projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add L2CAP create channel request handling
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
1da177e4
LT		 35
36#include <net/bluetooth/bluetooth.h>
37#include <net/bluetooth/hci_core.h>
38#include <net/bluetooth/l2cap.h>
b501d6a1 39#include <net/bluetooth/smp.h>
97e8e89d 40#include <net/bluetooth/a2mp.h>
1da177e4 41
d1de6d46 42bool disable_ertm;
f0709e03 43
47ec1dcd 44static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 45static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 46
b5ad8b7f
JB		 47static LIST_HEAD(chan_list);
48static DEFINE_RWLOCK(chan_list_lock);
1da177e4 49
1da177e4 50static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 51 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 52static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 53 void *data);
710f9b0a 54static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a 55static void l2cap_send_disconn_req(struct l2cap_conn *conn,
c5daa683 56 struct l2cap_chan *chan, int err);
1da177e4 57
d660366d 58static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 59 struct sk_buff_head *skbs, u8 event);
608bcc6d 60
0139418c 61/* ---- L2CAP channels ---- */
71ba0e56 62
2d792818
GP		 63static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
64 u16 cid)
0139418c 65{
3df91ea2 66 struct l2cap_chan *c;
3d57dc68 67
3df91ea2
AE		 68 list_for_each_entry(c, &conn->chan_l, list) {
69 if (c->dcid == cid)
70 return c;
0139418c 71 }
3df91ea2 72 return NULL;
0139418c
MH		 73}
74
2d792818
GP		 75static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
76 u16 cid)
0139418c 77{
3df91ea2 78 struct l2cap_chan *c;
3d57dc68 79
3df91ea2
AE		 80 list_for_each_entry(c, &conn->chan_l, list) {
81 if (c->scid == cid)
82 return c;
0139418c 83 }
3df91ea2 84 return NULL;
0139418c
MH		 85}
86
87/* Find channel with given SCID.
ef191ade 88 * Returns locked channel. */
2d792818
GP		 89static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
90 u16 cid)
0139418c 91{
48454079 92 struct l2cap_chan *c;
baa7e1fa 93
3df91ea2 94 mutex_lock(&conn->chan_lock);
baa7e1fa 95 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 96 if (c)
97 l2cap_chan_lock(c);
3df91ea2
AE		 98 mutex_unlock(&conn->chan_lock);
99
48454079 100 return c;
0139418c
MH		 101}
102
2d792818
GP		 103static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
104 u8 ident)
0139418c 105{
3df91ea2 106 struct l2cap_chan *c;
3d57dc68 107
3df91ea2
AE		 108 list_for_each_entry(c, &conn->chan_l, list) {
109 if (c->ident == ident)
110 return c;
0139418c 111 }
3df91ea2 112 return NULL;
0139418c
MH		 113}
114
23691d75 115static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 116{
23691d75 117 struct l2cap_chan *c;
9e4425ff 118
23691d75
GP		 119 list_for_each_entry(c, &chan_list, global_l) {
120 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 121 return c;
9e4425ff 122 }
250938cb 123 return NULL;
9e4425ff
GP		 124}
125
126int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
127{
73b2ec18
GP		 128 int err;
129
333055f2 130 write_lock(&chan_list_lock);
9e4425ff 131
23691d75 132 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 133 err = -EADDRINUSE;
134 goto done;
9e4425ff
GP		 135 }
136
73b2ec18
GP		 137 if (psm) {
138 chan->psm = psm;
139 chan->sport = psm;
140 err = 0;
141 } else {
142 u16 p;
143
144 err = -EINVAL;
145 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 146 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 147 chan->psm = cpu_to_le16(p);
148 chan->sport = cpu_to_le16(p);
149 err = 0;
150 break;
151 }
152 }
9e4425ff 153
73b2ec18 154done:
333055f2 155 write_unlock(&chan_list_lock);
73b2ec18 156 return err;
9e4425ff
GP		 157}
158
159int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
160{
333055f2 161 write_lock(&chan_list_lock);
9e4425ff
GP		 162
163 chan->scid = scid;
164
333055f2 165 write_unlock(&chan_list_lock);
9e4425ff
GP		 166
167 return 0;
168}
169
baa7e1fa 170static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 171{
8db4dc46 172 u16 cid = L2CAP_CID_DYN_START;
0139418c 173
8db4dc46 174 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 175 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 176 return cid;
177 }
178
179 return 0;
180}
181
0e587be7 182static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 183{
42d2d87c 184 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 185 state_to_string(state));
badaaa00 186
89bc500e 187 chan->state = state;
80b98027 188 chan->ops->state_change(chan, state);
89bc500e
GP		 189}
190
0e587be7
AE		 191static void l2cap_state_change(struct l2cap_chan *chan, int state)
192{
193 struct sock *sk = chan->sk;
194
195 lock_sock(sk);
196 __l2cap_state_change(chan, state);
197 release_sock(sk);
198}
199
2e0052e4
AE		 200static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
201{
202 struct sock *sk = chan->sk;
203
204 sk->sk_err = err;
205}
206
207static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
208{
209 struct sock *sk = chan->sk;
210
211 lock_sock(sk);
212 __l2cap_chan_set_err(chan, err);
213 release_sock(sk);
214}
215
4239d16f
MM		 216static void __set_retrans_timer(struct l2cap_chan *chan)
217{
218 if (!delayed_work_pending(&chan->monitor_timer) &&
219 chan->retrans_timeout) {
220 l2cap_set_timer(chan, &chan->retrans_timer,
221 msecs_to_jiffies(chan->retrans_timeout));
222 }
223}
224
225static void __set_monitor_timer(struct l2cap_chan *chan)
226{
227 __clear_retrans_timer(chan);
228 if (chan->monitor_timeout) {
229 l2cap_set_timer(chan, &chan->monitor_timer,
230 msecs_to_jiffies(chan->monitor_timeout));
231 }
232}
233
608bcc6d
MM		 234static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
235 u16 seq)
236{
237 struct sk_buff *skb;
238
239 skb_queue_walk(head, skb) {
240 if (bt_cb(skb)->control.txseq == seq)
241 return skb;
242 }
243
244 return NULL;
245}
246
3c588192
MM		 247/* ---- L2CAP sequence number lists ---- */
248
249/* For ERTM, ordered lists of sequence numbers must be tracked for
250 * SREJ requests that are received and for frames that are to be
251 * retransmitted. These seq_list functions implement a singly-linked
252 * list in an array, where membership in the list can also be checked
253 * in constant time. Items can also be added to the tail of the list
254 * and removed from the head in constant time, without further memory
255 * allocs or frees.
256 */
257
258static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
259{
260 size_t alloc_size, i;
261
262 /* Allocated size is a power of 2 to map sequence numbers
263 * (which may be up to 14 bits) in to a smaller array that is
264 * sized for the negotiated ERTM transmit windows.
265 */
266 alloc_size = roundup_pow_of_two(size);
267
268 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
269 if (!seq_list->list)
270 return -ENOMEM;
271
272 seq_list->mask = alloc_size - 1;
273 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
274 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
275 for (i = 0; i < alloc_size; i++)
276 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
277
278 return 0;
279}
280
281static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
282{
283 kfree(seq_list->list);
284}
285
286static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
287 u16 seq)
288{
289 /* Constant-time check for list membership */
290 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
291}
292
293static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
294{
295 u16 mask = seq_list->mask;
296
297 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
298 /* In case someone tries to pop the head of an empty list */
299 return L2CAP_SEQ_LIST_CLEAR;
300 } else if (seq_list->head == seq) {
301 /* Head can be removed in constant time */
302 seq_list->head = seq_list->list[seq & mask];
303 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
304
305 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
306 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
307 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
308 }
309 } else {
310 /* Walk the list to find the sequence number */
311 u16 prev = seq_list->head;
312 while (seq_list->list[prev & mask] != seq) {
313 prev = seq_list->list[prev & mask];
314 if (prev == L2CAP_SEQ_LIST_TAIL)
315 return L2CAP_SEQ_LIST_CLEAR;
316 }
317
318 /* Unlink the number from the list and clear it */
319 seq_list->list[prev & mask] = seq_list->list[seq & mask];
320 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
321 if (seq_list->tail == seq)
322 seq_list->tail = prev;
323 }
324 return seq;
325}
326
327static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
328{
329 /* Remove the head in constant time */
330 return l2cap_seq_list_remove(seq_list, seq_list->head);
331}
332
333static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
334{
f522ae36 335 u16 i;
3c588192 336
f522ae36
GP		 337 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
338 return;
339
340 for (i = 0; i <= seq_list->mask; i++)
341 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
342
343 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
344 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 345}
346
347static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
348{
349 u16 mask = seq_list->mask;
350
351 /* All appends happen in constant time */
352
f522ae36
GP		 353 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
354 return;
3c588192 355
f522ae36
GP		 356 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
357 seq_list->head = seq;
358 else
359 seq_list->list[seq_list->tail & mask] = seq;
360
361 seq_list->tail = seq;
362 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 363}
364
721c4181 365static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 366{
721c4181 367 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 368 chan_timer.work);
3df91ea2 369 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 370 int reason;
371
e05dcc32 372 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 373
3df91ea2 374 mutex_lock(&conn->chan_lock);
6be36555 375 l2cap_chan_lock(chan);
ab07801d 376
89bc500e 377 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 378 reason = ECONNREFUSED;
89bc500e 379 else if (chan->state == BT_CONNECT &&
2d792818 380 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 381 reason = ECONNREFUSED;
382 else
383 reason = ETIMEDOUT;
384
0f852724 385 l2cap_chan_close(chan, reason);
ab07801d 386
6be36555 387 l2cap_chan_unlock(chan);
ab07801d 388
80b98027 389 chan->ops->close(chan);
3df91ea2
AE		 390 mutex_unlock(&conn->chan_lock);
391
371fd835 392 l2cap_chan_put(chan);
ab07801d
GP		 393}
394
eef1d9b6 395struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 396{
397 struct l2cap_chan *chan;
398
399 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
400 if (!chan)
401 return NULL;
402
c03b355e
AE		 403 mutex_init(&chan->lock);
404
333055f2 405 write_lock(&chan_list_lock);
23691d75 406 list_add(&chan->global_l, &chan_list);
333055f2 407 write_unlock(&chan_list_lock);
23691d75 408
721c4181 409 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 410
89bc500e
GP		 411 chan->state = BT_OPEN;
412
144ad330 413 kref_init(&chan->kref);
71ba0e56 414
2827011f
MM		 415 /* This flag is cleared in l2cap_chan_ready() */
416 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
417
eef1d9b6 418 BT_DBG("chan %p", chan);
abc545b8 419
48454079
GP		 420 return chan;
421}
422
144ad330 423static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 424{
144ad330
SS		 425 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
426
4af66c69
JK		 427 BT_DBG("chan %p", chan);
428
333055f2 429 write_lock(&chan_list_lock);
23691d75 430 list_del(&chan->global_l);
333055f2 431 write_unlock(&chan_list_lock);
23691d75 432
4af66c69 433 kfree(chan);
6ff5abbf
GP		 434}
435
30648372
JK		 436void l2cap_chan_hold(struct l2cap_chan *c)
437{
144ad330 438 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 439
144ad330 440 kref_get(&c->kref);
30648372
JK		 441}
442
443void l2cap_chan_put(struct l2cap_chan *c)
444{
144ad330 445 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 446
144ad330 447 kref_put(&c->kref, l2cap_chan_destroy);
30648372
JK		 448}
449
bd4b1653
AE		 450void l2cap_chan_set_defaults(struct l2cap_chan *chan)
451{
452 chan->fcs = L2CAP_FCS_CRC16;
453 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
454 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
455 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
c20f8e35 456 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653
AE		 457 chan->sec_level = BT_SECURITY_LOW;
458
459 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
460}
461
93c3e8f5 462void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 463{
af05b30b 464 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 465 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 466
9f5a0d7b 467 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 468
8c1d787b 469 chan->conn = conn;
0139418c 470
5491120e
AE		 471 switch (chan->chan_type) {
472 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 473 if (conn->hcon->type == LE_LINK) {
474 /* LE connection */
6fcb06a2 475 chan->omtu = L2CAP_DEFAULT_MTU;
fe4128e0
GP		 476 chan->scid = L2CAP_CID_LE_DATA;
477 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 478 } else {
479 /* Alloc CID for connection-oriented socket */
fe4128e0 480 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 481 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 482 }
5491120e
AE		 483 break;
484
485 case L2CAP_CHAN_CONN_LESS:
0139418c 486 /* Connectionless socket */
fe4128e0
GP		 487 chan->scid = L2CAP_CID_CONN_LESS;
488 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 489 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 490 break;
491
416fa752
AE		 492 case L2CAP_CHAN_CONN_FIX_A2MP:
493 chan->scid = L2CAP_CID_A2MP;
494 chan->dcid = L2CAP_CID_A2MP;
495 chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
496 chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
497 break;
498
5491120e 499 default:
0139418c 500 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 501 chan->scid = L2CAP_CID_SIGNALING;
502 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 503 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 504 }
505
8f7975b1
AE		 506 chan->local_id = L2CAP_BESTEFFORT_ID;
507 chan->local_stype = L2CAP_SERV_BESTEFFORT;
508 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
509 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
510 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 511 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 512
371fd835 513 l2cap_chan_hold(chan);
baa7e1fa 514
3df91ea2 515 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 516}
517
466f8004 518void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 519{
520 mutex_lock(&conn->chan_lock);
521 __l2cap_chan_add(conn, chan);
3df91ea2 522 mutex_unlock(&conn->chan_lock);
0139418c
MH		 523}
524
466f8004 525void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 526{
8c1d787b 527 struct l2cap_conn *conn = chan->conn;
0139418c 528
c9b66675 529 __clear_chan_timer(chan);
0139418c 530
49208c9c 531 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 532
8e87d142 533 if (conn) {
56f60984 534 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 535 /* Delete from channel list */
3df91ea2 536 list_del(&chan->list);
3d57dc68 537
371fd835 538 l2cap_chan_put(chan);
baa7e1fa 539
8c1d787b 540 chan->conn = NULL;
3cabbfda
AE		 541
542 if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
543 hci_conn_put(conn->hcon);
56f60984
AE		 544
545 if (mgr && mgr->bredr_chan == chan)
546 mgr->bredr_chan = NULL;
0139418c
MH		 547 }
548
b699ec0d 549 chan->ops->teardown(chan, err);
6be36555 550
2827011f 551 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 552 return;
2ead70b8 553
ee556f66
GP		 554 switch(chan->mode) {
555 case L2CAP_MODE_BASIC:
556 break;
c13ffa62 557
ee556f66 558 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 559 __clear_retrans_timer(chan);
560 __clear_monitor_timer(chan);
561 __clear_ack_timer(chan);
c13ffa62 562
f1c6775b 563 skb_queue_purge(&chan->srej_q);
c13ffa62 564
3c588192
MM		 565 l2cap_seq_list_free(&chan->srej_list);
566 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 567
568 /* fall through */
569
570 case L2CAP_MODE_STREAMING:
571 skb_queue_purge(&chan->tx_q);
572 break;
c13ffa62 573 }
ee556f66
GP		 574
575 return;
0139418c
MH		 576}
577
0f852724 578void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 579{
580 struct l2cap_conn *conn = chan->conn;
581 struct sock *sk = chan->sk;
582
2d792818
GP		 583 BT_DBG("chan %p state %s sk %p", chan, state_to_string(chan->state),
584 sk);
4519de9a 585
89bc500e 586 switch (chan->state) {
4519de9a 587 case BT_LISTEN:
b699ec0d 588 chan->ops->teardown(chan, 0);
4519de9a
GP		 589 break;
590
591 case BT_CONNECTED:
592 case BT_CONFIG:
715ec005 593 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
2d792818 594 conn->hcon->type == ACL_LINK) {
c9b66675 595 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 596 l2cap_send_disconn_req(conn, chan, reason);
597 } else
598 l2cap_chan_del(chan, reason);
599 break;
600
601 case BT_CONNECT2:
715ec005 602 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
2d792818 603 conn->hcon->type == ACL_LINK) {
4519de9a
GP		 604 struct l2cap_conn_rsp rsp;
605 __u16 result;
606
c5daa683 607 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
4519de9a
GP		 608 result = L2CAP_CR_SEC_BLOCK;
609 else
610 result = L2CAP_CR_BAD_PSM;
89bc500e 611 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 612
613 rsp.scid = cpu_to_le16(chan->dcid);
614 rsp.dcid = cpu_to_le16(chan->scid);
615 rsp.result = cpu_to_le16(result);
ac73498c 616 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4519de9a 617 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 618 sizeof(rsp), &rsp);
4519de9a
GP		 619 }
620
621 l2cap_chan_del(chan, reason);
622 break;
623
624 case BT_CONNECT:
625 case BT_DISCONN:
626 l2cap_chan_del(chan, reason);
627 break;
628
629 default:
b699ec0d 630 chan->ops->teardown(chan, 0);
4519de9a
GP		 631 break;
632 }
633}
634
4343478f 635static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 636{
715ec005 637 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 638 switch (chan->sec_level) {
8556edd3
JH		 639 case BT_SECURITY_HIGH:
640 return HCI_AT_DEDICATED_BONDING_MITM;
641 case BT_SECURITY_MEDIUM:
642 return HCI_AT_DEDICATED_BONDING;
643 default:
644 return HCI_AT_NO_BONDING;
645 }
2983fd68 646 } else if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
4343478f
GP		 647 if (chan->sec_level == BT_SECURITY_LOW)
648 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 649
4343478f 650 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 651 return HCI_AT_NO_BONDING_MITM;
00ae4af9 652 else
8556edd3 653 return HCI_AT_NO_BONDING;
00ae4af9 654 } else {
4343478f 655 switch (chan->sec_level) {
00ae4af9 656 case BT_SECURITY_HIGH:
8556edd3 657 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 658 case BT_SECURITY_MEDIUM:
8556edd3 659 return HCI_AT_GENERAL_BONDING;
00ae4af9 660 default:
8556edd3 661 return HCI_AT_NO_BONDING;
00ae4af9 662 }
0684e5f9 663 }
8556edd3
JH		 664}
665
666/* Service level security */
d45fc423 667int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 668{
8c1d787b 669 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 670 __u8 auth_type;
671
4343478f 672 auth_type = l2cap_get_auth_type(chan);
79d554a6 673
4343478f 674 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 675}
676
b5ad8b7f 677static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 678{
679 u8 id;
680
681 /* Get next available identificator.
682 * 1 - 128 are used by kernel.
683 * 129 - 199 are reserved.
684 * 200 - 254 are used by utilities like l2ping, etc.
685 */
686
333055f2 687 spin_lock(&conn->lock);
4e8402a3
MH		 688
689 if (++conn->tx_ident > 128)
690 conn->tx_ident = 1;
691
692 id = conn->tx_ident;
693
333055f2 694 spin_unlock(&conn->lock);
4e8402a3
MH		 695
696 return id;
697}
698
2d792818
GP		 699static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
700 void *data)
4e8402a3
MH		 701{
702 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 703 u8 flags;
4e8402a3
MH		 704
705 BT_DBG("code 0x%2.2x", code);
706
707 if (!skb)
9a9c6a34 708 return;
4e8402a3 709
e702112f
AE		 710 if (lmp_no_flush_capable(conn->hcon->hdev))
711 flags = ACL_START_NO_FLUSH;
712 else
713 flags = ACL_START;
714
14b12d0b 715 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 716 skb->priority = HCI_PRIO_MAX;
14b12d0b 717
73d80deb
LAD		 718 hci_send_acl(conn->hchan, skb, flags);
719}
720
721static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
722{
723 struct hci_conn *hcon = chan->conn->hcon;
724 u16 flags;
725
726 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 727 skb->priority);
73d80deb
LAD		 728
729 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
2d792818 730 lmp_no_flush_capable(hcon->hdev))
73d80deb
LAD		 731 flags = ACL_START_NO_FLUSH;
732 else
733 flags = ACL_START;
14b12d0b 734
73d80deb
LAD		 735 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
736 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 737}
738
b76bbd66
MM		 739static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
740{
741 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
742 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
743
744 if (enh & L2CAP_CTRL_FRAME_TYPE) {
745 /* S-Frame */
746 control->sframe = 1;
747 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
748 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
749
750 control->sar = 0;
751 control->txseq = 0;
752 } else {
753 /* I-Frame */
754 control->sframe = 0;
755 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
756 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
757
758 control->poll = 0;
759 control->super = 0;
760 }
761}
762
b76bbd66
MM		 763static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
764{
765 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
766 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
767
768 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
769 /* S-Frame */
770 control->sframe = 1;
771 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
772 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
773
774 control->sar = 0;
775 control->txseq = 0;
776 } else {
777 /* I-Frame */
778 control->sframe = 0;
779 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
780 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
781
782 control->poll = 0;
783 control->super = 0;
784 }
785}
786
787static inline void __unpack_control(struct l2cap_chan *chan,
788 struct sk_buff *skb)
789{
790 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
791 __unpack_extended_control(get_unaligned_le32(skb->data),
792 &bt_cb(skb)->control);
cec8ab6e 793 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 794 } else {
795 __unpack_enhanced_control(get_unaligned_le16(skb->data),
796 &bt_cb(skb)->control);
cec8ab6e 797 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 798 }
799}
800
b5c6aaed
MM		 801static u32 __pack_extended_control(struct l2cap_ctrl *control)
802{
803 u32 packed;
804
805 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
806 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
807
808 if (control->sframe) {
809 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
810 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
811 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
812 } else {
813 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
814 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
815 }
816
817 return packed;
818}
819
820static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
821{
822 u16 packed;
823
824 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
825 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
826
827 if (control->sframe) {
828 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
829 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
830 packed |= L2CAP_CTRL_FRAME_TYPE;
831 } else {
832 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
833 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
834 }
835
836 return packed;
837}
838
b76bbd66
MM		 839static inline void __pack_control(struct l2cap_chan *chan,
840 struct l2cap_ctrl *control,
841 struct sk_buff *skb)
842{
843 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
844 put_unaligned_le32(__pack_extended_control(control),
845 skb->data + L2CAP_HDR_SIZE);
846 } else {
847 put_unaligned_le16(__pack_enhanced_control(control),
848 skb->data + L2CAP_HDR_SIZE);
849 }
850}
851
ba7aa64f
GP		 852static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
853{
854 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
855 return L2CAP_EXT_HDR_SIZE;
856 else
857 return L2CAP_ENH_HDR_SIZE;
858}
859
a67d7f6f
MM		 860static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
861 u32 control)
b5c6aaed
MM		 862{
863 struct sk_buff *skb;
864 struct l2cap_hdr *lh;
ba7aa64f 865 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 866
867 if (chan->fcs == L2CAP_FCS_CRC16)
868 hlen += L2CAP_FCS_SIZE;
869
a67d7f6f 870 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 871
b5c6aaed 872 if (!skb)
a67d7f6f 873 return ERR_PTR(-ENOMEM);
b5c6aaed
MM		 874
875 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
876 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
877 lh->cid = cpu_to_le16(chan->dcid);
878
a67d7f6f
MM		 879 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
880 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
881 else
882 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 883
884 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 885 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 886 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
887 }
888
889 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 890 return skb;
891}
892
893static void l2cap_send_sframe(struct l2cap_chan *chan,
894 struct l2cap_ctrl *control)
895{
896 struct sk_buff *skb;
897 u32 control_field;
898
899 BT_DBG("chan %p, control %p", chan, control);
900
901 if (!control->sframe)
902 return;
903
904 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
905 !control->poll)
906 control->final = 1;
907
908 if (control->super == L2CAP_SUPER_RR)
909 clear_bit(CONN_RNR_SENT, &chan->conn_state);
910 else if (control->super == L2CAP_SUPER_RNR)
911 set_bit(CONN_RNR_SENT, &chan->conn_state);
912
913 if (control->super != L2CAP_SUPER_SREJ) {
914 chan->last_acked_seq = control->reqseq;
915 __clear_ack_timer(chan);
916 }
917
918 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
919 control->final, control->poll, control->super);
920
921 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
922 control_field = __pack_extended_control(control);
923 else
924 control_field = __pack_enhanced_control(control);
925
926 skb = l2cap_create_sframe_pdu(chan, control_field);
927 if (!IS_ERR(skb))
928 l2cap_do_send(chan, skb);
b5c6aaed
MM		 929}
930
c9e3d5e0 931static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 932{
c9e3d5e0
MM		 933 struct l2cap_ctrl control;
934
935 BT_DBG("chan %p, poll %d", chan, poll);
936
937 memset(&control, 0, sizeof(control));
938 control.sframe = 1;
939 control.poll = poll;
940
941 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
942 control.super = L2CAP_SUPER_RNR;
943 else
944 control.super = L2CAP_SUPER_RR;
b5c6aaed 945
c9e3d5e0
MM		 946 control.reqseq = chan->buffer_seq;
947 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 948}
949
b4450035 950static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 951{
c1360a1c 952 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 953}
954
93c3e8f5
AE		 955static bool __amp_capable(struct l2cap_chan *chan)
956{
957 struct l2cap_conn *conn = chan->conn;
958
959 if (enable_hs &&
960 chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&
961 conn->fixed_chan_mask & L2CAP_FC_A2MP)
962 return true;
963 else
964 return false;
965}
966
2766be48 967void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 968{
969 struct l2cap_conn *conn = chan->conn;
970 struct l2cap_conn_req req;
971
972 req.scid = cpu_to_le16(chan->scid);
973 req.psm = chan->psm;
974
975 chan->ident = l2cap_get_ident(conn);
976
977 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
978
979 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
980}
981
9f0caeb1
VCG		 982static void l2cap_chan_ready(struct l2cap_chan *chan)
983{
2827011f 984 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 985 chan->conf_state = 0;
986 __clear_chan_timer(chan);
987
54a59aa2 988 chan->state = BT_CONNECTED;
9f0caeb1 989
fd83e2c2 990 chan->ops->ready(chan);
9f0caeb1
VCG		 991}
992
93c3e8f5
AE		 993static void l2cap_start_connection(struct l2cap_chan *chan)
994{
995 if (__amp_capable(chan)) {
996 BT_DBG("chan %p AMP capable: discover AMPs", chan);
997 a2mp_discover_amp(chan);
998 } else {
999 l2cap_send_conn_req(chan);
1000 }
1001}
1002
fc7f8a7e 1003static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1004{
8c1d787b 1005 struct l2cap_conn *conn = chan->conn;
79d554a6 1006
9f0caeb1
VCG		 1007 if (conn->hcon->type == LE_LINK) {
1008 l2cap_chan_ready(chan);
1009 return;
1010 }
1011
79d554a6 1012 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 1013 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1014 return;
1015
d45fc423 1016 if (l2cap_chan_check_security(chan) &&
2d792818 1017 __l2cap_no_conn_pending(chan)) {
93c3e8f5
AE		 1018 l2cap_start_connection(chan);
1019 }
79d554a6
MH		 1020 } else {
1021 struct l2cap_info_req req;
ac73498c 1022 req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 1023
1024 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1025 conn->info_ident = l2cap_get_ident(conn);
1026
ba13ccd9 1027 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 1028
2d792818
GP		 1029 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1030 sizeof(req), &req);
79d554a6
MH		 1031 }
1032}
1033
cf6c2c0b
GP		 1034static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1035{
1036 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1037 if (!disable_ertm)
cf6c2c0b
GP		 1038 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1039
1040 switch (mode) {
1041 case L2CAP_MODE_ERTM:
1042 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1043 case L2CAP_MODE_STREAMING:
1044 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1045 default:
1046 return 0x00;
1047 }
1048}
1049
2d792818
GP		 1050static void l2cap_send_disconn_req(struct l2cap_conn *conn,
1051 struct l2cap_chan *chan, int err)
22121fc9 1052{
6be36555 1053 struct sock *sk = chan->sk;
22121fc9
GP		 1054 struct l2cap_disconn_req req;
1055
c13ffa62
GP		 1056 if (!conn)
1057 return;
1058
aad3d0e3 1059 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1060 __clear_retrans_timer(chan);
1061 __clear_monitor_timer(chan);
1062 __clear_ack_timer(chan);
c13ffa62
GP		 1063 }
1064
416fa752 1065 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
d117773c 1066 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1067 return;
1068 }
1069
fe4128e0
GP		 1070 req.dcid = cpu_to_le16(chan->dcid);
1071 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1072 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1073 sizeof(req), &req);
c13ffa62 1074
6be36555 1075 lock_sock(sk);
0e587be7 1076 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1077 __l2cap_chan_set_err(chan, err);
6be36555 1078 release_sock(sk);
22121fc9
GP		 1079}
1080
1da177e4 1081/* ---- L2CAP connections ---- */
4e8402a3
MH		 1082static void l2cap_conn_start(struct l2cap_conn *conn)
1083{
3df91ea2 1084 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1085
1086 BT_DBG("conn %p", conn);
1087
3df91ea2 1088 mutex_lock(&conn->chan_lock);
4e8402a3 1089
3df91ea2 1090 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1091 struct sock *sk = chan->sk;
baa7e1fa 1092
6be36555 1093 l2cap_chan_lock(chan);
4e8402a3 1094
715ec005 1095 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1096 l2cap_chan_unlock(chan);
79d554a6
MH		 1097 continue;
1098 }
1099
89bc500e 1100 if (chan->state == BT_CONNECT) {
d45fc423 1101 if (!l2cap_chan_check_security(chan) ||
2d792818 1102 !__l2cap_no_conn_pending(chan)) {
6be36555 1103 l2cap_chan_unlock(chan);
47731de7
GP		 1104 continue;
1105 }
79d554a6 1106
c1360a1c 1107 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1108 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1109 &chan->conf_state)) {
89bc500e 1110 l2cap_chan_close(chan, ECONNRESET);
6be36555 1111 l2cap_chan_unlock(chan);
47731de7 1112 continue;
b1235d79 1113 }
47731de7 1114
93c3e8f5 1115 l2cap_start_connection(chan);
47731de7 1116
89bc500e 1117 } else if (chan->state == BT_CONNECT2) {
79d554a6 1118 struct l2cap_conn_rsp rsp;
e9aeb2dd 1119 char buf[128];
fe4128e0
GP		 1120 rsp.scid = cpu_to_le16(chan->dcid);
1121 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1122
d45fc423 1123 if (l2cap_chan_check_security(chan)) {
6be36555 1124 lock_sock(sk);
c5daa683
GP		 1125 if (test_bit(BT_SK_DEFER_SETUP,
1126 &bt_sk(sk)->flags)) {
ac73498c
AE		 1127 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1128 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1129 chan->ops->defer(chan);
f66dc81f
MH		 1130
1131 } else {
0e587be7 1132 __l2cap_state_change(chan, BT_CONFIG);
ac73498c
AE		 1133 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
1134 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1135 }
6be36555 1136 release_sock(sk);
79d554a6 1137 } else {
ac73498c
AE		 1138 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1139 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1140 }
1141
fc7f8a7e 1142 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1143 sizeof(rsp), &rsp);
e9aeb2dd 1144
c1360a1c 1145 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1146 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1147 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1148 continue;
1149 }
1150
c1360a1c 1151 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1152 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 1153 l2cap_build_conf_req(chan, buf), buf);
73ffa904 1154 chan->num_conf_req++;
4e8402a3
MH		 1155 }
1156
6be36555 1157 l2cap_chan_unlock(chan);
4e8402a3
MH		 1158 }
1159
3df91ea2 1160 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1161}
1162
c2287681 1163/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1164 * Returns closest match, locked.
1165 */
d9b88702 1166static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1167 bdaddr_t *src,
1168 bdaddr_t *dst)
b62f328b 1169{
23691d75 1170 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1171
23691d75 1172 read_lock(&chan_list_lock);
b62f328b 1173
23691d75
GP		 1174 list_for_each_entry(c, &chan_list, global_l) {
1175 struct sock *sk = c->sk;
fe4128e0 1176
89bc500e 1177 if (state && c->state != state)
b62f328b
VT		 1178 continue;
1179
23691d75 1180 if (c->scid == cid) {
c2287681
IY		 1181 int src_match, dst_match;
1182 int src_any, dst_any;
1183
b62f328b 1184 /* Exact match. */
c2287681
IY		 1185 src_match = !bacmp(&bt_sk(sk)->src, src);
1186 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1187 if (src_match && dst_match) {
23691d75
GP		 1188 read_unlock(&chan_list_lock);
1189 return c;
1190 }
b62f328b
VT		 1191
1192 /* Closest match */
c2287681
IY		 1193 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1194 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1195 if ((src_match && dst_any) || (src_any && dst_match) ||
1196 (src_any && dst_any))
23691d75 1197 c1 = c;
b62f328b
VT		 1198 }
1199 }
280f294f 1200
23691d75 1201 read_unlock(&chan_list_lock);
b62f328b 1202
23691d75 1203 return c1;
b62f328b
VT		 1204}
1205
1206static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1207{
c916fbe4 1208 struct sock *parent, *sk;
23691d75 1209 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1210
1211 BT_DBG("");
1212
1213 /* Check if we have socket listening on cid */
23691d75 1214 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1215 conn->src, conn->dst);
23691d75 1216 if (!pchan)
b62f328b
VT		 1217 return;
1218
23691d75
GP		 1219 parent = pchan->sk;
1220
aa2ac881 1221 lock_sock(parent);
62f3a2cf 1222
80b98027 1223 chan = pchan->ops->new_connection(pchan);
80808e43 1224 if (!chan)
b62f328b
VT		 1225 goto clean;
1226
80808e43 1227 sk = chan->sk;
5d41ce1d 1228
b62f328b 1229 hci_conn_hold(conn->hcon);
a9ea3ed9 1230 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
b62f328b 1231
b62f328b
VT		 1232 bacpy(&bt_sk(sk)->src, conn->src);
1233 bacpy(&bt_sk(sk)->dst, conn->dst);
1234
3d57dc68 1235 l2cap_chan_add(conn, chan);
48454079 1236
6754e0df 1237 l2cap_chan_ready(chan);
b62f328b 1238
b62f328b 1239clean:
aa2ac881 1240 release_sock(parent);
b62f328b
VT		 1241}
1242
4e8402a3
MH		 1243static void l2cap_conn_ready(struct l2cap_conn *conn)
1244{
48454079 1245 struct l2cap_chan *chan;
cc110922 1246 struct hci_conn *hcon = conn->hcon;
4e8402a3 1247
79d554a6 1248 BT_DBG("conn %p", conn);
4e8402a3 1249
cc110922 1250 if (!hcon->out && hcon->type == LE_LINK)
b62f328b
VT		 1251 l2cap_le_conn_ready(conn);
1252
cc110922
VCG		 1253 if (hcon->out && hcon->type == LE_LINK)
1254 smp_conn_security(hcon, hcon->pending_sec_level);
160dc6ac 1255
3df91ea2 1256 mutex_lock(&conn->chan_lock);
4e8402a3 1257
3df91ea2 1258 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1259
6be36555 1260 l2cap_chan_lock(chan);
4e8402a3 1261
416fa752
AE		 1262 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
1263 l2cap_chan_unlock(chan);
1264 continue;
1265 }
1266
cc110922
VCG		 1267 if (hcon->type == LE_LINK) {
1268 if (smp_conn_security(hcon, chan->sec_level))
cf4cd009 1269 l2cap_chan_ready(chan);
acd7d370 1270
63128451 1271 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1272 struct sock *sk = chan->sk;
c9b66675 1273 __clear_chan_timer(chan);
6be36555 1274 lock_sock(sk);
0e587be7 1275 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1276 sk->sk_state_change(sk);
6be36555 1277 release_sock(sk);
b501d6a1 1278
89bc500e 1279 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1280 l2cap_do_start(chan);
4e8402a3 1281
6be36555 1282 l2cap_chan_unlock(chan);
4e8402a3 1283 }
79d554a6 1284
3df91ea2 1285 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1286}
1287
1288/* Notify sockets that we cannot guaranty reliability anymore */
1289static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1290{
48454079 1291 struct l2cap_chan *chan;
4e8402a3
MH		 1292
1293 BT_DBG("conn %p", conn);
1294
3df91ea2 1295 mutex_lock(&conn->chan_lock);
4e8402a3 1296
3df91ea2 1297 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1298 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1299 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1300 }
1301
3df91ea2 1302 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1303}
1304
f878fcad 1305static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1306{
f878fcad 1307 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1308 info_timer.work);
4e8402a3 1309
984947dc 1310 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1311 conn->info_ident = 0;
984947dc 1312
4e8402a3
MH		 1313 l2cap_conn_start(conn);
1314}
1315
5d3de7df
VCG		 1316static void l2cap_conn_del(struct hci_conn *hcon, int err)
1317{
1318 struct l2cap_conn *conn = hcon->l2cap_data;
1319 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1320
1321 if (!conn)
1322 return;
1323
1324 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1325
1326 kfree_skb(conn->rx_skb);
1327
3df91ea2
AE		 1328 mutex_lock(&conn->chan_lock);
1329
5d3de7df
VCG		 1330 /* Kill channels */
1331 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1332 l2cap_chan_hold(chan);
6be36555
AE		 1333 l2cap_chan_lock(chan);
1334
5d3de7df 1335 l2cap_chan_del(chan, err);
6be36555
AE		 1336
1337 l2cap_chan_unlock(chan);
1338
80b98027 1339 chan->ops->close(chan);
61d6ef3e 1340 l2cap_chan_put(chan);
5d3de7df
VCG		 1341 }
1342
3df91ea2
AE		 1343 mutex_unlock(&conn->chan_lock);
1344
73d80deb
LAD		 1345 hci_chan_del(conn->hchan);
1346
5d3de7df 1347 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1348 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1349
51a8efd7 1350 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1351 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1352 smp_chan_destroy(conn);
d26a2345 1353 }
5d3de7df
VCG		 1354
1355 hcon->l2cap_data = NULL;
1356 kfree(conn);
1357}
1358
6c9d42a1 1359static void security_timeout(struct work_struct *work)
5d3de7df 1360{
6c9d42a1 1361 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1362 security_timer.work);
5d3de7df 1363
d06cc416
JH		 1364 BT_DBG("conn %p", conn);
1365
1366 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1367 smp_chan_destroy(conn);
1368 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1369 }
5d3de7df
VCG		 1370}
1371
1da177e4
LT		 1372static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1373{
0139418c 1374 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1375 struct hci_chan *hchan;
1da177e4 1376
0139418c 1377 if (conn || status)
1da177e4
LT		 1378 return conn;
1379
73d80deb
LAD		 1380 hchan = hci_chan_create(hcon);
1381 if (!hchan)
1382 return NULL;
1383
8bcde1f2 1384 conn = kzalloc(sizeof(struct l2cap_conn), GFP_KERNEL);
73d80deb
LAD		 1385 if (!conn) {
1386 hci_chan_del(hchan);
1da177e4 1387 return NULL;
73d80deb 1388 }
1da177e4
LT		 1389
1390 hcon->l2cap_data = conn;
1391 conn->hcon = hcon;
73d80deb 1392 conn->hchan = hchan;
1da177e4 1393
73d80deb 1394 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1395
dcc042d5
AE		 1396 switch (hcon->type) {
1397 case AMP_LINK:
1398 conn->mtu = hcon->hdev->block_mtu;
1399 break;
1400
1401 case LE_LINK:
1402 if (hcon->hdev->le_mtu) {
1403 conn->mtu = hcon->hdev->le_mtu;
1404 break;
1405 }
1406 /* fall through */
1407
1408 default:
acd7d370 1409 conn->mtu = hcon->hdev->acl_mtu;
dcc042d5
AE		 1410 break;
1411 }
acd7d370 1412
1da177e4
LT		 1413 conn->src = &hcon->hdev->bdaddr;
1414 conn->dst = &hcon->dst;
1415
4e8402a3
MH		 1416 conn->feat_mask = 0;
1417
1da177e4 1418 spin_lock_init(&conn->lock);
3df91ea2 1419 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1420
1421 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1422
5d3de7df 1423 if (hcon->type == LE_LINK)
6c9d42a1 1424 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1425 else
030013d8 1426 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1427
9f5a0d7b 1428 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1429
1da177e4
LT		 1430 return conn;
1431}
1432
1da177e4 1433/* ---- Socket interface ---- */
1da177e4 1434
c2287681 1435/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1436 * Returns closest match.
1437 */
c2287681
IY		 1438static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1439 bdaddr_t *src,
1440 bdaddr_t *dst)
1da177e4 1441{
23691d75 1442 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1443
23691d75 1444 read_lock(&chan_list_lock);
e0f0cb56 1445
23691d75
GP		 1446 list_for_each_entry(c, &chan_list, global_l) {
1447 struct sock *sk = c->sk;
fe4128e0 1448
89bc500e 1449 if (state && c->state != state)
1da177e4
LT		 1450 continue;
1451
23691d75 1452 if (c->psm == psm) {
c2287681
IY		 1453 int src_match, dst_match;
1454 int src_any, dst_any;
1455
1da177e4 1456 /* Exact match. */
c2287681
IY		 1457 src_match = !bacmp(&bt_sk(sk)->src, src);
1458 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1459 if (src_match && dst_match) {
a7567b20 1460 read_unlock(&chan_list_lock);
23691d75
GP		 1461 return c;
1462 }
1da177e4
LT		 1463
1464 /* Closest match */
c2287681
IY		 1465 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1466 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1467 if ((src_match && dst_any) || (src_any && dst_match) ||
1468 (src_any && dst_any))
23691d75 1469 c1 = c;
1da177e4
LT		 1470 }
1471 }
1da177e4 1472
23691d75 1473 read_unlock(&chan_list_lock);
e0f0cb56 1474
23691d75 1475 return c1;
1da177e4
LT		 1476}
1477
8e9f9892
AG		 1478int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1479 bdaddr_t *dst, u8 dst_type)
1da177e4 1480{
5d41ce1d 1481 struct sock *sk = chan->sk;
1da177e4 1482 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1483 struct l2cap_conn *conn;
1484 struct hci_conn *hcon;
1485 struct hci_dev *hdev;
09ab6f4c 1486 __u8 auth_type;
44d0e48e 1487 int err;
1da177e4 1488
6ed93dc6 1489 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", src, dst,
ab19516a 1490 dst_type, __le16_to_cpu(psm));
1da177e4 1491
af05b30b
GP		 1492 hdev = hci_get_route(dst, src);
1493 if (!hdev)
1da177e4
LT		 1494 return -EHOSTUNREACH;
1495
09fd0de5 1496 hci_dev_lock(hdev);
1da177e4 1497
6be36555 1498 l2cap_chan_lock(chan);
03a00194
GP		 1499
1500 /* PSM must be odd and lsb of upper byte must be 0 */
1501 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
2d792818 1502 chan->chan_type != L2CAP_CHAN_RAW) {
03a00194
GP		 1503 err = -EINVAL;
1504 goto done;
1505 }
1506
1507 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1508 err = -EINVAL;
1509 goto done;
1510 }
1511
1512 switch (chan->mode) {
1513 case L2CAP_MODE_BASIC:
1514 break;
1515 case L2CAP_MODE_ERTM:
1516 case L2CAP_MODE_STREAMING:
1517 if (!disable_ertm)
1518 break;
1519 /* fall through */
1520 default:
1521 err = -ENOTSUPP;
1522 goto done;
1523 }
1524
0797e01d 1525 switch (chan->state) {
03a00194
GP		 1526 case BT_CONNECT:
1527 case BT_CONNECT2:
1528 case BT_CONFIG:
1529 /* Already connecting */
1530 err = 0;
1531 goto done;
1532
1533 case BT_CONNECTED:
1534 /* Already connected */
1535 err = -EISCONN;
1536 goto done;
1537
1538 case BT_OPEN:
1539 case BT_BOUND:
1540 /* Can connect */
1541 break;
1542
1543 default:
1544 err = -EBADFD;
1545 goto done;
1546 }
1547
1548 /* Set destination address and psm */
0797e01d 1549 lock_sock(sk);
9219b2a0 1550 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1551 release_sock(sk);
1552
03a00194
GP		 1553 chan->psm = psm;
1554 chan->dcid = cid;
1da177e4 1555
4343478f 1556 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1557
fe4128e0 1558 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1559 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1560 chan->sec_level, auth_type);
acd7d370 1561 else
8e9f9892 1562 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1563 chan->sec_level, auth_type);
acd7d370 1564
30e76272
VT		 1565 if (IS_ERR(hcon)) {
1566 err = PTR_ERR(hcon);
1da177e4 1567 goto done;
30e76272 1568 }
1da177e4
LT		 1569
1570 conn = l2cap_conn_add(hcon, 0);
1571 if (!conn) {
1572 hci_conn_put(hcon);
30e76272 1573 err = -ENOMEM;
1da177e4
LT		 1574 goto done;
1575 }
1576
9f0caeb1
VCG		 1577 if (hcon->type == LE_LINK) {
1578 err = 0;
1579
1580 if (!list_empty(&conn->chan_l)) {
1581 err = -EBUSY;
1582 hci_conn_put(hcon);
1583 }
1584
1585 if (err)
1586 goto done;
1587 }
1588
1da177e4
LT		 1589 /* Update source addr of the socket */
1590 bacpy(src, conn->src);
1591
6be36555 1592 l2cap_chan_unlock(chan);
48454079 1593 l2cap_chan_add(conn, chan);
6be36555 1594 l2cap_chan_lock(chan);
48454079 1595
6be36555 1596 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1597 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1598
1599 if (hcon->state == BT_CONNECTED) {
715ec005 1600 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1601 __clear_chan_timer(chan);
d45fc423 1602 if (l2cap_chan_check_security(chan))
6be36555 1603 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1604 } else
fc7f8a7e 1605 l2cap_do_start(chan);
1da177e4
LT		 1606 }
1607
30e76272
VT		 1608 err = 0;
1609
1da177e4 1610done:
6be36555 1611 l2cap_chan_unlock(chan);
09fd0de5 1612 hci_dev_unlock(hdev);
1da177e4
LT		 1613 hci_dev_put(hdev);
1614 return err;
1615}
1616
dcba0dba 1617int __l2cap_wait_ack(struct sock *sk)
6161c038 1618{
8c1d787b 1619 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1620 DECLARE_WAITQUEUE(wait, current);
1621 int err = 0;
1622 int timeo = HZ/5;
1623
2b0b05dd 1624 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1625 set_current_state(TASK_INTERRUPTIBLE);
1626 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1627 if (!timeo)
1628 timeo = HZ/5;
1629
1630 if (signal_pending(current)) {
1631 err = sock_intr_errno(timeo);
1632 break;
1633 }
1634
1635 release_sock(sk);
1636 timeo = schedule_timeout(timeo);
1637 lock_sock(sk);
a71a0cf4 1638 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1639
1640 err = sock_error(sk);
1641 if (err)
1642 break;
1643 }
1644 set_current_state(TASK_RUNNING);
2b0b05dd 1645 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1646 return err;
1647}
1648
721c4181 1649static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1650{
721c4181 1651 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1652 monitor_timer.work);
e90bac06 1653
525cd185 1654 BT_DBG("chan %p", chan);
0e98958d 1655
6be36555
AE		 1656 l2cap_chan_lock(chan);
1657
80909e04 1658 if (!chan->conn) {
6be36555 1659 l2cap_chan_unlock(chan);
8d7e1c7f 1660 l2cap_chan_put(chan);
e90bac06
GP		 1661 return;
1662 }
1663
401bb1f7 1664 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1665
6be36555 1666 l2cap_chan_unlock(chan);
8d7e1c7f 1667 l2cap_chan_put(chan);
e90bac06
GP		 1668}
1669
721c4181 1670static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1671{
721c4181 1672 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1673 retrans_timer.work);
e90bac06 1674
49208c9c 1675 BT_DBG("chan %p", chan);
0e98958d 1676
6be36555
AE		 1677 l2cap_chan_lock(chan);
1678
80909e04
MM		 1679 if (!chan->conn) {
1680 l2cap_chan_unlock(chan);
1681 l2cap_chan_put(chan);
1682 return;
1683 }
6be36555 1684
401bb1f7 1685 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1686 l2cap_chan_unlock(chan);
8d7e1c7f 1687 l2cap_chan_put(chan);
e90bac06
GP		 1688}
1689
d660366d
GP		 1690static void l2cap_streaming_send(struct l2cap_chan *chan,
1691 struct sk_buff_head *skbs)
6840ed07 1692{
ccbb84af 1693 struct sk_buff *skb;
3733937d 1694 struct l2cap_ctrl *control;
6840ed07 1695
3733937d
MM		 1696 BT_DBG("chan %p, skbs %p", chan, skbs);
1697
3733937d
MM		 1698 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1699
1700 while (!skb_queue_empty(&chan->tx_q)) {
1701
1702 skb = skb_dequeue(&chan->tx_q);
1703
1704 bt_cb(skb)->control.retries = 1;
1705 control = &bt_cb(skb)->control;
1706
1707 control->reqseq = 0;
1708 control->txseq = chan->next_tx_seq;
1709
1710 __pack_control(chan, control, skb);
6840ed07 1711
47d1ec61 1712 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1713 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1714 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1715 }
1716
4343478f 1717 l2cap_do_send(chan, skb);
6840ed07 1718
b4400672 1719 BT_DBG("Sent txseq %u", control->txseq);
3733937d 1720
836be934 1721 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1722 chan->frames_sent++;
6840ed07 1723 }
6840ed07
GP		 1724}
1725
67c9e840 1726static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1727{
1728 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1729 struct l2cap_ctrl *control;
1730 int sent = 0;
1731
1732 BT_DBG("chan %p", chan);
1c2acffb 1733
89bc500e 1734 if (chan->state != BT_CONNECTED)
c13ffa62 1735 return -ENOTCONN;
e90bac06 1736
94122bbe
MM		 1737 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1738 return 0;
1739
18a48e76
MM		 1740 while (chan->tx_send_head &&
1741 chan->unacked_frames < chan->remote_tx_win &&
1742 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1743
18a48e76 1744 skb = chan->tx_send_head;
e90bac06 1745
18a48e76
MM		 1746 bt_cb(skb)->control.retries = 1;
1747 control = &bt_cb(skb)->control;
95ffa978 1748
e2ab4353 1749 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1750 control->final = 1;
e2ab4353 1751
18a48e76
MM		 1752 control->reqseq = chan->buffer_seq;
1753 chan->last_acked_seq = chan->buffer_seq;
1754 control->txseq = chan->next_tx_seq;
1c2acffb 1755
18a48e76 1756 __pack_control(chan, control, skb);
e90bac06 1757
47d1ec61 1758 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1759 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1760 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1761 }
1762
18a48e76
MM		 1763 /* Clone after data has been modified. Data is assumed to be
1764 read-only (for locking purposes) on cloned sk_buffs.
1765 */
1766 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1767
18a48e76
MM		 1768 if (!tx_skb)
1769 break;
1c2acffb 1770
18a48e76 1771 __set_retrans_timer(chan);
836be934
AE		 1772
1773 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1774 chan->unacked_frames++;
6a026610 1775 chan->frames_sent++;
18a48e76 1776 sent++;
1c2acffb 1777
58d35f87
GP		 1778 if (skb_queue_is_last(&chan->tx_q, skb))
1779 chan->tx_send_head = NULL;
1c2acffb 1780 else
58d35f87 1781 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1782
1783 l2cap_do_send(chan, tx_skb);
b4400672 1784 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 1785 }
1786
b4400672
AE		 1787 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1788 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 1789
1790 return sent;
9e917af1
GP		 1791}
1792
e1fbd4c1
MM		 1793static void l2cap_ertm_resend(struct l2cap_chan *chan)
1794{
1795 struct l2cap_ctrl control;
1796 struct sk_buff *skb;
1797 struct sk_buff *tx_skb;
1798 u16 seq;
1799
1800 BT_DBG("chan %p", chan);
1801
1802 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1803 return;
1804
1805 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1806 seq = l2cap_seq_list_pop(&chan->retrans_list);
1807
1808 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1809 if (!skb) {
1810 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 1811 seq);
e1fbd4c1
MM		 1812 continue;
1813 }
1814
1815 bt_cb(skb)->control.retries++;
1816 control = bt_cb(skb)->control;
1817
1818 if (chan->max_tx != 0 &&
1819 bt_cb(skb)->control.retries > chan->max_tx) {
1820 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
1821 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
1822 l2cap_seq_list_clear(&chan->retrans_list);
1823 break;
1824 }
1825
1826 control.reqseq = chan->buffer_seq;
1827 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1828 control.final = 1;
1829 else
1830 control.final = 0;
1831
1832 if (skb_cloned(skb)) {
1833 /* Cloned sk_buffs are read-only, so we need a
1834 * writeable copy
1835 */
8bcde1f2 1836 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 1837 } else {
8bcde1f2 1838 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 1839 }
1840
1841 if (!tx_skb) {
1842 l2cap_seq_list_clear(&chan->retrans_list);
1843 break;
1844 }
1845
1846 /* Update skb contents */
1847 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1848 put_unaligned_le32(__pack_extended_control(&control),
1849 tx_skb->data + L2CAP_HDR_SIZE);
1850 } else {
1851 put_unaligned_le16(__pack_enhanced_control(&control),
1852 tx_skb->data + L2CAP_HDR_SIZE);
1853 }
1854
1855 if (chan->fcs == L2CAP_FCS_CRC16) {
1856 u16 fcs = crc16(0, (u8 *) tx_skb->data, tx_skb->len);
1857 put_unaligned_le16(fcs, skb_put(tx_skb,
1858 L2CAP_FCS_SIZE));
1859 }
1860
1861 l2cap_do_send(chan, tx_skb);
1862
1863 BT_DBG("Resent txseq %d", control.txseq);
1864
1865 chan->last_acked_seq = chan->buffer_seq;
1866 }
1867}
1868
f80842a8
MM		 1869static void l2cap_retransmit(struct l2cap_chan *chan,
1870 struct l2cap_ctrl *control)
1871{
1872 BT_DBG("chan %p, control %p", chan, control);
1873
1874 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
1875 l2cap_ertm_resend(chan);
1876}
1877
d2a7ac5d
MM		 1878static void l2cap_retransmit_all(struct l2cap_chan *chan,
1879 struct l2cap_ctrl *control)
1880{
e1fbd4c1
MM		 1881 struct sk_buff *skb;
1882
1883 BT_DBG("chan %p, control %p", chan, control);
1884
1885 if (control->poll)
1886 set_bit(CONN_SEND_FBIT, &chan->conn_state);
1887
1888 l2cap_seq_list_clear(&chan->retrans_list);
1889
1890 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1891 return;
1892
1893 if (chan->unacked_frames) {
1894 skb_queue_walk(&chan->tx_q, skb) {
1895 if (bt_cb(skb)->control.txseq == control->reqseq ||
2d792818 1896 skb == chan->tx_send_head)
e1fbd4c1
MM		 1897 break;
1898 }
1899
1900 skb_queue_walk_from(&chan->tx_q, skb) {
1901 if (skb == chan->tx_send_head)
1902 break;
1903
1904 l2cap_seq_list_append(&chan->retrans_list,
1905 bt_cb(skb)->control.txseq);
1906 }
1907
1908 l2cap_ertm_resend(chan);
1909 }
d2a7ac5d
MM		 1910}
1911
0a0aba42 1912static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1913{
0a0aba42
MM		 1914 struct l2cap_ctrl control;
1915 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
1916 chan->last_acked_seq);
1917 int threshold;
9e917af1 1918
0a0aba42
MM		 1919 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
1920 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 1921
0a0aba42
MM		 1922 memset(&control, 0, sizeof(control));
1923 control.sframe = 1;
dfc909be 1924
0a0aba42
MM		 1925 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
1926 chan->rx_state == L2CAP_RX_STATE_RECV) {
1927 __clear_ack_timer(chan);
1928 control.super = L2CAP_SUPER_RNR;
1929 control.reqseq = chan->buffer_seq;
1930 l2cap_send_sframe(chan, &control);
1931 } else {
1932 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
1933 l2cap_ertm_send(chan);
1934 /* If any i-frames were sent, they included an ack */
1935 if (chan->buffer_seq == chan->last_acked_seq)
1936 frames_to_ack = 0;
1937 }
dfc909be 1938
c20f8e35 1939 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 1940 * Calculate without mul or div
1941 */
c20f8e35 1942 threshold = chan->ack_win;
0a0aba42
MM		 1943 threshold += threshold << 1;
1944 threshold >>= 2;
1945
b4400672 1946 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 1947 threshold);
1948
1949 if (frames_to_ack >= threshold) {
1950 __clear_ack_timer(chan);
1951 control.super = L2CAP_SUPER_RR;
1952 control.reqseq = chan->buffer_seq;
1953 l2cap_send_sframe(chan, &control);
1954 frames_to_ack = 0;
1955 }
1c2acffb 1956
0a0aba42
MM		 1957 if (frames_to_ack)
1958 __set_ack_timer(chan);
1959 }
b17e73bb
SJ		 1960}
1961
04124681
GP		 1962static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1963 struct msghdr *msg, int len,
1964 int count, struct sk_buff *skb)
1c2acffb 1965{
0952a57a 1966 struct l2cap_conn *conn = chan->conn;
1c2acffb 1967 struct sk_buff **frag;
90338947 1968 int sent = 0;
1da177e4 1969
59203a21 1970 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1971 return -EFAULT;
1da177e4
LT		 1972
1973 sent += count;
1974 len -= count;
1975
1976 /* Continuation fragments (no L2CAP header) */
1977 frag = &skb_shinfo(skb)->frag_list;
1978 while (len) {
fbe00700
GP		 1979 struct sk_buff *tmp;
1980
1da177e4
LT		 1981 count = min_t(unsigned int, conn->mtu, len);
1982
fbe00700
GP		 1983 tmp = chan->ops->alloc_skb(chan, count,
1984 msg->msg_flags & MSG_DONTWAIT);
1985 if (IS_ERR(tmp))
1986 return PTR_ERR(tmp);
1987
1988 *frag = tmp;
2f7719ce 1989
1c2acffb
GP		 1990 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1991 return -EFAULT;
1da177e4 1992
5e59b791
LAD		 1993 (*frag)->priority = skb->priority;
1994
1da177e4
LT		 1995 sent += count;
1996 len -= count;
1997
2d0ed3d5
GP		 1998 skb->len += (*frag)->len;
1999 skb->data_len += (*frag)->len;
2000
1da177e4
LT		 2001 frag = &(*frag)->next;
2002 }
1da177e4
LT		 2003
2004 return sent;
1c2acffb 2005}
1da177e4 2006
5e59b791 2007static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
b4400672
AE		 2008 struct msghdr *msg, size_t len,
2009 u32 priority)
1c2acffb 2010{
8c1d787b 2011 struct l2cap_conn *conn = chan->conn;
1c2acffb 2012 struct sk_buff *skb;
03a51213 2013 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2014 struct l2cap_hdr *lh;
2015
b4400672 2016 BT_DBG("chan %p len %zu priority %u", chan, len, priority);
1c2acffb
GP		 2017
2018 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2019
2020 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2021 msg->msg_flags & MSG_DONTWAIT);
2022 if (IS_ERR(skb))
2023 return skb;
1c2acffb 2024
5e59b791
LAD		 2025 skb->priority = priority;
2026
1c2acffb
GP		 2027 /* Create L2CAP header */
2028 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2029 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 2030 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2031 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2032
0952a57a 2033 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2034 if (unlikely(err < 0)) {
2035 kfree_skb(skb);
2036 return ERR_PTR(err);
2037 }
2038 return skb;
2039}
2040
5e59b791 2041static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
b4400672
AE		 2042 struct msghdr *msg, size_t len,
2043 u32 priority)
1c2acffb 2044{
8c1d787b 2045 struct l2cap_conn *conn = chan->conn;
1c2acffb 2046 struct sk_buff *skb;
f2ba7fae 2047 int err, count;
1c2acffb
GP		 2048 struct l2cap_hdr *lh;
2049
b4400672 2050 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2051
f2ba7fae 2052 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2053
f2ba7fae 2054 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 2055 msg->msg_flags & MSG_DONTWAIT);
2056 if (IS_ERR(skb))
2057 return skb;
1c2acffb 2058
5e59b791
LAD		 2059 skb->priority = priority;
2060
1c2acffb
GP		 2061 /* Create L2CAP header */
2062 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2063 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2064 lh->len = cpu_to_le16(len);
1c2acffb 2065
0952a57a 2066 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2067 if (unlikely(err < 0)) {
2068 kfree_skb(skb);
2069 return ERR_PTR(err);
2070 }
2071 return skb;
2072}
2073
ab0ff76d 2074static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2075 struct msghdr *msg, size_t len,
2076 u16 sdulen)
1c2acffb 2077{
8c1d787b 2078 struct l2cap_conn *conn = chan->conn;
1c2acffb 2079 struct sk_buff *skb;
e4ca6d98 2080 int err, count, hlen;
1c2acffb
GP		 2081 struct l2cap_hdr *lh;
2082
b4400672 2083 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2084
0ee0d208
GP		 2085 if (!conn)
2086 return ERR_PTR(-ENOTCONN);
2087
ba7aa64f 2088 hlen = __ertm_hdr_size(chan);
e4ca6d98 2089
c74e560c 2090 if (sdulen)
03a51213 2091 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2092
47d1ec61 2093 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2094 hlen += L2CAP_FCS_SIZE;
fcc203c3 2095
1c2acffb 2096 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2097
2098 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2099 msg->msg_flags & MSG_DONTWAIT);
2100 if (IS_ERR(skb))
2101 return skb;
1c2acffb
GP		 2102
2103 /* Create L2CAP header */
2104 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2105 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2106 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2107
18a48e76
MM		 2108 /* Control header is populated later */
2109 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2110 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2111 else
2112 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2113
c74e560c 2114 if (sdulen)
03a51213 2115 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2116
0952a57a 2117 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2118 if (unlikely(err < 0)) {
2119 kfree_skb(skb);
2120 return ERR_PTR(err);
2121 }
e90bac06 2122
18a48e76 2123 bt_cb(skb)->control.fcs = chan->fcs;
3ce3514f 2124 bt_cb(skb)->control.retries = 0;
1c2acffb 2125 return skb;
1da177e4
LT		 2126}
2127
94122bbe
MM		 2128static int l2cap_segment_sdu(struct l2cap_chan *chan,
2129 struct sk_buff_head *seg_queue,
2130 struct msghdr *msg, size_t len)
c74e560c 2131{
c74e560c 2132 struct sk_buff *skb;
94122bbe
MM		 2133 u16 sdu_len;
2134 size_t pdu_len;
94122bbe 2135 u8 sar;
c74e560c 2136
b4400672 2137 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2138
94122bbe
MM		 2139 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2140 * so fragmented skbs are not used. The HCI layer's handling
2141 * of fragmented skbs is not compatible with ERTM's queueing.
2142 */
c74e560c 2143
94122bbe
MM		 2144 /* PDU size is derived from the HCI MTU */
2145 pdu_len = chan->conn->mtu;
c74e560c 2146
94122bbe
MM		 2147 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2148
2149 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2150 if (chan->fcs)
2151 pdu_len -= L2CAP_FCS_SIZE;
2152
ba7aa64f 2153 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2154
2155 /* Remote device may have requested smaller PDUs */
2156 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2157
2158 if (len <= pdu_len) {
2159 sar = L2CAP_SAR_UNSEGMENTED;
2160 sdu_len = 0;
2161 pdu_len = len;
2162 } else {
2163 sar = L2CAP_SAR_START;
2164 sdu_len = len;
2165 pdu_len -= L2CAP_SDULEN_SIZE;
2166 }
2167
2168 while (len > 0) {
2169 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2170
c74e560c 2171 if (IS_ERR(skb)) {
94122bbe 2172 __skb_queue_purge(seg_queue);
c74e560c
GP		 2173 return PTR_ERR(skb);
2174 }
2175
94122bbe
MM		 2176 bt_cb(skb)->control.sar = sar;
2177 __skb_queue_tail(seg_queue, skb);
2178
2179 len -= pdu_len;
2180 if (sdu_len) {
2181 sdu_len = 0;
2182 pdu_len += L2CAP_SDULEN_SIZE;
2183 }
2184
2185 if (len <= pdu_len) {
2186 sar = L2CAP_SAR_END;
2187 pdu_len = len;
2188 } else {
2189 sar = L2CAP_SAR_CONTINUE;
2190 }
c74e560c 2191 }
c74e560c 2192
f0f62799 2193 return 0;
c74e560c
GP		 2194}
2195
5e59b791 2196int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2d792818 2197 u32 priority)
9a91a04a 2198{
9a91a04a 2199 struct sk_buff *skb;
9a91a04a 2200 int err;
94122bbe 2201 struct sk_buff_head seg_queue;
9a91a04a
GP		 2202
2203 /* Connectionless channel */
715ec005 2204 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2205 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2206 if (IS_ERR(skb))
2207 return PTR_ERR(skb);
2208
2209 l2cap_do_send(chan, skb);
2210 return len;
2211 }
2212
2213 switch (chan->mode) {
2214 case L2CAP_MODE_BASIC:
2215 /* Check outgoing MTU */
2216 if (len > chan->omtu)
2217 return -EMSGSIZE;
2218
2219 /* Create a basic PDU */
5e59b791 2220 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2221 if (IS_ERR(skb))
2222 return PTR_ERR(skb);
2223
2224 l2cap_do_send(chan, skb);
2225 err = len;
2226 break;
2227
2228 case L2CAP_MODE_ERTM:
2229 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2230 /* Check outgoing MTU */
2231 if (len > chan->omtu) {
2232 err = -EMSGSIZE;
2233 break;
2234 }
9a91a04a 2235
94122bbe 2236 __skb_queue_head_init(&seg_queue);
9a91a04a 2237
94122bbe
MM		 2238 /* Do segmentation before calling in to the state machine,
2239 * since it's possible to block while waiting for memory
2240 * allocation.
2241 */
2242 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2243
94122bbe
MM		 2244 /* The channel could have been closed while segmenting,
2245 * check that it is still connected.
2246 */
2247 if (chan->state != BT_CONNECTED) {
2248 __skb_queue_purge(&seg_queue);
2249 err = -ENOTCONN;
9a91a04a
GP		 2250 }
2251
94122bbe 2252 if (err)
9a91a04a 2253 break;
9a91a04a 2254
3733937d 2255 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2256 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2257 else
d660366d 2258 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2259
d660366d 2260 err = len;
9a91a04a 2261
94122bbe
MM		 2262 /* If the skbs were not queued for sending, they'll still be in
2263 * seg_queue and need to be purged.
2264 */
2265 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2266 break;
2267
2268 default:
2269 BT_DBG("bad state %1.1x", chan->mode);
2270 err = -EBADFD;
2271 }
2272
2273 return err;
2274}
2275
d2a7ac5d
MM		 2276static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2277{
bed68bde
MM		 2278 struct l2cap_ctrl control;
2279 u16 seq;
2280
b4400672 2281 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2282
2283 memset(&control, 0, sizeof(control));
2284 control.sframe = 1;
2285 control.super = L2CAP_SUPER_SREJ;
2286
2287 for (seq = chan->expected_tx_seq; seq != txseq;
2288 seq = __next_seq(chan, seq)) {
2289 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2290 control.reqseq = seq;
2291 l2cap_send_sframe(chan, &control);
2292 l2cap_seq_list_append(&chan->srej_list, seq);
2293 }
2294 }
2295
2296 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2297}
2298
2299static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2300{
bed68bde
MM		 2301 struct l2cap_ctrl control;
2302
2303 BT_DBG("chan %p", chan);
2304
2305 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2306 return;
2307
2308 memset(&control, 0, sizeof(control));
2309 control.sframe = 1;
2310 control.super = L2CAP_SUPER_SREJ;
2311 control.reqseq = chan->srej_list.tail;
2312 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2313}
2314
2315static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2316{
bed68bde
MM		 2317 struct l2cap_ctrl control;
2318 u16 initial_head;
2319 u16 seq;
2320
b4400672 2321 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2322
2323 memset(&control, 0, sizeof(control));
2324 control.sframe = 1;
2325 control.super = L2CAP_SUPER_SREJ;
2326
2327 /* Capture initial list head to allow only one pass through the list. */
2328 initial_head = chan->srej_list.head;
2329
2330 do {
2331 seq = l2cap_seq_list_pop(&chan->srej_list);
2332 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2333 break;
2334
2335 control.reqseq = seq;
2336 l2cap_send_sframe(chan, &control);
2337 l2cap_seq_list_append(&chan->srej_list, seq);
2338 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2339}
2340
608bcc6d
MM		 2341static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2342{
2343 struct sk_buff *acked_skb;
2344 u16 ackseq;
2345
b4400672 2346 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2347
2348 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2349 return;
2350
b4400672 2351 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2352 chan->expected_ack_seq, chan->unacked_frames);
2353
2354 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2355 ackseq = __next_seq(chan, ackseq)) {
2356
2357 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2358 if (acked_skb) {
2359 skb_unlink(acked_skb, &chan->tx_q);
2360 kfree_skb(acked_skb);
2361 chan->unacked_frames--;
2362 }
2363 }
2364
2365 chan->expected_ack_seq = reqseq;
2366
2367 if (chan->unacked_frames == 0)
2368 __clear_retrans_timer(chan);
2369
b4400672 2370 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2371}
2372
2373static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2374{
2375 BT_DBG("chan %p", chan);
2376
2377 chan->expected_tx_seq = chan->buffer_seq;
2378 l2cap_seq_list_clear(&chan->srej_list);
2379 skb_queue_purge(&chan->srej_q);
2380 chan->rx_state = L2CAP_RX_STATE_RECV;
2381}
2382
d660366d
GP		 2383static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2384 struct l2cap_ctrl *control,
2385 struct sk_buff_head *skbs, u8 event)
608bcc6d 2386{
608bcc6d
MM		 2387 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2388 event);
2389
2390 switch (event) {
2391 case L2CAP_EV_DATA_REQUEST:
2392 if (chan->tx_send_head == NULL)
2393 chan->tx_send_head = skb_peek(skbs);
2394
2395 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2396 l2cap_ertm_send(chan);
2397 break;
2398 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2399 BT_DBG("Enter LOCAL_BUSY");
2400 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2401
2402 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2403 /* The SREJ_SENT state must be aborted if we are to
2404 * enter the LOCAL_BUSY state.
2405 */
2406 l2cap_abort_rx_srej_sent(chan);
2407 }
2408
2409 l2cap_send_ack(chan);
2410
2411 break;
2412 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2413 BT_DBG("Exit LOCAL_BUSY");
2414 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2415
2416 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2417 struct l2cap_ctrl local_control;
2418
2419 memset(&local_control, 0, sizeof(local_control));
2420 local_control.sframe = 1;
2421 local_control.super = L2CAP_SUPER_RR;
2422 local_control.poll = 1;
2423 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2424 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2425
2426 chan->retry_count = 1;
2427 __set_monitor_timer(chan);
2428 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2429 }
2430 break;
2431 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2432 l2cap_process_reqseq(chan, control->reqseq);
2433 break;
2434 case L2CAP_EV_EXPLICIT_POLL:
2435 l2cap_send_rr_or_rnr(chan, 1);
2436 chan->retry_count = 1;
2437 __set_monitor_timer(chan);
2438 __clear_ack_timer(chan);
2439 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2440 break;
2441 case L2CAP_EV_RETRANS_TO:
2442 l2cap_send_rr_or_rnr(chan, 1);
2443 chan->retry_count = 1;
2444 __set_monitor_timer(chan);
2445 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2446 break;
2447 case L2CAP_EV_RECV_FBIT:
2448 /* Nothing to process */
2449 break;
2450 default:
2451 break;
2452 }
608bcc6d
MM		 2453}
2454
d660366d
GP		 2455static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2456 struct l2cap_ctrl *control,
2457 struct sk_buff_head *skbs, u8 event)
608bcc6d 2458{
608bcc6d
MM		 2459 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2460 event);
2461
2462 switch (event) {
2463 case L2CAP_EV_DATA_REQUEST:
2464 if (chan->tx_send_head == NULL)
2465 chan->tx_send_head = skb_peek(skbs);
2466 /* Queue data, but don't send. */
2467 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2468 break;
2469 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2470 BT_DBG("Enter LOCAL_BUSY");
2471 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2472
2473 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2474 /* The SREJ_SENT state must be aborted if we are to
2475 * enter the LOCAL_BUSY state.
2476 */
2477 l2cap_abort_rx_srej_sent(chan);
2478 }
2479
2480 l2cap_send_ack(chan);
2481
2482 break;
2483 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2484 BT_DBG("Exit LOCAL_BUSY");
2485 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2486
2487 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2488 struct l2cap_ctrl local_control;
2489 memset(&local_control, 0, sizeof(local_control));
2490 local_control.sframe = 1;
2491 local_control.super = L2CAP_SUPER_RR;
2492 local_control.poll = 1;
2493 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2494 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2495
2496 chan->retry_count = 1;
2497 __set_monitor_timer(chan);
2498 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2499 }
2500 break;
2501 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2502 l2cap_process_reqseq(chan, control->reqseq);
2503
2504 /* Fall through */
2505
2506 case L2CAP_EV_RECV_FBIT:
2507 if (control && control->final) {
2508 __clear_monitor_timer(chan);
2509 if (chan->unacked_frames > 0)
2510 __set_retrans_timer(chan);
2511 chan->retry_count = 0;
2512 chan->tx_state = L2CAP_TX_STATE_XMIT;
2513 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2514 }
2515 break;
2516 case L2CAP_EV_EXPLICIT_POLL:
2517 /* Ignore */
2518 break;
2519 case L2CAP_EV_MONITOR_TO:
2520 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2521 l2cap_send_rr_or_rnr(chan, 1);
2522 __set_monitor_timer(chan);
2523 chan->retry_count++;
2524 } else {
2525 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
2526 }
2527 break;
2528 default:
2529 break;
2530 }
608bcc6d
MM		 2531}
2532
d660366d
GP		 2533static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2534 struct sk_buff_head *skbs, u8 event)
608bcc6d 2535{
608bcc6d
MM		 2536 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2537 chan, control, skbs, event, chan->tx_state);
2538
2539 switch (chan->tx_state) {
2540 case L2CAP_TX_STATE_XMIT:
d660366d 2541 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2542 break;
2543 case L2CAP_TX_STATE_WAIT_F:
d660366d 2544 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2545 break;
2546 default:
2547 /* Ignore event */
2548 break;
2549 }
608bcc6d
MM		 2550}
2551
4b51dae9
MM		 2552static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2553 struct l2cap_ctrl *control)
2554{
2555 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2556 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2557}
2558
f80842a8
MM		 2559static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2560 struct l2cap_ctrl *control)
2561{
2562 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2563 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2564}
2565
1da177e4
LT		 2566/* Copy frame to all raw sockets on that connection */
2567static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2568{
1da177e4 2569 struct sk_buff *nskb;
48454079 2570 struct l2cap_chan *chan;
1da177e4
LT		 2571
2572 BT_DBG("conn %p", conn);
2573
3df91ea2 2574 mutex_lock(&conn->chan_lock);
3d57dc68 2575
3df91ea2 2576 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2577 struct sock *sk = chan->sk;
715ec005 2578 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2579 continue;
2580
2581 /* Don't send frame to the socket it came from */
2582 if (skb->sk == sk)
2583 continue;
8bcde1f2 2584 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 2585 if (!nskb)
1da177e4
LT		 2586 continue;
2587
80b98027 2588 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 2589 kfree_skb(nskb);
2590 }
3d57dc68 2591
3df91ea2 2592 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2593}
2594
2595/* ---- L2CAP signalling commands ---- */
b4400672
AE		 2596static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2597 u8 ident, u16 dlen, void *data)
1da177e4
LT		 2598{
2599 struct sk_buff *skb, **frag;
2600 struct l2cap_cmd_hdr *cmd;
2601 struct l2cap_hdr *lh;
2602 int len, count;
2603
b4400672
AE		 2604 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2605 conn, code, ident, dlen);
1da177e4
LT		 2606
2607 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2608 count = min_t(unsigned int, conn->mtu, len);
2609
8bcde1f2 2610 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2611 if (!skb)
2612 return NULL;
2613
2614 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2615 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2616
2617 if (conn->hcon->type == LE_LINK)
ac73498c 2618 lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 2619 else
ac73498c 2620 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2621
2622 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2623 cmd->code = code;
2624 cmd->ident = ident;
aca3192c 2625 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2626
2627 if (dlen) {
2628 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2629 memcpy(skb_put(skb, count), data, count);
2630 data += count;
2631 }
2632
2633 len -= skb->len;
2634
2635 /* Continuation fragments (no L2CAP header) */
2636 frag = &skb_shinfo(skb)->frag_list;
2637 while (len) {
2638 count = min_t(unsigned int, conn->mtu, len);
2639
8bcde1f2 2640 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2641 if (!*frag)
2642 goto fail;
2643
2644 memcpy(skb_put(*frag, count), data, count);
2645
2646 len -= count;
2647 data += count;
2648
2649 frag = &(*frag)->next;
2650 }
2651
2652 return skb;
2653
2654fail:
2655 kfree_skb(skb);
2656 return NULL;
2657}
2658
2d792818
GP		 2659static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2660 unsigned long *val)
1da177e4
LT		 2661{
2662 struct l2cap_conf_opt *opt = *ptr;
2663 int len;
2664
2665 len = L2CAP_CONF_OPT_SIZE + opt->len;
2666 *ptr += len;
2667
2668 *type = opt->type;
2669 *olen = opt->len;
2670
2671 switch (opt->len) {
2672 case 1:
2673 *val = *((u8 *) opt->val);
2674 break;
2675
2676 case 2:
bfaaeb3e 2677 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2678 break;
2679
2680 case 4:
bfaaeb3e 2681 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2682 break;
2683
2684 default:
2685 *val = (unsigned long) opt->val;
2686 break;
2687 }
2688
b4400672 2689 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 2690 return len;
2691}
2692
1da177e4
LT		 2693static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2694{
2695 struct l2cap_conf_opt *opt = *ptr;
2696
b4400672 2697 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4
LT		 2698
2699 opt->type = type;
2700 opt->len = len;
2701
2702 switch (len) {
2703 case 1:
2704 *((u8 *) opt->val) = val;
2705 break;
2706
2707 case 2:
4f8b691c 2708 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2709 break;
2710
2711 case 4:
4f8b691c 2712 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2713 break;
2714
2715 default:
2716 memcpy(opt->val, (void *) val, len);
2717 break;
2718 }
2719
2720 *ptr += L2CAP_CONF_OPT_SIZE + len;
2721}
2722
f89cef09
AE		 2723static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2724{
2725 struct l2cap_conf_efs efs;
2726
1ec918ce 2727 switch (chan->mode) {
f89cef09
AE		 2728 case L2CAP_MODE_ERTM:
2729 efs.id = chan->local_id;
2730 efs.stype = chan->local_stype;
2731 efs.msdu = cpu_to_le16(chan->local_msdu);
2732 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
ac73498c 2733 efs.acc_lat = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
8936fa6d 2734 efs.flush_to = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 2735 break;
2736
2737 case L2CAP_MODE_STREAMING:
2738 efs.id = 1;
2739 efs.stype = L2CAP_SERV_BESTEFFORT;
2740 efs.msdu = cpu_to_le16(chan->local_msdu);
2741 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2742 efs.acc_lat = 0;
2743 efs.flush_to = 0;
2744 break;
2745
2746 default:
2747 return;
2748 }
2749
2750 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
8936fa6d 2751 (unsigned long) &efs);
f89cef09
AE		 2752}
2753
721c4181 2754static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2755{
721c4181 2756 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 2757 ack_timer.work);
2758 u16 frames_to_ack;
c1b4f43b 2759
2fb9b3d4
GP		 2760 BT_DBG("chan %p", chan);
2761
6be36555
AE		 2762 l2cap_chan_lock(chan);
2763
0362520b
MM		 2764 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2765 chan->last_acked_seq);
6be36555 2766
0362520b
MM		 2767 if (frames_to_ack)
2768 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 2769
0362520b 2770 l2cap_chan_unlock(chan);
09bfb2ee 2771 l2cap_chan_put(chan);
c1b4f43b
GP		 2772}
2773
466f8004 2774int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2775{
3c588192
MM		 2776 int err;
2777
105bdf9e
MM		 2778 chan->next_tx_seq = 0;
2779 chan->expected_tx_seq = 0;
42e5c802 2780 chan->expected_ack_seq = 0;
6a026610 2781 chan->unacked_frames = 0;
42e5c802 2782 chan->buffer_seq = 0;
6a026610 2783 chan->frames_sent = 0;
105bdf9e
MM		 2784 chan->last_acked_seq = 0;
2785 chan->sdu = NULL;
2786 chan->sdu_last_frag = NULL;
2787 chan->sdu_len = 0;
2788
d34c34fb
MM		 2789 skb_queue_head_init(&chan->tx_q);
2790
08333283
MM		 2791 chan->local_amp_id = 0;
2792 chan->move_id = 0;
2793 chan->move_state = L2CAP_MOVE_STABLE;
2794 chan->move_role = L2CAP_MOVE_ROLE_NONE;
2795
105bdf9e
MM		 2796 if (chan->mode != L2CAP_MODE_ERTM)
2797 return 0;
2798
2799 chan->rx_state = L2CAP_RX_STATE_RECV;
2800 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2801
721c4181
GP		 2802 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2803 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2804 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2805
f1c6775b 2806 skb_queue_head_init(&chan->srej_q);
1890d36b 2807
3c588192
MM		 2808 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2809 if (err < 0)
2810 return err;
2811
9dc9affc
MM		 2812 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
2813 if (err < 0)
2814 l2cap_seq_list_free(&chan->srej_list);
2815
2816 return err;
0565c1c2
GP		 2817}
2818
f2fcfcd6
GP		 2819static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2820{
2821 switch (mode) {
2822 case L2CAP_MODE_STREAMING:
2823 case L2CAP_MODE_ERTM:
2824 if (l2cap_mode_supported(mode, remote_feat_mask))
2825 return mode;
2826 /* fall through */
2827 default:
2828 return L2CAP_MODE_BASIC;
2829 }
2830}
2831
6327eb98
AE		 2832static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2833{
2834 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2835}
2836
f89cef09
AE		 2837static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2838{
2839 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2840}
2841
6327eb98
AE		 2842static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2843{
2844 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
2d792818 2845 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2846 /* use extended control field */
2847 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2848 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2849 } else {
6327eb98 2850 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 2851 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2852 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2853 }
c20f8e35 2854 chan->ack_win = chan->tx_win;
6327eb98
AE		 2855}
2856
710f9b0a 2857static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2858{
1da177e4 2859 struct l2cap_conf_req *req = data;
0c1bc5c6 2860 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2861 void *ptr = req->data;
c8f79162 2862 u16 size;
1da177e4 2863
49208c9c 2864 BT_DBG("chan %p", chan);
1da177e4 2865
73ffa904 2866 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2867 goto done;
2868
0c1bc5c6 2869 switch (chan->mode) {
f2fcfcd6
GP		 2870 case L2CAP_MODE_STREAMING:
2871 case L2CAP_MODE_ERTM:
c1360a1c 2872 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2873 break;
85eb53c6 2874
f89cef09
AE		 2875 if (__l2cap_efs_supported(chan))
2876 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2877
2ba13ed6 2878 /* fall through */
f2fcfcd6 2879 default:
8c1d787b 2880 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2881 break;
2882 }
2883
2884done:
0c1bc5c6
GP		 2885 if (chan->imtu != L2CAP_DEFAULT_MTU)
2886 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2887
0c1bc5c6 2888 switch (chan->mode) {
65c7c491 2889 case L2CAP_MODE_BASIC:
8c1d787b 2890 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 2891 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2892 break;
2893
62547752
GP		 2894 rfc.mode = L2CAP_MODE_BASIC;
2895 rfc.txwin_size = 0;
2896 rfc.max_transmit = 0;
2897 rfc.retrans_timeout = 0;
2898 rfc.monitor_timeout = 0;
2899 rfc.max_pdu_size = 0;
2900
63406504 2901 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 2902 (unsigned long) &rfc);
65c7c491
MH		 2903 break;
2904
2905 case L2CAP_MODE_ERTM:
2906 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2907 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2908 rfc.retrans_timeout = 0;
2909 rfc.monitor_timeout = 0;
c8f79162
AE		 2910
2911 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 2912 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
2913 L2CAP_FCS_SIZE);
c8f79162 2914 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2915
6327eb98
AE		 2916 l2cap_txwin_setup(chan);
2917
2918 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 2919 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2920
63406504 2921 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 2922 (unsigned long) &rfc);
63406504 2923
f89cef09
AE		 2924 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2925 l2cap_add_opt_efs(&ptr, chan);
2926
8c1d787b 2927 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2928 break;
2929
47d1ec61 2930 if (chan->fcs == L2CAP_FCS_NONE ||
2d792818 2931 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2932 chan->fcs = L2CAP_FCS_NONE;
2933 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2934 }
6327eb98
AE		 2935
2936 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2937 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2d792818 2938 chan->tx_win);
f2fcfcd6
GP		 2939 break;
2940
2941 case L2CAP_MODE_STREAMING:
273759e2 2942 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 2943 rfc.mode = L2CAP_MODE_STREAMING;
2944 rfc.txwin_size = 0;
2945 rfc.max_transmit = 0;
2946 rfc.retrans_timeout = 0;
2947 rfc.monitor_timeout = 0;
c8f79162
AE		 2948
2949 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 2950 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
2951 L2CAP_FCS_SIZE);
c8f79162 2952 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2953
63406504 2954 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 2955 (unsigned long) &rfc);
63406504 2956
f89cef09
AE		 2957 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2958 l2cap_add_opt_efs(&ptr, chan);
2959
8c1d787b 2960 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2961 break;
2962
47d1ec61 2963 if (chan->fcs == L2CAP_FCS_NONE ||
2d792818 2964 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2965 chan->fcs = L2CAP_FCS_NONE;
2966 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2967 }
65c7c491
MH		 2968 break;
2969 }
1da177e4 2970
fe4128e0 2971 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 2972 req->flags = __constant_cpu_to_le16(0);
1da177e4
LT		 2973
2974 return ptr - data;
2975}
2976
73ffa904 2977static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2978{
5dee9e7c
MH		 2979 struct l2cap_conf_rsp *rsp = data;
2980 void *ptr = rsp->data;
73ffa904
GP		 2981 void *req = chan->conf_req;
2982 int len = chan->conf_len;
5dee9e7c
MH		 2983 int type, hint, olen;
2984 unsigned long val;
6464f35f 2985 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2986 struct l2cap_conf_efs efs;
2987 u8 remote_efs = 0;
861d6882 2988 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2989 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2990 u16 size;
1da177e4 2991
73ffa904 2992 BT_DBG("chan %p", chan);
820ae1b8 2993
5dee9e7c
MH		 2994 while (len >= L2CAP_CONF_OPT_SIZE) {
2995 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2996
589d2746 2997 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2998 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2999
3000 switch (type) {
3001 case L2CAP_CONF_MTU:
861d6882 3002 mtu = val;
5dee9e7c
MH		 3003 break;
3004
3005 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3006 chan->flush_to = val;
5dee9e7c
MH		 3007 break;
3008
3009 case L2CAP_CONF_QOS:
3010 break;
3011
6464f35f
MH		 3012 case L2CAP_CONF_RFC:
3013 if (olen == sizeof(rfc))
3014 memcpy(&rfc, (void *) val, olen);
3015 break;
3016
fcc203c3
GP		 3017 case L2CAP_CONF_FCS:
3018 if (val == L2CAP_FCS_NONE)
c1360a1c 3019 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 3020 break;
fcc203c3 3021
42dceae2
AE		 3022 case L2CAP_CONF_EFS:
3023 remote_efs = 1;
3024 if (olen == sizeof(efs))
3025 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3026 break;
3027
6327eb98
AE		 3028 case L2CAP_CONF_EWS:
3029 if (!enable_hs)
3030 return -ECONNREFUSED;
fcc203c3 3031
6327eb98
AE		 3032 set_bit(FLAG_EXT_CTRL, &chan->flags);
3033 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3034 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3035 chan->remote_tx_win = val;
fcc203c3
GP		 3036 break;
3037
5dee9e7c
MH		 3038 default:
3039 if (hint)
3040 break;
3041
3042 result = L2CAP_CONF_UNKNOWN;
3043 *((u8 *) ptr++) = type;
3044 break;
3045 }
3046 }
3047
73ffa904 3048 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3049 goto done;
3050
0c1bc5c6 3051 switch (chan->mode) {
f2fcfcd6
GP		 3052 case L2CAP_MODE_STREAMING:
3053 case L2CAP_MODE_ERTM:
c1360a1c 3054 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3055 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3056 chan->conn->feat_mask);
85eb53c6
GP		 3057 break;
3058 }
3059
42dceae2
AE		 3060 if (remote_efs) {
3061 if (__l2cap_efs_supported(chan))
3062 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3063 else
3064 return -ECONNREFUSED;
3065 }
3066
0c1bc5c6 3067 if (chan->mode != rfc.mode)
f2fcfcd6 3068 return -ECONNREFUSED;
742e519b 3069
f2fcfcd6 3070 break;
f2fcfcd6
GP		 3071 }
3072
3073done:
0c1bc5c6 3074 if (chan->mode != rfc.mode) {
f2fcfcd6 3075 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3076 rfc.mode = chan->mode;
f2fcfcd6 3077
73ffa904 3078 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3079 return -ECONNREFUSED;
3080
2d792818
GP		 3081 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3082 (unsigned long) &rfc);
f2fcfcd6
GP		 3083 }
3084
5dee9e7c
MH		 3085 if (result == L2CAP_CONF_SUCCESS) {
3086 /* Configure output options and let the other side know
3087 * which ones we don't like. */
3088
f2fcfcd6
GP		 3089 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3090 result = L2CAP_CONF_UNACCEPT;
3091 else {
0c1bc5c6 3092 chan->omtu = mtu;
c1360a1c 3093 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3094 }
0c1bc5c6 3095 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 3096
42dceae2
AE		 3097 if (remote_efs) {
3098 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3099 efs.stype != L2CAP_SERV_NOTRAFIC &&
3100 efs.stype != chan->local_stype) {
42dceae2
AE		 3101
3102 result = L2CAP_CONF_UNACCEPT;
3103
3104 if (chan->num_conf_req >= 1)
3105 return -ECONNREFUSED;
3106
3107 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3108 sizeof(efs),
3109 (unsigned long) &efs);
0e8b207e 3110 } else {
3e6b3b95 3111 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3112 result = L2CAP_CONF_PENDING;
3113 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3114 }
3115 }
3116
f2fcfcd6
GP		 3117 switch (rfc.mode) {
3118 case L2CAP_MODE_BASIC:
47d1ec61 3119 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3120 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3121 break;
3122
3123 case L2CAP_MODE_ERTM:
6327eb98
AE		 3124 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3125 chan->remote_tx_win = rfc.txwin_size;
3126 else
3127 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3128
2c03a7a4 3129 chan->remote_max_tx = rfc.max_transmit;
1c762159 3130
c8f79162 3131 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3132 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3133 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3134 rfc.max_pdu_size = cpu_to_le16(size);
3135 chan->remote_mps = size;
f2fcfcd6 3136
10467e9e 3137 rfc.retrans_timeout =
4fd21a88 3138 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 3139 rfc.monitor_timeout =
4fd21a88 3140 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 3141
c1360a1c 3142 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3143
3144 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3145 sizeof(rfc), (unsigned long) &rfc);
68ae6639 3146
42dceae2
AE		 3147 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3148 chan->remote_id = efs.id;
3149 chan->remote_stype = efs.stype;
3150 chan->remote_msdu = le16_to_cpu(efs.msdu);
3151 chan->remote_flush_to =
2d792818 3152 le32_to_cpu(efs.flush_to);
42dceae2 3153 chan->remote_acc_lat =
2d792818 3154 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3155 chan->remote_sdu_itime =
3156 le32_to_cpu(efs.sdu_itime);
3157 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3158 sizeof(efs),
3159 (unsigned long) &efs);
42dceae2 3160 }
f2fcfcd6
GP		 3161 break;
3162
3163 case L2CAP_MODE_STREAMING:
c8f79162 3164 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3165 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3166 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3167 rfc.max_pdu_size = cpu_to_le16(size);
3168 chan->remote_mps = size;
f2fcfcd6 3169
c1360a1c 3170 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3171
2d792818
GP		 3172 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3173 (unsigned long) &rfc);
68ae6639 3174
f2fcfcd6
GP		 3175 break;
3176
3177 default:
5dee9e7c 3178 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3179
6464f35f 3180 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3181 rfc.mode = chan->mode;
f2fcfcd6 3182 }
6464f35f 3183
f2fcfcd6 3184 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3185 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3186 }
fe4128e0 3187 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3188 rsp->result = cpu_to_le16(result);
59e54bd1 3189 rsp->flags = __constant_cpu_to_le16(0);
5dee9e7c
MH		 3190
3191 return ptr - data;
1da177e4
LT		 3192}
3193
2d792818
GP		 3194static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3195 void *data, u16 *result)
f2fcfcd6 3196{
f2fcfcd6
GP		 3197 struct l2cap_conf_req *req = data;
3198 void *ptr = req->data;
3199 int type, olen;
3200 unsigned long val;
36e999a8 3201 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3202 struct l2cap_conf_efs efs;
f2fcfcd6 3203
fe4128e0 3204 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3205
3206 while (len >= L2CAP_CONF_OPT_SIZE) {
3207 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3208
3209 switch (type) {
3210 case L2CAP_CONF_MTU:
3211 if (val < L2CAP_DEFAULT_MIN_MTU) {
3212 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3213 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3214 } else
0c1bc5c6
GP		 3215 chan->imtu = val;
3216 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 3217 break;
3218
3219 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3220 chan->flush_to = val;
f2fcfcd6 3221 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2d792818 3222 2, chan->flush_to);
f2fcfcd6
GP		 3223 break;
3224
3225 case L2CAP_CONF_RFC:
3226 if (olen == sizeof(rfc))
3227 memcpy(&rfc, (void *)val, olen);
3228
c1360a1c 3229 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3230 rfc.mode != chan->mode)
f2fcfcd6
GP		 3231 return -ECONNREFUSED;
3232
47d1ec61 3233 chan->fcs = 0;
f2fcfcd6
GP		 3234
3235 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3236 sizeof(rfc), (unsigned long) &rfc);
f2fcfcd6 3237 break;
6327eb98
AE		 3238
3239 case L2CAP_CONF_EWS:
c20f8e35 3240 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3241 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
c20f8e35 3242 chan->tx_win);
6327eb98 3243 break;
66af7aaf
AE		 3244
3245 case L2CAP_CONF_EFS:
3246 if (olen == sizeof(efs))
3247 memcpy(&efs, (void *)val, olen);
3248
3249 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3250 efs.stype != L2CAP_SERV_NOTRAFIC &&
3251 efs.stype != chan->local_stype)
66af7aaf
AE		 3252 return -ECONNREFUSED;
3253
2d792818
GP		 3254 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3255 (unsigned long) &efs);
66af7aaf 3256 break;
f2fcfcd6
GP		 3257 }
3258 }
3259
0c1bc5c6 3260 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3261 return -ECONNREFUSED;
3262
0c1bc5c6 3263 chan->mode = rfc.mode;
6c2ea7a8 3264
0e8b207e 3265 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3266 switch (rfc.mode) {
3267 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3268 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3269 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3270 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3271 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3272 chan->ack_win = min_t(u16, chan->ack_win,
3273 rfc.txwin_size);
66af7aaf
AE		 3274
3275 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3276 chan->local_msdu = le16_to_cpu(efs.msdu);
3277 chan->local_sdu_itime =
2d792818 3278 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3279 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3280 chan->local_flush_to =
2d792818 3281 le32_to_cpu(efs.flush_to);
66af7aaf 3282 }
f2fcfcd6 3283 break;
66af7aaf 3284
f2fcfcd6 3285 case L2CAP_MODE_STREAMING:
47d1ec61 3286 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3287 }
3288 }
3289
fe4128e0 3290 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 3291 req->flags = __constant_cpu_to_le16(0);
f2fcfcd6
GP		 3292
3293 return ptr - data;
3294}
3295
2d792818
GP		 3296static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3297 u16 result, u16 flags)
1da177e4
LT		 3298{
3299 struct l2cap_conf_rsp *rsp = data;
3300 void *ptr = rsp->data;
1da177e4 3301
fe4128e0 3302 BT_DBG("chan %p", chan);
1da177e4 3303
fe4128e0 3304 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3305 rsp->result = cpu_to_le16(result);
aca3192c 3306 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3307
3308 return ptr - data;
3309}
3310
8c1d787b 3311void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3312{
3313 struct l2cap_conn_rsp rsp;
8c1d787b 3314 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 3315 u8 buf[128];
3316
fe4128e0
GP		 3317 rsp.scid = cpu_to_le16(chan->dcid);
3318 rsp.dcid = cpu_to_le16(chan->scid);
ac73498c
AE		 3319 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
3320 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
2d792818 3321 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
710f9b0a 3322
c1360a1c 3323 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3324 return;
3325
710f9b0a 3326 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3327 l2cap_build_conf_req(chan, buf), buf);
710f9b0a
GP		 3328 chan->num_conf_req++;
3329}
3330
47d1ec61 3331static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3332{
7b1c0049
GP		 3333 int type, olen;
3334 unsigned long val;
c20f8e35
MM		 3335 /* Use sane default values in case a misbehaving remote device
3336 * did not send an RFC or extended window size option.
3337 */
3338 u16 txwin_ext = chan->ack_win;
3339 struct l2cap_conf_rfc rfc = {
3340 .mode = chan->mode,
3341 .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3342 .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3343 .max_pdu_size = cpu_to_le16(chan->imtu),
3344 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3345 };
7b1c0049 3346
47d1ec61 3347 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3348
0c1bc5c6 3349 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3350 return;
3351
3352 while (len >= L2CAP_CONF_OPT_SIZE) {
3353 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3354
c20f8e35
MM		 3355 switch (type) {
3356 case L2CAP_CONF_RFC:
3357 if (olen == sizeof(rfc))
3358 memcpy(&rfc, (void *)val, olen);
8f321f85 3359 break;
c20f8e35
MM		 3360 case L2CAP_CONF_EWS:
3361 txwin_ext = val;
3362 break;
3363 }
7b1c0049
GP		 3364 }
3365
7b1c0049
GP		 3366 switch (rfc.mode) {
3367 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3368 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3369 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 3370 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3371 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3372 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3373 else
3374 chan->ack_win = min_t(u16, chan->ack_win,
3375 rfc.txwin_size);
7b1c0049
GP		 3376 break;
3377 case L2CAP_MODE_STREAMING:
47d1ec61 3378 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3379 }
3380}
3381
2d792818
GP		 3382static inline int l2cap_command_rej(struct l2cap_conn *conn,
3383 struct l2cap_cmd_hdr *cmd, u8 *data)
4e8402a3 3384{
e2fd318e 3385 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3386
e2fd318e 3387 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3388 return 0;
3389
3390 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 3391 cmd->ident == conn->info_ident) {
17cd3f37 3392 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3393
3394 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3395 conn->info_ident = 0;
984947dc 3396
4e8402a3
MH		 3397 l2cap_conn_start(conn);
3398 }
3399
3400 return 0;
3401}
3402
1700915f
MM		 3403static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3404 struct l2cap_cmd_hdr *cmd,
3405 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 3406{
1da177e4
LT		 3407 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3408 struct l2cap_conn_rsp rsp;
23691d75 3409 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 3410 struct sock *parent, *sk = NULL;
e7c29cb1 3411 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3412
3413 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3414 __le16 psm = req->psm;
1da177e4 3415
097db76c 3416 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3417
3418 /* Check if we have socket listening on psm */
c2287681 3419 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 3420 if (!pchan) {
1da177e4
LT		 3421 result = L2CAP_CR_BAD_PSM;
3422 goto sendresp;
3423 }
3424
23691d75
GP		 3425 parent = pchan->sk;
3426
3df91ea2 3427 mutex_lock(&conn->chan_lock);
aa2ac881 3428 lock_sock(parent);
e0f0cb56 3429
e7c29cb1 3430 /* Check if the ACL is secure enough (if not SDP) */
2983fd68 3431 if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 3432 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3433 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3434 result = L2CAP_CR_SEC_BLOCK;
3435 goto response;
3436 }
3437
1da177e4
LT		 3438 result = L2CAP_CR_NO_MEM;
3439
2dfa1003
GP		 3440 /* Check if we already have channel with that dcid */
3441 if (__l2cap_get_chan_by_dcid(conn, scid))
3442 goto response;
3443
80b98027 3444 chan = pchan->ops->new_connection(pchan);
80808e43 3445 if (!chan)
1da177e4
LT		 3446 goto response;
3447
80808e43
GP		 3448 sk = chan->sk;
3449
1da177e4
LT		 3450 hci_conn_hold(conn->hcon);
3451
1da177e4
LT		 3452 bacpy(&bt_sk(sk)->src, conn->src);
3453 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3454 chan->psm = psm;
3455 chan->dcid = scid;
1700915f 3456 chan->local_amp_id = amp_id;
1da177e4 3457
6be36555 3458 __l2cap_chan_add(conn, chan);
48454079 3459
fe4128e0 3460 dcid = chan->scid;
1da177e4 3461
c9b66675 3462 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3463
fc7f8a7e 3464 chan->ident = cmd->ident;
1da177e4 3465
984947dc 3466 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3467 if (l2cap_chan_check_security(chan)) {
c5daa683 3468 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
0e587be7 3469 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3470 result = L2CAP_CR_PEND;
3471 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 3472 chan->ops->defer(chan);
f66dc81f 3473 } else {
1700915f
MM		 3474 /* Force pending result for AMP controllers.
3475 * The connection will succeed after the
3476 * physical link is up.
3477 */
3478 if (amp_id) {
3479 __l2cap_state_change(chan, BT_CONNECT2);
3480 result = L2CAP_CR_PEND;
3481 } else {
3482 __l2cap_state_change(chan, BT_CONFIG);
3483 result = L2CAP_CR_SUCCESS;
3484 }
f66dc81f
MH		 3485 status = L2CAP_CS_NO_INFO;
3486 }
79d554a6 3487 } else {
0e587be7 3488 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3489 result = L2CAP_CR_PEND;
3490 status = L2CAP_CS_AUTHEN_PEND;
3491 }
3492 } else {
0e587be7 3493 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3494 result = L2CAP_CR_PEND;
3495 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3496 }
3497
1da177e4 3498response:
aa2ac881 3499 release_sock(parent);
3df91ea2 3500 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3501
3502sendresp:
aca3192c
YH		 3503 rsp.scid = cpu_to_le16(scid);
3504 rsp.dcid = cpu_to_le16(dcid);
3505 rsp.result = cpu_to_le16(result);
3506 rsp.status = cpu_to_le16(status);
4c89b6aa 3507 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 3508
3509 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3510 struct l2cap_info_req info;
ac73498c 3511 info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 3512
3513 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3514 conn->info_ident = l2cap_get_ident(conn);
3515
ba13ccd9 3516 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 3517
2d792818
GP		 3518 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3519 sizeof(info), &info);
79d554a6
MH		 3520 }
3521
c1360a1c 3522 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 3523 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 3524 u8 buf[128];
c1360a1c 3525 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3526 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3527 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3528 chan->num_conf_req++;
e9aeb2dd 3529 }
1700915f
MM		 3530
3531 return chan;
4c89b6aa 3532}
e9aeb2dd 3533
4c89b6aa
MM		 3534static int l2cap_connect_req(struct l2cap_conn *conn,
3535 struct l2cap_cmd_hdr *cmd, u8 *data)
3536{
300229f9 3537 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 3538 return 0;
3539}
3540
2d792818
GP		 3541static inline int l2cap_connect_rsp(struct l2cap_conn *conn,
3542 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3543{
3544 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3545 u16 scid, dcid, result, status;
48454079 3546 struct l2cap_chan *chan;
1da177e4 3547 u8 req[128];
3df91ea2 3548 int err;
1da177e4
LT		 3549
3550 scid = __le16_to_cpu(rsp->scid);
3551 dcid = __le16_to_cpu(rsp->dcid);
3552 result = __le16_to_cpu(rsp->result);
3553 status = __le16_to_cpu(rsp->status);
3554
1b009c98 3555 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 3556 dcid, scid, result, status);
1da177e4 3557
3df91ea2
AE		 3558 mutex_lock(&conn->chan_lock);
3559
1da177e4 3560 if (scid) {
3df91ea2
AE		 3561 chan = __l2cap_get_chan_by_scid(conn, scid);
3562 if (!chan) {
3563 err = -EFAULT;
3564 goto unlock;
3565 }
1da177e4 3566 } else {
3df91ea2
AE		 3567 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3568 if (!chan) {
3569 err = -EFAULT;
3570 goto unlock;
3571 }
1da177e4
LT		 3572 }
3573
3df91ea2
AE		 3574 err = 0;
3575
6be36555 3576 l2cap_chan_lock(chan);
48454079 3577
1da177e4
LT		 3578 switch (result) {
3579 case L2CAP_CR_SUCCESS:
89bc500e 3580 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3581 chan->ident = 0;
fe4128e0 3582 chan->dcid = dcid;
c1360a1c 3583 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3584
c1360a1c 3585 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3586 break;
3587
1da177e4 3588 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3589 l2cap_build_conf_req(chan, req), req);
73ffa904 3590 chan->num_conf_req++;
1da177e4
LT		 3591 break;
3592
3593 case L2CAP_CR_PEND:
c1360a1c 3594 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3595 break;
3596
3597 default:
48454079 3598 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3599 break;
3600 }
3601
6be36555 3602 l2cap_chan_unlock(chan);
3df91ea2
AE		 3603
3604unlock:
3605 mutex_unlock(&conn->chan_lock);
3606
3607 return err;
1da177e4
LT		 3608}
3609
47d1ec61 3610static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3611{
3612 /* FCS is enabled only in ERTM or streaming mode, if one or both
3613 * sides request it.
3614 */
0c1bc5c6 3615 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3616 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3617 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3618 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3619}
3620
29d8a590
AE		 3621static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
3622 u8 ident, u16 flags)
3623{
3624 struct l2cap_conn *conn = chan->conn;
3625
3626 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
3627 flags);
3628
3629 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3630 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3631
3632 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
3633 l2cap_build_conf_rsp(chan, data,
3634 L2CAP_CONF_SUCCESS, flags), data);
3635}
3636
2d792818
GP		 3637static inline int l2cap_config_req(struct l2cap_conn *conn,
3638 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3639 u8 *data)
1da177e4
LT		 3640{
3641 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3642 u16 dcid, flags;
3643 u8 rsp[64];
48454079 3644 struct l2cap_chan *chan;
3c588192 3645 int len, err = 0;
1da177e4
LT		 3646
3647 dcid = __le16_to_cpu(req->dcid);
3648 flags = __le16_to_cpu(req->flags);
3649
3650 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3651
baa7e1fa 3652 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3653 if (!chan)
1da177e4
LT		 3654 return -ENOENT;
3655
033b1142 3656 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3657 struct l2cap_cmd_rej_cid rej;
3658
ac73498c 3659 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
e2fd318e
IK		 3660 rej.scid = cpu_to_le16(chan->scid);
3661 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3662
df6bd743 3663 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2d792818 3664 sizeof(rej), &rej);
354f60a9 3665 goto unlock;
df6bd743 3666 }
354f60a9 3667
5dee9e7c 3668 /* Reject if config buffer is too small. */
88219a0f 3669 len = cmd_len - sizeof(*req);
7ac28817 3670 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3671 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 3672 l2cap_build_conf_rsp(chan, rsp,
3673 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 3674 goto unlock;
3675 }
3676
3677 /* Store config. */
73ffa904
GP		 3678 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3679 chan->conf_len += len;
1da177e4 3680
59e54bd1 3681 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 3682 /* Incomplete config. Send empty response. */
3683 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 3684 l2cap_build_conf_rsp(chan, rsp,
3685 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 3686 goto unlock;
3687 }
3688
3689 /* Complete config. */
73ffa904 3690 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3691 if (len < 0) {
e92c8e70 3692 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3693 goto unlock;
f2fcfcd6 3694 }
1da177e4 3695
5dee9e7c 3696 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3697 chan->num_conf_rsp++;
5dee9e7c 3698
5dee9e7c 3699 /* Reset config buffer. */
73ffa904 3700 chan->conf_len = 0;
5dee9e7c 3701
c1360a1c 3702 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3703 goto unlock;
3704
c1360a1c 3705 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3706 set_default_fcs(chan);
fcc203c3 3707
105bdf9e
MM		 3708 if (chan->mode == L2CAP_MODE_ERTM ||
3709 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3710 err = l2cap_ertm_init(chan);
3711
3712 if (err < 0)
3713 l2cap_send_disconn_req(chan->conn, chan, -err);
3714 else
3715 l2cap_chan_ready(chan);
0565c1c2 3716
876d9484
MH		 3717 goto unlock;
3718 }
3719
c1360a1c 3720 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3721 u8 buf[64];
1da177e4 3722 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3723 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3724 chan->num_conf_req++;
1da177e4
LT		 3725 }
3726
0e8b207e
AE		 3727 /* Got Conf Rsp PENDING from remote side and asume we sent
3728 Conf Rsp PENDING in the code above */
3729 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 3730 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 3731
3732 /* check compatibility */
3733
79de886d
AE		 3734 /* Send rsp for BR/EDR channel */
3735 if (!chan->ctrl_id)
3736 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
3737 else
3738 chan->ident = cmd->ident;
0e8b207e
AE		 3739 }
3740
1da177e4 3741unlock:
6be36555 3742 l2cap_chan_unlock(chan);
3c588192 3743 return err;
1da177e4
LT		 3744}
3745
2d792818
GP		 3746static inline int l2cap_config_rsp(struct l2cap_conn *conn,
3747 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3748{
3749 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3750 u16 scid, flags, result;
48454079 3751 struct l2cap_chan *chan;
61386cba 3752 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3753 int err = 0;
1da177e4
LT		 3754
3755 scid = __le16_to_cpu(rsp->scid);
3756 flags = __le16_to_cpu(rsp->flags);
3757 result = __le16_to_cpu(rsp->result);
3758
61386cba
AE		 3759 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3760 result, len);
1da177e4 3761
baa7e1fa 3762 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3763 if (!chan)
1da177e4
LT		 3764 return 0;
3765
3766 switch (result) {
3767 case L2CAP_CONF_SUCCESS:
47d1ec61 3768 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3769 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3770 break;
3771
0e8b207e
AE		 3772 case L2CAP_CONF_PENDING:
3773 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3774
3775 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3776 char buf[64];
3777
3778 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 3779 buf, &result);
0e8b207e
AE		 3780 if (len < 0) {
3781 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3782 goto done;
3783 }
3784
3785 /* check compatibility */
3786
79de886d
AE		 3787 if (!chan->ctrl_id)
3788 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
3789 0);
3790 else
3791 chan->ident = cmd->ident;
0e8b207e
AE		 3792 }
3793 goto done;
3794
1da177e4 3795 case L2CAP_CONF_UNACCEPT:
73ffa904 3796 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3797 char req[64];
3798
c2c77ec8 3799 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3800 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3801 goto done;
3802 }
3803
f2fcfcd6
GP		 3804 /* throw out any old stored conf requests */
3805 result = L2CAP_CONF_SUCCESS;
b4450035 3806 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 3807 req, &result);
f2fcfcd6 3808 if (len < 0) {
e92c8e70 3809 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3810 goto done;
3811 }
3812
3813 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 3814 L2CAP_CONF_REQ, len, req);
73ffa904 3815 chan->num_conf_req++;
f2fcfcd6
GP		 3816 if (result != L2CAP_CONF_SUCCESS)
3817 goto done;
3818 break;
1da177e4
LT		 3819 }
3820
8e87d142 3821 default:
6be36555 3822 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3823
ba13ccd9 3824 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3825 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3826 goto done;
3827 }
3828
59e54bd1 3829 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 3830 goto done;
3831
c1360a1c 3832 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3833
c1360a1c 3834 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3835 set_default_fcs(chan);
fcc203c3 3836
105bdf9e
MM		 3837 if (chan->mode == L2CAP_MODE_ERTM ||
3838 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3839 err = l2cap_ertm_init(chan);
0565c1c2 3840
3c588192
MM		 3841 if (err < 0)
3842 l2cap_send_disconn_req(chan->conn, chan, -err);
3843 else
3844 l2cap_chan_ready(chan);
1da177e4
LT		 3845 }
3846
3847done:
6be36555 3848 l2cap_chan_unlock(chan);
3c588192 3849 return err;
1da177e4
LT		 3850}
3851
2d792818
GP		 3852static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
3853 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3854{
3855 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3856 struct l2cap_disconn_rsp rsp;
3857 u16 dcid, scid;
48454079 3858 struct l2cap_chan *chan;
1da177e4
LT		 3859 struct sock *sk;
3860
3861 scid = __le16_to_cpu(req->scid);
3862 dcid = __le16_to_cpu(req->dcid);
3863
3864 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3865
3df91ea2
AE		 3866 mutex_lock(&conn->chan_lock);
3867
3868 chan = __l2cap_get_chan_by_scid(conn, dcid);
3869 if (!chan) {
3870 mutex_unlock(&conn->chan_lock);
1da177e4 3871 return 0;
3df91ea2 3872 }
1da177e4 3873
6be36555
AE		 3874 l2cap_chan_lock(chan);
3875
48454079
GP		 3876 sk = chan->sk;
3877
fe4128e0
GP		 3878 rsp.dcid = cpu_to_le16(chan->scid);
3879 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3880 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3881
6be36555 3882 lock_sock(sk);
1da177e4 3883 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3884 release_sock(sk);
1da177e4 3885
61d6ef3e 3886 l2cap_chan_hold(chan);
48454079 3887 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3888
3889 l2cap_chan_unlock(chan);
1da177e4 3890
80b98027 3891 chan->ops->close(chan);
61d6ef3e 3892 l2cap_chan_put(chan);
3df91ea2
AE		 3893
3894 mutex_unlock(&conn->chan_lock);
3895
1da177e4
LT		 3896 return 0;
3897}
3898
2d792818
GP		 3899static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
3900 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3901{
3902 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3903 u16 dcid, scid;
48454079 3904 struct l2cap_chan *chan;
1da177e4
LT		 3905
3906 scid = __le16_to_cpu(rsp->scid);
3907 dcid = __le16_to_cpu(rsp->dcid);
3908
3909 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3910
3df91ea2
AE		 3911 mutex_lock(&conn->chan_lock);
3912
3913 chan = __l2cap_get_chan_by_scid(conn, scid);
3914 if (!chan) {
3915 mutex_unlock(&conn->chan_lock);
1da177e4 3916 return 0;
3df91ea2 3917 }
1da177e4 3918
6be36555 3919 l2cap_chan_lock(chan);
48454079 3920
61d6ef3e 3921 l2cap_chan_hold(chan);
48454079 3922 l2cap_chan_del(chan, 0);
6be36555
AE		 3923
3924 l2cap_chan_unlock(chan);
1da177e4 3925
80b98027 3926 chan->ops->close(chan);
61d6ef3e 3927 l2cap_chan_put(chan);
3df91ea2
AE		 3928
3929 mutex_unlock(&conn->chan_lock);
3930
1da177e4
LT		 3931 return 0;
3932}
3933
2d792818
GP		 3934static inline int l2cap_information_req(struct l2cap_conn *conn,
3935 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3936{
3937 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3938 u16 type;
3939
3940 type = __le16_to_cpu(req->type);
3941
3942 BT_DBG("type 0x%4.4x", type);
3943
f0709e03
MH		 3944 if (type == L2CAP_IT_FEAT_MASK) {
3945 u8 buf[8];
44dd46de 3946 u32 feat_mask = l2cap_feat_mask;
f0709e03 3947 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
ac73498c
AE		 3948 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
3949 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3950 if (!disable_ertm)
fcc203c3 3951 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 3952 | L2CAP_FEAT_FCS;
a5fd6f30 3953 if (enable_hs)
6327eb98 3954 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 3955 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3956
1b7bf4ed 3957 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 3958 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
3959 buf);
e1027a7c
MH		 3960 } else if (type == L2CAP_IT_FIXED_CHAN) {
3961 u8 buf[12];
3962 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3963
3964 if (enable_hs)
3965 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3966 else
3967 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3968
ac73498c
AE		 3969 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3970 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3971 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
2d792818
GP		 3972 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
3973 buf);
f0709e03
MH		 3974 } else {
3975 struct l2cap_info_rsp rsp;
3976 rsp.type = cpu_to_le16(type);
ac73498c 3977 rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 3978 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
3979 &rsp);
f0709e03 3980 }
1da177e4
LT		 3981
3982 return 0;
3983}
3984
2d792818
GP		 3985static inline int l2cap_information_rsp(struct l2cap_conn *conn,
3986 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3987{
3988 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3989 u16 type, result;
3990
3991 type = __le16_to_cpu(rsp->type);
3992 result = __le16_to_cpu(rsp->result);
3993
3994 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3995
e90165be
AE		 3996 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3997 if (cmd->ident != conn->info_ident ||
2d792818 3998 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 3999 return 0;
4000
17cd3f37 4001 cancel_delayed_work(&conn->info_timer);
4e8402a3 4002
adb08ede
VT		 4003 if (result != L2CAP_IR_SUCCESS) {
4004 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4005 conn->info_ident = 0;
4006
4007 l2cap_conn_start(conn);
4008
4009 return 0;
4010 }
4011
978c93b9
AE		 4012 switch (type) {
4013 case L2CAP_IT_FEAT_MASK:
83985319 4014 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4015
47ec1dcd 4016 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4017 struct l2cap_info_req req;
ac73498c 4018 req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4019
4020 conn->info_ident = l2cap_get_ident(conn);
4021
4022 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4023 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4024 } else {
4025 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4026 conn->info_ident = 0;
4027
4028 l2cap_conn_start(conn);
4029 }
978c93b9
AE		 4030 break;
4031
4032 case L2CAP_IT_FIXED_CHAN:
4033 conn->fixed_chan_mask = rsp->data[0];
984947dc 4034 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4035 conn->info_ident = 0;
984947dc
MH		 4036
4037 l2cap_conn_start(conn);
978c93b9 4038 break;
984947dc 4039 }
4e8402a3 4040
1da177e4
LT		 4041 return 0;
4042}
4043
1700915f
MM		 4044static int l2cap_create_channel_req(struct l2cap_conn *conn,
4045 struct l2cap_cmd_hdr *cmd,
4046 u16 cmd_len, void *data)
f94ff6ff
MM		 4047{
4048 struct l2cap_create_chan_req *req = data;
1700915f 4049 struct l2cap_chan *chan;
f94ff6ff
MM		 4050 u16 psm, scid;
4051
4052 if (cmd_len != sizeof(*req))
4053 return -EPROTO;
4054
4055 if (!enable_hs)
4056 return -EINVAL;
4057
4058 psm = le16_to_cpu(req->psm);
4059 scid = le16_to_cpu(req->scid);
4060
ad0ac6ca 4061 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4062
1700915f
MM		 4063 if (req->amp_id) {
4064 struct hci_dev *hdev;
4065
4066 /* Validate AMP controller id */
4067 hdev = hci_dev_get(req->amp_id);
4068 if (!hdev || hdev->dev_type != HCI_AMP ||
4069 !test_bit(HCI_UP, &hdev->flags)) {
4070 struct l2cap_create_chan_rsp rsp;
4071
4072 rsp.dcid = 0;
4073 rsp.scid = cpu_to_le16(scid);
4074 rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP);
4075 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4076
4077 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4078 sizeof(rsp), &rsp);
4079
4080 if (hdev)
4081 hci_dev_put(hdev);
4082
4083 return 0;
4084 }
4085
4086 hci_dev_put(hdev);
4087 }
f94ff6ff 4088
1700915f
MM		 4089 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4090 req->amp_id);
f94ff6ff
MM		 4091
4092 return 0;
4093}
4094
4095static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
2d792818
GP		 4096 struct l2cap_cmd_hdr *cmd,
4097 void *data)
f94ff6ff
MM		 4098{
4099 BT_DBG("conn %p", conn);
4100
4101 return l2cap_connect_rsp(conn, cmd, data);
4102}
4103
8d5a04a1 4104static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4105 u16 icid, u16 result)
8d5a04a1
MM		 4106{
4107 struct l2cap_move_chan_rsp rsp;
4108
ad0ac6ca 4109 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1
MM		 4110
4111 rsp.icid = cpu_to_le16(icid);
4112 rsp.result = cpu_to_le16(result);
4113
4114 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
4115}
4116
4117static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
ad0ac6ca
AE		 4118 struct l2cap_chan *chan,
4119 u16 icid, u16 result)
8d5a04a1
MM		 4120{
4121 struct l2cap_move_chan_cfm cfm;
4122 u8 ident;
4123
ad0ac6ca 4124 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1
MM		 4125
4126 ident = l2cap_get_ident(conn);
4127 if (chan)
4128 chan->ident = ident;
4129
4130 cfm.icid = cpu_to_le16(icid);
4131 cfm.result = cpu_to_le16(result);
4132
4133 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
4134}
4135
4136static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4137 u16 icid)
8d5a04a1
MM		 4138{
4139 struct l2cap_move_chan_cfm_rsp rsp;
4140
ad0ac6ca 4141 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4142
4143 rsp.icid = cpu_to_le16(icid);
4144 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4145}
4146
4147static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 4148 struct l2cap_cmd_hdr *cmd,
4149 u16 cmd_len, void *data)
8d5a04a1
MM		 4150{
4151 struct l2cap_move_chan_req *req = data;
4152 u16 icid = 0;
4153 u16 result = L2CAP_MR_NOT_ALLOWED;
4154
4155 if (cmd_len != sizeof(*req))
4156 return -EPROTO;
4157
4158 icid = le16_to_cpu(req->icid);
4159
ad0ac6ca 4160 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1
MM		 4161
4162 if (!enable_hs)
4163 return -EINVAL;
4164
4165 /* Placeholder: Always refuse */
4166 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
4167
4168 return 0;
4169}
4170
4171static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 4172 struct l2cap_cmd_hdr *cmd,
4173 u16 cmd_len, void *data)
8d5a04a1
MM		 4174{
4175 struct l2cap_move_chan_rsp *rsp = data;
4176 u16 icid, result;
4177
4178 if (cmd_len != sizeof(*rsp))
4179 return -EPROTO;
4180
4181 icid = le16_to_cpu(rsp->icid);
4182 result = le16_to_cpu(rsp->result);
4183
ad0ac6ca 4184 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1
MM		 4185
4186 /* Placeholder: Always unconfirmed */
4187 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
4188
4189 return 0;
4190}
4191
4192static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
ad0ac6ca
AE		 4193 struct l2cap_cmd_hdr *cmd,
4194 u16 cmd_len, void *data)
8d5a04a1
MM		 4195{
4196 struct l2cap_move_chan_cfm *cfm = data;
4197 u16 icid, result;
4198
4199 if (cmd_len != sizeof(*cfm))
4200 return -EPROTO;
4201
4202 icid = le16_to_cpu(cfm->icid);
4203 result = le16_to_cpu(cfm->result);
4204
ad0ac6ca 4205 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1
MM		 4206
4207 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
4208
4209 return 0;
4210}
4211
4212static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 4213 struct l2cap_cmd_hdr *cmd,
4214 u16 cmd_len, void *data)
8d5a04a1
MM		 4215{
4216 struct l2cap_move_chan_cfm_rsp *rsp = data;
4217 u16 icid;
4218
4219 if (cmd_len != sizeof(*rsp))
4220 return -EPROTO;
4221
4222 icid = le16_to_cpu(rsp->icid);
4223
ad0ac6ca 4224 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4225
4226 return 0;
4227}
4228
e2174ca4 4229static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
2d792818 4230 u16 to_multiplier)
de73115a
CT		 4231{
4232 u16 max_latency;
4233
4234 if (min > max || min < 6 || max > 3200)
4235 return -EINVAL;
4236
4237 if (to_multiplier < 10 || to_multiplier > 3200)
4238 return -EINVAL;
4239
4240 if (max >= to_multiplier * 8)
4241 return -EINVAL;
4242
4243 max_latency = (to_multiplier * 8 / max) - 1;
4244 if (latency > 499 || latency > max_latency)
4245 return -EINVAL;
4246
4247 return 0;
4248}
4249
4250static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818
GP		 4251 struct l2cap_cmd_hdr *cmd,
4252 u8 *data)
de73115a
CT		 4253{
4254 struct hci_conn *hcon = conn->hcon;
4255 struct l2cap_conn_param_update_req *req;
4256 struct l2cap_conn_param_update_rsp rsp;
4257 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 4258 int err;
de73115a
CT		 4259
4260 if (!(hcon->link_mode & HCI_LM_MASTER))
4261 return -EINVAL;
4262
4263 cmd_len = __le16_to_cpu(cmd->len);
4264 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4265 return -EPROTO;
4266
4267 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 4268 min = __le16_to_cpu(req->min);
4269 max = __le16_to_cpu(req->max);
de73115a
CT		 4270 latency = __le16_to_cpu(req->latency);
4271 to_multiplier = __le16_to_cpu(req->to_multiplier);
4272
4273 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 4274 min, max, latency, to_multiplier);
de73115a
CT		 4275
4276 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 4277
4278 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
4279 if (err)
ac73498c 4280 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 4281 else
ac73498c 4282 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 4283
4284 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 4285 sizeof(rsp), &rsp);
de73115a 4286
2ce603eb
CT		 4287 if (!err)
4288 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
4289
de73115a
CT		 4290 return 0;
4291}
4292
3300d9a9 4293static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 4294 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4295 u8 *data)
3300d9a9
CT		 4296{
4297 int err = 0;
4298
4299 switch (cmd->code) {
4300 case L2CAP_COMMAND_REJ:
4301 l2cap_command_rej(conn, cmd, data);
4302 break;
4303
4304 case L2CAP_CONN_REQ:
4305 err = l2cap_connect_req(conn, cmd, data);
4306 break;
4307
4308 case L2CAP_CONN_RSP:
f5a2598d 4309 case L2CAP_CREATE_CHAN_RSP:
3300d9a9
CT		 4310 err = l2cap_connect_rsp(conn, cmd, data);
4311 break;
4312
4313 case L2CAP_CONF_REQ:
4314 err = l2cap_config_req(conn, cmd, cmd_len, data);
4315 break;
4316
4317 case L2CAP_CONF_RSP:
4318 err = l2cap_config_rsp(conn, cmd, data);
4319 break;
4320
4321 case L2CAP_DISCONN_REQ:
4322 err = l2cap_disconnect_req(conn, cmd, data);
4323 break;
4324
4325 case L2CAP_DISCONN_RSP:
4326 err = l2cap_disconnect_rsp(conn, cmd, data);
4327 break;
4328
4329 case L2CAP_ECHO_REQ:
4330 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4331 break;
4332
4333 case L2CAP_ECHO_RSP:
4334 break;
4335
4336 case L2CAP_INFO_REQ:
4337 err = l2cap_information_req(conn, cmd, data);
4338 break;
4339
4340 case L2CAP_INFO_RSP:
4341 err = l2cap_information_rsp(conn, cmd, data);
4342 break;
4343
f94ff6ff
MM		 4344 case L2CAP_CREATE_CHAN_REQ:
4345 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
4346 break;
4347
8d5a04a1
MM		 4348 case L2CAP_MOVE_CHAN_REQ:
4349 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
4350 break;
4351
4352 case L2CAP_MOVE_CHAN_RSP:
4353 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
4354 break;
4355
4356 case L2CAP_MOVE_CHAN_CFM:
4357 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
4358 break;
4359
4360 case L2CAP_MOVE_CHAN_CFM_RSP:
4361 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
4362 break;
4363
3300d9a9
CT		 4364 default:
4365 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4366 err = -EINVAL;
4367 break;
4368 }
4369
4370 return err;
4371}
4372
4373static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
2d792818 4374 struct l2cap_cmd_hdr *cmd, u8 *data)
3300d9a9
CT		 4375{
4376 switch (cmd->code) {
4377 case L2CAP_COMMAND_REJ:
4378 return 0;
4379
4380 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 4381 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 4382
4383 case L2CAP_CONN_PARAM_UPDATE_RSP:
4384 return 0;
4385
4386 default:
4387 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
4388 return -EINVAL;
4389 }
4390}
4391
4392static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 4393 struct sk_buff *skb)
1da177e4
LT		 4394{
4395 u8 *data = skb->data;
4396 int len = skb->len;
4397 struct l2cap_cmd_hdr cmd;
3300d9a9 4398 int err;
1da177e4
LT		 4399
4400 l2cap_raw_recv(conn, skb);
4401
4402 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 4403 u16 cmd_len;
1da177e4
LT		 4404 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
4405 data += L2CAP_CMD_HDR_SIZE;
4406 len -= L2CAP_CMD_HDR_SIZE;
4407
88219a0f 4408 cmd_len = le16_to_cpu(cmd.len);
1da177e4 4409
2d792818
GP		 4410 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
4411 cmd.ident);
1da177e4 4412
88219a0f 4413 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 4414 BT_DBG("corrupted command");
4415 break;
4416 }
4417
3300d9a9
CT		 4418 if (conn->hcon->type == LE_LINK)
4419 err = l2cap_le_sig_cmd(conn, &cmd, data);
4420 else
4421 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 4422
4423 if (err) {
e2fd318e 4424 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 4425
4426 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 4427
4428 /* FIXME: Map err to a valid reason */
ac73498c 4429 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
2d792818
GP		 4430 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
4431 sizeof(rej), &rej);
1da177e4
LT		 4432 }
4433
88219a0f
AV		 4434 data += cmd_len;
4435 len -= cmd_len;
1da177e4
LT		 4436 }
4437
4438 kfree_skb(skb);
4439}
4440
47d1ec61 4441static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 4442{
4443 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 4444 int hdr_size;
4445
4446 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
4447 hdr_size = L2CAP_EXT_HDR_SIZE;
4448 else
4449 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 4450
47d1ec61 4451 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 4452 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 4453 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
4454 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
4455
4456 if (our_fcs != rcv_fcs)
7a560e5c 4457 return -EBADMSG;
fcc203c3
GP		 4458 }
4459 return 0;
4460}
4461
6ea00485 4462static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 4463{
e31f7633 4464 struct l2cap_ctrl control;
d5392c8f 4465
e31f7633 4466 BT_DBG("chan %p", chan);
d5392c8f 4467
e31f7633
MM		 4468 memset(&control, 0, sizeof(control));
4469 control.sframe = 1;
4470 control.final = 1;
4471 control.reqseq = chan->buffer_seq;
4472 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 4473
e2ab4353 4474 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 4475 control.super = L2CAP_SUPER_RNR;
4476 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 4477 }
4478
e31f7633
MM		 4479 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
4480 chan->unacked_frames > 0)
4481 __set_retrans_timer(chan);
d5392c8f 4482
e31f7633 4483 /* Send pending iframes */
525cd185 4484 l2cap_ertm_send(chan);
d5392c8f 4485
e2ab4353 4486 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 4487 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
4488 /* F-bit wasn't sent in an s-frame or i-frame yet, so
4489 * send it now.
4490 */
4491 control.super = L2CAP_SUPER_RR;
4492 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 4493 }
4494}
4495
2d792818
GP		 4496static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
4497 struct sk_buff **last_frag)
18778a63 4498{
84084a31
MM		 4499 /* skb->len reflects data in skb as well as all fragments
4500 * skb->data_len reflects only data in fragments
4501 */
4502 if (!skb_has_frag_list(skb))
4503 skb_shinfo(skb)->frag_list = new_frag;
4504
4505 new_frag->next = NULL;
4506
4507 (*last_frag)->next = new_frag;
4508 *last_frag = new_frag;
4509
4510 skb->len += new_frag->len;
4511 skb->data_len += new_frag->len;
4512 skb->truesize += new_frag->truesize;
4513}
4514
4b51dae9
MM		 4515static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
4516 struct l2cap_ctrl *control)
84084a31
MM		 4517{
4518 int err = -EINVAL;
18778a63 4519
4b51dae9 4520 switch (control->sar) {
7e0ef6ee 4521 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 4522 if (chan->sdu)
4523 break;
18778a63 4524
80b98027 4525 err = chan->ops->recv(chan, skb);
84084a31 4526 break;
18778a63 4527
7e0ef6ee 4528 case L2CAP_SAR_START:
84084a31
MM		 4529 if (chan->sdu)
4530 break;
18778a63 4531
6f61fd47 4532 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 4533 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 4534
84084a31
MM		 4535 if (chan->sdu_len > chan->imtu) {
4536 err = -EMSGSIZE;
4537 break;
4538 }
1890d36b 4539
84084a31
MM		 4540 if (skb->len >= chan->sdu_len)
4541 break;
18778a63 4542
84084a31
MM		 4543 chan->sdu = skb;
4544 chan->sdu_last_frag = skb;
18778a63 4545
84084a31
MM		 4546 skb = NULL;
4547 err = 0;
18778a63
GP		 4548 break;
4549
7e0ef6ee 4550 case L2CAP_SAR_CONTINUE:
6f61fd47 4551 if (!chan->sdu)
84084a31 4552 break;
18778a63 4553
84084a31
MM		 4554 append_skb_frag(chan->sdu, skb,
4555 &chan->sdu_last_frag);
4556 skb = NULL;
18778a63 4557
84084a31
MM		 4558 if (chan->sdu->len >= chan->sdu_len)
4559 break;
4178ba46 4560
84084a31 4561 err = 0;
18778a63
GP		 4562 break;
4563
7e0ef6ee 4564 case L2CAP_SAR_END:
6f61fd47 4565 if (!chan->sdu)
84084a31 4566 break;
18778a63 4567
84084a31
MM		 4568 append_skb_frag(chan->sdu, skb,
4569 &chan->sdu_last_frag);
4570 skb = NULL;
4178ba46 4571
84084a31
MM		 4572 if (chan->sdu->len != chan->sdu_len)
4573 break;
18778a63 4574
80b98027 4575 err = chan->ops->recv(chan, chan->sdu);
1890d36b 4576
84084a31
MM		 4577 if (!err) {
4578 /* Reassembly complete */
4579 chan->sdu = NULL;
4580 chan->sdu_last_frag = NULL;
4581 chan->sdu_len = 0;
1890d36b 4582 }
18778a63
GP		 4583 break;
4584 }
4585
84084a31
MM		 4586 if (err) {
4587 kfree_skb(skb);
4588 kfree_skb(chan->sdu);
4589 chan->sdu = NULL;
4590 chan->sdu_last_frag = NULL;
4591 chan->sdu_len = 0;
4592 }
18778a63 4593
84084a31 4594 return err;
18778a63
GP		 4595}
4596
61aa4f5b 4597void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 4598{
61aa4f5b 4599 u8 event;
712132eb 4600
61aa4f5b
MM		 4601 if (chan->mode != L2CAP_MODE_ERTM)
4602 return;
712132eb 4603
61aa4f5b 4604 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 4605 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 4606}
4607
d2a7ac5d
MM		 4608static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
4609{
63838725
MM		 4610 int err = 0;
4611 /* Pass sequential frames to l2cap_reassemble_sdu()
4612 * until a gap is encountered.
4613 */
4614
4615 BT_DBG("chan %p", chan);
4616
4617 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4618 struct sk_buff *skb;
4619 BT_DBG("Searching for skb with txseq %d (queue len %d)",
4620 chan->buffer_seq, skb_queue_len(&chan->srej_q));
4621
4622 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
4623
4624 if (!skb)
4625 break;
4626
4627 skb_unlink(skb, &chan->srej_q);
4628 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4629 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
4630 if (err)
4631 break;
4632 }
4633
4634 if (skb_queue_empty(&chan->srej_q)) {
4635 chan->rx_state = L2CAP_RX_STATE_RECV;
4636 l2cap_send_ack(chan);
4637 }
4638
4639 return err;
d2a7ac5d
MM		 4640}
4641
4642static void l2cap_handle_srej(struct l2cap_chan *chan,
4643 struct l2cap_ctrl *control)
4644{
f80842a8
MM		 4645 struct sk_buff *skb;
4646
4647 BT_DBG("chan %p, control %p", chan, control);
4648
4649 if (control->reqseq == chan->next_tx_seq) {
4650 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
4651 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4652 return;
4653 }
4654
4655 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
4656
4657 if (skb == NULL) {
4658 BT_DBG("Seq %d not available for retransmission",
4659 control->reqseq);
4660 return;
4661 }
4662
4663 if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
4664 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
4665 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4666 return;
4667 }
4668
4669 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4670
4671 if (control->poll) {
4672 l2cap_pass_to_tx(chan, control);
4673
4674 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4675 l2cap_retransmit(chan, control);
4676 l2cap_ertm_send(chan);
4677
4678 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
4679 set_bit(CONN_SREJ_ACT, &chan->conn_state);
4680 chan->srej_save_reqseq = control->reqseq;
4681 }
4682 } else {
4683 l2cap_pass_to_tx_fbit(chan, control);
4684
4685 if (control->final) {
4686 if (chan->srej_save_reqseq != control->reqseq ||
4687 !test_and_clear_bit(CONN_SREJ_ACT,
4688 &chan->conn_state))
4689 l2cap_retransmit(chan, control);
4690 } else {
4691 l2cap_retransmit(chan, control);
4692 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
4693 set_bit(CONN_SREJ_ACT, &chan->conn_state);
4694 chan->srej_save_reqseq = control->reqseq;
4695 }
4696 }
4697 }
d2a7ac5d
MM		 4698}
4699
4700static void l2cap_handle_rej(struct l2cap_chan *chan,
4701 struct l2cap_ctrl *control)
4702{
fcd289df
MM		 4703 struct sk_buff *skb;
4704
4705 BT_DBG("chan %p, control %p", chan, control);
4706
4707 if (control->reqseq == chan->next_tx_seq) {
4708 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
4709 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4710 return;
4711 }
4712
4713 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
4714
4715 if (chan->max_tx && skb &&
4716 bt_cb(skb)->control.retries >= chan->max_tx) {
4717 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
4718 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4719 return;
4720 }
4721
4722 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4723
4724 l2cap_pass_to_tx(chan, control);
4725
4726 if (control->final) {
4727 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
4728 l2cap_retransmit_all(chan, control);
4729 } else {
4730 l2cap_retransmit_all(chan, control);
4731 l2cap_ertm_send(chan);
4732 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
4733 set_bit(CONN_REJ_ACT, &chan->conn_state);
4734 }
d2a7ac5d
MM		 4735}
4736
4b51dae9
MM		 4737static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
4738{
4739 BT_DBG("chan %p, txseq %d", chan, txseq);
4740
4741 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
4742 chan->expected_tx_seq);
4743
4744 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
4745 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 4746 chan->tx_win) {
4b51dae9
MM		 4747 /* See notes below regarding "double poll" and
4748 * invalid packets.
4749 */
4750 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
4751 BT_DBG("Invalid/Ignore - after SREJ");
4752 return L2CAP_TXSEQ_INVALID_IGNORE;
4753 } else {
4754 BT_DBG("Invalid - in window after SREJ sent");
4755 return L2CAP_TXSEQ_INVALID;
4756 }
4757 }
4758
4759 if (chan->srej_list.head == txseq) {
4760 BT_DBG("Expected SREJ");
4761 return L2CAP_TXSEQ_EXPECTED_SREJ;
4762 }
4763
4764 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
4765 BT_DBG("Duplicate SREJ - txseq already stored");
4766 return L2CAP_TXSEQ_DUPLICATE_SREJ;
4767 }
4768
4769 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
4770 BT_DBG("Unexpected SREJ - not requested");
4771 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
4772 }
4773 }
4774
4775 if (chan->expected_tx_seq == txseq) {
4776 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
4777 chan->tx_win) {
4778 BT_DBG("Invalid - txseq outside tx window");
4779 return L2CAP_TXSEQ_INVALID;
4780 } else {
4781 BT_DBG("Expected");
4782 return L2CAP_TXSEQ_EXPECTED;
4783 }
4784 }
4785
4786 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 4787 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 4788 BT_DBG("Duplicate - expected_tx_seq later than txseq");
4789 return L2CAP_TXSEQ_DUPLICATE;
4790 }
4791
4792 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
4793 /* A source of invalid packets is a "double poll" condition,
4794 * where delays cause us to send multiple poll packets. If
4795 * the remote stack receives and processes both polls,
4796 * sequence numbers can wrap around in such a way that a
4797 * resent frame has a sequence number that looks like new data
4798 * with a sequence gap. This would trigger an erroneous SREJ
4799 * request.
4800 *
4801 * Fortunately, this is impossible with a tx window that's
4802 * less than half of the maximum sequence number, which allows
4803 * invalid frames to be safely ignored.
4804 *
4805 * With tx window sizes greater than half of the tx window
4806 * maximum, the frame is invalid and cannot be ignored. This
4807 * causes a disconnect.
4808 */
4809
4810 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
4811 BT_DBG("Invalid/Ignore - txseq outside tx window");
4812 return L2CAP_TXSEQ_INVALID_IGNORE;
4813 } else {
4814 BT_DBG("Invalid - txseq outside tx window");
4815 return L2CAP_TXSEQ_INVALID;
4816 }
4817 } else {
4818 BT_DBG("Unexpected - txseq indicates missing frames");
4819 return L2CAP_TXSEQ_UNEXPECTED;
4820 }
4821}
4822
d2a7ac5d
MM		 4823static int l2cap_rx_state_recv(struct l2cap_chan *chan,
4824 struct l2cap_ctrl *control,
4825 struct sk_buff *skb, u8 event)
4826{
4827 int err = 0;
4828 bool skb_in_use = 0;
4829
4830 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
4831 event);
4832
4833 switch (event) {
4834 case L2CAP_EV_RECV_IFRAME:
4835 switch (l2cap_classify_txseq(chan, control->txseq)) {
4836 case L2CAP_TXSEQ_EXPECTED:
4837 l2cap_pass_to_tx(chan, control);
4838
4839 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4840 BT_DBG("Busy, discarding expected seq %d",
4841 control->txseq);
4842 break;
4843 }
4844
4845 chan->expected_tx_seq = __next_seq(chan,
4846 control->txseq);
4847
4848 chan->buffer_seq = chan->expected_tx_seq;
4849 skb_in_use = 1;
4850
4851 err = l2cap_reassemble_sdu(chan, skb, control);
4852 if (err)
4853 break;
4854
4855 if (control->final) {
4856 if (!test_and_clear_bit(CONN_REJ_ACT,
4857 &chan->conn_state)) {
4858 control->final = 0;
4859 l2cap_retransmit_all(chan, control);
4860 l2cap_ertm_send(chan);
4861 }
4862 }
4863
4864 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
4865 l2cap_send_ack(chan);
4866 break;
4867 case L2CAP_TXSEQ_UNEXPECTED:
4868 l2cap_pass_to_tx(chan, control);
4869
4870 /* Can't issue SREJ frames in the local busy state.
4871 * Drop this frame, it will be seen as missing
4872 * when local busy is exited.
4873 */
4874 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4875 BT_DBG("Busy, discarding unexpected seq %d",
4876 control->txseq);
4877 break;
4878 }
4879
4880 /* There was a gap in the sequence, so an SREJ
4881 * must be sent for each missing frame. The
4882 * current frame is stored for later use.
4883 */
4884 skb_queue_tail(&chan->srej_q, skb);
4885 skb_in_use = 1;
4886 BT_DBG("Queued %p (queue len %d)", skb,
4887 skb_queue_len(&chan->srej_q));
4888
4889 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
4890 l2cap_seq_list_clear(&chan->srej_list);
4891 l2cap_send_srej(chan, control->txseq);
4892
4893 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
4894 break;
4895 case L2CAP_TXSEQ_DUPLICATE:
4896 l2cap_pass_to_tx(chan, control);
4897 break;
4898 case L2CAP_TXSEQ_INVALID_IGNORE:
4899 break;
4900 case L2CAP_TXSEQ_INVALID:
4901 default:
4902 l2cap_send_disconn_req(chan->conn, chan,
4903 ECONNRESET);
4904 break;
4905 }
4906 break;
4907 case L2CAP_EV_RECV_RR:
4908 l2cap_pass_to_tx(chan, control);
4909 if (control->final) {
4910 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4911
4912 if (!test_and_clear_bit(CONN_REJ_ACT,
4913 &chan->conn_state)) {
4914 control->final = 0;
4915 l2cap_retransmit_all(chan, control);
4916 }
4917
4918 l2cap_ertm_send(chan);
4919 } else if (control->poll) {
4920 l2cap_send_i_or_rr_or_rnr(chan);
4921 } else {
4922 if (test_and_clear_bit(CONN_REMOTE_BUSY,
4923 &chan->conn_state) &&
4924 chan->unacked_frames)
4925 __set_retrans_timer(chan);
4926
4927 l2cap_ertm_send(chan);
4928 }
4929 break;
4930 case L2CAP_EV_RECV_RNR:
4931 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4932 l2cap_pass_to_tx(chan, control);
4933 if (control && control->poll) {
4934 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4935 l2cap_send_rr_or_rnr(chan, 0);
4936 }
4937 __clear_retrans_timer(chan);
4938 l2cap_seq_list_clear(&chan->retrans_list);
4939 break;
4940 case L2CAP_EV_RECV_REJ:
4941 l2cap_handle_rej(chan, control);
4942 break;
4943 case L2CAP_EV_RECV_SREJ:
4944 l2cap_handle_srej(chan, control);
4945 break;
4946 default:
4947 break;
4948 }
4949
4950 if (skb && !skb_in_use) {
4951 BT_DBG("Freeing %p", skb);
4952 kfree_skb(skb);
4953 }
4954
4955 return err;
4956}
4957
4958static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
4959 struct l2cap_ctrl *control,
4960 struct sk_buff *skb, u8 event)
4961{
4962 int err = 0;
4963 u16 txseq = control->txseq;
4964 bool skb_in_use = 0;
4965
4966 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
4967 event);
4968
4969 switch (event) {
4970 case L2CAP_EV_RECV_IFRAME:
4971 switch (l2cap_classify_txseq(chan, txseq)) {
4972 case L2CAP_TXSEQ_EXPECTED:
4973 /* Keep frame for reassembly later */
4974 l2cap_pass_to_tx(chan, control);
4975 skb_queue_tail(&chan->srej_q, skb);
4976 skb_in_use = 1;
4977 BT_DBG("Queued %p (queue len %d)", skb,
4978 skb_queue_len(&chan->srej_q));
4979
4980 chan->expected_tx_seq = __next_seq(chan, txseq);
4981 break;
4982 case L2CAP_TXSEQ_EXPECTED_SREJ:
4983 l2cap_seq_list_pop(&chan->srej_list);
4984
4985 l2cap_pass_to_tx(chan, control);
4986 skb_queue_tail(&chan->srej_q, skb);
4987 skb_in_use = 1;
4988 BT_DBG("Queued %p (queue len %d)", skb,
4989 skb_queue_len(&chan->srej_q));
4990
4991 err = l2cap_rx_queued_iframes(chan);
4992 if (err)
4993 break;
4994
4995 break;
4996 case L2CAP_TXSEQ_UNEXPECTED:
4997 /* Got a frame that can't be reassembled yet.
4998 * Save it for later, and send SREJs to cover
4999 * the missing frames.
5000 */
5001 skb_queue_tail(&chan->srej_q, skb);
5002 skb_in_use = 1;
5003 BT_DBG("Queued %p (queue len %d)", skb,
5004 skb_queue_len(&chan->srej_q));
5005
5006 l2cap_pass_to_tx(chan, control);
5007 l2cap_send_srej(chan, control->txseq);
5008 break;
5009 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
5010 /* This frame was requested with an SREJ, but
5011 * some expected retransmitted frames are
5012 * missing. Request retransmission of missing
5013 * SREJ'd frames.
5014 */
5015 skb_queue_tail(&chan->srej_q, skb);
5016 skb_in_use = 1;
5017 BT_DBG("Queued %p (queue len %d)", skb,
5018 skb_queue_len(&chan->srej_q));
5019
5020 l2cap_pass_to_tx(chan, control);
5021 l2cap_send_srej_list(chan, control->txseq);
5022 break;
5023 case L2CAP_TXSEQ_DUPLICATE_SREJ:
5024 /* We've already queued this frame. Drop this copy. */
5025 l2cap_pass_to_tx(chan, control);
5026 break;
5027 case L2CAP_TXSEQ_DUPLICATE:
5028 /* Expecting a later sequence number, so this frame
5029 * was already received. Ignore it completely.
5030 */
5031 break;
5032 case L2CAP_TXSEQ_INVALID_IGNORE:
5033 break;
5034 case L2CAP_TXSEQ_INVALID:
5035 default:
5036 l2cap_send_disconn_req(chan->conn, chan,
5037 ECONNRESET);
5038 break;
5039 }
5040 break;
5041 case L2CAP_EV_RECV_RR:
5042 l2cap_pass_to_tx(chan, control);
5043 if (control->final) {
5044 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5045
5046 if (!test_and_clear_bit(CONN_REJ_ACT,
5047 &chan->conn_state)) {
5048 control->final = 0;
5049 l2cap_retransmit_all(chan, control);
5050 }
5051
5052 l2cap_ertm_send(chan);
5053 } else if (control->poll) {
5054 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5055 &chan->conn_state) &&
5056 chan->unacked_frames) {
5057 __set_retrans_timer(chan);
5058 }
5059
5060 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5061 l2cap_send_srej_tail(chan);
5062 } else {
5063 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5064 &chan->conn_state) &&
5065 chan->unacked_frames)
5066 __set_retrans_timer(chan);
5067
5068 l2cap_send_ack(chan);
5069 }
5070 break;
5071 case L2CAP_EV_RECV_RNR:
5072 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5073 l2cap_pass_to_tx(chan, control);
5074 if (control->poll) {
5075 l2cap_send_srej_tail(chan);
5076 } else {
5077 struct l2cap_ctrl rr_control;
5078 memset(&rr_control, 0, sizeof(rr_control));
5079 rr_control.sframe = 1;
5080 rr_control.super = L2CAP_SUPER_RR;
5081 rr_control.reqseq = chan->buffer_seq;
5082 l2cap_send_sframe(chan, &rr_control);
5083 }
5084
5085 break;
5086 case L2CAP_EV_RECV_REJ:
5087 l2cap_handle_rej(chan, control);
5088 break;
5089 case L2CAP_EV_RECV_SREJ:
5090 l2cap_handle_srej(chan, control);
5091 break;
5092 }
5093
5094 if (skb && !skb_in_use) {
5095 BT_DBG("Freeing %p", skb);
5096 kfree_skb(skb);
5097 }
5098
5099 return err;
5100}
5101
5102static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
5103{
5104 /* Make sure reqseq is for a packet that has been sent but not acked */
5105 u16 unacked;
5106
5107 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
5108 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
5109}
5110
cec8ab6e
MM		 5111static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5112 struct sk_buff *skb, u8 event)
218bb9df 5113{
d2a7ac5d
MM		 5114 int err = 0;
5115
5116 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
5117 control, skb, event, chan->rx_state);
5118
5119 if (__valid_reqseq(chan, control->reqseq)) {
5120 switch (chan->rx_state) {
5121 case L2CAP_RX_STATE_RECV:
5122 err = l2cap_rx_state_recv(chan, control, skb, event);
5123 break;
5124 case L2CAP_RX_STATE_SREJ_SENT:
5125 err = l2cap_rx_state_srej_sent(chan, control, skb,
5126 event);
5127 break;
5128 default:
5129 /* shut it down */
5130 break;
5131 }
5132 } else {
5133 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
5134 control->reqseq, chan->next_tx_seq,
5135 chan->expected_ack_seq);
5136 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5137 }
5138
5139 return err;
cec8ab6e
MM		 5140}
5141
5142static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5143 struct sk_buff *skb)
5144{
4b51dae9
MM		 5145 int err = 0;
5146
5147 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
5148 chan->rx_state);
5149
5150 if (l2cap_classify_txseq(chan, control->txseq) ==
5151 L2CAP_TXSEQ_EXPECTED) {
5152 l2cap_pass_to_tx(chan, control);
5153
5154 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
5155 __next_seq(chan, chan->buffer_seq));
5156
5157 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5158
5159 l2cap_reassemble_sdu(chan, skb, control);
5160 } else {
5161 if (chan->sdu) {
5162 kfree_skb(chan->sdu);
5163 chan->sdu = NULL;
5164 }
5165 chan->sdu_last_frag = NULL;
5166 chan->sdu_len = 0;
5167
5168 if (skb) {
5169 BT_DBG("Freeing %p", skb);
5170 kfree_skb(skb);
5171 }
5172 }
5173
5174 chan->last_acked_seq = control->txseq;
5175 chan->expected_tx_seq = __next_seq(chan, control->txseq);
5176
5177 return err;
cec8ab6e
MM		 5178}
5179
5180static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
5181{
5182 struct l2cap_ctrl *control = &bt_cb(skb)->control;
5183 u16 len;
5184 u8 event;
218bb9df 5185
b76bbd66
MM		 5186 __unpack_control(chan, skb);
5187
218bb9df
GP		 5188 len = skb->len;
5189
5190 /*
5191 * We can just drop the corrupted I-frame here.
5192 * Receiver will miss it and start proper recovery
cec8ab6e 5193 * procedures and ask for retransmission.
218bb9df 5194 */
47d1ec61 5195 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 5196 goto drop;
5197
cec8ab6e 5198 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 5199 len -= L2CAP_SDULEN_SIZE;
218bb9df 5200
47d1ec61 5201 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 5202 len -= L2CAP_FCS_SIZE;
218bb9df 5203
47d1ec61 5204 if (len > chan->mps) {
8c1d787b 5205 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5206 goto drop;
5207 }
5208
cec8ab6e
MM		 5209 if (!control->sframe) {
5210 int err;
218bb9df 5211
cec8ab6e
MM		 5212 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
5213 control->sar, control->reqseq, control->final,
5214 control->txseq);
218bb9df 5215
cec8ab6e
MM		 5216 /* Validate F-bit - F=0 always valid, F=1 only
5217 * valid in TX WAIT_F
5218 */
5219 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 5220 goto drop;
cec8ab6e
MM		 5221
5222 if (chan->mode != L2CAP_MODE_STREAMING) {
5223 event = L2CAP_EV_RECV_IFRAME;
5224 err = l2cap_rx(chan, control, skb, event);
5225 } else {
5226 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 5227 }
5228
cec8ab6e
MM		 5229 if (err)
5230 l2cap_send_disconn_req(chan->conn, chan,
5231 ECONNRESET);
218bb9df 5232 } else {
cec8ab6e
MM		 5233 const u8 rx_func_to_event[4] = {
5234 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
5235 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
5236 };
5237
5238 /* Only I-frames are expected in streaming mode */
5239 if (chan->mode == L2CAP_MODE_STREAMING)
5240 goto drop;
5241
5242 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
5243 control->reqseq, control->final, control->poll,
5244 control->super);
5245
218bb9df
GP		 5246 if (len != 0) {
5247 BT_ERR("%d", len);
8c1d787b 5248 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5249 goto drop;
5250 }
5251
cec8ab6e
MM		 5252 /* Validate F and P bits */
5253 if (control->final && (control->poll ||
5254 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
5255 goto drop;
5256
5257 event = rx_func_to_event[control->super];
5258 if (l2cap_rx(chan, control, skb, event))
5259 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5260 }
5261
5262 return 0;
5263
5264drop:
5265 kfree_skb(skb);
5266 return 0;
5267}
5268
13ca56e0
AE		 5269static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
5270 struct sk_buff *skb)
1da177e4 5271{
48454079 5272 struct l2cap_chan *chan;
1da177e4 5273
baa7e1fa 5274 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 5275 if (!chan) {
97e8e89d
AE		 5276 if (cid == L2CAP_CID_A2MP) {
5277 chan = a2mp_channel_create(conn, skb);
5278 if (!chan) {
5279 kfree_skb(skb);
13ca56e0 5280 return;
97e8e89d
AE		 5281 }
5282
5283 l2cap_chan_lock(chan);
5284 } else {
5285 BT_DBG("unknown cid 0x%4.4x", cid);
5286 /* Drop packet and return */
5287 kfree_skb(skb);
13ca56e0 5288 return;
97e8e89d 5289 }
1da177e4
LT		 5290 }
5291
49208c9c 5292 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 5293
89bc500e 5294 if (chan->state != BT_CONNECTED)
1da177e4
LT		 5295 goto drop;
5296
0c1bc5c6 5297 switch (chan->mode) {
1c2acffb
GP		 5298 case L2CAP_MODE_BASIC:
5299 /* If socket recv buffers overflows we drop data here
5300 * which is *bad* because L2CAP has to be reliable.
5301 * But we don't have any other choice. L2CAP doesn't
5302 * provide flow control mechanism. */
1da177e4 5303
0c1bc5c6 5304 if (chan->imtu < skb->len)
1c2acffb 5305 goto drop;
1da177e4 5306
80b98027 5307 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 5308 goto done;
5309 break;
5310
5311 case L2CAP_MODE_ERTM:
6840ed07 5312 case L2CAP_MODE_STREAMING:
cec8ab6e 5313 l2cap_data_rcv(chan, skb);
6840ed07
GP		 5314 goto done;
5315
1c2acffb 5316 default:
0c1bc5c6 5317 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 5318 break;
5319 }
1da177e4
LT		 5320
5321drop:
5322 kfree_skb(skb);
5323
5324done:
6be36555 5325 l2cap_chan_unlock(chan);
1da177e4
LT		 5326}
5327
84104b24
AE		 5328static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
5329 struct sk_buff *skb)
1da177e4 5330{
23691d75 5331 struct l2cap_chan *chan;
1da177e4 5332
c2287681 5333 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 5334 if (!chan)
1da177e4
LT		 5335 goto drop;
5336
5b4cedaa 5337 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 5338
89bc500e 5339 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 5340 goto drop;
5341
e13e21dc 5342 if (chan->imtu < skb->len)
1da177e4
LT		 5343 goto drop;
5344
80b98027 5345 if (!chan->ops->recv(chan, skb))
84104b24 5346 return;
1da177e4
LT		 5347
5348drop:
5349 kfree_skb(skb);
1da177e4
LT		 5350}
5351
6810fca7
AE		 5352static void l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
5353 struct sk_buff *skb)
9f69bda6 5354{
23691d75 5355 struct l2cap_chan *chan;
9f69bda6 5356
c2287681 5357 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 5358 if (!chan)
9f69bda6
GP		 5359 goto drop;
5360
5b4cedaa 5361 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 5362
89bc500e 5363 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 5364 goto drop;
5365
e13e21dc 5366 if (chan->imtu < skb->len)
9f69bda6
GP		 5367 goto drop;
5368
80b98027 5369 if (!chan->ops->recv(chan, skb))
6810fca7 5370 return;
9f69bda6
GP		 5371
5372drop:
5373 kfree_skb(skb);
9f69bda6
GP		 5374}
5375
1da177e4
LT		 5376static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
5377{
5378 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 5379 u16 cid, len;
5380 __le16 psm;
1da177e4
LT		 5381
5382 skb_pull(skb, L2CAP_HDR_SIZE);
5383 cid = __le16_to_cpu(lh->cid);
5384 len = __le16_to_cpu(lh->len);
5385
1c2acffb
GP		 5386 if (len != skb->len) {
5387 kfree_skb(skb);
5388 return;
5389 }
5390
1da177e4
LT		 5391 BT_DBG("len %d, cid 0x%4.4x", len, cid);
5392
5393 switch (cid) {
3300d9a9 5394 case L2CAP_CID_LE_SIGNALING:
8db4dc46 5395 case L2CAP_CID_SIGNALING:
1da177e4
LT		 5396 l2cap_sig_channel(conn, skb);
5397 break;
5398
8db4dc46 5399 case L2CAP_CID_CONN_LESS:
097db76c 5400 psm = get_unaligned((__le16 *) skb->data);
0181a70f 5401 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 5402 l2cap_conless_channel(conn, psm, skb);
5403 break;
5404
9f69bda6
GP		 5405 case L2CAP_CID_LE_DATA:
5406 l2cap_att_channel(conn, cid, skb);
5407 break;
5408
b501d6a1
AB		 5409 case L2CAP_CID_SMP:
5410 if (smp_sig_channel(conn, skb))
5411 l2cap_conn_del(conn->hcon, EACCES);
5412 break;
5413
1da177e4
LT		 5414 default:
5415 l2cap_data_channel(conn, cid, skb);
5416 break;
5417 }
5418}
5419
5420/* ---- L2CAP interface with lower layer (HCI) ---- */
5421
686ebf28 5422int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 5423{
5424 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 5425 struct l2cap_chan *c;
1da177e4 5426
6ed93dc6 5427 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 5428
5429 /* Find listening sockets and check their link_mode */
23691d75
GP		 5430 read_lock(&chan_list_lock);
5431 list_for_each_entry(c, &chan_list, global_l) {
5432 struct sock *sk = c->sk;
4343478f 5433
89bc500e 5434 if (c->state != BT_LISTEN)
1da177e4
LT		 5435 continue;
5436
5437 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 5438 lm1 |= HCI_LM_ACCEPT;
43bd0f32 5439 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 5440 lm1 |= HCI_LM_MASTER;
1da177e4 5441 exact++;
2af6b9d5
MH		 5442 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
5443 lm2 |= HCI_LM_ACCEPT;
43bd0f32 5444 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 5445 lm2 |= HCI_LM_MASTER;
5446 }
1da177e4 5447 }
23691d75 5448 read_unlock(&chan_list_lock);
1da177e4
LT		 5449
5450 return exact ? lm1 : lm2;
5451}
5452
9e664631 5453void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 5454{
0139418c
MH		 5455 struct l2cap_conn *conn;
5456
6ed93dc6 5457 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 5458
1da177e4 5459 if (!status) {
1da177e4
LT		 5460 conn = l2cap_conn_add(hcon, status);
5461 if (conn)
5462 l2cap_conn_ready(conn);
0139418c 5463 } else
e175072f 5464 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4 5465
1da177e4
LT		 5466}
5467
686ebf28 5468int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 5469{
5470 struct l2cap_conn *conn = hcon->l2cap_data;
5471
5472 BT_DBG("hcon %p", hcon);
5473
686ebf28 5474 if (!conn)
9f5a0d7b 5475 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 5476 return conn->disc_reason;
5477}
5478
9e664631 5479void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 5480{
5481 BT_DBG("hcon %p reason %d", hcon, reason);
5482
e175072f 5483 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 5484}
5485
4343478f 5486static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 5487{
715ec005 5488 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 5489 return;
5490
f62e4323 5491 if (encrypt == 0x00) {
4343478f 5492 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 5493 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 5494 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 5495 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 5496 } else {
4343478f 5497 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 5498 __clear_chan_timer(chan);
f62e4323
MH		 5499 }
5500}
5501
686ebf28 5502int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 5503{
0139418c 5504 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 5505 struct l2cap_chan *chan;
1da177e4 5506
0139418c 5507 if (!conn)
1da177e4 5508 return 0;
0139418c 5509
89d8b407 5510 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 5511
160dc6ac 5512 if (hcon->type == LE_LINK) {
35d4adcc
HG		 5513 if (!status && encrypt)
5514 smp_distribute_keys(conn, 0);
17cd3f37 5515 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 5516 }
5517
3df91ea2 5518 mutex_lock(&conn->chan_lock);
1da177e4 5519
3df91ea2 5520 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 5521 l2cap_chan_lock(chan);
1da177e4 5522
89d8b407
AE		 5523 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
5524 state_to_string(chan->state));
f1cb9af5 5525
78eb2f98
AE		 5526 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
5527 l2cap_chan_unlock(chan);
5528 continue;
5529 }
5530
f1cb9af5
VCG		 5531 if (chan->scid == L2CAP_CID_LE_DATA) {
5532 if (!status && encrypt) {
5533 chan->sec_level = hcon->sec_level;
cf4cd009 5534 l2cap_chan_ready(chan);
f1cb9af5
VCG		 5535 }
5536
6be36555 5537 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 5538 continue;
5539 }
5540
c1360a1c 5541 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 5542 l2cap_chan_unlock(chan);
6a8d3010
MH		 5543 continue;
5544 }
5545
89bc500e 5546 if (!status && (chan->state == BT_CONNECTED ||
2d792818 5547 chan->state == BT_CONFIG)) {
a7d7723a
GP		 5548 struct sock *sk = chan->sk;
5549
c5daa683 5550 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
a7d7723a
GP		 5551 sk->sk_state_change(sk);
5552
4343478f 5553 l2cap_check_encryption(chan, encrypt);
6be36555 5554 l2cap_chan_unlock(chan);
9719f8af
MH		 5555 continue;
5556 }
5557
89bc500e 5558 if (chan->state == BT_CONNECT) {
b1235d79 5559 if (!status) {
93c3e8f5 5560 l2cap_start_connection(chan);
b1235d79 5561 } else {
ba13ccd9 5562 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 5563 }
89bc500e 5564 } else if (chan->state == BT_CONNECT2) {
6be36555 5565 struct sock *sk = chan->sk;
b1235d79 5566 struct l2cap_conn_rsp rsp;
df3c3931 5567 __u16 res, stat;
1da177e4 5568
6be36555
AE		 5569 lock_sock(sk);
5570
b1235d79 5571 if (!status) {
c5daa683
GP		 5572 if (test_bit(BT_SK_DEFER_SETUP,
5573 &bt_sk(sk)->flags)) {
df3c3931
JH		 5574 res = L2CAP_CR_PEND;
5575 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 5576 chan->ops->defer(chan);
df3c3931 5577 } else {
0e587be7 5578 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 5579 res = L2CAP_CR_SUCCESS;
5580 stat = L2CAP_CS_NO_INFO;
5581 }
b1235d79 5582 } else {
0e587be7 5583 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 5584 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 5585 res = L2CAP_CR_SEC_BLOCK;
5586 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 5587 }
5588
6be36555
AE		 5589 release_sock(sk);
5590
fe4128e0
GP		 5591 rsp.scid = cpu_to_le16(chan->dcid);
5592 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 5593 rsp.result = cpu_to_le16(res);
5594 rsp.status = cpu_to_le16(stat);
fc7f8a7e 5595 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 5596 sizeof(rsp), &rsp);
2d369359
MM		 5597
5598 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
5599 res == L2CAP_CR_SUCCESS) {
5600 char buf[128];
5601 set_bit(CONF_REQ_SENT, &chan->conf_state);
5602 l2cap_send_cmd(conn, l2cap_get_ident(conn),
5603 L2CAP_CONF_REQ,
5604 l2cap_build_conf_req(chan, buf),
5605 buf);
5606 chan->num_conf_req++;
5607 }
b1235d79 5608 }
1da177e4 5609
6be36555 5610 l2cap_chan_unlock(chan);
1da177e4
LT		 5611 }
5612
3df91ea2 5613 mutex_unlock(&conn->chan_lock);
b1235d79 5614
1da177e4
LT		 5615 return 0;
5616}
5617
686ebf28 5618int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 5619{
5620 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988
AE		 5621 struct l2cap_hdr *hdr;
5622 int len;
1da177e4 5623
1d13a254
AE		 5624 /* For AMP controller do not create l2cap conn */
5625 if (!conn && hcon->hdev->dev_type != HCI_BREDR)
5626 goto drop;
1da177e4 5627
5a08ecce
AE		 5628 if (!conn)
5629 conn = l2cap_conn_add(hcon, 0);
5630
5631 if (!conn)
1da177e4
LT		 5632 goto drop;
5633
5634 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
5635
d73a0988
AE		 5636 switch (flags) {
5637 case ACL_START:
5638 case ACL_START_NO_FLUSH:
5639 case ACL_COMPLETE:
1da177e4
LT		 5640 if (conn->rx_len) {
5641 BT_ERR("Unexpected start frame (len %d)", skb->len);
5642 kfree_skb(conn->rx_skb);
5643 conn->rx_skb = NULL;
5644 conn->rx_len = 0;
5645 l2cap_conn_unreliable(conn, ECOMM);
5646 }
5647
aae7fe22
AE		 5648 /* Start fragment always begin with Basic L2CAP header */
5649 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 5650 BT_ERR("Frame is too short (len %d)", skb->len);
5651 l2cap_conn_unreliable(conn, ECOMM);
5652 goto drop;
5653 }
5654
5655 hdr = (struct l2cap_hdr *) skb->data;
5656 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
5657
5658 if (len == skb->len) {
5659 /* Complete frame received */
5660 l2cap_recv_frame(conn, skb);
5661 return 0;
5662 }
5663
5664 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
5665
5666 if (skb->len > len) {
5667 BT_ERR("Frame is too long (len %d, expected len %d)",
2d792818 5668 skb->len, len);
1da177e4
LT		 5669 l2cap_conn_unreliable(conn, ECOMM);
5670 goto drop;
5671 }
5672
5673 /* Allocate skb for the complete frame (with header) */
8bcde1f2 5674 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
af05b30b 5675 if (!conn->rx_skb)
1da177e4
LT		 5676 goto drop;
5677
d626f62b 5678 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 5679 skb->len);
1da177e4 5680 conn->rx_len = len - skb->len;
d73a0988
AE		 5681 break;
5682
5683 case ACL_CONT:
1da177e4
LT		 5684 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5685
5686 if (!conn->rx_len) {
5687 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5688 l2cap_conn_unreliable(conn, ECOMM);
5689 goto drop;
5690 }
5691
5692 if (skb->len > conn->rx_len) {
5693 BT_ERR("Fragment is too long (len %d, expected %d)",
2d792818 5694 skb->len, conn->rx_len);
1da177e4
LT		 5695 kfree_skb(conn->rx_skb);
5696 conn->rx_skb = NULL;
5697 conn->rx_len = 0;
5698 l2cap_conn_unreliable(conn, ECOMM);
5699 goto drop;
5700 }
5701
d626f62b 5702 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 5703 skb->len);
1da177e4
LT		 5704 conn->rx_len -= skb->len;
5705
5706 if (!conn->rx_len) {
5707 /* Complete frame received */
5708 l2cap_recv_frame(conn, conn->rx_skb);
5709 conn->rx_skb = NULL;
5710 }
d73a0988 5711 break;
1da177e4
LT		 5712 }
5713
5714drop:
5715 kfree_skb(skb);
5716 return 0;
5717}
5718
aef7d97c 5719static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5720{
23691d75 5721 struct l2cap_chan *c;
1da177e4 5722
333055f2 5723 read_lock(&chan_list_lock);
1da177e4 5724
23691d75
GP		 5725 list_for_each_entry(c, &chan_list, global_l) {
5726 struct sock *sk = c->sk;
101545f6 5727
fcb73338
AE		 5728 seq_printf(f, "%pMR %pMR %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
5729 &bt_sk(sk)->src, &bt_sk(sk)->dst,
5730 c->state, __le16_to_cpu(c->psm),
5731 c->scid, c->dcid, c->imtu, c->omtu,
5732 c->sec_level, c->mode);
61e1b4b7 5733 }
1da177e4 5734
333055f2 5735 read_unlock(&chan_list_lock);
1da177e4 5736
aef7d97c 5737 return 0;
1da177e4
LT		 5738}
5739
aef7d97c
MH		 5740static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5741{
5742 return single_open(file, l2cap_debugfs_show, inode->i_private);
5743}
5744
5745static const struct file_operations l2cap_debugfs_fops = {
5746 .open = l2cap_debugfs_open,
5747 .read = seq_read,
5748 .llseek = seq_lseek,
5749 .release = single_release,
5750};
5751
5752static struct dentry *l2cap_debugfs;
1da177e4 5753
64274518 5754int __init l2cap_init(void)
1da177e4
LT		 5755{
5756 int err;
be9d1227 5757
bb58f747 5758 err = l2cap_init_sockets();
1da177e4
LT		 5759 if (err < 0)
5760 return err;
5761
aef7d97c 5762 if (bt_debugfs) {
2d792818
GP		 5763 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
5764 NULL, &l2cap_debugfs_fops);
aef7d97c
MH		 5765 if (!l2cap_debugfs)
5766 BT_ERR("Failed to create L2CAP debug file");
5767 }
1da177e4 5768
1da177e4 5769 return 0;
1da177e4
LT		 5770}
5771
64274518 5772void l2cap_exit(void)
1da177e4 5773{
aef7d97c 5774 debugfs_remove(l2cap_debugfs);
bb58f747 5775 l2cap_cleanup_sockets();
1da177e4
LT		 5776}
5777
d1c4a17d
GP		 5778module_param(disable_ertm, bool, 0644);
5779MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)