projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add LE signaling commands handling
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
1da177e4
LT		 6
7 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License version 2 as
11 published by the Free Software Foundation;
12
13 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
14 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
16 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 17 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
18 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 20 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21
8e87d142
YH		 22 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
23 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 24 SOFTWARE IS DISCLAIMED.
25*/
26
bb58f747 27/* Bluetooth L2CAP core. */
1da177e4 28
1da177e4
LT		 29#include <linux/module.h>
30
31#include <linux/types.h>
4fc268d2 32#include <linux/capability.h>
1da177e4
LT		 33#include <linux/errno.h>
34#include <linux/kernel.h>
1da177e4
LT		 35#include <linux/sched.h>
36#include <linux/slab.h>
37#include <linux/poll.h>
38#include <linux/fcntl.h>
39#include <linux/init.h>
40#include <linux/interrupt.h>
41#include <linux/socket.h>
42#include <linux/skbuff.h>
1da177e4 43#include <linux/list.h>
be9d1227 44#include <linux/device.h>
aef7d97c
MH		 45#include <linux/debugfs.h>
46#include <linux/seq_file.h>
af05b30b 47#include <linux/uaccess.h>
fcc203c3 48#include <linux/crc16.h>
1da177e4
LT		 49#include <net/sock.h>
50
51#include <asm/system.h>
1da177e4
LT		 52#include <asm/unaligned.h>
53
54#include <net/bluetooth/bluetooth.h>
55#include <net/bluetooth/hci_core.h>
56#include <net/bluetooth/l2cap.h>
57
bb58f747 58int disable_ertm;
f0709e03 59
47ec1dcd 60static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
e1027a7c 61static u8 l2cap_fixed_chan[8] = { 0x02, };
1da177e4 62
1890d36b
GP		 63static struct workqueue_struct *_busy_wq;
64
bb58f747 65struct bt_sock_list l2cap_sk_list = {
d5fb2962 66 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
1da177e4
LT		 67};
68
1890d36b
GP		 69static void l2cap_busy_work(struct work_struct *work);
70
1da177e4
LT		 71static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
72 u8 code, u8 ident, u16 dlen, void *data);
73
218bb9df
GP		 74static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
75
0139418c
MH		 76/* ---- L2CAP channels ---- */
77static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
78{
79 struct sock *s;
80 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
81 if (l2cap_pi(s)->dcid == cid)
82 break;
83 }
84 return s;
85}
86
87static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
88{
89 struct sock *s;
90 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
91 if (l2cap_pi(s)->scid == cid)
92 break;
93 }
94 return s;
95}
96
97/* Find channel with given SCID.
98 * Returns locked socket */
99static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
100{
101 struct sock *s;
102 read_lock(&l->lock);
103 s = __l2cap_get_chan_by_scid(l, cid);
af05b30b
GP		 104 if (s)
105 bh_lock_sock(s);
0139418c
MH		 106 read_unlock(&l->lock);
107 return s;
108}
109
110static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
111{
112 struct sock *s;
113 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
114 if (l2cap_pi(s)->ident == ident)
115 break;
116 }
117 return s;
118}
119
120static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
121{
122 struct sock *s;
123 read_lock(&l->lock);
124 s = __l2cap_get_chan_by_ident(l, ident);
af05b30b
GP		 125 if (s)
126 bh_lock_sock(s);
0139418c
MH		 127 read_unlock(&l->lock);
128 return s;
129}
130
131static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
132{
8db4dc46 133 u16 cid = L2CAP_CID_DYN_START;
0139418c 134
8db4dc46 135 for (; cid < L2CAP_CID_DYN_END; cid++) {
af05b30b 136 if (!__l2cap_get_chan_by_scid(l, cid))
0139418c
MH		 137 return cid;
138 }
139
140 return 0;
141}
142
143static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
144{
145 sock_hold(sk);
146
147 if (l->head)
148 l2cap_pi(l->head)->prev_c = sk;
149
150 l2cap_pi(sk)->next_c = l->head;
151 l2cap_pi(sk)->prev_c = NULL;
152 l->head = sk;
153}
154
155static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
156{
157 struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
158
fd1278d7 159 write_lock_bh(&l->lock);
0139418c
MH		 160 if (sk == l->head)
161 l->head = next;
162
163 if (next)
164 l2cap_pi(next)->prev_c = prev;
165 if (prev)
166 l2cap_pi(prev)->next_c = next;
fd1278d7 167 write_unlock_bh(&l->lock);
0139418c
MH		 168
169 __sock_put(sk);
170}
171
172static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
173{
174 struct l2cap_chan_list *l = &conn->chan_list;
175
af05b30b
GP		 176 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
177 l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
0139418c 178
2950f21a
MH		 179 conn->disc_reason = 0x13;
180
0139418c
MH		 181 l2cap_pi(sk)->conn = conn;
182
bd3c9e25 183 if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
b62f328b
VT		 184 if (conn->hcon->type == LE_LINK) {
185 /* LE connection */
186 l2cap_pi(sk)->omtu = L2CAP_LE_DEFAULT_MTU;
187 l2cap_pi(sk)->scid = L2CAP_CID_LE_DATA;
188 l2cap_pi(sk)->dcid = L2CAP_CID_LE_DATA;
189 } else {
190 /* Alloc CID for connection-oriented socket */
191 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
192 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
193 }
0139418c
MH		 194 } else if (sk->sk_type == SOCK_DGRAM) {
195 /* Connectionless socket */
8db4dc46
GP		 196 l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
197 l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
0139418c
MH		 198 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
199 } else {
200 /* Raw socket can send/recv signalling messages only */
8db4dc46
GP		 201 l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
202 l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
0139418c
MH		 203 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
204 }
205
206 __l2cap_chan_link(l, sk);
207
208 if (parent)
209 bt_accept_enqueue(parent, sk);
210}
211
8e87d142 212/* Delete channel.
0139418c 213 * Must be called on the locked socket. */
6de0702b 214void l2cap_chan_del(struct sock *sk, int err)
0139418c
MH		 215{
216 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
217 struct sock *parent = bt_sk(sk)->parent;
218
219 l2cap_sock_clear_timer(sk);
220
221 BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
222
8e87d142 223 if (conn) {
0139418c
MH		 224 /* Unlink from channel list */
225 l2cap_chan_unlink(&conn->chan_list, sk);
226 l2cap_pi(sk)->conn = NULL;
227 hci_conn_put(conn->hcon);
228 }
229
b1235d79 230 sk->sk_state = BT_CLOSED;
0139418c
MH		 231 sock_set_flag(sk, SOCK_ZAPPED);
232
233 if (err)
234 sk->sk_err = err;
235
236 if (parent) {
237 bt_accept_unlink(sk);
238 parent->sk_data_ready(parent, 0);
239 } else
240 sk->sk_state_change(sk);
c13ffa62
GP		 241
242 skb_queue_purge(TX_QUEUE(sk));
243
244 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
245 struct srej_list *l, *tmp;
246
247 del_timer(&l2cap_pi(sk)->retrans_timer);
248 del_timer(&l2cap_pi(sk)->monitor_timer);
249 del_timer(&l2cap_pi(sk)->ack_timer);
250
251 skb_queue_purge(SREJ_QUEUE(sk));
252 skb_queue_purge(BUSY_QUEUE(sk));
253
254 list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
255 list_del(&l->list);
256 kfree(l);
257 }
258 }
0139418c
MH		 259}
260
8556edd3 261static inline u8 l2cap_get_auth_type(struct sock *sk)
79d554a6 262{
8556edd3
JH		 263 if (sk->sk_type == SOCK_RAW) {
264 switch (l2cap_pi(sk)->sec_level) {
265 case BT_SECURITY_HIGH:
266 return HCI_AT_DEDICATED_BONDING_MITM;
267 case BT_SECURITY_MEDIUM:
268 return HCI_AT_DEDICATED_BONDING;
269 default:
270 return HCI_AT_NO_BONDING;
271 }
272 } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
273 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
274 l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
0684e5f9 275
00ae4af9 276 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
8556edd3 277 return HCI_AT_NO_BONDING_MITM;
00ae4af9 278 else
8556edd3 279 return HCI_AT_NO_BONDING;
00ae4af9
MH		 280 } else {
281 switch (l2cap_pi(sk)->sec_level) {
282 case BT_SECURITY_HIGH:
8556edd3 283 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 284 case BT_SECURITY_MEDIUM:
8556edd3 285 return HCI_AT_GENERAL_BONDING;
00ae4af9 286 default:
8556edd3 287 return HCI_AT_NO_BONDING;
00ae4af9 288 }
0684e5f9 289 }
8556edd3
JH		 290}
291
292/* Service level security */
293static inline int l2cap_check_security(struct sock *sk)
294{
295 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
296 __u8 auth_type;
297
298 auth_type = l2cap_get_auth_type(sk);
79d554a6 299
0684e5f9
MH		 300 return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
301 auth_type);
79d554a6
MH		 302}
303
68983259 304u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 305{
306 u8 id;
307
308 /* Get next available identificator.
309 * 1 - 128 are used by kernel.
310 * 129 - 199 are reserved.
311 * 200 - 254 are used by utilities like l2ping, etc.
312 */
313
314 spin_lock_bh(&conn->lock);
315
316 if (++conn->tx_ident > 128)
317 conn->tx_ident = 1;
318
319 id = conn->tx_ident;
320
321 spin_unlock_bh(&conn->lock);
322
323 return id;
324}
325
68983259 326void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 327{
328 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 329 u8 flags;
4e8402a3
MH		 330
331 BT_DBG("code 0x%2.2x", code);
332
333 if (!skb)
9a9c6a34 334 return;
4e8402a3 335
e702112f
AE		 336 if (lmp_no_flush_capable(conn->hcon->hdev))
337 flags = ACL_START_NO_FLUSH;
338 else
339 flags = ACL_START;
340
341 hci_send_acl(conn->hcon, skb, flags);
4e8402a3
MH		 342}
343
9a9c6a34 344static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
1c2acffb
GP		 345{
346 struct sk_buff *skb;
347 struct l2cap_hdr *lh;
348 struct l2cap_conn *conn = pi->conn;
c13ffa62 349 struct sock *sk = (struct sock *)pi;
fcc203c3 350 int count, hlen = L2CAP_HDR_SIZE + 2;
e702112f 351 u8 flags;
fcc203c3 352
c13ffa62
GP		 353 if (sk->sk_state != BT_CONNECTED)
354 return;
355
fcc203c3
GP		 356 if (pi->fcs == L2CAP_FCS_CRC16)
357 hlen += 2;
1c2acffb
GP		 358
359 BT_DBG("pi %p, control 0x%2.2x", pi, control);
360
fcc203c3 361 count = min_t(unsigned int, conn->mtu, hlen);
1c2acffb
GP		 362 control |= L2CAP_CTRL_FRAME_TYPE;
363
9e917af1
GP		 364 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
365 control |= L2CAP_CTRL_FINAL;
366 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
367 }
368
f0946ccf
GP		 369 if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
370 control |= L2CAP_CTRL_POLL;
371 pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
372 }
373
1c2acffb
GP		 374 skb = bt_skb_alloc(count, GFP_ATOMIC);
375 if (!skb)
9a9c6a34 376 return;
1c2acffb
GP		 377
378 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fcc203c3 379 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1c2acffb
GP		 380 lh->cid = cpu_to_le16(pi->dcid);
381 put_unaligned_le16(control, skb_put(skb, 2));
382
fcc203c3
GP		 383 if (pi->fcs == L2CAP_FCS_CRC16) {
384 u16 fcs = crc16(0, (u8 *)lh, count - 2);
385 put_unaligned_le16(fcs, skb_put(skb, 2));
386 }
387
e702112f
AE		 388 if (lmp_no_flush_capable(conn->hcon->hdev))
389 flags = ACL_START_NO_FLUSH;
390 else
391 flags = ACL_START;
392
393 hci_send_acl(pi->conn->hcon, skb, flags);
1c2acffb
GP		 394}
395
9a9c6a34 396static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
7e743090 397{
1890d36b 398 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
7e743090 399 control |= L2CAP_SUPER_RCV_NOT_READY;
1890d36b
GP		 400 pi->conn_state |= L2CAP_CONN_RNR_SENT;
401 } else
7e743090
GP		 402 control |= L2CAP_SUPER_RCV_READY;
403
2ab25cdd
GP		 404 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
405
9a9c6a34 406 l2cap_send_sframe(pi, control);
7e743090
GP		 407}
408
e501d055
AE		 409static inline int __l2cap_no_conn_pending(struct sock *sk)
410{
411 return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
412}
413
79d554a6
MH		 414static void l2cap_do_start(struct sock *sk)
415{
416 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
417
418 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 419 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
420 return;
421
e501d055 422 if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
b1235d79
MH		 423 struct l2cap_conn_req req;
424 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
425 req.psm = l2cap_pi(sk)->psm;
79d554a6 426
b1235d79 427 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
e501d055 428 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
79d554a6 429
b1235d79 430 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
79d554a6 431 L2CAP_CONN_REQ, sizeof(req), &req);
b1235d79 432 }
79d554a6
MH		 433 } else {
434 struct l2cap_info_req req;
435 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
436
437 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
438 conn->info_ident = l2cap_get_ident(conn);
439
440 mod_timer(&conn->info_timer, jiffies +
441 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
442
443 l2cap_send_cmd(conn, conn->info_ident,
444 L2CAP_INFO_REQ, sizeof(req), &req);
445 }
446}
447
cf6c2c0b
GP		 448static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
449{
450 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 451 if (!disable_ertm)
cf6c2c0b
GP		 452 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
453
454 switch (mode) {
455 case L2CAP_MODE_ERTM:
456 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
457 case L2CAP_MODE_STREAMING:
458 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
459 default:
460 return 0x00;
461 }
462}
463
6de0702b 464void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err)
22121fc9
GP		 465{
466 struct l2cap_disconn_req req;
467
c13ffa62
GP		 468 if (!conn)
469 return;
470
471 skb_queue_purge(TX_QUEUE(sk));
472
473 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
474 del_timer(&l2cap_pi(sk)->retrans_timer);
475 del_timer(&l2cap_pi(sk)->monitor_timer);
476 del_timer(&l2cap_pi(sk)->ack_timer);
477 }
478
22121fc9
GP		 479 req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
480 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
481 l2cap_send_cmd(conn, l2cap_get_ident(conn),
482 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62
GP		 483
484 sk->sk_state = BT_DISCONN;
9b108fc0 485 sk->sk_err = err;
22121fc9
GP		 486}
487
1da177e4 488/* ---- L2CAP connections ---- */
4e8402a3
MH		 489static void l2cap_conn_start(struct l2cap_conn *conn)
490{
491 struct l2cap_chan_list *l = &conn->chan_list;
cf6c2c0b 492 struct sock_del_list del, *tmp1, *tmp2;
4e8402a3
MH		 493 struct sock *sk;
494
495 BT_DBG("conn %p", conn);
496
cf6c2c0b
GP		 497 INIT_LIST_HEAD(&del.list);
498
4e8402a3
MH		 499 read_lock(&l->lock);
500
501 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
502 bh_lock_sock(sk);
503
bd3c9e25
GP		 504 if (sk->sk_type != SOCK_SEQPACKET &&
505 sk->sk_type != SOCK_STREAM) {
79d554a6
MH		 506 bh_unlock_sock(sk);
507 continue;
508 }
509
510 if (sk->sk_state == BT_CONNECT) {
47731de7 511 struct l2cap_conn_req req;
79d554a6 512
47731de7
GP		 513 if (!l2cap_check_security(sk) ||
514 !__l2cap_no_conn_pending(sk)) {
515 bh_unlock_sock(sk);
516 continue;
517 }
79d554a6 518
47731de7
GP		 519 if (!l2cap_mode_supported(l2cap_pi(sk)->mode,
520 conn->feat_mask)
521 && l2cap_pi(sk)->conf_state &
522 L2CAP_CONF_STATE2_DEVICE) {
523 tmp1 = kzalloc(sizeof(struct sock_del_list),
524 GFP_ATOMIC);
525 tmp1->sk = sk;
526 list_add_tail(&tmp1->list, &del.list);
527 bh_unlock_sock(sk);
528 continue;
b1235d79 529 }
47731de7
GP		 530
531 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
532 req.psm = l2cap_pi(sk)->psm;
533
534 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
535 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
536
537 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
538 L2CAP_CONN_REQ, sizeof(req), &req);
539
79d554a6
MH		 540 } else if (sk->sk_state == BT_CONNECT2) {
541 struct l2cap_conn_rsp rsp;
e9aeb2dd 542 char buf[128];
79d554a6
MH		 543 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
544 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
545
2af6b9d5 546 if (l2cap_check_security(sk)) {
f66dc81f
MH		 547 if (bt_sk(sk)->defer_setup) {
548 struct sock *parent = bt_sk(sk)->parent;
549 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
550 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
551 parent->sk_data_ready(parent, 0);
552
553 } else {
554 sk->sk_state = BT_CONFIG;
555 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
556 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
557 }
79d554a6
MH		 558 } else {
559 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
560 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
561 }
562
563 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
564 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
e9aeb2dd
GP		 565
566 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT ||
567 rsp.result != L2CAP_CR_SUCCESS) {
568 bh_unlock_sock(sk);
569 continue;
570 }
571
572 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
573 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
574 l2cap_build_conf_req(sk, buf), buf);
575 l2cap_pi(sk)->num_conf_req++;
4e8402a3
MH		 576 }
577
578 bh_unlock_sock(sk);
579 }
580
581 read_unlock(&l->lock);
cf6c2c0b
GP		 582
583 list_for_each_entry_safe(tmp1, tmp2, &del.list, list) {
584 bh_lock_sock(tmp1->sk);
585 __l2cap_sock_close(tmp1->sk, ECONNRESET);
586 bh_unlock_sock(tmp1->sk);
587 list_del(&tmp1->list);
588 kfree(tmp1);
589 }
4e8402a3
MH		 590}
591
b62f328b
VT		 592/* Find socket with cid and source bdaddr.
593 * Returns closest match, locked.
594 */
595static struct sock *l2cap_get_sock_by_scid(int state, __le16 cid, bdaddr_t *src)
596{
597 struct sock *s, *sk = NULL, *sk1 = NULL;
598 struct hlist_node *node;
599
600 read_lock(&l2cap_sk_list.lock);
601
602 sk_for_each(sk, node, &l2cap_sk_list.head) {
603 if (state && sk->sk_state != state)
604 continue;
605
606 if (l2cap_pi(sk)->scid == cid) {
607 /* Exact match. */
608 if (!bacmp(&bt_sk(sk)->src, src))
609 break;
610
611 /* Closest match */
612 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
613 sk1 = sk;
614 }
615 }
616 s = node ? sk : sk1;
617 if (s)
618 bh_lock_sock(s);
619 read_unlock(&l2cap_sk_list.lock);
620
621 return s;
622}
623
624static void l2cap_le_conn_ready(struct l2cap_conn *conn)
625{
626 struct l2cap_chan_list *list = &conn->chan_list;
627 struct sock *parent, *uninitialized_var(sk);
628
629 BT_DBG("");
630
631 /* Check if we have socket listening on cid */
632 parent = l2cap_get_sock_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
633 conn->src);
634 if (!parent)
635 return;
636
637 /* Check for backlog size */
638 if (sk_acceptq_is_full(parent)) {
639 BT_DBG("backlog full %d", parent->sk_ack_backlog);
640 goto clean;
641 }
642
643 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
644 if (!sk)
645 goto clean;
646
647 write_lock_bh(&list->lock);
648
649 hci_conn_hold(conn->hcon);
650
651 l2cap_sock_init(sk, parent);
652 bacpy(&bt_sk(sk)->src, conn->src);
653 bacpy(&bt_sk(sk)->dst, conn->dst);
654
655 __l2cap_chan_add(conn, sk, parent);
656
657 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
658
659 sk->sk_state = BT_CONNECTED;
660 parent->sk_data_ready(parent, 0);
661
662 write_unlock_bh(&list->lock);
663
664clean:
665 bh_unlock_sock(parent);
666}
667
4e8402a3
MH		 668static void l2cap_conn_ready(struct l2cap_conn *conn)
669{
79d554a6
MH		 670 struct l2cap_chan_list *l = &conn->chan_list;
671 struct sock *sk;
4e8402a3 672
79d554a6 673 BT_DBG("conn %p", conn);
4e8402a3 674
b62f328b
VT		 675 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
676 l2cap_le_conn_ready(conn);
677
79d554a6 678 read_lock(&l->lock);
4e8402a3 679
79d554a6
MH		 680 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
681 bh_lock_sock(sk);
4e8402a3 682
acd7d370
VT		 683 if (conn->hcon->type == LE_LINK) {
684 l2cap_sock_clear_timer(sk);
685 sk->sk_state = BT_CONNECTED;
686 sk->sk_state_change(sk);
687 }
688
bd3c9e25
GP		 689 if (sk->sk_type != SOCK_SEQPACKET &&
690 sk->sk_type != SOCK_STREAM) {
79d554a6
MH		 691 l2cap_sock_clear_timer(sk);
692 sk->sk_state = BT_CONNECTED;
693 sk->sk_state_change(sk);
694 } else if (sk->sk_state == BT_CONNECT)
695 l2cap_do_start(sk);
4e8402a3 696
79d554a6 697 bh_unlock_sock(sk);
4e8402a3 698 }
79d554a6
MH		 699
700 read_unlock(&l->lock);
4e8402a3
MH		 701}
702
703/* Notify sockets that we cannot guaranty reliability anymore */
704static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
705{
706 struct l2cap_chan_list *l = &conn->chan_list;
707 struct sock *sk;
708
709 BT_DBG("conn %p", conn);
710
711 read_lock(&l->lock);
712
713 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2af6b9d5 714 if (l2cap_pi(sk)->force_reliable)
4e8402a3
MH		 715 sk->sk_err = err;
716 }
717
718 read_unlock(&l->lock);
719}
720
721static void l2cap_info_timeout(unsigned long arg)
722{
723 struct l2cap_conn *conn = (void *) arg;
724
984947dc 725 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 726 conn->info_ident = 0;
984947dc 727
4e8402a3
MH		 728 l2cap_conn_start(conn);
729}
730
1da177e4
LT		 731static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
732{
0139418c 733 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4 734
0139418c 735 if (conn || status)
1da177e4
LT		 736 return conn;
737
0139418c
MH		 738 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
739 if (!conn)
1da177e4 740 return NULL;
1da177e4
LT		 741
742 hcon->l2cap_data = conn;
743 conn->hcon = hcon;
744
0139418c
MH		 745 BT_DBG("hcon %p conn %p", hcon, conn);
746
acd7d370
VT		 747 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
748 conn->mtu = hcon->hdev->le_mtu;
749 else
750 conn->mtu = hcon->hdev->acl_mtu;
751
1da177e4
LT		 752 conn->src = &hcon->hdev->bdaddr;
753 conn->dst = &hcon->dst;
754
4e8402a3
MH		 755 conn->feat_mask = 0;
756
1da177e4
LT		 757 spin_lock_init(&conn->lock);
758 rwlock_init(&conn->chan_list.lock);
759
b62f328b
VT		 760 if (hcon->type != LE_LINK)
761 setup_timer(&conn->info_timer, l2cap_info_timeout,
45054dc1
DY		 762 (unsigned long) conn);
763
2950f21a
MH		 764 conn->disc_reason = 0x13;
765
1da177e4
LT		 766 return conn;
767}
768
0139418c 769static void l2cap_conn_del(struct hci_conn *hcon, int err)
1da177e4 770{
0139418c 771 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4
LT		 772 struct sock *sk;
773
0139418c
MH		 774 if (!conn)
775 return;
1da177e4
LT		 776
777 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
778
7585b97a 779 kfree_skb(conn->rx_skb);
1da177e4
LT		 780
781 /* Kill channels */
782 while ((sk = conn->chan_list.head)) {
783 bh_lock_sock(sk);
784 l2cap_chan_del(sk, err);
785 bh_unlock_sock(sk);
786 l2cap_sock_kill(sk);
787 }
788
8e8440f5
DY		 789 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
790 del_timer_sync(&conn->info_timer);
3ab22731 791
1da177e4
LT		 792 hcon->l2cap_data = NULL;
793 kfree(conn);
1da177e4
LT		 794}
795
796static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
797{
798 struct l2cap_chan_list *l = &conn->chan_list;
fd1278d7 799 write_lock_bh(&l->lock);
1da177e4 800 __l2cap_chan_add(conn, sk, parent);
fd1278d7 801 write_unlock_bh(&l->lock);
1da177e4
LT		 802}
803
1da177e4 804/* ---- Socket interface ---- */
1da177e4
LT		 805
806/* Find socket with psm and source bdaddr.
807 * Returns closest match.
808 */
e0f0cb56 809static struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4
LT		 810{
811 struct sock *sk = NULL, *sk1 = NULL;
812 struct hlist_node *node;
813
e0f0cb56
GP		 814 read_lock(&l2cap_sk_list.lock);
815
1da177e4
LT		 816 sk_for_each(sk, node, &l2cap_sk_list.head) {
817 if (state && sk->sk_state != state)
818 continue;
819
820 if (l2cap_pi(sk)->psm == psm) {
821 /* Exact match. */
822 if (!bacmp(&bt_sk(sk)->src, src))
823 break;
824
825 /* Closest match */
826 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
827 sk1 = sk;
828 }
829 }
1da177e4 830
1da177e4 831 read_unlock(&l2cap_sk_list.lock);
e0f0cb56
GP		 832
833 return node ? sk : sk1;
1da177e4
LT		 834}
835
4e34c50b 836int l2cap_do_connect(struct sock *sk)
1da177e4
LT		 837{
838 bdaddr_t *src = &bt_sk(sk)->src;
839 bdaddr_t *dst = &bt_sk(sk)->dst;
840 struct l2cap_conn *conn;
841 struct hci_conn *hcon;
842 struct hci_dev *hdev;
09ab6f4c 843 __u8 auth_type;
44d0e48e 844 int err;
1da177e4 845
f29972de
MH		 846 BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
847 l2cap_pi(sk)->psm);
1da177e4 848
af05b30b
GP		 849 hdev = hci_get_route(dst, src);
850 if (!hdev)
1da177e4
LT		 851 return -EHOSTUNREACH;
852
853 hci_dev_lock_bh(hdev);
854
855 err = -ENOMEM;
856
8556edd3 857 auth_type = l2cap_get_auth_type(sk);
09ab6f4c 858
acd7d370
VT		 859 if (l2cap_pi(sk)->dcid == L2CAP_CID_LE_DATA)
860 hcon = hci_connect(hdev, LE_LINK, dst,
2af6b9d5 861 l2cap_pi(sk)->sec_level, auth_type);
acd7d370
VT		 862 else
863 hcon = hci_connect(hdev, ACL_LINK, dst,
864 l2cap_pi(sk)->sec_level, auth_type);
865
1da177e4
LT		 866 if (!hcon)
867 goto done;
868
869 conn = l2cap_conn_add(hcon, 0);
870 if (!conn) {
871 hci_conn_put(hcon);
872 goto done;
873 }
874
875 err = 0;
876
877 /* Update source addr of the socket */
878 bacpy(src, conn->src);
879
880 l2cap_chan_add(conn, sk, NULL);
881
882 sk->sk_state = BT_CONNECT;
883 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
884
885 if (hcon->state == BT_CONNECTED) {
bd3c9e25
GP		 886 if (sk->sk_type != SOCK_SEQPACKET &&
887 sk->sk_type != SOCK_STREAM) {
1da177e4 888 l2cap_sock_clear_timer(sk);
d00ef24f
JH		 889 if (l2cap_check_security(sk))
890 sk->sk_state = BT_CONNECTED;
79d554a6
MH		 891 } else
892 l2cap_do_start(sk);
1da177e4
LT		 893 }
894
895done:
896 hci_dev_unlock_bh(hdev);
897 hci_dev_put(hdev);
898 return err;
899}
900
dcba0dba 901int __l2cap_wait_ack(struct sock *sk)
6161c038
GP		 902{
903 DECLARE_WAITQUEUE(wait, current);
904 int err = 0;
905 int timeo = HZ/5;
906
2b0b05dd 907 add_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 908 while ((l2cap_pi(sk)->unacked_frames > 0 && l2cap_pi(sk)->conn)) {
909 set_current_state(TASK_INTERRUPTIBLE);
910
911 if (!timeo)
912 timeo = HZ/5;
913
914 if (signal_pending(current)) {
915 err = sock_intr_errno(timeo);
916 break;
917 }
918
919 release_sock(sk);
920 timeo = schedule_timeout(timeo);
921 lock_sock(sk);
922
923 err = sock_error(sk);
924 if (err)
925 break;
926 }
927 set_current_state(TASK_RUNNING);
2b0b05dd 928 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 929 return err;
930}
931
e90bac06
GP		 932static void l2cap_monitor_timeout(unsigned long arg)
933{
934 struct sock *sk = (void *) arg;
e90bac06 935
0e98958d
GP		 936 BT_DBG("sk %p", sk);
937
e686219a 938 bh_lock_sock(sk);
e90bac06 939 if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
9b108fc0 940 l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk, ECONNABORTED);
b13f5860 941 bh_unlock_sock(sk);
e90bac06
GP		 942 return;
943 }
944
945 l2cap_pi(sk)->retry_count++;
946 __mod_monitor_timer();
947
a2e12a2a 948 l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
e686219a 949 bh_unlock_sock(sk);
e90bac06
GP		 950}
951
952static void l2cap_retrans_timeout(unsigned long arg)
953{
954 struct sock *sk = (void *) arg;
e90bac06 955
0e98958d
GP		 956 BT_DBG("sk %p", sk);
957
e686219a 958 bh_lock_sock(sk);
e90bac06
GP		 959 l2cap_pi(sk)->retry_count = 1;
960 __mod_monitor_timer();
961
962 l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
963
a2e12a2a 964 l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
e686219a 965 bh_unlock_sock(sk);
e90bac06
GP		 966}
967
1c2acffb 968static void l2cap_drop_acked_frames(struct sock *sk)
1da177e4 969{
1c2acffb 970 struct sk_buff *skb;
1da177e4 971
812e737e
GP		 972 while ((skb = skb_peek(TX_QUEUE(sk))) &&
973 l2cap_pi(sk)->unacked_frames) {
1c2acffb
GP		 974 if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
975 break;
1da177e4 976
1c2acffb
GP		 977 skb = skb_dequeue(TX_QUEUE(sk));
978 kfree_skb(skb);
1da177e4 979
1c2acffb
GP		 980 l2cap_pi(sk)->unacked_frames--;
981 }
1da177e4 982
e90bac06
GP		 983 if (!l2cap_pi(sk)->unacked_frames)
984 del_timer(&l2cap_pi(sk)->retrans_timer);
1c2acffb 985}
1da177e4 986
fd83ccdb 987void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
1c2acffb
GP		 988{
989 struct l2cap_pinfo *pi = l2cap_pi(sk);
e702112f
AE		 990 struct hci_conn *hcon = pi->conn->hcon;
991 u16 flags;
1c2acffb
GP		 992
993 BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
1da177e4 994
e702112f
AE		 995 if (!pi->flushable && lmp_no_flush_capable(hcon->hdev))
996 flags = ACL_START_NO_FLUSH;
997 else
998 flags = ACL_START;
999
1000 hci_send_acl(hcon, skb, flags);
1c2acffb
GP		 1001}
1002
fd83ccdb 1003void l2cap_streaming_send(struct sock *sk)
6840ed07 1004{
ccbb84af 1005 struct sk_buff *skb;
6840ed07 1006 struct l2cap_pinfo *pi = l2cap_pi(sk);
fcc203c3 1007 u16 control, fcs;
6840ed07 1008
ccbb84af
GP		 1009 while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
1010 control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
6840ed07 1011 control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
ccbb84af 1012 put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1013
e8235c6b 1014 if (pi->fcs == L2CAP_FCS_CRC16) {
ccbb84af
GP		 1015 fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
1016 put_unaligned_le16(fcs, skb->data + skb->len - 2);
fcc203c3
GP		 1017 }
1018
ccbb84af 1019 l2cap_do_send(sk, skb);
6840ed07
GP		 1020
1021 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
6840ed07 1022 }
6840ed07
GP		 1023}
1024
dfc909be 1025static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
8f17154f
GP		 1026{
1027 struct l2cap_pinfo *pi = l2cap_pi(sk);
1028 struct sk_buff *skb, *tx_skb;
1029 u16 control, fcs;
8f17154f
GP		 1030
1031 skb = skb_peek(TX_QUEUE(sk));
f11d676d
GP		 1032 if (!skb)
1033 return;
8f17154f 1034
f11d676d
GP		 1035 do {
1036 if (bt_cb(skb)->tx_seq == tx_seq)
8f17154f 1037 break;
8f17154f 1038
f11d676d
GP		 1039 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1040 return;
8f17154f 1041
f11d676d 1042 } while ((skb = skb_queue_next(TX_QUEUE(sk), skb)));
8f17154f 1043
f11d676d
GP		 1044 if (pi->remote_max_tx &&
1045 bt_cb(skb)->retries == pi->remote_max_tx) {
9b108fc0 1046 l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
f11d676d
GP		 1047 return;
1048 }
1049
1050 tx_skb = skb_clone(skb, GFP_ATOMIC);
1051 bt_cb(skb)->retries++;
1052 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
3cb123d1
GP		 1053
1054 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
1055 control |= L2CAP_CTRL_FINAL;
1056 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
1057 }
95ffa978 1058
f11d676d
GP		 1059 control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
1060 | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
3cb123d1 1061
f11d676d
GP		 1062 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1063
1064 if (pi->fcs == L2CAP_FCS_CRC16) {
1065 fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
1066 put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
1067 }
1068
1069 l2cap_do_send(sk, tx_skb);
8f17154f
GP		 1070}
1071
fd83ccdb 1072int l2cap_ertm_send(struct sock *sk)
1c2acffb
GP		 1073{
1074 struct sk_buff *skb, *tx_skb;
1075 struct l2cap_pinfo *pi = l2cap_pi(sk);
fcc203c3 1076 u16 control, fcs;
9a9c6a34 1077 int nsent = 0;
1c2acffb 1078
c13ffa62
GP		 1079 if (sk->sk_state != BT_CONNECTED)
1080 return -ENOTCONN;
e90bac06 1081
6e2b6722 1082 while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))) {
1c2acffb 1083
e90bac06
GP		 1084 if (pi->remote_max_tx &&
1085 bt_cb(skb)->retries == pi->remote_max_tx) {
9b108fc0 1086 l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
e90bac06
GP		 1087 break;
1088 }
1089
e420aba3
AE		 1090 tx_skb = skb_clone(skb, GFP_ATOMIC);
1091
e90bac06
GP		 1092 bt_cb(skb)->retries++;
1093
1c2acffb 1094 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
95ffa978
GP		 1095 control &= L2CAP_CTRL_SAR;
1096
d5392c8f
GP		 1097 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
1098 control |= L2CAP_CTRL_FINAL;
1099 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
1100 }
9f121a5a 1101 control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
1c2acffb
GP		 1102 | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
1103 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1104
e90bac06 1105
e8235c6b 1106 if (pi->fcs == L2CAP_FCS_CRC16) {
fcc203c3
GP		 1107 fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
1108 put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
1109 }
1110
9a9c6a34
GP		 1111 l2cap_do_send(sk, tx_skb);
1112
e90bac06 1113 __mod_retrans_timer();
1c2acffb
GP		 1114
1115 bt_cb(skb)->tx_seq = pi->next_tx_seq;
1116 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
1117
1118 pi->unacked_frames++;
d5392c8f 1119 pi->frames_sent++;
1c2acffb
GP		 1120
1121 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1122 sk->sk_send_head = NULL;
1123 else
1124 sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
9e917af1
GP		 1125
1126 nsent++;
1c2acffb
GP		 1127 }
1128
9e917af1
GP		 1129 return nsent;
1130}
1131
dfc909be
GP		 1132static int l2cap_retransmit_frames(struct sock *sk)
1133{
1134 struct l2cap_pinfo *pi = l2cap_pi(sk);
1135 int ret;
1136
dfc909be
GP		 1137 if (!skb_queue_empty(TX_QUEUE(sk)))
1138 sk->sk_send_head = TX_QUEUE(sk)->next;
1139
1140 pi->next_tx_seq = pi->expected_ack_seq;
1141 ret = l2cap_ertm_send(sk);
dfc909be
GP		 1142 return ret;
1143}
1144
9a9c6a34 1145static void l2cap_send_ack(struct l2cap_pinfo *pi)
9e917af1
GP		 1146{
1147 struct sock *sk = (struct sock *)pi;
1148 u16 control = 0;
1149
1150 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
1151
1152 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
1153 control |= L2CAP_SUPER_RCV_NOT_READY;
1890d36b 1154 pi->conn_state |= L2CAP_CONN_RNR_SENT;
9a9c6a34
GP		 1155 l2cap_send_sframe(pi, control);
1156 return;
9e917af1 1157 }
dfc909be 1158
e0f66218 1159 if (l2cap_ertm_send(sk) > 0)
dfc909be
GP		 1160 return;
1161
1162 control |= L2CAP_SUPER_RCV_READY;
1163 l2cap_send_sframe(pi, control);
1c2acffb
GP		 1164}
1165
9a9c6a34 1166static void l2cap_send_srejtail(struct sock *sk)
99b0d4b7
GP		 1167{
1168 struct srej_list *tail;
1169 u16 control;
1170
1171 control = L2CAP_SUPER_SELECT_REJECT;
1172 control |= L2CAP_CTRL_FINAL;
1173
1174 tail = list_entry(SREJ_LIST(sk)->prev, struct srej_list, list);
1175 control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
1176
1177 l2cap_send_sframe(l2cap_pi(sk), control);
99b0d4b7
GP		 1178}
1179
1c2acffb
GP		 1180static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
1181{
1182 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1183 struct sk_buff **frag;
1184 int err, sent = 0;
1da177e4 1185
59203a21 1186 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1187 return -EFAULT;
1da177e4
LT		 1188
1189 sent += count;
1190 len -= count;
1191
1192 /* Continuation fragments (no L2CAP header) */
1193 frag = &skb_shinfo(skb)->frag_list;
1194 while (len) {
1195 count = min_t(unsigned int, conn->mtu, len);
1196
1197 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1198 if (!*frag)
0175d629 1199 return err;
1c2acffb
GP		 1200 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1201 return -EFAULT;
1da177e4
LT		 1202
1203 sent += count;
1204 len -= count;
1205
1206 frag = &(*frag)->next;
1207 }
1da177e4
LT		 1208
1209 return sent;
1c2acffb 1210}
1da177e4 1211
fd83ccdb 1212struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len)
1c2acffb
GP		 1213{
1214 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1215 struct sk_buff *skb;
1216 int err, count, hlen = L2CAP_HDR_SIZE + 2;
1217 struct l2cap_hdr *lh;
1218
1219 BT_DBG("sk %p len %d", sk, (int)len);
1220
1221 count = min_t(unsigned int, (conn->mtu - hlen), len);
1222 skb = bt_skb_send_alloc(sk, count + hlen,
1223 msg->msg_flags & MSG_DONTWAIT, &err);
1224 if (!skb)
0175d629 1225 return ERR_PTR(err);
1c2acffb
GP		 1226
1227 /* Create L2CAP header */
1228 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1229 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1230 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1231 put_unaligned_le16(l2cap_pi(sk)->psm, skb_put(skb, 2));
1232
1233 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1234 if (unlikely(err < 0)) {
1235 kfree_skb(skb);
1236 return ERR_PTR(err);
1237 }
1238 return skb;
1239}
1240
fd83ccdb 1241struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len)
1c2acffb
GP		 1242{
1243 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1244 struct sk_buff *skb;
1245 int err, count, hlen = L2CAP_HDR_SIZE;
1246 struct l2cap_hdr *lh;
1247
1248 BT_DBG("sk %p len %d", sk, (int)len);
1249
1250 count = min_t(unsigned int, (conn->mtu - hlen), len);
1251 skb = bt_skb_send_alloc(sk, count + hlen,
1252 msg->msg_flags & MSG_DONTWAIT, &err);
1253 if (!skb)
0175d629 1254 return ERR_PTR(err);
1c2acffb
GP		 1255
1256 /* Create L2CAP header */
1257 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1258 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1259 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1260
1261 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1262 if (unlikely(err < 0)) {
1263 kfree_skb(skb);
1264 return ERR_PTR(err);
1265 }
1266 return skb;
1267}
1268
fd83ccdb 1269struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
1c2acffb
GP		 1270{
1271 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1272 struct sk_buff *skb;
1273 int err, count, hlen = L2CAP_HDR_SIZE + 2;
1274 struct l2cap_hdr *lh;
1275
1276 BT_DBG("sk %p len %d", sk, (int)len);
1277
0ee0d208
GP		 1278 if (!conn)
1279 return ERR_PTR(-ENOTCONN);
1280
c74e560c
GP		 1281 if (sdulen)
1282 hlen += 2;
1283
fcc203c3
GP		 1284 if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
1285 hlen += 2;
1286
1c2acffb
GP		 1287 count = min_t(unsigned int, (conn->mtu - hlen), len);
1288 skb = bt_skb_send_alloc(sk, count + hlen,
1289 msg->msg_flags & MSG_DONTWAIT, &err);
1290 if (!skb)
0175d629 1291 return ERR_PTR(err);
1c2acffb
GP		 1292
1293 /* Create L2CAP header */
1294 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1295 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1296 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1297 put_unaligned_le16(control, skb_put(skb, 2));
c74e560c
GP		 1298 if (sdulen)
1299 put_unaligned_le16(sdulen, skb_put(skb, 2));
1c2acffb
GP		 1300
1301 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1302 if (unlikely(err < 0)) {
1303 kfree_skb(skb);
1304 return ERR_PTR(err);
1305 }
e90bac06 1306
fcc203c3
GP		 1307 if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
1308 put_unaligned_le16(0, skb_put(skb, 2));
1309
e90bac06 1310 bt_cb(skb)->retries = 0;
1c2acffb 1311 return skb;
1da177e4
LT		 1312}
1313
fd83ccdb 1314int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
c74e560c
GP		 1315{
1316 struct l2cap_pinfo *pi = l2cap_pi(sk);
1317 struct sk_buff *skb;
1318 struct sk_buff_head sar_queue;
1319 u16 control;
1320 size_t size = 0;
1321
ff12fd64 1322 skb_queue_head_init(&sar_queue);
c74e560c 1323 control = L2CAP_SDU_START;
1c762159 1324 skb = l2cap_create_iframe_pdu(sk, msg, pi->remote_mps, control, len);
c74e560c
GP		 1325 if (IS_ERR(skb))
1326 return PTR_ERR(skb);
1327
1328 __skb_queue_tail(&sar_queue, skb);
1c762159
GP		 1329 len -= pi->remote_mps;
1330 size += pi->remote_mps;
c74e560c
GP		 1331
1332 while (len > 0) {
1333 size_t buflen;
1334
1c762159 1335 if (len > pi->remote_mps) {
44651b85 1336 control = L2CAP_SDU_CONTINUE;
1c762159 1337 buflen = pi->remote_mps;
c74e560c 1338 } else {
44651b85 1339 control = L2CAP_SDU_END;
c74e560c
GP		 1340 buflen = len;
1341 }
1342
6840ed07 1343 skb = l2cap_create_iframe_pdu(sk, msg, buflen, control, 0);
c74e560c
GP		 1344 if (IS_ERR(skb)) {
1345 skb_queue_purge(&sar_queue);
1346 return PTR_ERR(skb);
1347 }
1348
1349 __skb_queue_tail(&sar_queue, skb);
1350 len -= buflen;
1351 size += buflen;
c74e560c
GP		 1352 }
1353 skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
1354 if (sk->sk_send_head == NULL)
1355 sk->sk_send_head = sar_queue.next;
1356
1357 return size;
1358}
1359
1da177e4
LT		 1360static void l2cap_chan_ready(struct sock *sk)
1361{
1362 struct sock *parent = bt_sk(sk)->parent;
1363
1364 BT_DBG("sk %p, parent %p", sk, parent);
1365
1366 l2cap_pi(sk)->conf_state = 0;
1367 l2cap_sock_clear_timer(sk);
1368
1369 if (!parent) {
1370 /* Outgoing channel.
1371 * Wake up socket sleeping on connect.
1372 */
1373 sk->sk_state = BT_CONNECTED;
1374 sk->sk_state_change(sk);
1375 } else {
1376 /* Incoming channel.
1377 * Wake up socket sleeping on accept.
1378 */
1379 parent->sk_data_ready(parent, 0);
1380 }
1381}
1382
1383/* Copy frame to all raw sockets on that connection */
1384static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1385{
1386 struct l2cap_chan_list *l = &conn->chan_list;
1387 struct sk_buff *nskb;
af05b30b 1388 struct sock *sk;
1da177e4
LT		 1389
1390 BT_DBG("conn %p", conn);
1391
1392 read_lock(&l->lock);
1393 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
1394 if (sk->sk_type != SOCK_RAW)
1395 continue;
1396
1397 /* Don't send frame to the socket it came from */
1398 if (skb->sk == sk)
1399 continue;
af05b30b
GP		 1400 nskb = skb_clone(skb, GFP_ATOMIC);
1401 if (!nskb)
1da177e4
LT		 1402 continue;
1403
1404 if (sock_queue_rcv_skb(sk, nskb))
1405 kfree_skb(nskb);
1406 }
1407 read_unlock(&l->lock);
1408}
1409
1410/* ---- L2CAP signalling commands ---- */
1411static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1412 u8 code, u8 ident, u16 dlen, void *data)
1413{
1414 struct sk_buff *skb, **frag;
1415 struct l2cap_cmd_hdr *cmd;
1416 struct l2cap_hdr *lh;
1417 int len, count;
1418
af05b30b
GP		 1419 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
1420 conn, code, ident, dlen);
1da177e4
LT		 1421
1422 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1423 count = min_t(unsigned int, conn->mtu, len);
1424
1425 skb = bt_skb_alloc(count, GFP_ATOMIC);
1426 if (!skb)
1427 return NULL;
1428
1429 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 1430 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 1431
1432 if (conn->hcon->type == LE_LINK)
1433 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
1434 else
1435 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 1436
1437 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1438 cmd->code = code;
1439 cmd->ident = ident;
aca3192c 1440 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 1441
1442 if (dlen) {
1443 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1444 memcpy(skb_put(skb, count), data, count);
1445 data += count;
1446 }
1447
1448 len -= skb->len;
1449
1450 /* Continuation fragments (no L2CAP header) */
1451 frag = &skb_shinfo(skb)->frag_list;
1452 while (len) {
1453 count = min_t(unsigned int, conn->mtu, len);
1454
1455 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1456 if (!*frag)
1457 goto fail;
1458
1459 memcpy(skb_put(*frag, count), data, count);
1460
1461 len -= count;
1462 data += count;
1463
1464 frag = &(*frag)->next;
1465 }
1466
1467 return skb;
1468
1469fail:
1470 kfree_skb(skb);
1471 return NULL;
1472}
1473
1474static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1475{
1476 struct l2cap_conf_opt *opt = *ptr;
1477 int len;
1478
1479 len = L2CAP_CONF_OPT_SIZE + opt->len;
1480 *ptr += len;
1481
1482 *type = opt->type;
1483 *olen = opt->len;
1484
1485 switch (opt->len) {
1486 case 1:
1487 *val = *((u8 *) opt->val);
1488 break;
1489
1490 case 2:
bfaaeb3e 1491 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 1492 break;
1493
1494 case 4:
bfaaeb3e 1495 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 1496 break;
1497
1498 default:
1499 *val = (unsigned long) opt->val;
1500 break;
1501 }
1502
1503 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1504 return len;
1505}
1506
1da177e4
LT		 1507static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1508{
1509 struct l2cap_conf_opt *opt = *ptr;
1510
1511 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1512
1513 opt->type = type;
1514 opt->len = len;
1515
1516 switch (len) {
1517 case 1:
1518 *((u8 *) opt->val) = val;
1519 break;
1520
1521 case 2:
4f8b691c 1522 put_unaligned_le16(val, opt->val);
1da177e4
LT		 1523 break;
1524
1525 case 4:
4f8b691c 1526 put_unaligned_le32(val, opt->val);
1da177e4
LT		 1527 break;
1528
1529 default:
1530 memcpy(opt->val, (void *) val, len);
1531 break;
1532 }
1533
1534 *ptr += L2CAP_CONF_OPT_SIZE + len;
1535}
1536
c1b4f43b
GP		 1537static void l2cap_ack_timeout(unsigned long arg)
1538{
1539 struct sock *sk = (void *) arg;
1540
1541 bh_lock_sock(sk);
1542 l2cap_send_ack(l2cap_pi(sk));
1543 bh_unlock_sock(sk);
1544}
1545
0565c1c2
GP		 1546static inline void l2cap_ertm_init(struct sock *sk)
1547{
1548 l2cap_pi(sk)->expected_ack_seq = 0;
1549 l2cap_pi(sk)->unacked_frames = 0;
1550 l2cap_pi(sk)->buffer_seq = 0;
803020c6 1551 l2cap_pi(sk)->num_acked = 0;
d5392c8f 1552 l2cap_pi(sk)->frames_sent = 0;
0565c1c2
GP		 1553
1554 setup_timer(&l2cap_pi(sk)->retrans_timer,
1555 l2cap_retrans_timeout, (unsigned long) sk);
1556 setup_timer(&l2cap_pi(sk)->monitor_timer,
1557 l2cap_monitor_timeout, (unsigned long) sk);
c1b4f43b
GP		 1558 setup_timer(&l2cap_pi(sk)->ack_timer,
1559 l2cap_ack_timeout, (unsigned long) sk);
0565c1c2
GP		 1560
1561 __skb_queue_head_init(SREJ_QUEUE(sk));
1890d36b
GP		 1562 __skb_queue_head_init(BUSY_QUEUE(sk));
1563
1564 INIT_WORK(&l2cap_pi(sk)->busy_work, l2cap_busy_work);
218bb9df
GP		 1565
1566 sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
0565c1c2
GP		 1567}
1568
f2fcfcd6
GP		 1569static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
1570{
1571 switch (mode) {
1572 case L2CAP_MODE_STREAMING:
1573 case L2CAP_MODE_ERTM:
1574 if (l2cap_mode_supported(mode, remote_feat_mask))
1575 return mode;
1576 /* fall through */
1577 default:
1578 return L2CAP_MODE_BASIC;
1579 }
1580}
1581
68983259 1582int l2cap_build_conf_req(struct sock *sk, void *data)
1da177e4
LT		 1583{
1584 struct l2cap_pinfo *pi = l2cap_pi(sk);
1585 struct l2cap_conf_req *req = data;
bd3c9e25 1586 struct l2cap_conf_rfc rfc = { .mode = pi->mode };
1da177e4
LT		 1587 void *ptr = req->data;
1588
1589 BT_DBG("sk %p", sk);
1590
f2fcfcd6
GP		 1591 if (pi->num_conf_req || pi->num_conf_rsp)
1592 goto done;
1593
1594 switch (pi->mode) {
1595 case L2CAP_MODE_STREAMING:
1596 case L2CAP_MODE_ERTM:
2ba13ed6 1597 if (pi->conf_state & L2CAP_CONF_STATE2_DEVICE)
85eb53c6 1598 break;
85eb53c6 1599
2ba13ed6 1600 /* fall through */
f2fcfcd6
GP		 1601 default:
1602 pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
1603 break;
1604 }
1605
1606done:
7990681c
GP		 1607 if (pi->imtu != L2CAP_DEFAULT_MTU)
1608 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
1609
65c7c491
MH		 1610 switch (pi->mode) {
1611 case L2CAP_MODE_BASIC:
63406504
GP		 1612 if (!(pi->conn->feat_mask & L2CAP_FEAT_ERTM) &&
1613 !(pi->conn->feat_mask & L2CAP_FEAT_STREAMING))
1614 break;
1615
62547752
GP		 1616 rfc.mode = L2CAP_MODE_BASIC;
1617 rfc.txwin_size = 0;
1618 rfc.max_transmit = 0;
1619 rfc.retrans_timeout = 0;
1620 rfc.monitor_timeout = 0;
1621 rfc.max_pdu_size = 0;
1622
63406504
GP		 1623 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
1624 (unsigned long) &rfc);
65c7c491
MH		 1625 break;
1626
1627 case L2CAP_MODE_ERTM:
1628 rfc.mode = L2CAP_MODE_ERTM;
14b5aa71 1629 rfc.txwin_size = pi->tx_win;
68d7f0ce 1630 rfc.max_transmit = pi->max_tx;
f2fcfcd6
GP		 1631 rfc.retrans_timeout = 0;
1632 rfc.monitor_timeout = 0;
c74e560c 1633 rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
d1daa091 1634 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
1c762159 1635 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
f2fcfcd6 1636
63406504
GP		 1637 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
1638 (unsigned long) &rfc);
1639
fcc203c3
GP		 1640 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
1641 break;
1642
1643 if (pi->fcs == L2CAP_FCS_NONE ||
1644 pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
1645 pi->fcs = L2CAP_FCS_NONE;
1646 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
1647 }
f2fcfcd6
GP		 1648 break;
1649
1650 case L2CAP_MODE_STREAMING:
1651 rfc.mode = L2CAP_MODE_STREAMING;
1652 rfc.txwin_size = 0;
1653 rfc.max_transmit = 0;
1654 rfc.retrans_timeout = 0;
1655 rfc.monitor_timeout = 0;
c74e560c 1656 rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
d1daa091 1657 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
1c762159 1658 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
65c7c491 1659
63406504
GP		 1660 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
1661 (unsigned long) &rfc);
1662
fcc203c3
GP		 1663 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
1664 break;
1665
1666 if (pi->fcs == L2CAP_FCS_NONE ||
1667 pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
1668 pi->fcs = L2CAP_FCS_NONE;
1669 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
1670 }
65c7c491
MH		 1671 break;
1672 }
1da177e4
LT		 1673
1674 /* FIXME: Need actual value of the flush timeout */
1675 //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
1676 // l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
1677
aca3192c
YH		 1678 req->dcid = cpu_to_le16(pi->dcid);
1679 req->flags = cpu_to_le16(0);
1da177e4
LT		 1680
1681 return ptr - data;
1682}
1683
5dee9e7c 1684static int l2cap_parse_conf_req(struct sock *sk, void *data)
1da177e4
LT		 1685{
1686 struct l2cap_pinfo *pi = l2cap_pi(sk);
5dee9e7c
MH		 1687 struct l2cap_conf_rsp *rsp = data;
1688 void *ptr = rsp->data;
1689 void *req = pi->conf_req;
1690 int len = pi->conf_len;
1691 int type, hint, olen;
1692 unsigned long val;
6464f35f 1693 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
861d6882 1694 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 1695 u16 result = L2CAP_CONF_SUCCESS;
1da177e4 1696
5dee9e7c 1697 BT_DBG("sk %p", sk);
820ae1b8 1698
5dee9e7c
MH		 1699 while (len >= L2CAP_CONF_OPT_SIZE) {
1700 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 1701
589d2746 1702 hint = type & L2CAP_CONF_HINT;
47ec1dcd 1703 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 1704
1705 switch (type) {
1706 case L2CAP_CONF_MTU:
861d6882 1707 mtu = val;
5dee9e7c
MH		 1708 break;
1709
1710 case L2CAP_CONF_FLUSH_TO:
1711 pi->flush_to = val;
1712 break;
1713
1714 case L2CAP_CONF_QOS:
1715 break;
1716
6464f35f
MH		 1717 case L2CAP_CONF_RFC:
1718 if (olen == sizeof(rfc))
1719 memcpy(&rfc, (void *) val, olen);
1720 break;
1721
fcc203c3
GP		 1722 case L2CAP_CONF_FCS:
1723 if (val == L2CAP_FCS_NONE)
1724 pi->conf_state |= L2CAP_CONF_NO_FCS_RECV;
1725
1726 break;
1727
5dee9e7c
MH		 1728 default:
1729 if (hint)
1730 break;
1731
1732 result = L2CAP_CONF_UNKNOWN;
1733 *((u8 *) ptr++) = type;
1734 break;
1735 }
1736 }
1737
e9aeb2dd 1738 if (pi->num_conf_rsp || pi->num_conf_req > 1)
f2fcfcd6
GP		 1739 goto done;
1740
1741 switch (pi->mode) {
1742 case L2CAP_MODE_STREAMING:
1743 case L2CAP_MODE_ERTM:
85eb53c6
GP		 1744 if (!(pi->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
1745 pi->mode = l2cap_select_mode(rfc.mode,
1746 pi->conn->feat_mask);
1747 break;
1748 }
1749
742e519b 1750 if (pi->mode != rfc.mode)
f2fcfcd6 1751 return -ECONNREFUSED;
742e519b 1752
f2fcfcd6 1753 break;
f2fcfcd6
GP		 1754 }
1755
1756done:
1757 if (pi->mode != rfc.mode) {
1758 result = L2CAP_CONF_UNACCEPT;
1759 rfc.mode = pi->mode;
1760
1761 if (pi->num_conf_rsp == 1)
1762 return -ECONNREFUSED;
1763
1764 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1765 sizeof(rfc), (unsigned long) &rfc);
1766 }
1767
1768
5dee9e7c
MH		 1769 if (result == L2CAP_CONF_SUCCESS) {
1770 /* Configure output options and let the other side know
1771 * which ones we don't like. */
1772
f2fcfcd6
GP		 1773 if (mtu < L2CAP_DEFAULT_MIN_MTU)
1774 result = L2CAP_CONF_UNACCEPT;
1775 else {
1776 pi->omtu = mtu;
1777 pi->conf_state |= L2CAP_CONF_MTU_DONE;
1778 }
1779 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
6464f35f 1780
f2fcfcd6
GP		 1781 switch (rfc.mode) {
1782 case L2CAP_MODE_BASIC:
1783 pi->fcs = L2CAP_FCS_NONE;
1784 pi->conf_state |= L2CAP_CONF_MODE_DONE;
1785 break;
1786
1787 case L2CAP_MODE_ERTM:
1788 pi->remote_tx_win = rfc.txwin_size;
1789 pi->remote_max_tx = rfc.max_transmit;
86b1b263
MM		 1790
1791 if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
1792 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
1c762159
GP		 1793
1794 pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6 1795
10467e9e
GP		 1796 rfc.retrans_timeout =
1797 le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
1798 rfc.monitor_timeout =
1799 le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6
GP		 1800
1801 pi->conf_state |= L2CAP_CONF_MODE_DONE;
68ae6639
GP		 1802
1803 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1804 sizeof(rfc), (unsigned long) &rfc);
1805
f2fcfcd6
GP		 1806 break;
1807
1808 case L2CAP_MODE_STREAMING:
86b1b263
MM		 1809 if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
1810 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
1c762159
GP		 1811
1812 pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 1813
1814 pi->conf_state |= L2CAP_CONF_MODE_DONE;
68ae6639
GP		 1815
1816 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1817 sizeof(rfc), (unsigned long) &rfc);
1818
f2fcfcd6
GP		 1819 break;
1820
1821 default:
5dee9e7c 1822 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 1823
6464f35f 1824 memset(&rfc, 0, sizeof(rfc));
f2fcfcd6
GP		 1825 rfc.mode = pi->mode;
1826 }
6464f35f 1827
f2fcfcd6
GP		 1828 if (result == L2CAP_CONF_SUCCESS)
1829 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
1830 }
5dee9e7c
MH		 1831 rsp->scid = cpu_to_le16(pi->dcid);
1832 rsp->result = cpu_to_le16(result);
1833 rsp->flags = cpu_to_le16(0x0000);
1834
1835 return ptr - data;
1da177e4
LT		 1836}
1837
f2fcfcd6
GP		 1838static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data, u16 *result)
1839{
1840 struct l2cap_pinfo *pi = l2cap_pi(sk);
1841 struct l2cap_conf_req *req = data;
1842 void *ptr = req->data;
1843 int type, olen;
1844 unsigned long val;
1845 struct l2cap_conf_rfc rfc;
1846
1847 BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
1848
1849 while (len >= L2CAP_CONF_OPT_SIZE) {
1850 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
1851
1852 switch (type) {
1853 case L2CAP_CONF_MTU:
1854 if (val < L2CAP_DEFAULT_MIN_MTU) {
1855 *result = L2CAP_CONF_UNACCEPT;
8183b775 1856 pi->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 1857 } else
8183b775
AE		 1858 pi->imtu = val;
1859 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
f2fcfcd6
GP		 1860 break;
1861
1862 case L2CAP_CONF_FLUSH_TO:
1863 pi->flush_to = val;
1864 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
1865 2, pi->flush_to);
1866 break;
1867
1868 case L2CAP_CONF_RFC:
1869 if (olen == sizeof(rfc))
1870 memcpy(&rfc, (void *)val, olen);
1871
1872 if ((pi->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
1873 rfc.mode != pi->mode)
1874 return -ECONNREFUSED;
1875
f2fcfcd6
GP		 1876 pi->fcs = 0;
1877
1878 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1879 sizeof(rfc), (unsigned long) &rfc);
1880 break;
1881 }
1882 }
1883
6c2ea7a8
GP		 1884 if (pi->mode == L2CAP_MODE_BASIC && pi->mode != rfc.mode)
1885 return -ECONNREFUSED;
1886
1887 pi->mode = rfc.mode;
1888
f2fcfcd6
GP		 1889 if (*result == L2CAP_CONF_SUCCESS) {
1890 switch (rfc.mode) {
1891 case L2CAP_MODE_ERTM:
10467e9e
GP		 1892 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
1893 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
1c762159 1894 pi->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 1895 break;
1896 case L2CAP_MODE_STREAMING:
1c762159 1897 pi->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 1898 }
1899 }
1900
1901 req->dcid = cpu_to_le16(pi->dcid);
1902 req->flags = cpu_to_le16(0x0000);
1903
1904 return ptr - data;
1905}
1906
5dee9e7c 1907static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1da177e4
LT		 1908{
1909 struct l2cap_conf_rsp *rsp = data;
1910 void *ptr = rsp->data;
1da177e4 1911
5dee9e7c 1912 BT_DBG("sk %p", sk);
1da177e4 1913
aca3192c 1914 rsp->scid = cpu_to_le16(l2cap_pi(sk)->dcid);
5dee9e7c 1915 rsp->result = cpu_to_le16(result);
aca3192c 1916 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 1917
1918 return ptr - data;
1919}
1920
7b1c0049
GP		 1921static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
1922{
1923 struct l2cap_pinfo *pi = l2cap_pi(sk);
1924 int type, olen;
1925 unsigned long val;
1926 struct l2cap_conf_rfc rfc;
1927
1928 BT_DBG("sk %p, rsp %p, len %d", sk, rsp, len);
1929
1930 if ((pi->mode != L2CAP_MODE_ERTM) && (pi->mode != L2CAP_MODE_STREAMING))
1931 return;
1932
1933 while (len >= L2CAP_CONF_OPT_SIZE) {
1934 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
1935
1936 switch (type) {
1937 case L2CAP_CONF_RFC:
1938 if (olen == sizeof(rfc))
1939 memcpy(&rfc, (void *)val, olen);
1940 goto done;
1941 }
1942 }
1943
1944done:
1945 switch (rfc.mode) {
1946 case L2CAP_MODE_ERTM:
10467e9e
GP		 1947 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
1948 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
7b1c0049
GP		 1949 pi->mps = le16_to_cpu(rfc.max_pdu_size);
1950 break;
1951 case L2CAP_MODE_STREAMING:
1952 pi->mps = le16_to_cpu(rfc.max_pdu_size);
1953 }
1954}
1955
4e8402a3
MH		 1956static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1957{
1958 struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
1959
1960 if (rej->reason != 0x0000)
1961 return 0;
1962
1963 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
1964 cmd->ident == conn->info_ident) {
4e8402a3 1965 del_timer(&conn->info_timer);
984947dc
MH		 1966
1967 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1968 conn->info_ident = 0;
984947dc 1969
4e8402a3
MH		 1970 l2cap_conn_start(conn);
1971 }
1972
1973 return 0;
1974}
1975
1da177e4
LT		 1976static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1977{
1978 struct l2cap_chan_list *list = &conn->chan_list;
1979 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
1980 struct l2cap_conn_rsp rsp;
d793fe8c 1981 struct sock *parent, *sk = NULL;
e7c29cb1 1982 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 1983
1984 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 1985 __le16 psm = req->psm;
1da177e4
LT		 1986
1987 BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
1988
1989 /* Check if we have socket listening on psm */
1990 parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
1991 if (!parent) {
1992 result = L2CAP_CR_BAD_PSM;
1993 goto sendresp;
1994 }
1995
e0f0cb56
GP		 1996 bh_lock_sock(parent);
1997
e7c29cb1
MH		 1998 /* Check if the ACL is secure enough (if not SDP) */
1999 if (psm != cpu_to_le16(0x0001) &&
2000 !hci_conn_check_link_mode(conn->hcon)) {
2950f21a 2001 conn->disc_reason = 0x05;
e7c29cb1
MH		 2002 result = L2CAP_CR_SEC_BLOCK;
2003 goto response;
2004 }
2005
1da177e4
LT		 2006 result = L2CAP_CR_NO_MEM;
2007
2008 /* Check for backlog size */
2009 if (sk_acceptq_is_full(parent)) {
8e87d142 2010 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2011 goto response;
2012 }
2013
3b1e0a65 2014 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1da177e4
LT		 2015 if (!sk)
2016 goto response;
2017
fd1278d7 2018 write_lock_bh(&list->lock);
1da177e4
LT		 2019
2020 /* Check if we already have channel with that dcid */
2021 if (__l2cap_get_chan_by_dcid(list, scid)) {
fd1278d7 2022 write_unlock_bh(&list->lock);
1da177e4
LT		 2023 sock_set_flag(sk, SOCK_ZAPPED);
2024 l2cap_sock_kill(sk);
2025 goto response;
2026 }
2027
2028 hci_conn_hold(conn->hcon);
2029
2030 l2cap_sock_init(sk, parent);
2031 bacpy(&bt_sk(sk)->src, conn->src);
2032 bacpy(&bt_sk(sk)->dst, conn->dst);
2033 l2cap_pi(sk)->psm = psm;
2034 l2cap_pi(sk)->dcid = scid;
2035
2036 __l2cap_chan_add(conn, sk, parent);
2037 dcid = l2cap_pi(sk)->scid;
2038
2039 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
2040
1da177e4
LT		 2041 l2cap_pi(sk)->ident = cmd->ident;
2042
984947dc 2043 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
2af6b9d5 2044 if (l2cap_check_security(sk)) {
f66dc81f
MH		 2045 if (bt_sk(sk)->defer_setup) {
2046 sk->sk_state = BT_CONNECT2;
2047 result = L2CAP_CR_PEND;
2048 status = L2CAP_CS_AUTHOR_PEND;
2049 parent->sk_data_ready(parent, 0);
2050 } else {
2051 sk->sk_state = BT_CONFIG;
2052 result = L2CAP_CR_SUCCESS;
2053 status = L2CAP_CS_NO_INFO;
2054 }
79d554a6
MH		 2055 } else {
2056 sk->sk_state = BT_CONNECT2;
2057 result = L2CAP_CR_PEND;
2058 status = L2CAP_CS_AUTHEN_PEND;
2059 }
2060 } else {
2061 sk->sk_state = BT_CONNECT2;
2062 result = L2CAP_CR_PEND;
2063 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2064 }
2065
fd1278d7 2066 write_unlock_bh(&list->lock);
1da177e4
LT		 2067
2068response:
2069 bh_unlock_sock(parent);
2070
2071sendresp:
aca3192c
YH		 2072 rsp.scid = cpu_to_le16(scid);
2073 rsp.dcid = cpu_to_le16(dcid);
2074 rsp.result = cpu_to_le16(result);
2075 rsp.status = cpu_to_le16(status);
1da177e4 2076 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 2077
2078 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
2079 struct l2cap_info_req info;
2080 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2081
2082 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
2083 conn->info_ident = l2cap_get_ident(conn);
2084
2085 mod_timer(&conn->info_timer, jiffies +
2086 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
2087
2088 l2cap_send_cmd(conn, conn->info_ident,
2089 L2CAP_INFO_REQ, sizeof(info), &info);
2090 }
2091
d793fe8c 2092 if (sk && !(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
e9aeb2dd
GP		 2093 result == L2CAP_CR_SUCCESS) {
2094 u8 buf[128];
2095 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
2096 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2097 l2cap_build_conf_req(sk, buf), buf);
2098 l2cap_pi(sk)->num_conf_req++;
2099 }
2100
1da177e4
LT		 2101 return 0;
2102}
2103
2104static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2105{
2106 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
2107 u16 scid, dcid, result, status;
2108 struct sock *sk;
2109 u8 req[128];
2110
2111 scid = __le16_to_cpu(rsp->scid);
2112 dcid = __le16_to_cpu(rsp->dcid);
2113 result = __le16_to_cpu(rsp->result);
2114 status = __le16_to_cpu(rsp->status);
2115
2116 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
2117
2118 if (scid) {
af05b30b
GP		 2119 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2120 if (!sk)
57d3b22b 2121 return -EFAULT;
1da177e4 2122 } else {
af05b30b
GP		 2123 sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
2124 if (!sk)
57d3b22b 2125 return -EFAULT;
1da177e4
LT		 2126 }
2127
2128 switch (result) {
2129 case L2CAP_CR_SUCCESS:
2130 sk->sk_state = BT_CONFIG;
2131 l2cap_pi(sk)->ident = 0;
2132 l2cap_pi(sk)->dcid = dcid;
6a8d3010
MH		 2133 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
2134
e9aeb2dd
GP		 2135 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)
2136 break;
2137
2138 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
2139
1da177e4
LT		 2140 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2141 l2cap_build_conf_req(sk, req), req);
f2fcfcd6 2142 l2cap_pi(sk)->num_conf_req++;
1da177e4
LT		 2143 break;
2144
2145 case L2CAP_CR_PEND:
6a8d3010 2146 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1da177e4
LT		 2147 break;
2148
2149 default:
a49184c2
AE		 2150 /* don't delete l2cap channel if sk is owned by user */
2151 if (sock_owned_by_user(sk)) {
2152 sk->sk_state = BT_DISCONN;
2153 l2cap_sock_clear_timer(sk);
2154 l2cap_sock_set_timer(sk, HZ / 5);
2155 break;
2156 }
2157
1da177e4
LT		 2158 l2cap_chan_del(sk, ECONNREFUSED);
2159 break;
2160 }
2161
2162 bh_unlock_sock(sk);
2163 return 0;
2164}
2165
8c462b60
MM		 2166static inline void set_default_fcs(struct l2cap_pinfo *pi)
2167{
2168 /* FCS is enabled only in ERTM or streaming mode, if one or both
2169 * sides request it.
2170 */
2171 if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
2172 pi->fcs = L2CAP_FCS_NONE;
2173 else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
2174 pi->fcs = L2CAP_FCS_CRC16;
2175}
2176
88219a0f 2177static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 2178{
2179 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2180 u16 dcid, flags;
2181 u8 rsp[64];
2182 struct sock *sk;
5dee9e7c 2183 int len;
1da177e4
LT		 2184
2185 dcid = __le16_to_cpu(req->dcid);
2186 flags = __le16_to_cpu(req->flags);
2187
2188 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2189
af05b30b
GP		 2190 sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2191 if (!sk)
1da177e4
LT		 2192 return -ENOENT;
2193
df6bd743
GP		 2194 if (sk->sk_state != BT_CONFIG) {
2195 struct l2cap_cmd_rej rej;
2196
2197 rej.reason = cpu_to_le16(0x0002);
2198 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2199 sizeof(rej), &rej);
354f60a9 2200 goto unlock;
df6bd743 2201 }
354f60a9 2202
5dee9e7c 2203 /* Reject if config buffer is too small. */
88219a0f 2204 len = cmd_len - sizeof(*req);
5dee9e7c
MH		 2205 if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
2206 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2207 l2cap_build_conf_rsp(sk, rsp,
2208 L2CAP_CONF_REJECT, flags), rsp);
2209 goto unlock;
2210 }
2211
2212 /* Store config. */
2213 memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
2214 l2cap_pi(sk)->conf_len += len;
1da177e4
LT		 2215
2216 if (flags & 0x0001) {
2217 /* Incomplete config. Send empty response. */
2218 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
5dee9e7c
MH		 2219 l2cap_build_conf_rsp(sk, rsp,
2220 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 2221 goto unlock;
2222 }
2223
2224 /* Complete config. */
5dee9e7c 2225 len = l2cap_parse_conf_req(sk, rsp);
f2fcfcd6 2226 if (len < 0) {
9b108fc0 2227 l2cap_send_disconn_req(conn, sk, ECONNRESET);
1da177e4 2228 goto unlock;
f2fcfcd6 2229 }
1da177e4 2230
5dee9e7c 2231 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
f2fcfcd6 2232 l2cap_pi(sk)->num_conf_rsp++;
5dee9e7c 2233
5dee9e7c
MH		 2234 /* Reset config buffer. */
2235 l2cap_pi(sk)->conf_len = 0;
2236
876d9484
MH		 2237 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
2238 goto unlock;
2239
1da177e4 2240 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
8c462b60 2241 set_default_fcs(l2cap_pi(sk));
fcc203c3 2242
1da177e4 2243 sk->sk_state = BT_CONNECTED;
e90bac06 2244
0565c1c2
GP		 2245 l2cap_pi(sk)->next_tx_seq = 0;
2246 l2cap_pi(sk)->expected_tx_seq = 0;
1c2acffb 2247 __skb_queue_head_init(TX_QUEUE(sk));
0565c1c2
GP		 2248 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
2249 l2cap_ertm_init(sk);
2250
1da177e4 2251 l2cap_chan_ready(sk);
876d9484
MH		 2252 goto unlock;
2253 }
2254
2255 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
79d554a6 2256 u8 buf[64];
ab3e5715 2257 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1da177e4 2258 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
79d554a6 2259 l2cap_build_conf_req(sk, buf), buf);
f2fcfcd6 2260 l2cap_pi(sk)->num_conf_req++;
1da177e4
LT		 2261 }
2262
2263unlock:
2264 bh_unlock_sock(sk);
2265 return 0;
2266}
2267
2268static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2269{
2270 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2271 u16 scid, flags, result;
2272 struct sock *sk;
7b1c0049 2273 int len = cmd->len - sizeof(*rsp);
1da177e4
LT		 2274
2275 scid = __le16_to_cpu(rsp->scid);
2276 flags = __le16_to_cpu(rsp->flags);
2277 result = __le16_to_cpu(rsp->result);
2278
af05b30b
GP		 2279 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
2280 scid, flags, result);
1da177e4 2281
af05b30b
GP		 2282 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2283 if (!sk)
1da177e4
LT		 2284 return 0;
2285
2286 switch (result) {
2287 case L2CAP_CONF_SUCCESS:
7b1c0049 2288 l2cap_conf_rfc_get(sk, rsp->data, len);
1da177e4
LT		 2289 break;
2290
2291 case L2CAP_CONF_UNACCEPT:
f2fcfcd6 2292 if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 2293 char req[64];
2294
c2c77ec8 2295 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
9b108fc0 2296 l2cap_send_disconn_req(conn, sk, ECONNRESET);
c2c77ec8
AE		 2297 goto done;
2298 }
2299
f2fcfcd6
GP		 2300 /* throw out any old stored conf requests */
2301 result = L2CAP_CONF_SUCCESS;
2302 len = l2cap_parse_conf_rsp(sk, rsp->data,
2303 len, req, &result);
2304 if (len < 0) {
9b108fc0 2305 l2cap_send_disconn_req(conn, sk, ECONNRESET);
f2fcfcd6
GP		 2306 goto done;
2307 }
2308
2309 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2310 L2CAP_CONF_REQ, len, req);
2311 l2cap_pi(sk)->num_conf_req++;
2312 if (result != L2CAP_CONF_SUCCESS)
2313 goto done;
2314 break;
1da177e4
LT		 2315 }
2316
8e87d142 2317 default:
b1235d79 2318 sk->sk_err = ECONNRESET;
1da177e4 2319 l2cap_sock_set_timer(sk, HZ * 5);
9b108fc0 2320 l2cap_send_disconn_req(conn, sk, ECONNRESET);
1da177e4
LT		 2321 goto done;
2322 }
2323
2324 if (flags & 0x01)
2325 goto done;
2326
1da177e4
LT		 2327 l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
2328
2329 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
8c462b60 2330 set_default_fcs(l2cap_pi(sk));
fcc203c3 2331
1da177e4 2332 sk->sk_state = BT_CONNECTED;
0565c1c2 2333 l2cap_pi(sk)->next_tx_seq = 0;
1c2acffb 2334 l2cap_pi(sk)->expected_tx_seq = 0;
1c2acffb 2335 __skb_queue_head_init(TX_QUEUE(sk));
0565c1c2
GP		 2336 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
2337 l2cap_ertm_init(sk);
2338
1da177e4
LT		 2339 l2cap_chan_ready(sk);
2340 }
2341
2342done:
2343 bh_unlock_sock(sk);
2344 return 0;
2345}
2346
2347static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2348{
2349 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2350 struct l2cap_disconn_rsp rsp;
2351 u16 dcid, scid;
2352 struct sock *sk;
2353
2354 scid = __le16_to_cpu(req->scid);
2355 dcid = __le16_to_cpu(req->dcid);
2356
2357 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2358
af05b30b
GP		 2359 sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2360 if (!sk)
1da177e4
LT		 2361 return 0;
2362
aca3192c
YH		 2363 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
2364 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
1da177e4
LT		 2365 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
2366
2367 sk->sk_shutdown = SHUTDOWN_MASK;
2368
a49184c2
AE		 2369 /* don't delete l2cap channel if sk is owned by user */
2370 if (sock_owned_by_user(sk)) {
2371 sk->sk_state = BT_DISCONN;
2372 l2cap_sock_clear_timer(sk);
2373 l2cap_sock_set_timer(sk, HZ / 5);
2374 bh_unlock_sock(sk);
2375 return 0;
2376 }
2377
1da177e4
LT		 2378 l2cap_chan_del(sk, ECONNRESET);
2379 bh_unlock_sock(sk);
2380
2381 l2cap_sock_kill(sk);
2382 return 0;
2383}
2384
2385static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2386{
2387 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
2388 u16 dcid, scid;
2389 struct sock *sk;
2390
2391 scid = __le16_to_cpu(rsp->scid);
2392 dcid = __le16_to_cpu(rsp->dcid);
2393
2394 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
2395
af05b30b
GP		 2396 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2397 if (!sk)
1da177e4
LT		 2398 return 0;
2399
a49184c2
AE		 2400 /* don't delete l2cap channel if sk is owned by user */
2401 if (sock_owned_by_user(sk)) {
2402 sk->sk_state = BT_DISCONN;
2403 l2cap_sock_clear_timer(sk);
2404 l2cap_sock_set_timer(sk, HZ / 5);
2405 bh_unlock_sock(sk);
2406 return 0;
2407 }
2408
1da177e4
LT		 2409 l2cap_chan_del(sk, 0);
2410 bh_unlock_sock(sk);
2411
2412 l2cap_sock_kill(sk);
2413 return 0;
2414}
2415
2416static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2417{
2418 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 2419 u16 type;
2420
2421 type = __le16_to_cpu(req->type);
2422
2423 BT_DBG("type 0x%4.4x", type);
2424
f0709e03
MH		 2425 if (type == L2CAP_IT_FEAT_MASK) {
2426 u8 buf[8];
44dd46de 2427 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 2428 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2429 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2430 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 2431 if (!disable_ertm)
fcc203c3
GP		 2432 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2433 | L2CAP_FEAT_FCS;
1b7bf4ed 2434 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 2435 l2cap_send_cmd(conn, cmd->ident,
2436 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 2437 } else if (type == L2CAP_IT_FIXED_CHAN) {
2438 u8 buf[12];
2439 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2440 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2441 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2442 memcpy(buf + 4, l2cap_fixed_chan, 8);
2443 l2cap_send_cmd(conn, cmd->ident,
2444 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 2445 } else {
2446 struct l2cap_info_rsp rsp;
2447 rsp.type = cpu_to_le16(type);
2448 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2449 l2cap_send_cmd(conn, cmd->ident,
2450 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
2451 }
1da177e4
LT		 2452
2453 return 0;
2454}
2455
2456static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2457{
2458 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
2459 u16 type, result;
2460
2461 type = __le16_to_cpu(rsp->type);
2462 result = __le16_to_cpu(rsp->result);
2463
2464 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
2465
4e8402a3
MH		 2466 del_timer(&conn->info_timer);
2467
adb08ede
VT		 2468 if (result != L2CAP_IR_SUCCESS) {
2469 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2470 conn->info_ident = 0;
2471
2472 l2cap_conn_start(conn);
2473
2474 return 0;
2475 }
2476
984947dc 2477 if (type == L2CAP_IT_FEAT_MASK) {
83985319 2478 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 2479
47ec1dcd 2480 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 2481 struct l2cap_info_req req;
2482 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2483
2484 conn->info_ident = l2cap_get_ident(conn);
2485
2486 l2cap_send_cmd(conn, conn->info_ident,
2487 L2CAP_INFO_REQ, sizeof(req), &req);
2488 } else {
2489 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2490 conn->info_ident = 0;
2491
2492 l2cap_conn_start(conn);
2493 }
2494 } else if (type == L2CAP_IT_FIXED_CHAN) {
984947dc 2495 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2496 conn->info_ident = 0;
984947dc
MH		 2497
2498 l2cap_conn_start(conn);
2499 }
4e8402a3 2500
1da177e4
LT		 2501 return 0;
2502}
2503
3300d9a9
CT		 2504static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2505 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
2506{
2507 int err = 0;
2508
2509 switch (cmd->code) {
2510 case L2CAP_COMMAND_REJ:
2511 l2cap_command_rej(conn, cmd, data);
2512 break;
2513
2514 case L2CAP_CONN_REQ:
2515 err = l2cap_connect_req(conn, cmd, data);
2516 break;
2517
2518 case L2CAP_CONN_RSP:
2519 err = l2cap_connect_rsp(conn, cmd, data);
2520 break;
2521
2522 case L2CAP_CONF_REQ:
2523 err = l2cap_config_req(conn, cmd, cmd_len, data);
2524 break;
2525
2526 case L2CAP_CONF_RSP:
2527 err = l2cap_config_rsp(conn, cmd, data);
2528 break;
2529
2530 case L2CAP_DISCONN_REQ:
2531 err = l2cap_disconnect_req(conn, cmd, data);
2532 break;
2533
2534 case L2CAP_DISCONN_RSP:
2535 err = l2cap_disconnect_rsp(conn, cmd, data);
2536 break;
2537
2538 case L2CAP_ECHO_REQ:
2539 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
2540 break;
2541
2542 case L2CAP_ECHO_RSP:
2543 break;
2544
2545 case L2CAP_INFO_REQ:
2546 err = l2cap_information_req(conn, cmd, data);
2547 break;
2548
2549 case L2CAP_INFO_RSP:
2550 err = l2cap_information_rsp(conn, cmd, data);
2551 break;
2552
2553 default:
2554 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
2555 err = -EINVAL;
2556 break;
2557 }
2558
2559 return err;
2560}
2561
2562static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
2563 struct l2cap_cmd_hdr *cmd, u8 *data)
2564{
2565 switch (cmd->code) {
2566 case L2CAP_COMMAND_REJ:
2567 return 0;
2568
2569 case L2CAP_CONN_PARAM_UPDATE_REQ:
2570 return -EINVAL;
2571
2572 case L2CAP_CONN_PARAM_UPDATE_RSP:
2573 return 0;
2574
2575 default:
2576 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
2577 return -EINVAL;
2578 }
2579}
2580
2581static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2582 struct sk_buff *skb)
1da177e4
LT		 2583{
2584 u8 *data = skb->data;
2585 int len = skb->len;
2586 struct l2cap_cmd_hdr cmd;
3300d9a9 2587 int err;
1da177e4
LT		 2588
2589 l2cap_raw_recv(conn, skb);
2590
2591 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 2592 u16 cmd_len;
1da177e4
LT		 2593 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
2594 data += L2CAP_CMD_HDR_SIZE;
2595 len -= L2CAP_CMD_HDR_SIZE;
2596
88219a0f 2597 cmd_len = le16_to_cpu(cmd.len);
1da177e4 2598
88219a0f 2599 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 2600
88219a0f 2601 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 2602 BT_DBG("corrupted command");
2603 break;
2604 }
2605
3300d9a9
CT		 2606 if (conn->hcon->type == LE_LINK)
2607 err = l2cap_le_sig_cmd(conn, &cmd, data);
2608 else
2609 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 2610
2611 if (err) {
2612 struct l2cap_cmd_rej rej;
2613 BT_DBG("error %d", err);
2614
2615 /* FIXME: Map err to a valid reason */
aca3192c 2616 rej.reason = cpu_to_le16(0);
1da177e4
LT		 2617 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
2618 }
2619
88219a0f
AV		 2620 data += cmd_len;
2621 len -= cmd_len;
1da177e4
LT		 2622 }
2623
2624 kfree_skb(skb);
2625}
2626
fcc203c3
GP		 2627static int l2cap_check_fcs(struct l2cap_pinfo *pi, struct sk_buff *skb)
2628{
2629 u16 our_fcs, rcv_fcs;
2630 int hdr_size = L2CAP_HDR_SIZE + 2;
2631
2632 if (pi->fcs == L2CAP_FCS_CRC16) {
2633 skb_trim(skb, skb->len - 2);
2634 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
2635 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
2636
2637 if (our_fcs != rcv_fcs)
7a560e5c 2638 return -EBADMSG;
fcc203c3
GP		 2639 }
2640 return 0;
2641}
2642
d5392c8f
GP		 2643static inline void l2cap_send_i_or_rr_or_rnr(struct sock *sk)
2644{
2645 struct l2cap_pinfo *pi = l2cap_pi(sk);
2646 u16 control = 0;
2647
2648 pi->frames_sent = 0;
d5392c8f
GP		 2649
2650 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
2651
2652 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
64988868 2653 control |= L2CAP_SUPER_RCV_NOT_READY;
d5392c8f 2654 l2cap_send_sframe(pi, control);
1890d36b 2655 pi->conn_state |= L2CAP_CONN_RNR_SENT;
d5392c8f
GP		 2656 }
2657
4ea727ef
GP		 2658 if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
2659 l2cap_retransmit_frames(sk);
d5392c8f
GP		 2660
2661 l2cap_ertm_send(sk);
2662
2663 if (!(pi->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
2664 pi->frames_sent == 0) {
2665 control |= L2CAP_SUPER_RCV_READY;
d5392c8f
GP		 2666 l2cap_send_sframe(pi, control);
2667 }
2668}
2669
9b53350d 2670static int l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
8f17154f
GP		 2671{
2672 struct sk_buff *next_skb;
bfbacc11
JPRV		 2673 struct l2cap_pinfo *pi = l2cap_pi(sk);
2674 int tx_seq_offset, next_tx_seq_offset;
8f17154f
GP		 2675
2676 bt_cb(skb)->tx_seq = tx_seq;
2677 bt_cb(skb)->sar = sar;
2678
2679 next_skb = skb_peek(SREJ_QUEUE(sk));
2680 if (!next_skb) {
2681 __skb_queue_tail(SREJ_QUEUE(sk), skb);
9b53350d 2682 return 0;
8f17154f
GP		 2683 }
2684
bfbacc11
JPRV		 2685 tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
2686 if (tx_seq_offset < 0)
2687 tx_seq_offset += 64;
2688
8f17154f 2689 do {
9b53350d
JPRV		 2690 if (bt_cb(next_skb)->tx_seq == tx_seq)
2691 return -EINVAL;
2692
bfbacc11
JPRV		 2693 next_tx_seq_offset = (bt_cb(next_skb)->tx_seq -
2694 pi->buffer_seq) % 64;
2695 if (next_tx_seq_offset < 0)
2696 next_tx_seq_offset += 64;
2697
2698 if (next_tx_seq_offset > tx_seq_offset) {
8f17154f 2699 __skb_queue_before(SREJ_QUEUE(sk), next_skb, skb);
9b53350d 2700 return 0;
8f17154f
GP		 2701 }
2702
2703 if (skb_queue_is_last(SREJ_QUEUE(sk), next_skb))
2704 break;
2705
59203a21 2706 } while ((next_skb = skb_queue_next(SREJ_QUEUE(sk), next_skb)));
8f17154f
GP		 2707
2708 __skb_queue_tail(SREJ_QUEUE(sk), skb);
9b53350d
JPRV		 2709
2710 return 0;
8f17154f
GP		 2711}
2712
18778a63
GP		 2713static int l2cap_ertm_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
2714{
2715 struct l2cap_pinfo *pi = l2cap_pi(sk);
2716 struct sk_buff *_skb;
1890d36b 2717 int err;
18778a63
GP		 2718
2719 switch (control & L2CAP_CTRL_SAR) {
2720 case L2CAP_SDU_UNSEGMENTED:
2721 if (pi->conn_state & L2CAP_CONN_SAR_SDU)
2722 goto drop;
2723
2724 err = sock_queue_rcv_skb(sk, skb);
2725 if (!err)
2726 return err;
2727
2728 break;
2729
2730 case L2CAP_SDU_START:
2731 if (pi->conn_state & L2CAP_CONN_SAR_SDU)
2732 goto drop;
2733
2734 pi->sdu_len = get_unaligned_le16(skb->data);
18778a63
GP		 2735
2736 if (pi->sdu_len > pi->imtu)
2737 goto disconnect;
2738
2739 pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
1890d36b
GP		 2740 if (!pi->sdu)
2741 return -ENOMEM;
2742
2743 /* pull sdu_len bytes only after alloc, because of Local Busy
2744 * condition we have to be sure that this will be executed
2745 * only once, i.e., when alloc does not fail */
2746 skb_pull(skb, 2);
18778a63
GP		 2747
2748 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
2749
2750 pi->conn_state |= L2CAP_CONN_SAR_SDU;
2751 pi->partial_sdu_len = skb->len;
2752 break;
2753
2754 case L2CAP_SDU_CONTINUE:
2755 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
2756 goto disconnect;
2757
2758 if (!pi->sdu)
2759 goto disconnect;
2760
18778a63
GP		 2761 pi->partial_sdu_len += skb->len;
2762 if (pi->partial_sdu_len > pi->sdu_len)
2763 goto drop;
2764
4178ba46
GP		 2765 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
2766
18778a63
GP		 2767 break;
2768
2769 case L2CAP_SDU_END:
2770 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
2771 goto disconnect;
2772
2773 if (!pi->sdu)
2774 goto disconnect;
2775
1890d36b 2776 if (!(pi->conn_state & L2CAP_CONN_SAR_RETRY)) {
1890d36b 2777 pi->partial_sdu_len += skb->len;
18778a63 2778
1890d36b
GP		 2779 if (pi->partial_sdu_len > pi->imtu)
2780 goto drop;
18778a63 2781
1890d36b
GP		 2782 if (pi->partial_sdu_len != pi->sdu_len)
2783 goto drop;
4178ba46
GP		 2784
2785 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
1890d36b 2786 }
18778a63
GP		 2787
2788 _skb = skb_clone(pi->sdu, GFP_ATOMIC);
1890d36b
GP		 2789 if (!_skb) {
2790 pi->conn_state |= L2CAP_CONN_SAR_RETRY;
2791 return -ENOMEM;
2792 }
2793
18778a63 2794 err = sock_queue_rcv_skb(sk, _skb);
1890d36b 2795 if (err < 0) {
18778a63 2796 kfree_skb(_skb);
1890d36b
GP		 2797 pi->conn_state |= L2CAP_CONN_SAR_RETRY;
2798 return err;
2799 }
2800
2801 pi->conn_state &= ~L2CAP_CONN_SAR_RETRY;
2802 pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
18778a63
GP		 2803
2804 kfree_skb(pi->sdu);
2805 break;
2806 }
2807
2808 kfree_skb(skb);
1890d36b 2809 return 0;
18778a63
GP		 2810
2811drop:
2812 kfree_skb(pi->sdu);
2813 pi->sdu = NULL;
2814
2815disconnect:
9b108fc0 2816 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
18778a63
GP		 2817 kfree_skb(skb);
2818 return 0;
2819}
2820
712132eb
GP		 2821static int l2cap_try_push_rx_skb(struct sock *sk)
2822{
2823 struct l2cap_pinfo *pi = l2cap_pi(sk);
2824 struct sk_buff *skb;
2825 u16 control;
2826 int err;
2827
2828 while ((skb = skb_dequeue(BUSY_QUEUE(sk)))) {
2829 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
2830 err = l2cap_ertm_reassembly_sdu(sk, skb, control);
2831 if (err < 0) {
2832 skb_queue_head(BUSY_QUEUE(sk), skb);
2833 return -EBUSY;
2834 }
2835
2836 pi->buffer_seq = (pi->buffer_seq + 1) % 64;
2837 }
2838
2839 if (!(pi->conn_state & L2CAP_CONN_RNR_SENT))
2840 goto done;
2841
2842 control = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
2843 control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
2844 l2cap_send_sframe(pi, control);
2845 l2cap_pi(sk)->retry_count = 1;
2846
2847 del_timer(&pi->retrans_timer);
2848 __mod_monitor_timer();
2849
2850 l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
2851
2852done:
2853 pi->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
2854 pi->conn_state &= ~L2CAP_CONN_RNR_SENT;
2855
2856 BT_DBG("sk %p, Exit local busy", sk);
2857
2858 return 0;
2859}
2860
1890d36b
GP		 2861static void l2cap_busy_work(struct work_struct *work)
2862{
2863 DECLARE_WAITQUEUE(wait, current);
2864 struct l2cap_pinfo *pi =
2865 container_of(work, struct l2cap_pinfo, busy_work);
2866 struct sock *sk = (struct sock *)pi;
2867 int n_tries = 0, timeo = HZ/5, err;
2868 struct sk_buff *skb;
1890d36b
GP		 2869
2870 lock_sock(sk);
2871
2b0b05dd 2872 add_wait_queue(sk_sleep(sk), &wait);
1890d36b
GP		 2873 while ((skb = skb_peek(BUSY_QUEUE(sk)))) {
2874 set_current_state(TASK_INTERRUPTIBLE);
2875
2876 if (n_tries++ > L2CAP_LOCAL_BUSY_TRIES) {
2877 err = -EBUSY;
9b108fc0 2878 l2cap_send_disconn_req(pi->conn, sk, EBUSY);
712132eb 2879 break;
1890d36b
GP		 2880 }
2881
2882 if (!timeo)
2883 timeo = HZ/5;
2884
2885 if (signal_pending(current)) {
2886 err = sock_intr_errno(timeo);
712132eb 2887 break;
1890d36b
GP		 2888 }
2889
2890 release_sock(sk);
2891 timeo = schedule_timeout(timeo);
2892 lock_sock(sk);
2893
2894 err = sock_error(sk);
2895 if (err)
712132eb 2896 break;
1890d36b 2897
712132eb 2898 if (l2cap_try_push_rx_skb(sk) == 0)
1890d36b
GP		 2899 break;
2900 }
2901
1890d36b 2902 set_current_state(TASK_RUNNING);
2b0b05dd 2903 remove_wait_queue(sk_sleep(sk), &wait);
1890d36b
GP		 2904
2905 release_sock(sk);
2906}
2907
2908static int l2cap_push_rx_skb(struct sock *sk, struct sk_buff *skb, u16 control)
2909{
2910 struct l2cap_pinfo *pi = l2cap_pi(sk);
2911 int sctrl, err;
2912
2913 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
2914 bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
2915 __skb_queue_tail(BUSY_QUEUE(sk), skb);
712132eb
GP		 2916 return l2cap_try_push_rx_skb(sk);
2917
2918
1890d36b
GP		 2919 }
2920
2921 err = l2cap_ertm_reassembly_sdu(sk, skb, control);
2922 if (err >= 0) {
2923 pi->buffer_seq = (pi->buffer_seq + 1) % 64;
2924 return err;
2925 }
2926
2927 /* Busy Condition */
0e98958d
GP		 2928 BT_DBG("sk %p, Enter local busy", sk);
2929
1890d36b
GP		 2930 pi->conn_state |= L2CAP_CONN_LOCAL_BUSY;
2931 bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
2932 __skb_queue_tail(BUSY_QUEUE(sk), skb);
2933
2934 sctrl = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
2935 sctrl |= L2CAP_SUPER_RCV_NOT_READY;
2936 l2cap_send_sframe(pi, sctrl);
2937
2938 pi->conn_state |= L2CAP_CONN_RNR_SENT;
2939
7fe9b298
GP		 2940 del_timer(&pi->ack_timer);
2941
1890d36b
GP		 2942 queue_work(_busy_wq, &pi->busy_work);
2943
2944 return err;
2945}
2946
18778a63 2947static int l2cap_streaming_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
c74e560c
GP		 2948{
2949 struct l2cap_pinfo *pi = l2cap_pi(sk);
2950 struct sk_buff *_skb;
2951 int err = -EINVAL;
2952
18778a63
GP		 2953 /*
2954 * TODO: We have to notify the userland if some data is lost with the
2955 * Streaming Mode.
2956 */
2957
c74e560c
GP		 2958 switch (control & L2CAP_CTRL_SAR) {
2959 case L2CAP_SDU_UNSEGMENTED:
2960 if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
2961 kfree_skb(pi->sdu);
2962 break;
2963 }
2964
2965 err = sock_queue_rcv_skb(sk, skb);
2966 if (!err)
2967 return 0;
2968
2969 break;
2970
2971 case L2CAP_SDU_START:
2972 if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
2973 kfree_skb(pi->sdu);
2974 break;
2975 }
2976
2977 pi->sdu_len = get_unaligned_le16(skb->data);
2978 skb_pull(skb, 2);
2979
052897ca
GP		 2980 if (pi->sdu_len > pi->imtu) {
2981 err = -EMSGSIZE;
2982 break;
2983 }
2984
c74e560c
GP		 2985 pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
2986 if (!pi->sdu) {
2987 err = -ENOMEM;
2988 break;
2989 }
2990
2991 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
2992
2993 pi->conn_state |= L2CAP_CONN_SAR_SDU;
2994 pi->partial_sdu_len = skb->len;
2995 err = 0;
2996 break;
2997
2998 case L2CAP_SDU_CONTINUE:
2999 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3000 break;
3001
3002 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3003
3004 pi->partial_sdu_len += skb->len;
3005 if (pi->partial_sdu_len > pi->sdu_len)
3006 kfree_skb(pi->sdu);
3007 else
3008 err = 0;
3009
3010 break;
3011
3012 case L2CAP_SDU_END:
3013 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3014 break;
3015
3016 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3017
3018 pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
3019 pi->partial_sdu_len += skb->len;
3020
36f2fd58
GP		 3021 if (pi->partial_sdu_len > pi->imtu)
3022 goto drop;
3023
c74e560c
GP		 3024 if (pi->partial_sdu_len == pi->sdu_len) {
3025 _skb = skb_clone(pi->sdu, GFP_ATOMIC);
3026 err = sock_queue_rcv_skb(sk, _skb);
3027 if (err < 0)
3028 kfree_skb(_skb);
3029 }
c74e560c
GP		 3030 err = 0;
3031
36f2fd58
GP		 3032drop:
3033 kfree_skb(pi->sdu);
c74e560c
GP		 3034 break;
3035 }
3036
3037 kfree_skb(skb);
3038 return err;
3039}
3040
8f17154f
GP		 3041static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
3042{
3043 struct sk_buff *skb;
afefdbc4 3044 u16 control;
8f17154f 3045
59203a21 3046 while ((skb = skb_peek(SREJ_QUEUE(sk)))) {
8f17154f
GP		 3047 if (bt_cb(skb)->tx_seq != tx_seq)
3048 break;
3049
3050 skb = skb_dequeue(SREJ_QUEUE(sk));
afefdbc4 3051 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
18778a63 3052 l2cap_ertm_reassembly_sdu(sk, skb, control);
8f17154f
GP		 3053 l2cap_pi(sk)->buffer_seq_srej =
3054 (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
8ff50ec0 3055 tx_seq = (tx_seq + 1) % 64;
8f17154f
GP		 3056 }
3057}
3058
3059static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
3060{
3061 struct l2cap_pinfo *pi = l2cap_pi(sk);
3062 struct srej_list *l, *tmp;
3063 u16 control;
3064
59203a21 3065 list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
8f17154f
GP		 3066 if (l->tx_seq == tx_seq) {
3067 list_del(&l->list);
3068 kfree(l);
3069 return;
3070 }
3071 control = L2CAP_SUPER_SELECT_REJECT;
3072 control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3073 l2cap_send_sframe(pi, control);
3074 list_del(&l->list);
3075 list_add_tail(&l->list, SREJ_LIST(sk));
3076 }
3077}
3078
3079static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
3080{
3081 struct l2cap_pinfo *pi = l2cap_pi(sk);
3082 struct srej_list *new;
3083 u16 control;
3084
3085 while (tx_seq != pi->expected_tx_seq) {
3086 control = L2CAP_SUPER_SELECT_REJECT;
3087 control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3088 l2cap_send_sframe(pi, control);
3089
3090 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
8ff50ec0
GP		 3091 new->tx_seq = pi->expected_tx_seq;
3092 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
8f17154f
GP		 3093 list_add_tail(&new->list, SREJ_LIST(sk));
3094 }
8ff50ec0 3095 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
8f17154f
GP		 3096}
3097
1c2acffb
GP		 3098static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
3099{
3100 struct l2cap_pinfo *pi = l2cap_pi(sk);
3101 u8 tx_seq = __get_txseq(rx_control);
9f121a5a 3102 u8 req_seq = __get_reqseq(rx_control);
8f17154f 3103 u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
f6337c77 3104 int tx_seq_offset, expected_tx_seq_offset;
803020c6 3105 int num_to_ack = (pi->tx_win/6) + 1;
1c2acffb
GP		 3106 int err = 0;
3107
0e98958d
GP		 3108 BT_DBG("sk %p len %d tx_seq %d rx_control 0x%4.4x", sk, skb->len, tx_seq,
3109 rx_control);
1c2acffb 3110
9b16dc65
GP		 3111 if (L2CAP_CTRL_FINAL & rx_control &&
3112 l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
1d8f5d16
GP		 3113 del_timer(&pi->monitor_timer);
3114 if (pi->unacked_frames > 0)
3115 __mod_retrans_timer();
3116 pi->conn_state &= ~L2CAP_CONN_WAIT_F;
3117 }
3118
9f121a5a
GP		 3119 pi->expected_ack_seq = req_seq;
3120 l2cap_drop_acked_frames(sk);
3121
8f17154f
GP		 3122 if (tx_seq == pi->expected_tx_seq)
3123 goto expected;
1c2acffb 3124
9b53350d
JPRV		 3125 tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
3126 if (tx_seq_offset < 0)
3127 tx_seq_offset += 64;
3128
3129 /* invalid tx_seq */
3130 if (tx_seq_offset >= pi->tx_win) {
9b108fc0 3131 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
9b53350d
JPRV		 3132 goto drop;
3133 }
3134
1890d36b
GP		 3135 if (pi->conn_state == L2CAP_CONN_LOCAL_BUSY)
3136 goto drop;
3137
8f17154f
GP		 3138 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3139 struct srej_list *first;
30afb5b2 3140
8f17154f
GP		 3141 first = list_first_entry(SREJ_LIST(sk),
3142 struct srej_list, list);
3143 if (tx_seq == first->tx_seq) {
3144 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
3145 l2cap_check_srej_gap(sk, tx_seq);
3146
3147 list_del(&first->list);
3148 kfree(first);
3149
3150 if (list_empty(SREJ_LIST(sk))) {
3151 pi->buffer_seq = pi->buffer_seq_srej;
3152 pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
855666cc 3153 l2cap_send_ack(pi);
0e98958d 3154 BT_DBG("sk %p, Exit SREJ_SENT", sk);
8f17154f
GP		 3155 }
3156 } else {
3157 struct srej_list *l;
9b53350d
JPRV		 3158
3159 /* duplicated tx_seq */
3160 if (l2cap_add_to_srej_queue(sk, skb, tx_seq, sar) < 0)
3161 goto drop;
8f17154f
GP		 3162
3163 list_for_each_entry(l, SREJ_LIST(sk), list) {
3164 if (l->tx_seq == tx_seq) {
3165 l2cap_resend_srejframe(sk, tx_seq);
3166 return 0;
3167 }
3168 }
3169 l2cap_send_srejframe(sk, tx_seq);
30afb5b2
GP		 3170 }
3171 } else {
9b53350d
JPRV		 3172 expected_tx_seq_offset =
3173 (pi->expected_tx_seq - pi->buffer_seq) % 64;
3174 if (expected_tx_seq_offset < 0)
3175 expected_tx_seq_offset += 64;
3176
3177 /* duplicated tx_seq */
3178 if (tx_seq_offset < expected_tx_seq_offset)
3179 goto drop;
3180
8f17154f 3181 pi->conn_state |= L2CAP_CONN_SREJ_SENT;
1c2acffb 3182
0e98958d
GP		 3183 BT_DBG("sk %p, Enter SREJ", sk);
3184
8f17154f
GP		 3185 INIT_LIST_HEAD(SREJ_LIST(sk));
3186 pi->buffer_seq_srej = pi->buffer_seq;
3187
3188 __skb_queue_head_init(SREJ_QUEUE(sk));
1890d36b 3189 __skb_queue_head_init(BUSY_QUEUE(sk));
8f17154f
GP		 3190 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
3191
ef54fd93
GP		 3192 pi->conn_state |= L2CAP_CONN_SEND_PBIT;
3193
8f17154f 3194 l2cap_send_srejframe(sk, tx_seq);
7fe9b298
GP		 3195
3196 del_timer(&pi->ack_timer);
1c2acffb 3197 }
30afb5b2
GP		 3198 return 0;
3199
8f17154f
GP		 3200expected:
3201 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
3202
3203 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3b1a9f3f
GP		 3204 bt_cb(skb)->tx_seq = tx_seq;
3205 bt_cb(skb)->sar = sar;
3206 __skb_queue_tail(SREJ_QUEUE(sk), skb);
8f17154f
GP		 3207 return 0;
3208 }
3209
2ece3684
GP		 3210 err = l2cap_push_rx_skb(sk, skb, rx_control);
3211 if (err < 0)
3212 return 0;
3213
4ec10d97
GP		 3214 if (rx_control & L2CAP_CTRL_FINAL) {
3215 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
3216 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
dfc909be
GP		 3217 else
3218 l2cap_retransmit_frames(sk);
4ec10d97
GP		 3219 }
3220
c1b4f43b
GP		 3221 __mod_ack_timer();
3222
803020c6
GP		 3223 pi->num_acked = (pi->num_acked + 1) % num_to_ack;
3224 if (pi->num_acked == num_to_ack - 1)
9e917af1
GP		 3225 l2cap_send_ack(pi);
3226
8f17154f 3227 return 0;
9b53350d
JPRV		 3228
3229drop:
3230 kfree_skb(skb);
3231 return 0;
1c2acffb
GP		 3232}
3233
e072745f 3234static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
1c2acffb
GP		 3235{
3236 struct l2cap_pinfo *pi = l2cap_pi(sk);
6e3a5981 3237
0e98958d
GP		 3238 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, __get_reqseq(rx_control),
3239 rx_control);
3240
6e3a5981
GP		 3241 pi->expected_ack_seq = __get_reqseq(rx_control);
3242 l2cap_drop_acked_frames(sk);
1c2acffb 3243
e072745f 3244 if (rx_control & L2CAP_CTRL_POLL) {
3cb123d1 3245 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
05fbd89d
GP		 3246 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3247 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
3248 (pi->unacked_frames > 0))
3249 __mod_retrans_timer();
3250
3251 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
3252 l2cap_send_srejtail(sk);
3253 } else {
3254 l2cap_send_i_or_rr_or_rnr(sk);
05fbd89d 3255 }
1d8f5d16 3256
e072745f
GP		 3257 } else if (rx_control & L2CAP_CTRL_FINAL) {
3258 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
4ec10d97 3259
e072745f
GP		 3260 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
3261 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
dfc909be
GP		 3262 else
3263 l2cap_retransmit_frames(sk);
2246b2f1 3264
e072745f 3265 } else {
e072745f
GP		 3266 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
3267 (pi->unacked_frames > 0))
3268 __mod_retrans_timer();
1c2acffb 3269
2246b2f1 3270 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
894718a6 3271 if (pi->conn_state & L2CAP_CONN_SREJ_SENT)
e072745f 3272 l2cap_send_ack(pi);
894718a6 3273 else
e072745f
GP		 3274 l2cap_ertm_send(sk);
3275 }
3276}
2246b2f1 3277
e072745f
GP		 3278static inline void l2cap_data_channel_rejframe(struct sock *sk, u16 rx_control)
3279{
3280 struct l2cap_pinfo *pi = l2cap_pi(sk);
3281 u8 tx_seq = __get_reqseq(rx_control);
30afb5b2 3282
0e98958d
GP		 3283 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
3284
e072745f
GP		 3285 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
3286
8abb52ee 3287 pi->expected_ack_seq = tx_seq;
e072745f
GP		 3288 l2cap_drop_acked_frames(sk);
3289
3290 if (rx_control & L2CAP_CTRL_FINAL) {
3291 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
3292 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
dfc909be
GP		 3293 else
3294 l2cap_retransmit_frames(sk);
e072745f 3295 } else {
dfc909be 3296 l2cap_retransmit_frames(sk);
30afb5b2 3297
0301ef04 3298 if (pi->conn_state & L2CAP_CONN_WAIT_F)
e072745f 3299 pi->conn_state |= L2CAP_CONN_REJ_ACT;
e072745f
GP		 3300 }
3301}
3302static inline void l2cap_data_channel_srejframe(struct sock *sk, u16 rx_control)
3303{
3304 struct l2cap_pinfo *pi = l2cap_pi(sk);
3305 u8 tx_seq = __get_reqseq(rx_control);
30afb5b2 3306
0e98958d
GP		 3307 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
3308
e072745f 3309 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
2246b2f1 3310
e072745f
GP		 3311 if (rx_control & L2CAP_CTRL_POLL) {
3312 pi->expected_ack_seq = tx_seq;
3313 l2cap_drop_acked_frames(sk);
3cb123d1
GP		 3314
3315 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
dfc909be
GP		 3316 l2cap_retransmit_one_frame(sk, tx_seq);
3317
e072745f 3318 l2cap_ertm_send(sk);
dfc909be 3319
e072745f
GP		 3320 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
3321 pi->srej_save_reqseq = tx_seq;
3322 pi->conn_state |= L2CAP_CONN_SREJ_ACT;
ef54fd93 3323 }
e072745f
GP		 3324 } else if (rx_control & L2CAP_CTRL_FINAL) {
3325 if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
3326 pi->srej_save_reqseq == tx_seq)
3327 pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
3328 else
dfc909be 3329 l2cap_retransmit_one_frame(sk, tx_seq);
e072745f 3330 } else {
dfc909be 3331 l2cap_retransmit_one_frame(sk, tx_seq);
e072745f
GP		 3332 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
3333 pi->srej_save_reqseq = tx_seq;
3334 pi->conn_state |= L2CAP_CONN_SREJ_ACT;
ef54fd93 3335 }
e072745f
GP		 3336 }
3337}
3338
3339static inline void l2cap_data_channel_rnrframe(struct sock *sk, u16 rx_control)
3340{
3341 struct l2cap_pinfo *pi = l2cap_pi(sk);
3342 u8 tx_seq = __get_reqseq(rx_control);
3343
0e98958d
GP		 3344 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
3345
e072745f
GP		 3346 pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
3347 pi->expected_ack_seq = tx_seq;
3348 l2cap_drop_acked_frames(sk);
3349
3cb123d1
GP		 3350 if (rx_control & L2CAP_CTRL_POLL)
3351 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
3352
99b0d4b7
GP		 3353 if (!(pi->conn_state & L2CAP_CONN_SREJ_SENT)) {
3354 del_timer(&pi->retrans_timer);
a2e12a2a
GP		 3355 if (rx_control & L2CAP_CTRL_POLL)
3356 l2cap_send_rr_or_rnr(pi, L2CAP_CTRL_FINAL);
99b0d4b7 3357 return;
e072745f 3358 }
99b0d4b7
GP		 3359
3360 if (rx_control & L2CAP_CTRL_POLL)
3361 l2cap_send_srejtail(sk);
3362 else
3363 l2cap_send_sframe(pi, L2CAP_SUPER_RCV_READY);
e072745f
GP		 3364}
3365
3366static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
3367{
3368 BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
3369
9b16dc65
GP		 3370 if (L2CAP_CTRL_FINAL & rx_control &&
3371 l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
e072745f
GP		 3372 del_timer(&l2cap_pi(sk)->monitor_timer);
3373 if (l2cap_pi(sk)->unacked_frames > 0)
3374 __mod_retrans_timer();
3375 l2cap_pi(sk)->conn_state &= ~L2CAP_CONN_WAIT_F;
3376 }
3377
3378 switch (rx_control & L2CAP_CTRL_SUPERVISE) {
3379 case L2CAP_SUPER_RCV_READY:
3380 l2cap_data_channel_rrframe(sk, rx_control);
8f17154f
GP		 3381 break;
3382
e072745f
GP		 3383 case L2CAP_SUPER_REJECT:
3384 l2cap_data_channel_rejframe(sk, rx_control);
3385 break;
2246b2f1 3386
e072745f
GP		 3387 case L2CAP_SUPER_SELECT_REJECT:
3388 l2cap_data_channel_srejframe(sk, rx_control);
3389 break;
3390
3391 case L2CAP_SUPER_RCV_NOT_READY:
3392 l2cap_data_channel_rnrframe(sk, rx_control);
1c2acffb
GP		 3393 break;
3394 }
3395
faaebd19 3396 kfree_skb(skb);
1c2acffb
GP		 3397 return 0;
3398}
3399
218bb9df
GP		 3400static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
3401{
3402 struct l2cap_pinfo *pi = l2cap_pi(sk);
3403 u16 control;
3404 u8 req_seq;
3405 int len, next_tx_seq_offset, req_seq_offset;
3406
3407 control = get_unaligned_le16(skb->data);
3408 skb_pull(skb, 2);
3409 len = skb->len;
3410
3411 /*
3412 * We can just drop the corrupted I-frame here.
3413 * Receiver will miss it and start proper recovery
3414 * procedures and ask retransmission.
3415 */
3416 if (l2cap_check_fcs(pi, skb))
3417 goto drop;
3418
3419 if (__is_sar_start(control) && __is_iframe(control))
3420 len -= 2;
3421
3422 if (pi->fcs == L2CAP_FCS_CRC16)
3423 len -= 2;
3424
3425 if (len > pi->mps) {
3426 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
3427 goto drop;
3428 }
3429
3430 req_seq = __get_reqseq(control);
3431 req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
3432 if (req_seq_offset < 0)
3433 req_seq_offset += 64;
3434
3435 next_tx_seq_offset =
3436 (pi->next_tx_seq - pi->expected_ack_seq) % 64;
3437 if (next_tx_seq_offset < 0)
3438 next_tx_seq_offset += 64;
3439
3440 /* check for invalid req-seq */
3441 if (req_seq_offset > next_tx_seq_offset) {
3442 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
3443 goto drop;
3444 }
3445
3446 if (__is_iframe(control)) {
3447 if (len < 0) {
3448 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
3449 goto drop;
3450 }
3451
3452 l2cap_data_channel_iframe(sk, control, skb);
3453 } else {
3454 if (len != 0) {
3455 BT_ERR("%d", len);
3456 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
3457 goto drop;
3458 }
3459
3460 l2cap_data_channel_sframe(sk, control, skb);
3461 }
3462
3463 return 0;
3464
3465drop:
3466 kfree_skb(skb);
3467 return 0;
3468}
3469
1da177e4
LT		 3470static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
3471{
3472 struct sock *sk;
6840ed07 3473 struct l2cap_pinfo *pi;
51893f88 3474 u16 control;
218bb9df
GP		 3475 u8 tx_seq;
3476 int len;
1da177e4
LT		 3477
3478 sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
3479 if (!sk) {
3480 BT_DBG("unknown cid 0x%4.4x", cid);
3481 goto drop;
3482 }
3483
6840ed07
GP		 3484 pi = l2cap_pi(sk);
3485
1da177e4
LT		 3486 BT_DBG("sk %p, len %d", sk, skb->len);
3487
3488 if (sk->sk_state != BT_CONNECTED)
3489 goto drop;
3490
6840ed07 3491 switch (pi->mode) {
1c2acffb
GP		 3492 case L2CAP_MODE_BASIC:
3493 /* If socket recv buffers overflows we drop data here
3494 * which is *bad* because L2CAP has to be reliable.
3495 * But we don't have any other choice. L2CAP doesn't
3496 * provide flow control mechanism. */
1da177e4 3497
6840ed07 3498 if (pi->imtu < skb->len)
1c2acffb 3499 goto drop;
1da177e4 3500
1c2acffb
GP		 3501 if (!sock_queue_rcv_skb(sk, skb))
3502 goto done;
3503 break;
3504
3505 case L2CAP_MODE_ERTM:
218bb9df
GP		 3506 if (!sock_owned_by_user(sk)) {
3507 l2cap_ertm_data_rcv(sk, skb);
277ffbe3 3508 } else {
218bb9df 3509 if (sk_add_backlog(sk, skb))
277ffbe3 3510 goto drop;
277ffbe3 3511 }
1c2acffb 3512
fcafde2e 3513 goto done;
1c2acffb 3514
6840ed07
GP		 3515 case L2CAP_MODE_STREAMING:
3516 control = get_unaligned_le16(skb->data);
3517 skb_pull(skb, 2);
3518 len = skb->len;
3519
26000089
GP		 3520 if (l2cap_check_fcs(pi, skb))
3521 goto drop;
3522
6840ed07
GP		 3523 if (__is_sar_start(control))
3524 len -= 2;
3525
fcc203c3
GP		 3526 if (pi->fcs == L2CAP_FCS_CRC16)
3527 len -= 2;
3528
51893f88 3529 if (len > pi->mps || len < 0 || __is_sframe(control))
6840ed07
GP		 3530 goto drop;
3531
3532 tx_seq = __get_txseq(control);
3533
3534 if (pi->expected_tx_seq == tx_seq)
3535 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
3536 else
7dffe421 3537 pi->expected_tx_seq = (tx_seq + 1) % 64;
6840ed07 3538
18778a63 3539 l2cap_streaming_reassembly_sdu(sk, skb, control);
6840ed07
GP		 3540
3541 goto done;
3542
1c2acffb 3543 default:
e8235c6b 3544 BT_DBG("sk %p: bad mode 0x%2.2x", sk, pi->mode);
1c2acffb
GP		 3545 break;
3546 }
1da177e4
LT		 3547
3548drop:
3549 kfree_skb(skb);
3550
3551done:
0139418c
MH		 3552 if (sk)
3553 bh_unlock_sock(sk);
3554
1da177e4
LT		 3555 return 0;
3556}
3557
8e036fc3 3558static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4
LT		 3559{
3560 struct sock *sk;
3561
3562 sk = l2cap_get_sock_by_psm(0, psm, conn->src);
3563 if (!sk)
3564 goto drop;
3565
e0f0cb56
GP		 3566 bh_lock_sock(sk);
3567
1da177e4
LT		 3568 BT_DBG("sk %p, len %d", sk, skb->len);
3569
3570 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
3571 goto drop;
3572
3573 if (l2cap_pi(sk)->imtu < skb->len)
3574 goto drop;
3575
3576 if (!sock_queue_rcv_skb(sk, skb))
3577 goto done;
3578
3579drop:
3580 kfree_skb(skb);
3581
3582done:
af05b30b
GP		 3583 if (sk)
3584 bh_unlock_sock(sk);
1da177e4
LT		 3585 return 0;
3586}
3587
3588static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
3589{
3590 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 3591 u16 cid, len;
3592 __le16 psm;
1da177e4
LT		 3593
3594 skb_pull(skb, L2CAP_HDR_SIZE);
3595 cid = __le16_to_cpu(lh->cid);
3596 len = __le16_to_cpu(lh->len);
3597
1c2acffb
GP		 3598 if (len != skb->len) {
3599 kfree_skb(skb);
3600 return;
3601 }
3602
1da177e4
LT		 3603 BT_DBG("len %d, cid 0x%4.4x", len, cid);
3604
3605 switch (cid) {
3300d9a9 3606 case L2CAP_CID_LE_SIGNALING:
8db4dc46 3607 case L2CAP_CID_SIGNALING:
1da177e4
LT		 3608 l2cap_sig_channel(conn, skb);
3609 break;
3610
8db4dc46 3611 case L2CAP_CID_CONN_LESS:
1b7bf4ed 3612 psm = get_unaligned_le16(skb->data);
1da177e4
LT		 3613 skb_pull(skb, 2);
3614 l2cap_conless_channel(conn, psm, skb);
3615 break;
3616
3617 default:
3618 l2cap_data_channel(conn, cid, skb);
3619 break;
3620 }
3621}
3622
3623/* ---- L2CAP interface with lower layer (HCI) ---- */
3624
3625static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3626{
3627 int exact = 0, lm1 = 0, lm2 = 0;
3628 register struct sock *sk;
3629 struct hlist_node *node;
3630
3631 if (type != ACL_LINK)
963cf687 3632 return -EINVAL;
1da177e4
LT		 3633
3634 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
3635
3636 /* Find listening sockets and check their link_mode */
3637 read_lock(&l2cap_sk_list.lock);
3638 sk_for_each(sk, node, &l2cap_sk_list.head) {
3639 if (sk->sk_state != BT_LISTEN)
3640 continue;
3641
3642 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5
MH		 3643 lm1 |= HCI_LM_ACCEPT;
3644 if (l2cap_pi(sk)->role_switch)
3645 lm1 |= HCI_LM_MASTER;
1da177e4 3646 exact++;
2af6b9d5
MH		 3647 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
3648 lm2 |= HCI_LM_ACCEPT;
3649 if (l2cap_pi(sk)->role_switch)
3650 lm2 |= HCI_LM_MASTER;
3651 }
1da177e4
LT		 3652 }
3653 read_unlock(&l2cap_sk_list.lock);
3654
3655 return exact ? lm1 : lm2;
3656}
3657
3658static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
3659{
0139418c
MH		 3660 struct l2cap_conn *conn;
3661
1da177e4
LT		 3662 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
3663
acd7d370 3664 if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
963cf687 3665 return -EINVAL;
1da177e4
LT		 3666
3667 if (!status) {
1da177e4
LT		 3668 conn = l2cap_conn_add(hcon, status);
3669 if (conn)
3670 l2cap_conn_ready(conn);
0139418c 3671 } else
1da177e4
LT		 3672 l2cap_conn_del(hcon, bt_err(status));
3673
3674 return 0;
3675}
3676
2950f21a
MH		 3677static int l2cap_disconn_ind(struct hci_conn *hcon)
3678{
3679 struct l2cap_conn *conn = hcon->l2cap_data;
3680
3681 BT_DBG("hcon %p", hcon);
3682
3683 if (hcon->type != ACL_LINK || !conn)
3684 return 0x13;
3685
3686 return conn->disc_reason;
3687}
3688
3689static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 3690{
3691 BT_DBG("hcon %p reason %d", hcon, reason);
3692
acd7d370 3693 if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
963cf687 3694 return -EINVAL;
1da177e4
LT		 3695
3696 l2cap_conn_del(hcon, bt_err(reason));
0139418c 3697
1da177e4
LT		 3698 return 0;
3699}
3700
f62e4323
MH		 3701static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
3702{
bd3c9e25 3703 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
255c7601
MH		 3704 return;
3705
f62e4323
MH		 3706 if (encrypt == 0x00) {
3707 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
3708 l2cap_sock_clear_timer(sk);
3709 l2cap_sock_set_timer(sk, HZ * 5);
3710 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
3711 __l2cap_sock_close(sk, ECONNREFUSED);
3712 } else {
3713 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
3714 l2cap_sock_clear_timer(sk);
3715 }
3716}
3717
8c1b2355 3718static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4
LT		 3719{
3720 struct l2cap_chan_list *l;
0139418c 3721 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4 3722 struct sock *sk;
1da177e4 3723
0139418c 3724 if (!conn)
1da177e4 3725 return 0;
0139418c 3726
1da177e4
LT		 3727 l = &conn->chan_list;
3728
3729 BT_DBG("conn %p", conn);
3730
3731 read_lock(&l->lock);
3732
3733 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
3734 bh_lock_sock(sk);
3735
6a8d3010
MH		 3736 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
3737 bh_unlock_sock(sk);
3738 continue;
3739 }
3740
f62e4323 3741 if (!status && (sk->sk_state == BT_CONNECTED ||
8c1b2355 3742 sk->sk_state == BT_CONFIG)) {
f62e4323 3743 l2cap_check_encryption(sk, encrypt);
9719f8af
MH		 3744 bh_unlock_sock(sk);
3745 continue;
3746 }
3747
b1235d79
MH		 3748 if (sk->sk_state == BT_CONNECT) {
3749 if (!status) {
3750 struct l2cap_conn_req req;
3751 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
3752 req.psm = l2cap_pi(sk)->psm;
1da177e4 3753
b1235d79 3754 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
e501d055 3755 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1da177e4 3756
b1235d79
MH		 3757 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
3758 L2CAP_CONN_REQ, sizeof(req), &req);
3759 } else {
3760 l2cap_sock_clear_timer(sk);
3761 l2cap_sock_set_timer(sk, HZ / 10);
3762 }
3763 } else if (sk->sk_state == BT_CONNECT2) {
3764 struct l2cap_conn_rsp rsp;
3765 __u16 result;
1da177e4 3766
b1235d79
MH		 3767 if (!status) {
3768 sk->sk_state = BT_CONFIG;
3769 result = L2CAP_CR_SUCCESS;
3770 } else {
3771 sk->sk_state = BT_DISCONN;
3772 l2cap_sock_set_timer(sk, HZ / 10);
3773 result = L2CAP_CR_SEC_BLOCK;
3774 }
3775
3776 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
3777 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
3778 rsp.result = cpu_to_le16(result);
e7c29cb1 3779 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
b1235d79
MH		 3780 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
3781 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
3782 }
1da177e4
LT		 3783
3784 bh_unlock_sock(sk);
3785 }
3786
3787 read_unlock(&l->lock);
b1235d79 3788
1da177e4
LT		 3789 return 0;
3790}
3791
3792static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
3793{
3794 struct l2cap_conn *conn = hcon->l2cap_data;
3795
5a08ecce
AE		 3796 if (!conn)
3797 conn = l2cap_conn_add(hcon, 0);
3798
3799 if (!conn)
1da177e4
LT		 3800 goto drop;
3801
3802 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
3803
e702112f 3804 if (!(flags & ACL_CONT)) {
1da177e4 3805 struct l2cap_hdr *hdr;
89794813
AE		 3806 struct sock *sk;
3807 u16 cid;
1da177e4
LT		 3808 int len;
3809
3810 if (conn->rx_len) {
3811 BT_ERR("Unexpected start frame (len %d)", skb->len);
3812 kfree_skb(conn->rx_skb);
3813 conn->rx_skb = NULL;
3814 conn->rx_len = 0;
3815 l2cap_conn_unreliable(conn, ECOMM);
3816 }
3817
aae7fe22
AE		 3818 /* Start fragment always begin with Basic L2CAP header */
3819 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 3820 BT_ERR("Frame is too short (len %d)", skb->len);
3821 l2cap_conn_unreliable(conn, ECOMM);
3822 goto drop;
3823 }
3824
3825 hdr = (struct l2cap_hdr *) skb->data;
3826 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 3827 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 3828
3829 if (len == skb->len) {
3830 /* Complete frame received */
3831 l2cap_recv_frame(conn, skb);
3832 return 0;
3833 }
3834
3835 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
3836
3837 if (skb->len > len) {
3838 BT_ERR("Frame is too long (len %d, expected len %d)",
3839 skb->len, len);
3840 l2cap_conn_unreliable(conn, ECOMM);
3841 goto drop;
3842 }
3843
89794813
AE		 3844 sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
3845
3846 if (sk && l2cap_pi(sk)->imtu < len - L2CAP_HDR_SIZE) {
3847 BT_ERR("Frame exceeding recv MTU (len %d, MTU %d)",
3848 len, l2cap_pi(sk)->imtu);
3849 bh_unlock_sock(sk);
3850 l2cap_conn_unreliable(conn, ECOMM);
3851 goto drop;
3852 }
3853
3854 if (sk)
3855 bh_unlock_sock(sk);
3856
1da177e4 3857 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 3858 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
3859 if (!conn->rx_skb)
1da177e4
LT		 3860 goto drop;
3861
d626f62b 3862 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 3863 skb->len);
1da177e4
LT		 3864 conn->rx_len = len - skb->len;
3865 } else {
3866 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
3867
3868 if (!conn->rx_len) {
3869 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
3870 l2cap_conn_unreliable(conn, ECOMM);
3871 goto drop;
3872 }
3873
3874 if (skb->len > conn->rx_len) {
3875 BT_ERR("Fragment is too long (len %d, expected %d)",
3876 skb->len, conn->rx_len);
3877 kfree_skb(conn->rx_skb);
3878 conn->rx_skb = NULL;
3879 conn->rx_len = 0;
3880 l2cap_conn_unreliable(conn, ECOMM);
3881 goto drop;
3882 }
3883
d626f62b 3884 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 3885 skb->len);
1da177e4
LT		 3886 conn->rx_len -= skb->len;
3887
3888 if (!conn->rx_len) {
3889 /* Complete frame received */
3890 l2cap_recv_frame(conn, conn->rx_skb);
3891 conn->rx_skb = NULL;
3892 }
3893 }
3894
3895drop:
3896 kfree_skb(skb);
3897 return 0;
3898}
3899
aef7d97c 3900static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4
LT		 3901{
3902 struct sock *sk;
3903 struct hlist_node *node;
1da177e4
LT		 3904
3905 read_lock_bh(&l2cap_sk_list.lock);
3906
be9d1227
MH		 3907 sk_for_each(sk, node, &l2cap_sk_list.head) {
3908 struct l2cap_pinfo *pi = l2cap_pi(sk);
101545f6 3909
903d343e 3910 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 3911 batostr(&bt_sk(sk)->src),
3912 batostr(&bt_sk(sk)->dst),
3913 sk->sk_state, __le16_to_cpu(pi->psm),
3914 pi->scid, pi->dcid,
903d343e
GP		 3915 pi->imtu, pi->omtu, pi->sec_level,
3916 pi->mode);
be9d1227 3917 }
1da177e4 3918
1da177e4 3919 read_unlock_bh(&l2cap_sk_list.lock);
1da177e4 3920
aef7d97c 3921 return 0;
1da177e4
LT		 3922}
3923
aef7d97c
MH		 3924static int l2cap_debugfs_open(struct inode *inode, struct file *file)
3925{
3926 return single_open(file, l2cap_debugfs_show, inode->i_private);
3927}
3928
3929static const struct file_operations l2cap_debugfs_fops = {
3930 .open = l2cap_debugfs_open,
3931 .read = seq_read,
3932 .llseek = seq_lseek,
3933 .release = single_release,
3934};
3935
3936static struct dentry *l2cap_debugfs;
1da177e4 3937
1da177e4
LT		 3938static struct hci_proto l2cap_hci_proto = {
3939 .name = "L2CAP",
3940 .id = HCI_PROTO_L2CAP,
3941 .connect_ind = l2cap_connect_ind,
3942 .connect_cfm = l2cap_connect_cfm,
3943 .disconn_ind = l2cap_disconn_ind,
2950f21a 3944 .disconn_cfm = l2cap_disconn_cfm,
8c1b2355 3945 .security_cfm = l2cap_security_cfm,
1da177e4
LT		 3946 .recv_acldata = l2cap_recv_acldata
3947};
3948
64274518 3949int __init l2cap_init(void)
1da177e4
LT		 3950{
3951 int err;
be9d1227 3952
bb58f747 3953 err = l2cap_init_sockets();
1da177e4
LT		 3954 if (err < 0)
3955 return err;
3956
1890d36b 3957 _busy_wq = create_singlethread_workqueue("l2cap");
b78d7b4f 3958 if (!_busy_wq) {
bb58f747 3959 err = -ENOMEM;
1da177e4
LT		 3960 goto error;
3961 }
3962
3963 err = hci_register_proto(&l2cap_hci_proto);
3964 if (err < 0) {
3965 BT_ERR("L2CAP protocol registration failed");
3966 bt_sock_unregister(BTPROTO_L2CAP);
3967 goto error;
3968 }
3969
aef7d97c
MH		 3970 if (bt_debugfs) {
3971 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
3972 bt_debugfs, NULL, &l2cap_debugfs_fops);
3973 if (!l2cap_debugfs)
3974 BT_ERR("Failed to create L2CAP debug file");
3975 }
1da177e4 3976
1da177e4
LT		 3977 BT_INFO("L2CAP socket layer initialized");
3978
3979 return 0;
3980
3981error:
b78d7b4f 3982 destroy_workqueue(_busy_wq);
bb58f747 3983 l2cap_cleanup_sockets();
1da177e4
LT		 3984 return err;
3985}
3986
64274518 3987void l2cap_exit(void)
1da177e4 3988{
aef7d97c 3989 debugfs_remove(l2cap_debugfs);
1da177e4 3990
1890d36b
GP		 3991 flush_workqueue(_busy_wq);
3992 destroy_workqueue(_busy_wq);
3993
1da177e4
LT		 3994 if (hci_unregister_proto(&l2cap_hci_proto) < 0)
3995 BT_ERR("L2CAP protocol unregistration failed");
3996
bb58f747 3997 l2cap_cleanup_sockets();
1da177e4
LT		 3998}
3999
d1c4a17d
GP		 4000module_param(disable_ertm, bool, 0644);
4001MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)