->state == BT_CONNECT) { 1380 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) 1381 l2cap_ecred_connect(chan); 1382 else 1383 l2cap_le_connect(chan); 1384 } 1385 } 1386 1387 static void l2cap_start_connection(struct l2cap_chan *chan) 1388 { 1389 if (chan->conn->hcon->type == LE_LINK) { 1390 l2cap_le_start(chan); 1391 } else { 1392 l2cap_send_conn_req(chan); 1393 } 1394 } 1395 1396 static void l2cap_request_info(struct l2cap_conn *conn) 1397 { 1398 struct l2cap_info_req req; 1399 1400 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1401 return; 1402 1403 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 1404 1405 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 1406 conn->info_ident = l2cap_get_ident(conn); 1407 1408 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 1409 1410 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 1411 sizeof(req), &req); 1412 } 1413 1414 static bool l2cap_check_enc_key_size(struct hci_conn *hcon, 1415 struct l2cap_chan *chan) 1416 { 1417 /* The minimum encryption key size needs to be enforced by the 1418 * host stack before establishing any L2CAP connections. The 1419 * specification in theory allows a minimum of 1, but to align 1420 * BR/EDR and LE transports, a minimum of 7 is chosen. 1421 * 1422 * This check might also be called for unencrypted connections 1423 * that have no key size requirements. Ensure that the link is 1424 * actually encrypted before enforcing a key size. 1425 */ 1426 int min_key_size = hcon->hdev->min_enc_key_size; 1427 1428 /* On FIPS security level, key size must be 16 bytes */ 1429 if (chan->sec_level == BT_SECURITY_FIPS) 1430 min_key_size = 16; 1431 1432 return (!test_bit(HCI_CONN_ENCRYPT, &hcon->flags) || 1433 hcon->enc_key_size >= min_key_size); 1434 } 1435 1436 static void l2cap_do_start(struct l2cap_chan *chan) 1437 { 1438 struct l2cap_conn *conn = chan->conn; 1439 1440 if (conn->hcon->type == LE_LINK) { 1441 l2cap_le_start(chan); 1442 return; 1443 } 1444 1445 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)) { 1446 l2cap_request_info(conn); 1447 return; 1448 } 1449 1450 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 1451 return; 1452 1453 if (!l2cap_chan_check_security(chan, true) || 1454 !__l2cap_no_conn_pending(chan)) 1455 return; 1456 1457 if (l2cap_check_enc_key_size(conn->hcon, chan)) 1458 l2cap_start_connection(chan); 1459 else 1460 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 1461 } 1462 1463 static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 1464 { 1465 u32 local_feat_mask = l2cap_feat_mask; 1466 if (!disable_ertm) 1467 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 1468 1469 switch (mode) { 1470 case L2CAP_MODE_ERTM: 1471 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 1472 case L2CAP_MODE_STREAMING: 1473 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 1474 default: 1475 return 0x00; 1476 } 1477 } 1478 1479 static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err) 1480 { 1481 struct l2cap_conn *conn = chan->conn; 1482 struct l2cap_disconn_req req; 1483 1484 if (!conn) 1485 return; 1486 1487 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) { 1488 __clear_retrans_timer(chan); 1489 __clear_monitor_timer(chan); 1490 __clear_ack_timer(chan); 1491 } 1492 1493 req.dcid = cpu_to_le16(chan->dcid); 1494 req.scid = cpu_to_le16(chan->scid); 1495 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ, 1496 sizeof(req), &req); 1497 1498 l2cap_state_change_and_error(chan, BT_DISCONN, err); 1499 } 1500 1501 /* ---- L2CAP connections ---- */ 1502 static void l2cap_conn_start(struct l2cap_conn *conn) 1503 { 1504 struct l2cap_chan *chan, *tmp; 1505 1506 BT_DBG("conn %p", conn); 1507 1508 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 1509 l2cap_chan_lock(chan); 1510 1511 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1512 l2cap_chan_ready(chan); 1513 l2cap_chan_unlock(chan); 1514 continue; 1515 } 1516 1517 if (chan->state == BT_CONNECT) { 1518 if (!l2cap_chan_check_security(chan, true) || 1519 !__l2cap_no_conn_pending(chan)) { 1520 l2cap_chan_unlock(chan); 1521 continue; 1522 } 1523 1524 if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 1525 && test_bit(CONF_STATE2_DEVICE, 1526 &chan->conf_state)) { 1527 l2cap_chan_close(chan, ECONNRESET); 1528 l2cap_chan_unlock(chan); 1529 continue; 1530 } 1531 1532 if (l2cap_check_enc_key_size(conn->hcon, chan)) 1533 l2cap_start_connection(chan); 1534 else 1535 l2cap_chan_close(chan, ECONNREFUSED); 1536 1537 } else if (chan->state == BT_CONNECT2) { 1538 struct l2cap_conn_rsp rsp; 1539 char buf[128]; 1540 rsp.scid = cpu_to_le16(chan->dcid); 1541 rsp.dcid = cpu_to_le16(chan->scid); 1542 1543 if (l2cap_chan_check_security(chan, false)) { 1544 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 1545 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1546 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 1547 chan->ops->defer(chan); 1548 1549 } else { 1550 l2cap_state_change(chan, BT_CONFIG); 1551 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 1552 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 1553 } 1554 } else { 1555 rsp.result = cpu_to_le16(L2CAP_CR_PEND); 1556 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 1557 } 1558 1559 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 1560 sizeof(rsp), &rsp); 1561 1562 if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 1563 rsp.result != L2CAP_CR_SUCCESS) { 1564 l2cap_chan_unlock(chan); 1565 continue; 1566 } 1567 1568 set_bit(CONF_REQ_SENT, &chan->conf_state); 1569 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 1570 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 1571 chan->num_conf_req++; 1572 } 1573 1574 l2cap_chan_unlock(chan); 1575 } 1576 } 1577 1578 static void l2cap_le_conn_ready(struct l2cap_conn *conn) 1579 { 1580 struct hci_conn *hcon = conn->hcon; 1581 struct hci_dev *hdev = hcon->hdev; 1582 1583 BT_DBG("%s conn %p", hdev->name, conn); 1584 1585 /* For outgoing pairing which doesn't necessarily have an 1586 * associated socket (e.g. mgmt_pair_device). 1587 */ 1588 if (hcon->out) 1589 smp_conn_security(hcon, hcon->pending_sec_level); 1590 1591 /* For LE peripheral connections, make sure the connection interval 1592 * is in the range of the minimum and maximum interval that has 1593 * been configured for this connection. If not, then trigger 1594 * the connection update procedure. 1595 */ 1596 if (hcon->role == HCI_ROLE_SLAVE && 1597 (hcon->le_conn_interval < hcon->le_conn_min_interval || 1598 hcon->le_conn_interval > hcon->le_conn_max_interval)) { 1599 struct l2cap_conn_param_update_req req; 1600 1601 req.min = cpu_to_le16(hcon->le_conn_min_interval); 1602 req.max = cpu_to_le16(hcon->le_conn_max_interval); 1603 req.latency = cpu_to_le16(hcon->le_conn_latency); 1604 req.to_multiplier = cpu_to_le16(hcon->le_supv_timeout); 1605 1606 l2cap_send_cmd(conn, l2cap_get_ident(conn), 1607 L2CAP_CONN_PARAM_UPDATE_REQ, sizeof(req), &req); 1608 } 1609 } 1610 1611 static void l2cap_conn_ready(struct l2cap_conn *conn) 1612 { 1613 struct l2cap_chan *chan; 1614 struct hci_conn *hcon = conn->hcon; 1615 1616 BT_DBG("conn %p", conn); 1617 1618 if (hcon->type == ACL_LINK) 1619 l2cap_request_info(conn); 1620 1621 mutex_lock(&conn->lock); 1622 1623 list_for_each_entry(chan, &conn->chan_l, list) { 1624 1625 l2cap_chan_lock(chan); 1626 1627 if (hcon->type == LE_LINK) { 1628 l2cap_le_start(chan); 1629 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1630 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 1631 l2cap_chan_ready(chan); 1632 } else if (chan->state == BT_CONNECT) { 1633 l2cap_do_start(chan); 1634 } 1635 1636 l2cap_chan_unlock(chan); 1637 } 1638 1639 mutex_unlock(&conn->lock); 1640 1641 if (hcon->type == LE_LINK) 1642 l2cap_le_conn_ready(conn); 1643 1644 queue_work(hcon->hdev->workqueue, &conn->pending_rx_work); 1645 } 1646 1647 /* Notify sockets that we cannot guaranty reliability anymore */ 1648 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 1649 { 1650 struct l2cap_chan *chan; 1651 1652 BT_DBG("conn %p", conn); 1653 1654 list_for_each_entry(chan, &conn->chan_l, list) { 1655 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 1656 l2cap_chan_set_err(chan, err); 1657 } 1658 } 1659 1660 static void l2cap_info_timeout(struct work_struct *work) 1661 { 1662 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 1663 info_timer.work); 1664 1665 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 1666 conn->info_ident = 0; 1667 1668 mutex_lock(&conn->lock); 1669 l2cap_conn_start(conn); 1670 mutex_unlock(&conn->lock); 1671 } 1672 1673 /* 1674 * l2cap_user 1675 * External modules can register l2cap_user objects on l2cap_conn. The ->probe 1676 * callback is called during registration. The ->remove callback is called 1677 * during unregistration. 1678 * An l2cap_user object can either be explicitly unregistered or when the 1679 * underlying l2cap_conn object is deleted. This guarantees that l2cap->hcon, 1680 * l2cap->hchan, .. are valid as long as the remove callback hasn't been called. 1681 * External modules must own a reference to the l2cap_conn object if they intend 1682 * to call l2cap_unregister_user(). The l2cap_conn object might get destroyed at 1683 * any time if they don't. 1684 */ 1685 1686 int l2cap_register_user(struct l2cap_conn *conn, struct l2cap_user *user) 1687 { 1688 struct hci_dev *hdev = conn->hcon->hdev; 1689 int ret; 1690 1691 /* We need to check whether l2cap_conn is registered. If it is not, we 1692 * must not register the l2cap_user. l2cap_conn_del() is unregisters 1693 * l2cap_conn objects, but doesn't provide its own locking. Instead, it 1694 * relies on the parent hci_conn object to be locked. This itself relies 1695 * on the hci_dev object to be locked. So we must lock the hci device 1696 * here, too. */ 1697 1698 hci_dev_lock(hdev); 1699 1700 if (!list_empty(&user->list)) { 1701 ret = -EINVAL; 1702 goto out_unlock; 1703 } 1704 1705 /* conn->hchan is NULL after l2cap_conn_del() was called */ 1706 if (!conn->hchan) { 1707 ret = -ENODEV; 1708 goto out_unlock; 1709 } 1710 1711 ret = user->probe(conn, user); 1712 if (ret) 1713 goto out_unlock; 1714 1715 list_add(&user->list, &conn->users); 1716 ret = 0; 1717 1718 out_unlock: 1719 hci_dev_unlock(hdev); 1720 return ret; 1721 } 1722 EXPORT_SYMBOL(l2cap_register_user); 1723 1724 void l2cap_unregister_user(struct l2cap_conn *conn, struct l2cap_user *user) 1725 { 1726 struct hci_dev *hdev = conn->hcon->hdev; 1727 1728 hci_dev_lock(hdev); 1729 1730 if (list_empty(&user->list)) 1731 goto out_unlock; 1732 1733 list_del_init(&user->list); 1734 user->remove(conn, user); 1735 1736 out_unlock: 1737 hci_dev_unlock(hdev); 1738 } 1739 EXPORT_SYMBOL(l2cap_unregister_user); 1740 1741 static void l2cap_unregister_all_users(struct l2cap_conn *conn) 1742 { 1743 struct l2cap_user *user; 1744 1745 while (!list_empty(&conn->users)) { 1746 user = list_first_entry(&conn->users, struct l2cap_user, list); 1747 list_del_init(&user->list); 1748 user->remove(conn, user); 1749 } 1750 } 1751 1752 static void l2cap_conn_del(struct hci_conn *hcon, int err) 1753 { 1754 struct l2cap_conn *conn = hcon->l2cap_data; 1755 struct l2cap_chan *chan, *l; 1756 1757 if (!conn) 1758 return; 1759 1760 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 1761 1762 mutex_lock(&conn->lock); 1763 1764 kfree_skb(conn->rx_skb); 1765 1766 skb_queue_purge(&conn->pending_rx); 1767 1768 /* We can not call flush_work(&conn->pending_rx_work) here since we 1769 * might block if we are running on a worker from the same workqueue 1770 * pending_rx_work is waiting on. 1771 */ 1772 if (work_pending(&conn->pending_rx_work)) 1773 cancel_work_sync(&conn->pending_rx_work); 1774 1775 cancel_delayed_work_sync(&conn->id_addr_timer); 1776 1777 l2cap_unregister_all_users(conn); 1778 1779 /* Force the connection to be immediately dropped */ 1780 hcon->disc_timeout = 0; 1781 1782 /* Kill channels */ 1783 list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 1784 l2cap_chan_hold(chan); 1785 l2cap_chan_lock(chan); 1786 1787 l2cap_chan_del(chan, err); 1788 1789 chan->ops->close(chan); 1790 1791 l2cap_chan_unlock(chan); 1792 l2cap_chan_put(chan); 1793 } 1794 1795 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 1796 cancel_delayed_work_sync(&conn->info_timer); 1797 1798 hci_chan_del(conn->hchan); 1799 conn->hchan = NULL; 1800 1801 hcon->l2cap_data = NULL; 1802 mutex_unlock(&conn->lock); 1803 l2cap_conn_put(conn); 1804 } 1805 1806 static void l2cap_conn_free(struct kref *ref) 1807 { 1808 struct l2cap_conn *conn = container_of(ref, struct l2cap_conn, ref); 1809 1810 hci_conn_put(conn->hcon); 1811 kfree(conn); 1812 } 1813 1814 struct l2cap_conn *l2cap_conn_get(struct l2cap_conn *conn) 1815 { 1816 kref_get(&conn->ref); 1817 return conn; 1818 } 1819 EXPORT_SYMBOL(l2cap_conn_get); 1820 1821 void l2cap_conn_put(struct l2cap_conn *conn) 1822 { 1823 kref_put(&conn->ref, l2cap_conn_free); 1824 } 1825 EXPORT_SYMBOL(l2cap_conn_put); 1826 1827 /* ---- Socket interface ---- */ 1828 1829 /* Find socket with psm and source / destination bdaddr. 1830 * Returns closest match. 1831 */ 1832 static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, 1833 bdaddr_t *src, 1834 bdaddr_t *dst, 1835 u8 link_type) 1836 { 1837 struct l2cap_chan *c, *tmp, *c1 = NULL; 1838 1839 read_lock(&chan_list_lock); 1840 1841 list_for_each_entry_safe(c, tmp, &chan_list, global_l) { 1842 if (state && c->state != state) 1843 continue; 1844 1845 if (link_type == ACL_LINK && c->src_type != BDADDR_BREDR) 1846 continue; 1847 1848 if (link_type == LE_LINK && c->src_type == BDADDR_BREDR) 1849 continue; 1850 1851 if (c->chan_type != L2CAP_CHAN_FIXED && c->psm == psm) { 1852 int src_match, dst_match; 1853 int src_any, dst_any; 1854 1855 /* Exact match. */ 1856 src_match = !bacmp(&c->src, src); 1857 dst_match = !bacmp(&c->dst, dst); 1858 if (src_match && dst_match) { 1859 if (!l2cap_chan_hold_unless_zero(c)) 1860 continue; 1861 1862 read_unlock(&chan_list_lock); 1863 return c; 1864 } 1865 1866 /* Closest match */ 1867 src_any = !bacmp(&c->src, BDADDR_ANY); 1868 dst_any = !bacmp(&c->dst, BDADDR_ANY); 1869 if ((src_match && dst_any) || (src_any && dst_match) || 1870 (src_any && dst_any)) 1871 c1 = c; 1872 } 1873 } 1874 1875 if (c1) 1876 c1 = l2cap_chan_hold_unless_zero(c1); 1877 1878 read_unlock(&chan_list_lock); 1879 1880 return c1; 1881 } 1882 1883 static void l2cap_monitor_timeout(struct work_struct *work) 1884 { 1885 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 1886 monitor_timer.work); 1887 1888 BT_DBG("chan %p", chan); 1889 1890 l2cap_chan_lock(chan); 1891 1892 if (!chan->conn) { 1893 l2cap_chan_unlock(chan); 1894 l2cap_chan_put(chan); 1895 return; 1896 } 1897 1898 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO); 1899 1900 l2cap_chan_unlock(chan); 1901 l2cap_chan_put(chan); 1902 } 1903 1904 static void l2cap_retrans_timeout(struct work_struct *work) 1905 { 1906 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 1907 retrans_timer.work); 1908 1909 BT_DBG("chan %p", chan); 1910 1911 l2cap_chan_lock(chan); 1912 1913 if (!chan->conn) { 1914 l2cap_chan_unlock(chan); 1915 l2cap_chan_put(chan); 1916 return; 1917 } 1918 1919 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO); 1920 l2cap_chan_unlock(chan); 1921 l2cap_chan_put(chan); 1922 } 1923 1924 static void l2cap_streaming_send(struct l2cap_chan *chan, 1925 struct sk_buff_head *skbs) 1926 { 1927 struct sk_buff *skb; 1928 struct l2cap_ctrl *control; 1929 1930 BT_DBG("chan %p, skbs %p", chan, skbs); 1931 1932 skb_queue_splice_tail_init(skbs, &chan->tx_q); 1933 1934 while (!skb_queue_empty(&chan->tx_q)) { 1935 1936 skb = skb_dequeue(&chan->tx_q); 1937 1938 bt_cb(skb)->l2cap.retries = 1; 1939 control = &bt_cb(skb)->l2cap; 1940 1941 control->reqseq = 0; 1942 control->txseq = chan->next_tx_seq; 1943 1944 __pack_control(chan, control, skb); 1945 1946 if (chan->fcs == L2CAP_FCS_CRC16) { 1947 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 1948 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1949 } 1950 1951 l2cap_do_send(chan, skb); 1952 1953 BT_DBG("Sent txseq %u", control->txseq); 1954 1955 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 1956 chan->frames_sent++; 1957 } 1958 } 1959 1960 static int l2cap_ertm_send(struct l2cap_chan *chan) 1961 { 1962 struct sk_buff *skb, *tx_skb; 1963 struct l2cap_ctrl *control; 1964 int sent = 0; 1965 1966 BT_DBG("chan %p", chan); 1967 1968 if (chan->state != BT_CONNECTED) 1969 return -ENOTCONN; 1970 1971 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 1972 return 0; 1973 1974 while (chan->tx_send_head && 1975 chan->unacked_frames < chan->remote_tx_win && 1976 chan->tx_state == L2CAP_TX_STATE_XMIT) { 1977 1978 skb = chan->tx_send_head; 1979 1980 bt_cb(skb)->l2cap.retries = 1; 1981 control = &bt_cb(skb)->l2cap; 1982 1983 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 1984 control->final = 1; 1985 1986 control->reqseq = chan->buffer_seq; 1987 chan->last_acked_seq = chan->buffer_seq; 1988 control->txseq = chan->next_tx_seq; 1989 1990 __pack_control(chan, control, skb); 1991 1992 if (chan->fcs == L2CAP_FCS_CRC16) { 1993 u16 fcs = crc16(0, (u8 *) skb->data, skb->len); 1994 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE)); 1995 } 1996 1997 /* Clone after data has been modified. Data is assumed to be 1998 read-only (for locking purposes) on cloned sk_buffs. 1999 */ 2000 tx_skb = skb_clone(skb, GFP_KERNEL); 2001 2002 if (!tx_skb) 2003 break; 2004 2005 __set_retrans_timer(chan); 2006 2007 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq); 2008 chan->unacked_frames++; 2009 chan->frames_sent++; 2010 sent++; 2011 2012 if (skb_queue_is_last(&chan->tx_q, skb)) 2013 chan->tx_send_head = NULL; 2014 else 2015 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 2016 2017 l2cap_do_send(chan, tx_skb); 2018 BT_DBG("Sent txseq %u", control->txseq); 2019 } 2020 2021 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent, 2022 chan->unacked_frames, skb_queue_len(&chan->tx_q)); 2023 2024 return sent; 2025 } 2026 2027 static void l2cap_ertm_resend(struct l2cap_chan *chan) 2028 { 2029 struct l2cap_ctrl control; 2030 struct sk_buff *skb; 2031 struct sk_buff *tx_skb; 2032 u16 seq; 2033 2034 BT_DBG("chan %p", chan); 2035 2036 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2037 return; 2038 2039 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) { 2040 seq = l2cap_seq_list_pop(&chan->retrans_list); 2041 2042 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq); 2043 if (!skb) { 2044 BT_DBG("Error: Can't retransmit seq %d, frame missing", 2045 seq); 2046 continue; 2047 } 2048 2049 bt_cb(skb)->l2cap.retries++; 2050 control = bt_cb(skb)->l2cap; 2051 2052 if (chan->max_tx != 0 && 2053 bt_cb(skb)->l2cap.retries > chan->max_tx) { 2054 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 2055 l2cap_send_disconn_req(chan, ECONNRESET); 2056 l2cap_seq_list_clear(&chan->retrans_list); 2057 break; 2058 } 2059 2060 control.reqseq = chan->buffer_seq; 2061 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 2062 control.final = 1; 2063 else 2064 control.final = 0; 2065 2066 if (skb_cloned(skb)) { 2067 /* Cloned sk_buffs are read-only, so we need a 2068 * writeable copy 2069 */ 2070 tx_skb = skb_copy(skb, GFP_KERNEL); 2071 } else { 2072 tx_skb = skb_clone(skb, GFP_KERNEL); 2073 } 2074 2075 if (!tx_skb) { 2076 l2cap_seq_list_clear(&chan->retrans_list); 2077 break; 2078 } 2079 2080 /* Update skb contents */ 2081 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) { 2082 put_unaligned_le32(__pack_extended_control(&control), 2083 tx_skb->data + L2CAP_HDR_SIZE); 2084 } else { 2085 put_unaligned_le16(__pack_enhanced_control(&control), 2086 tx_skb->data + L2CAP_HDR_SIZE); 2087 } 2088 2089 /* Update FCS */ 2090 if (chan->fcs == L2CAP_FCS_CRC16) { 2091 u16 fcs = crc16(0, (u8 *) tx_skb->data, 2092 tx_skb->len - L2CAP_FCS_SIZE); 2093 put_unaligned_le16(fcs, skb_tail_pointer(tx_skb) - 2094 L2CAP_FCS_SIZE); 2095 } 2096 2097 l2cap_do_send(chan, tx_skb); 2098 2099 BT_DBG("Resent txseq %d", control.txseq); 2100 2101 chan->last_acked_seq = chan->buffer_seq; 2102 } 2103 } 2104 2105 static void l2cap_retransmit(struct l2cap_chan *chan, 2106 struct l2cap_ctrl *control) 2107 { 2108 BT_DBG("chan %p, control %p", chan, control); 2109 2110 l2cap_seq_list_append(&chan->retrans_list, control->reqseq); 2111 l2cap_ertm_resend(chan); 2112 } 2113 2114 static void l2cap_retransmit_all(struct l2cap_chan *chan, 2115 struct l2cap_ctrl *control) 2116 { 2117 struct sk_buff *skb; 2118 2119 BT_DBG("chan %p, control %p", chan, control); 2120 2121 if (control->poll) 2122 set_bit(CONN_SEND_FBIT, &chan->conn_state); 2123 2124 l2cap_seq_list_clear(&chan->retrans_list); 2125 2126 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 2127 return; 2128 2129 if (chan->unacked_frames) { 2130 skb_queue_walk(&chan->tx_q, skb) { 2131 if (bt_cb(skb)->l2cap.txseq == control->reqseq || 2132 skb == chan->tx_send_head) 2133 break; 2134 } 2135 2136 skb_queue_walk_from(&chan->tx_q, skb) { 2137 if (skb == chan->tx_send_head) 2138 break; 2139 2140 l2cap_seq_list_append(&chan->retrans_list, 2141 bt_cb(skb)->l2cap.txseq); 2142 } 2143 2144 l2cap_ertm_resend(chan); 2145 } 2146 } 2147 2148 static void l2cap_send_ack(struct l2cap_chan *chan) 2149 { 2150 struct l2cap_ctrl control; 2151 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 2152 chan->last_acked_seq); 2153 int threshold; 2154 2155 BT_DBG("chan %p last_acked_seq %d buffer_seq %d", 2156 chan, chan->last_acked_seq, chan->buffer_seq); 2157 2158 memset(&control, 0, sizeof(control)); 2159 control.sframe = 1; 2160 2161 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 2162 chan->rx_state == L2CAP_RX_STATE_RECV) { 2163 __clear_ack_timer(chan); 2164 control.super = L2CAP_SUPER_RNR; 2165 control.reqseq = chan->buffer_seq; 2166 l2cap_send_sframe(chan, &control); 2167 } else { 2168 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) { 2169 l2cap_ertm_send(chan); 2170 /* If any i-frames were sent, they included an ack */ 2171 if (chan->buffer_seq == chan->last_acked_seq) 2172 frames_to_ack = 0; 2173 } 2174 2175 /* Ack now if the window is 3/4ths full. 2176 * Calculate without mul or div 2177 */ 2178 threshold = chan->ack_win; 2179 threshold += threshold << 1; 2180 threshold >>= 2; 2181 2182 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack, 2183 threshold); 2184 2185 if (frames_to_ack >= threshold) { 2186 __clear_ack_timer(chan); 2187 control.super = L2CAP_SUPER_RR; 2188 control.reqseq = chan->buffer_seq; 2189 l2cap_send_sframe(chan, &control); 2190 frames_to_ack = 0; 2191 } 2192 2193 if (frames_to_ack) 2194 __set_ack_timer(chan); 2195 } 2196 } 2197 2198 static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan, 2199 struct msghdr *msg, int len, 2200 int count, struct sk_buff *skb) 2201 { 2202 struct l2cap_conn *conn = chan->conn; 2203 struct sk_buff **frag; 2204 int sent = 0; 2205 2206 if (!copy_from_iter_full(skb_put(skb, count), count, &msg->msg_iter)) 2207 return -EFAULT; 2208 2209 sent += count; 2210 len -= count; 2211 2212 /* Continuation fragments (no L2CAP header) */ 2213 frag = &skb_shinfo(skb)->frag_list; 2214 while (len) { 2215 struct sk_buff *tmp; 2216 2217 count = min_t(unsigned int, conn->mtu, len); 2218 2219 tmp = chan->ops->alloc_skb(chan, 0, count, 2220 msg->msg_flags & MSG_DONTWAIT); 2221 if (IS_ERR(tmp)) 2222 return PTR_ERR(tmp); 2223 2224 *frag = tmp; 2225 2226 if (!copy_from_iter_full(skb_put(*frag, count), count, 2227 &msg->msg_iter)) 2228 return -EFAULT; 2229 2230 sent += count; 2231 len -= count; 2232 2233 skb->len += (*frag)->len; 2234 skb->data_len += (*frag)->len; 2235 2236 frag = &(*frag)->next; 2237 } 2238 2239 return sent; 2240 } 2241 2242 static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, 2243 struct msghdr *msg, size_t len) 2244 { 2245 struct l2cap_conn *conn = chan->conn; 2246 struct sk_buff *skb; 2247 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE; 2248 struct l2cap_hdr *lh; 2249 2250 BT_DBG("chan %p psm 0x%2.2x len %zu", chan, 2251 __le16_to_cpu(chan->psm), len); 2252 2253 count = min_t(unsigned int, (conn->mtu - hlen), len); 2254 2255 skb = chan->ops->alloc_skb(chan, hlen, count, 2256 msg->msg_flags & MSG_DONTWAIT); 2257 if (IS_ERR(skb)) 2258 return skb; 2259 2260 /* Create L2CAP header */ 2261 lh = skb_put(skb, L2CAP_HDR_SIZE); 2262 lh->cid = cpu_to_le16(chan->dcid); 2263 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE); 2264 put_unaligned(chan->psm, (__le16 *) skb_put(skb, L2CAP_PSMLEN_SIZE)); 2265 2266 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2267 if (unlikely(err < 0)) { 2268 kfree_skb(skb); 2269 return ERR_PTR(err); 2270 } 2271 return skb; 2272 } 2273 2274 static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, 2275 struct msghdr *msg, size_t len) 2276 { 2277 struct l2cap_conn *conn = chan->conn; 2278 struct sk_buff *skb; 2279 int err, count; 2280 struct l2cap_hdr *lh; 2281 2282 BT_DBG("chan %p len %zu", chan, len); 2283 2284 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len); 2285 2286 skb = chan->ops->alloc_skb(chan, L2CAP_HDR_SIZE, count, 2287 msg->msg_flags & MSG_DONTWAIT); 2288 if (IS_ERR(skb)) 2289 return skb; 2290 2291 /* Create L2CAP header */ 2292 lh = skb_put(skb, L2CAP_HDR_SIZE); 2293 lh->cid = cpu_to_le16(chan->dcid); 2294 lh->len = cpu_to_le16(len); 2295 2296 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2297 if (unlikely(err < 0)) { 2298 kfree_skb(skb); 2299 return ERR_PTR(err); 2300 } 2301 return skb; 2302 } 2303 2304 static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 2305 struct msghdr *msg, size_t len, 2306 u16 sdulen) 2307 { 2308 struct l2cap_conn *conn = chan->conn; 2309 struct sk_buff *skb; 2310 int err, count, hlen; 2311 struct l2cap_hdr *lh; 2312 2313 BT_DBG("chan %p len %zu", chan, len); 2314 2315 if (!conn) 2316 return ERR_PTR(-ENOTCONN); 2317 2318 hlen = __ertm_hdr_size(chan); 2319 2320 if (sdulen) 2321 hlen += L2CAP_SDULEN_SIZE; 2322 2323 if (chan->fcs == L2CAP_FCS_CRC16) 2324 hlen += L2CAP_FCS_SIZE; 2325 2326 count = min_t(unsigned int, (conn->mtu - hlen), len); 2327 2328 skb = chan->ops->alloc_skb(chan, hlen, count, 2329 msg->msg_flags & MSG_DONTWAIT); 2330 if (IS_ERR(skb)) 2331 return skb; 2332 2333 /* Create L2CAP header */ 2334 lh = skb_put(skb, L2CAP_HDR_SIZE); 2335 lh->cid = cpu_to_le16(chan->dcid); 2336 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2337 2338 /* Control header is populated later */ 2339 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 2340 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE)); 2341 else 2342 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE)); 2343 2344 if (sdulen) 2345 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2346 2347 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2348 if (unlikely(err < 0)) { 2349 kfree_skb(skb); 2350 return ERR_PTR(err); 2351 } 2352 2353 bt_cb(skb)->l2cap.fcs = chan->fcs; 2354 bt_cb(skb)->l2cap.retries = 0; 2355 return skb; 2356 } 2357 2358 static int l2cap_segment_sdu(struct l2cap_chan *chan, 2359 struct sk_buff_head *seg_queue, 2360 struct msghdr *msg, size_t len) 2361 { 2362 struct sk_buff *skb; 2363 u16 sdu_len; 2364 size_t pdu_len; 2365 u8 sar; 2366 2367 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2368 2369 /* It is critical that ERTM PDUs fit in a single HCI fragment, 2370 * so fragmented skbs are not used. The HCI layer's handling 2371 * of fragmented skbs is not compatible with ERTM's queueing. 2372 */ 2373 2374 /* PDU size is derived from the HCI MTU */ 2375 pdu_len = chan->conn->mtu; 2376 2377 /* Constrain PDU size for BR/EDR connections */ 2378 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD); 2379 2380 /* Adjust for largest possible L2CAP overhead. */ 2381 if (chan->fcs) 2382 pdu_len -= L2CAP_FCS_SIZE; 2383 2384 pdu_len -= __ertm_hdr_size(chan); 2385 2386 /* Remote device may have requested smaller PDUs */ 2387 pdu_len = min_t(size_t, pdu_len, chan->remote_mps); 2388 2389 if (len <= pdu_len) { 2390 sar = L2CAP_SAR_UNSEGMENTED; 2391 sdu_len = 0; 2392 pdu_len = len; 2393 } else { 2394 sar = L2CAP_SAR_START; 2395 sdu_len = len; 2396 } 2397 2398 while (len > 0) { 2399 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len); 2400 2401 if (IS_ERR(skb)) { 2402 __skb_queue_purge(seg_queue); 2403 return PTR_ERR(skb); 2404 } 2405 2406 bt_cb(skb)->l2cap.sar = sar; 2407 __skb_queue_tail(seg_queue, skb); 2408 2409 len -= pdu_len; 2410 if (sdu_len) 2411 sdu_len = 0; 2412 2413 if (len <= pdu_len) { 2414 sar = L2CAP_SAR_END; 2415 pdu_len = len; 2416 } else { 2417 sar = L2CAP_SAR_CONTINUE; 2418 } 2419 } 2420 2421 return 0; 2422 } 2423 2424 static struct sk_buff *l2cap_create_le_flowctl_pdu(struct l2cap_chan *chan, 2425 struct msghdr *msg, 2426 size_t len, u16 sdulen) 2427 { 2428 struct l2cap_conn *conn = chan->conn; 2429 struct sk_buff *skb; 2430 int err, count, hlen; 2431 struct l2cap_hdr *lh; 2432 2433 BT_DBG("chan %p len %zu", chan, len); 2434 2435 if (!conn) 2436 return ERR_PTR(-ENOTCONN); 2437 2438 hlen = L2CAP_HDR_SIZE; 2439 2440 if (sdulen) 2441 hlen += L2CAP_SDULEN_SIZE; 2442 2443 count = min_t(unsigned int, (conn->mtu - hlen), len); 2444 2445 skb = chan->ops->alloc_skb(chan, hlen, count, 2446 msg->msg_flags & MSG_DONTWAIT); 2447 if (IS_ERR(skb)) 2448 return skb; 2449 2450 /* Create L2CAP header */ 2451 lh = skb_put(skb, L2CAP_HDR_SIZE); 2452 lh->cid = cpu_to_le16(chan->dcid); 2453 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 2454 2455 if (sdulen) 2456 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE)); 2457 2458 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb); 2459 if (unlikely(err < 0)) { 2460 kfree_skb(skb); 2461 return ERR_PTR(err); 2462 } 2463 2464 return skb; 2465 } 2466 2467 static int l2cap_segment_le_sdu(struct l2cap_chan *chan, 2468 struct sk_buff_head *seg_queue, 2469 struct msghdr *msg, size_t len) 2470 { 2471 struct sk_buff *skb; 2472 size_t pdu_len; 2473 u16 sdu_len; 2474 2475 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len); 2476 2477 sdu_len = len; 2478 pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE; 2479 2480 while (len > 0) { 2481 if (len <= pdu_len) 2482 pdu_len = len; 2483 2484 skb = l2cap_create_le_flowctl_pdu(chan, msg, pdu_len, sdu_len); 2485 if (IS_ERR(skb)) { 2486 __skb_queue_purge(seg_queue); 2487 return PTR_ERR(skb); 2488 } 2489 2490 __skb_queue_tail(seg_queue, skb); 2491 2492 len -= pdu_len; 2493 2494 if (sdu_len) { 2495 sdu_len = 0; 2496 pdu_len += L2CAP_SDULEN_SIZE; 2497 } 2498 } 2499 2500 return 0; 2501 } 2502 2503 static void l2cap_le_flowctl_send(struct l2cap_chan *chan) 2504 { 2505 int sent = 0; 2506 2507 BT_DBG("chan %p", chan); 2508 2509 while (chan->tx_credits && !skb_queue_empty(&chan->tx_q)) { 2510 l2cap_do_send(chan, skb_dequeue(&chan->tx_q)); 2511 chan->tx_credits--; 2512 sent++; 2513 } 2514 2515 BT_DBG("Sent %d credits %u queued %u", sent, chan->tx_credits, 2516 skb_queue_len(&chan->tx_q)); 2517 } 2518 2519 static void l2cap_tx_timestamp(struct sk_buff *skb, 2520 const struct sockcm_cookie *sockc, 2521 size_t len) 2522 { 2523 struct sock *sk = skb ? skb->sk : NULL; 2524 2525 if (sk && sk->sk_type == SOCK_STREAM) 2526 hci_setup_tx_timestamp(skb, len, sockc); 2527 else 2528 hci_setup_tx_timestamp(skb, 1, sockc); 2529 } 2530 2531 static void l2cap_tx_timestamp_seg(struct sk_buff_head *queue, 2532 const struct sockcm_cookie *sockc, 2533 size_t len) 2534 { 2535 struct sk_buff *skb = skb_peek(queue); 2536 struct sock *sk = skb ? skb->sk : NULL; 2537 2538 if (sk && sk->sk_type == SOCK_STREAM) 2539 l2cap_tx_timestamp(skb_peek_tail(queue), sockc, len); 2540 else 2541 l2cap_tx_timestamp(skb, sockc, len); 2542 } 2543 2544 int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len, 2545 const struct sockcm_cookie *sockc) 2546 { 2547 struct sk_buff *skb; 2548 int err; 2549 struct sk_buff_head seg_queue; 2550 2551 if (!chan->conn) 2552 return -ENOTCONN; 2553 2554 /* Connectionless channel */ 2555 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 2556 skb = l2cap_create_connless_pdu(chan, msg, len); 2557 if (IS_ERR(skb)) 2558 return PTR_ERR(skb); 2559 2560 l2cap_tx_timestamp(skb, sockc, len); 2561 2562 l2cap_do_send(chan, skb); 2563 return len; 2564 } 2565 2566 switch (chan->mode) { 2567 case L2CAP_MODE_LE_FLOWCTL: 2568 case L2CAP_MODE_EXT_FLOWCTL: 2569 /* Check outgoing MTU */ 2570 if (len > chan->omtu) 2571 return -EMSGSIZE; 2572 2573 __skb_queue_head_init(&seg_queue); 2574 2575 err = l2cap_segment_le_sdu(chan, &seg_queue, msg, len); 2576 2577 if (chan->state != BT_CONNECTED) { 2578 __skb_queue_purge(&seg_queue); 2579 err = -ENOTCONN; 2580 } 2581 2582 if (err) 2583 return err; 2584 2585 l2cap_tx_timestamp_seg(&seg_queue, sockc, len); 2586 2587 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q); 2588 2589 l2cap_le_flowctl_send(chan); 2590 2591 if (!chan->tx_credits) 2592 chan->ops->suspend(chan); 2593 2594 err = len; 2595 2596 break; 2597 2598 case L2CAP_MODE_BASIC: 2599 /* Check outgoing MTU */ 2600 if (len > chan->omtu) 2601 return -EMSGSIZE; 2602 2603 /* Create a basic PDU */ 2604 skb = l2cap_create_basic_pdu(chan, msg, len); 2605 if (IS_ERR(skb)) 2606 return PTR_ERR(skb); 2607 2608 l2cap_tx_timestamp(skb, sockc, len); 2609 2610 l2cap_do_send(chan, skb); 2611 err = len; 2612 break; 2613 2614 case L2CAP_MODE_ERTM: 2615 case L2CAP_MODE_STREAMING: 2616 /* Check outgoing MTU */ 2617 if (len > chan->omtu) { 2618 err = -EMSGSIZE; 2619 break; 2620 } 2621 2622 __skb_queue_head_init(&seg_queue); 2623 2624 /* Do segmentation before calling in to the state machine, 2625 * since it's possible to block while waiting for memory 2626 * allocation. 2627 */ 2628 err = l2cap_segment_sdu(chan, &seg_queue, msg, len); 2629 2630 if (err) 2631 break; 2632 2633 if (chan->mode == L2CAP_MODE_ERTM) { 2634 /* TODO: ERTM mode timestamping */ 2635 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST); 2636 } else { 2637 l2cap_tx_timestamp_seg(&seg_queue, sockc, len); 2638 l2cap_streaming_send(chan, &seg_queue); 2639 } 2640 2641 err = len; 2642 2643 /* If the skbs were not queued for sending, they'll still be in 2644 * seg_queue and need to be purged. 2645 */ 2646 __skb_queue_purge(&seg_queue); 2647 break; 2648 2649 default: 2650 BT_DBG("bad state %1.1x", chan->mode); 2651 err = -EBADFD; 2652 } 2653 2654 return err; 2655 } 2656 EXPORT_SYMBOL_GPL(l2cap_chan_send); 2657 2658 static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq) 2659 { 2660 struct l2cap_ctrl control; 2661 u16 seq; 2662 2663 BT_DBG("chan %p, txseq %u", chan, txseq); 2664 2665 memset(&control, 0, sizeof(control)); 2666 control.sframe = 1; 2667 control.super = L2CAP_SUPER_SREJ; 2668 2669 for (seq = chan->expected_tx_seq; seq != txseq; 2670 seq = __next_seq(chan, seq)) { 2671 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) { 2672 control.reqseq = seq; 2673 l2cap_send_sframe(chan, &control); 2674 l2cap_seq_list_append(&chan->srej_list, seq); 2675 } 2676 } 2677 2678 chan->expected_tx_seq = __next_seq(chan, txseq); 2679 } 2680 2681 static void l2cap_send_srej_tail(struct l2cap_chan *chan) 2682 { 2683 struct l2cap_ctrl control; 2684 2685 BT_DBG("chan %p", chan); 2686 2687 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR) 2688 return; 2689 2690 memset(&control, 0, sizeof(control)); 2691 control.sframe = 1; 2692 control.super = L2CAP_SUPER_SREJ; 2693 control.reqseq = chan->srej_list.tail; 2694 l2cap_send_sframe(chan, &control); 2695 } 2696 2697 static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq) 2698 { 2699 struct l2cap_ctrl control; 2700 u16 initial_head; 2701 u16 seq; 2702 2703 BT_DBG("chan %p, txseq %u", chan, txseq); 2704 2705 memset(&control, 0, sizeof(control)); 2706 control.sframe = 1; 2707 control.super = L2CAP_SUPER_SREJ; 2708 2709 /* Capture initial list head to allow only one pass through the list. */ 2710 initial_head = chan->srej_list.head; 2711 2712 do { 2713 seq = l2cap_seq_list_pop(&chan->srej_list); 2714 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR) 2715 break; 2716 2717 control.reqseq = seq; 2718 l2cap_send_sframe(chan, &control); 2719 l2cap_seq_list_append(&chan->srej_list, seq); 2720 } while (chan->srej_list.head != initial_head); 2721 } 2722 2723 static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq) 2724 { 2725 struct sk_buff *acked_skb; 2726 u16 ackseq; 2727 2728 BT_DBG("chan %p, reqseq %u", chan, reqseq); 2729 2730 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq) 2731 return; 2732 2733 BT_DBG("expected_ack_seq %u, unacked_frames %u", 2734 chan->expected_ack_seq, chan->unacked_frames); 2735 2736 for (ackseq = chan->expected_ack_seq; ackseq != reqseq; 2737 ackseq = __next_seq(chan, ackseq)) { 2738 2739 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq); 2740 if (acked_skb) { 2741 skb_unlink(acked_skb, &chan->tx_q); 2742 kfree_skb(acked_skb); 2743 chan->unacked_frames--; 2744 } 2745 } 2746 2747 chan->expected_ack_seq = reqseq; 2748 2749 if (chan->unacked_frames == 0) 2750 __clear_retrans_timer(chan); 2751 2752 BT_DBG("unacked_frames %u", chan->unacked_frames); 2753 } 2754 2755 static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan) 2756 { 2757 BT_DBG("chan %p", chan); 2758 2759 chan->expected_tx_seq = chan->buffer_seq; 2760 l2cap_seq_list_clear(&chan->srej_list); 2761 skb_queue_purge(&chan->srej_q); 2762 chan->rx_state = L2CAP_RX_STATE_RECV; 2763 } 2764 2765 static void l2cap_tx_state_xmit(struct l2cap_chan *chan, 2766 struct l2cap_ctrl *control, 2767 struct sk_buff_head *skbs, u8 event) 2768 { 2769 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2770 event); 2771 2772 switch (event) { 2773 case L2CAP_EV_DATA_REQUEST: 2774 if (chan->tx_send_head == NULL) 2775 chan->tx_send_head = skb_peek(skbs); 2776 2777 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2778 l2cap_ertm_send(chan); 2779 break; 2780 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2781 BT_DBG("Enter LOCAL_BUSY"); 2782 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2783 2784 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2785 /* The SREJ_SENT state must be aborted if we are to 2786 * enter the LOCAL_BUSY state. 2787 */ 2788 l2cap_abort_rx_srej_sent(chan); 2789 } 2790 2791 l2cap_send_ack(chan); 2792 2793 break; 2794 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2795 BT_DBG("Exit LOCAL_BUSY"); 2796 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2797 2798 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2799 struct l2cap_ctrl local_control; 2800 2801 memset(&local_control, 0, sizeof(local_control)); 2802 local_control.sframe = 1; 2803 local_control.super = L2CAP_SUPER_RR; 2804 local_control.poll = 1; 2805 local_control.reqseq = chan->buffer_seq; 2806 l2cap_send_sframe(chan, &local_control); 2807 2808 chan->retry_count = 1; 2809 __set_monitor_timer(chan); 2810 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2811 } 2812 break; 2813 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2814 l2cap_process_reqseq(chan, control->reqseq); 2815 break; 2816 case L2CAP_EV_EXPLICIT_POLL: 2817 l2cap_send_rr_or_rnr(chan, 1); 2818 chan->retry_count = 1; 2819 __set_monitor_timer(chan); 2820 __clear_ack_timer(chan); 2821 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2822 break; 2823 case L2CAP_EV_RETRANS_TO: 2824 l2cap_send_rr_or_rnr(chan, 1); 2825 chan->retry_count = 1; 2826 __set_monitor_timer(chan); 2827 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2828 break; 2829 case L2CAP_EV_RECV_FBIT: 2830 /* Nothing to process */ 2831 break; 2832 default: 2833 break; 2834 } 2835 } 2836 2837 static void l2cap_tx_state_wait_f(struct l2cap_chan *chan, 2838 struct l2cap_ctrl *control, 2839 struct sk_buff_head *skbs, u8 event) 2840 { 2841 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs, 2842 event); 2843 2844 switch (event) { 2845 case L2CAP_EV_DATA_REQUEST: 2846 if (chan->tx_send_head == NULL) 2847 chan->tx_send_head = skb_peek(skbs); 2848 /* Queue data, but don't send. */ 2849 skb_queue_splice_tail_init(skbs, &chan->tx_q); 2850 break; 2851 case L2CAP_EV_LOCAL_BUSY_DETECTED: 2852 BT_DBG("Enter LOCAL_BUSY"); 2853 set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2854 2855 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 2856 /* The SREJ_SENT state must be aborted if we are to 2857 * enter the LOCAL_BUSY state. 2858 */ 2859 l2cap_abort_rx_srej_sent(chan); 2860 } 2861 2862 l2cap_send_ack(chan); 2863 2864 break; 2865 case L2CAP_EV_LOCAL_BUSY_CLEAR: 2866 BT_DBG("Exit LOCAL_BUSY"); 2867 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 2868 2869 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) { 2870 struct l2cap_ctrl local_control; 2871 memset(&local_control, 0, sizeof(local_control)); 2872 local_control.sframe = 1; 2873 local_control.super = L2CAP_SUPER_RR; 2874 local_control.poll = 1; 2875 local_control.reqseq = chan->buffer_seq; 2876 l2cap_send_sframe(chan, &local_control); 2877 2878 chan->retry_count = 1; 2879 __set_monitor_timer(chan); 2880 chan->tx_state = L2CAP_TX_STATE_WAIT_F; 2881 } 2882 break; 2883 case L2CAP_EV_RECV_REQSEQ_AND_FBIT: 2884 l2cap_process_reqseq(chan, control->reqseq); 2885 fallthrough; 2886 2887 case L2CAP_EV_RECV_FBIT: 2888 if (control && control->final) { 2889 __clear_monitor_timer(chan); 2890 if (chan->unacked_frames > 0) 2891 __set_retrans_timer(chan); 2892 chan->retry_count = 0; 2893 chan->tx_state = L2CAP_TX_STATE_XMIT; 2894 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state); 2895 } 2896 break; 2897 case L2CAP_EV_EXPLICIT_POLL: 2898 /* Ignore */ 2899 break; 2900 case L2CAP_EV_MONITOR_TO: 2901 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) { 2902 l2cap_send_rr_or_rnr(chan, 1); 2903 __set_monitor_timer(chan); 2904 chan->retry_count++; 2905 } else { 2906 l2cap_send_disconn_req(chan, ECONNABORTED); 2907 } 2908 break; 2909 default: 2910 break; 2911 } 2912 } 2913 2914 static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 2915 struct sk_buff_head *skbs, u8 event) 2916 { 2917 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d", 2918 chan, control, skbs, event, chan->tx_state); 2919 2920 switch (chan->tx_state) { 2921 case L2CAP_TX_STATE_XMIT: 2922 l2cap_tx_state_xmit(chan, control, skbs, event); 2923 break; 2924 case L2CAP_TX_STATE_WAIT_F: 2925 l2cap_tx_state_wait_f(chan, control, skbs, event); 2926 break; 2927 default: 2928 /* Ignore event */ 2929 break; 2930 } 2931 } 2932 2933 static void l2cap_pass_to_tx(struct l2cap_chan *chan, 2934 struct l2cap_ctrl *control) 2935 { 2936 BT_DBG("chan %p, control %p", chan, control); 2937 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT); 2938 } 2939 2940 static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan, 2941 struct l2cap_ctrl *control) 2942 { 2943 BT_DBG("chan %p, control %p", chan, control); 2944 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT); 2945 } 2946 2947 /* Copy frame to all raw sockets on that connection */ 2948 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 2949 { 2950 struct sk_buff *nskb; 2951 struct l2cap_chan *chan; 2952 2953 BT_DBG("conn %p", conn); 2954 2955 list_for_each_entry(chan, &conn->chan_l, list) { 2956 if (chan->chan_type != L2CAP_CHAN_RAW) 2957 continue; 2958 2959 /* Don't send frame to the channel it came from */ 2960 if (bt_cb(skb)->l2cap.chan == chan) 2961 continue; 2962 2963 nskb = skb_clone(skb, GFP_KERNEL); 2964 if (!nskb) 2965 continue; 2966 if (chan->ops->recv(chan, nskb)) 2967 kfree_skb(nskb); 2968 } 2969 } 2970 2971 /* ---- L2CAP signalling commands ---- */ 2972 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code, 2973 u8 ident, u16 dlen, void *data) 2974 { 2975 struct sk_buff *skb, **frag; 2976 struct l2cap_cmd_hdr *cmd; 2977 struct l2cap_hdr *lh; 2978 int len, count; 2979 2980 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u", 2981 conn, code, ident, dlen); 2982 2983 if (conn->mtu < L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE) 2984 return NULL; 2985 2986 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 2987 count = min_t(unsigned int, conn->mtu, len); 2988 2989 skb = bt_skb_alloc(count, GFP_KERNEL); 2990 if (!skb) 2991 return NULL; 2992 2993 lh = skb_put(skb, L2CAP_HDR_SIZE); 2994 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 2995 2996 if (conn->hcon->type == LE_LINK) 2997 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 2998 else 2999 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 3000 3001 cmd = skb_put(skb, L2CAP_CMD_HDR_SIZE); 3002 cmd->code = code; 3003 cmd->ident = ident; 3004 cmd->len = cpu_to_le16(dlen); 3005 3006 if (dlen) { 3007 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 3008 skb_put_data(skb, data, count); 3009 data += count; 3010 } 3011 3012 len -= skb->len; 3013 3014 /* Continuation fragments (no L2CAP header) */ 3015 frag = &skb_shinfo(skb)->frag_list; 3016 while (len) { 3017 count = min_t(unsigned int, conn->mtu, len); 3018 3019 *frag = bt_skb_alloc(count, GFP_KERNEL); 3020 if (!*frag) 3021 goto fail; 3022 3023 skb_put_data(*frag, data, count); 3024 3025 len -= count; 3026 data += count; 3027 3028 frag = &(*frag)->next; 3029 } 3030 3031 return skb; 3032 3033 fail: 3034 kfree_skb(skb); 3035 return NULL; 3036 } 3037 3038 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, 3039 unsigned long *val) 3040 { 3041 struct l2cap_conf_opt *opt = *ptr; 3042 int len; 3043 3044 len = L2CAP_CONF_OPT_SIZE + opt->len; 3045 *ptr += len; 3046 3047 *type = opt->type; 3048 *olen = opt->len; 3049 3050 switch (opt->len) { 3051 case 1: 3052 *val = *((u8 *) opt->val); 3053 break; 3054 3055 case 2: 3056 *val = get_unaligned_le16(opt->val); 3057 break; 3058 3059 case 4: 3060 *val = get_unaligned_le32(opt->val); 3061 break; 3062 3063 default: 3064 *val = (unsigned long) opt->val; 3065 break; 3066 } 3067 3068 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val); 3069 return len; 3070 } 3071 3072 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) 3073 { 3074 struct l2cap_conf_opt *opt = *ptr; 3075 3076 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); 3077 3078 if (size < L2CAP_CONF_OPT_SIZE + len) 3079 return; 3080 3081 opt->type = type; 3082 opt->len = len; 3083 3084 switch (len) { 3085 case 1: 3086 *((u8 *) opt->val) = val; 3087 break; 3088 3089 case 2: 3090 put_unaligned_le16(val, opt->val); 3091 break; 3092 3093 case 4: 3094 put_unaligned_le32(val, opt->val); 3095 break; 3096 3097 default: 3098 memcpy(opt->val, (void *) val, len); 3099 break; 3100 } 3101 3102 *ptr += L2CAP_CONF_OPT_SIZE + len; 3103 } 3104 3105 static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) 3106 { 3107 struct l2cap_conf_efs efs; 3108 3109 switch (chan->mode) { 3110 case L2CAP_MODE_ERTM: 3111 efs.id = chan->local_id; 3112 efs.stype = chan->local_stype; 3113 efs.msdu = cpu_to_le16(chan->local_msdu); 3114 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3115 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT); 3116 efs.flush_to = cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO); 3117 break; 3118 3119 case L2CAP_MODE_STREAMING: 3120 efs.id = 1; 3121 efs.stype = L2CAP_SERV_BESTEFFORT; 3122 efs.msdu = cpu_to_le16(chan->local_msdu); 3123 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime); 3124 efs.acc_lat = 0; 3125 efs.flush_to = 0; 3126 break; 3127 3128 default: 3129 return; 3130 } 3131 3132 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), 3133 (unsigned long) &efs, size); 3134 } 3135 3136 static void l2cap_ack_timeout(struct work_struct *work) 3137 { 3138 struct l2cap_chan *chan = container_of(work, struct l2cap_chan, 3139 ack_timer.work); 3140 u16 frames_to_ack; 3141 3142 BT_DBG("chan %p", chan); 3143 3144 l2cap_chan_lock(chan); 3145 3146 frames_to_ack = __seq_offset(chan, chan->buffer_seq, 3147 chan->last_acked_seq); 3148 3149 if (frames_to_ack) 3150 l2cap_send_rr_or_rnr(chan, 0); 3151 3152 l2cap_chan_unlock(chan); 3153 l2cap_chan_put(chan); 3154 } 3155 3156 int l2cap_ertm_init(struct l2cap_chan *chan) 3157 { 3158 int err; 3159 3160 chan->next_tx_seq = 0; 3161 chan->expected_tx_seq = 0; 3162 chan->expected_ack_seq = 0; 3163 chan->unacked_frames = 0; 3164 chan->buffer_seq = 0; 3165 chan->frames_sent = 0; 3166 chan->last_acked_seq = 0; 3167 chan->sdu = NULL; 3168 chan->sdu_last_frag = NULL; 3169 chan->sdu_len = 0; 3170 3171 skb_queue_head_init(&chan->tx_q); 3172 3173 if (chan->mode != L2CAP_MODE_ERTM) 3174 return 0; 3175 3176 chan->rx_state = L2CAP_RX_STATE_RECV; 3177 chan->tx_state = L2CAP_TX_STATE_XMIT; 3178 3179 skb_queue_head_init(&chan->srej_q); 3180 3181 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win); 3182 if (err < 0) 3183 return err; 3184 3185 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win); 3186 if (err < 0) 3187 l2cap_seq_list_free(&chan->srej_list); 3188 3189 return err; 3190 } 3191 3192 static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 3193 { 3194 switch (mode) { 3195 case L2CAP_MODE_STREAMING: 3196 case L2CAP_MODE_ERTM: 3197 if (l2cap_mode_supported(mode, remote_feat_mask)) 3198 return mode; 3199 fallthrough; 3200 default: 3201 return L2CAP_MODE_BASIC; 3202 } 3203 } 3204 3205 static inline bool __l2cap_ews_supported(struct l2cap_conn *conn) 3206 { 3207 return (conn->feat_mask & L2CAP_FEAT_EXT_WINDOW); 3208 } 3209 3210 static inline bool __l2cap_efs_supported(struct l2cap_conn *conn) 3211 { 3212 return (conn->feat_mask & L2CAP_FEAT_EXT_FLOW); 3213 } 3214 3215 static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan, 3216 struct l2cap_conf_rfc *rfc) 3217 { 3218 rfc->retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 3219 rfc->monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 3220 } 3221 3222 static inline void l2cap_txwin_setup(struct l2cap_chan *chan) 3223 { 3224 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW && 3225 __l2cap_ews_supported(chan->conn)) { 3226 /* use extended control field */ 3227 set_bit(FLAG_EXT_CTRL, &chan->flags); 3228 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW; 3229 } else { 3230 chan->tx_win = min_t(u16, chan->tx_win, 3231 L2CAP_DEFAULT_TX_WINDOW); 3232 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW; 3233 } 3234 chan->ack_win = chan->tx_win; 3235 } 3236 3237 static void l2cap_mtu_auto(struct l2cap_chan *chan) 3238 { 3239 struct hci_conn *conn = chan->conn->hcon; 3240 3241 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3242 3243 /* The 2-DH1 packet has between 2 and 56 information bytes 3244 * (including the 2-byte payload header) 3245 */ 3246 if (!(conn->pkt_type & HCI_2DH1)) 3247 chan->imtu = 54; 3248 3249 /* The 3-DH1 packet has between 2 and 85 information bytes 3250 * (including the 2-byte payload header) 3251 */ 3252 if (!(conn->pkt_type & HCI_3DH1)) 3253 chan->imtu = 83; 3254 3255 /* The 2-DH3 packet has between 2 and 369 information bytes 3256 * (including the 2-byte payload header) 3257 */ 3258 if (!(conn->pkt_type & HCI_2DH3)) 3259 chan->imtu = 367; 3260 3261 /* The 3-DH3 packet has between 2 and 554 information bytes 3262 * (including the 2-byte payload header) 3263 */ 3264 if (!(conn->pkt_type & HCI_3DH3)) 3265 chan->imtu = 552; 3266 3267 /* The 2-DH5 packet has between 2 and 681 information bytes 3268 * (including the 2-byte payload header) 3269 */ 3270 if (!(conn->pkt_type & HCI_2DH5)) 3271 chan->imtu = 679; 3272 3273 /* The 3-DH5 packet has between 2 and 1023 information bytes 3274 * (including the 2-byte payload header) 3275 */ 3276 if (!(conn->pkt_type & HCI_3DH5)) 3277 chan->imtu = 1021; 3278 } 3279 3280 static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3281 { 3282 struct l2cap_conf_req *req = data; 3283 struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 3284 void *ptr = req->data; 3285 void *endptr = data + data_size; 3286 u16 size; 3287 3288 BT_DBG("chan %p", chan); 3289 3290 if (chan->num_conf_req || chan->num_conf_rsp) 3291 goto done; 3292 3293 switch (chan->mode) { 3294 case L2CAP_MODE_STREAMING: 3295 case L2CAP_MODE_ERTM: 3296 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 3297 break; 3298 3299 if (__l2cap_efs_supported(chan->conn)) 3300 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3301 3302 fallthrough; 3303 default: 3304 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 3305 break; 3306 } 3307 3308 done: 3309 if (chan->imtu != L2CAP_DEFAULT_MTU) { 3310 if (!chan->imtu) 3311 l2cap_mtu_auto(chan); 3312 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3313 endptr - ptr); 3314 } 3315 3316 switch (chan->mode) { 3317 case L2CAP_MODE_BASIC: 3318 if (disable_ertm) 3319 break; 3320 3321 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 3322 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 3323 break; 3324 3325 rfc.mode = L2CAP_MODE_BASIC; 3326 rfc.txwin_size = 0; 3327 rfc.max_transmit = 0; 3328 rfc.retrans_timeout = 0; 3329 rfc.monitor_timeout = 0; 3330 rfc.max_pdu_size = 0; 3331 3332 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3333 (unsigned long) &rfc, endptr - ptr); 3334 break; 3335 3336 case L2CAP_MODE_ERTM: 3337 rfc.mode = L2CAP_MODE_ERTM; 3338 rfc.max_transmit = chan->max_tx; 3339 3340 __l2cap_set_ertm_timeouts(chan, &rfc); 3341 3342 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3343 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3344 L2CAP_FCS_SIZE); 3345 rfc.max_pdu_size = cpu_to_le16(size); 3346 3347 l2cap_txwin_setup(chan); 3348 3349 rfc.txwin_size = min_t(u16, chan->tx_win, 3350 L2CAP_DEFAULT_TX_WINDOW); 3351 3352 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3353 (unsigned long) &rfc, endptr - ptr); 3354 3355 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3356 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3357 3358 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 3359 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3360 chan->tx_win, endptr - ptr); 3361 3362 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3363 if (chan->fcs == L2CAP_FCS_NONE || 3364 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3365 chan->fcs = L2CAP_FCS_NONE; 3366 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3367 chan->fcs, endptr - ptr); 3368 } 3369 break; 3370 3371 case L2CAP_MODE_STREAMING: 3372 l2cap_txwin_setup(chan); 3373 rfc.mode = L2CAP_MODE_STREAMING; 3374 rfc.txwin_size = 0; 3375 rfc.max_transmit = 0; 3376 rfc.retrans_timeout = 0; 3377 rfc.monitor_timeout = 0; 3378 3379 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu - 3380 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE - 3381 L2CAP_FCS_SIZE); 3382 rfc.max_pdu_size = cpu_to_le16(size); 3383 3384 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3385 (unsigned long) &rfc, endptr - ptr); 3386 3387 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) 3388 l2cap_add_opt_efs(&ptr, chan, endptr - ptr); 3389 3390 if (chan->conn->feat_mask & L2CAP_FEAT_FCS) 3391 if (chan->fcs == L2CAP_FCS_NONE || 3392 test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { 3393 chan->fcs = L2CAP_FCS_NONE; 3394 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, 3395 chan->fcs, endptr - ptr); 3396 } 3397 break; 3398 } 3399 3400 req->dcid = cpu_to_le16(chan->dcid); 3401 req->flags = cpu_to_le16(0); 3402 3403 return ptr - data; 3404 } 3405 3406 static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) 3407 { 3408 struct l2cap_conf_rsp *rsp = data; 3409 void *ptr = rsp->data; 3410 void *endptr = data + data_size; 3411 void *req = chan->conf_req; 3412 int len = chan->conf_len; 3413 int type, hint, olen; 3414 unsigned long val; 3415 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3416 struct l2cap_conf_efs efs; 3417 u8 remote_efs = 0; 3418 u16 mtu = L2CAP_DEFAULT_MTU; 3419 u16 result = L2CAP_CONF_SUCCESS; 3420 u16 size; 3421 3422 BT_DBG("chan %p", chan); 3423 3424 while (len >= L2CAP_CONF_OPT_SIZE) { 3425 len -= l2cap_get_conf_opt(&req, &type, &olen, &val); 3426 if (len < 0) 3427 break; 3428 3429 hint = type & L2CAP_CONF_HINT; 3430 type &= L2CAP_CONF_MASK; 3431 3432 switch (type) { 3433 case L2CAP_CONF_MTU: 3434 if (olen != 2) 3435 break; 3436 mtu = val; 3437 break; 3438 3439 case L2CAP_CONF_FLUSH_TO: 3440 if (olen != 2) 3441 break; 3442 chan->flush_to = val; 3443 break; 3444 3445 case L2CAP_CONF_QOS: 3446 break; 3447 3448 case L2CAP_CONF_RFC: 3449 if (olen != sizeof(rfc)) 3450 break; 3451 memcpy(&rfc, (void *) val, olen); 3452 break; 3453 3454 case L2CAP_CONF_FCS: 3455 if (olen != 1) 3456 break; 3457 if (val == L2CAP_FCS_NONE) 3458 set_bit(CONF_RECV_NO_FCS, &chan->conf_state); 3459 break; 3460 3461 case L2CAP_CONF_EFS: 3462 if (olen != sizeof(efs)) 3463 break; 3464 remote_efs = 1; 3465 memcpy(&efs, (void *) val, olen); 3466 break; 3467 3468 case L2CAP_CONF_EWS: 3469 if (olen != 2) 3470 break; 3471 return -ECONNREFUSED; 3472 3473 default: 3474 if (hint) 3475 break; 3476 result = L2CAP_CONF_UNKNOWN; 3477 l2cap_add_conf_opt(&ptr, (u8)type, sizeof(u8), type, endptr - ptr); 3478 break; 3479 } 3480 } 3481 3482 if (chan->num_conf_rsp || chan->num_conf_req > 1) 3483 goto done; 3484 3485 switch (chan->mode) { 3486 case L2CAP_MODE_STREAMING: 3487 case L2CAP_MODE_ERTM: 3488 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 3489 chan->mode = l2cap_select_mode(rfc.mode, 3490 chan->conn->feat_mask); 3491 break; 3492 } 3493 3494 if (remote_efs) { 3495 if (__l2cap_efs_supported(chan->conn)) 3496 set_bit(FLAG_EFS_ENABLE, &chan->flags); 3497 else 3498 return -ECONNREFUSED; 3499 } 3500 3501 if (chan->mode != rfc.mode) 3502 return -ECONNREFUSED; 3503 3504 break; 3505 } 3506 3507 done: 3508 if (chan->mode != rfc.mode) { 3509 result = L2CAP_CONF_UNACCEPT; 3510 rfc.mode = chan->mode; 3511 3512 if (chan->num_conf_rsp == 1) 3513 return -ECONNREFUSED; 3514 3515 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3516 (unsigned long) &rfc, endptr - ptr); 3517 } 3518 3519 if (result == L2CAP_CONF_SUCCESS) { 3520 /* Configure output options and let the other side know 3521 * which ones we don't like. */ 3522 3523 if (mtu < L2CAP_DEFAULT_MIN_MTU) 3524 result = L2CAP_CONF_UNACCEPT; 3525 else { 3526 chan->omtu = mtu; 3527 set_bit(CONF_MTU_DONE, &chan->conf_state); 3528 } 3529 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); 3530 3531 if (remote_efs) { 3532 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3533 efs.stype != L2CAP_SERV_NOTRAFIC && 3534 efs.stype != chan->local_stype) { 3535 3536 result = L2CAP_CONF_UNACCEPT; 3537 3538 if (chan->num_conf_req >= 1) 3539 return -ECONNREFUSED; 3540 3541 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3542 sizeof(efs), 3543 (unsigned long) &efs, endptr - ptr); 3544 } else { 3545 /* Send PENDING Conf Rsp */ 3546 result = L2CAP_CONF_PENDING; 3547 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 3548 } 3549 } 3550 3551 switch (rfc.mode) { 3552 case L2CAP_MODE_BASIC: 3553 chan->fcs = L2CAP_FCS_NONE; 3554 set_bit(CONF_MODE_DONE, &chan->conf_state); 3555 break; 3556 3557 case L2CAP_MODE_ERTM: 3558 if (!test_bit(CONF_EWS_RECV, &chan->conf_state)) 3559 chan->remote_tx_win = rfc.txwin_size; 3560 else 3561 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 3562 3563 chan->remote_max_tx = rfc.max_transmit; 3564 3565 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3566 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3567 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3568 rfc.max_pdu_size = cpu_to_le16(size); 3569 chan->remote_mps = size; 3570 3571 __l2cap_set_ertm_timeouts(chan, &rfc); 3572 3573 set_bit(CONF_MODE_DONE, &chan->conf_state); 3574 3575 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 3576 sizeof(rfc), (unsigned long) &rfc, endptr - ptr); 3577 3578 if (remote_efs && 3579 test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3580 chan->remote_id = efs.id; 3581 chan->remote_stype = efs.stype; 3582 chan->remote_msdu = le16_to_cpu(efs.msdu); 3583 chan->remote_flush_to = 3584 le32_to_cpu(efs.flush_to); 3585 chan->remote_acc_lat = 3586 le32_to_cpu(efs.acc_lat); 3587 chan->remote_sdu_itime = 3588 le32_to_cpu(efs.sdu_itime); 3589 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, 3590 sizeof(efs), 3591 (unsigned long) &efs, endptr - ptr); 3592 } 3593 break; 3594 3595 case L2CAP_MODE_STREAMING: 3596 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size), 3597 chan->conn->mtu - L2CAP_EXT_HDR_SIZE - 3598 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE); 3599 rfc.max_pdu_size = cpu_to_le16(size); 3600 chan->remote_mps = size; 3601 3602 set_bit(CONF_MODE_DONE, &chan->conf_state); 3603 3604 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3605 (unsigned long) &rfc, endptr - ptr); 3606 3607 break; 3608 3609 default: 3610 result = L2CAP_CONF_UNACCEPT; 3611 3612 memset(&rfc, 0, sizeof(rfc)); 3613 rfc.mode = chan->mode; 3614 } 3615 3616 if (result == L2CAP_CONF_SUCCESS) 3617 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 3618 } 3619 rsp->scid = cpu_to_le16(chan->dcid); 3620 rsp->result = cpu_to_le16(result); 3621 rsp->flags = cpu_to_le16(0); 3622 3623 return ptr - data; 3624 } 3625 3626 static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 3627 void *data, size_t size, u16 *result) 3628 { 3629 struct l2cap_conf_req *req = data; 3630 void *ptr = req->data; 3631 void *endptr = data + size; 3632 int type, olen; 3633 unsigned long val; 3634 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 3635 struct l2cap_conf_efs efs; 3636 3637 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 3638 3639 while (len >= L2CAP_CONF_OPT_SIZE) { 3640 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 3641 if (len < 0) 3642 break; 3643 3644 switch (type) { 3645 case L2CAP_CONF_MTU: 3646 if (olen != 2) 3647 break; 3648 if (val < L2CAP_DEFAULT_MIN_MTU) { 3649 *result = L2CAP_CONF_UNACCEPT; 3650 chan->imtu = L2CAP_DEFAULT_MIN_MTU; 3651 } else 3652 chan->imtu = val; 3653 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, 3654 endptr - ptr); 3655 break; 3656 3657 case L2CAP_CONF_FLUSH_TO: 3658 if (olen != 2) 3659 break; 3660 chan->flush_to = val; 3661 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, 3662 chan->flush_to, endptr - ptr); 3663 break; 3664 3665 case L2CAP_CONF_RFC: 3666 if (olen != sizeof(rfc)) 3667 break; 3668 memcpy(&rfc, (void *)val, olen); 3669 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 3670 rfc.mode != chan->mode) 3671 return -ECONNREFUSED; 3672 chan->fcs = 0; 3673 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 3674 (unsigned long) &rfc, endptr - ptr); 3675 break; 3676 3677 case L2CAP_CONF_EWS: 3678 if (olen != 2) 3679 break; 3680 chan->ack_win = min_t(u16, val, chan->ack_win); 3681 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 3682 chan->tx_win, endptr - ptr); 3683 break; 3684 3685 case L2CAP_CONF_EFS: 3686 if (olen != sizeof(efs)) 3687 break; 3688 memcpy(&efs, (void *)val, olen); 3689 if (chan->local_stype != L2CAP_SERV_NOTRAFIC && 3690 efs.stype != L2CAP_SERV_NOTRAFIC && 3691 efs.stype != chan->local_stype) 3692 return -ECONNREFUSED; 3693 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), 3694 (unsigned long) &efs, endptr - ptr); 3695 break; 3696 3697 case L2CAP_CONF_FCS: 3698 if (olen != 1) 3699 break; 3700 if (*result == L2CAP_CONF_PENDING) 3701 if (val == L2CAP_FCS_NONE) 3702 set_bit(CONF_RECV_NO_FCS, 3703 &chan->conf_state); 3704 break; 3705 } 3706 } 3707 3708 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) 3709 return -ECONNREFUSED; 3710 3711 chan->mode = rfc.mode; 3712 3713 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) { 3714 switch (rfc.mode) { 3715 case L2CAP_MODE_ERTM: 3716 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 3717 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 3718 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3719 if (!test_bit(FLAG_EXT_CTRL, &chan->flags)) 3720 chan->ack_win = min_t(u16, chan->ack_win, 3721 rfc.txwin_size); 3722 3723 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { 3724 chan->local_msdu = le16_to_cpu(efs.msdu); 3725 chan->local_sdu_itime = 3726 le32_to_cpu(efs.sdu_itime); 3727 chan->local_acc_lat = le32_to_cpu(efs.acc_lat); 3728 chan->local_flush_to = 3729 le32_to_cpu(efs.flush_to); 3730 } 3731 break; 3732 3733 case L2CAP_MODE_STREAMING: 3734 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3735 } 3736 } 3737 3738 req->dcid = cpu_to_le16(chan->dcid); 3739 req->flags = cpu_to_le16(0); 3740 3741 return ptr - data; 3742 } 3743 3744 static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, 3745 u16 result, u16 flags) 3746 { 3747 struct l2cap_conf_rsp *rsp = data; 3748 void *ptr = rsp->data; 3749 3750 BT_DBG("chan %p", chan); 3751 3752 rsp->scid = cpu_to_le16(chan->dcid); 3753 rsp->result = cpu_to_le16(result); 3754 rsp->flags = cpu_to_le16(flags); 3755 3756 return ptr - data; 3757 } 3758 3759 void __l2cap_le_connect_rsp_defer(struct l2cap_chan *chan) 3760 { 3761 struct l2cap_le_conn_rsp rsp; 3762 struct l2cap_conn *conn = chan->conn; 3763 3764 BT_DBG("chan %p", chan); 3765 3766 rsp.dcid = cpu_to_le16(chan->scid); 3767 rsp.mtu = cpu_to_le16(chan->imtu); 3768 rsp.mps = cpu_to_le16(chan->mps); 3769 rsp.credits = cpu_to_le16(chan->rx_credits); 3770 rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3771 3772 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), 3773 &rsp); 3774 } 3775 3776 static void l2cap_ecred_list_defer(struct l2cap_chan *chan, void *data) 3777 { 3778 int *result = data; 3779 3780 if (*result || test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags)) 3781 return; 3782 3783 switch (chan->state) { 3784 case BT_CONNECT2: 3785 /* If channel still pending accept add to result */ 3786 (*result)++; 3787 return; 3788 case BT_CONNECTED: 3789 return; 3790 default: 3791 /* If not connected or pending accept it has been refused */ 3792 *result = -ECONNREFUSED; 3793 return; 3794 } 3795 } 3796 3797 struct l2cap_ecred_rsp_data { 3798 struct { 3799 struct l2cap_ecred_conn_rsp_hdr rsp; 3800 __le16 scid[L2CAP_ECRED_MAX_CID]; 3801 } __packed pdu; 3802 int count; 3803 }; 3804 3805 static void l2cap_ecred_rsp_defer(struct l2cap_chan *chan, void *data) 3806 { 3807 struct l2cap_ecred_rsp_data *rsp = data; 3808 struct l2cap_ecred_conn_rsp *rsp_flex = 3809 container_of(&rsp->pdu.rsp, struct l2cap_ecred_conn_rsp, hdr); 3810 3811 /* Check if channel for outgoing connection or if it wasn't deferred 3812 * since in those cases it must be skipped. 3813 */ 3814 if (test_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags) || 3815 !test_and_clear_bit(FLAG_DEFER_SETUP, &chan->flags)) 3816 return; 3817 3818 /* Reset ident so only one response is sent */ 3819 chan->ident = 0; 3820 3821 /* Include all channels pending with the same ident */ 3822 if (!rsp->pdu.rsp.result) 3823 rsp_flex->dcid[rsp->count++] = cpu_to_le16(chan->scid); 3824 else 3825 l2cap_chan_del(chan, ECONNRESET); 3826 } 3827 3828 void __l2cap_ecred_conn_rsp_defer(struct l2cap_chan *chan) 3829 { 3830 struct l2cap_conn *conn = chan->conn; 3831 struct l2cap_ecred_rsp_data data; 3832 u16 id = chan->ident; 3833 int result = 0; 3834 3835 if (!id) 3836 return; 3837 3838 BT_DBG("chan %p id %d", chan, id); 3839 3840 memset(&data, 0, sizeof(data)); 3841 3842 data.pdu.rsp.mtu = cpu_to_le16(chan->imtu); 3843 data.pdu.rsp.mps = cpu_to_le16(chan->mps); 3844 data.pdu.rsp.credits = cpu_to_le16(chan->rx_credits); 3845 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_SUCCESS); 3846 3847 /* Verify that all channels are ready */ 3848 __l2cap_chan_list_id(conn, id, l2cap_ecred_list_defer, &result); 3849 3850 if (result > 0) 3851 return; 3852 3853 if (result < 0) 3854 data.pdu.rsp.result = cpu_to_le16(L2CAP_CR_LE_AUTHORIZATION); 3855 3856 /* Build response */ 3857 __l2cap_chan_list_id(conn, id, l2cap_ecred_rsp_defer, &data); 3858 3859 l2cap_send_cmd(conn, id, L2CAP_ECRED_CONN_RSP, 3860 sizeof(data.pdu.rsp) + (data.count * sizeof(__le16)), 3861 &data.pdu); 3862 } 3863 3864 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 3865 { 3866 struct l2cap_conn_rsp rsp; 3867 struct l2cap_conn *conn = chan->conn; 3868 u8 buf[128]; 3869 u8 rsp_code; 3870 3871 rsp.scid = cpu_to_le16(chan->dcid); 3872 rsp.dcid = cpu_to_le16(chan->scid); 3873 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 3874 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 3875 rsp_code = L2CAP_CONN_RSP; 3876 3877 BT_DBG("chan %p rsp_code %u", chan, rsp_code); 3878 3879 l2cap_send_cmd(conn, chan->ident, rsp_code, sizeof(rsp), &rsp); 3880 3881 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 3882 return; 3883 3884 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 3885 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 3886 chan->num_conf_req++; 3887 } 3888 3889 static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 3890 { 3891 int type, olen; 3892 unsigned long val; 3893 /* Use sane default values in case a misbehaving remote device 3894 * did not send an RFC or extended window size option. 3895 */ 3896 u16 txwin_ext = chan->ack_win; 3897 struct l2cap_conf_rfc rfc = { 3898 .mode = chan->mode, 3899 .retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO), 3900 .monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO), 3901 .max_pdu_size = cpu_to_le16(chan->imtu), 3902 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW), 3903 }; 3904 3905 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 3906 3907 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 3908 return; 3909 3910 while (len >= L2CAP_CONF_OPT_SIZE) { 3911 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 3912 if (len < 0) 3913 break; 3914 3915 switch (type) { 3916 case L2CAP_CONF_RFC: 3917 if (olen != sizeof(rfc)) 3918 break; 3919 memcpy(&rfc, (void *)val, olen); 3920 break; 3921 case L2CAP_CONF_EWS: 3922 if (olen != 2) 3923 break; 3924 txwin_ext = val; 3925 break; 3926 } 3927 } 3928 3929 switch (rfc.mode) { 3930 case L2CAP_MODE_ERTM: 3931 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 3932 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 3933 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3934 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 3935 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext); 3936 else 3937 chan->ack_win = min_t(u16, chan->ack_win, 3938 rfc.txwin_size); 3939 break; 3940 case L2CAP_MODE_STREAMING: 3941 chan->mps = le16_to_cpu(rfc.max_pdu_size); 3942 } 3943 } 3944 3945 static inline int l2cap_command_rej(struct l2cap_conn *conn, 3946 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 3947 u8 *data) 3948 { 3949 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 3950 3951 if (cmd_len < sizeof(*rej)) 3952 return -EPROTO; 3953 3954 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 3955 return 0; 3956 3957 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 3958 cmd->ident == conn->info_ident) { 3959 cancel_delayed_work(&conn->info_timer); 3960 3961 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 3962 conn->info_ident = 0; 3963 3964 l2cap_conn_start(conn); 3965 } 3966 3967 return 0; 3968 } 3969 3970 static void l2cap_connect(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, 3971 u8 *data, u8 rsp_code) 3972 { 3973 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 3974 struct l2cap_conn_rsp rsp; 3975 struct l2cap_chan *chan = NULL, *pchan = NULL; 3976 int result, status = L2CAP_CS_NO_INFO; 3977 3978 u16 dcid = 0, scid = __le16_to_cpu(req->scid); 3979 __le16 psm = req->psm; 3980 3981 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid); 3982 3983 /* Check if we have socket listening on psm */ 3984 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 3985 &conn->hcon->dst, ACL_LINK); 3986 if (!pchan) { 3987 result = L2CAP_CR_BAD_PSM; 3988 goto response; 3989 } 3990 3991 l2cap_chan_lock(pchan); 3992 3993 /* Check if the ACL is secure enough (if not SDP) */ 3994 if (psm != cpu_to_le16(L2CAP_PSM_SDP) && 3995 (!hci_conn_check_link_mode(conn->hcon) || 3996 !l2cap_check_enc_key_size(conn->hcon, pchan))) { 3997 conn->disc_reason = HCI_ERROR_AUTH_FAILURE; 3998 result = L2CAP_CR_SEC_BLOCK; 3999 goto response; 4000 } 4001 4002 result = L2CAP_CR_NO_MEM; 4003 4004 /* Check for valid dynamic CID range (as per Erratum 3253) */ 4005 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_DYN_END) { 4006 result = L2CAP_CR_INVALID_SCID; 4007 goto response; 4008 } 4009 4010 /* Check if we already have channel with that dcid */ 4011 if (__l2cap_get_chan_by_dcid(conn, scid)) { 4012 result = L2CAP_CR_SCID_IN_USE; 4013 goto response; 4014 } 4015 4016 chan = pchan->ops->new_connection(pchan); 4017 if (!chan) 4018 goto response; 4019 4020 /* For certain devices (ex: HID mouse), support for authentication, 4021 * pairing and bonding is optional. For such devices, inorder to avoid 4022 * the ACL alive for too long after L2CAP disconnection, reset the ACL 4023 * disc_timeout back to HCI_DISCONN_TIMEOUT during L2CAP connect. 4024 */ 4025 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT; 4026 4027 bacpy(&chan->src, &conn->hcon->src); 4028 bacpy(&chan->dst, &conn->hcon->dst); 4029 chan->src_type = bdaddr_src_type(conn->hcon); 4030 chan->dst_type = bdaddr_dst_type(conn->hcon); 4031 chan->psm = psm; 4032 chan->dcid = scid; 4033 4034 __l2cap_chan_add(conn, chan); 4035 4036 dcid = chan->scid; 4037 4038 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 4039 4040 chan->ident = cmd->ident; 4041 4042 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 4043 if (l2cap_chan_check_security(chan, false)) { 4044 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 4045 l2cap_state_change(chan, BT_CONNECT2); 4046 result = L2CAP_CR_PEND; 4047 status = L2CAP_CS_AUTHOR_PEND; 4048 chan->ops->defer(chan); 4049 } else { 4050 l2cap_state_change(chan, BT_CONFIG); 4051 result = L2CAP_CR_SUCCESS; 4052 status = L2CAP_CS_NO_INFO; 4053 } 4054 } else { 4055 l2cap_state_change(chan, BT_CONNECT2); 4056 result = L2CAP_CR_PEND; 4057 status = L2CAP_CS_AUTHEN_PEND; 4058 } 4059 } else { 4060 l2cap_state_change(chan, BT_CONNECT2); 4061 result = L2CAP_CR_PEND; 4062 status = L2CAP_CS_NO_INFO; 4063 } 4064 4065 response: 4066 rsp.scid = cpu_to_le16(scid); 4067 rsp.dcid = cpu_to_le16(dcid); 4068 rsp.result = cpu_to_le16(result); 4069 rsp.status = cpu_to_le16(status); 4070 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp); 4071 4072 if (!pchan) 4073 return; 4074 4075 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 4076 struct l2cap_info_req info; 4077 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4078 4079 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 4080 conn->info_ident = l2cap_get_ident(conn); 4081 4082 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT); 4083 4084 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ, 4085 sizeof(info), &info); 4086 } 4087 4088 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 4089 result == L2CAP_CR_SUCCESS) { 4090 u8 buf[128]; 4091 set_bit(CONF_REQ_SENT, &chan->conf_state); 4092 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4093 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4094 chan->num_conf_req++; 4095 } 4096 4097 l2cap_chan_unlock(pchan); 4098 l2cap_chan_put(pchan); 4099 } 4100 4101 static int l2cap_connect_req(struct l2cap_conn *conn, 4102 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 4103 { 4104 if (cmd_len < sizeof(struct l2cap_conn_req)) 4105 return -EPROTO; 4106 4107 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP); 4108 return 0; 4109 } 4110 4111 static int l2cap_connect_create_rsp(struct l2cap_conn *conn, 4112 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4113 u8 *data) 4114 { 4115 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 4116 u16 scid, dcid, result, status; 4117 struct l2cap_chan *chan; 4118 u8 req[128]; 4119 int err; 4120 4121 if (cmd_len < sizeof(*rsp)) 4122 return -EPROTO; 4123 4124 scid = __le16_to_cpu(rsp->scid); 4125 dcid = __le16_to_cpu(rsp->dcid); 4126 result = __le16_to_cpu(rsp->result); 4127 status = __le16_to_cpu(rsp->status); 4128 4129 if (result == L2CAP_CR_SUCCESS && (dcid < L2CAP_CID_DYN_START || 4130 dcid > L2CAP_CID_DYN_END)) 4131 return -EPROTO; 4132 4133 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", 4134 dcid, scid, result, status); 4135 4136 if (scid) { 4137 chan = __l2cap_get_chan_by_scid(conn, scid); 4138 if (!chan) 4139 return -EBADSLT; 4140 } else { 4141 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 4142 if (!chan) 4143 return -EBADSLT; 4144 } 4145 4146 chan = l2cap_chan_hold_unless_zero(chan); 4147 if (!chan) 4148 return -EBADSLT; 4149 4150 err = 0; 4151 4152 l2cap_chan_lock(chan); 4153 4154 switch (result) { 4155 case L2CAP_CR_SUCCESS: 4156 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 4157 err = -EBADSLT; 4158 break; 4159 } 4160 4161 l2cap_state_change(chan, BT_CONFIG); 4162 chan->ident = 0; 4163 chan->dcid = dcid; 4164 clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 4165 4166 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 4167 break; 4168 4169 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4170 l2cap_build_conf_req(chan, req, sizeof(req)), req); 4171 chan->num_conf_req++; 4172 break; 4173 4174 case L2CAP_CR_PEND: 4175 set_bit(CONF_CONNECT_PEND, &chan->conf_state); 4176 break; 4177 4178 default: 4179 l2cap_chan_del(chan, ECONNREFUSED); 4180 break; 4181 } 4182 4183 l2cap_chan_unlock(chan); 4184 l2cap_chan_put(chan); 4185 4186 return err; 4187 } 4188 4189 static inline void set_default_fcs(struct l2cap_chan *chan) 4190 { 4191 /* FCS is enabled only in ERTM or streaming mode, if one or both 4192 * sides request it. 4193 */ 4194 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 4195 chan->fcs = L2CAP_FCS_NONE; 4196 else if (!test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) 4197 chan->fcs = L2CAP_FCS_CRC16; 4198 } 4199 4200 static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data, 4201 u8 ident, u16 flags) 4202 { 4203 struct l2cap_conn *conn = chan->conn; 4204 4205 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident, 4206 flags); 4207 4208 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state); 4209 set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 4210 4211 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP, 4212 l2cap_build_conf_rsp(chan, data, 4213 L2CAP_CONF_SUCCESS, flags), data); 4214 } 4215 4216 static void cmd_reject_invalid_cid(struct l2cap_conn *conn, u8 ident, 4217 u16 scid, u16 dcid) 4218 { 4219 struct l2cap_cmd_rej_cid rej; 4220 4221 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 4222 rej.scid = __cpu_to_le16(scid); 4223 rej.dcid = __cpu_to_le16(dcid); 4224 4225 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 4226 } 4227 4228 static inline int l2cap_config_req(struct l2cap_conn *conn, 4229 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4230 u8 *data) 4231 { 4232 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 4233 u16 dcid, flags; 4234 u8 rsp[64]; 4235 struct l2cap_chan *chan; 4236 int len, err = 0; 4237 4238 if (cmd_len < sizeof(*req)) 4239 return -EPROTO; 4240 4241 dcid = __le16_to_cpu(req->dcid); 4242 flags = __le16_to_cpu(req->flags); 4243 4244 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 4245 4246 chan = l2cap_get_chan_by_scid(conn, dcid); 4247 if (!chan) { 4248 cmd_reject_invalid_cid(conn, cmd->ident, dcid, 0); 4249 return 0; 4250 } 4251 4252 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 && 4253 chan->state != BT_CONNECTED) { 4254 cmd_reject_invalid_cid(conn, cmd->ident, chan->scid, 4255 chan->dcid); 4256 goto unlock; 4257 } 4258 4259 /* Reject if config buffer is too small. */ 4260 len = cmd_len - sizeof(*req); 4261 if (chan->conf_len + len > sizeof(chan->conf_req)) { 4262 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4263 l2cap_build_conf_rsp(chan, rsp, 4264 L2CAP_CONF_REJECT, flags), rsp); 4265 goto unlock; 4266 } 4267 4268 /* Store config. */ 4269 memcpy(chan->conf_req + chan->conf_len, req->data, len); 4270 chan->conf_len += len; 4271 4272 if (flags & L2CAP_CONF_FLAG_CONTINUATION) { 4273 /* Incomplete config. Send empty response. */ 4274 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 4275 l2cap_build_conf_rsp(chan, rsp, 4276 L2CAP_CONF_SUCCESS, flags), rsp); 4277 goto unlock; 4278 } 4279 4280 /* Complete config. */ 4281 len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); 4282 if (len < 0) { 4283 l2cap_send_disconn_req(chan, ECONNRESET); 4284 goto unlock; 4285 } 4286 4287 chan->ident = cmd->ident; 4288 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 4289 if (chan->num_conf_rsp < L2CAP_CONF_MAX_CONF_RSP) 4290 chan->num_conf_rsp++; 4291 4292 /* Reset config buffer. */ 4293 chan->conf_len = 0; 4294 4295 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 4296 goto unlock; 4297 4298 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 4299 set_default_fcs(chan); 4300 4301 if (chan->mode == L2CAP_MODE_ERTM || 4302 chan->mode == L2CAP_MODE_STREAMING) 4303 err = l2cap_ertm_init(chan); 4304 4305 if (err < 0) 4306 l2cap_send_disconn_req(chan, -err); 4307 else 4308 l2cap_chan_ready(chan); 4309 4310 goto unlock; 4311 } 4312 4313 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 4314 u8 buf[64]; 4315 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 4316 l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); 4317 chan->num_conf_req++; 4318 } 4319 4320 /* Got Conf Rsp PENDING from remote side and assume we sent 4321 Conf Rsp PENDING in the code above */ 4322 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) && 4323 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4324 4325 /* check compatibility */ 4326 4327 /* Send rsp for BR/EDR channel */ 4328 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags); 4329 } 4330 4331 unlock: 4332 l2cap_chan_unlock(chan); 4333 l2cap_chan_put(chan); 4334 return err; 4335 } 4336 4337 static inline int l2cap_config_rsp(struct l2cap_conn *conn, 4338 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4339 u8 *data) 4340 { 4341 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 4342 u16 scid, flags, result; 4343 struct l2cap_chan *chan; 4344 int len = cmd_len - sizeof(*rsp); 4345 int err = 0; 4346 4347 if (cmd_len < sizeof(*rsp)) 4348 return -EPROTO; 4349 4350 scid = __le16_to_cpu(rsp->scid); 4351 flags = __le16_to_cpu(rsp->flags); 4352 result = __le16_to_cpu(rsp->result); 4353 4354 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags, 4355 result, len); 4356 4357 chan = l2cap_get_chan_by_scid(conn, scid); 4358 if (!chan) 4359 return 0; 4360 4361 switch (result) { 4362 case L2CAP_CONF_SUCCESS: 4363 l2cap_conf_rfc_get(chan, rsp->data, len); 4364 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4365 break; 4366 4367 case L2CAP_CONF_PENDING: 4368 set_bit(CONF_REM_CONF_PEND, &chan->conf_state); 4369 4370 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) { 4371 char buf[64]; 4372 4373 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4374 buf, sizeof(buf), &result); 4375 if (len < 0) { 4376 l2cap_send_disconn_req(chan, ECONNRESET); 4377 goto done; 4378 } 4379 4380 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident, 0); 4381 } 4382 goto done; 4383 4384 case L2CAP_CONF_UNKNOWN: 4385 case L2CAP_CONF_UNACCEPT: 4386 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 4387 char req[64]; 4388 4389 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 4390 l2cap_send_disconn_req(chan, ECONNRESET); 4391 goto done; 4392 } 4393 4394 /* throw out any old stored conf requests */ 4395 result = L2CAP_CONF_SUCCESS; 4396 len = l2cap_parse_conf_rsp(chan, rsp->data, len, 4397 req, sizeof(req), &result); 4398 if (len < 0) { 4399 l2cap_send_disconn_req(chan, ECONNRESET); 4400 goto done; 4401 } 4402 4403 l2cap_send_cmd(conn, l2cap_get_ident(conn), 4404 L2CAP_CONF_REQ, len, req); 4405 chan->num_conf_req++; 4406 if (result != L2CAP_CONF_SUCCESS) 4407 goto done; 4408 break; 4409 } 4410 fallthrough; 4411 4412 default: 4413 l2cap_chan_set_err(chan, ECONNRESET); 4414 4415 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT); 4416 l2cap_send_disconn_req(chan, ECONNRESET); 4417 goto done; 4418 } 4419 4420 if (flags & L2CAP_CONF_FLAG_CONTINUATION) 4421 goto done; 4422 4423 set_bit(CONF_INPUT_DONE, &chan->conf_state); 4424 4425 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 4426 set_default_fcs(chan); 4427 4428 if (chan->mode == L2CAP_MODE_ERTM || 4429 chan->mode == L2CAP_MODE_STREAMING) 4430 err = l2cap_ertm_init(chan); 4431 4432 if (err < 0) 4433 l2cap_send_disconn_req(chan, -err); 4434 else 4435 l2cap_chan_ready(chan); 4436 } 4437 4438 done: 4439 l2cap_chan_unlock(chan); 4440 l2cap_chan_put(chan); 4441 return err; 4442 } 4443 4444 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, 4445 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4446 u8 *data) 4447 { 4448 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 4449 struct l2cap_disconn_rsp rsp; 4450 u16 dcid, scid; 4451 struct l2cap_chan *chan; 4452 4453 if (cmd_len != sizeof(*req)) 4454 return -EPROTO; 4455 4456 scid = __le16_to_cpu(req->scid); 4457 dcid = __le16_to_cpu(req->dcid); 4458 4459 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 4460 4461 chan = l2cap_get_chan_by_scid(conn, dcid); 4462 if (!chan) { 4463 cmd_reject_invalid_cid(conn, cmd->ident, dcid, scid); 4464 return 0; 4465 } 4466 4467 rsp.dcid = cpu_to_le16(chan->scid); 4468 rsp.scid = cpu_to_le16(chan->dcid); 4469 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 4470 4471 chan->ops->set_shutdown(chan); 4472 4473 l2cap_chan_del(chan, ECONNRESET); 4474 4475 chan->ops->close(chan); 4476 4477 l2cap_chan_unlock(chan); 4478 l2cap_chan_put(chan); 4479 4480 return 0; 4481 } 4482 4483 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, 4484 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4485 u8 *data) 4486 { 4487 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 4488 u16 dcid, scid; 4489 struct l2cap_chan *chan; 4490 4491 if (cmd_len != sizeof(*rsp)) 4492 return -EPROTO; 4493 4494 scid = __le16_to_cpu(rsp->scid); 4495 dcid = __le16_to_cpu(rsp->dcid); 4496 4497 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 4498 4499 chan = l2cap_get_chan_by_scid(conn, scid); 4500 if (!chan) { 4501 return 0; 4502 } 4503 4504 if (chan->state != BT_DISCONN) { 4505 l2cap_chan_unlock(chan); 4506 l2cap_chan_put(chan); 4507 return 0; 4508 } 4509 4510 l2cap_chan_del(chan, 0); 4511 4512 chan->ops->close(chan); 4513 4514 l2cap_chan_unlock(chan); 4515 l2cap_chan_put(chan); 4516 4517 return 0; 4518 } 4519 4520 static inline int l2cap_information_req(struct l2cap_conn *conn, 4521 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4522 u8 *data) 4523 { 4524 struct l2cap_info_req *req = (struct l2cap_info_req *) data; 4525 u16 type; 4526 4527 if (cmd_len != sizeof(*req)) 4528 return -EPROTO; 4529 4530 type = __le16_to_cpu(req->type); 4531 4532 BT_DBG("type 0x%4.4x", type); 4533 4534 if (type == L2CAP_IT_FEAT_MASK) { 4535 u8 buf[8]; 4536 u32 feat_mask = l2cap_feat_mask; 4537 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4538 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 4539 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4540 if (!disable_ertm) 4541 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 4542 | L2CAP_FEAT_FCS; 4543 4544 put_unaligned_le32(feat_mask, rsp->data); 4545 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4546 buf); 4547 } else if (type == L2CAP_IT_FIXED_CHAN) { 4548 u8 buf[12]; 4549 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 4550 4551 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4552 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 4553 rsp->data[0] = conn->local_fixed_chan; 4554 memset(rsp->data + 1, 0, 7); 4555 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf), 4556 buf); 4557 } else { 4558 struct l2cap_info_rsp rsp; 4559 rsp.type = cpu_to_le16(type); 4560 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 4561 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp), 4562 &rsp); 4563 } 4564 4565 return 0; 4566 } 4567 4568 static inline int l2cap_information_rsp(struct l2cap_conn *conn, 4569 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4570 u8 *data) 4571 { 4572 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 4573 u16 type, result; 4574 4575 if (cmd_len < sizeof(*rsp)) 4576 return -EPROTO; 4577 4578 type = __le16_to_cpu(rsp->type); 4579 result = __le16_to_cpu(rsp->result); 4580 4581 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 4582 4583 /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 4584 if (cmd->ident != conn->info_ident || 4585 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 4586 return 0; 4587 4588 cancel_delayed_work(&conn->info_timer); 4589 4590 if (result != L2CAP_IR_SUCCESS) { 4591 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4592 conn->info_ident = 0; 4593 4594 l2cap_conn_start(conn); 4595 4596 return 0; 4597 } 4598 4599 switch (type) { 4600 case L2CAP_IT_FEAT_MASK: 4601 conn->feat_mask = get_unaligned_le32(rsp->data); 4602 4603 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 4604 struct l2cap_info_req req; 4605 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 4606 4607 conn->info_ident = l2cap_get_ident(conn); 4608 4609 l2cap_send_cmd(conn, conn->info_ident, 4610 L2CAP_INFO_REQ, sizeof(req), &req); 4611 } else { 4612 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4613 conn->info_ident = 0; 4614 4615 l2cap_conn_start(conn); 4616 } 4617 break; 4618 4619 case L2CAP_IT_FIXED_CHAN: 4620 conn->remote_fixed_chan = rsp->data[0]; 4621 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 4622 conn->info_ident = 0; 4623 4624 l2cap_conn_start(conn); 4625 break; 4626 } 4627 4628 return 0; 4629 } 4630 4631 static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 4632 struct l2cap_cmd_hdr *cmd, 4633 u16 cmd_len, u8 *data) 4634 { 4635 struct hci_conn *hcon = conn->hcon; 4636 struct l2cap_conn_param_update_req *req; 4637 struct l2cap_conn_param_update_rsp rsp; 4638 u16 min, max, latency, to_multiplier; 4639 int err; 4640 4641 if (hcon->role != HCI_ROLE_MASTER) 4642 return -EINVAL; 4643 4644 if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 4645 return -EPROTO; 4646 4647 req = (struct l2cap_conn_param_update_req *) data; 4648 min = __le16_to_cpu(req->min); 4649 max = __le16_to_cpu(req->max); 4650 latency = __le16_to_cpu(req->latency); 4651 to_multiplier = __le16_to_cpu(req->to_multiplier); 4652 4653 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 4654 min, max, latency, to_multiplier); 4655 4656 memset(&rsp, 0, sizeof(rsp)); 4657 4658 err = hci_check_conn_params(min, max, latency, to_multiplier); 4659 if (err) 4660 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 4661 else 4662 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 4663 4664 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 4665 sizeof(rsp), &rsp); 4666 4667 if (!err) { 4668 u8 store_hint; 4669 4670 store_hint = hci_le_conn_update(hcon, min, max, latency, 4671 to_multiplier); 4672 mgmt_new_conn_param(hcon->hdev, &hcon->dst, hcon->dst_type, 4673 store_hint, min, max, latency, 4674 to_multiplier); 4675 4676 } 4677 4678 return 0; 4679 } 4680 4681 static int l2cap_le_connect_rsp(struct l2cap_conn *conn, 4682 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4683 u8 *data) 4684 { 4685 struct l2cap_le_conn_rsp *rsp = (struct l2cap_le_conn_rsp *) data; 4686 struct hci_conn *hcon = conn->hcon; 4687 u16 dcid, mtu, mps, credits, result; 4688 struct l2cap_chan *chan; 4689 int err, sec_level; 4690 4691 if (cmd_len < sizeof(*rsp)) 4692 return -EPROTO; 4693 4694 dcid = __le16_to_cpu(rsp->dcid); 4695 mtu = __le16_to_cpu(rsp->mtu); 4696 mps = __le16_to_cpu(rsp->mps); 4697 credits = __le16_to_cpu(rsp->credits); 4698 result = __le16_to_cpu(rsp->result); 4699 4700 if (result == L2CAP_CR_LE_SUCCESS && (mtu < 23 || mps < 23 || 4701 dcid < L2CAP_CID_DYN_START || 4702 dcid > L2CAP_CID_LE_DYN_END)) 4703 return -EPROTO; 4704 4705 BT_DBG("dcid 0x%4.4x mtu %u mps %u credits %u result 0x%2.2x", 4706 dcid, mtu, mps, credits, result); 4707 4708 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 4709 if (!chan) 4710 return -EBADSLT; 4711 4712 err = 0; 4713 4714 l2cap_chan_lock(chan); 4715 4716 switch (result) { 4717 case L2CAP_CR_LE_SUCCESS: 4718 if (__l2cap_get_chan_by_dcid(conn, dcid)) { 4719 err = -EBADSLT; 4720 break; 4721 } 4722 4723 chan->ident = 0; 4724 chan->dcid = dcid; 4725 chan->omtu = mtu; 4726 chan->remote_mps = mps; 4727 chan->tx_credits = credits; 4728 l2cap_chan_ready(chan); 4729 break; 4730 4731 case L2CAP_CR_LE_AUTHENTICATION: 4732 case L2CAP_CR_LE_ENCRYPTION: 4733 /* If we already have MITM protection we can't do 4734 * anything. 4735 */ 4736 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 4737 l2cap_chan_del(chan, ECONNREFUSED); 4738 break; 4739 } 4740 4741 sec_level = hcon->sec_level + 1; 4742 if (chan->sec_level < sec_level) 4743 chan->sec_level = sec_level; 4744 4745 /* We'll need to send a new Connect Request */ 4746 clear_bit(FLAG_LE_CONN_REQ_SENT, &chan->flags); 4747 4748 smp_conn_security(hcon, chan->sec_level); 4749 break; 4750 4751 default: 4752 l2cap_chan_del(chan, ECONNREFUSED); 4753 break; 4754 } 4755 4756 l2cap_chan_unlock(chan); 4757 4758 return err; 4759 } 4760 4761 static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 4762 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4763 u8 *data) 4764 { 4765 int err = 0; 4766 4767 switch (cmd->code) { 4768 case L2CAP_COMMAND_REJ: 4769 l2cap_command_rej(conn, cmd, cmd_len, data); 4770 break; 4771 4772 case L2CAP_CONN_REQ: 4773 err = l2cap_connect_req(conn, cmd, cmd_len, data); 4774 break; 4775 4776 case L2CAP_CONN_RSP: 4777 l2cap_connect_create_rsp(conn, cmd, cmd_len, data); 4778 break; 4779 4780 case L2CAP_CONF_REQ: 4781 err = l2cap_config_req(conn, cmd, cmd_len, data); 4782 break; 4783 4784 case L2CAP_CONF_RSP: 4785 l2cap_config_rsp(conn, cmd, cmd_len, data); 4786 break; 4787 4788 case L2CAP_DISCONN_REQ: 4789 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 4790 break; 4791 4792 case L2CAP_DISCONN_RSP: 4793 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 4794 break; 4795 4796 case L2CAP_ECHO_REQ: 4797 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 4798 break; 4799 4800 case L2CAP_ECHO_RSP: 4801 break; 4802 4803 case L2CAP_INFO_REQ: 4804 err = l2cap_information_req(conn, cmd, cmd_len, data); 4805 break; 4806 4807 case L2CAP_INFO_RSP: 4808 l2cap_information_rsp(conn, cmd, cmd_len, data); 4809 break; 4810 4811 default: 4812 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 4813 err = -EINVAL; 4814 break; 4815 } 4816 4817 return err; 4818 } 4819 4820 static int l2cap_le_connect_req(struct l2cap_conn *conn, 4821 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4822 u8 *data) 4823 { 4824 struct l2cap_le_conn_req *req = (struct l2cap_le_conn_req *) data; 4825 struct l2cap_le_conn_rsp rsp; 4826 struct l2cap_chan *chan, *pchan; 4827 u16 dcid, scid, credits, mtu, mps; 4828 __le16 psm; 4829 u8 result; 4830 4831 if (cmd_len != sizeof(*req)) 4832 return -EPROTO; 4833 4834 scid = __le16_to_cpu(req->scid); 4835 mtu = __le16_to_cpu(req->mtu); 4836 mps = __le16_to_cpu(req->mps); 4837 psm = req->psm; 4838 dcid = 0; 4839 credits = 0; 4840 4841 if (mtu < 23 || mps < 23) 4842 return -EPROTO; 4843 4844 BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm), 4845 scid, mtu, mps); 4846 4847 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 4848 * page 1059: 4849 * 4850 * Valid range: 0x0001-0x00ff 4851 * 4852 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 4853 */ 4854 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 4855 result = L2CAP_CR_LE_BAD_PSM; 4856 chan = NULL; 4857 goto response; 4858 } 4859 4860 /* Check if we have socket listening on psm */ 4861 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 4862 &conn->hcon->dst, LE_LINK); 4863 if (!pchan) { 4864 result = L2CAP_CR_LE_BAD_PSM; 4865 chan = NULL; 4866 goto response; 4867 } 4868 4869 l2cap_chan_lock(pchan); 4870 4871 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 4872 SMP_ALLOW_STK)) { 4873 result = pchan->sec_level == BT_SECURITY_MEDIUM ? 4874 L2CAP_CR_LE_ENCRYPTION : L2CAP_CR_LE_AUTHENTICATION; 4875 chan = NULL; 4876 goto response_unlock; 4877 } 4878 4879 /* Check for valid dynamic CID range */ 4880 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 4881 result = L2CAP_CR_LE_INVALID_SCID; 4882 chan = NULL; 4883 goto response_unlock; 4884 } 4885 4886 /* Check if we already have channel with that dcid */ 4887 if (__l2cap_get_chan_by_dcid(conn, scid)) { 4888 result = L2CAP_CR_LE_SCID_IN_USE; 4889 chan = NULL; 4890 goto response_unlock; 4891 } 4892 4893 chan = pchan->ops->new_connection(pchan); 4894 if (!chan) { 4895 result = L2CAP_CR_LE_NO_MEM; 4896 goto response_unlock; 4897 } 4898 4899 bacpy(&chan->src, &conn->hcon->src); 4900 bacpy(&chan->dst, &conn->hcon->dst); 4901 chan->src_type = bdaddr_src_type(conn->hcon); 4902 chan->dst_type = bdaddr_dst_type(conn->hcon); 4903 chan->psm = psm; 4904 chan->dcid = scid; 4905 chan->omtu = mtu; 4906 chan->remote_mps = mps; 4907 4908 __l2cap_chan_add(conn, chan); 4909 4910 l2cap_le_flowctl_init(chan, __le16_to_cpu(req->credits)); 4911 4912 dcid = chan->scid; 4913 credits = chan->rx_credits; 4914 4915 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 4916 4917 chan->ident = cmd->ident; 4918 4919 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 4920 l2cap_state_change(chan, BT_CONNECT2); 4921 /* The following result value is actually not defined 4922 * for LE CoC but we use it to let the function know 4923 * that it should bail out after doing its cleanup 4924 * instead of sending a response. 4925 */ 4926 result = L2CAP_CR_PEND; 4927 chan->ops->defer(chan); 4928 } else { 4929 l2cap_chan_ready(chan); 4930 result = L2CAP_CR_LE_SUCCESS; 4931 } 4932 4933 response_unlock: 4934 l2cap_chan_unlock(pchan); 4935 l2cap_chan_put(pchan); 4936 4937 if (result == L2CAP_CR_PEND) 4938 return 0; 4939 4940 response: 4941 if (chan) { 4942 rsp.mtu = cpu_to_le16(chan->imtu); 4943 rsp.mps = cpu_to_le16(chan->mps); 4944 } else { 4945 rsp.mtu = 0; 4946 rsp.mps = 0; 4947 } 4948 4949 rsp.dcid = cpu_to_le16(dcid); 4950 rsp.credits = cpu_to_le16(credits); 4951 rsp.result = cpu_to_le16(result); 4952 4953 l2cap_send_cmd(conn, cmd->ident, L2CAP_LE_CONN_RSP, sizeof(rsp), &rsp); 4954 4955 return 0; 4956 } 4957 4958 static inline int l2cap_le_credits(struct l2cap_conn *conn, 4959 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 4960 u8 *data) 4961 { 4962 struct l2cap_le_credits *pkt; 4963 struct l2cap_chan *chan; 4964 u16 cid, credits, max_credits; 4965 4966 if (cmd_len != sizeof(*pkt)) 4967 return -EPROTO; 4968 4969 pkt = (struct l2cap_le_credits *) data; 4970 cid = __le16_to_cpu(pkt->cid); 4971 credits = __le16_to_cpu(pkt->credits); 4972 4973 BT_DBG("cid 0x%4.4x credits 0x%4.4x", cid, credits); 4974 4975 chan = l2cap_get_chan_by_dcid(conn, cid); 4976 if (!chan) 4977 return -EBADSLT; 4978 4979 max_credits = LE_FLOWCTL_MAX_CREDITS - chan->tx_credits; 4980 if (credits > max_credits) { 4981 BT_ERR("LE credits overflow"); 4982 l2cap_send_disconn_req(chan, ECONNRESET); 4983 4984 /* Return 0 so that we don't trigger an unnecessary 4985 * command reject packet. 4986 */ 4987 goto unlock; 4988 } 4989 4990 chan->tx_credits += credits; 4991 4992 /* Resume sending */ 4993 l2cap_le_flowctl_send(chan); 4994 4995 if (chan->tx_credits) 4996 chan->ops->resume(chan); 4997 4998 unlock: 4999 l2cap_chan_unlock(chan); 5000 l2cap_chan_put(chan); 5001 5002 return 0; 5003 } 5004 5005 static inline int l2cap_ecred_conn_req(struct l2cap_conn *conn, 5006 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5007 u8 *data) 5008 { 5009 struct l2cap_ecred_conn_req *req = (void *) data; 5010 DEFINE_RAW_FLEX(struct l2cap_ecred_conn_rsp, pdu, dcid, L2CAP_ECRED_MAX_CID); 5011 struct l2cap_chan *chan, *pchan; 5012 u16 mtu, mps; 5013 __le16 psm; 5014 u8 result, len = 0; 5015 int i, num_scid; 5016 bool defer = false; 5017 5018 if (!enable_ecred) 5019 return -EINVAL; 5020 5021 if (cmd_len < sizeof(*req) || (cmd_len - sizeof(*req)) % sizeof(u16)) { 5022 result = L2CAP_CR_LE_INVALID_PARAMS; 5023 goto response; 5024 } 5025 5026 cmd_len -= sizeof(*req); 5027 num_scid = cmd_len / sizeof(u16); 5028 5029 if (num_scid > L2CAP_ECRED_MAX_CID) { 5030 result = L2CAP_CR_LE_INVALID_PARAMS; 5031 goto response; 5032 } 5033 5034 mtu = __le16_to_cpu(req->mtu); 5035 mps = __le16_to_cpu(req->mps); 5036 5037 if (mtu < L2CAP_ECRED_MIN_MTU || mps < L2CAP_ECRED_MIN_MPS) { 5038 result = L2CAP_CR_LE_UNACCEPT_PARAMS; 5039 goto response; 5040 } 5041 5042 psm = req->psm; 5043 5044 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A 5045 * page 1059: 5046 * 5047 * Valid range: 0x0001-0x00ff 5048 * 5049 * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges 5050 */ 5051 if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) { 5052 result = L2CAP_CR_LE_BAD_PSM; 5053 goto response; 5054 } 5055 5056 BT_DBG("psm 0x%2.2x mtu %u mps %u", __le16_to_cpu(psm), mtu, mps); 5057 5058 memset(pdu, 0, sizeof(*pdu)); 5059 5060 /* Check if we have socket listening on psm */ 5061 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src, 5062 &conn->hcon->dst, LE_LINK); 5063 if (!pchan) { 5064 result = L2CAP_CR_LE_BAD_PSM; 5065 goto response; 5066 } 5067 5068 l2cap_chan_lock(pchan); 5069 5070 if (!smp_sufficient_security(conn->hcon, pchan->sec_level, 5071 SMP_ALLOW_STK)) { 5072 result = L2CAP_CR_LE_AUTHENTICATION; 5073 goto unlock; 5074 } 5075 5076 result = L2CAP_CR_LE_SUCCESS; 5077 5078 for (i = 0; i < num_scid; i++) { 5079 u16 scid = __le16_to_cpu(req->scid[i]); 5080 5081 BT_DBG("scid[%d] 0x%4.4x", i, scid); 5082 5083 pdu->dcid[i] = 0x0000; 5084 len += sizeof(*pdu->dcid); 5085 5086 /* Check for valid dynamic CID range */ 5087 if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { 5088 result = L2CAP_CR_LE_INVALID_SCID; 5089 continue; 5090 } 5091 5092 /* Check if we already have channel with that dcid */ 5093 if (__l2cap_get_chan_by_dcid(conn, scid)) { 5094 result = L2CAP_CR_LE_SCID_IN_USE; 5095 continue; 5096 } 5097 5098 chan = pchan->ops->new_connection(pchan); 5099 if (!chan) { 5100 result = L2CAP_CR_LE_NO_MEM; 5101 continue; 5102 } 5103 5104 bacpy(&chan->src, &conn->hcon->src); 5105 bacpy(&chan->dst, &conn->hcon->dst); 5106 chan->src_type = bdaddr_src_type(conn->hcon); 5107 chan->dst_type = bdaddr_dst_type(conn->hcon); 5108 chan->psm = psm; 5109 chan->dcid = scid; 5110 chan->omtu = mtu; 5111 chan->remote_mps = mps; 5112 5113 __l2cap_chan_add(conn, chan); 5114 5115 l2cap_ecred_init(chan, __le16_to_cpu(req->credits)); 5116 5117 /* Init response */ 5118 if (!pdu->credits) { 5119 pdu->mtu = cpu_to_le16(chan->imtu); 5120 pdu->mps = cpu_to_le16(chan->mps); 5121 pdu->credits = cpu_to_le16(chan->rx_credits); 5122 } 5123 5124 pdu->dcid[i] = cpu_to_le16(chan->scid); 5125 5126 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 5127 5128 chan->ident = cmd->ident; 5129 chan->mode = L2CAP_MODE_EXT_FLOWCTL; 5130 5131 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 5132 l2cap_state_change(chan, BT_CONNECT2); 5133 defer = true; 5134 chan->ops->defer(chan); 5135 } else { 5136 l2cap_chan_ready(chan); 5137 } 5138 } 5139 5140 unlock: 5141 l2cap_chan_unlock(pchan); 5142 l2cap_chan_put(pchan); 5143 5144 response: 5145 pdu->result = cpu_to_le16(result); 5146 5147 if (defer) 5148 return 0; 5149 5150 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_CONN_RSP, 5151 sizeof(*pdu) + len, pdu); 5152 5153 return 0; 5154 } 5155 5156 static inline int l2cap_ecred_conn_rsp(struct l2cap_conn *conn, 5157 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5158 u8 *data) 5159 { 5160 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 5161 struct hci_conn *hcon = conn->hcon; 5162 u16 mtu, mps, credits, result; 5163 struct l2cap_chan *chan, *tmp; 5164 int err = 0, sec_level; 5165 int i = 0; 5166 5167 if (cmd_len < sizeof(*rsp)) 5168 return -EPROTO; 5169 5170 mtu = __le16_to_cpu(rsp->mtu); 5171 mps = __le16_to_cpu(rsp->mps); 5172 credits = __le16_to_cpu(rsp->credits); 5173 result = __le16_to_cpu(rsp->result); 5174 5175 BT_DBG("mtu %u mps %u credits %u result 0x%4.4x", mtu, mps, credits, 5176 result); 5177 5178 cmd_len -= sizeof(*rsp); 5179 5180 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 5181 u16 dcid; 5182 5183 if (chan->ident != cmd->ident || 5184 chan->mode != L2CAP_MODE_EXT_FLOWCTL || 5185 chan->state == BT_CONNECTED) 5186 continue; 5187 5188 l2cap_chan_lock(chan); 5189 5190 /* Check that there is a dcid for each pending channel */ 5191 if (cmd_len < sizeof(dcid)) { 5192 l2cap_chan_del(chan, ECONNREFUSED); 5193 l2cap_chan_unlock(chan); 5194 continue; 5195 } 5196 5197 dcid = __le16_to_cpu(rsp->dcid[i++]); 5198 cmd_len -= sizeof(u16); 5199 5200 BT_DBG("dcid[%d] 0x%4.4x", i, dcid); 5201 5202 /* Check if dcid is already in use */ 5203 if (dcid && __l2cap_get_chan_by_dcid(conn, dcid)) { 5204 /* If a device receives a 5205 * L2CAP_CREDIT_BASED_CONNECTION_RSP packet with an 5206 * already-assigned Destination CID, then both the 5207 * original channel and the new channel shall be 5208 * immediately discarded and not used. 5209 */ 5210 l2cap_chan_del(chan, ECONNREFUSED); 5211 l2cap_chan_unlock(chan); 5212 chan = __l2cap_get_chan_by_dcid(conn, dcid); 5213 l2cap_chan_lock(chan); 5214 l2cap_chan_del(chan, ECONNRESET); 5215 l2cap_chan_unlock(chan); 5216 continue; 5217 } 5218 5219 switch (result) { 5220 case L2CAP_CR_LE_AUTHENTICATION: 5221 case L2CAP_CR_LE_ENCRYPTION: 5222 /* If we already have MITM protection we can't do 5223 * anything. 5224 */ 5225 if (hcon->sec_level > BT_SECURITY_MEDIUM) { 5226 l2cap_chan_del(chan, ECONNREFUSED); 5227 break; 5228 } 5229 5230 sec_level = hcon->sec_level + 1; 5231 if (chan->sec_level < sec_level) 5232 chan->sec_level = sec_level; 5233 5234 /* We'll need to send a new Connect Request */ 5235 clear_bit(FLAG_ECRED_CONN_REQ_SENT, &chan->flags); 5236 5237 smp_conn_security(hcon, chan->sec_level); 5238 break; 5239 5240 case L2CAP_CR_LE_BAD_PSM: 5241 l2cap_chan_del(chan, ECONNREFUSED); 5242 break; 5243 5244 default: 5245 /* If dcid was not set it means channels was refused */ 5246 if (!dcid) { 5247 l2cap_chan_del(chan, ECONNREFUSED); 5248 break; 5249 } 5250 5251 chan->ident = 0; 5252 chan->dcid = dcid; 5253 chan->omtu = mtu; 5254 chan->remote_mps = mps; 5255 chan->tx_credits = credits; 5256 l2cap_chan_ready(chan); 5257 break; 5258 } 5259 5260 l2cap_chan_unlock(chan); 5261 } 5262 5263 return err; 5264 } 5265 5266 static inline int l2cap_ecred_reconf_req(struct l2cap_conn *conn, 5267 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5268 u8 *data) 5269 { 5270 struct l2cap_ecred_reconf_req *req = (void *) data; 5271 struct l2cap_ecred_reconf_rsp rsp; 5272 u16 mtu, mps, result; 5273 struct l2cap_chan *chan; 5274 int i, num_scid; 5275 5276 if (!enable_ecred) 5277 return -EINVAL; 5278 5279 if (cmd_len < sizeof(*req) || cmd_len - sizeof(*req) % sizeof(u16)) { 5280 result = L2CAP_CR_LE_INVALID_PARAMS; 5281 goto respond; 5282 } 5283 5284 mtu = __le16_to_cpu(req->mtu); 5285 mps = __le16_to_cpu(req->mps); 5286 5287 BT_DBG("mtu %u mps %u", mtu, mps); 5288 5289 if (mtu < L2CAP_ECRED_MIN_MTU) { 5290 result = L2CAP_RECONF_INVALID_MTU; 5291 goto respond; 5292 } 5293 5294 if (mps < L2CAP_ECRED_MIN_MPS) { 5295 result = L2CAP_RECONF_INVALID_MPS; 5296 goto respond; 5297 } 5298 5299 cmd_len -= sizeof(*req); 5300 num_scid = cmd_len / sizeof(u16); 5301 result = L2CAP_RECONF_SUCCESS; 5302 5303 for (i = 0; i < num_scid; i++) { 5304 u16 scid; 5305 5306 scid = __le16_to_cpu(req->scid[i]); 5307 if (!scid) 5308 return -EPROTO; 5309 5310 chan = __l2cap_get_chan_by_dcid(conn, scid); 5311 if (!chan) 5312 continue; 5313 5314 /* If the MTU value is decreased for any of the included 5315 * channels, then the receiver shall disconnect all 5316 * included channels. 5317 */ 5318 if (chan->omtu > mtu) { 5319 BT_ERR("chan %p decreased MTU %u -> %u", chan, 5320 chan->omtu, mtu); 5321 result = L2CAP_RECONF_INVALID_MTU; 5322 } 5323 5324 chan->omtu = mtu; 5325 chan->remote_mps = mps; 5326 } 5327 5328 respond: 5329 rsp.result = cpu_to_le16(result); 5330 5331 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECRED_RECONF_RSP, sizeof(rsp), 5332 &rsp); 5333 5334 return 0; 5335 } 5336 5337 static inline int l2cap_ecred_reconf_rsp(struct l2cap_conn *conn, 5338 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5339 u8 *data) 5340 { 5341 struct l2cap_chan *chan, *tmp; 5342 struct l2cap_ecred_conn_rsp *rsp = (void *) data; 5343 u16 result; 5344 5345 if (cmd_len < sizeof(*rsp)) 5346 return -EPROTO; 5347 5348 result = __le16_to_cpu(rsp->result); 5349 5350 BT_DBG("result 0x%4.4x", rsp->result); 5351 5352 if (!result) 5353 return 0; 5354 5355 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 5356 if (chan->ident != cmd->ident) 5357 continue; 5358 5359 l2cap_chan_del(chan, ECONNRESET); 5360 } 5361 5362 return 0; 5363 } 5364 5365 static inline int l2cap_le_command_rej(struct l2cap_conn *conn, 5366 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5367 u8 *data) 5368 { 5369 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 5370 struct l2cap_chan *chan; 5371 5372 if (cmd_len < sizeof(*rej)) 5373 return -EPROTO; 5374 5375 chan = __l2cap_get_chan_by_ident(conn, cmd->ident); 5376 if (!chan) 5377 goto done; 5378 5379 chan = l2cap_chan_hold_unless_zero(chan); 5380 if (!chan) 5381 goto done; 5382 5383 l2cap_chan_lock(chan); 5384 l2cap_chan_del(chan, ECONNREFUSED); 5385 l2cap_chan_unlock(chan); 5386 l2cap_chan_put(chan); 5387 5388 done: 5389 return 0; 5390 } 5391 5392 static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 5393 struct l2cap_cmd_hdr *cmd, u16 cmd_len, 5394 u8 *data) 5395 { 5396 int err = 0; 5397 5398 switch (cmd->code) { 5399 case L2CAP_COMMAND_REJ: 5400 l2cap_le_command_rej(conn, cmd, cmd_len, data); 5401 break; 5402 5403 case L2CAP_CONN_PARAM_UPDATE_REQ: 5404 err = l2cap_conn_param_update_req(conn, cmd, cmd_len, data); 5405 break; 5406 5407 case L2CAP_CONN_PARAM_UPDATE_RSP: 5408 break; 5409 5410 case L2CAP_LE_CONN_RSP: 5411 l2cap_le_connect_rsp(conn, cmd, cmd_len, data); 5412 break; 5413 5414 case L2CAP_LE_CONN_REQ: 5415 err = l2cap_le_connect_req(conn, cmd, cmd_len, data); 5416 break; 5417 5418 case L2CAP_LE_CREDITS: 5419 err = l2cap_le_credits(conn, cmd, cmd_len, data); 5420 break; 5421 5422 case L2CAP_ECRED_CONN_REQ: 5423 err = l2cap_ecred_conn_req(conn, cmd, cmd_len, data); 5424 break; 5425 5426 case L2CAP_ECRED_CONN_RSP: 5427 err = l2cap_ecred_conn_rsp(conn, cmd, cmd_len, data); 5428 break; 5429 5430 case L2CAP_ECRED_RECONF_REQ: 5431 err = l2cap_ecred_reconf_req(conn, cmd, cmd_len, data); 5432 break; 5433 5434 case L2CAP_ECRED_RECONF_RSP: 5435 err = l2cap_ecred_reconf_rsp(conn, cmd, cmd_len, data); 5436 break; 5437 5438 case L2CAP_DISCONN_REQ: 5439 err = l2cap_disconnect_req(conn, cmd, cmd_len, data); 5440 break; 5441 5442 case L2CAP_DISCONN_RSP: 5443 l2cap_disconnect_rsp(conn, cmd, cmd_len, data); 5444 break; 5445 5446 default: 5447 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 5448 err = -EINVAL; 5449 break; 5450 } 5451 5452 return err; 5453 } 5454 5455 static inline void l2cap_le_sig_channel(struct l2cap_conn *conn, 5456 struct sk_buff *skb) 5457 { 5458 struct hci_conn *hcon = conn->hcon; 5459 struct l2cap_cmd_hdr *cmd; 5460 u16 len; 5461 int err; 5462 5463 if (hcon->type != LE_LINK) 5464 goto drop; 5465 5466 if (skb->len < L2CAP_CMD_HDR_SIZE) 5467 goto drop; 5468 5469 cmd = (void *) skb->data; 5470 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 5471 5472 len = le16_to_cpu(cmd->len); 5473 5474 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, cmd->ident); 5475 5476 if (len != skb->len || !cmd->ident) { 5477 BT_DBG("corrupted command"); 5478 goto drop; 5479 } 5480 5481 err = l2cap_le_sig_cmd(conn, cmd, len, skb->data); 5482 if (err) { 5483 struct l2cap_cmd_rej_unk rej; 5484 5485 BT_ERR("Wrong link type (%d)", err); 5486 5487 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 5488 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 5489 sizeof(rej), &rej); 5490 } 5491 5492 drop: 5493 kfree_skb(skb); 5494 } 5495 5496 static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident) 5497 { 5498 struct l2cap_cmd_rej_unk rej; 5499 5500 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 5501 l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 5502 } 5503 5504 static inline void l2cap_sig_channel(struct l2cap_conn *conn, 5505 struct sk_buff *skb) 5506 { 5507 struct hci_conn *hcon = conn->hcon; 5508 struct l2cap_cmd_hdr *cmd; 5509 int err; 5510 5511 l2cap_raw_recv(conn, skb); 5512 5513 if (hcon->type != ACL_LINK) 5514 goto drop; 5515 5516 while (skb->len >= L2CAP_CMD_HDR_SIZE) { 5517 u16 len; 5518 5519 cmd = (void *) skb->data; 5520 skb_pull(skb, L2CAP_CMD_HDR_SIZE); 5521 5522 len = le16_to_cpu(cmd->len); 5523 5524 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd->code, len, 5525 cmd->ident); 5526 5527 if (len > skb->len || !cmd->ident) { 5528 BT_DBG("corrupted command"); 5529 l2cap_sig_send_rej(conn, cmd->ident); 5530 skb_pull(skb, len > skb->len ? skb->len : len); 5531 continue; 5532 } 5533 5534 err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data); 5535 if (err) { 5536 BT_ERR("Wrong link type (%d)", err); 5537 l2cap_sig_send_rej(conn, cmd->ident); 5538 } 5539 5540 skb_pull(skb, len); 5541 } 5542 5543 if (skb->len > 0) { 5544 BT_DBG("corrupted command"); 5545 l2cap_sig_send_rej(conn, 0); 5546 } 5547 5548 drop: 5549 kfree_skb(skb); 5550 } 5551 5552 static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 5553 { 5554 u16 our_fcs, rcv_fcs; 5555 int hdr_size; 5556 5557 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 5558 hdr_size = L2CAP_EXT_HDR_SIZE; 5559 else 5560 hdr_size = L2CAP_ENH_HDR_SIZE; 5561 5562 if (chan->fcs == L2CAP_FCS_CRC16) { 5563 skb_trim(skb, skb->len - L2CAP_FCS_SIZE); 5564 rcv_fcs = get_unaligned_le16(skb->data + skb->len); 5565 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 5566 5567 if (our_fcs != rcv_fcs) 5568 return -EBADMSG; 5569 } 5570 return 0; 5571 } 5572 5573 static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 5574 { 5575 struct l2cap_ctrl control; 5576 5577 BT_DBG("chan %p", chan); 5578 5579 memset(&control, 0, sizeof(control)); 5580 control.sframe = 1; 5581 control.final = 1; 5582 control.reqseq = chan->buffer_seq; 5583 set_bit(CONN_SEND_FBIT, &chan->conn_state); 5584 5585 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5586 control.super = L2CAP_SUPER_RNR; 5587 l2cap_send_sframe(chan, &control); 5588 } 5589 5590 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 5591 chan->unacked_frames > 0) 5592 __set_retrans_timer(chan); 5593 5594 /* Send pending iframes */ 5595 l2cap_ertm_send(chan); 5596 5597 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 5598 test_bit(CONN_SEND_FBIT, &chan->conn_state)) { 5599 /* F-bit wasn't sent in an s-frame or i-frame yet, so 5600 * send it now. 5601 */ 5602 control.super = L2CAP_SUPER_RR; 5603 l2cap_send_sframe(chan, &control); 5604 } 5605 } 5606 5607 static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag, 5608 struct sk_buff **last_frag) 5609 { 5610 /* skb->len reflects data in skb as well as all fragments 5611 * skb->data_len reflects only data in fragments 5612 */ 5613 if (!skb_has_frag_list(skb)) 5614 skb_shinfo(skb)->frag_list = new_frag; 5615 5616 new_frag->next = NULL; 5617 5618 (*last_frag)->next = new_frag; 5619 *last_frag = new_frag; 5620 5621 skb->len += new_frag->len; 5622 skb->data_len += new_frag->len; 5623 skb->truesize += new_frag->truesize; 5624 } 5625 5626 static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, 5627 struct l2cap_ctrl *control) 5628 { 5629 int err = -EINVAL; 5630 5631 switch (control->sar) { 5632 case L2CAP_SAR_UNSEGMENTED: 5633 if (chan->sdu) 5634 break; 5635 5636 err = chan->ops->recv(chan, skb); 5637 break; 5638 5639 case L2CAP_SAR_START: 5640 if (chan->sdu) 5641 break; 5642 5643 if (!pskb_may_pull(skb, L2CAP_SDULEN_SIZE)) 5644 break; 5645 5646 chan->sdu_len = get_unaligned_le16(skb->data); 5647 skb_pull(skb, L2CAP_SDULEN_SIZE); 5648 5649 if (chan->sdu_len > chan->imtu) { 5650 err = -EMSGSIZE; 5651 break; 5652 } 5653 5654 if (skb->len >= chan->sdu_len) 5655 break; 5656 5657 chan->sdu = skb; 5658 chan->sdu_last_frag = skb; 5659 5660 skb = NULL; 5661 err = 0; 5662 break; 5663 5664 case L2CAP_SAR_CONTINUE: 5665 if (!chan->sdu) 5666 break; 5667 5668 append_skb_frag(chan->sdu, skb, 5669 &chan->sdu_last_frag); 5670 skb = NULL; 5671 5672 if (chan->sdu->len >= chan->sdu_len) 5673 break; 5674 5675 err = 0; 5676 break; 5677 5678 case L2CAP_SAR_END: 5679 if (!chan->sdu) 5680 break; 5681 5682 append_skb_frag(chan->sdu, skb, 5683 &chan->sdu_last_frag); 5684 skb = NULL; 5685 5686 if (chan->sdu->len != chan->sdu_len) 5687 break; 5688 5689 err = chan->ops->recv(chan, chan->sdu); 5690 5691 if (!err) { 5692 /* Reassembly complete */ 5693 chan->sdu = NULL; 5694 chan->sdu_last_frag = NULL; 5695 chan->sdu_len = 0; 5696 } 5697 break; 5698 } 5699 5700 if (err) { 5701 kfree_skb(skb); 5702 kfree_skb(chan->sdu); 5703 chan->sdu = NULL; 5704 chan->sdu_last_frag = NULL; 5705 chan->sdu_len = 0; 5706 } 5707 5708 return err; 5709 } 5710 5711 static int l2cap_resegment(struct l2cap_chan *chan) 5712 { 5713 /* Placeholder */ 5714 return 0; 5715 } 5716 5717 void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 5718 { 5719 u8 event; 5720 5721 if (chan->mode != L2CAP_MODE_ERTM) 5722 return; 5723 5724 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR; 5725 l2cap_tx(chan, NULL, NULL, event); 5726 } 5727 5728 static int l2cap_rx_queued_iframes(struct l2cap_chan *chan) 5729 { 5730 int err = 0; 5731 /* Pass sequential frames to l2cap_reassemble_sdu() 5732 * until a gap is encountered. 5733 */ 5734 5735 BT_DBG("chan %p", chan); 5736 5737 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5738 struct sk_buff *skb; 5739 BT_DBG("Searching for skb with txseq %d (queue len %d)", 5740 chan->buffer_seq, skb_queue_len(&chan->srej_q)); 5741 5742 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq); 5743 5744 if (!skb) 5745 break; 5746 5747 skb_unlink(skb, &chan->srej_q); 5748 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 5749 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->l2cap); 5750 if (err) 5751 break; 5752 } 5753 5754 if (skb_queue_empty(&chan->srej_q)) { 5755 chan->rx_state = L2CAP_RX_STATE_RECV; 5756 l2cap_send_ack(chan); 5757 } 5758 5759 return err; 5760 } 5761 5762 static void l2cap_handle_srej(struct l2cap_chan *chan, 5763 struct l2cap_ctrl *control) 5764 { 5765 struct sk_buff *skb; 5766 5767 BT_DBG("chan %p, control %p", chan, control); 5768 5769 if (control->reqseq == chan->next_tx_seq) { 5770 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 5771 l2cap_send_disconn_req(chan, ECONNRESET); 5772 return; 5773 } 5774 5775 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 5776 5777 if (skb == NULL) { 5778 BT_DBG("Seq %d not available for retransmission", 5779 control->reqseq); 5780 return; 5781 } 5782 5783 if (chan->max_tx != 0 && bt_cb(skb)->l2cap.retries >= chan->max_tx) { 5784 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 5785 l2cap_send_disconn_req(chan, ECONNRESET); 5786 return; 5787 } 5788 5789 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 5790 5791 if (control->poll) { 5792 l2cap_pass_to_tx(chan, control); 5793 5794 set_bit(CONN_SEND_FBIT, &chan->conn_state); 5795 l2cap_retransmit(chan, control); 5796 l2cap_ertm_send(chan); 5797 5798 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 5799 set_bit(CONN_SREJ_ACT, &chan->conn_state); 5800 chan->srej_save_reqseq = control->reqseq; 5801 } 5802 } else { 5803 l2cap_pass_to_tx_fbit(chan, control); 5804 5805 if (control->final) { 5806 if (chan->srej_save_reqseq != control->reqseq || 5807 !test_and_clear_bit(CONN_SREJ_ACT, 5808 &chan->conn_state)) 5809 l2cap_retransmit(chan, control); 5810 } else { 5811 l2cap_retransmit(chan, control); 5812 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) { 5813 set_bit(CONN_SREJ_ACT, &chan->conn_state); 5814 chan->srej_save_reqseq = control->reqseq; 5815 } 5816 } 5817 } 5818 } 5819 5820 static void l2cap_handle_rej(struct l2cap_chan *chan, 5821 struct l2cap_ctrl *control) 5822 { 5823 struct sk_buff *skb; 5824 5825 BT_DBG("chan %p, control %p", chan, control); 5826 5827 if (control->reqseq == chan->next_tx_seq) { 5828 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq); 5829 l2cap_send_disconn_req(chan, ECONNRESET); 5830 return; 5831 } 5832 5833 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq); 5834 5835 if (chan->max_tx && skb && 5836 bt_cb(skb)->l2cap.retries >= chan->max_tx) { 5837 BT_DBG("Retry limit exceeded (%d)", chan->max_tx); 5838 l2cap_send_disconn_req(chan, ECONNRESET); 5839 return; 5840 } 5841 5842 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 5843 5844 l2cap_pass_to_tx(chan, control); 5845 5846 if (control->final) { 5847 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 5848 l2cap_retransmit_all(chan, control); 5849 } else { 5850 l2cap_retransmit_all(chan, control); 5851 l2cap_ertm_send(chan); 5852 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) 5853 set_bit(CONN_REJ_ACT, &chan->conn_state); 5854 } 5855 } 5856 5857 static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq) 5858 { 5859 BT_DBG("chan %p, txseq %d", chan, txseq); 5860 5861 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq, 5862 chan->expected_tx_seq); 5863 5864 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) { 5865 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 5866 chan->tx_win) { 5867 /* See notes below regarding "double poll" and 5868 * invalid packets. 5869 */ 5870 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 5871 BT_DBG("Invalid/Ignore - after SREJ"); 5872 return L2CAP_TXSEQ_INVALID_IGNORE; 5873 } else { 5874 BT_DBG("Invalid - in window after SREJ sent"); 5875 return L2CAP_TXSEQ_INVALID; 5876 } 5877 } 5878 5879 if (chan->srej_list.head == txseq) { 5880 BT_DBG("Expected SREJ"); 5881 return L2CAP_TXSEQ_EXPECTED_SREJ; 5882 } 5883 5884 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) { 5885 BT_DBG("Duplicate SREJ - txseq already stored"); 5886 return L2CAP_TXSEQ_DUPLICATE_SREJ; 5887 } 5888 5889 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) { 5890 BT_DBG("Unexpected SREJ - not requested"); 5891 return L2CAP_TXSEQ_UNEXPECTED_SREJ; 5892 } 5893 } 5894 5895 if (chan->expected_tx_seq == txseq) { 5896 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= 5897 chan->tx_win) { 5898 BT_DBG("Invalid - txseq outside tx window"); 5899 return L2CAP_TXSEQ_INVALID; 5900 } else { 5901 BT_DBG("Expected"); 5902 return L2CAP_TXSEQ_EXPECTED; 5903 } 5904 } 5905 5906 if (__seq_offset(chan, txseq, chan->last_acked_seq) < 5907 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) { 5908 BT_DBG("Duplicate - expected_tx_seq later than txseq"); 5909 return L2CAP_TXSEQ_DUPLICATE; 5910 } 5911 5912 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) { 5913 /* A source of invalid packets is a "double poll" condition, 5914 * where delays cause us to send multiple poll packets. If 5915 * the remote stack receives and processes both polls, 5916 * sequence numbers can wrap around in such a way that a 5917 * resent frame has a sequence number that looks like new data 5918 * with a sequence gap. This would trigger an erroneous SREJ 5919 * request. 5920 * 5921 * Fortunately, this is impossible with a tx window that's 5922 * less than half of the maximum sequence number, which allows 5923 * invalid frames to be safely ignored. 5924 * 5925 * With tx window sizes greater than half of the tx window 5926 * maximum, the frame is invalid and cannot be ignored. This 5927 * causes a disconnect. 5928 */ 5929 5930 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) { 5931 BT_DBG("Invalid/Ignore - txseq outside tx window"); 5932 return L2CAP_TXSEQ_INVALID_IGNORE; 5933 } else { 5934 BT_DBG("Invalid - txseq outside tx window"); 5935 return L2CAP_TXSEQ_INVALID; 5936 } 5937 } else { 5938 BT_DBG("Unexpected - txseq indicates missing frames"); 5939 return L2CAP_TXSEQ_UNEXPECTED; 5940 } 5941 } 5942 5943 static int l2cap_rx_state_recv(struct l2cap_chan *chan, 5944 struct l2cap_ctrl *control, 5945 struct sk_buff *skb, u8 event) 5946 { 5947 struct l2cap_ctrl local_control; 5948 int err = 0; 5949 bool skb_in_use = false; 5950 5951 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 5952 event); 5953 5954 switch (event) { 5955 case L2CAP_EV_RECV_IFRAME: 5956 switch (l2cap_classify_txseq(chan, control->txseq)) { 5957 case L2CAP_TXSEQ_EXPECTED: 5958 l2cap_pass_to_tx(chan, control); 5959 5960 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 5961 BT_DBG("Busy, discarding expected seq %d", 5962 control->txseq); 5963 break; 5964 } 5965 5966 chan->expected_tx_seq = __next_seq(chan, 5967 control->txseq); 5968 5969 chan->buffer_seq = chan->expected_tx_seq; 5970 skb_in_use = true; 5971 5972 /* l2cap_reassemble_sdu may free skb, hence invalidate 5973 * control, so make a copy in advance to use it after 5974 * l2cap_reassemble_sdu returns and to avoid the race 5975 * condition, for example: 5976 * 5977 * The current thread calls: 5978 * l2cap_reassemble_sdu 5979 * chan->ops->recv == l2cap_sock_recv_cb 5980 * __sock_queue_rcv_skb 5981 * Another thread calls: 5982 * bt_sock_recvmsg 5983 * skb_recv_datagram 5984 * skb_free_datagram 5985 * Then the current thread tries to access control, but 5986 * it was freed by skb_free_datagram. 5987 */ 5988 local_control = *control; 5989 err = l2cap_reassemble_sdu(chan, skb, control); 5990 if (err) 5991 break; 5992 5993 if (local_control.final) { 5994 if (!test_and_clear_bit(CONN_REJ_ACT, 5995 &chan->conn_state)) { 5996 local_control.final = 0; 5997 l2cap_retransmit_all(chan, &local_control); 5998 l2cap_ertm_send(chan); 5999 } 6000 } 6001 6002 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 6003 l2cap_send_ack(chan); 6004 break; 6005 case L2CAP_TXSEQ_UNEXPECTED: 6006 l2cap_pass_to_tx(chan, control); 6007 6008 /* Can't issue SREJ frames in the local busy state. 6009 * Drop this frame, it will be seen as missing 6010 * when local busy is exited. 6011 */ 6012 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6013 BT_DBG("Busy, discarding unexpected seq %d", 6014 control->txseq); 6015 break; 6016 } 6017 6018 /* There was a gap in the sequence, so an SREJ 6019 * must be sent for each missing frame. The 6020 * current frame is stored for later use. 6021 */ 6022 skb_queue_tail(&chan->srej_q, skb); 6023 skb_in_use = true; 6024 BT_DBG("Queued %p (queue len %d)", skb, 6025 skb_queue_len(&chan->srej_q)); 6026 6027 clear_bit(CONN_SREJ_ACT, &chan->conn_state); 6028 l2cap_seq_list_clear(&chan->srej_list); 6029 l2cap_send_srej(chan, control->txseq); 6030 6031 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT; 6032 break; 6033 case L2CAP_TXSEQ_DUPLICATE: 6034 l2cap_pass_to_tx(chan, control); 6035 break; 6036 case L2CAP_TXSEQ_INVALID_IGNORE: 6037 break; 6038 case L2CAP_TXSEQ_INVALID: 6039 default: 6040 l2cap_send_disconn_req(chan, ECONNRESET); 6041 break; 6042 } 6043 break; 6044 case L2CAP_EV_RECV_RR: 6045 l2cap_pass_to_tx(chan, control); 6046 if (control->final) { 6047 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6048 6049 if (!test_and_clear_bit(CONN_REJ_ACT, 6050 &chan->conn_state)) { 6051 control->final = 0; 6052 l2cap_retransmit_all(chan, control); 6053 } 6054 6055 l2cap_ertm_send(chan); 6056 } else if (control->poll) { 6057 l2cap_send_i_or_rr_or_rnr(chan); 6058 } else { 6059 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6060 &chan->conn_state) && 6061 chan->unacked_frames) 6062 __set_retrans_timer(chan); 6063 6064 l2cap_ertm_send(chan); 6065 } 6066 break; 6067 case L2CAP_EV_RECV_RNR: 6068 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6069 l2cap_pass_to_tx(chan, control); 6070 if (control && control->poll) { 6071 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6072 l2cap_send_rr_or_rnr(chan, 0); 6073 } 6074 __clear_retrans_timer(chan); 6075 l2cap_seq_list_clear(&chan->retrans_list); 6076 break; 6077 case L2CAP_EV_RECV_REJ: 6078 l2cap_handle_rej(chan, control); 6079 break; 6080 case L2CAP_EV_RECV_SREJ: 6081 l2cap_handle_srej(chan, control); 6082 break; 6083 default: 6084 break; 6085 } 6086 6087 if (skb && !skb_in_use) { 6088 BT_DBG("Freeing %p", skb); 6089 kfree_skb(skb); 6090 } 6091 6092 return err; 6093 } 6094 6095 static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan, 6096 struct l2cap_ctrl *control, 6097 struct sk_buff *skb, u8 event) 6098 { 6099 int err = 0; 6100 u16 txseq = control->txseq; 6101 bool skb_in_use = false; 6102 6103 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6104 event); 6105 6106 switch (event) { 6107 case L2CAP_EV_RECV_IFRAME: 6108 switch (l2cap_classify_txseq(chan, txseq)) { 6109 case L2CAP_TXSEQ_EXPECTED: 6110 /* Keep frame for reassembly later */ 6111 l2cap_pass_to_tx(chan, control); 6112 skb_queue_tail(&chan->srej_q, skb); 6113 skb_in_use = true; 6114 BT_DBG("Queued %p (queue len %d)", skb, 6115 skb_queue_len(&chan->srej_q)); 6116 6117 chan->expected_tx_seq = __next_seq(chan, txseq); 6118 break; 6119 case L2CAP_TXSEQ_EXPECTED_SREJ: 6120 l2cap_seq_list_pop(&chan->srej_list); 6121 6122 l2cap_pass_to_tx(chan, control); 6123 skb_queue_tail(&chan->srej_q, skb); 6124 skb_in_use = true; 6125 BT_DBG("Queued %p (queue len %d)", skb, 6126 skb_queue_len(&chan->srej_q)); 6127 6128 err = l2cap_rx_queued_iframes(chan); 6129 if (err) 6130 break; 6131 6132 break; 6133 case L2CAP_TXSEQ_UNEXPECTED: 6134 /* Got a frame that can't be reassembled yet. 6135 * Save it for later, and send SREJs to cover 6136 * the missing frames. 6137 */ 6138 skb_queue_tail(&chan->srej_q, skb); 6139 skb_in_use = true; 6140 BT_DBG("Queued %p (queue len %d)", skb, 6141 skb_queue_len(&chan->srej_q)); 6142 6143 l2cap_pass_to_tx(chan, control); 6144 l2cap_send_srej(chan, control->txseq); 6145 break; 6146 case L2CAP_TXSEQ_UNEXPECTED_SREJ: 6147 /* This frame was requested with an SREJ, but 6148 * some expected retransmitted frames are 6149 * missing. Request retransmission of missing 6150 * SREJ'd frames. 6151 */ 6152 skb_queue_tail(&chan->srej_q, skb); 6153 skb_in_use = true; 6154 BT_DBG("Queued %p (queue len %d)", skb, 6155 skb_queue_len(&chan->srej_q)); 6156 6157 l2cap_pass_to_tx(chan, control); 6158 l2cap_send_srej_list(chan, control->txseq); 6159 break; 6160 case L2CAP_TXSEQ_DUPLICATE_SREJ: 6161 /* We've already queued this frame. Drop this copy. */ 6162 l2cap_pass_to_tx(chan, control); 6163 break; 6164 case L2CAP_TXSEQ_DUPLICATE: 6165 /* Expecting a later sequence number, so this frame 6166 * was already received. Ignore it completely. 6167 */ 6168 break; 6169 case L2CAP_TXSEQ_INVALID_IGNORE: 6170 break; 6171 case L2CAP_TXSEQ_INVALID: 6172 default: 6173 l2cap_send_disconn_req(chan, ECONNRESET); 6174 break; 6175 } 6176 break; 6177 case L2CAP_EV_RECV_RR: 6178 l2cap_pass_to_tx(chan, control); 6179 if (control->final) { 6180 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6181 6182 if (!test_and_clear_bit(CONN_REJ_ACT, 6183 &chan->conn_state)) { 6184 control->final = 0; 6185 l2cap_retransmit_all(chan, control); 6186 } 6187 6188 l2cap_ertm_send(chan); 6189 } else if (control->poll) { 6190 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6191 &chan->conn_state) && 6192 chan->unacked_frames) { 6193 __set_retrans_timer(chan); 6194 } 6195 6196 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6197 l2cap_send_srej_tail(chan); 6198 } else { 6199 if (test_and_clear_bit(CONN_REMOTE_BUSY, 6200 &chan->conn_state) && 6201 chan->unacked_frames) 6202 __set_retrans_timer(chan); 6203 6204 l2cap_send_ack(chan); 6205 } 6206 break; 6207 case L2CAP_EV_RECV_RNR: 6208 set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6209 l2cap_pass_to_tx(chan, control); 6210 if (control->poll) { 6211 l2cap_send_srej_tail(chan); 6212 } else { 6213 struct l2cap_ctrl rr_control; 6214 memset(&rr_control, 0, sizeof(rr_control)); 6215 rr_control.sframe = 1; 6216 rr_control.super = L2CAP_SUPER_RR; 6217 rr_control.reqseq = chan->buffer_seq; 6218 l2cap_send_sframe(chan, &rr_control); 6219 } 6220 6221 break; 6222 case L2CAP_EV_RECV_REJ: 6223 l2cap_handle_rej(chan, control); 6224 break; 6225 case L2CAP_EV_RECV_SREJ: 6226 l2cap_handle_srej(chan, control); 6227 break; 6228 } 6229 6230 if (skb && !skb_in_use) { 6231 BT_DBG("Freeing %p", skb); 6232 kfree_skb(skb); 6233 } 6234 6235 return err; 6236 } 6237 6238 static int l2cap_finish_move(struct l2cap_chan *chan) 6239 { 6240 BT_DBG("chan %p", chan); 6241 6242 chan->rx_state = L2CAP_RX_STATE_RECV; 6243 chan->conn->mtu = chan->conn->hcon->mtu; 6244 6245 return l2cap_resegment(chan); 6246 } 6247 6248 static int l2cap_rx_state_wait_p(struct l2cap_chan *chan, 6249 struct l2cap_ctrl *control, 6250 struct sk_buff *skb, u8 event) 6251 { 6252 int err; 6253 6254 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb, 6255 event); 6256 6257 if (!control->poll) 6258 return -EPROTO; 6259 6260 l2cap_process_reqseq(chan, control->reqseq); 6261 6262 if (!skb_queue_empty(&chan->tx_q)) 6263 chan->tx_send_head = skb_peek(&chan->tx_q); 6264 else 6265 chan->tx_send_head = NULL; 6266 6267 /* Rewind next_tx_seq to the point expected 6268 * by the receiver. 6269 */ 6270 chan->next_tx_seq = control->reqseq; 6271 chan->unacked_frames = 0; 6272 6273 err = l2cap_finish_move(chan); 6274 if (err) 6275 return err; 6276 6277 set_bit(CONN_SEND_FBIT, &chan->conn_state); 6278 l2cap_send_i_or_rr_or_rnr(chan); 6279 6280 if (event == L2CAP_EV_RECV_IFRAME) 6281 return -EPROTO; 6282 6283 return l2cap_rx_state_recv(chan, control, NULL, event); 6284 } 6285 6286 static int l2cap_rx_state_wait_f(struct l2cap_chan *chan, 6287 struct l2cap_ctrl *control, 6288 struct sk_buff *skb, u8 event) 6289 { 6290 int err; 6291 6292 if (!control->final) 6293 return -EPROTO; 6294 6295 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 6296 6297 chan->rx_state = L2CAP_RX_STATE_RECV; 6298 l2cap_process_reqseq(chan, control->reqseq); 6299 6300 if (!skb_queue_empty(&chan->tx_q)) 6301 chan->tx_send_head = skb_peek(&chan->tx_q); 6302 else 6303 chan->tx_send_head = NULL; 6304 6305 /* Rewind next_tx_seq to the point expected 6306 * by the receiver. 6307 */ 6308 chan->next_tx_seq = control->reqseq; 6309 chan->unacked_frames = 0; 6310 chan->conn->mtu = chan->conn->hcon->mtu; 6311 6312 err = l2cap_resegment(chan); 6313 6314 if (!err) 6315 err = l2cap_rx_state_recv(chan, control, skb, event); 6316 6317 return err; 6318 } 6319 6320 static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq) 6321 { 6322 /* Make sure reqseq is for a packet that has been sent but not acked */ 6323 u16 unacked; 6324 6325 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq); 6326 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked; 6327 } 6328 6329 static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 6330 struct sk_buff *skb, u8 event) 6331 { 6332 int err = 0; 6333 6334 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan, 6335 control, skb, event, chan->rx_state); 6336 6337 if (__valid_reqseq(chan, control->reqseq)) { 6338 switch (chan->rx_state) { 6339 case L2CAP_RX_STATE_RECV: 6340 err = l2cap_rx_state_recv(chan, control, skb, event); 6341 break; 6342 case L2CAP_RX_STATE_SREJ_SENT: 6343 err = l2cap_rx_state_srej_sent(chan, control, skb, 6344 event); 6345 break; 6346 case L2CAP_RX_STATE_WAIT_P: 6347 err = l2cap_rx_state_wait_p(chan, control, skb, event); 6348 break; 6349 case L2CAP_RX_STATE_WAIT_F: 6350 err = l2cap_rx_state_wait_f(chan, control, skb, event); 6351 break; 6352 default: 6353 /* shut it down */ 6354 break; 6355 } 6356 } else { 6357 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d", 6358 control->reqseq, chan->next_tx_seq, 6359 chan->expected_ack_seq); 6360 l2cap_send_disconn_req(chan, ECONNRESET); 6361 } 6362 6363 return err; 6364 } 6365 6366 static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, 6367 struct sk_buff *skb) 6368 { 6369 /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store 6370 * the txseq field in advance to use it after l2cap_reassemble_sdu 6371 * returns and to avoid the race condition, for example: 6372 * 6373 * The current thread calls: 6374 * l2cap_reassemble_sdu 6375 * chan->ops->recv == l2cap_sock_recv_cb 6376 * __sock_queue_rcv_skb 6377 * Another thread calls: 6378 * bt_sock_recvmsg 6379 * skb_recv_datagram 6380 * skb_free_datagram 6381 * Then the current thread tries to access control, but it was freed by 6382 * skb_free_datagram. 6383 */ 6384 u16 txseq = control->txseq; 6385 6386 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, 6387 chan->rx_state); 6388 6389 if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { 6390 l2cap_pass_to_tx(chan, control); 6391 6392 BT_DBG("buffer_seq %u->%u", chan->buffer_seq, 6393 __next_seq(chan, chan->buffer_seq)); 6394 6395 chan->buffer_seq = __next_seq(chan, chan->buffer_seq); 6396 6397 l2cap_reassemble_sdu(chan, skb, control); 6398 } else { 6399 if (chan->sdu) { 6400 kfree_skb(chan->sdu); 6401 chan->sdu = NULL; 6402 } 6403 chan->sdu_last_frag = NULL; 6404 chan->sdu_len = 0; 6405 6406 if (skb) { 6407 BT_DBG("Freeing %p", skb); 6408 kfree_skb(skb); 6409 } 6410 } 6411 6412 chan->last_acked_seq = txseq; 6413 chan->expected_tx_seq = __next_seq(chan, txseq); 6414 6415 return 0; 6416 } 6417 6418 static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 6419 { 6420 struct l2cap_ctrl *control = &bt_cb(skb)->l2cap; 6421 u16 len; 6422 u8 event; 6423 6424 __unpack_control(chan, skb); 6425 6426 len = skb->len; 6427 6428 /* 6429 * We can just drop the corrupted I-frame here. 6430 * Receiver will miss it and start proper recovery 6431 * procedures and ask for retransmission. 6432 */ 6433 if (l2cap_check_fcs(chan, skb)) 6434 goto drop; 6435 6436 if (!control->sframe && control->sar == L2CAP_SAR_START) 6437 len -= L2CAP_SDULEN_SIZE; 6438 6439 if (chan->fcs == L2CAP_FCS_CRC16) 6440 len -= L2CAP_FCS_SIZE; 6441 6442 if (len > chan->mps) { 6443 l2cap_send_disconn_req(chan, ECONNRESET); 6444 goto drop; 6445 } 6446 6447 if (chan->ops->filter) { 6448 if (chan->ops->filter(chan, skb)) 6449 goto drop; 6450 } 6451 6452 if (!control->sframe) { 6453 int err; 6454 6455 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d", 6456 control->sar, control->reqseq, control->final, 6457 control->txseq); 6458 6459 /* Validate F-bit - F=0 always valid, F=1 only 6460 * valid in TX WAIT_F 6461 */ 6462 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F) 6463 goto drop; 6464 6465 if (chan->mode != L2CAP_MODE_STREAMING) { 6466 event = L2CAP_EV_RECV_IFRAME; 6467 err = l2cap_rx(chan, control, skb, event); 6468 } else { 6469 err = l2cap_stream_rx(chan, control, skb); 6470 } 6471 6472 if (err) 6473 l2cap_send_disconn_req(chan, ECONNRESET); 6474 } else { 6475 const u8 rx_func_to_event[4] = { 6476 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ, 6477 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ 6478 }; 6479 6480 /* Only I-frames are expected in streaming mode */ 6481 if (chan->mode == L2CAP_MODE_STREAMING) 6482 goto drop; 6483 6484 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d", 6485 control->reqseq, control->final, control->poll, 6486 control->super); 6487 6488 if (len != 0) { 6489 BT_ERR("Trailing bytes: %d in sframe", len); 6490 l2cap_send_disconn_req(chan, ECONNRESET); 6491 goto drop; 6492 } 6493 6494 /* Validate F and P bits */ 6495 if (control->final && (control->poll || 6496 chan->tx_state != L2CAP_TX_STATE_WAIT_F)) 6497 goto drop; 6498 6499 event = rx_func_to_event[control->super]; 6500 if (l2cap_rx(chan, control, skb, event)) 6501 l2cap_send_disconn_req(chan, ECONNRESET); 6502 } 6503 6504 return 0; 6505 6506 drop: 6507 kfree_skb(skb); 6508 return 0; 6509 } 6510 6511 static void l2cap_chan_le_send_credits(struct l2cap_chan *chan) 6512 { 6513 struct l2cap_conn *conn = chan->conn; 6514 struct l2cap_le_credits pkt; 6515 u16 return_credits = l2cap_le_rx_credits(chan); 6516 6517 if (chan->rx_credits >= return_credits) 6518 return; 6519 6520 return_credits -= chan->rx_credits; 6521 6522 BT_DBG("chan %p returning %u credits to sender", chan, return_credits); 6523 6524 chan->rx_credits += return_credits; 6525 6526 pkt.cid = cpu_to_le16(chan->scid); 6527 pkt.credits = cpu_to_le16(return_credits); 6528 6529 chan->ident = l2cap_get_ident(conn); 6530 6531 l2cap_send_cmd(conn, chan->ident, L2CAP_LE_CREDITS, sizeof(pkt), &pkt); 6532 } 6533 6534 void l2cap_chan_rx_avail(struct l2cap_chan *chan, ssize_t rx_avail) 6535 { 6536 if (chan->rx_avail == rx_avail) 6537 return; 6538 6539 BT_DBG("chan %p has %zd bytes avail for rx", chan, rx_avail); 6540 6541 chan->rx_avail = rx_avail; 6542 6543 if (chan->state == BT_CONNECTED) 6544 l2cap_chan_le_send_credits(chan); 6545 } 6546 6547 static int l2cap_ecred_recv(struct l2cap_chan *chan, struct sk_buff *skb) 6548 { 6549 int err; 6550 6551 BT_DBG("SDU reassemble complete: chan %p skb->len %u", chan, skb->len); 6552 6553 /* Wait recv to confirm reception before updating the credits */ 6554 err = chan->ops->recv(chan, skb); 6555 6556 if (err < 0 && chan->rx_avail != -1) { 6557 BT_ERR("Queueing received LE L2CAP data failed"); 6558 l2cap_send_disconn_req(chan, ECONNRESET); 6559 return err; 6560 } 6561 6562 /* Update credits whenever an SDU is received */ 6563 l2cap_chan_le_send_credits(chan); 6564 6565 return err; 6566 } 6567 6568 static int l2cap_ecred_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb) 6569 { 6570 int err; 6571 6572 if (!chan->rx_credits) { 6573 BT_ERR("No credits to receive LE L2CAP data"); 6574 l2cap_send_disconn_req(chan, ECONNRESET); 6575 return -ENOBUFS; 6576 } 6577 6578 if (chan->imtu < skb->len) { 6579 BT_ERR("Too big LE L2CAP PDU"); 6580 return -ENOBUFS; 6581 } 6582 6583 chan->rx_credits--; 6584 BT_DBG("chan %p: rx_credits %u -> %u", 6585 chan, chan->rx_credits + 1, chan->rx_credits); 6586 6587 /* Update if remote had run out of credits, this should only happens 6588 * if the remote is not using the entire MPS. 6589 */ 6590 if (!chan->rx_credits) 6591 l2cap_chan_le_send_credits(chan); 6592 6593 err = 0; 6594 6595 if (!chan->sdu) { 6596 u16 sdu_len; 6597 6598 sdu_len = get_unaligned_le16(skb->data); 6599 skb_pull(skb, L2CAP_SDULEN_SIZE); 6600 6601 BT_DBG("Start of new SDU. sdu_len %u skb->len %u imtu %u", 6602 sdu_len, skb->len, chan->imtu); 6603 6604 if (sdu_len > chan->imtu) { 6605 BT_ERR("Too big LE L2CAP SDU length received"); 6606 err = -EMSGSIZE; 6607 goto failed; 6608 } 6609 6610 if (skb->len > sdu_len) { 6611 BT_ERR("Too much LE L2CAP data received"); 6612 err = -EINVAL; 6613 goto failed; 6614 } 6615 6616 if (skb->len == sdu_len) 6617 return l2cap_ecred_recv(chan, skb); 6618 6619 chan->sdu = skb; 6620 chan->sdu_len = sdu_len; 6621 chan->sdu_last_frag = skb; 6622 6623 /* Detect if remote is not able to use the selected MPS */ 6624 if (skb->len + L2CAP_SDULEN_SIZE < chan->mps) { 6625 u16 mps_len = skb->len + L2CAP_SDULEN_SIZE; 6626 6627 /* Adjust the number of credits */ 6628 BT_DBG("chan->mps %u -> %u", chan->mps, mps_len); 6629 chan->mps = mps_len; 6630 l2cap_chan_le_send_credits(chan); 6631 } 6632 6633 return 0; 6634 } 6635 6636 BT_DBG("SDU fragment. chan->sdu->len %u skb->len %u chan->sdu_len %u", 6637 chan->sdu->len, skb->len, chan->sdu_len); 6638 6639 if (chan->sdu->len + skb->len > chan->sdu_len) { 6640 BT_ERR("Too much LE L2CAP data received"); 6641 err = -EINVAL; 6642 goto failed; 6643 } 6644 6645 append_skb_frag(chan->sdu, skb, &chan->sdu_last_frag); 6646 skb = NULL; 6647 6648 if (chan->sdu->len == chan->sdu_len) { 6649 err = l2cap_ecred_recv(chan, chan->sdu); 6650 if (!err) { 6651 chan->sdu = NULL; 6652 chan->sdu_last_frag = NULL; 6653 chan->sdu_len = 0; 6654 } 6655 } 6656 6657 failed: 6658 if (err) { 6659 kfree_skb(skb); 6660 kfree_skb(chan->sdu); 6661 chan->sdu = NULL; 6662 chan->sdu_last_frag = NULL; 6663 chan->sdu_len = 0; 6664 } 6665 6666 /* We can't return an error here since we took care of the skb 6667 * freeing internally. An error return would cause the caller to 6668 * do a double-free of the skb. 6669 */ 6670 return 0; 6671 } 6672 6673 static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid, 6674 struct sk_buff *skb) 6675 { 6676 struct l2cap_chan *chan; 6677 6678 chan = l2cap_get_chan_by_scid(conn, cid); 6679 if (!chan) { 6680 BT_DBG("unknown cid 0x%4.4x", cid); 6681 /* Drop packet and return */ 6682 kfree_skb(skb); 6683 return; 6684 } 6685 6686 BT_DBG("chan %p, len %d", chan, skb->len); 6687 6688 /* If we receive data on a fixed channel before the info req/rsp 6689 * procedure is done simply assume that the channel is supported 6690 * and mark it as ready. 6691 */ 6692 if (chan->chan_type == L2CAP_CHAN_FIXED) 6693 l2cap_chan_ready(chan); 6694 6695 if (chan->state != BT_CONNECTED) 6696 goto drop; 6697 6698 switch (chan->mode) { 6699 case L2CAP_MODE_LE_FLOWCTL: 6700 case L2CAP_MODE_EXT_FLOWCTL: 6701 if (l2cap_ecred_data_rcv(chan, skb) < 0) 6702 goto drop; 6703 6704 goto done; 6705 6706 case L2CAP_MODE_BASIC: 6707 /* If socket recv buffers overflows we drop data here 6708 * which is *bad* because L2CAP has to be reliable. 6709 * But we don't have any other choice. L2CAP doesn't 6710 * provide flow control mechanism. */ 6711 6712 if (chan->imtu < skb->len) { 6713 BT_ERR("Dropping L2CAP data: receive buffer overflow"); 6714 goto drop; 6715 } 6716 6717 if (!chan->ops->recv(chan, skb)) 6718 goto done; 6719 break; 6720 6721 case L2CAP_MODE_ERTM: 6722 case L2CAP_MODE_STREAMING: 6723 l2cap_data_rcv(chan, skb); 6724 goto done; 6725 6726 default: 6727 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 6728 break; 6729 } 6730 6731 drop: 6732 kfree_skb(skb); 6733 6734 done: 6735 l2cap_chan_unlock(chan); 6736 l2cap_chan_put(chan); 6737 } 6738 6739 static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, 6740 struct sk_buff *skb) 6741 { 6742 struct hci_conn *hcon = conn->hcon; 6743 struct l2cap_chan *chan; 6744 6745 if (hcon->type != ACL_LINK) 6746 goto free_skb; 6747 6748 chan = l2cap_global_chan_by_psm(0, psm, &hcon->src, &hcon->dst, 6749 ACL_LINK); 6750 if (!chan) 6751 goto free_skb; 6752 6753 BT_DBG("chan %p, len %d", chan, skb->len); 6754 6755 l2cap_chan_lock(chan); 6756 6757 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 6758 goto drop; 6759 6760 if (chan->imtu < skb->len) 6761 goto drop; 6762 6763 /* Store remote BD_ADDR and PSM for msg_name */ 6764 bacpy(&bt_cb(skb)->l2cap.bdaddr, &hcon->dst); 6765 bt_cb(skb)->l2cap.psm = psm; 6766 6767 if (!chan->ops->recv(chan, skb)) { 6768 l2cap_chan_unlock(chan); 6769 l2cap_chan_put(chan); 6770 return; 6771 } 6772 6773 drop: 6774 l2cap_chan_unlock(chan); 6775 l2cap_chan_put(chan); 6776 free_skb: 6777 kfree_skb(skb); 6778 } 6779 6780 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 6781 { 6782 struct l2cap_hdr *lh = (void *) skb->data; 6783 struct hci_conn *hcon = conn->hcon; 6784 u16 cid, len; 6785 __le16 psm; 6786 6787 if (hcon->state != BT_CONNECTED) { 6788 BT_DBG("queueing pending rx skb"); 6789 skb_queue_tail(&conn->pending_rx, skb); 6790 return; 6791 } 6792 6793 skb_pull(skb, L2CAP_HDR_SIZE); 6794 cid = __le16_to_cpu(lh->cid); 6795 len = __le16_to_cpu(lh->len); 6796 6797 if (len != skb->len) { 6798 kfree_skb(skb); 6799 return; 6800 } 6801 6802 /* Since we can't actively block incoming LE connections we must 6803 * at least ensure that we ignore incoming data from them. 6804 */ 6805 if (hcon->type == LE_LINK && 6806 hci_bdaddr_list_lookup(&hcon->hdev->reject_list, &hcon->dst, 6807 bdaddr_dst_type(hcon))) { 6808 kfree_skb(skb); 6809 return; 6810 } 6811 6812 BT_DBG("len %d, cid 0x%4.4x", len, cid); 6813 6814 switch (cid) { 6815 case L2CAP_CID_SIGNALING: 6816 l2cap_sig_channel(conn, skb); 6817 break; 6818 6819 case L2CAP_CID_CONN_LESS: 6820 psm = get_unaligned((__le16 *) skb->data); 6821 skb_pull(skb, L2CAP_PSMLEN_SIZE); 6822 l2cap_conless_channel(conn, psm, skb); 6823 break; 6824 6825 case L2CAP_CID_LE_SIGNALING: 6826 l2cap_le_sig_channel(conn, skb); 6827 break; 6828 6829 default: 6830 l2cap_data_channel(conn, cid, skb); 6831 break; 6832 } 6833 } 6834 6835 static void process_pending_rx(struct work_struct *work) 6836 { 6837 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 6838 pending_rx_work); 6839 struct sk_buff *skb; 6840 6841 BT_DBG(""); 6842 6843 mutex_lock(&conn->lock); 6844 6845 while ((skb = skb_dequeue(&conn->pending_rx))) 6846 l2cap_recv_frame(conn, skb); 6847 6848 mutex_unlock(&conn->lock); 6849 } 6850 6851 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon) 6852 { 6853 struct l2cap_conn *conn = hcon->l2cap_data; 6854 struct hci_chan *hchan; 6855 6856 if (conn) 6857 return conn; 6858 6859 hchan = hci_chan_create(hcon); 6860 if (!hchan) 6861 return NULL; 6862 6863 conn = kzalloc(sizeof(*conn), GFP_KERNEL); 6864 if (!conn) { 6865 hci_chan_del(hchan); 6866 return NULL; 6867 } 6868 6869 kref_init(&conn->ref); 6870 hcon->l2cap_data = conn; 6871 conn->hcon = hci_conn_get(hcon); 6872 conn->hchan = hchan; 6873 6874 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan); 6875 6876 conn->mtu = hcon->mtu; 6877 conn->feat_mask = 0; 6878 6879 conn->local_fixed_chan = L2CAP_FC_SIG_BREDR | L2CAP_FC_CONNLESS; 6880 6881 if (hci_dev_test_flag(hcon->hdev, HCI_LE_ENABLED) && 6882 (bredr_sc_enabled(hcon->hdev) || 6883 hci_dev_test_flag(hcon->hdev, HCI_FORCE_BREDR_SMP))) 6884 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR; 6885 6886 mutex_init(&conn->ident_lock); 6887 mutex_init(&conn->lock); 6888 6889 INIT_LIST_HEAD(&conn->chan_l); 6890 INIT_LIST_HEAD(&conn->users); 6891 6892 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout); 6893 6894 skb_queue_head_init(&conn->pending_rx); 6895 INIT_WORK(&conn->pending_rx_work, process_pending_rx); 6896 INIT_DELAYED_WORK(&conn->id_addr_timer, l2cap_conn_update_id_addr); 6897 6898 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM; 6899 6900 return conn; 6901 } 6902 6903 static bool is_valid_psm(u16 psm, u8 dst_type) 6904 { 6905 if (!psm) 6906 return false; 6907 6908 if (bdaddr_type_is_le(dst_type)) 6909 return (psm <= 0x00ff); 6910 6911 /* PSM must be odd and lsb of upper byte must be 0 */ 6912 return ((psm & 0x0101) == 0x0001); 6913 } 6914 6915 struct l2cap_chan_data { 6916 struct l2cap_chan *chan; 6917 struct pid *pid; 6918 int count; 6919 }; 6920 6921 static void l2cap_chan_by_pid(struct l2cap_chan *chan, void *data) 6922 { 6923 struct l2cap_chan_data *d = data; 6924 struct pid *pid; 6925 6926 if (chan == d->chan) 6927 return; 6928 6929 if (!test_bit(FLAG_DEFER_SETUP, &chan->flags)) 6930 return; 6931 6932 pid = chan->ops->get_peer_pid(chan); 6933 6934 /* Only count deferred channels with the same PID/PSM */ 6935 if (d->pid != pid || chan->psm != d->chan->psm || chan->ident || 6936 chan->mode != L2CAP_MODE_EXT_FLOWCTL || chan->state != BT_CONNECT) 6937 return; 6938 6939 d->count++; 6940 } 6941 6942 int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, 6943 bdaddr_t *dst, u8 dst_type, u16 timeout) 6944 { 6945 struct l2cap_conn *conn; 6946 struct hci_conn *hcon; 6947 struct hci_dev *hdev; 6948 int err; 6949 6950 BT_DBG("%pMR -> %pMR (type %u) psm 0x%4.4x mode 0x%2.2x", &chan->src, 6951 dst, dst_type, __le16_to_cpu(psm), chan->mode); 6952 6953 hdev = hci_get_route(dst, &chan->src, chan->src_type); 6954 if (!hdev) 6955 return -EHOSTUNREACH; 6956 6957 hci_dev_lock(hdev); 6958 6959 if (!is_valid_psm(__le16_to_cpu(psm), dst_type) && !cid && 6960 chan->chan_type != L2CAP_CHAN_RAW) { 6961 err = -EINVAL; 6962 goto done; 6963 } 6964 6965 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !psm) { 6966 err = -EINVAL; 6967 goto done; 6968 } 6969 6970 if (chan->chan_type == L2CAP_CHAN_FIXED && !cid) { 6971 err = -EINVAL; 6972 goto done; 6973 } 6974 6975 switch (chan->mode) { 6976 case L2CAP_MODE_BASIC: 6977 break; 6978 case L2CAP_MODE_LE_FLOWCTL: 6979 break; 6980 case L2CAP_MODE_EXT_FLOWCTL: 6981 if (!enable_ecred) { 6982 err = -EOPNOTSUPP; 6983 goto done; 6984 } 6985 break; 6986 case L2CAP_MODE_ERTM: 6987 case L2CAP_MODE_STREAMING: 6988 if (!disable_ertm) 6989 break; 6990 fallthrough; 6991 default: 6992 err = -EOPNOTSUPP; 6993 goto done; 6994 } 6995 6996 switch (chan->state) { 6997 case BT_CONNECT: 6998 case BT_CONNECT2: 6999 case BT_CONFIG: 7000 /* Already connecting */ 7001 err = 0; 7002 goto done; 7003 7004 case BT_CONNECTED: 7005 /* Already connected */ 7006 err = -EISCONN; 7007 goto done; 7008 7009 case BT_OPEN: 7010 case BT_BOUND: 7011 /* Can connect */ 7012 break; 7013 7014 default: 7015 err = -EBADFD; 7016 goto done; 7017 } 7018 7019 /* Set destination address and psm */ 7020 bacpy(&chan->dst, dst); 7021 chan->dst_type = dst_type; 7022 7023 chan->psm = psm; 7024 chan->dcid = cid; 7025 7026 if (bdaddr_type_is_le(dst_type)) { 7027 /* Convert from L2CAP channel address type to HCI address type 7028 */ 7029 if (dst_type == BDADDR_LE_PUBLIC) 7030 dst_type = ADDR_LE_DEV_PUBLIC; 7031 else 7032 dst_type = ADDR_LE_DEV_RANDOM; 7033 7034 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7035 hcon = hci_connect_le(hdev, dst, dst_type, false, 7036 chan->sec_level, timeout, 7037 HCI_ROLE_SLAVE, 0, 0); 7038 else 7039 hcon = hci_connect_le_scan(hdev, dst, dst_type, 7040 chan->sec_level, timeout, 7041 CONN_REASON_L2CAP_CHAN); 7042 7043 } else { 7044 u8 auth_type = l2cap_get_auth_type(chan); 7045 hcon = hci_connect_acl(hdev, dst, chan->sec_level, auth_type, 7046 CONN_REASON_L2CAP_CHAN, timeout); 7047 } 7048 7049 if (IS_ERR(hcon)) { 7050 err = PTR_ERR(hcon); 7051 goto done; 7052 } 7053 7054 conn = l2cap_conn_add(hcon); 7055 if (!conn) { 7056 hci_conn_drop(hcon); 7057 err = -ENOMEM; 7058 goto done; 7059 } 7060 7061 if (chan->mode == L2CAP_MODE_EXT_FLOWCTL) { 7062 struct l2cap_chan_data data; 7063 7064 data.chan = chan; 7065 data.pid = chan->ops->get_peer_pid(chan); 7066 data.count = 1; 7067 7068 l2cap_chan_list(conn, l2cap_chan_by_pid, &data); 7069 7070 /* Check if there isn't too many channels being connected */ 7071 if (data.count > L2CAP_ECRED_CONN_SCID_MAX) { 7072 hci_conn_drop(hcon); 7073 err = -EPROTO; 7074 goto done; 7075 } 7076 } 7077 7078 mutex_lock(&conn->lock); 7079 l2cap_chan_lock(chan); 7080 7081 if (cid && __l2cap_get_chan_by_dcid(conn, cid)) { 7082 hci_conn_drop(hcon); 7083 err = -EBUSY; 7084 goto chan_unlock; 7085 } 7086 7087 /* Update source addr of the socket */ 7088 bacpy(&chan->src, &hcon->src); 7089 chan->src_type = bdaddr_src_type(hcon); 7090 7091 __l2cap_chan_add(conn, chan); 7092 7093 /* l2cap_chan_add takes its own ref so we can drop this one */ 7094 hci_conn_drop(hcon); 7095 7096 l2cap_state_change(chan, BT_CONNECT); 7097 __set_chan_timer(chan, chan->ops->get_sndtimeo(chan)); 7098 7099 /* Release chan->sport so that it can be reused by other 7100 * sockets (as it's only used for listening sockets). 7101 */ 7102 write_lock(&chan_list_lock); 7103 chan->sport = 0; 7104 write_unlock(&chan_list_lock); 7105 7106 if (hcon->state == BT_CONNECTED) { 7107 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 7108 __clear_chan_timer(chan); 7109 if (l2cap_chan_check_security(chan, true)) 7110 l2cap_state_change(chan, BT_CONNECTED); 7111 } else 7112 l2cap_do_start(chan); 7113 } 7114 7115 err = 0; 7116 7117 chan_unlock: 7118 l2cap_chan_unlock(chan); 7119 mutex_unlock(&conn->lock); 7120 done: 7121 hci_dev_unlock(hdev); 7122 hci_dev_put(hdev); 7123 return err; 7124 } 7125 EXPORT_SYMBOL_GPL(l2cap_chan_connect); 7126 7127 static void l2cap_ecred_reconfigure(struct l2cap_chan *chan) 7128 { 7129 struct l2cap_conn *conn = chan->conn; 7130 DEFINE_RAW_FLEX(struct l2cap_ecred_reconf_req, pdu, scid, 1); 7131 7132 pdu->mtu = cpu_to_le16(chan->imtu); 7133 pdu->mps = cpu_to_le16(chan->mps); 7134 pdu->scid[0] = cpu_to_le16(chan->scid); 7135 7136 chan->ident = l2cap_get_ident(conn); 7137 7138 l2cap_send_cmd(conn, chan->ident, L2CAP_ECRED_RECONF_REQ, 7139 sizeof(pdu), &pdu); 7140 } 7141 7142 int l2cap_chan_reconfigure(struct l2cap_chan *chan, __u16 mtu) 7143 { 7144 if (chan->imtu > mtu) 7145 return -EINVAL; 7146 7147 BT_DBG("chan %p mtu 0x%4.4x", chan, mtu); 7148 7149 chan->imtu = mtu; 7150 7151 l2cap_ecred_reconfigure(chan); 7152 7153 return 0; 7154 } 7155 7156 /* ---- L2CAP interface with lower layer (HCI) ---- */ 7157 7158 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr) 7159 { 7160 int exact = 0, lm1 = 0, lm2 = 0; 7161 struct l2cap_chan *c; 7162 7163 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr); 7164 7165 /* Find listening sockets and check their link_mode */ 7166 read_lock(&chan_list_lock); 7167 list_for_each_entry(c, &chan_list, global_l) { 7168 if (c->state != BT_LISTEN) 7169 continue; 7170 7171 if (!bacmp(&c->src, &hdev->bdaddr)) { 7172 lm1 |= HCI_LM_ACCEPT; 7173 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 7174 lm1 |= HCI_LM_MASTER; 7175 exact++; 7176 } else if (!bacmp(&c->src, BDADDR_ANY)) { 7177 lm2 |= HCI_LM_ACCEPT; 7178 if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 7179 lm2 |= HCI_LM_MASTER; 7180 } 7181 } 7182 read_unlock(&chan_list_lock); 7183 7184 return exact ? lm1 : lm2; 7185 } 7186 7187 /* Find the next fixed channel in BT_LISTEN state, continue iteration 7188 * from an existing channel in the list or from the beginning of the 7189 * global list (by passing NULL as first parameter). 7190 */ 7191 static struct l2cap_chan *l2cap_global_fixed_chan(struct l2cap_chan *c, 7192 struct hci_conn *hcon) 7193 { 7194 u8 src_type = bdaddr_src_type(hcon); 7195 7196 read_lock(&chan_list_lock); 7197 7198 if (c) 7199 c = list_next_entry(c, global_l); 7200 else 7201 c = list_entry(chan_list.next, typeof(*c), global_l); 7202 7203 list_for_each_entry_from(c, &chan_list, global_l) { 7204 if (c->chan_type != L2CAP_CHAN_FIXED) 7205 continue; 7206 if (c->state != BT_LISTEN) 7207 continue; 7208 if (bacmp(&c->src, &hcon->src) && bacmp(&c->src, BDADDR_ANY)) 7209 continue; 7210 if (src_type != c->src_type) 7211 continue; 7212 7213 c = l2cap_chan_hold_unless_zero(c); 7214 read_unlock(&chan_list_lock); 7215 return c; 7216 } 7217 7218 read_unlock(&chan_list_lock); 7219 7220 return NULL; 7221 } 7222 7223 static void l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 7224 { 7225 struct hci_dev *hdev = hcon->hdev; 7226 struct l2cap_conn *conn; 7227 struct l2cap_chan *pchan; 7228 u8 dst_type; 7229 7230 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 7231 return; 7232 7233 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status); 7234 7235 if (status) { 7236 l2cap_conn_del(hcon, bt_to_errno(status)); 7237 return; 7238 } 7239 7240 conn = l2cap_conn_add(hcon); 7241 if (!conn) 7242 return; 7243 7244 dst_type = bdaddr_dst_type(hcon); 7245 7246 /* If device is blocked, do not create channels for it */ 7247 if (hci_bdaddr_list_lookup(&hdev->reject_list, &hcon->dst, dst_type)) 7248 return; 7249 7250 /* Find fixed channels and notify them of the new connection. We 7251 * use multiple individual lookups, continuing each time where 7252 * we left off, because the list lock would prevent calling the 7253 * potentially sleeping l2cap_chan_lock() function. 7254 */ 7255 pchan = l2cap_global_fixed_chan(NULL, hcon); 7256 while (pchan) { 7257 struct l2cap_chan *chan, *next; 7258 7259 /* Client fixed channels should override server ones */ 7260 if (__l2cap_get_chan_by_dcid(conn, pchan->scid)) 7261 goto next; 7262 7263 l2cap_chan_lock(pchan); 7264 chan = pchan->ops->new_connection(pchan); 7265 if (chan) { 7266 bacpy(&chan->src, &hcon->src); 7267 bacpy(&chan->dst, &hcon->dst); 7268 chan->src_type = bdaddr_src_type(hcon); 7269 chan->dst_type = dst_type; 7270 7271 __l2cap_chan_add(conn, chan); 7272 } 7273 7274 l2cap_chan_unlock(pchan); 7275 next: 7276 next = l2cap_global_fixed_chan(pchan, hcon); 7277 l2cap_chan_put(pchan); 7278 pchan = next; 7279 } 7280 7281 l2cap_conn_ready(conn); 7282 } 7283 7284 int l2cap_disconn_ind(struct hci_conn *hcon) 7285 { 7286 struct l2cap_conn *conn = hcon->l2cap_data; 7287 7288 BT_DBG("hcon %p", hcon); 7289 7290 if (!conn) 7291 return HCI_ERROR_REMOTE_USER_TERM; 7292 return conn->disc_reason; 7293 } 7294 7295 static void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 7296 { 7297 if (hcon->type != ACL_LINK && hcon->type != LE_LINK) 7298 return; 7299 7300 BT_DBG("hcon %p reason %d", hcon, reason); 7301 7302 l2cap_conn_del(hcon, bt_to_errno(reason)); 7303 } 7304 7305 static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 7306 { 7307 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 7308 return; 7309 7310 if (encrypt == 0x00) { 7311 if (chan->sec_level == BT_SECURITY_MEDIUM) { 7312 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT); 7313 } else if (chan->sec_level == BT_SECURITY_HIGH || 7314 chan->sec_level == BT_SECURITY_FIPS) 7315 l2cap_chan_close(chan, ECONNREFUSED); 7316 } else { 7317 if (chan->sec_level == BT_SECURITY_MEDIUM) 7318 __clear_chan_timer(chan); 7319 } 7320 } 7321 7322 static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 7323 { 7324 struct l2cap_conn *conn = hcon->l2cap_data; 7325 struct l2cap_chan *chan; 7326 7327 if (!conn) 7328 return; 7329 7330 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt); 7331 7332 mutex_lock(&conn->lock); 7333 7334 list_for_each_entry(chan, &conn->chan_l, list) { 7335 l2cap_chan_lock(chan); 7336 7337 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid, 7338 state_to_string(chan->state)); 7339 7340 if (!status && encrypt) 7341 chan->sec_level = hcon->sec_level; 7342 7343 if (!__l2cap_no_conn_pending(chan)) { 7344 l2cap_chan_unlock(chan); 7345 continue; 7346 } 7347 7348 if (!status && (chan->state == BT_CONNECTED || 7349 chan->state == BT_CONFIG)) { 7350 chan->ops->resume(chan); 7351 l2cap_check_encryption(chan, encrypt); 7352 l2cap_chan_unlock(chan); 7353 continue; 7354 } 7355 7356 if (chan->state == BT_CONNECT) { 7357 if (!status && l2cap_check_enc_key_size(hcon, chan)) 7358 l2cap_start_connection(chan); 7359 else 7360 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 7361 } else if (chan->state == BT_CONNECT2 && 7362 !(chan->mode == L2CAP_MODE_EXT_FLOWCTL || 7363 chan->mode == L2CAP_MODE_LE_FLOWCTL)) { 7364 struct l2cap_conn_rsp rsp; 7365 __u16 res, stat; 7366 7367 if (!status && l2cap_check_enc_key_size(hcon, chan)) { 7368 if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) { 7369 res = L2CAP_CR_PEND; 7370 stat = L2CAP_CS_AUTHOR_PEND; 7371 chan->ops->defer(chan); 7372 } else { 7373 l2cap_state_change(chan, BT_CONFIG); 7374 res = L2CAP_CR_SUCCESS; 7375 stat = L2CAP_CS_NO_INFO; 7376 } 7377 } else { 7378 l2cap_state_change(chan, BT_DISCONN); 7379 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 7380 res = L2CAP_CR_SEC_BLOCK; 7381 stat = L2CAP_CS_NO_INFO; 7382 } 7383 7384 rsp.scid = cpu_to_le16(chan->dcid); 7385 rsp.dcid = cpu_to_le16(chan->scid); 7386 rsp.result = cpu_to_le16(res); 7387 rsp.status = cpu_to_le16(stat); 7388 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 7389 sizeof(rsp), &rsp); 7390 7391 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) && 7392 res == L2CAP_CR_SUCCESS) { 7393 char buf[128]; 7394 set_bit(CONF_REQ_SENT, &chan->conf_state); 7395 l2cap_send_cmd(conn, l2cap_get_ident(conn), 7396 L2CAP_CONF_REQ, 7397 l2cap_build_conf_req(chan, buf, sizeof(buf)), 7398 buf); 7399 chan->num_conf_req++; 7400 } 7401 } 7402 7403 l2cap_chan_unlock(chan); 7404 } 7405 7406 mutex_unlock(&conn->lock); 7407 } 7408 7409 /* Append fragment into frame respecting the maximum len of rx_skb */ 7410 static int l2cap_recv_frag(struct l2cap_conn *conn, struct sk_buff *skb, 7411 u16 len) 7412 { 7413 if (!conn->rx_skb) { 7414 /* Allocate skb for the complete frame (with header) */ 7415 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL); 7416 if (!conn->rx_skb) 7417 return -ENOMEM; 7418 /* Init rx_len */ 7419 conn->rx_len = len; 7420 7421 skb_set_delivery_time(conn->rx_skb, skb->tstamp, 7422 skb->tstamp_type); 7423 } 7424 7425 /* Copy as much as the rx_skb can hold */ 7426 len = min_t(u16, len, skb->len); 7427 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, len), len); 7428 skb_pull(skb, len); 7429 conn->rx_len -= len; 7430 7431 return len; 7432 } 7433 7434 static int l2cap_recv_len(struct l2cap_conn *conn, struct sk_buff *skb) 7435 { 7436 struct sk_buff *rx_skb; 7437 int len; 7438 7439 /* Append just enough to complete the header */ 7440 len = l2cap_recv_frag(conn, skb, L2CAP_LEN_SIZE - conn->rx_skb->len); 7441 7442 /* If header could not be read just continue */ 7443 if (len < 0 || conn->rx_skb->len < L2CAP_LEN_SIZE) 7444 return len; 7445 7446 rx_skb = conn->rx_skb; 7447 len = get_unaligned_le16(rx_skb->data); 7448 7449 /* Check if rx_skb has enough space to received all fragments */ 7450 if (len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE) <= skb_tailroom(rx_skb)) { 7451 /* Update expected len */ 7452 conn->rx_len = len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE); 7453 return L2CAP_LEN_SIZE; 7454 } 7455 7456 /* Reset conn->rx_skb since it will need to be reallocated in order to 7457 * fit all fragments. 7458 */ 7459 conn->rx_skb = NULL; 7460 7461 /* Reallocates rx_skb using the exact expected length */ 7462 len = l2cap_recv_frag(conn, rx_skb, 7463 len + (L2CAP_HDR_SIZE - L2CAP_LEN_SIZE)); 7464 kfree_skb(rx_skb); 7465 7466 return len; 7467 } 7468 7469 static void l2cap_recv_reset(struct l2cap_conn *conn) 7470 { 7471 kfree_skb(conn->rx_skb); 7472 conn->rx_skb = NULL; 7473 conn->rx_len = 0; 7474 } 7475 7476 struct l2cap_conn *l2cap_conn_hold_unless_zero(struct l2cap_conn *c) 7477 { 7478 if (!c) 7479 return NULL; 7480 7481 BT_DBG("conn %p orig refcnt %u", c, kref_read(&c->ref)); 7482 7483 if (!kref_get_unless_zero(&c->ref)) 7484 return NULL; 7485 7486 return c; 7487 } 7488 7489 void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) 7490 { 7491 struct l2cap_conn *conn; 7492 int len; 7493 7494 /* Lock hdev to access l2cap_data to avoid race with l2cap_conn_del */ 7495 hci_dev_lock(hcon->hdev); 7496 7497 conn = hcon->l2cap_data; 7498 7499 if (!conn) 7500 conn = l2cap_conn_add(hcon); 7501 7502 conn = l2cap_conn_hold_unless_zero(conn); 7503 7504 hci_dev_unlock(hcon->hdev); 7505 7506 if (!conn) { 7507 kfree_skb(skb); 7508 return; 7509 } 7510 7511 BT_DBG("conn %p len %u flags 0x%x", conn, skb->len, flags); 7512 7513 mutex_lock(&conn->lock); 7514 7515 switch (flags) { 7516 case ACL_START: 7517 case ACL_START_NO_FLUSH: 7518 case ACL_COMPLETE: 7519 if (conn->rx_skb) { 7520 BT_ERR("Unexpected start frame (len %d)", skb->len); 7521 l2cap_recv_reset(conn); 7522 l2cap_conn_unreliable(conn, ECOMM); 7523 } 7524 7525 /* Start fragment may not contain the L2CAP length so just 7526 * copy the initial byte when that happens and use conn->mtu as 7527 * expected length. 7528 */ 7529 if (skb->len < L2CAP_LEN_SIZE) { 7530 l2cap_recv_frag(conn, skb, conn->mtu); 7531 break; 7532 } 7533 7534 len = get_unaligned_le16(skb->data) + L2CAP_HDR_SIZE; 7535 7536 if (len == skb->len) { 7537 /* Complete frame received */ 7538 l2cap_recv_frame(conn, skb); 7539 goto unlock; 7540 } 7541 7542 BT_DBG("Start: total len %d, frag len %u", len, skb->len); 7543 7544 if (skb->len > len) { 7545 BT_ERR("Frame is too long (len %u, expected len %d)", 7546 skb->len, len); 7547 /* PTS test cases L2CAP/COS/CED/BI-14-C and BI-15-C 7548 * (Multiple Signaling Command in one PDU, Data 7549 * Truncated, BR/EDR) send a C-frame to the IUT with 7550 * PDU Length set to 8 and Channel ID set to the 7551 * correct signaling channel for the logical link. 7552 * The Information payload contains one L2CAP_ECHO_REQ 7553 * packet with Data Length set to 0 with 0 octets of 7554 * echo data and one invalid command packet due to 7555 * data truncated in PDU but present in HCI packet. 7556 * 7557 * Shorter the socket buffer to the PDU length to 7558 * allow to process valid commands from the PDU before 7559 * setting the socket unreliable. 7560 */ 7561 skb->len = len; 7562 l2cap_recv_frame(conn, skb); 7563 l2cap_conn_unreliable(conn, ECOMM); 7564 goto unlock; 7565 } 7566 7567 /* Append fragment into frame (with header) */ 7568 if (l2cap_recv_frag(conn, skb, len) < 0) 7569 goto drop; 7570 7571 break; 7572 7573 case ACL_CONT: 7574 BT_DBG("Cont: frag len %u (expecting %u)", skb->len, conn->rx_len); 7575 7576 if (!conn->rx_skb) { 7577 BT_ERR("Unexpected continuation frame (len %d)", skb->len); 7578 l2cap_conn_unreliable(conn, ECOMM); 7579 goto drop; 7580 } 7581 7582 /* Complete the L2CAP length if it has not been read */ 7583 if (conn->rx_skb->len < L2CAP_LEN_SIZE) { 7584 if (l2cap_recv_len(conn, skb) < 0) { 7585 l2cap_conn_unreliable(conn, ECOMM); 7586 goto drop; 7587 } 7588 7589 /* Header still could not be read just continue */ 7590 if (conn->rx_skb->len < L2CAP_LEN_SIZE) 7591 break; 7592 } 7593 7594 if (skb->len > conn->rx_len) { 7595 BT_ERR("Fragment is too long (len %u, expected %u)", 7596 skb->len, conn->rx_len); 7597 l2cap_recv_reset(conn); 7598 l2cap_conn_unreliable(conn, ECOMM); 7599 goto drop; 7600 } 7601 7602 /* Append fragment into frame (with header) */ 7603 l2cap_recv_frag(conn, skb, skb->len); 7604 7605 if (!conn->rx_len) { 7606 /* Complete frame received. l2cap_recv_frame 7607 * takes ownership of the skb so set the global 7608 * rx_skb pointer to NULL first. 7609 */ 7610 struct sk_buff *rx_skb = conn->rx_skb; 7611 conn->rx_skb = NULL; 7612 l2cap_recv_frame(conn, rx_skb); 7613 } 7614 break; 7615 } 7616 7617 drop: 7618 kfree_skb(skb); 7619 unlock: 7620 mutex_unlock(&conn->lock); 7621 l2cap_conn_put(conn); 7622 } 7623 7624 static struct hci_cb l2cap_cb = { 7625 .name = "L2CAP", 7626 .connect_cfm = l2cap_connect_cfm, 7627 .disconn_cfm = l2cap_disconn_cfm, 7628 .security_cfm = l2cap_security_cfm, 7629 }; 7630 7631 static int l2cap_debugfs_show(struct seq_file *f, void *p) 7632 { 7633 struct l2cap_chan *c; 7634 7635 read_lock(&chan_list_lock); 7636 7637 list_for_each_entry(c, &chan_list, global_l) { 7638 seq_printf(f, "%pMR (%u) %pMR (%u) %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 7639 &c->src, c->src_type, &c->dst, c->dst_type, 7640 c->state, __le16_to_cpu(c->psm), 7641 c->scid, c->dcid, c->imtu, c->omtu, 7642 c->sec_level, c->mode); 7643 } 7644 7645 read_unlock(&chan_list_lock); 7646 7647 return 0; 7648 } 7649 7650 DEFINE_SHOW_ATTRIBUTE(l2cap_debugfs); 7651 7652 static struct dentry *l2cap_debugfs; 7653 7654 int __init l2cap_init(void) 7655 { 7656 int err; 7657 7658 err = l2cap_init_sockets(); 7659 if (err < 0) 7660 return err; 7661 7662 hci_register_cb(&l2cap_cb); 7663 7664 if (IS_ERR_OR_NULL(bt_debugfs)) 7665 return 0; 7666 7667 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs, 7668 NULL, &l2cap_debugfs_fops); 7669 7670 return 0; 7671 } 7672 7673 void l2cap_exit(void) 7674 { 7675 debugfs_remove(l2cap_debugfs); 7676 hci_unregister_cb(&l2cap_cb); 7677 l2cap_cleanup_sockets(); 7678 } 7679 7680 module_param(disable_ertm, bool, 0644); 7681 MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 7682 7683 module_param(enable_ecred, bool, 0644); 7684 MODULE_PARM_DESC(enable_ecred, "Enable enhanced credit flow control mode"); 7685