projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix skb length calculation
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
33#include <linux/types.h>
4fc268d2 34#include <linux/capability.h>
1da177e4
LT		 35#include <linux/errno.h>
36#include <linux/kernel.h>
1da177e4
LT		 37#include <linux/sched.h>
38#include <linux/slab.h>
39#include <linux/poll.h>
40#include <linux/fcntl.h>
41#include <linux/init.h>
42#include <linux/interrupt.h>
43#include <linux/socket.h>
44#include <linux/skbuff.h>
1da177e4 45#include <linux/list.h>
be9d1227 46#include <linux/device.h>
aef7d97c
MH		 47#include <linux/debugfs.h>
48#include <linux/seq_file.h>
af05b30b 49#include <linux/uaccess.h>
fcc203c3 50#include <linux/crc16.h>
1da177e4
LT		 51#include <net/sock.h>
52
1da177e4
LT		 53#include <asm/unaligned.h>
54
55#include <net/bluetooth/bluetooth.h>
56#include <net/bluetooth/hci_core.h>
57#include <net/bluetooth/l2cap.h>
b501d6a1 58#include <net/bluetooth/smp.h>
1da177e4 59
eb939922 60bool disable_ertm;
f0709e03 61
47ec1dcd 62static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 63static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 64
b5ad8b7f
JB		 65static LIST_HEAD(chan_list);
66static DEFINE_RWLOCK(chan_list_lock);
1da177e4 67
1da177e4
LT		 68static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
69 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 70static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
71 void *data);
710f9b0a 72static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a
GP		 73static void l2cap_send_disconn_req(struct l2cap_conn *conn,
74 struct l2cap_chan *chan, int err);
1da177e4 75
0139418c 76/* ---- L2CAP channels ---- */
71ba0e56 77
baa7e1fa 78static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 79{
3df91ea2 80 struct l2cap_chan *c;
3d57dc68 81
3df91ea2
AE		 82 list_for_each_entry(c, &conn->chan_l, list) {
83 if (c->dcid == cid)
84 return c;
0139418c 85 }
3df91ea2 86 return NULL;
0139418c
MH		 87}
88
baa7e1fa 89static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 90{
3df91ea2 91 struct l2cap_chan *c;
3d57dc68 92
3df91ea2
AE		 93 list_for_each_entry(c, &conn->chan_l, list) {
94 if (c->scid == cid)
95 return c;
0139418c 96 }
3df91ea2 97 return NULL;
0139418c
MH		 98}
99
100/* Find channel with given SCID.
101 * Returns locked socket */
baa7e1fa 102static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 103{
48454079 104 struct l2cap_chan *c;
baa7e1fa 105
3df91ea2 106 mutex_lock(&conn->chan_lock);
baa7e1fa 107 c = __l2cap_get_chan_by_scid(conn, cid);
3df91ea2
AE		 108 mutex_unlock(&conn->chan_lock);
109
48454079 110 return c;
0139418c
MH		 111}
112
baa7e1fa 113static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 114{
3df91ea2 115 struct l2cap_chan *c;
3d57dc68 116
3df91ea2
AE		 117 list_for_each_entry(c, &conn->chan_l, list) {
118 if (c->ident == ident)
119 return c;
0139418c 120 }
3df91ea2 121 return NULL;
0139418c
MH		 122}
123
23691d75 124static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 125{
23691d75 126 struct l2cap_chan *c;
9e4425ff 127
23691d75
GP		 128 list_for_each_entry(c, &chan_list, global_l) {
129 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 130 return c;
9e4425ff 131 }
250938cb 132 return NULL;
9e4425ff
GP		 133}
134
135int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
136{
73b2ec18
GP		 137 int err;
138
333055f2 139 write_lock(&chan_list_lock);
9e4425ff 140
23691d75 141 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 142 err = -EADDRINUSE;
143 goto done;
9e4425ff
GP		 144 }
145
73b2ec18
GP		 146 if (psm) {
147 chan->psm = psm;
148 chan->sport = psm;
149 err = 0;
150 } else {
151 u16 p;
152
153 err = -EINVAL;
154 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 155 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 156 chan->psm = cpu_to_le16(p);
157 chan->sport = cpu_to_le16(p);
158 err = 0;
159 break;
160 }
161 }
9e4425ff 162
73b2ec18 163done:
333055f2 164 write_unlock(&chan_list_lock);
73b2ec18 165 return err;
9e4425ff
GP		 166}
167
168int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
169{
333055f2 170 write_lock(&chan_list_lock);
9e4425ff
GP		 171
172 chan->scid = scid;
173
333055f2 174 write_unlock(&chan_list_lock);
9e4425ff
GP		 175
176 return 0;
177}
178
baa7e1fa 179static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 180{
8db4dc46 181 u16 cid = L2CAP_CID_DYN_START;
0139418c 182
8db4dc46 183 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 184 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 185 return cid;
186 }
187
188 return 0;
189}
190
0e587be7 191static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 192{
42d2d87c 193 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 194 state_to_string(state));
195
89bc500e
GP		 196 chan->state = state;
197 chan->ops->state_change(chan->data, state);
198}
199
0e587be7
AE		 200static void l2cap_state_change(struct l2cap_chan *chan, int state)
201{
202 struct sock *sk = chan->sk;
203
204 lock_sock(sk);
205 __l2cap_state_change(chan, state);
206 release_sock(sk);
207}
208
2e0052e4
AE		 209static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
210{
211 struct sock *sk = chan->sk;
212
213 sk->sk_err = err;
214}
215
216static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
217{
218 struct sock *sk = chan->sk;
219
220 lock_sock(sk);
221 __l2cap_chan_set_err(chan, err);
222 release_sock(sk);
223}
224
3c588192
MM		 225/* ---- L2CAP sequence number lists ---- */
226
227/* For ERTM, ordered lists of sequence numbers must be tracked for
228 * SREJ requests that are received and for frames that are to be
229 * retransmitted. These seq_list functions implement a singly-linked
230 * list in an array, where membership in the list can also be checked
231 * in constant time. Items can also be added to the tail of the list
232 * and removed from the head in constant time, without further memory
233 * allocs or frees.
234 */
235
236static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
237{
238 size_t alloc_size, i;
239
240 /* Allocated size is a power of 2 to map sequence numbers
241 * (which may be up to 14 bits) in to a smaller array that is
242 * sized for the negotiated ERTM transmit windows.
243 */
244 alloc_size = roundup_pow_of_two(size);
245
246 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
247 if (!seq_list->list)
248 return -ENOMEM;
249
250 seq_list->mask = alloc_size - 1;
251 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
252 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
253 for (i = 0; i < alloc_size; i++)
254 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
255
256 return 0;
257}
258
259static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
260{
261 kfree(seq_list->list);
262}
263
264static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
265 u16 seq)
266{
267 /* Constant-time check for list membership */
268 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
269}
270
271static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
272{
273 u16 mask = seq_list->mask;
274
275 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
276 /* In case someone tries to pop the head of an empty list */
277 return L2CAP_SEQ_LIST_CLEAR;
278 } else if (seq_list->head == seq) {
279 /* Head can be removed in constant time */
280 seq_list->head = seq_list->list[seq & mask];
281 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
282
283 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
284 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
285 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
286 }
287 } else {
288 /* Walk the list to find the sequence number */
289 u16 prev = seq_list->head;
290 while (seq_list->list[prev & mask] != seq) {
291 prev = seq_list->list[prev & mask];
292 if (prev == L2CAP_SEQ_LIST_TAIL)
293 return L2CAP_SEQ_LIST_CLEAR;
294 }
295
296 /* Unlink the number from the list and clear it */
297 seq_list->list[prev & mask] = seq_list->list[seq & mask];
298 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
299 if (seq_list->tail == seq)
300 seq_list->tail = prev;
301 }
302 return seq;
303}
304
305static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
306{
307 /* Remove the head in constant time */
308 return l2cap_seq_list_remove(seq_list, seq_list->head);
309}
310
311static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
312{
313 if (seq_list->head != L2CAP_SEQ_LIST_CLEAR) {
314 u16 i;
315 for (i = 0; i <= seq_list->mask; i++)
316 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
317
318 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
319 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
320 }
321}
322
323static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
324{
325 u16 mask = seq_list->mask;
326
327 /* All appends happen in constant time */
328
329 if (seq_list->list[seq & mask] == L2CAP_SEQ_LIST_CLEAR) {
330 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
331 seq_list->head = seq;
332 else
333 seq_list->list[seq_list->tail & mask] = seq;
334
335 seq_list->tail = seq;
336 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
337 }
338}
339
721c4181 340static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 341{
721c4181
GP		 342 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
343 chan_timer.work);
3df91ea2 344 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 345 int reason;
346
e05dcc32 347 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 348
3df91ea2 349 mutex_lock(&conn->chan_lock);
6be36555 350 l2cap_chan_lock(chan);
ab07801d 351
89bc500e 352 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 353 reason = ECONNREFUSED;
89bc500e 354 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 355 chan->sec_level != BT_SECURITY_SDP)
356 reason = ECONNREFUSED;
357 else
358 reason = ETIMEDOUT;
359
0f852724 360 l2cap_chan_close(chan, reason);
ab07801d 361
6be36555 362 l2cap_chan_unlock(chan);
ab07801d 363
ba3bd0ee 364 chan->ops->close(chan->data);
3df91ea2
AE		 365 mutex_unlock(&conn->chan_lock);
366
371fd835 367 l2cap_chan_put(chan);
ab07801d
GP		 368}
369
eef1d9b6 370struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 371{
372 struct l2cap_chan *chan;
373
374 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
375 if (!chan)
376 return NULL;
377
c03b355e
AE		 378 mutex_init(&chan->lock);
379
333055f2 380 write_lock(&chan_list_lock);
23691d75 381 list_add(&chan->global_l, &chan_list);
333055f2 382 write_unlock(&chan_list_lock);
23691d75 383
721c4181 384 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 385
89bc500e
GP		 386 chan->state = BT_OPEN;
387
71ba0e56
GP		 388 atomic_set(&chan->refcnt, 1);
389
eef1d9b6 390 BT_DBG("chan %p", chan);
abc545b8 391
48454079
GP		 392 return chan;
393}
394
23691d75 395void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 396{
333055f2 397 write_lock(&chan_list_lock);
23691d75 398 list_del(&chan->global_l);
333055f2 399 write_unlock(&chan_list_lock);
23691d75 400
371fd835 401 l2cap_chan_put(chan);
6ff5abbf
GP		 402}
403
bd4b1653
AE		 404void l2cap_chan_set_defaults(struct l2cap_chan *chan)
405{
406 chan->fcs = L2CAP_FCS_CRC16;
407 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
408 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
409 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
410 chan->sec_level = BT_SECURITY_LOW;
411
412 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
413}
414
14a28491 415static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 416{
af05b30b 417 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 418 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 419
9f5a0d7b 420 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 421
8c1d787b 422 chan->conn = conn;
0139418c 423
5491120e
AE		 424 switch (chan->chan_type) {
425 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 426 if (conn->hcon->type == LE_LINK) {
427 /* LE connection */
0c1bc5c6 428 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 429 chan->scid = L2CAP_CID_LE_DATA;
430 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 431 } else {
432 /* Alloc CID for connection-oriented socket */
fe4128e0 433 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 434 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 435 }
5491120e
AE		 436 break;
437
438 case L2CAP_CHAN_CONN_LESS:
0139418c 439 /* Connectionless socket */
fe4128e0
GP		 440 chan->scid = L2CAP_CID_CONN_LESS;
441 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 442 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 443 break;
444
445 default:
0139418c 446 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 447 chan->scid = L2CAP_CID_SIGNALING;
448 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 449 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 450 }
451
8f7975b1
AE		 452 chan->local_id = L2CAP_BESTEFFORT_ID;
453 chan->local_stype = L2CAP_SERV_BESTEFFORT;
454 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
455 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
456 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
457 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
458
371fd835 459 l2cap_chan_hold(chan);
baa7e1fa 460
3df91ea2 461 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 462}
463
14a28491 464static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 465{
466 mutex_lock(&conn->chan_lock);
467 __l2cap_chan_add(conn, chan);
3df91ea2 468 mutex_unlock(&conn->chan_lock);
0139418c
MH		 469}
470
4519de9a 471static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 472{
48454079 473 struct sock *sk = chan->sk;
8c1d787b 474 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 475 struct sock *parent = bt_sk(sk)->parent;
476
c9b66675 477 __clear_chan_timer(chan);
0139418c 478
49208c9c 479 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 480
8e87d142 481 if (conn) {
baa7e1fa 482 /* Delete from channel list */
3df91ea2 483 list_del(&chan->list);
3d57dc68 484
371fd835 485 l2cap_chan_put(chan);
baa7e1fa 486
8c1d787b 487 chan->conn = NULL;
0139418c
MH		 488 hci_conn_put(conn->hcon);
489 }
490
6be36555
AE		 491 lock_sock(sk);
492
0e587be7 493 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 494 sock_set_flag(sk, SOCK_ZAPPED);
495
496 if (err)
2e0052e4 497 __l2cap_chan_set_err(chan, err);
0139418c
MH		 498
499 if (parent) {
500 bt_accept_unlink(sk);
501 parent->sk_data_ready(parent, 0);
502 } else
503 sk->sk_state_change(sk);
c13ffa62 504
6be36555
AE		 505 release_sock(sk);
506
c1360a1c
GP		 507 if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
508 test_bit(CONF_INPUT_DONE, &chan->conf_state)))
6ff5abbf 509 return;
2ead70b8 510
58d35f87 511 skb_queue_purge(&chan->tx_q);
c13ffa62 512
0c1bc5c6 513 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 514 struct srej_list *l, *tmp;
515
1a09bcb9
GP		 516 __clear_retrans_timer(chan);
517 __clear_monitor_timer(chan);
518 __clear_ack_timer(chan);
c13ffa62 519
f1c6775b 520 skb_queue_purge(&chan->srej_q);
c13ffa62 521
3c588192
MM		 522 l2cap_seq_list_free(&chan->srej_list);
523 l2cap_seq_list_free(&chan->retrans_list);
39d5a3ee 524 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 525 list_del(&l->list);
526 kfree(l);
527 }
528 }
0139418c
MH		 529}
530
4519de9a
GP		 531static void l2cap_chan_cleanup_listen(struct sock *parent)
532{
533 struct sock *sk;
534
535 BT_DBG("parent %p", parent);
536
537 /* Close not yet accepted channels */
0f852724 538 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 539 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 540
6be36555 541 l2cap_chan_lock(chan);
c9b66675 542 __clear_chan_timer(chan);
ba3bd0ee 543 l2cap_chan_close(chan, ECONNRESET);
6be36555 544 l2cap_chan_unlock(chan);
3df91ea2 545
ba3bd0ee 546 chan->ops->close(chan->data);
0f852724 547 }
4519de9a
GP		 548}
549
0f852724 550void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 551{
552 struct l2cap_conn *conn = chan->conn;
553 struct sock *sk = chan->sk;
554
e05dcc32
AE		 555 BT_DBG("chan %p state %s sk %p", chan,
556 state_to_string(chan->state), sk);
4519de9a 557
89bc500e 558 switch (chan->state) {
4519de9a 559 case BT_LISTEN:
6be36555 560 lock_sock(sk);
4519de9a 561 l2cap_chan_cleanup_listen(sk);
89bc500e 562
0e587be7 563 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 564 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 565 release_sock(sk);
4519de9a
GP		 566 break;
567
568 case BT_CONNECTED:
569 case BT_CONFIG:
715ec005 570 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 571 conn->hcon->type == ACL_LINK) {
c9b66675 572 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 573 l2cap_send_disconn_req(conn, chan, reason);
574 } else
575 l2cap_chan_del(chan, reason);
576 break;
577
578 case BT_CONNECT2:
715ec005 579 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 580 conn->hcon->type == ACL_LINK) {
581 struct l2cap_conn_rsp rsp;
582 __u16 result;
583
584 if (bt_sk(sk)->defer_setup)
585 result = L2CAP_CR_SEC_BLOCK;
586 else
587 result = L2CAP_CR_BAD_PSM;
89bc500e 588 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 589
590 rsp.scid = cpu_to_le16(chan->dcid);
591 rsp.dcid = cpu_to_le16(chan->scid);
592 rsp.result = cpu_to_le16(result);
593 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
594 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
595 sizeof(rsp), &rsp);
596 }
597
598 l2cap_chan_del(chan, reason);
599 break;
600
601 case BT_CONNECT:
602 case BT_DISCONN:
603 l2cap_chan_del(chan, reason);
604 break;
605
606 default:
6be36555 607 lock_sock(sk);
4519de9a 608 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 609 release_sock(sk);
4519de9a
GP		 610 break;
611 }
612}
613
4343478f 614static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 615{
715ec005 616 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 617 switch (chan->sec_level) {
8556edd3
JH		 618 case BT_SECURITY_HIGH:
619 return HCI_AT_DEDICATED_BONDING_MITM;
620 case BT_SECURITY_MEDIUM:
621 return HCI_AT_DEDICATED_BONDING;
622 default:
623 return HCI_AT_NO_BONDING;
624 }
fe4128e0 625 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 626 if (chan->sec_level == BT_SECURITY_LOW)
627 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 628
4343478f 629 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 630 return HCI_AT_NO_BONDING_MITM;
00ae4af9 631 else
8556edd3 632 return HCI_AT_NO_BONDING;
00ae4af9 633 } else {
4343478f 634 switch (chan->sec_level) {
00ae4af9 635 case BT_SECURITY_HIGH:
8556edd3 636 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 637 case BT_SECURITY_MEDIUM:
8556edd3 638 return HCI_AT_GENERAL_BONDING;
00ae4af9 639 default:
8556edd3 640 return HCI_AT_NO_BONDING;
00ae4af9 641 }
0684e5f9 642 }
8556edd3
JH		 643}
644
645/* Service level security */
d45fc423 646int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 647{
8c1d787b 648 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 649 __u8 auth_type;
650
4343478f 651 auth_type = l2cap_get_auth_type(chan);
79d554a6 652
4343478f 653 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 654}
655
b5ad8b7f 656static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 657{
658 u8 id;
659
660 /* Get next available identificator.
661 * 1 - 128 are used by kernel.
662 * 129 - 199 are reserved.
663 * 200 - 254 are used by utilities like l2ping, etc.
664 */
665
333055f2 666 spin_lock(&conn->lock);
4e8402a3
MH		 667
668 if (++conn->tx_ident > 128)
669 conn->tx_ident = 1;
670
671 id = conn->tx_ident;
672
333055f2 673 spin_unlock(&conn->lock);
4e8402a3
MH		 674
675 return id;
676}
677
4519de9a 678static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 679{
680 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 681 u8 flags;
4e8402a3
MH		 682
683 BT_DBG("code 0x%2.2x", code);
684
685 if (!skb)
9a9c6a34 686 return;
4e8402a3 687
e702112f
AE		 688 if (lmp_no_flush_capable(conn->hcon->hdev))
689 flags = ACL_START_NO_FLUSH;
690 else
691 flags = ACL_START;
692
14b12d0b 693 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 694 skb->priority = HCI_PRIO_MAX;
14b12d0b 695
73d80deb
LAD		 696 hci_send_acl(conn->hchan, skb, flags);
697}
698
699static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
700{
701 struct hci_conn *hcon = chan->conn->hcon;
702 u16 flags;
703
704 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
705 skb->priority);
706
707 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
708 lmp_no_flush_capable(hcon->hdev))
709 flags = ACL_START_NO_FLUSH;
710 else
711 flags = ACL_START;
14b12d0b 712
73d80deb
LAD		 713 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
714 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 715}
716
b76bbd66
MM		 717static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
718{
719 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
720 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
721
722 if (enh & L2CAP_CTRL_FRAME_TYPE) {
723 /* S-Frame */
724 control->sframe = 1;
725 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
726 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
727
728 control->sar = 0;
729 control->txseq = 0;
730 } else {
731 /* I-Frame */
732 control->sframe = 0;
733 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
734 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
735
736 control->poll = 0;
737 control->super = 0;
738 }
739}
740
b76bbd66
MM		 741static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
742{
743 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
744 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
745
746 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
747 /* S-Frame */
748 control->sframe = 1;
749 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
750 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
751
752 control->sar = 0;
753 control->txseq = 0;
754 } else {
755 /* I-Frame */
756 control->sframe = 0;
757 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
758 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
759
760 control->poll = 0;
761 control->super = 0;
762 }
763}
764
765static inline void __unpack_control(struct l2cap_chan *chan,
766 struct sk_buff *skb)
767{
768 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
769 __unpack_extended_control(get_unaligned_le32(skb->data),
770 &bt_cb(skb)->control);
771 } else {
772 __unpack_enhanced_control(get_unaligned_le16(skb->data),
773 &bt_cb(skb)->control);
774 }
775}
776
b5c6aaed
MM		 777static u32 __pack_extended_control(struct l2cap_ctrl *control)
778{
779 u32 packed;
780
781 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
782 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
783
784 if (control->sframe) {
785 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
786 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
787 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
788 } else {
789 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
790 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
791 }
792
793 return packed;
794}
795
796static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
797{
798 u16 packed;
799
800 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
801 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
802
803 if (control->sframe) {
804 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
805 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
806 packed |= L2CAP_CTRL_FRAME_TYPE;
807 } else {
808 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
809 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
810 }
811
812 return packed;
813}
814
b76bbd66
MM		 815static inline void __pack_control(struct l2cap_chan *chan,
816 struct l2cap_ctrl *control,
817 struct sk_buff *skb)
818{
819 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
820 put_unaligned_le32(__pack_extended_control(control),
821 skb->data + L2CAP_HDR_SIZE);
822 } else {
823 put_unaligned_le16(__pack_enhanced_control(control),
824 skb->data + L2CAP_HDR_SIZE);
825 }
826}
827
b5c6aaed
MM		 828static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
829{
830 struct sk_buff *skb;
831 struct l2cap_hdr *lh;
832 struct l2cap_conn *conn = chan->conn;
833 int count, hlen;
834
835 if (chan->state != BT_CONNECTED)
836 return;
837
838 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
839 hlen = L2CAP_EXT_HDR_SIZE;
840 else
841 hlen = L2CAP_ENH_HDR_SIZE;
842
843 if (chan->fcs == L2CAP_FCS_CRC16)
844 hlen += L2CAP_FCS_SIZE;
845
846 BT_DBG("chan %p, control 0x%8.8x", chan, control);
847
848 count = min_t(unsigned int, conn->mtu, hlen);
849
850 control |= __set_sframe(chan);
851
852 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
853 control |= __set_ctrl_final(chan);
854
855 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
856 control |= __set_ctrl_poll(chan);
857
858 skb = bt_skb_alloc(count, GFP_ATOMIC);
859 if (!skb)
860 return;
861
862 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
863 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
864 lh->cid = cpu_to_le16(chan->dcid);
865
866 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
867
868 if (chan->fcs == L2CAP_FCS_CRC16) {
869 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
870 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
871 }
872
873 skb->priority = HCI_PRIO_MAX;
874 l2cap_do_send(chan, skb);
875}
876
877static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
878{
879 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
880 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
881 set_bit(CONN_RNR_SENT, &chan->conn_state);
882 } else
883 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
884
885 control |= __set_reqseq(chan, chan->buffer_seq);
886
887 l2cap_send_sframe(chan, control);
888}
889
b4450035 890static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 891{
c1360a1c 892 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 893}
894
9b27f350
AE		 895static void l2cap_send_conn_req(struct l2cap_chan *chan)
896{
897 struct l2cap_conn *conn = chan->conn;
898 struct l2cap_conn_req req;
899
900 req.scid = cpu_to_le16(chan->scid);
901 req.psm = chan->psm;
902
903 chan->ident = l2cap_get_ident(conn);
904
905 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
906
907 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
908}
909
9f0caeb1
VCG		 910static void l2cap_chan_ready(struct l2cap_chan *chan)
911{
912 struct sock *sk = chan->sk;
913 struct sock *parent;
914
915 lock_sock(sk);
916
917 parent = bt_sk(sk)->parent;
918
919 BT_DBG("sk %p, parent %p", sk, parent);
920
921 chan->conf_state = 0;
922 __clear_chan_timer(chan);
923
924 __l2cap_state_change(chan, BT_CONNECTED);
925 sk->sk_state_change(sk);
926
927 if (parent)
928 parent->sk_data_ready(parent, 0);
929
930 release_sock(sk);
931}
932
fc7f8a7e 933static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 934{
8c1d787b 935 struct l2cap_conn *conn = chan->conn;
79d554a6 936
9f0caeb1
VCG		 937 if (conn->hcon->type == LE_LINK) {
938 l2cap_chan_ready(chan);
939 return;
940 }
941
79d554a6 942 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 943 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
944 return;
945
d45fc423 946 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 947 __l2cap_no_conn_pending(chan))
948 l2cap_send_conn_req(chan);
79d554a6
MH		 949 } else {
950 struct l2cap_info_req req;
951 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
952
953 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
954 conn->info_ident = l2cap_get_ident(conn);
955
ba13ccd9 956 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 957
958 l2cap_send_cmd(conn, conn->info_ident,
959 L2CAP_INFO_REQ, sizeof(req), &req);
960 }
961}
962
cf6c2c0b
GP		 963static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
964{
965 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 966 if (!disable_ertm)
cf6c2c0b
GP		 967 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
968
969 switch (mode) {
970 case L2CAP_MODE_ERTM:
971 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
972 case L2CAP_MODE_STREAMING:
973 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
974 default:
975 return 0x00;
976 }
977}
978
4519de9a 979static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 980{
6be36555 981 struct sock *sk = chan->sk;
22121fc9
GP		 982 struct l2cap_disconn_req req;
983
c13ffa62
GP		 984 if (!conn)
985 return;
986
0c1bc5c6 987 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 988 __clear_retrans_timer(chan);
989 __clear_monitor_timer(chan);
990 __clear_ack_timer(chan);
c13ffa62
GP		 991 }
992
fe4128e0
GP		 993 req.dcid = cpu_to_le16(chan->dcid);
994 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 995 l2cap_send_cmd(conn, l2cap_get_ident(conn),
996 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 997
6be36555 998 lock_sock(sk);
0e587be7 999 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1000 __l2cap_chan_set_err(chan, err);
6be36555 1001 release_sock(sk);
22121fc9
GP		 1002}
1003
1da177e4 1004/* ---- L2CAP connections ---- */
4e8402a3
MH		 1005static void l2cap_conn_start(struct l2cap_conn *conn)
1006{
3df91ea2 1007 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1008
1009 BT_DBG("conn %p", conn);
1010
3df91ea2 1011 mutex_lock(&conn->chan_lock);
4e8402a3 1012
3df91ea2 1013 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1014 struct sock *sk = chan->sk;
baa7e1fa 1015
6be36555 1016 l2cap_chan_lock(chan);
4e8402a3 1017
715ec005 1018 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1019 l2cap_chan_unlock(chan);
79d554a6
MH		 1020 continue;
1021 }
1022
89bc500e 1023 if (chan->state == BT_CONNECT) {
d45fc423 1024 if (!l2cap_chan_check_security(chan) ||
b4450035 1025 !__l2cap_no_conn_pending(chan)) {
6be36555 1026 l2cap_chan_unlock(chan);
47731de7
GP		 1027 continue;
1028 }
79d554a6 1029
c1360a1c
GP		 1030 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1031 && test_bit(CONF_STATE2_DEVICE,
1032 &chan->conf_state)) {
89bc500e 1033 l2cap_chan_close(chan, ECONNRESET);
6be36555 1034 l2cap_chan_unlock(chan);
47731de7 1035 continue;
b1235d79 1036 }
47731de7 1037
9b27f350 1038 l2cap_send_conn_req(chan);
47731de7 1039
89bc500e 1040 } else if (chan->state == BT_CONNECT2) {
79d554a6 1041 struct l2cap_conn_rsp rsp;
e9aeb2dd 1042 char buf[128];
fe4128e0
GP		 1043 rsp.scid = cpu_to_le16(chan->dcid);
1044 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1045
d45fc423 1046 if (l2cap_chan_check_security(chan)) {
6be36555 1047 lock_sock(sk);
f66dc81f
MH		 1048 if (bt_sk(sk)->defer_setup) {
1049 struct sock *parent = bt_sk(sk)->parent;
1050 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1051 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 1052 if (parent)
1053 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 1054
1055 } else {
0e587be7 1056 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 1057 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1058 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1059 }
6be36555 1060 release_sock(sk);
79d554a6
MH		 1061 } else {
1062 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1063 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1064 }
1065
fc7f8a7e
GP		 1066 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1067 sizeof(rsp), &rsp);
e9aeb2dd 1068
c1360a1c 1069 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 1070 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1071 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1072 continue;
1073 }
1074
c1360a1c 1075 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1076 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 1077 l2cap_build_conf_req(chan, buf), buf);
1078 chan->num_conf_req++;
4e8402a3
MH		 1079 }
1080
6be36555 1081 l2cap_chan_unlock(chan);
4e8402a3
MH		 1082 }
1083
3df91ea2 1084 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1085}
1086
c2287681 1087/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1088 * Returns closest match, locked.
1089 */
d9b88702 1090static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1091 bdaddr_t *src,
1092 bdaddr_t *dst)
b62f328b 1093{
23691d75 1094 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1095
23691d75 1096 read_lock(&chan_list_lock);
b62f328b 1097
23691d75
GP		 1098 list_for_each_entry(c, &chan_list, global_l) {
1099 struct sock *sk = c->sk;
fe4128e0 1100
89bc500e 1101 if (state && c->state != state)
b62f328b
VT		 1102 continue;
1103
23691d75 1104 if (c->scid == cid) {
c2287681
IY		 1105 int src_match, dst_match;
1106 int src_any, dst_any;
1107
b62f328b 1108 /* Exact match. */
c2287681
IY		 1109 src_match = !bacmp(&bt_sk(sk)->src, src);
1110 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1111 if (src_match && dst_match) {
23691d75
GP		 1112 read_unlock(&chan_list_lock);
1113 return c;
1114 }
b62f328b
VT		 1115
1116 /* Closest match */
c2287681
IY		 1117 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1118 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1119 if ((src_match && dst_any) || (src_any && dst_match) ||
1120 (src_any && dst_any))
23691d75 1121 c1 = c;
b62f328b
VT		 1122 }
1123 }
280f294f 1124
23691d75 1125 read_unlock(&chan_list_lock);
b62f328b 1126
23691d75 1127 return c1;
b62f328b
VT		 1128}
1129
1130static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1131{
c916fbe4 1132 struct sock *parent, *sk;
23691d75 1133 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1134
1135 BT_DBG("");
1136
1137 /* Check if we have socket listening on cid */
23691d75 1138 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1139 conn->src, conn->dst);
23691d75 1140 if (!pchan)
b62f328b
VT		 1141 return;
1142
23691d75
GP		 1143 parent = pchan->sk;
1144
aa2ac881 1145 lock_sock(parent);
62f3a2cf 1146
b62f328b
VT		 1147 /* Check for backlog size */
1148 if (sk_acceptq_is_full(parent)) {
1149 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1150 goto clean;
1151 }
1152
80808e43
GP		 1153 chan = pchan->ops->new_connection(pchan->data);
1154 if (!chan)
b62f328b
VT		 1155 goto clean;
1156
80808e43 1157 sk = chan->sk;
5d41ce1d 1158
b62f328b
VT		 1159 hci_conn_hold(conn->hcon);
1160
b62f328b
VT		 1161 bacpy(&bt_sk(sk)->src, conn->src);
1162 bacpy(&bt_sk(sk)->dst, conn->dst);
1163
d1010240
GP		 1164 bt_accept_enqueue(parent, sk);
1165
3d57dc68 1166 l2cap_chan_add(conn, chan);
48454079 1167
c9b66675 1168 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 1169
0e587be7 1170 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 1171 parent->sk_data_ready(parent, 0);
1172
b62f328b 1173clean:
aa2ac881 1174 release_sock(parent);
b62f328b
VT		 1175}
1176
4e8402a3
MH		 1177static void l2cap_conn_ready(struct l2cap_conn *conn)
1178{
48454079 1179 struct l2cap_chan *chan;
4e8402a3 1180
79d554a6 1181 BT_DBG("conn %p", conn);
4e8402a3 1182
b62f328b
VT		 1183 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
1184 l2cap_le_conn_ready(conn);
1185
160dc6ac
VCG		 1186 if (conn->hcon->out && conn->hcon->type == LE_LINK)
1187 smp_conn_security(conn, conn->hcon->pending_sec_level);
1188
3df91ea2 1189 mutex_lock(&conn->chan_lock);
4e8402a3 1190
3df91ea2 1191 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1192
6be36555 1193 l2cap_chan_lock(chan);
4e8402a3 1194
63128451 1195 if (conn->hcon->type == LE_LINK) {
b501d6a1 1196 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 1197 l2cap_chan_ready(chan);
acd7d370 1198
63128451 1199 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1200 struct sock *sk = chan->sk;
c9b66675 1201 __clear_chan_timer(chan);
6be36555 1202 lock_sock(sk);
0e587be7 1203 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1204 sk->sk_state_change(sk);
6be36555 1205 release_sock(sk);
b501d6a1 1206
89bc500e 1207 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1208 l2cap_do_start(chan);
4e8402a3 1209
6be36555 1210 l2cap_chan_unlock(chan);
4e8402a3 1211 }
79d554a6 1212
3df91ea2 1213 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1214}
1215
1216/* Notify sockets that we cannot guaranty reliability anymore */
1217static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1218{
48454079 1219 struct l2cap_chan *chan;
4e8402a3
MH		 1220
1221 BT_DBG("conn %p", conn);
1222
3df91ea2 1223 mutex_lock(&conn->chan_lock);
4e8402a3 1224
3df91ea2 1225 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1226 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 1227 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1228 }
1229
3df91ea2 1230 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1231}
1232
f878fcad 1233static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1234{
f878fcad 1235 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 1236 info_timer.work);
4e8402a3 1237
984947dc 1238 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1239 conn->info_ident = 0;
984947dc 1240
4e8402a3
MH		 1241 l2cap_conn_start(conn);
1242}
1243
5d3de7df
VCG		 1244static void l2cap_conn_del(struct hci_conn *hcon, int err)
1245{
1246 struct l2cap_conn *conn = hcon->l2cap_data;
1247 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1248
1249 if (!conn)
1250 return;
1251
1252 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1253
1254 kfree_skb(conn->rx_skb);
1255
3df91ea2
AE		 1256 mutex_lock(&conn->chan_lock);
1257
5d3de7df
VCG		 1258 /* Kill channels */
1259 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1260 l2cap_chan_hold(chan);
6be36555
AE		 1261 l2cap_chan_lock(chan);
1262
5d3de7df 1263 l2cap_chan_del(chan, err);
6be36555
AE		 1264
1265 l2cap_chan_unlock(chan);
1266
5d3de7df 1267 chan->ops->close(chan->data);
61d6ef3e 1268 l2cap_chan_put(chan);
5d3de7df
VCG		 1269 }
1270
3df91ea2
AE		 1271 mutex_unlock(&conn->chan_lock);
1272
73d80deb
LAD		 1273 hci_chan_del(conn->hchan);
1274
5d3de7df 1275 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1276 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1277
51a8efd7 1278 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1279 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1280 smp_chan_destroy(conn);
d26a2345 1281 }
5d3de7df
VCG		 1282
1283 hcon->l2cap_data = NULL;
1284 kfree(conn);
1285}
1286
6c9d42a1 1287static void security_timeout(struct work_struct *work)
5d3de7df 1288{
6c9d42a1
GP		 1289 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1290 security_timer.work);
5d3de7df
VCG		 1291
1292 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1293}
1294
1da177e4
LT		 1295static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1296{
0139418c 1297 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1298 struct hci_chan *hchan;
1da177e4 1299
0139418c 1300 if (conn || status)
1da177e4
LT		 1301 return conn;
1302
73d80deb
LAD		 1303 hchan = hci_chan_create(hcon);
1304 if (!hchan)
1305 return NULL;
1306
0139418c 1307 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1308 if (!conn) {
1309 hci_chan_del(hchan);
1da177e4 1310 return NULL;
73d80deb 1311 }
1da177e4
LT		 1312
1313 hcon->l2cap_data = conn;
1314 conn->hcon = hcon;
73d80deb 1315 conn->hchan = hchan;
1da177e4 1316
73d80deb 1317 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1318
acd7d370
VT		 1319 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1320 conn->mtu = hcon->hdev->le_mtu;
1321 else
1322 conn->mtu = hcon->hdev->acl_mtu;
1323
1da177e4
LT		 1324 conn->src = &hcon->hdev->bdaddr;
1325 conn->dst = &hcon->dst;
1326
4e8402a3
MH		 1327 conn->feat_mask = 0;
1328
1da177e4 1329 spin_lock_init(&conn->lock);
3df91ea2 1330 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1331
1332 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1333
5d3de7df 1334 if (hcon->type == LE_LINK)
6c9d42a1 1335 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1336 else
030013d8 1337 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1338
9f5a0d7b 1339 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1340
1da177e4
LT		 1341 return conn;
1342}
1343
1da177e4 1344/* ---- Socket interface ---- */
1da177e4 1345
c2287681 1346/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1347 * Returns closest match.
1348 */
c2287681
IY		 1349static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1350 bdaddr_t *src,
1351 bdaddr_t *dst)
1da177e4 1352{
23691d75 1353 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1354
23691d75 1355 read_lock(&chan_list_lock);
e0f0cb56 1356
23691d75
GP		 1357 list_for_each_entry(c, &chan_list, global_l) {
1358 struct sock *sk = c->sk;
fe4128e0 1359
89bc500e 1360 if (state && c->state != state)
1da177e4
LT		 1361 continue;
1362
23691d75 1363 if (c->psm == psm) {
c2287681
IY		 1364 int src_match, dst_match;
1365 int src_any, dst_any;
1366
1da177e4 1367 /* Exact match. */
c2287681
IY		 1368 src_match = !bacmp(&bt_sk(sk)->src, src);
1369 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1370 if (src_match && dst_match) {
a7567b20 1371 read_unlock(&chan_list_lock);
23691d75
GP		 1372 return c;
1373 }
1da177e4
LT		 1374
1375 /* Closest match */
c2287681
IY		 1376 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1377 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1378 if ((src_match && dst_any) || (src_any && dst_match) ||
1379 (src_any && dst_any))
23691d75 1380 c1 = c;
1da177e4
LT		 1381 }
1382 }
1da177e4 1383
23691d75 1384 read_unlock(&chan_list_lock);
e0f0cb56 1385
23691d75 1386 return c1;
1da177e4
LT		 1387}
1388
8e9f9892
AG		 1389int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1390 bdaddr_t *dst, u8 dst_type)
1da177e4 1391{
5d41ce1d 1392 struct sock *sk = chan->sk;
1da177e4 1393 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1394 struct l2cap_conn *conn;
1395 struct hci_conn *hcon;
1396 struct hci_dev *hdev;
09ab6f4c 1397 __u8 auth_type;
44d0e48e 1398 int err;
1da177e4 1399
8e9f9892
AG		 1400 BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
1401 dst_type, __le16_to_cpu(chan->psm));
1da177e4 1402
af05b30b
GP		 1403 hdev = hci_get_route(dst, src);
1404 if (!hdev)
1da177e4
LT		 1405 return -EHOSTUNREACH;
1406
09fd0de5 1407 hci_dev_lock(hdev);
1da177e4 1408
6be36555 1409 l2cap_chan_lock(chan);
03a00194
GP		 1410
1411 /* PSM must be odd and lsb of upper byte must be 0 */
1412 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1413 chan->chan_type != L2CAP_CHAN_RAW) {
1414 err = -EINVAL;
1415 goto done;
1416 }
1417
1418 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1419 err = -EINVAL;
1420 goto done;
1421 }
1422
1423 switch (chan->mode) {
1424 case L2CAP_MODE_BASIC:
1425 break;
1426 case L2CAP_MODE_ERTM:
1427 case L2CAP_MODE_STREAMING:
1428 if (!disable_ertm)
1429 break;
1430 /* fall through */
1431 default:
1432 err = -ENOTSUPP;
1433 goto done;
1434 }
1435
6be36555
AE		 1436 lock_sock(sk);
1437
03a00194
GP		 1438 switch (sk->sk_state) {
1439 case BT_CONNECT:
1440 case BT_CONNECT2:
1441 case BT_CONFIG:
1442 /* Already connecting */
1443 err = 0;
6be36555 1444 release_sock(sk);
03a00194
GP		 1445 goto done;
1446
1447 case BT_CONNECTED:
1448 /* Already connected */
1449 err = -EISCONN;
6be36555 1450 release_sock(sk);
03a00194
GP		 1451 goto done;
1452
1453 case BT_OPEN:
1454 case BT_BOUND:
1455 /* Can connect */
1456 break;
1457
1458 default:
1459 err = -EBADFD;
6be36555 1460 release_sock(sk);
03a00194
GP		 1461 goto done;
1462 }
1463
1464 /* Set destination address and psm */
9219b2a0 1465 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1466
1467 release_sock(sk);
1468
03a00194
GP		 1469 chan->psm = psm;
1470 chan->dcid = cid;
1da177e4 1471
4343478f 1472 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1473
fe4128e0 1474 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1475 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1476 chan->sec_level, auth_type);
acd7d370 1477 else
8e9f9892 1478 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1479 chan->sec_level, auth_type);
acd7d370 1480
30e76272
VT		 1481 if (IS_ERR(hcon)) {
1482 err = PTR_ERR(hcon);
1da177e4 1483 goto done;
30e76272 1484 }
1da177e4
LT		 1485
1486 conn = l2cap_conn_add(hcon, 0);
1487 if (!conn) {
1488 hci_conn_put(hcon);
30e76272 1489 err = -ENOMEM;
1da177e4
LT		 1490 goto done;
1491 }
1492
9f0caeb1
VCG		 1493 if (hcon->type == LE_LINK) {
1494 err = 0;
1495
1496 if (!list_empty(&conn->chan_l)) {
1497 err = -EBUSY;
1498 hci_conn_put(hcon);
1499 }
1500
1501 if (err)
1502 goto done;
1503 }
1504
1da177e4
LT		 1505 /* Update source addr of the socket */
1506 bacpy(src, conn->src);
1507
6be36555 1508 l2cap_chan_unlock(chan);
48454079 1509 l2cap_chan_add(conn, chan);
6be36555 1510 l2cap_chan_lock(chan);
48454079 1511
6be36555 1512 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1513 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1514
1515 if (hcon->state == BT_CONNECTED) {
715ec005 1516 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1517 __clear_chan_timer(chan);
d45fc423 1518 if (l2cap_chan_check_security(chan))
6be36555 1519 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1520 } else
fc7f8a7e 1521 l2cap_do_start(chan);
1da177e4
LT		 1522 }
1523
30e76272
VT		 1524 err = 0;
1525
1da177e4 1526done:
6be36555 1527 l2cap_chan_unlock(chan);
09fd0de5 1528 hci_dev_unlock(hdev);
1da177e4
LT		 1529 hci_dev_put(hdev);
1530 return err;
1531}
1532
dcba0dba 1533int __l2cap_wait_ack(struct sock *sk)
6161c038 1534{
8c1d787b 1535 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1536 DECLARE_WAITQUEUE(wait, current);
1537 int err = 0;
1538 int timeo = HZ/5;
1539
2b0b05dd 1540 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1541 set_current_state(TASK_INTERRUPTIBLE);
1542 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1543 if (!timeo)
1544 timeo = HZ/5;
1545
1546 if (signal_pending(current)) {
1547 err = sock_intr_errno(timeo);
1548 break;
1549 }
1550
1551 release_sock(sk);
1552 timeo = schedule_timeout(timeo);
1553 lock_sock(sk);
a71a0cf4 1554 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1555
1556 err = sock_error(sk);
1557 if (err)
1558 break;
1559 }
1560 set_current_state(TASK_RUNNING);
2b0b05dd 1561 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1562 return err;
1563}
1564
721c4181 1565static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1566{
721c4181
GP		 1567 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1568 monitor_timer.work);
e90bac06 1569
525cd185 1570 BT_DBG("chan %p", chan);
0e98958d 1571
6be36555
AE		 1572 l2cap_chan_lock(chan);
1573
2c03a7a4 1574 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1575 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
6be36555 1576 l2cap_chan_unlock(chan);
8d7e1c7f 1577 l2cap_chan_put(chan);
e90bac06
GP		 1578 return;
1579 }
1580
6a026610 1581 chan->retry_count++;
1a09bcb9 1582 __set_monitor_timer(chan);
e90bac06 1583
525cd185 1584 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555 1585 l2cap_chan_unlock(chan);
8d7e1c7f 1586 l2cap_chan_put(chan);
e90bac06
GP		 1587}
1588
721c4181 1589static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1590{
721c4181
GP		 1591 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1592 retrans_timer.work);
e90bac06 1593
49208c9c 1594 BT_DBG("chan %p", chan);
0e98958d 1595
6be36555
AE		 1596 l2cap_chan_lock(chan);
1597
6a026610 1598 chan->retry_count = 1;
1a09bcb9 1599 __set_monitor_timer(chan);
e90bac06 1600
e2ab4353 1601 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1602
525cd185 1603 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555
AE		 1604
1605 l2cap_chan_unlock(chan);
8d7e1c7f 1606 l2cap_chan_put(chan);
e90bac06
GP		 1607}
1608
42e5c802 1609static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1610{
1c2acffb 1611 struct sk_buff *skb;
1da177e4 1612
58d35f87 1613 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1614 chan->unacked_frames) {
3ce3514f 1615 if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
1c2acffb 1616 break;
1da177e4 1617
58d35f87 1618 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1619 kfree_skb(skb);
1da177e4 1620
6a026610 1621 chan->unacked_frames--;
1c2acffb 1622 }
1da177e4 1623
6a026610 1624 if (!chan->unacked_frames)
1a09bcb9 1625 __clear_retrans_timer(chan);
1c2acffb 1626}
1da177e4 1627
67c9e840 1628static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1629{
ccbb84af 1630 struct sk_buff *skb;
88843ab0
AE		 1631 u32 control;
1632 u16 fcs;
6840ed07 1633
58d35f87 1634 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1635 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1636 control |= __set_txseq(chan, chan->next_tx_seq);
94122bbe 1637 control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
88843ab0 1638 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1639
47d1ec61 1640 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1641 fcs = crc16(0, (u8 *)skb->data,
1642 skb->len - L2CAP_FCS_SIZE);
1643 put_unaligned_le16(fcs,
1644 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1645 }
1646
4343478f 1647 l2cap_do_send(chan, skb);
6840ed07 1648
836be934 1649 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1650 }
6840ed07
GP		 1651}
1652
fb45de7d 1653static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1654{
8f17154f 1655 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1656 u16 fcs;
1657 u32 control;
8f17154f 1658
58d35f87 1659 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1660 if (!skb)
1661 return;
8f17154f 1662
3ce3514f 1663 while (bt_cb(skb)->control.txseq != tx_seq) {
58d35f87 1664 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1665 return;
8f17154f 1666
d1726b6d
SJ		 1667 skb = skb_queue_next(&chan->tx_q, skb);
1668 }
8f17154f 1669
3ce3514f
MM		 1670 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1671 chan->remote_max_tx) {
8c1d787b 1672 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1673 return;
1674 }
1675
1676 tx_skb = skb_clone(skb, GFP_ATOMIC);
3ce3514f 1677 bt_cb(skb)->control.retries++;
88843ab0
AE		 1678
1679 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1680 control &= __get_sar_mask(chan);
3cb123d1 1681
e2ab4353 1682 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1683 control |= __set_ctrl_final(chan);
95ffa978 1684
0b209fae 1685 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1686 control |= __set_txseq(chan, tx_seq);
3cb123d1 1687
88843ab0 1688 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1689
47d1ec61 1690 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1691 fcs = crc16(0, (u8 *)tx_skb->data,
1692 tx_skb->len - L2CAP_FCS_SIZE);
1693 put_unaligned_le16(fcs,
1694 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1695 }
1696
4343478f 1697 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1698}
1699
67c9e840 1700static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1701{
1702 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1703 u16 fcs;
1704 u32 control;
9a9c6a34 1705 int nsent = 0;
1c2acffb 1706
89bc500e 1707 if (chan->state != BT_CONNECTED)
c13ffa62 1708 return -ENOTCONN;
e90bac06 1709
94122bbe
MM		 1710 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1711 return 0;
1712
58d35f87 1713 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1714
3ce3514f
MM		 1715 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1716 chan->remote_max_tx) {
8c1d787b 1717 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1718 break;
1719 }
1720
e420aba3
AE		 1721 tx_skb = skb_clone(skb, GFP_ATOMIC);
1722
3ce3514f 1723 bt_cb(skb)->control.retries++;
e90bac06 1724
88843ab0 1725 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1726 control &= __get_sar_mask(chan);
95ffa978 1727
e2ab4353 1728 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1729 control |= __set_ctrl_final(chan);
e2ab4353 1730
0b209fae 1731 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1732 control |= __set_txseq(chan, chan->next_tx_seq);
94122bbe 1733 control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
1c2acffb 1734
88843ab0 1735 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1736
47d1ec61 1737 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1738 fcs = crc16(0, (u8 *)skb->data,
1739 tx_skb->len - L2CAP_FCS_SIZE);
1740 put_unaligned_le16(fcs, skb->data +
1741 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1742 }
1743
4343478f 1744 l2cap_do_send(chan, tx_skb);
9a9c6a34 1745
1a09bcb9 1746 __set_retrans_timer(chan);
1c2acffb 1747
3ce3514f 1748 bt_cb(skb)->control.txseq = chan->next_tx_seq;
836be934
AE		 1749
1750 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1751
3ce3514f 1752 if (bt_cb(skb)->control.retries == 1) {
6a026610 1753 chan->unacked_frames++;
930fa4ae
SJ		 1754
1755 if (!nsent++)
1756 __clear_ack_timer(chan);
8ed7a0ae 1757 }
23e9fde2 1758
6a026610 1759 chan->frames_sent++;
1c2acffb 1760
58d35f87
GP		 1761 if (skb_queue_is_last(&chan->tx_q, skb))
1762 chan->tx_send_head = NULL;
1c2acffb 1763 else
58d35f87 1764 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1c2acffb
GP		 1765 }
1766
9e917af1
GP		 1767 return nsent;
1768}
1769
525cd185 1770static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1771{
dfc909be
GP		 1772 int ret;
1773
58d35f87
GP		 1774 if (!skb_queue_empty(&chan->tx_q))
1775 chan->tx_send_head = chan->tx_q.next;
dfc909be 1776
42e5c802 1777 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1778 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1779 return ret;
1780}
1781
b17e73bb 1782static void __l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1783{
88843ab0 1784 u32 control = 0;
9e917af1 1785
0b209fae 1786 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1787
e2ab4353 1788 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1789 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1790 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1791 l2cap_send_sframe(chan, control);
9a9c6a34 1792 return;
9e917af1 1793 }
dfc909be 1794
525cd185 1795 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1796 return;
1797
ab784b73 1798 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1799 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1800}
1801
b17e73bb
SJ		 1802static void l2cap_send_ack(struct l2cap_chan *chan)
1803{
1804 __clear_ack_timer(chan);
1805 __l2cap_send_ack(chan);
1806}
1807
525cd185 1808static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1809{
1810 struct srej_list *tail;
88843ab0 1811 u32 control;
99b0d4b7 1812
ab784b73 1813 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1814 control |= __set_ctrl_final(chan);
99b0d4b7 1815
39d5a3ee 1816 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1817 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1818
525cd185 1819 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1820}
1821
04124681
GP		 1822static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1823 struct msghdr *msg, int len,
1824 int count, struct sk_buff *skb)
1c2acffb 1825{
0952a57a 1826 struct l2cap_conn *conn = chan->conn;
1c2acffb 1827 struct sk_buff **frag;
90338947 1828 int sent = 0;
1da177e4 1829
59203a21 1830 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1831 return -EFAULT;
1da177e4
LT		 1832
1833 sent += count;
1834 len -= count;
1835
1836 /* Continuation fragments (no L2CAP header) */
1837 frag = &skb_shinfo(skb)->frag_list;
1838 while (len) {
fbe00700
GP		 1839 struct sk_buff *tmp;
1840
1da177e4
LT		 1841 count = min_t(unsigned int, conn->mtu, len);
1842
fbe00700
GP		 1843 tmp = chan->ops->alloc_skb(chan, count,
1844 msg->msg_flags & MSG_DONTWAIT);
1845 if (IS_ERR(tmp))
1846 return PTR_ERR(tmp);
1847
1848 *frag = tmp;
2f7719ce 1849
1c2acffb
GP		 1850 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1851 return -EFAULT;
1da177e4 1852
5e59b791
LAD		 1853 (*frag)->priority = skb->priority;
1854
1da177e4
LT		 1855 sent += count;
1856 len -= count;
1857
2d0ed3d5
GP		 1858 skb->len += (*frag)->len;
1859 skb->data_len += (*frag)->len;
1860
1da177e4
LT		 1861 frag = &(*frag)->next;
1862 }
1da177e4
LT		 1863
1864 return sent;
1c2acffb 1865}
1da177e4 1866
5e59b791
LAD		 1867static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1868 struct msghdr *msg, size_t len,
1869 u32 priority)
1c2acffb 1870{
8c1d787b 1871 struct l2cap_conn *conn = chan->conn;
1c2acffb 1872 struct sk_buff *skb;
03a51213 1873 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1874 struct l2cap_hdr *lh;
1875
6d5922b0 1876 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1877
1878 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1879
1880 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1881 msg->msg_flags & MSG_DONTWAIT);
1882 if (IS_ERR(skb))
1883 return skb;
1c2acffb 1884
5e59b791
LAD		 1885 skb->priority = priority;
1886
1c2acffb
GP		 1887 /* Create L2CAP header */
1888 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1889 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 1890 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
1891 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 1892
0952a57a 1893 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1894 if (unlikely(err < 0)) {
1895 kfree_skb(skb);
1896 return ERR_PTR(err);
1897 }
1898 return skb;
1899}
1900
5e59b791
LAD		 1901static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1902 struct msghdr *msg, size_t len,
1903 u32 priority)
1c2acffb 1904{
8c1d787b 1905 struct l2cap_conn *conn = chan->conn;
1c2acffb 1906 struct sk_buff *skb;
f2ba7fae 1907 int err, count;
1c2acffb
GP		 1908 struct l2cap_hdr *lh;
1909
6d5922b0 1910 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1911
f2ba7fae 1912 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 1913
f2ba7fae 1914 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 1915 msg->msg_flags & MSG_DONTWAIT);
1916 if (IS_ERR(skb))
1917 return skb;
1c2acffb 1918
5e59b791
LAD		 1919 skb->priority = priority;
1920
1c2acffb
GP		 1921 /* Create L2CAP header */
1922 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1923 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 1924 lh->len = cpu_to_le16(len);
1c2acffb 1925
0952a57a 1926 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1927 if (unlikely(err < 0)) {
1928 kfree_skb(skb);
1929 return ERR_PTR(err);
1930 }
1931 return skb;
1932}
1933
ab0ff76d
LAD		 1934static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1935 struct msghdr *msg, size_t len,
94122bbe 1936 u16 sdulen)
1c2acffb 1937{
8c1d787b 1938 struct l2cap_conn *conn = chan->conn;
1c2acffb 1939 struct sk_buff *skb;
e4ca6d98 1940 int err, count, hlen;
1c2acffb
GP		 1941 struct l2cap_hdr *lh;
1942
6d5922b0 1943 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1944
0ee0d208
GP		 1945 if (!conn)
1946 return ERR_PTR(-ENOTCONN);
1947
e4ca6d98
AE		 1948 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1949 hlen = L2CAP_EXT_HDR_SIZE;
1950 else
1951 hlen = L2CAP_ENH_HDR_SIZE;
1952
c74e560c 1953 if (sdulen)
03a51213 1954 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1955
47d1ec61 1956 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1957 hlen += L2CAP_FCS_SIZE;
fcc203c3 1958
1c2acffb 1959 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1960
1961 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1962 msg->msg_flags & MSG_DONTWAIT);
1963 if (IS_ERR(skb))
1964 return skb;
1c2acffb
GP		 1965
1966 /* Create L2CAP header */
1967 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1968 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1969 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 1970
94122bbe 1971 __put_control(chan, 0, skb_put(skb, __ctrl_size(chan)));
88843ab0 1972
c74e560c 1973 if (sdulen)
03a51213 1974 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 1975
0952a57a 1976 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1977 if (unlikely(err < 0)) {
1978 kfree_skb(skb);
1979 return ERR_PTR(err);
1980 }
e90bac06 1981
47d1ec61 1982 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1983 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1984
3ce3514f 1985 bt_cb(skb)->control.retries = 0;
1c2acffb 1986 return skb;
1da177e4
LT		 1987}
1988
94122bbe
MM		 1989static int l2cap_segment_sdu(struct l2cap_chan *chan,
1990 struct sk_buff_head *seg_queue,
1991 struct msghdr *msg, size_t len)
c74e560c 1992{
c74e560c 1993 struct sk_buff *skb;
94122bbe
MM		 1994 u16 sdu_len;
1995 size_t pdu_len;
1996 int err = 0;
1997 u8 sar;
c74e560c 1998
94122bbe 1999 BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
c74e560c 2000
94122bbe
MM		 2001 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2002 * so fragmented skbs are not used. The HCI layer's handling
2003 * of fragmented skbs is not compatible with ERTM's queueing.
2004 */
c74e560c 2005
94122bbe
MM		 2006 /* PDU size is derived from the HCI MTU */
2007 pdu_len = chan->conn->mtu;
c74e560c 2008
94122bbe
MM		 2009 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2010
2011 /* Adjust for largest possible L2CAP overhead. */
2012 pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
2013
2014 /* Remote device may have requested smaller PDUs */
2015 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2016
2017 if (len <= pdu_len) {
2018 sar = L2CAP_SAR_UNSEGMENTED;
2019 sdu_len = 0;
2020 pdu_len = len;
2021 } else {
2022 sar = L2CAP_SAR_START;
2023 sdu_len = len;
2024 pdu_len -= L2CAP_SDULEN_SIZE;
2025 }
2026
2027 while (len > 0) {
2028 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2029
c74e560c 2030 if (IS_ERR(skb)) {
94122bbe 2031 __skb_queue_purge(seg_queue);
c74e560c
GP		 2032 return PTR_ERR(skb);
2033 }
2034
94122bbe
MM		 2035 bt_cb(skb)->control.sar = sar;
2036 __skb_queue_tail(seg_queue, skb);
2037
2038 len -= pdu_len;
2039 if (sdu_len) {
2040 sdu_len = 0;
2041 pdu_len += L2CAP_SDULEN_SIZE;
2042 }
2043
2044 if (len <= pdu_len) {
2045 sar = L2CAP_SAR_END;
2046 pdu_len = len;
2047 } else {
2048 sar = L2CAP_SAR_CONTINUE;
2049 }
c74e560c 2050 }
c74e560c 2051
94122bbe 2052 return err;
c74e560c
GP		 2053}
2054
5e59b791
LAD		 2055int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2056 u32 priority)
9a91a04a 2057{
9a91a04a 2058 struct sk_buff *skb;
9a91a04a 2059 int err;
94122bbe 2060 struct sk_buff_head seg_queue;
9a91a04a
GP		 2061
2062 /* Connectionless channel */
715ec005 2063 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2064 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2065 if (IS_ERR(skb))
2066 return PTR_ERR(skb);
2067
2068 l2cap_do_send(chan, skb);
2069 return len;
2070 }
2071
2072 switch (chan->mode) {
2073 case L2CAP_MODE_BASIC:
2074 /* Check outgoing MTU */
2075 if (len > chan->omtu)
2076 return -EMSGSIZE;
2077
2078 /* Create a basic PDU */
5e59b791 2079 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2080 if (IS_ERR(skb))
2081 return PTR_ERR(skb);
2082
2083 l2cap_do_send(chan, skb);
2084 err = len;
2085 break;
2086
2087 case L2CAP_MODE_ERTM:
2088 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2089 /* Check outgoing MTU */
2090 if (len > chan->omtu) {
2091 err = -EMSGSIZE;
2092 break;
2093 }
9a91a04a 2094
94122bbe 2095 __skb_queue_head_init(&seg_queue);
9a91a04a 2096
94122bbe
MM		 2097 /* Do segmentation before calling in to the state machine,
2098 * since it's possible to block while waiting for memory
2099 * allocation.
2100 */
2101 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2102
94122bbe
MM		 2103 /* The channel could have been closed while segmenting,
2104 * check that it is still connected.
2105 */
2106 if (chan->state != BT_CONNECTED) {
2107 __skb_queue_purge(&seg_queue);
2108 err = -ENOTCONN;
9a91a04a
GP		 2109 }
2110
94122bbe 2111 if (err)
9a91a04a 2112 break;
9a91a04a 2113
577cfaeb
MM		 2114 if (chan->mode == L2CAP_MODE_ERTM && chan->tx_send_head == NULL)
2115 chan->tx_send_head = seg_queue.next;
94122bbe 2116 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
577cfaeb 2117
94122bbe
MM		 2118 if (chan->mode == L2CAP_MODE_ERTM)
2119 err = l2cap_ertm_send(chan);
2120 else
2121 l2cap_streaming_send(chan);
9a91a04a 2122
9a91a04a
GP		 2123 if (err >= 0)
2124 err = len;
2125
94122bbe
MM		 2126 /* If the skbs were not queued for sending, they'll still be in
2127 * seg_queue and need to be purged.
2128 */
2129 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2130 break;
2131
2132 default:
2133 BT_DBG("bad state %1.1x", chan->mode);
2134 err = -EBADFD;
2135 }
2136
2137 return err;
2138}
2139
1da177e4
LT		 2140/* Copy frame to all raw sockets on that connection */
2141static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2142{
1da177e4 2143 struct sk_buff *nskb;
48454079 2144 struct l2cap_chan *chan;
1da177e4
LT		 2145
2146 BT_DBG("conn %p", conn);
2147
3df91ea2 2148 mutex_lock(&conn->chan_lock);
3d57dc68 2149
3df91ea2 2150 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2151 struct sock *sk = chan->sk;
715ec005 2152 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2153 continue;
2154
2155 /* Don't send frame to the socket it came from */
2156 if (skb->sk == sk)
2157 continue;
af05b30b
GP		 2158 nskb = skb_clone(skb, GFP_ATOMIC);
2159 if (!nskb)
1da177e4
LT		 2160 continue;
2161
23070494 2162 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 2163 kfree_skb(nskb);
2164 }
3d57dc68 2165
3df91ea2 2166 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2167}
2168
2169/* ---- L2CAP signalling commands ---- */
2170static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2171 u8 code, u8 ident, u16 dlen, void *data)
2172{
2173 struct sk_buff *skb, **frag;
2174 struct l2cap_cmd_hdr *cmd;
2175 struct l2cap_hdr *lh;
2176 int len, count;
2177
af05b30b
GP		 2178 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2179 conn, code, ident, dlen);
1da177e4
LT		 2180
2181 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2182 count = min_t(unsigned int, conn->mtu, len);
2183
2184 skb = bt_skb_alloc(count, GFP_ATOMIC);
2185 if (!skb)
2186 return NULL;
2187
2188 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2189 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2190
2191 if (conn->hcon->type == LE_LINK)
2192 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2193 else
2194 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2195
2196 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2197 cmd->code = code;
2198 cmd->ident = ident;
aca3192c 2199 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2200
2201 if (dlen) {
2202 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2203 memcpy(skb_put(skb, count), data, count);
2204 data += count;
2205 }
2206
2207 len -= skb->len;
2208
2209 /* Continuation fragments (no L2CAP header) */
2210 frag = &skb_shinfo(skb)->frag_list;
2211 while (len) {
2212 count = min_t(unsigned int, conn->mtu, len);
2213
2214 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2215 if (!*frag)
2216 goto fail;
2217
2218 memcpy(skb_put(*frag, count), data, count);
2219
2220 len -= count;
2221 data += count;
2222
2223 frag = &(*frag)->next;
2224 }
2225
2226 return skb;
2227
2228fail:
2229 kfree_skb(skb);
2230 return NULL;
2231}
2232
2233static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2234{
2235 struct l2cap_conf_opt *opt = *ptr;
2236 int len;
2237
2238 len = L2CAP_CONF_OPT_SIZE + opt->len;
2239 *ptr += len;
2240
2241 *type = opt->type;
2242 *olen = opt->len;
2243
2244 switch (opt->len) {
2245 case 1:
2246 *val = *((u8 *) opt->val);
2247 break;
2248
2249 case 2:
bfaaeb3e 2250 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2251 break;
2252
2253 case 4:
bfaaeb3e 2254 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2255 break;
2256
2257 default:
2258 *val = (unsigned long) opt->val;
2259 break;
2260 }
2261
2262 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2263 return len;
2264}
2265
1da177e4
LT		 2266static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2267{
2268 struct l2cap_conf_opt *opt = *ptr;
2269
2270 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2271
2272 opt->type = type;
2273 opt->len = len;
2274
2275 switch (len) {
2276 case 1:
2277 *((u8 *) opt->val) = val;
2278 break;
2279
2280 case 2:
4f8b691c 2281 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2282 break;
2283
2284 case 4:
4f8b691c 2285 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2286 break;
2287
2288 default:
2289 memcpy(opt->val, (void *) val, len);
2290 break;
2291 }
2292
2293 *ptr += L2CAP_CONF_OPT_SIZE + len;
2294}
2295
f89cef09
AE		 2296static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2297{
2298 struct l2cap_conf_efs efs;
2299
1ec918ce 2300 switch (chan->mode) {
f89cef09
AE		 2301 case L2CAP_MODE_ERTM:
2302 efs.id = chan->local_id;
2303 efs.stype = chan->local_stype;
2304 efs.msdu = cpu_to_le16(chan->local_msdu);
2305 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2306 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2307 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2308 break;
2309
2310 case L2CAP_MODE_STREAMING:
2311 efs.id = 1;
2312 efs.stype = L2CAP_SERV_BESTEFFORT;
2313 efs.msdu = cpu_to_le16(chan->local_msdu);
2314 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2315 efs.acc_lat = 0;
2316 efs.flush_to = 0;
2317 break;
2318
2319 default:
2320 return;
2321 }
2322
2323 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2324 (unsigned long) &efs);
2325}
2326
721c4181 2327static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2328{
721c4181
GP		 2329 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2330 ack_timer.work);
c1b4f43b 2331
2fb9b3d4
GP		 2332 BT_DBG("chan %p", chan);
2333
6be36555
AE		 2334 l2cap_chan_lock(chan);
2335
b17e73bb 2336 __l2cap_send_ack(chan);
6be36555
AE		 2337
2338 l2cap_chan_unlock(chan);
09bfb2ee
SJ		 2339
2340 l2cap_chan_put(chan);
c1b4f43b
GP		 2341}
2342
3c588192 2343static inline int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2344{
3c588192
MM		 2345 int err;
2346
105bdf9e
MM		 2347 chan->next_tx_seq = 0;
2348 chan->expected_tx_seq = 0;
42e5c802 2349 chan->expected_ack_seq = 0;
6a026610 2350 chan->unacked_frames = 0;
42e5c802 2351 chan->buffer_seq = 0;
6a026610
GP		 2352 chan->num_acked = 0;
2353 chan->frames_sent = 0;
105bdf9e
MM		 2354 chan->last_acked_seq = 0;
2355 chan->sdu = NULL;
2356 chan->sdu_last_frag = NULL;
2357 chan->sdu_len = 0;
2358
d34c34fb
MM		 2359 skb_queue_head_init(&chan->tx_q);
2360
105bdf9e
MM		 2361 if (chan->mode != L2CAP_MODE_ERTM)
2362 return 0;
2363
2364 chan->rx_state = L2CAP_RX_STATE_RECV;
2365 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2366
721c4181
GP		 2367 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2368 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2369 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2370
f1c6775b 2371 skb_queue_head_init(&chan->srej_q);
1890d36b 2372
39d5a3ee 2373 INIT_LIST_HEAD(&chan->srej_l);
3c588192
MM		 2374 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2375 if (err < 0)
2376 return err;
2377
2378 return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
0565c1c2
GP		 2379}
2380
f2fcfcd6
GP		 2381static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2382{
2383 switch (mode) {
2384 case L2CAP_MODE_STREAMING:
2385 case L2CAP_MODE_ERTM:
2386 if (l2cap_mode_supported(mode, remote_feat_mask))
2387 return mode;
2388 /* fall through */
2389 default:
2390 return L2CAP_MODE_BASIC;
2391 }
2392}
2393
6327eb98
AE		 2394static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2395{
2396 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2397}
2398
f89cef09
AE		 2399static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2400{
2401 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2402}
2403
6327eb98
AE		 2404static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2405{
2406 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2407 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2408 /* use extended control field */
2409 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2410 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2411 } else {
6327eb98
AE		 2412 chan->tx_win = min_t(u16, chan->tx_win,
2413 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2414 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2415 }
6327eb98
AE		 2416}
2417
710f9b0a 2418static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2419{
1da177e4 2420 struct l2cap_conf_req *req = data;
0c1bc5c6 2421 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2422 void *ptr = req->data;
c8f79162 2423 u16 size;
1da177e4 2424
49208c9c 2425 BT_DBG("chan %p", chan);
1da177e4 2426
73ffa904 2427 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2428 goto done;
2429
0c1bc5c6 2430 switch (chan->mode) {
f2fcfcd6
GP		 2431 case L2CAP_MODE_STREAMING:
2432 case L2CAP_MODE_ERTM:
c1360a1c 2433 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2434 break;
85eb53c6 2435
f89cef09
AE		 2436 if (__l2cap_efs_supported(chan))
2437 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2438
2ba13ed6 2439 /* fall through */
f2fcfcd6 2440 default:
8c1d787b 2441 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2442 break;
2443 }
2444
2445done:
0c1bc5c6
GP		 2446 if (chan->imtu != L2CAP_DEFAULT_MTU)
2447 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2448
0c1bc5c6 2449 switch (chan->mode) {
65c7c491 2450 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2451 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2452 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2453 break;
2454
62547752
GP		 2455 rfc.mode = L2CAP_MODE_BASIC;
2456 rfc.txwin_size = 0;
2457 rfc.max_transmit = 0;
2458 rfc.retrans_timeout = 0;
2459 rfc.monitor_timeout = 0;
2460 rfc.max_pdu_size = 0;
2461
63406504
GP		 2462 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2463 (unsigned long) &rfc);
65c7c491
MH		 2464 break;
2465
2466 case L2CAP_MODE_ERTM:
2467 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2468 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2469 rfc.retrans_timeout = 0;
2470 rfc.monitor_timeout = 0;
c8f79162
AE		 2471
2472 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2473 L2CAP_EXT_HDR_SIZE -
2474 L2CAP_SDULEN_SIZE -
2475 L2CAP_FCS_SIZE);
2476 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2477
6327eb98
AE		 2478 l2cap_txwin_setup(chan);
2479
2480 rfc.txwin_size = min_t(u16, chan->tx_win,
2481 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2482
63406504
GP		 2483 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2484 (unsigned long) &rfc);
2485
f89cef09
AE		 2486 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2487 l2cap_add_opt_efs(&ptr, chan);
2488
8c1d787b 2489 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2490 break;
2491
47d1ec61 2492 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2493 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2494 chan->fcs = L2CAP_FCS_NONE;
2495 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2496 }
6327eb98
AE		 2497
2498 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2499 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2500 chan->tx_win);
f2fcfcd6
GP		 2501 break;
2502
2503 case L2CAP_MODE_STREAMING:
2504 rfc.mode = L2CAP_MODE_STREAMING;
2505 rfc.txwin_size = 0;
2506 rfc.max_transmit = 0;
2507 rfc.retrans_timeout = 0;
2508 rfc.monitor_timeout = 0;
c8f79162
AE		 2509
2510 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2511 L2CAP_EXT_HDR_SIZE -
2512 L2CAP_SDULEN_SIZE -
2513 L2CAP_FCS_SIZE);
2514 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2515
63406504
GP		 2516 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2517 (unsigned long) &rfc);
2518
f89cef09
AE		 2519 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2520 l2cap_add_opt_efs(&ptr, chan);
2521
8c1d787b 2522 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2523 break;
2524
47d1ec61 2525 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2526 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2527 chan->fcs = L2CAP_FCS_NONE;
2528 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2529 }
65c7c491
MH		 2530 break;
2531 }
1da177e4 2532
fe4128e0 2533 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2534 req->flags = cpu_to_le16(0);
1da177e4
LT		 2535
2536 return ptr - data;
2537}
2538
73ffa904 2539static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2540{
5dee9e7c
MH		 2541 struct l2cap_conf_rsp *rsp = data;
2542 void *ptr = rsp->data;
73ffa904
GP		 2543 void *req = chan->conf_req;
2544 int len = chan->conf_len;
5dee9e7c
MH		 2545 int type, hint, olen;
2546 unsigned long val;
6464f35f 2547 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2548 struct l2cap_conf_efs efs;
2549 u8 remote_efs = 0;
861d6882 2550 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2551 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2552 u16 size;
1da177e4 2553
73ffa904 2554 BT_DBG("chan %p", chan);
820ae1b8 2555
5dee9e7c
MH		 2556 while (len >= L2CAP_CONF_OPT_SIZE) {
2557 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2558
589d2746 2559 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2560 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2561
2562 switch (type) {
2563 case L2CAP_CONF_MTU:
861d6882 2564 mtu = val;
5dee9e7c
MH		 2565 break;
2566
2567 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2568 chan->flush_to = val;
5dee9e7c
MH		 2569 break;
2570
2571 case L2CAP_CONF_QOS:
2572 break;
2573
6464f35f
MH		 2574 case L2CAP_CONF_RFC:
2575 if (olen == sizeof(rfc))
2576 memcpy(&rfc, (void *) val, olen);
2577 break;
2578
fcc203c3
GP		 2579 case L2CAP_CONF_FCS:
2580 if (val == L2CAP_FCS_NONE)
c1360a1c 2581 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2582 break;
fcc203c3 2583
42dceae2
AE		 2584 case L2CAP_CONF_EFS:
2585 remote_efs = 1;
2586 if (olen == sizeof(efs))
2587 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2588 break;
2589
6327eb98
AE		 2590 case L2CAP_CONF_EWS:
2591 if (!enable_hs)
2592 return -ECONNREFUSED;
fcc203c3 2593
6327eb98
AE		 2594 set_bit(FLAG_EXT_CTRL, &chan->flags);
2595 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2596 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2597 chan->remote_tx_win = val;
fcc203c3
GP		 2598 break;
2599
5dee9e7c
MH		 2600 default:
2601 if (hint)
2602 break;
2603
2604 result = L2CAP_CONF_UNKNOWN;
2605 *((u8 *) ptr++) = type;
2606 break;
2607 }
2608 }
2609
73ffa904 2610 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2611 goto done;
2612
0c1bc5c6 2613 switch (chan->mode) {
f2fcfcd6
GP		 2614 case L2CAP_MODE_STREAMING:
2615 case L2CAP_MODE_ERTM:
c1360a1c 2616 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2617 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2618 chan->conn->feat_mask);
85eb53c6
GP		 2619 break;
2620 }
2621
42dceae2
AE		 2622 if (remote_efs) {
2623 if (__l2cap_efs_supported(chan))
2624 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2625 else
2626 return -ECONNREFUSED;
2627 }
2628
0c1bc5c6 2629 if (chan->mode != rfc.mode)
f2fcfcd6 2630 return -ECONNREFUSED;
742e519b 2631
f2fcfcd6 2632 break;
f2fcfcd6
GP		 2633 }
2634
2635done:
0c1bc5c6 2636 if (chan->mode != rfc.mode) {
f2fcfcd6 2637 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2638 rfc.mode = chan->mode;
f2fcfcd6 2639
73ffa904 2640 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2641 return -ECONNREFUSED;
2642
2643 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2644 sizeof(rfc), (unsigned long) &rfc);
2645 }
2646
5dee9e7c
MH		 2647 if (result == L2CAP_CONF_SUCCESS) {
2648 /* Configure output options and let the other side know
2649 * which ones we don't like. */
2650
f2fcfcd6
GP		 2651 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2652 result = L2CAP_CONF_UNACCEPT;
2653 else {
0c1bc5c6 2654 chan->omtu = mtu;
c1360a1c 2655 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2656 }
0c1bc5c6 2657 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2658
42dceae2
AE		 2659 if (remote_efs) {
2660 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2661 efs.stype != L2CAP_SERV_NOTRAFIC &&
2662 efs.stype != chan->local_stype) {
2663
2664 result = L2CAP_CONF_UNACCEPT;
2665
2666 if (chan->num_conf_req >= 1)
2667 return -ECONNREFUSED;
2668
2669 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2670 sizeof(efs),
42dceae2 2671 (unsigned long) &efs);
0e8b207e 2672 } else {
3e6b3b95 2673 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2674 result = L2CAP_CONF_PENDING;
2675 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2676 }
2677 }
2678
f2fcfcd6
GP		 2679 switch (rfc.mode) {
2680 case L2CAP_MODE_BASIC:
47d1ec61 2681 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2682 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2683 break;
2684
2685 case L2CAP_MODE_ERTM:
6327eb98
AE		 2686 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2687 chan->remote_tx_win = rfc.txwin_size;
2688 else
2689 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2690
2c03a7a4 2691 chan->remote_max_tx = rfc.max_transmit;
1c762159 2692
c8f79162
AE		 2693 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2694 chan->conn->mtu -
2695 L2CAP_EXT_HDR_SIZE -
2696 L2CAP_SDULEN_SIZE -
2697 L2CAP_FCS_SIZE);
2698 rfc.max_pdu_size = cpu_to_le16(size);
2699 chan->remote_mps = size;
f2fcfcd6 2700
10467e9e 2701 rfc.retrans_timeout =
4fd21a88 2702 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 2703 rfc.monitor_timeout =
4fd21a88 2704 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2705
c1360a1c 2706 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2707
2708 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2709 sizeof(rfc), (unsigned long) &rfc);
2710
42dceae2
AE		 2711 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2712 chan->remote_id = efs.id;
2713 chan->remote_stype = efs.stype;
2714 chan->remote_msdu = le16_to_cpu(efs.msdu);
2715 chan->remote_flush_to =
2716 le32_to_cpu(efs.flush_to);
2717 chan->remote_acc_lat =
2718 le32_to_cpu(efs.acc_lat);
2719 chan->remote_sdu_itime =
2720 le32_to_cpu(efs.sdu_itime);
2721 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2722 sizeof(efs), (unsigned long) &efs);
2723 }
f2fcfcd6
GP		 2724 break;
2725
2726 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2727 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2728 chan->conn->mtu -
2729 L2CAP_EXT_HDR_SIZE -
2730 L2CAP_SDULEN_SIZE -
2731 L2CAP_FCS_SIZE);
2732 rfc.max_pdu_size = cpu_to_le16(size);
2733 chan->remote_mps = size;
f2fcfcd6 2734
c1360a1c 2735 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2736
2737 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2738 sizeof(rfc), (unsigned long) &rfc);
2739
f2fcfcd6
GP		 2740 break;
2741
2742 default:
5dee9e7c 2743 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2744
6464f35f 2745 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2746 rfc.mode = chan->mode;
f2fcfcd6 2747 }
6464f35f 2748
f2fcfcd6 2749 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2750 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2751 }
fe4128e0 2752 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2753 rsp->result = cpu_to_le16(result);
2754 rsp->flags = cpu_to_le16(0x0000);
2755
2756 return ptr - data;
1da177e4
LT		 2757}
2758
b4450035 2759static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2760{
f2fcfcd6
GP		 2761 struct l2cap_conf_req *req = data;
2762 void *ptr = req->data;
2763 int type, olen;
2764 unsigned long val;
36e999a8 2765 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 2766 struct l2cap_conf_efs efs;
f2fcfcd6 2767
fe4128e0 2768 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2769
2770 while (len >= L2CAP_CONF_OPT_SIZE) {
2771 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2772
2773 switch (type) {
2774 case L2CAP_CONF_MTU:
2775 if (val < L2CAP_DEFAULT_MIN_MTU) {
2776 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2777 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2778 } else
0c1bc5c6
GP		 2779 chan->imtu = val;
2780 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2781 break;
2782
2783 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2784 chan->flush_to = val;
f2fcfcd6 2785 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2786 2, chan->flush_to);
f2fcfcd6
GP		 2787 break;
2788
2789 case L2CAP_CONF_RFC:
2790 if (olen == sizeof(rfc))
2791 memcpy(&rfc, (void *)val, olen);
2792
c1360a1c 2793 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2794 rfc.mode != chan->mode)
f2fcfcd6
GP		 2795 return -ECONNREFUSED;
2796
47d1ec61 2797 chan->fcs = 0;
f2fcfcd6
GP		 2798
2799 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2800 sizeof(rfc), (unsigned long) &rfc);
2801 break;
6327eb98
AE		 2802
2803 case L2CAP_CONF_EWS:
2804 chan->tx_win = min_t(u16, val,
2805 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2806 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2807 chan->tx_win);
6327eb98 2808 break;
66af7aaf
AE		 2809
2810 case L2CAP_CONF_EFS:
2811 if (olen == sizeof(efs))
2812 memcpy(&efs, (void *)val, olen);
2813
2814 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2815 efs.stype != L2CAP_SERV_NOTRAFIC &&
2816 efs.stype != chan->local_stype)
2817 return -ECONNREFUSED;
2818
2819 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2820 sizeof(efs), (unsigned long) &efs);
2821 break;
f2fcfcd6
GP		 2822 }
2823 }
2824
0c1bc5c6 2825 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2826 return -ECONNREFUSED;
2827
0c1bc5c6 2828 chan->mode = rfc.mode;
6c2ea7a8 2829
0e8b207e 2830 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2831 switch (rfc.mode) {
2832 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2833 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2834 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2835 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2836
2837 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2838 chan->local_msdu = le16_to_cpu(efs.msdu);
2839 chan->local_sdu_itime =
2840 le32_to_cpu(efs.sdu_itime);
2841 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2842 chan->local_flush_to =
2843 le32_to_cpu(efs.flush_to);
2844 }
f2fcfcd6 2845 break;
66af7aaf 2846
f2fcfcd6 2847 case L2CAP_MODE_STREAMING:
47d1ec61 2848 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2849 }
2850 }
2851
fe4128e0 2852 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2853 req->flags = cpu_to_le16(0x0000);
2854
2855 return ptr - data;
2856}
2857
fe4128e0 2858static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2859{
2860 struct l2cap_conf_rsp *rsp = data;
2861 void *ptr = rsp->data;
1da177e4 2862
fe4128e0 2863 BT_DBG("chan %p", chan);
1da177e4 2864
fe4128e0 2865 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2866 rsp->result = cpu_to_le16(result);
aca3192c 2867 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2868
2869 return ptr - data;
2870}
2871
8c1d787b 2872void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2873{
2874 struct l2cap_conn_rsp rsp;
8c1d787b 2875 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2876 u8 buf[128];
2877
fe4128e0
GP		 2878 rsp.scid = cpu_to_le16(chan->dcid);
2879 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2880 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2881 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2882 l2cap_send_cmd(conn, chan->ident,
2883 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2884
c1360a1c 2885 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2886 return;
2887
710f9b0a
GP		 2888 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2889 l2cap_build_conf_req(chan, buf), buf);
2890 chan->num_conf_req++;
2891}
2892
47d1ec61 2893static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2894{
7b1c0049
GP		 2895 int type, olen;
2896 unsigned long val;
2897 struct l2cap_conf_rfc rfc;
2898
47d1ec61 2899 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2900
0c1bc5c6 2901 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2902 return;
2903
2904 while (len >= L2CAP_CONF_OPT_SIZE) {
2905 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2906
2907 switch (type) {
2908 case L2CAP_CONF_RFC:
2909 if (olen == sizeof(rfc))
2910 memcpy(&rfc, (void *)val, olen);
2911 goto done;
2912 }
2913 }
2914
36e999a8
MM		 2915 /* Use sane default values in case a misbehaving remote device
2916 * did not send an RFC option.
2917 */
2918 rfc.mode = chan->mode;
2919 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2920 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2921 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2922
2923 BT_ERR("Expected RFC option was not found, using defaults");
2924
7b1c0049
GP		 2925done:
2926 switch (rfc.mode) {
2927 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2928 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2929 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2930 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2931 break;
2932 case L2CAP_MODE_STREAMING:
47d1ec61 2933 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2934 }
2935}
2936
4e8402a3
MH		 2937static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2938{
e2fd318e 2939 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2940
e2fd318e 2941 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2942 return 0;
2943
2944 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2945 cmd->ident == conn->info_ident) {
17cd3f37 2946 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 2947
2948 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2949 conn->info_ident = 0;
984947dc 2950
4e8402a3
MH		 2951 l2cap_conn_start(conn);
2952 }
2953
2954 return 0;
2955}
2956
1da177e4
LT		 2957static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2958{
1da177e4
LT		 2959 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2960 struct l2cap_conn_rsp rsp;
23691d75 2961 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2962 struct sock *parent, *sk = NULL;
e7c29cb1 2963 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2964
2965 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2966 __le16 psm = req->psm;
1da177e4 2967
097db76c 2968 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 2969
2970 /* Check if we have socket listening on psm */
c2287681 2971 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 2972 if (!pchan) {
1da177e4
LT		 2973 result = L2CAP_CR_BAD_PSM;
2974 goto sendresp;
2975 }
2976
23691d75
GP		 2977 parent = pchan->sk;
2978
3df91ea2 2979 mutex_lock(&conn->chan_lock);
aa2ac881 2980 lock_sock(parent);
e0f0cb56 2981
e7c29cb1
MH		 2982 /* Check if the ACL is secure enough (if not SDP) */
2983 if (psm != cpu_to_le16(0x0001) &&
2984 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2985 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2986 result = L2CAP_CR_SEC_BLOCK;
2987 goto response;
2988 }
2989
1da177e4
LT		 2990 result = L2CAP_CR_NO_MEM;
2991
2992 /* Check for backlog size */
2993 if (sk_acceptq_is_full(parent)) {
8e87d142 2994 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2995 goto response;
2996 }
2997
80808e43
GP		 2998 chan = pchan->ops->new_connection(pchan->data);
2999 if (!chan)
1da177e4
LT		 3000 goto response;
3001
80808e43
GP		 3002 sk = chan->sk;
3003
1da177e4 3004 /* Check if we already have channel with that dcid */
baa7e1fa 3005 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 3006 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 3007 chan->ops->close(chan->data);
1da177e4
LT		 3008 goto response;
3009 }
3010
3011 hci_conn_hold(conn->hcon);
3012
1da177e4
LT		 3013 bacpy(&bt_sk(sk)->src, conn->src);
3014 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3015 chan->psm = psm;
3016 chan->dcid = scid;
1da177e4 3017
d1010240
GP		 3018 bt_accept_enqueue(parent, sk);
3019
6be36555 3020 __l2cap_chan_add(conn, chan);
48454079 3021
fe4128e0 3022 dcid = chan->scid;
1da177e4 3023
c9b66675 3024 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3025
fc7f8a7e 3026 chan->ident = cmd->ident;
1da177e4 3027
984947dc 3028 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3029 if (l2cap_chan_check_security(chan)) {
f66dc81f 3030 if (bt_sk(sk)->defer_setup) {
0e587be7 3031 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3032 result = L2CAP_CR_PEND;
3033 status = L2CAP_CS_AUTHOR_PEND;
3034 parent->sk_data_ready(parent, 0);
3035 } else {
0e587be7 3036 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 3037 result = L2CAP_CR_SUCCESS;
3038 status = L2CAP_CS_NO_INFO;
3039 }
79d554a6 3040 } else {
0e587be7 3041 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3042 result = L2CAP_CR_PEND;
3043 status = L2CAP_CS_AUTHEN_PEND;
3044 }
3045 } else {
0e587be7 3046 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3047 result = L2CAP_CR_PEND;
3048 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3049 }
3050
1da177e4 3051response:
aa2ac881 3052 release_sock(parent);
3df91ea2 3053 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3054
3055sendresp:
aca3192c
YH		 3056 rsp.scid = cpu_to_le16(scid);
3057 rsp.dcid = cpu_to_le16(dcid);
3058 rsp.result = cpu_to_le16(result);
3059 rsp.status = cpu_to_le16(status);
1da177e4 3060 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 3061
3062 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3063 struct l2cap_info_req info;
3064 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3065
3066 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3067 conn->info_ident = l2cap_get_ident(conn);
3068
ba13ccd9 3069 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 3070
3071 l2cap_send_cmd(conn, conn->info_ident,
3072 L2CAP_INFO_REQ, sizeof(info), &info);
3073 }
3074
c1360a1c 3075 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 3076 result == L2CAP_CR_SUCCESS) {
3077 u8 buf[128];
c1360a1c 3078 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3079 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3080 l2cap_build_conf_req(chan, buf), buf);
3081 chan->num_conf_req++;
e9aeb2dd
GP		 3082 }
3083
1da177e4
LT		 3084 return 0;
3085}
3086
3087static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3088{
3089 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3090 u16 scid, dcid, result, status;
48454079 3091 struct l2cap_chan *chan;
1da177e4 3092 u8 req[128];
3df91ea2 3093 int err;
1da177e4
LT		 3094
3095 scid = __le16_to_cpu(rsp->scid);
3096 dcid = __le16_to_cpu(rsp->dcid);
3097 result = __le16_to_cpu(rsp->result);
3098 status = __le16_to_cpu(rsp->status);
3099
1b009c98
AE		 3100 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3101 dcid, scid, result, status);
1da177e4 3102
3df91ea2
AE		 3103 mutex_lock(&conn->chan_lock);
3104
1da177e4 3105 if (scid) {
3df91ea2
AE		 3106 chan = __l2cap_get_chan_by_scid(conn, scid);
3107 if (!chan) {
3108 err = -EFAULT;
3109 goto unlock;
3110 }
1da177e4 3111 } else {
3df91ea2
AE		 3112 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3113 if (!chan) {
3114 err = -EFAULT;
3115 goto unlock;
3116 }
1da177e4
LT		 3117 }
3118
3df91ea2
AE		 3119 err = 0;
3120
6be36555 3121 l2cap_chan_lock(chan);
48454079 3122
1da177e4
LT		 3123 switch (result) {
3124 case L2CAP_CR_SUCCESS:
89bc500e 3125 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3126 chan->ident = 0;
fe4128e0 3127 chan->dcid = dcid;
c1360a1c 3128 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3129
c1360a1c 3130 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3131 break;
3132
1da177e4 3133 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3134 l2cap_build_conf_req(chan, req), req);
3135 chan->num_conf_req++;
1da177e4
LT		 3136 break;
3137
3138 case L2CAP_CR_PEND:
c1360a1c 3139 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3140 break;
3141
3142 default:
48454079 3143 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3144 break;
3145 }
3146
6be36555 3147 l2cap_chan_unlock(chan);
3df91ea2
AE		 3148
3149unlock:
3150 mutex_unlock(&conn->chan_lock);
3151
3152 return err;
1da177e4
LT		 3153}
3154
47d1ec61 3155static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3156{
3157 /* FCS is enabled only in ERTM or streaming mode, if one or both
3158 * sides request it.
3159 */
0c1bc5c6 3160 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3161 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3162 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3163 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3164}
3165
88219a0f 3166static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3167{
3168 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3169 u16 dcid, flags;
3170 u8 rsp[64];
48454079 3171 struct l2cap_chan *chan;
3c588192 3172 int len, err = 0;
1da177e4
LT		 3173
3174 dcid = __le16_to_cpu(req->dcid);
3175 flags = __le16_to_cpu(req->flags);
3176
3177 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3178
baa7e1fa 3179 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3180 if (!chan)
1da177e4
LT		 3181 return -ENOENT;
3182
6be36555 3183 l2cap_chan_lock(chan);
48454079 3184
033b1142 3185 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3186 struct l2cap_cmd_rej_cid rej;
3187
3188 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3189 rej.scid = cpu_to_le16(chan->scid);
3190 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3191
df6bd743
GP		 3192 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3193 sizeof(rej), &rej);
354f60a9 3194 goto unlock;
df6bd743 3195 }
354f60a9 3196
5dee9e7c 3197 /* Reject if config buffer is too small. */
88219a0f 3198 len = cmd_len - sizeof(*req);
7ac28817 3199 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3200 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3201 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 3202 L2CAP_CONF_REJECT, flags), rsp);
3203 goto unlock;
3204 }
3205
3206 /* Store config. */
73ffa904
GP		 3207 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3208 chan->conf_len += len;
1da177e4
LT		 3209
3210 if (flags & 0x0001) {
3211 /* Incomplete config. Send empty response. */
3212 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3213 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 3214 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 3215 goto unlock;
3216 }
3217
3218 /* Complete config. */
73ffa904 3219 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3220 if (len < 0) {
e92c8e70 3221 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3222 goto unlock;
f2fcfcd6 3223 }
1da177e4 3224
5dee9e7c 3225 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3226 chan->num_conf_rsp++;
5dee9e7c 3227
5dee9e7c 3228 /* Reset config buffer. */
73ffa904 3229 chan->conf_len = 0;
5dee9e7c 3230
c1360a1c 3231 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3232 goto unlock;
3233
c1360a1c 3234 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3235 set_default_fcs(chan);
fcc203c3 3236
89bc500e 3237 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 3238
105bdf9e
MM		 3239 if (chan->mode == L2CAP_MODE_ERTM ||
3240 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3241 err = l2cap_ertm_init(chan);
3242
3243 if (err < 0)
3244 l2cap_send_disconn_req(chan->conn, chan, -err);
3245 else
3246 l2cap_chan_ready(chan);
0565c1c2 3247
876d9484
MH		 3248 goto unlock;
3249 }
3250
c1360a1c 3251 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3252 u8 buf[64];
1da177e4 3253 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3254 l2cap_build_conf_req(chan, buf), buf);
3255 chan->num_conf_req++;
1da177e4
LT		 3256 }
3257
0e8b207e
AE		 3258 /* Got Conf Rsp PENDING from remote side and asume we sent
3259 Conf Rsp PENDING in the code above */
3260 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3261 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3262
3263 /* check compatibility */
3264
3265 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3266 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3267
3268 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3269 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 3270 L2CAP_CONF_SUCCESS, 0x0000), rsp);
3271 }
3272
1da177e4 3273unlock:
6be36555 3274 l2cap_chan_unlock(chan);
3c588192 3275 return err;
1da177e4
LT		 3276}
3277
3278static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3279{
3280 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3281 u16 scid, flags, result;
48454079 3282 struct l2cap_chan *chan;
61386cba 3283 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3284 int err = 0;
1da177e4
LT		 3285
3286 scid = __le16_to_cpu(rsp->scid);
3287 flags = __le16_to_cpu(rsp->flags);
3288 result = __le16_to_cpu(rsp->result);
3289
61386cba
AE		 3290 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3291 result, len);
1da177e4 3292
baa7e1fa 3293 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3294 if (!chan)
1da177e4
LT		 3295 return 0;
3296
6be36555 3297 l2cap_chan_lock(chan);
48454079 3298
1da177e4
LT		 3299 switch (result) {
3300 case L2CAP_CONF_SUCCESS:
47d1ec61 3301 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3302 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3303 break;
3304
0e8b207e
AE		 3305 case L2CAP_CONF_PENDING:
3306 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3307
3308 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3309 char buf[64];
3310
3311 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3312 buf, &result);
3313 if (len < 0) {
3314 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3315 goto done;
3316 }
3317
3318 /* check compatibility */
3319
3320 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3321 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3322
3323 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3324 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 3325 L2CAP_CONF_SUCCESS, 0x0000), buf);
3326 }
3327 goto done;
3328
1da177e4 3329 case L2CAP_CONF_UNACCEPT:
73ffa904 3330 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3331 char req[64];
3332
c2c77ec8 3333 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3334 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3335 goto done;
3336 }
3337
f2fcfcd6
GP		 3338 /* throw out any old stored conf requests */
3339 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3340 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3341 req, &result);
f2fcfcd6 3342 if (len < 0) {
e92c8e70 3343 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3344 goto done;
3345 }
3346
3347 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3348 L2CAP_CONF_REQ, len, req);
73ffa904 3349 chan->num_conf_req++;
f2fcfcd6
GP		 3350 if (result != L2CAP_CONF_SUCCESS)
3351 goto done;
3352 break;
1da177e4
LT		 3353 }
3354
8e87d142 3355 default:
6be36555 3356 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3357
ba13ccd9 3358 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3359 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3360 goto done;
3361 }
3362
3363 if (flags & 0x01)
3364 goto done;
3365
c1360a1c 3366 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3367
c1360a1c 3368 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3369 set_default_fcs(chan);
fcc203c3 3370
89bc500e 3371 l2cap_state_change(chan, BT_CONNECTED);
105bdf9e
MM		 3372 if (chan->mode == L2CAP_MODE_ERTM ||
3373 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3374 err = l2cap_ertm_init(chan);
0565c1c2 3375
3c588192
MM		 3376 if (err < 0)
3377 l2cap_send_disconn_req(chan->conn, chan, -err);
3378 else
3379 l2cap_chan_ready(chan);
1da177e4
LT		 3380 }
3381
3382done:
6be36555 3383 l2cap_chan_unlock(chan);
3c588192 3384 return err;
1da177e4
LT		 3385}
3386
3387static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3388{
3389 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3390 struct l2cap_disconn_rsp rsp;
3391 u16 dcid, scid;
48454079 3392 struct l2cap_chan *chan;
1da177e4
LT		 3393 struct sock *sk;
3394
3395 scid = __le16_to_cpu(req->scid);
3396 dcid = __le16_to_cpu(req->dcid);
3397
3398 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3399
3df91ea2
AE		 3400 mutex_lock(&conn->chan_lock);
3401
3402 chan = __l2cap_get_chan_by_scid(conn, dcid);
3403 if (!chan) {
3404 mutex_unlock(&conn->chan_lock);
1da177e4 3405 return 0;
3df91ea2 3406 }
1da177e4 3407
6be36555
AE		 3408 l2cap_chan_lock(chan);
3409
48454079
GP		 3410 sk = chan->sk;
3411
fe4128e0
GP		 3412 rsp.dcid = cpu_to_le16(chan->scid);
3413 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3414 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3415
6be36555 3416 lock_sock(sk);
1da177e4 3417 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3418 release_sock(sk);
1da177e4 3419
61d6ef3e 3420 l2cap_chan_hold(chan);
48454079 3421 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3422
3423 l2cap_chan_unlock(chan);
1da177e4 3424
ba3bd0ee 3425 chan->ops->close(chan->data);
61d6ef3e 3426 l2cap_chan_put(chan);
3df91ea2
AE		 3427
3428 mutex_unlock(&conn->chan_lock);
3429
1da177e4
LT		 3430 return 0;
3431}
3432
3433static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3434{
3435 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3436 u16 dcid, scid;
48454079 3437 struct l2cap_chan *chan;
1da177e4
LT		 3438
3439 scid = __le16_to_cpu(rsp->scid);
3440 dcid = __le16_to_cpu(rsp->dcid);
3441
3442 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3443
3df91ea2
AE		 3444 mutex_lock(&conn->chan_lock);
3445
3446 chan = __l2cap_get_chan_by_scid(conn, scid);
3447 if (!chan) {
3448 mutex_unlock(&conn->chan_lock);
1da177e4 3449 return 0;
3df91ea2 3450 }
1da177e4 3451
6be36555 3452 l2cap_chan_lock(chan);
48454079 3453
61d6ef3e 3454 l2cap_chan_hold(chan);
48454079 3455 l2cap_chan_del(chan, 0);
6be36555
AE		 3456
3457 l2cap_chan_unlock(chan);
1da177e4 3458
ba3bd0ee 3459 chan->ops->close(chan->data);
61d6ef3e 3460 l2cap_chan_put(chan);
3df91ea2
AE		 3461
3462 mutex_unlock(&conn->chan_lock);
3463
1da177e4
LT		 3464 return 0;
3465}
3466
3467static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3468{
3469 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3470 u16 type;
3471
3472 type = __le16_to_cpu(req->type);
3473
3474 BT_DBG("type 0x%4.4x", type);
3475
f0709e03
MH		 3476 if (type == L2CAP_IT_FEAT_MASK) {
3477 u8 buf[8];
44dd46de 3478 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3479 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3480 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3481 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3482 if (!disable_ertm)
fcc203c3
GP		 3483 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3484 | L2CAP_FEAT_FCS;
a5fd6f30 3485 if (enable_hs)
6327eb98
AE		 3486 feat_mask |= L2CAP_FEAT_EXT_FLOW
3487 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3488
1b7bf4ed 3489 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3490 l2cap_send_cmd(conn, cmd->ident,
3491 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3492 } else if (type == L2CAP_IT_FIXED_CHAN) {
3493 u8 buf[12];
3494 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3495
3496 if (enable_hs)
3497 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3498 else
3499 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3500
e1027a7c
MH		 3501 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3502 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3503 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3504 l2cap_send_cmd(conn, cmd->ident,
3505 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3506 } else {
3507 struct l2cap_info_rsp rsp;
3508 rsp.type = cpu_to_le16(type);
3509 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3510 l2cap_send_cmd(conn, cmd->ident,
3511 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3512 }
1da177e4
LT		 3513
3514 return 0;
3515}
3516
3517static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3518{
3519 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3520 u16 type, result;
3521
3522 type = __le16_to_cpu(rsp->type);
3523 result = __le16_to_cpu(rsp->result);
3524
3525 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3526
e90165be
AE		 3527 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3528 if (cmd->ident != conn->info_ident ||
3529 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3530 return 0;
3531
17cd3f37 3532 cancel_delayed_work(&conn->info_timer);
4e8402a3 3533
adb08ede
VT		 3534 if (result != L2CAP_IR_SUCCESS) {
3535 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3536 conn->info_ident = 0;
3537
3538 l2cap_conn_start(conn);
3539
3540 return 0;
3541 }
3542
978c93b9
AE		 3543 switch (type) {
3544 case L2CAP_IT_FEAT_MASK:
83985319 3545 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3546
47ec1dcd 3547 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3548 struct l2cap_info_req req;
3549 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3550
3551 conn->info_ident = l2cap_get_ident(conn);
3552
3553 l2cap_send_cmd(conn, conn->info_ident,
3554 L2CAP_INFO_REQ, sizeof(req), &req);
3555 } else {
3556 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3557 conn->info_ident = 0;
3558
3559 l2cap_conn_start(conn);
3560 }
978c93b9
AE		 3561 break;
3562
3563 case L2CAP_IT_FIXED_CHAN:
3564 conn->fixed_chan_mask = rsp->data[0];
984947dc 3565 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3566 conn->info_ident = 0;
984947dc
MH		 3567
3568 l2cap_conn_start(conn);
978c93b9 3569 break;
984947dc 3570 }
4e8402a3 3571
1da177e4
LT		 3572 return 0;
3573}
3574
f94ff6ff
MM		 3575static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3576 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3577 void *data)
3578{
3579 struct l2cap_create_chan_req *req = data;
3580 struct l2cap_create_chan_rsp rsp;
3581 u16 psm, scid;
3582
3583 if (cmd_len != sizeof(*req))
3584 return -EPROTO;
3585
3586 if (!enable_hs)
3587 return -EINVAL;
3588
3589 psm = le16_to_cpu(req->psm);
3590 scid = le16_to_cpu(req->scid);
3591
3592 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3593
3594 /* Placeholder: Always reject */
3595 rsp.dcid = 0;
3596 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 3597 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3598 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 3599
3600 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3601 sizeof(rsp), &rsp);
3602
3603 return 0;
3604}
3605
3606static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3607 struct l2cap_cmd_hdr *cmd, void *data)
3608{
3609 BT_DBG("conn %p", conn);
3610
3611 return l2cap_connect_rsp(conn, cmd, data);
3612}
3613
8d5a04a1
MM		 3614static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3615 u16 icid, u16 result)
3616{
3617 struct l2cap_move_chan_rsp rsp;
3618
3619 BT_DBG("icid %d, result %d", icid, result);
3620
3621 rsp.icid = cpu_to_le16(icid);
3622 rsp.result = cpu_to_le16(result);
3623
3624 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3625}
3626
3627static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3628 struct l2cap_chan *chan, u16 icid, u16 result)
3629{
3630 struct l2cap_move_chan_cfm cfm;
3631 u8 ident;
3632
3633 BT_DBG("icid %d, result %d", icid, result);
3634
3635 ident = l2cap_get_ident(conn);
3636 if (chan)
3637 chan->ident = ident;
3638
3639 cfm.icid = cpu_to_le16(icid);
3640 cfm.result = cpu_to_le16(result);
3641
3642 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3643}
3644
3645static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3646 u16 icid)
3647{
3648 struct l2cap_move_chan_cfm_rsp rsp;
3649
3650 BT_DBG("icid %d", icid);
3651
3652 rsp.icid = cpu_to_le16(icid);
3653 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3654}
3655
3656static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3657 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3658{
3659 struct l2cap_move_chan_req *req = data;
3660 u16 icid = 0;
3661 u16 result = L2CAP_MR_NOT_ALLOWED;
3662
3663 if (cmd_len != sizeof(*req))
3664 return -EPROTO;
3665
3666 icid = le16_to_cpu(req->icid);
3667
3668 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3669
3670 if (!enable_hs)
3671 return -EINVAL;
3672
3673 /* Placeholder: Always refuse */
3674 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3675
3676 return 0;
3677}
3678
3679static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3680 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3681{
3682 struct l2cap_move_chan_rsp *rsp = data;
3683 u16 icid, result;
3684
3685 if (cmd_len != sizeof(*rsp))
3686 return -EPROTO;
3687
3688 icid = le16_to_cpu(rsp->icid);
3689 result = le16_to_cpu(rsp->result);
3690
3691 BT_DBG("icid %d, result %d", icid, result);
3692
3693 /* Placeholder: Always unconfirmed */
3694 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3695
3696 return 0;
3697}
3698
3699static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3700 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3701{
3702 struct l2cap_move_chan_cfm *cfm = data;
3703 u16 icid, result;
3704
3705 if (cmd_len != sizeof(*cfm))
3706 return -EPROTO;
3707
3708 icid = le16_to_cpu(cfm->icid);
3709 result = le16_to_cpu(cfm->result);
3710
3711 BT_DBG("icid %d, result %d", icid, result);
3712
3713 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3714
3715 return 0;
3716}
3717
3718static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3719 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3720{
3721 struct l2cap_move_chan_cfm_rsp *rsp = data;
3722 u16 icid;
3723
3724 if (cmd_len != sizeof(*rsp))
3725 return -EPROTO;
3726
3727 icid = le16_to_cpu(rsp->icid);
3728
3729 BT_DBG("icid %d", icid);
3730
3731 return 0;
3732}
3733
e2174ca4 3734static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3735 u16 to_multiplier)
3736{
3737 u16 max_latency;
3738
3739 if (min > max || min < 6 || max > 3200)
3740 return -EINVAL;
3741
3742 if (to_multiplier < 10 || to_multiplier > 3200)
3743 return -EINVAL;
3744
3745 if (max >= to_multiplier * 8)
3746 return -EINVAL;
3747
3748 max_latency = (to_multiplier * 8 / max) - 1;
3749 if (latency > 499 || latency > max_latency)
3750 return -EINVAL;
3751
3752 return 0;
3753}
3754
3755static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3756 struct l2cap_cmd_hdr *cmd, u8 *data)
3757{
3758 struct hci_conn *hcon = conn->hcon;
3759 struct l2cap_conn_param_update_req *req;
3760 struct l2cap_conn_param_update_rsp rsp;
3761 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3762 int err;
de73115a
CT		 3763
3764 if (!(hcon->link_mode & HCI_LM_MASTER))
3765 return -EINVAL;
3766
3767 cmd_len = __le16_to_cpu(cmd->len);
3768 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3769 return -EPROTO;
3770
3771 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3772 min = __le16_to_cpu(req->min);
3773 max = __le16_to_cpu(req->max);
de73115a
CT		 3774 latency = __le16_to_cpu(req->latency);
3775 to_multiplier = __le16_to_cpu(req->to_multiplier);
3776
3777 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3778 min, max, latency, to_multiplier);
3779
3780 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3781
3782 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3783 if (err)
de73115a
CT		 3784 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3785 else
3786 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3787
3788 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3789 sizeof(rsp), &rsp);
3790
2ce603eb
CT		 3791 if (!err)
3792 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3793
de73115a
CT		 3794 return 0;
3795}
3796
3300d9a9
CT		 3797static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3798 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3799{
3800 int err = 0;
3801
3802 switch (cmd->code) {
3803 case L2CAP_COMMAND_REJ:
3804 l2cap_command_rej(conn, cmd, data);
3805 break;
3806
3807 case L2CAP_CONN_REQ:
3808 err = l2cap_connect_req(conn, cmd, data);
3809 break;
3810
3811 case L2CAP_CONN_RSP:
3812 err = l2cap_connect_rsp(conn, cmd, data);
3813 break;
3814
3815 case L2CAP_CONF_REQ:
3816 err = l2cap_config_req(conn, cmd, cmd_len, data);
3817 break;
3818
3819 case L2CAP_CONF_RSP:
3820 err = l2cap_config_rsp(conn, cmd, data);
3821 break;
3822
3823 case L2CAP_DISCONN_REQ:
3824 err = l2cap_disconnect_req(conn, cmd, data);
3825 break;
3826
3827 case L2CAP_DISCONN_RSP:
3828 err = l2cap_disconnect_rsp(conn, cmd, data);
3829 break;
3830
3831 case L2CAP_ECHO_REQ:
3832 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3833 break;
3834
3835 case L2CAP_ECHO_RSP:
3836 break;
3837
3838 case L2CAP_INFO_REQ:
3839 err = l2cap_information_req(conn, cmd, data);
3840 break;
3841
3842 case L2CAP_INFO_RSP:
3843 err = l2cap_information_rsp(conn, cmd, data);
3844 break;
3845
f94ff6ff
MM		 3846 case L2CAP_CREATE_CHAN_REQ:
3847 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3848 break;
3849
3850 case L2CAP_CREATE_CHAN_RSP:
3851 err = l2cap_create_channel_rsp(conn, cmd, data);
3852 break;
3853
8d5a04a1
MM		 3854 case L2CAP_MOVE_CHAN_REQ:
3855 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3856 break;
3857
3858 case L2CAP_MOVE_CHAN_RSP:
3859 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3860 break;
3861
3862 case L2CAP_MOVE_CHAN_CFM:
3863 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3864 break;
3865
3866 case L2CAP_MOVE_CHAN_CFM_RSP:
3867 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3868 break;
3869
3300d9a9
CT		 3870 default:
3871 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3872 err = -EINVAL;
3873 break;
3874 }
3875
3876 return err;
3877}
3878
3879static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3880 struct l2cap_cmd_hdr *cmd, u8 *data)
3881{
3882 switch (cmd->code) {
3883 case L2CAP_COMMAND_REJ:
3884 return 0;
3885
3886 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3887 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3888
3889 case L2CAP_CONN_PARAM_UPDATE_RSP:
3890 return 0;
3891
3892 default:
3893 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3894 return -EINVAL;
3895 }
3896}
3897
3898static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3899 struct sk_buff *skb)
1da177e4
LT		 3900{
3901 u8 *data = skb->data;
3902 int len = skb->len;
3903 struct l2cap_cmd_hdr cmd;
3300d9a9 3904 int err;
1da177e4
LT		 3905
3906 l2cap_raw_recv(conn, skb);
3907
3908 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3909 u16 cmd_len;
1da177e4
LT		 3910 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3911 data += L2CAP_CMD_HDR_SIZE;
3912 len -= L2CAP_CMD_HDR_SIZE;
3913
88219a0f 3914 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3915
88219a0f 3916 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3917
88219a0f 3918 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3919 BT_DBG("corrupted command");
3920 break;
3921 }
3922
3300d9a9
CT		 3923 if (conn->hcon->type == LE_LINK)
3924 err = l2cap_le_sig_cmd(conn, &cmd, data);
3925 else
3926 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3927
3928 if (err) {
e2fd318e 3929 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3930
3931 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3932
3933 /* FIXME: Map err to a valid reason */
e2fd318e 3934 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3935 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3936 }
3937
88219a0f
AV		 3938 data += cmd_len;
3939 len -= cmd_len;
1da177e4
LT		 3940 }
3941
3942 kfree_skb(skb);
3943}
3944
47d1ec61 3945static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3946{
3947 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3948 int hdr_size;
3949
3950 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3951 hdr_size = L2CAP_EXT_HDR_SIZE;
3952 else
3953 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3954
47d1ec61 3955 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3956 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3957 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3958 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3959
3960 if (our_fcs != rcv_fcs)
7a560e5c 3961 return -EBADMSG;
fcc203c3
GP		 3962 }
3963 return 0;
3964}
3965
525cd185 3966static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3967{
88843ab0 3968 u32 control = 0;
d5392c8f 3969
6a026610 3970 chan->frames_sent = 0;
d5392c8f 3971
0b209fae 3972 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3973
e2ab4353 3974 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3975 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3976 l2cap_send_sframe(chan, control);
e2ab4353 3977 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3978 }
3979
e2ab4353 3980 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3981 l2cap_retransmit_frames(chan);
d5392c8f 3982
525cd185 3983 l2cap_ertm_send(chan);
d5392c8f 3984
e2ab4353 3985 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3986 chan->frames_sent == 0) {
ab784b73 3987 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3988 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3989 }
3990}
3991
fb45de7d 3992static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 3993{
3994 struct sk_buff *next_skb;
bfbacc11 3995 int tx_seq_offset, next_tx_seq_offset;
8f17154f 3996
3ce3514f
MM		 3997 bt_cb(skb)->control.txseq = tx_seq;
3998 bt_cb(skb)->control.sar = sar;
8f17154f 3999
f1c6775b 4000 next_skb = skb_peek(&chan->srej_q);
8f17154f 4001
836be934 4002 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 4003
039d9572 4004 while (next_skb) {
3ce3514f 4005 if (bt_cb(next_skb)->control.txseq == tx_seq)
9b53350d
JPRV		 4006 return -EINVAL;
4007
836be934 4008 next_tx_seq_offset = __seq_offset(chan,
3ce3514f 4009 bt_cb(next_skb)->control.txseq, chan->buffer_seq);
bfbacc11
JPRV		 4010
4011 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 4012 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 4013 return 0;
8f17154f
GP		 4014 }
4015
f1c6775b 4016 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 4017 next_skb = NULL;
4018 else
4019 next_skb = skb_queue_next(&chan->srej_q, next_skb);
4020 }
8f17154f 4021
f1c6775b 4022 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 4023
4024 return 0;
8f17154f
GP		 4025}
4026
84084a31
MM		 4027static void append_skb_frag(struct sk_buff *skb,
4028 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 4029{
84084a31
MM		 4030 /* skb->len reflects data in skb as well as all fragments
4031 * skb->data_len reflects only data in fragments
4032 */
4033 if (!skb_has_frag_list(skb))
4034 skb_shinfo(skb)->frag_list = new_frag;
4035
4036 new_frag->next = NULL;
4037
4038 (*last_frag)->next = new_frag;
4039 *last_frag = new_frag;
4040
4041 skb->len += new_frag->len;
4042 skb->data_len += new_frag->len;
4043 skb->truesize += new_frag->truesize;
4044}
4045
88843ab0 4046static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 4047{
4048 int err = -EINVAL;
18778a63 4049
7e0ef6ee
AE		 4050 switch (__get_ctrl_sar(chan, control)) {
4051 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 4052 if (chan->sdu)
4053 break;
18778a63 4054
84084a31
MM		 4055 err = chan->ops->recv(chan->data, skb);
4056 break;
18778a63 4057
7e0ef6ee 4058 case L2CAP_SAR_START:
84084a31
MM		 4059 if (chan->sdu)
4060 break;
18778a63 4061
6f61fd47 4062 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 4063 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 4064
84084a31
MM		 4065 if (chan->sdu_len > chan->imtu) {
4066 err = -EMSGSIZE;
4067 break;
4068 }
1890d36b 4069
84084a31
MM		 4070 if (skb->len >= chan->sdu_len)
4071 break;
18778a63 4072
84084a31
MM		 4073 chan->sdu = skb;
4074 chan->sdu_last_frag = skb;
18778a63 4075
84084a31
MM		 4076 skb = NULL;
4077 err = 0;
18778a63
GP		 4078 break;
4079
7e0ef6ee 4080 case L2CAP_SAR_CONTINUE:
6f61fd47 4081 if (!chan->sdu)
84084a31 4082 break;
18778a63 4083
84084a31
MM		 4084 append_skb_frag(chan->sdu, skb,
4085 &chan->sdu_last_frag);
4086 skb = NULL;
18778a63 4087
84084a31
MM		 4088 if (chan->sdu->len >= chan->sdu_len)
4089 break;
4178ba46 4090
84084a31 4091 err = 0;
18778a63
GP		 4092 break;
4093
7e0ef6ee 4094 case L2CAP_SAR_END:
6f61fd47 4095 if (!chan->sdu)
84084a31 4096 break;
18778a63 4097
84084a31
MM		 4098 append_skb_frag(chan->sdu, skb,
4099 &chan->sdu_last_frag);
4100 skb = NULL;
4178ba46 4101
84084a31
MM		 4102 if (chan->sdu->len != chan->sdu_len)
4103 break;
18778a63 4104
84084a31 4105 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 4106
84084a31
MM		 4107 if (!err) {
4108 /* Reassembly complete */
4109 chan->sdu = NULL;
4110 chan->sdu_last_frag = NULL;
4111 chan->sdu_len = 0;
1890d36b 4112 }
18778a63
GP		 4113 break;
4114 }
4115
84084a31
MM		 4116 if (err) {
4117 kfree_skb(skb);
4118 kfree_skb(chan->sdu);
4119 chan->sdu = NULL;
4120 chan->sdu_last_frag = NULL;
4121 chan->sdu_len = 0;
4122 }
18778a63 4123
84084a31 4124 return err;
18778a63
GP		 4125}
4126
26f880d2 4127static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 4128{
26f880d2 4129 BT_DBG("chan %p, Enter local busy", chan);
712132eb 4130
26f880d2 4131 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3c588192 4132 l2cap_seq_list_clear(&chan->srej_list);
26f880d2 4133
77f918bc 4134 __set_ack_timer(chan);
26f880d2
MM		 4135}
4136
4137static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
4138{
88843ab0 4139 u32 control;
712132eb 4140
e2ab4353 4141 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 4142 goto done;
4143
0b209fae 4144 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 4145 control |= __set_ctrl_poll(chan);
ab784b73 4146 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 4147 l2cap_send_sframe(chan, control);
6a026610 4148 chan->retry_count = 1;
712132eb 4149
1a09bcb9
GP		 4150 __clear_retrans_timer(chan);
4151 __set_monitor_timer(chan);
712132eb 4152
e2ab4353 4153 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 4154
4155done:
e2ab4353
GP		 4156 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4157 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 4158
49208c9c 4159 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 4160}
4161
e328140f 4162void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 4163{
e328140f
MM		 4164 if (chan->mode == L2CAP_MODE_ERTM) {
4165 if (busy)
4166 l2cap_ertm_enter_local_busy(chan);
4167 else
4168 l2cap_ertm_exit_local_busy(chan);
1890d36b 4169 }
1890d36b
GP		 4170}
4171
fb45de7d 4172static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 4173{
4174 struct sk_buff *skb;
88843ab0 4175 u32 control;
8f17154f 4176
e328140f
MM		 4177 while ((skb = skb_peek(&chan->srej_q)) &&
4178 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4179 int err;
4180
3ce3514f 4181 if (bt_cb(skb)->control.txseq != tx_seq)
8f17154f
GP		 4182 break;
4183
f1c6775b 4184 skb = skb_dequeue(&chan->srej_q);
3ce3514f 4185 control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
84084a31 4186 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 4187
4188 if (err < 0) {
4189 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4190 break;
4191 }
4192
836be934
AE		 4193 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
4194 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 4195 }
4196}
4197
fb45de7d 4198static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4199{
8f17154f 4200 struct srej_list *l, *tmp;
88843ab0 4201 u32 control;
8f17154f 4202
39d5a3ee 4203 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 4204 if (l->tx_seq == tx_seq) {
4205 list_del(&l->list);
4206 kfree(l);
4207 return;
4208 }
ab784b73 4209 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4210 control |= __set_reqseq(chan, l->tx_seq);
525cd185 4211 l2cap_send_sframe(chan, control);
8f17154f 4212 list_del(&l->list);
39d5a3ee 4213 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 4214 }
4215}
4216
aef89f21 4217static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4218{
8f17154f 4219 struct srej_list *new;
88843ab0 4220 u32 control;
8f17154f 4221
42e5c802 4222 while (tx_seq != chan->expected_tx_seq) {
ab784b73 4223 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4224 control |= __set_reqseq(chan, chan->expected_tx_seq);
3c588192 4225 l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
525cd185 4226 l2cap_send_sframe(chan, control);
8f17154f
GP		 4227
4228 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 4229 if (!new)
4230 return -ENOMEM;
4231
42e5c802 4232 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 4233
4234 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4235
39d5a3ee 4236 list_add_tail(&new->list, &chan->srej_l);
8f17154f 4237 }
836be934
AE		 4238
4239 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 4240
4241 return 0;
8f17154f
GP		 4242}
4243
88843ab0 4244static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 4245{
fb45de7d 4246 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 4247 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 4248 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 4249 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 4250 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 4251 int err = 0;
4252
88843ab0 4253 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 4254 tx_seq, rx_control);
1c2acffb 4255
03f6715d 4256 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4257 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4258 __clear_monitor_timer(chan);
6a026610 4259 if (chan->unacked_frames > 0)
1a09bcb9 4260 __set_retrans_timer(chan);
e2ab4353 4261 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 4262 }
4263
42e5c802
GP		 4264 chan->expected_ack_seq = req_seq;
4265 l2cap_drop_acked_frames(chan);
9f121a5a 4266
836be934 4267 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4268
4269 /* invalid tx_seq */
47d1ec61 4270 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 4271 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 4272 goto drop;
4273 }
4274
77f918bc
SJ		 4275 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4276 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4277 l2cap_send_ack(chan);
1890d36b 4278 goto drop;
77f918bc 4279 }
1890d36b 4280
02f1b641
MM		 4281 if (tx_seq == chan->expected_tx_seq)
4282 goto expected;
4283
e2ab4353 4284 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 4285 struct srej_list *first;
30afb5b2 4286
39d5a3ee 4287 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 4288 struct srej_list, list);
4289 if (tx_seq == first->tx_seq) {
42e5c802 4290 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 4291 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 4292
4293 list_del(&first->list);
4294 kfree(first);
4295
39d5a3ee 4296 if (list_empty(&chan->srej_l)) {
42e5c802 4297 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 4298 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 4299 l2cap_send_ack(chan);
49208c9c 4300 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 4301 }
4302 } else {
4303 struct srej_list *l;
9b53350d
JPRV		 4304
4305 /* duplicated tx_seq */
42e5c802 4306 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 4307 goto drop;
8f17154f 4308
39d5a3ee 4309 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 4310 if (l->tx_seq == tx_seq) {
525cd185 4311 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 4312 return 0;
4313 }
4314 }
aef89f21
SJ		 4315
4316 err = l2cap_send_srejframe(chan, tx_seq);
4317 if (err < 0) {
4318 l2cap_send_disconn_req(chan->conn, chan, -err);
4319 return err;
4320 }
30afb5b2
GP		 4321 }
4322 } else {
836be934
AE		 4323 expected_tx_seq_offset = __seq_offset(chan,
4324 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4325
4326 /* duplicated tx_seq */
4327 if (tx_seq_offset < expected_tx_seq_offset)
4328 goto drop;
4329
e2ab4353 4330 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 4331
49208c9c 4332 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 4333
39d5a3ee 4334 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 4335 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 4336
f1c6775b 4337 __skb_queue_head_init(&chan->srej_q);
42e5c802 4338 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 4339
0ef3ef0f
SJ		 4340 /* Set P-bit only if there are some I-frames to ack. */
4341 if (__clear_ack_timer(chan))
4342 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 4343
aef89f21
SJ		 4344 err = l2cap_send_srejframe(chan, tx_seq);
4345 if (err < 0) {
4346 l2cap_send_disconn_req(chan->conn, chan, -err);
4347 return err;
4348 }
1c2acffb 4349 }
30afb5b2
GP		 4350 return 0;
4351
8f17154f 4352expected:
836be934 4353 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 4354
e2ab4353 4355 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3ce3514f
MM		 4356 bt_cb(skb)->control.txseq = tx_seq;
4357 bt_cb(skb)->control.sar = sar;
f1c6775b 4358 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 4359 return 0;
4360 }
4361
84084a31 4362 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 4363 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4364
e328140f
MM		 4365 if (err < 0) {
4366 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4367 return err;
4368 }
2ece3684 4369
03f6715d 4370 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4371 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4372 l2cap_retransmit_frames(chan);
4ec10d97
GP		 4373 }
4374
c1b4f43b 4375
6a026610
GP		 4376 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4377 if (chan->num_acked == num_to_ack - 1)
525cd185 4378 l2cap_send_ack(chan);
4d611e4d
GP		 4379 else
4380 __set_ack_timer(chan);
9e917af1 4381
8f17154f 4382 return 0;
9b53350d
JPRV		 4383
4384drop:
4385 kfree_skb(skb);
4386 return 0;
1c2acffb
GP		 4387}
4388
88843ab0 4389static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 4390{
88843ab0 4391 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 4392 __get_reqseq(chan, rx_control), rx_control);
0e98958d 4393
0b209fae 4394 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 4395 l2cap_drop_acked_frames(chan);
1c2acffb 4396
e3781735 4397 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 4398 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4399 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4400 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4401 (chan->unacked_frames > 0))
1a09bcb9 4402 __set_retrans_timer(chan);
05fbd89d 4403
e2ab4353 4404 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 4405 l2cap_send_srejtail(chan);
05fbd89d 4406 } else {
525cd185 4407 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 4408 }
1d8f5d16 4409
03f6715d 4410 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4411 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4412
e2ab4353 4413 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4414 l2cap_retransmit_frames(chan);
2246b2f1 4415
e072745f 4416 } else {
e2ab4353 4417 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4418 (chan->unacked_frames > 0))
1a09bcb9 4419 __set_retrans_timer(chan);
1c2acffb 4420
e2ab4353
GP		 4421 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4422 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4423 l2cap_send_ack(chan);
894718a6 4424 else
525cd185 4425 l2cap_ertm_send(chan);
e072745f
GP		 4426 }
4427}
2246b2f1 4428
88843ab0 4429static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4430{
0b209fae 4431 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4432
88843ab0 4433 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4434
e2ab4353 4435 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4436
42e5c802
GP		 4437 chan->expected_ack_seq = tx_seq;
4438 l2cap_drop_acked_frames(chan);
e072745f 4439
03f6715d 4440 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4441 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4442 l2cap_retransmit_frames(chan);
e072745f 4443 } else {
525cd185 4444 l2cap_retransmit_frames(chan);
30afb5b2 4445
e2ab4353
GP		 4446 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4447 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4448 }
4449}
88843ab0 4450static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4451{
0b209fae 4452 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4453
88843ab0 4454 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4455
e2ab4353 4456 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4457
e3781735 4458 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4459 chan->expected_ack_seq = tx_seq;
4460 l2cap_drop_acked_frames(chan);
3cb123d1 4461
e2ab4353 4462 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4463 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4464
525cd185 4465 l2cap_ertm_send(chan);
dfc909be 4466
e2ab4353 4467 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4468 chan->srej_save_reqseq = tx_seq;
e2ab4353 4469 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4470 }
03f6715d 4471 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4472 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4473 chan->srej_save_reqseq == tx_seq)
e2ab4353 4474 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4475 else
525cd185 4476 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4477 } else {
525cd185 4478 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4479 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4480 chan->srej_save_reqseq = tx_seq;
e2ab4353 4481 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4482 }
e072745f
GP		 4483 }
4484}
4485
88843ab0 4486static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4487{
0b209fae 4488 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4489
88843ab0 4490 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4491
e2ab4353 4492 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4493 chan->expected_ack_seq = tx_seq;
4494 l2cap_drop_acked_frames(chan);
e072745f 4495
e3781735 4496 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4497 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4498
e2ab4353 4499 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4500 __clear_retrans_timer(chan);
e3781735 4501 if (__is_ctrl_poll(chan, rx_control))
525cd185 4502 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4503 return;
e072745f 4504 }
99b0d4b7 4505
e3781735 4506 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4507 l2cap_send_srejtail(chan);
ab784b73
AE		 4508 } else {
4509 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4510 l2cap_send_sframe(chan, rx_control);
4511 }
e072745f
GP		 4512}
4513
88843ab0 4514static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4515{
88843ab0 4516 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4517
03f6715d 4518 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4519 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4520 __clear_monitor_timer(chan);
6a026610 4521 if (chan->unacked_frames > 0)
1a09bcb9 4522 __set_retrans_timer(chan);
e2ab4353 4523 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4524 }
4525
ab784b73
AE		 4526 switch (__get_ctrl_super(chan, rx_control)) {
4527 case L2CAP_SUPER_RR:
525cd185 4528 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4529 break;
4530
ab784b73 4531 case L2CAP_SUPER_REJ:
525cd185 4532 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4533 break;
2246b2f1 4534
ab784b73 4535 case L2CAP_SUPER_SREJ:
525cd185 4536 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4537 break;
4538
ab784b73 4539 case L2CAP_SUPER_RNR:
525cd185 4540 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4541 break;
4542 }
4543
faaebd19 4544 kfree_skb(skb);
1c2acffb
GP		 4545 return 0;
4546}
4547
cad8f1d0 4548static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
218bb9df 4549{
88843ab0 4550 u32 control;
0b209fae 4551 u16 req_seq;
218bb9df
GP		 4552 int len, next_tx_seq_offset, req_seq_offset;
4553
b76bbd66
MM		 4554 __unpack_control(chan, skb);
4555
88843ab0
AE		 4556 control = __get_control(chan, skb->data);
4557 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4558 len = skb->len;
4559
4560 /*
4561 * We can just drop the corrupted I-frame here.
4562 * Receiver will miss it and start proper recovery
4563 * procedures and ask retransmission.
4564 */
47d1ec61 4565 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4566 goto drop;
4567
793c2f1c 4568 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4569 len -= L2CAP_SDULEN_SIZE;
218bb9df 4570
47d1ec61 4571 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4572 len -= L2CAP_FCS_SIZE;
218bb9df 4573
47d1ec61 4574 if (len > chan->mps) {
8c1d787b 4575 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4576 goto drop;
4577 }
4578
0b209fae 4579 req_seq = __get_reqseq(chan, control);
218bb9df 4580
836be934
AE		 4581 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4582
4583 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4584 chan->expected_ack_seq);
218bb9df
GP		 4585
4586 /* check for invalid req-seq */
4587 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4588 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4589 goto drop;
4590 }
4591
793c2f1c 4592 if (!__is_sframe(chan, control)) {
218bb9df 4593 if (len < 0) {
8c1d787b 4594 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4595 goto drop;
4596 }
4597
525cd185 4598 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4599 } else {
4600 if (len != 0) {
4601 BT_ERR("%d", len);
8c1d787b 4602 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4603 goto drop;
4604 }
4605
525cd185 4606 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4607 }
4608
4609 return 0;
4610
4611drop:
4612 kfree_skb(skb);
4613 return 0;
4614}
4615
1da177e4
LT		 4616static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4617{
48454079 4618 struct l2cap_chan *chan;
88843ab0 4619 u32 control;
fb45de7d 4620 u16 tx_seq;
218bb9df 4621 int len;
1da177e4 4622
baa7e1fa 4623 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4624 if (!chan) {
1da177e4 4625 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 4626 /* Drop packet and return */
3379013b 4627 kfree_skb(skb);
6be36555 4628 return 0;
1da177e4
LT		 4629 }
4630
6be36555 4631 l2cap_chan_lock(chan);
6840ed07 4632
49208c9c 4633 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4634
89bc500e 4635 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4636 goto drop;
4637
0c1bc5c6 4638 switch (chan->mode) {
1c2acffb
GP		 4639 case L2CAP_MODE_BASIC:
4640 /* If socket recv buffers overflows we drop data here
4641 * which is *bad* because L2CAP has to be reliable.
4642 * But we don't have any other choice. L2CAP doesn't
4643 * provide flow control mechanism. */
1da177e4 4644
0c1bc5c6 4645 if (chan->imtu < skb->len)
1c2acffb 4646 goto drop;
1da177e4 4647
23070494 4648 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4649 goto done;
4650 break;
4651
4652 case L2CAP_MODE_ERTM:
5ef8cb9e 4653 l2cap_ertm_data_rcv(chan, skb);
1c2acffb 4654
fcafde2e 4655 goto done;
1c2acffb 4656
6840ed07 4657 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4658 control = __get_control(chan, skb->data);
4659 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4660 len = skb->len;
4661
47d1ec61 4662 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4663 goto drop;
4664
7e0ef6ee 4665 if (__is_sar_start(chan, control))
03a51213 4666 len -= L2CAP_SDULEN_SIZE;
6840ed07 4667
47d1ec61 4668 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4669 len -= L2CAP_FCS_SIZE;
fcc203c3 4670
793c2f1c 4671 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4672 goto drop;
4673
fb45de7d 4674 tx_seq = __get_txseq(chan, control);
6840ed07 4675
84084a31
MM		 4676 if (chan->expected_tx_seq != tx_seq) {
4677 /* Frame(s) missing - must discard partial SDU */
4678 kfree_skb(chan->sdu);
4679 chan->sdu = NULL;
4680 chan->sdu_last_frag = NULL;
4681 chan->sdu_len = 0;
6840ed07 4682
84084a31
MM		 4683 /* TODO: Notify userland of missing data */
4684 }
4685
836be934 4686 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4687
4688 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4689 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4690
4691 goto done;
4692
1c2acffb 4693 default:
0c1bc5c6 4694 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4695 break;
4696 }
1da177e4
LT		 4697
4698drop:
4699 kfree_skb(skb);
4700
4701done:
6be36555 4702 l2cap_chan_unlock(chan);
0139418c 4703
1da177e4
LT		 4704 return 0;
4705}
4706
8e036fc3 4707static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4708{
23691d75 4709 struct l2cap_chan *chan;
1da177e4 4710
c2287681 4711 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 4712 if (!chan)
1da177e4
LT		 4713 goto drop;
4714
5b4cedaa 4715 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4716
89bc500e 4717 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4718 goto drop;
4719
e13e21dc 4720 if (chan->imtu < skb->len)
1da177e4
LT		 4721 goto drop;
4722
23070494 4723 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4724 return 0;
1da177e4
LT		 4725
4726drop:
4727 kfree_skb(skb);
4728
1da177e4
LT		 4729 return 0;
4730}
4731
d9b88702
AE		 4732static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4733 struct sk_buff *skb)
9f69bda6 4734{
23691d75 4735 struct l2cap_chan *chan;
9f69bda6 4736
c2287681 4737 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 4738 if (!chan)
9f69bda6
GP		 4739 goto drop;
4740
5b4cedaa 4741 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 4742
89bc500e 4743 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4744 goto drop;
4745
e13e21dc 4746 if (chan->imtu < skb->len)
9f69bda6
GP		 4747 goto drop;
4748
23070494 4749 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4750 return 0;
9f69bda6
GP		 4751
4752drop:
4753 kfree_skb(skb);
4754
9f69bda6
GP		 4755 return 0;
4756}
4757
1da177e4
LT		 4758static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4759{
4760 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4761 u16 cid, len;
4762 __le16 psm;
1da177e4
LT		 4763
4764 skb_pull(skb, L2CAP_HDR_SIZE);
4765 cid = __le16_to_cpu(lh->cid);
4766 len = __le16_to_cpu(lh->len);
4767
1c2acffb
GP		 4768 if (len != skb->len) {
4769 kfree_skb(skb);
4770 return;
4771 }
4772
1da177e4
LT		 4773 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4774
4775 switch (cid) {
3300d9a9 4776 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4777 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4778 l2cap_sig_channel(conn, skb);
4779 break;
4780
8db4dc46 4781 case L2CAP_CID_CONN_LESS:
097db76c 4782 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 4783 skb_pull(skb, 2);
4784 l2cap_conless_channel(conn, psm, skb);
4785 break;
4786
9f69bda6
GP		 4787 case L2CAP_CID_LE_DATA:
4788 l2cap_att_channel(conn, cid, skb);
4789 break;
4790
b501d6a1
AB		 4791 case L2CAP_CID_SMP:
4792 if (smp_sig_channel(conn, skb))
4793 l2cap_conn_del(conn->hcon, EACCES);
4794 break;
4795
1da177e4
LT		 4796 default:
4797 l2cap_data_channel(conn, cid, skb);
4798 break;
4799 }
4800}
4801
4802/* ---- L2CAP interface with lower layer (HCI) ---- */
4803
686ebf28 4804int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 4805{
4806 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4807 struct l2cap_chan *c;
1da177e4 4808
1da177e4
LT		 4809 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4810
4811 /* Find listening sockets and check their link_mode */
23691d75
GP		 4812 read_lock(&chan_list_lock);
4813 list_for_each_entry(c, &chan_list, global_l) {
4814 struct sock *sk = c->sk;
4343478f 4815
89bc500e 4816 if (c->state != BT_LISTEN)
1da177e4
LT		 4817 continue;
4818
4819 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4820 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4821 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4822 lm1 |= HCI_LM_MASTER;
1da177e4 4823 exact++;
2af6b9d5
MH		 4824 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4825 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4826 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4827 lm2 |= HCI_LM_MASTER;
4828 }
1da177e4 4829 }
23691d75 4830 read_unlock(&chan_list_lock);
1da177e4
LT		 4831
4832 return exact ? lm1 : lm2;
4833}
4834
686ebf28 4835int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 4836{
0139418c
MH		 4837 struct l2cap_conn *conn;
4838
1da177e4
LT		 4839 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4840
1da177e4 4841 if (!status) {
1da177e4
LT		 4842 conn = l2cap_conn_add(hcon, status);
4843 if (conn)
4844 l2cap_conn_ready(conn);
0139418c 4845 } else
e175072f 4846 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4847
4848 return 0;
4849}
4850
686ebf28 4851int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 4852{
4853 struct l2cap_conn *conn = hcon->l2cap_data;
4854
4855 BT_DBG("hcon %p", hcon);
4856
686ebf28 4857 if (!conn)
9f5a0d7b 4858 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4859 return conn->disc_reason;
4860}
4861
686ebf28 4862int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4863{
4864 BT_DBG("hcon %p reason %d", hcon, reason);
4865
e175072f 4866 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 4867 return 0;
4868}
4869
4343478f 4870static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4871{
715ec005 4872 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4873 return;
4874
f62e4323 4875 if (encrypt == 0x00) {
4343478f 4876 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 4877 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4878 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4879 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4880 } else {
4343478f 4881 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4882 __clear_chan_timer(chan);
f62e4323
MH		 4883 }
4884}
4885
686ebf28 4886int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4887{
0139418c 4888 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4889 struct l2cap_chan *chan;
1da177e4 4890
0139418c 4891 if (!conn)
1da177e4 4892 return 0;
0139418c 4893
1da177e4
LT		 4894 BT_DBG("conn %p", conn);
4895
160dc6ac 4896 if (hcon->type == LE_LINK) {
35d4adcc
HG		 4897 if (!status && encrypt)
4898 smp_distribute_keys(conn, 0);
17cd3f37 4899 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 4900 }
4901
3df91ea2 4902 mutex_lock(&conn->chan_lock);
1da177e4 4903
3df91ea2 4904 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 4905 l2cap_chan_lock(chan);
1da177e4 4906
f1cb9af5
VCG		 4907 BT_DBG("chan->scid %d", chan->scid);
4908
4909 if (chan->scid == L2CAP_CID_LE_DATA) {
4910 if (!status && encrypt) {
4911 chan->sec_level = hcon->sec_level;
cf4cd009 4912 l2cap_chan_ready(chan);
f1cb9af5
VCG		 4913 }
4914
6be36555 4915 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 4916 continue;
4917 }
4918
c1360a1c 4919 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 4920 l2cap_chan_unlock(chan);
6a8d3010
MH		 4921 continue;
4922 }
4923
89bc500e
GP		 4924 if (!status && (chan->state == BT_CONNECTED ||
4925 chan->state == BT_CONFIG)) {
a7d7723a
GP		 4926 struct sock *sk = chan->sk;
4927
4928 bt_sk(sk)->suspended = false;
4929 sk->sk_state_change(sk);
4930
4343478f 4931 l2cap_check_encryption(chan, encrypt);
6be36555 4932 l2cap_chan_unlock(chan);
9719f8af
MH		 4933 continue;
4934 }
4935
89bc500e 4936 if (chan->state == BT_CONNECT) {
b1235d79 4937 if (!status) {
9b27f350 4938 l2cap_send_conn_req(chan);
b1235d79 4939 } else {
ba13ccd9 4940 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4941 }
89bc500e 4942 } else if (chan->state == BT_CONNECT2) {
6be36555 4943 struct sock *sk = chan->sk;
b1235d79 4944 struct l2cap_conn_rsp rsp;
df3c3931 4945 __u16 res, stat;
1da177e4 4946
6be36555
AE		 4947 lock_sock(sk);
4948
b1235d79 4949 if (!status) {
df3c3931
JH		 4950 if (bt_sk(sk)->defer_setup) {
4951 struct sock *parent = bt_sk(sk)->parent;
4952 res = L2CAP_CR_PEND;
4953 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4954 if (parent)
4955 parent->sk_data_ready(parent, 0);
df3c3931 4956 } else {
0e587be7 4957 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4958 res = L2CAP_CR_SUCCESS;
4959 stat = L2CAP_CS_NO_INFO;
4960 }
b1235d79 4961 } else {
0e587be7 4962 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 4963 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4964 res = L2CAP_CR_SEC_BLOCK;
4965 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4966 }
4967
6be36555
AE		 4968 release_sock(sk);
4969
fe4128e0
GP		 4970 rsp.scid = cpu_to_le16(chan->dcid);
4971 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4972 rsp.result = cpu_to_le16(res);
4973 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4974 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4975 sizeof(rsp), &rsp);
b1235d79 4976 }
1da177e4 4977
6be36555 4978 l2cap_chan_unlock(chan);
1da177e4
LT		 4979 }
4980
3df91ea2 4981 mutex_unlock(&conn->chan_lock);
b1235d79 4982
1da177e4
LT		 4983 return 0;
4984}
4985
686ebf28 4986int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 4987{
4988 struct l2cap_conn *conn = hcon->l2cap_data;
4989
5a08ecce
AE		 4990 if (!conn)
4991 conn = l2cap_conn_add(hcon, 0);
4992
4993 if (!conn)
1da177e4
LT		 4994 goto drop;
4995
4996 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4997
e702112f 4998 if (!(flags & ACL_CONT)) {
1da177e4 4999 struct l2cap_hdr *hdr;
48454079 5000 struct l2cap_chan *chan;
89794813 5001 u16 cid;
1da177e4
LT		 5002 int len;
5003
5004 if (conn->rx_len) {
5005 BT_ERR("Unexpected start frame (len %d)", skb->len);
5006 kfree_skb(conn->rx_skb);
5007 conn->rx_skb = NULL;
5008 conn->rx_len = 0;
5009 l2cap_conn_unreliable(conn, ECOMM);
5010 }
5011
aae7fe22
AE		 5012 /* Start fragment always begin with Basic L2CAP header */
5013 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 5014 BT_ERR("Frame is too short (len %d)", skb->len);
5015 l2cap_conn_unreliable(conn, ECOMM);
5016 goto drop;
5017 }
5018
5019 hdr = (struct l2cap_hdr *) skb->data;
5020 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 5021 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 5022
5023 if (len == skb->len) {
5024 /* Complete frame received */
5025 l2cap_recv_frame(conn, skb);
5026 return 0;
5027 }
5028
5029 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
5030
5031 if (skb->len > len) {
5032 BT_ERR("Frame is too long (len %d, expected len %d)",
5033 skb->len, len);
5034 l2cap_conn_unreliable(conn, ECOMM);
5035 goto drop;
5036 }
5037
baa7e1fa 5038 chan = l2cap_get_chan_by_scid(conn, cid);
89794813 5039
48454079
GP		 5040 if (chan && chan->sk) {
5041 struct sock *sk = chan->sk;
3df91ea2 5042 lock_sock(sk);
89794813 5043
0c1bc5c6 5044 if (chan->imtu < len - L2CAP_HDR_SIZE) {
48454079
GP		 5045 BT_ERR("Frame exceeding recv MTU (len %d, "
5046 "MTU %d)", len,
0c1bc5c6 5047 chan->imtu);
aa2ac881 5048 release_sock(sk);
48454079
GP		 5049 l2cap_conn_unreliable(conn, ECOMM);
5050 goto drop;
5051 }
aa2ac881 5052 release_sock(sk);
48454079 5053 }
89794813 5054
1da177e4 5055 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 5056 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
5057 if (!conn->rx_skb)
1da177e4
LT		 5058 goto drop;
5059
d626f62b 5060 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5061 skb->len);
1da177e4
LT		 5062 conn->rx_len = len - skb->len;
5063 } else {
5064 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5065
5066 if (!conn->rx_len) {
5067 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5068 l2cap_conn_unreliable(conn, ECOMM);
5069 goto drop;
5070 }
5071
5072 if (skb->len > conn->rx_len) {
5073 BT_ERR("Fragment is too long (len %d, expected %d)",
5074 skb->len, conn->rx_len);
5075 kfree_skb(conn->rx_skb);
5076 conn->rx_skb = NULL;
5077 conn->rx_len = 0;
5078 l2cap_conn_unreliable(conn, ECOMM);
5079 goto drop;
5080 }
5081
d626f62b 5082 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5083 skb->len);
1da177e4
LT		 5084 conn->rx_len -= skb->len;
5085
5086 if (!conn->rx_len) {
5087 /* Complete frame received */
5088 l2cap_recv_frame(conn, conn->rx_skb);
5089 conn->rx_skb = NULL;
5090 }
5091 }
5092
5093drop:
5094 kfree_skb(skb);
5095 return 0;
5096}
5097
aef7d97c 5098static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5099{
23691d75 5100 struct l2cap_chan *c;
1da177e4 5101
333055f2 5102 read_lock(&chan_list_lock);
1da177e4 5103
23691d75
GP		 5104 list_for_each_entry(c, &chan_list, global_l) {
5105 struct sock *sk = c->sk;
101545f6 5106
903d343e 5107 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 5108 batostr(&bt_sk(sk)->src),
5109 batostr(&bt_sk(sk)->dst),
89bc500e 5110 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 5111 c->scid, c->dcid, c->imtu, c->omtu,
5112 c->sec_level, c->mode);
61e1b4b7 5113 }
1da177e4 5114
333055f2 5115 read_unlock(&chan_list_lock);
1da177e4 5116
aef7d97c 5117 return 0;
1da177e4
LT		 5118}
5119
aef7d97c
MH		 5120static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5121{
5122 return single_open(file, l2cap_debugfs_show, inode->i_private);
5123}
5124
5125static const struct file_operations l2cap_debugfs_fops = {
5126 .open = l2cap_debugfs_open,
5127 .read = seq_read,
5128 .llseek = seq_lseek,
5129 .release = single_release,
5130};
5131
5132static struct dentry *l2cap_debugfs;
1da177e4 5133
64274518 5134int __init l2cap_init(void)
1da177e4
LT		 5135{
5136 int err;
be9d1227 5137
bb58f747 5138 err = l2cap_init_sockets();
1da177e4
LT		 5139 if (err < 0)
5140 return err;
5141
aef7d97c
MH		 5142 if (bt_debugfs) {
5143 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5144 bt_debugfs, NULL, &l2cap_debugfs_fops);
5145 if (!l2cap_debugfs)
5146 BT_ERR("Failed to create L2CAP debug file");
5147 }
1da177e4 5148
1da177e4 5149 return 0;
1da177e4
LT		 5150}
5151
64274518 5152void l2cap_exit(void)
1da177e4 5153{
aef7d97c 5154 debugfs_remove(l2cap_debugfs);
bb58f747 5155 l2cap_cleanup_sockets();
1da177e4
LT		 5156}
5157
d1c4a17d
GP		 5158module_param(disable_ertm, bool, 0644);
5159MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)