projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Update tx_send_head when sending ERTM data
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
33#include <linux/types.h>
4fc268d2 34#include <linux/capability.h>
1da177e4
LT		 35#include <linux/errno.h>
36#include <linux/kernel.h>
1da177e4
LT		 37#include <linux/sched.h>
38#include <linux/slab.h>
39#include <linux/poll.h>
40#include <linux/fcntl.h>
41#include <linux/init.h>
42#include <linux/interrupt.h>
43#include <linux/socket.h>
44#include <linux/skbuff.h>
1da177e4 45#include <linux/list.h>
be9d1227 46#include <linux/device.h>
aef7d97c
MH		 47#include <linux/debugfs.h>
48#include <linux/seq_file.h>
af05b30b 49#include <linux/uaccess.h>
fcc203c3 50#include <linux/crc16.h>
1da177e4
LT		 51#include <net/sock.h>
52
1da177e4
LT		 53#include <asm/unaligned.h>
54
55#include <net/bluetooth/bluetooth.h>
56#include <net/bluetooth/hci_core.h>
57#include <net/bluetooth/l2cap.h>
b501d6a1 58#include <net/bluetooth/smp.h>
1da177e4 59
eb939922 60bool disable_ertm;
f0709e03 61
47ec1dcd 62static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 63static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 64
b5ad8b7f
JB		 65static LIST_HEAD(chan_list);
66static DEFINE_RWLOCK(chan_list_lock);
1da177e4 67
1da177e4
LT		 68static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
69 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 70static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
71 void *data);
710f9b0a 72static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a
GP		 73static void l2cap_send_disconn_req(struct l2cap_conn *conn,
74 struct l2cap_chan *chan, int err);
1da177e4 75
0139418c 76/* ---- L2CAP channels ---- */
71ba0e56 77
baa7e1fa 78static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 79{
3df91ea2 80 struct l2cap_chan *c;
3d57dc68 81
3df91ea2
AE		 82 list_for_each_entry(c, &conn->chan_l, list) {
83 if (c->dcid == cid)
84 return c;
0139418c 85 }
3df91ea2 86 return NULL;
0139418c
MH		 87}
88
baa7e1fa 89static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 90{
3df91ea2 91 struct l2cap_chan *c;
3d57dc68 92
3df91ea2
AE		 93 list_for_each_entry(c, &conn->chan_l, list) {
94 if (c->scid == cid)
95 return c;
0139418c 96 }
3df91ea2 97 return NULL;
0139418c
MH		 98}
99
100/* Find channel with given SCID.
101 * Returns locked socket */
baa7e1fa 102static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 103{
48454079 104 struct l2cap_chan *c;
baa7e1fa 105
3df91ea2 106 mutex_lock(&conn->chan_lock);
baa7e1fa 107 c = __l2cap_get_chan_by_scid(conn, cid);
3df91ea2
AE		 108 mutex_unlock(&conn->chan_lock);
109
48454079 110 return c;
0139418c
MH		 111}
112
baa7e1fa 113static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 114{
3df91ea2 115 struct l2cap_chan *c;
3d57dc68 116
3df91ea2
AE		 117 list_for_each_entry(c, &conn->chan_l, list) {
118 if (c->ident == ident)
119 return c;
0139418c 120 }
3df91ea2 121 return NULL;
0139418c
MH		 122}
123
23691d75 124static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 125{
23691d75 126 struct l2cap_chan *c;
9e4425ff 127
23691d75
GP		 128 list_for_each_entry(c, &chan_list, global_l) {
129 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 130 return c;
9e4425ff 131 }
250938cb 132 return NULL;
9e4425ff
GP		 133}
134
135int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
136{
73b2ec18
GP		 137 int err;
138
333055f2 139 write_lock(&chan_list_lock);
9e4425ff 140
23691d75 141 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 142 err = -EADDRINUSE;
143 goto done;
9e4425ff
GP		 144 }
145
73b2ec18
GP		 146 if (psm) {
147 chan->psm = psm;
148 chan->sport = psm;
149 err = 0;
150 } else {
151 u16 p;
152
153 err = -EINVAL;
154 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 155 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 156 chan->psm = cpu_to_le16(p);
157 chan->sport = cpu_to_le16(p);
158 err = 0;
159 break;
160 }
161 }
9e4425ff 162
73b2ec18 163done:
333055f2 164 write_unlock(&chan_list_lock);
73b2ec18 165 return err;
9e4425ff
GP		 166}
167
168int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
169{
333055f2 170 write_lock(&chan_list_lock);
9e4425ff
GP		 171
172 chan->scid = scid;
173
333055f2 174 write_unlock(&chan_list_lock);
9e4425ff
GP		 175
176 return 0;
177}
178
baa7e1fa 179static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 180{
8db4dc46 181 u16 cid = L2CAP_CID_DYN_START;
0139418c 182
8db4dc46 183 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 184 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 185 return cid;
186 }
187
188 return 0;
189}
190
0e587be7 191static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 192{
42d2d87c 193 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 194 state_to_string(state));
195
89bc500e
GP		 196 chan->state = state;
197 chan->ops->state_change(chan->data, state);
198}
199
0e587be7
AE		 200static void l2cap_state_change(struct l2cap_chan *chan, int state)
201{
202 struct sock *sk = chan->sk;
203
204 lock_sock(sk);
205 __l2cap_state_change(chan, state);
206 release_sock(sk);
207}
208
2e0052e4
AE		 209static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
210{
211 struct sock *sk = chan->sk;
212
213 sk->sk_err = err;
214}
215
216static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
217{
218 struct sock *sk = chan->sk;
219
220 lock_sock(sk);
221 __l2cap_chan_set_err(chan, err);
222 release_sock(sk);
223}
224
3c588192
MM		 225/* ---- L2CAP sequence number lists ---- */
226
227/* For ERTM, ordered lists of sequence numbers must be tracked for
228 * SREJ requests that are received and for frames that are to be
229 * retransmitted. These seq_list functions implement a singly-linked
230 * list in an array, where membership in the list can also be checked
231 * in constant time. Items can also be added to the tail of the list
232 * and removed from the head in constant time, without further memory
233 * allocs or frees.
234 */
235
236static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
237{
238 size_t alloc_size, i;
239
240 /* Allocated size is a power of 2 to map sequence numbers
241 * (which may be up to 14 bits) in to a smaller array that is
242 * sized for the negotiated ERTM transmit windows.
243 */
244 alloc_size = roundup_pow_of_two(size);
245
246 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
247 if (!seq_list->list)
248 return -ENOMEM;
249
250 seq_list->mask = alloc_size - 1;
251 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
252 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
253 for (i = 0; i < alloc_size; i++)
254 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
255
256 return 0;
257}
258
259static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
260{
261 kfree(seq_list->list);
262}
263
264static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
265 u16 seq)
266{
267 /* Constant-time check for list membership */
268 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
269}
270
271static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
272{
273 u16 mask = seq_list->mask;
274
275 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
276 /* In case someone tries to pop the head of an empty list */
277 return L2CAP_SEQ_LIST_CLEAR;
278 } else if (seq_list->head == seq) {
279 /* Head can be removed in constant time */
280 seq_list->head = seq_list->list[seq & mask];
281 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
282
283 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
284 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
285 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
286 }
287 } else {
288 /* Walk the list to find the sequence number */
289 u16 prev = seq_list->head;
290 while (seq_list->list[prev & mask] != seq) {
291 prev = seq_list->list[prev & mask];
292 if (prev == L2CAP_SEQ_LIST_TAIL)
293 return L2CAP_SEQ_LIST_CLEAR;
294 }
295
296 /* Unlink the number from the list and clear it */
297 seq_list->list[prev & mask] = seq_list->list[seq & mask];
298 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
299 if (seq_list->tail == seq)
300 seq_list->tail = prev;
301 }
302 return seq;
303}
304
305static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
306{
307 /* Remove the head in constant time */
308 return l2cap_seq_list_remove(seq_list, seq_list->head);
309}
310
311static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
312{
313 if (seq_list->head != L2CAP_SEQ_LIST_CLEAR) {
314 u16 i;
315 for (i = 0; i <= seq_list->mask; i++)
316 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
317
318 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
319 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
320 }
321}
322
323static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
324{
325 u16 mask = seq_list->mask;
326
327 /* All appends happen in constant time */
328
329 if (seq_list->list[seq & mask] == L2CAP_SEQ_LIST_CLEAR) {
330 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
331 seq_list->head = seq;
332 else
333 seq_list->list[seq_list->tail & mask] = seq;
334
335 seq_list->tail = seq;
336 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
337 }
338}
339
721c4181 340static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 341{
721c4181
GP		 342 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
343 chan_timer.work);
3df91ea2 344 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 345 int reason;
346
e05dcc32 347 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 348
3df91ea2 349 mutex_lock(&conn->chan_lock);
6be36555 350 l2cap_chan_lock(chan);
ab07801d 351
89bc500e 352 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 353 reason = ECONNREFUSED;
89bc500e 354 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 355 chan->sec_level != BT_SECURITY_SDP)
356 reason = ECONNREFUSED;
357 else
358 reason = ETIMEDOUT;
359
0f852724 360 l2cap_chan_close(chan, reason);
ab07801d 361
6be36555 362 l2cap_chan_unlock(chan);
ab07801d 363
ba3bd0ee 364 chan->ops->close(chan->data);
3df91ea2
AE		 365 mutex_unlock(&conn->chan_lock);
366
371fd835 367 l2cap_chan_put(chan);
ab07801d
GP		 368}
369
eef1d9b6 370struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 371{
372 struct l2cap_chan *chan;
373
374 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
375 if (!chan)
376 return NULL;
377
c03b355e
AE		 378 mutex_init(&chan->lock);
379
333055f2 380 write_lock(&chan_list_lock);
23691d75 381 list_add(&chan->global_l, &chan_list);
333055f2 382 write_unlock(&chan_list_lock);
23691d75 383
721c4181 384 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 385
89bc500e
GP		 386 chan->state = BT_OPEN;
387
71ba0e56
GP		 388 atomic_set(&chan->refcnt, 1);
389
eef1d9b6 390 BT_DBG("chan %p", chan);
abc545b8 391
48454079
GP		 392 return chan;
393}
394
23691d75 395void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 396{
333055f2 397 write_lock(&chan_list_lock);
23691d75 398 list_del(&chan->global_l);
333055f2 399 write_unlock(&chan_list_lock);
23691d75 400
371fd835 401 l2cap_chan_put(chan);
6ff5abbf
GP		 402}
403
bd4b1653
AE		 404void l2cap_chan_set_defaults(struct l2cap_chan *chan)
405{
406 chan->fcs = L2CAP_FCS_CRC16;
407 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
408 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
409 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
410 chan->sec_level = BT_SECURITY_LOW;
411
412 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
413}
414
14a28491 415static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 416{
af05b30b 417 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 418 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 419
9f5a0d7b 420 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 421
8c1d787b 422 chan->conn = conn;
0139418c 423
5491120e
AE		 424 switch (chan->chan_type) {
425 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 426 if (conn->hcon->type == LE_LINK) {
427 /* LE connection */
0c1bc5c6 428 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 429 chan->scid = L2CAP_CID_LE_DATA;
430 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 431 } else {
432 /* Alloc CID for connection-oriented socket */
fe4128e0 433 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 434 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 435 }
5491120e
AE		 436 break;
437
438 case L2CAP_CHAN_CONN_LESS:
0139418c 439 /* Connectionless socket */
fe4128e0
GP		 440 chan->scid = L2CAP_CID_CONN_LESS;
441 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 442 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 443 break;
444
445 default:
0139418c 446 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 447 chan->scid = L2CAP_CID_SIGNALING;
448 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 449 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 450 }
451
8f7975b1
AE		 452 chan->local_id = L2CAP_BESTEFFORT_ID;
453 chan->local_stype = L2CAP_SERV_BESTEFFORT;
454 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
455 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
456 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
457 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
458
371fd835 459 l2cap_chan_hold(chan);
baa7e1fa 460
3df91ea2 461 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 462}
463
14a28491 464static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 465{
466 mutex_lock(&conn->chan_lock);
467 __l2cap_chan_add(conn, chan);
3df91ea2 468 mutex_unlock(&conn->chan_lock);
0139418c
MH		 469}
470
4519de9a 471static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 472{
48454079 473 struct sock *sk = chan->sk;
8c1d787b 474 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 475 struct sock *parent = bt_sk(sk)->parent;
476
c9b66675 477 __clear_chan_timer(chan);
0139418c 478
49208c9c 479 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 480
8e87d142 481 if (conn) {
baa7e1fa 482 /* Delete from channel list */
3df91ea2 483 list_del(&chan->list);
3d57dc68 484
371fd835 485 l2cap_chan_put(chan);
baa7e1fa 486
8c1d787b 487 chan->conn = NULL;
0139418c
MH		 488 hci_conn_put(conn->hcon);
489 }
490
6be36555
AE		 491 lock_sock(sk);
492
0e587be7 493 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 494 sock_set_flag(sk, SOCK_ZAPPED);
495
496 if (err)
2e0052e4 497 __l2cap_chan_set_err(chan, err);
0139418c
MH		 498
499 if (parent) {
500 bt_accept_unlink(sk);
501 parent->sk_data_ready(parent, 0);
502 } else
503 sk->sk_state_change(sk);
c13ffa62 504
6be36555
AE		 505 release_sock(sk);
506
c1360a1c
GP		 507 if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
508 test_bit(CONF_INPUT_DONE, &chan->conf_state)))
6ff5abbf 509 return;
2ead70b8 510
58d35f87 511 skb_queue_purge(&chan->tx_q);
c13ffa62 512
0c1bc5c6 513 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 514 struct srej_list *l, *tmp;
515
1a09bcb9
GP		 516 __clear_retrans_timer(chan);
517 __clear_monitor_timer(chan);
518 __clear_ack_timer(chan);
c13ffa62 519
f1c6775b 520 skb_queue_purge(&chan->srej_q);
c13ffa62 521
3c588192
MM		 522 l2cap_seq_list_free(&chan->srej_list);
523 l2cap_seq_list_free(&chan->retrans_list);
39d5a3ee 524 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 525 list_del(&l->list);
526 kfree(l);
527 }
528 }
0139418c
MH		 529}
530
4519de9a
GP		 531static void l2cap_chan_cleanup_listen(struct sock *parent)
532{
533 struct sock *sk;
534
535 BT_DBG("parent %p", parent);
536
537 /* Close not yet accepted channels */
0f852724 538 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 539 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 540
6be36555 541 l2cap_chan_lock(chan);
c9b66675 542 __clear_chan_timer(chan);
ba3bd0ee 543 l2cap_chan_close(chan, ECONNRESET);
6be36555 544 l2cap_chan_unlock(chan);
3df91ea2 545
ba3bd0ee 546 chan->ops->close(chan->data);
0f852724 547 }
4519de9a
GP		 548}
549
0f852724 550void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 551{
552 struct l2cap_conn *conn = chan->conn;
553 struct sock *sk = chan->sk;
554
e05dcc32
AE		 555 BT_DBG("chan %p state %s sk %p", chan,
556 state_to_string(chan->state), sk);
4519de9a 557
89bc500e 558 switch (chan->state) {
4519de9a 559 case BT_LISTEN:
6be36555 560 lock_sock(sk);
4519de9a 561 l2cap_chan_cleanup_listen(sk);
89bc500e 562
0e587be7 563 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 564 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 565 release_sock(sk);
4519de9a
GP		 566 break;
567
568 case BT_CONNECTED:
569 case BT_CONFIG:
715ec005 570 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 571 conn->hcon->type == ACL_LINK) {
c9b66675 572 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 573 l2cap_send_disconn_req(conn, chan, reason);
574 } else
575 l2cap_chan_del(chan, reason);
576 break;
577
578 case BT_CONNECT2:
715ec005 579 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 580 conn->hcon->type == ACL_LINK) {
581 struct l2cap_conn_rsp rsp;
582 __u16 result;
583
584 if (bt_sk(sk)->defer_setup)
585 result = L2CAP_CR_SEC_BLOCK;
586 else
587 result = L2CAP_CR_BAD_PSM;
89bc500e 588 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 589
590 rsp.scid = cpu_to_le16(chan->dcid);
591 rsp.dcid = cpu_to_le16(chan->scid);
592 rsp.result = cpu_to_le16(result);
593 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
594 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
595 sizeof(rsp), &rsp);
596 }
597
598 l2cap_chan_del(chan, reason);
599 break;
600
601 case BT_CONNECT:
602 case BT_DISCONN:
603 l2cap_chan_del(chan, reason);
604 break;
605
606 default:
6be36555 607 lock_sock(sk);
4519de9a 608 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 609 release_sock(sk);
4519de9a
GP		 610 break;
611 }
612}
613
4343478f 614static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 615{
715ec005 616 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 617 switch (chan->sec_level) {
8556edd3
JH		 618 case BT_SECURITY_HIGH:
619 return HCI_AT_DEDICATED_BONDING_MITM;
620 case BT_SECURITY_MEDIUM:
621 return HCI_AT_DEDICATED_BONDING;
622 default:
623 return HCI_AT_NO_BONDING;
624 }
fe4128e0 625 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 626 if (chan->sec_level == BT_SECURITY_LOW)
627 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 628
4343478f 629 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 630 return HCI_AT_NO_BONDING_MITM;
00ae4af9 631 else
8556edd3 632 return HCI_AT_NO_BONDING;
00ae4af9 633 } else {
4343478f 634 switch (chan->sec_level) {
00ae4af9 635 case BT_SECURITY_HIGH:
8556edd3 636 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 637 case BT_SECURITY_MEDIUM:
8556edd3 638 return HCI_AT_GENERAL_BONDING;
00ae4af9 639 default:
8556edd3 640 return HCI_AT_NO_BONDING;
00ae4af9 641 }
0684e5f9 642 }
8556edd3
JH		 643}
644
645/* Service level security */
d45fc423 646int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 647{
8c1d787b 648 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 649 __u8 auth_type;
650
4343478f 651 auth_type = l2cap_get_auth_type(chan);
79d554a6 652
4343478f 653 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 654}
655
b5ad8b7f 656static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 657{
658 u8 id;
659
660 /* Get next available identificator.
661 * 1 - 128 are used by kernel.
662 * 129 - 199 are reserved.
663 * 200 - 254 are used by utilities like l2ping, etc.
664 */
665
333055f2 666 spin_lock(&conn->lock);
4e8402a3
MH		 667
668 if (++conn->tx_ident > 128)
669 conn->tx_ident = 1;
670
671 id = conn->tx_ident;
672
333055f2 673 spin_unlock(&conn->lock);
4e8402a3
MH		 674
675 return id;
676}
677
4519de9a 678static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 679{
680 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 681 u8 flags;
4e8402a3
MH		 682
683 BT_DBG("code 0x%2.2x", code);
684
685 if (!skb)
9a9c6a34 686 return;
4e8402a3 687
e702112f
AE		 688 if (lmp_no_flush_capable(conn->hcon->hdev))
689 flags = ACL_START_NO_FLUSH;
690 else
691 flags = ACL_START;
692
14b12d0b 693 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 694 skb->priority = HCI_PRIO_MAX;
14b12d0b 695
73d80deb
LAD		 696 hci_send_acl(conn->hchan, skb, flags);
697}
698
699static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
700{
701 struct hci_conn *hcon = chan->conn->hcon;
702 u16 flags;
703
704 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
705 skb->priority);
706
707 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
708 lmp_no_flush_capable(hcon->hdev))
709 flags = ACL_START_NO_FLUSH;
710 else
711 flags = ACL_START;
14b12d0b 712
73d80deb
LAD		 713 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
714 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 715}
716
b76bbd66
MM		 717static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
718{
719 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
720 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
721
722 if (enh & L2CAP_CTRL_FRAME_TYPE) {
723 /* S-Frame */
724 control->sframe = 1;
725 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
726 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
727
728 control->sar = 0;
729 control->txseq = 0;
730 } else {
731 /* I-Frame */
732 control->sframe = 0;
733 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
734 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
735
736 control->poll = 0;
737 control->super = 0;
738 }
739}
740
b76bbd66
MM		 741static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
742{
743 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
744 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
745
746 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
747 /* S-Frame */
748 control->sframe = 1;
749 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
750 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
751
752 control->sar = 0;
753 control->txseq = 0;
754 } else {
755 /* I-Frame */
756 control->sframe = 0;
757 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
758 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
759
760 control->poll = 0;
761 control->super = 0;
762 }
763}
764
765static inline void __unpack_control(struct l2cap_chan *chan,
766 struct sk_buff *skb)
767{
768 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
769 __unpack_extended_control(get_unaligned_le32(skb->data),
770 &bt_cb(skb)->control);
771 } else {
772 __unpack_enhanced_control(get_unaligned_le16(skb->data),
773 &bt_cb(skb)->control);
774 }
775}
776
b5c6aaed
MM		 777static u32 __pack_extended_control(struct l2cap_ctrl *control)
778{
779 u32 packed;
780
781 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
782 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
783
784 if (control->sframe) {
785 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
786 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
787 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
788 } else {
789 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
790 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
791 }
792
793 return packed;
794}
795
796static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
797{
798 u16 packed;
799
800 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
801 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
802
803 if (control->sframe) {
804 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
805 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
806 packed |= L2CAP_CTRL_FRAME_TYPE;
807 } else {
808 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
809 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
810 }
811
812 return packed;
813}
814
b76bbd66
MM		 815static inline void __pack_control(struct l2cap_chan *chan,
816 struct l2cap_ctrl *control,
817 struct sk_buff *skb)
818{
819 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
820 put_unaligned_le32(__pack_extended_control(control),
821 skb->data + L2CAP_HDR_SIZE);
822 } else {
823 put_unaligned_le16(__pack_enhanced_control(control),
824 skb->data + L2CAP_HDR_SIZE);
825 }
826}
827
b5c6aaed
MM		 828static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
829{
830 struct sk_buff *skb;
831 struct l2cap_hdr *lh;
832 struct l2cap_conn *conn = chan->conn;
833 int count, hlen;
834
835 if (chan->state != BT_CONNECTED)
836 return;
837
838 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
839 hlen = L2CAP_EXT_HDR_SIZE;
840 else
841 hlen = L2CAP_ENH_HDR_SIZE;
842
843 if (chan->fcs == L2CAP_FCS_CRC16)
844 hlen += L2CAP_FCS_SIZE;
845
846 BT_DBG("chan %p, control 0x%8.8x", chan, control);
847
848 count = min_t(unsigned int, conn->mtu, hlen);
849
850 control |= __set_sframe(chan);
851
852 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
853 control |= __set_ctrl_final(chan);
854
855 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
856 control |= __set_ctrl_poll(chan);
857
858 skb = bt_skb_alloc(count, GFP_ATOMIC);
859 if (!skb)
860 return;
861
862 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
863 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
864 lh->cid = cpu_to_le16(chan->dcid);
865
866 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
867
868 if (chan->fcs == L2CAP_FCS_CRC16) {
869 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
870 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
871 }
872
873 skb->priority = HCI_PRIO_MAX;
874 l2cap_do_send(chan, skb);
875}
876
877static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
878{
879 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
880 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
881 set_bit(CONN_RNR_SENT, &chan->conn_state);
882 } else
883 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
884
885 control |= __set_reqseq(chan, chan->buffer_seq);
886
887 l2cap_send_sframe(chan, control);
888}
889
b4450035 890static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 891{
c1360a1c 892 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 893}
894
9b27f350
AE		 895static void l2cap_send_conn_req(struct l2cap_chan *chan)
896{
897 struct l2cap_conn *conn = chan->conn;
898 struct l2cap_conn_req req;
899
900 req.scid = cpu_to_le16(chan->scid);
901 req.psm = chan->psm;
902
903 chan->ident = l2cap_get_ident(conn);
904
905 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
906
907 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
908}
909
9f0caeb1
VCG		 910static void l2cap_chan_ready(struct l2cap_chan *chan)
911{
912 struct sock *sk = chan->sk;
913 struct sock *parent;
914
915 lock_sock(sk);
916
917 parent = bt_sk(sk)->parent;
918
919 BT_DBG("sk %p, parent %p", sk, parent);
920
921 chan->conf_state = 0;
922 __clear_chan_timer(chan);
923
924 __l2cap_state_change(chan, BT_CONNECTED);
925 sk->sk_state_change(sk);
926
927 if (parent)
928 parent->sk_data_ready(parent, 0);
929
930 release_sock(sk);
931}
932
fc7f8a7e 933static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 934{
8c1d787b 935 struct l2cap_conn *conn = chan->conn;
79d554a6 936
9f0caeb1
VCG		 937 if (conn->hcon->type == LE_LINK) {
938 l2cap_chan_ready(chan);
939 return;
940 }
941
79d554a6 942 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 943 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
944 return;
945
d45fc423 946 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 947 __l2cap_no_conn_pending(chan))
948 l2cap_send_conn_req(chan);
79d554a6
MH		 949 } else {
950 struct l2cap_info_req req;
951 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
952
953 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
954 conn->info_ident = l2cap_get_ident(conn);
955
ba13ccd9 956 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 957
958 l2cap_send_cmd(conn, conn->info_ident,
959 L2CAP_INFO_REQ, sizeof(req), &req);
960 }
961}
962
cf6c2c0b
GP		 963static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
964{
965 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 966 if (!disable_ertm)
cf6c2c0b
GP		 967 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
968
969 switch (mode) {
970 case L2CAP_MODE_ERTM:
971 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
972 case L2CAP_MODE_STREAMING:
973 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
974 default:
975 return 0x00;
976 }
977}
978
4519de9a 979static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 980{
6be36555 981 struct sock *sk = chan->sk;
22121fc9
GP		 982 struct l2cap_disconn_req req;
983
c13ffa62
GP		 984 if (!conn)
985 return;
986
0c1bc5c6 987 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 988 __clear_retrans_timer(chan);
989 __clear_monitor_timer(chan);
990 __clear_ack_timer(chan);
c13ffa62
GP		 991 }
992
fe4128e0
GP		 993 req.dcid = cpu_to_le16(chan->dcid);
994 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 995 l2cap_send_cmd(conn, l2cap_get_ident(conn),
996 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 997
6be36555 998 lock_sock(sk);
0e587be7 999 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1000 __l2cap_chan_set_err(chan, err);
6be36555 1001 release_sock(sk);
22121fc9
GP		 1002}
1003
1da177e4 1004/* ---- L2CAP connections ---- */
4e8402a3
MH		 1005static void l2cap_conn_start(struct l2cap_conn *conn)
1006{
3df91ea2 1007 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1008
1009 BT_DBG("conn %p", conn);
1010
3df91ea2 1011 mutex_lock(&conn->chan_lock);
4e8402a3 1012
3df91ea2 1013 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1014 struct sock *sk = chan->sk;
baa7e1fa 1015
6be36555 1016 l2cap_chan_lock(chan);
4e8402a3 1017
715ec005 1018 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1019 l2cap_chan_unlock(chan);
79d554a6
MH		 1020 continue;
1021 }
1022
89bc500e 1023 if (chan->state == BT_CONNECT) {
d45fc423 1024 if (!l2cap_chan_check_security(chan) ||
b4450035 1025 !__l2cap_no_conn_pending(chan)) {
6be36555 1026 l2cap_chan_unlock(chan);
47731de7
GP		 1027 continue;
1028 }
79d554a6 1029
c1360a1c
GP		 1030 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1031 && test_bit(CONF_STATE2_DEVICE,
1032 &chan->conf_state)) {
89bc500e 1033 l2cap_chan_close(chan, ECONNRESET);
6be36555 1034 l2cap_chan_unlock(chan);
47731de7 1035 continue;
b1235d79 1036 }
47731de7 1037
9b27f350 1038 l2cap_send_conn_req(chan);
47731de7 1039
89bc500e 1040 } else if (chan->state == BT_CONNECT2) {
79d554a6 1041 struct l2cap_conn_rsp rsp;
e9aeb2dd 1042 char buf[128];
fe4128e0
GP		 1043 rsp.scid = cpu_to_le16(chan->dcid);
1044 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1045
d45fc423 1046 if (l2cap_chan_check_security(chan)) {
6be36555 1047 lock_sock(sk);
f66dc81f
MH		 1048 if (bt_sk(sk)->defer_setup) {
1049 struct sock *parent = bt_sk(sk)->parent;
1050 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1051 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 1052 if (parent)
1053 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 1054
1055 } else {
0e587be7 1056 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 1057 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1058 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1059 }
6be36555 1060 release_sock(sk);
79d554a6
MH		 1061 } else {
1062 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1063 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1064 }
1065
fc7f8a7e
GP		 1066 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1067 sizeof(rsp), &rsp);
e9aeb2dd 1068
c1360a1c 1069 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 1070 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1071 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1072 continue;
1073 }
1074
c1360a1c 1075 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1076 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 1077 l2cap_build_conf_req(chan, buf), buf);
1078 chan->num_conf_req++;
4e8402a3
MH		 1079 }
1080
6be36555 1081 l2cap_chan_unlock(chan);
4e8402a3
MH		 1082 }
1083
3df91ea2 1084 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1085}
1086
c2287681 1087/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1088 * Returns closest match, locked.
1089 */
d9b88702 1090static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1091 bdaddr_t *src,
1092 bdaddr_t *dst)
b62f328b 1093{
23691d75 1094 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1095
23691d75 1096 read_lock(&chan_list_lock);
b62f328b 1097
23691d75
GP		 1098 list_for_each_entry(c, &chan_list, global_l) {
1099 struct sock *sk = c->sk;
fe4128e0 1100
89bc500e 1101 if (state && c->state != state)
b62f328b
VT		 1102 continue;
1103
23691d75 1104 if (c->scid == cid) {
c2287681
IY		 1105 int src_match, dst_match;
1106 int src_any, dst_any;
1107
b62f328b 1108 /* Exact match. */
c2287681
IY		 1109 src_match = !bacmp(&bt_sk(sk)->src, src);
1110 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1111 if (src_match && dst_match) {
23691d75
GP		 1112 read_unlock(&chan_list_lock);
1113 return c;
1114 }
b62f328b
VT		 1115
1116 /* Closest match */
c2287681
IY		 1117 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1118 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1119 if ((src_match && dst_any) || (src_any && dst_match) ||
1120 (src_any && dst_any))
23691d75 1121 c1 = c;
b62f328b
VT		 1122 }
1123 }
280f294f 1124
23691d75 1125 read_unlock(&chan_list_lock);
b62f328b 1126
23691d75 1127 return c1;
b62f328b
VT		 1128}
1129
1130static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1131{
c916fbe4 1132 struct sock *parent, *sk;
23691d75 1133 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1134
1135 BT_DBG("");
1136
1137 /* Check if we have socket listening on cid */
23691d75 1138 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1139 conn->src, conn->dst);
23691d75 1140 if (!pchan)
b62f328b
VT		 1141 return;
1142
23691d75
GP		 1143 parent = pchan->sk;
1144
aa2ac881 1145 lock_sock(parent);
62f3a2cf 1146
b62f328b
VT		 1147 /* Check for backlog size */
1148 if (sk_acceptq_is_full(parent)) {
1149 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1150 goto clean;
1151 }
1152
80808e43
GP		 1153 chan = pchan->ops->new_connection(pchan->data);
1154 if (!chan)
b62f328b
VT		 1155 goto clean;
1156
80808e43 1157 sk = chan->sk;
5d41ce1d 1158
b62f328b
VT		 1159 hci_conn_hold(conn->hcon);
1160
b62f328b
VT		 1161 bacpy(&bt_sk(sk)->src, conn->src);
1162 bacpy(&bt_sk(sk)->dst, conn->dst);
1163
d1010240
GP		 1164 bt_accept_enqueue(parent, sk);
1165
3d57dc68 1166 l2cap_chan_add(conn, chan);
48454079 1167
c9b66675 1168 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 1169
0e587be7 1170 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 1171 parent->sk_data_ready(parent, 0);
1172
b62f328b 1173clean:
aa2ac881 1174 release_sock(parent);
b62f328b
VT		 1175}
1176
4e8402a3
MH		 1177static void l2cap_conn_ready(struct l2cap_conn *conn)
1178{
48454079 1179 struct l2cap_chan *chan;
4e8402a3 1180
79d554a6 1181 BT_DBG("conn %p", conn);
4e8402a3 1182
b62f328b
VT		 1183 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
1184 l2cap_le_conn_ready(conn);
1185
160dc6ac
VCG		 1186 if (conn->hcon->out && conn->hcon->type == LE_LINK)
1187 smp_conn_security(conn, conn->hcon->pending_sec_level);
1188
3df91ea2 1189 mutex_lock(&conn->chan_lock);
4e8402a3 1190
3df91ea2 1191 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1192
6be36555 1193 l2cap_chan_lock(chan);
4e8402a3 1194
63128451 1195 if (conn->hcon->type == LE_LINK) {
b501d6a1 1196 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 1197 l2cap_chan_ready(chan);
acd7d370 1198
63128451 1199 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1200 struct sock *sk = chan->sk;
c9b66675 1201 __clear_chan_timer(chan);
6be36555 1202 lock_sock(sk);
0e587be7 1203 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1204 sk->sk_state_change(sk);
6be36555 1205 release_sock(sk);
b501d6a1 1206
89bc500e 1207 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1208 l2cap_do_start(chan);
4e8402a3 1209
6be36555 1210 l2cap_chan_unlock(chan);
4e8402a3 1211 }
79d554a6 1212
3df91ea2 1213 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1214}
1215
1216/* Notify sockets that we cannot guaranty reliability anymore */
1217static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1218{
48454079 1219 struct l2cap_chan *chan;
4e8402a3
MH		 1220
1221 BT_DBG("conn %p", conn);
1222
3df91ea2 1223 mutex_lock(&conn->chan_lock);
4e8402a3 1224
3df91ea2 1225 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1226 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 1227 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1228 }
1229
3df91ea2 1230 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1231}
1232
f878fcad 1233static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1234{
f878fcad 1235 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 1236 info_timer.work);
4e8402a3 1237
984947dc 1238 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1239 conn->info_ident = 0;
984947dc 1240
4e8402a3
MH		 1241 l2cap_conn_start(conn);
1242}
1243
5d3de7df
VCG		 1244static void l2cap_conn_del(struct hci_conn *hcon, int err)
1245{
1246 struct l2cap_conn *conn = hcon->l2cap_data;
1247 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1248
1249 if (!conn)
1250 return;
1251
1252 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1253
1254 kfree_skb(conn->rx_skb);
1255
3df91ea2
AE		 1256 mutex_lock(&conn->chan_lock);
1257
5d3de7df
VCG		 1258 /* Kill channels */
1259 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1260 l2cap_chan_hold(chan);
6be36555
AE		 1261 l2cap_chan_lock(chan);
1262
5d3de7df 1263 l2cap_chan_del(chan, err);
6be36555
AE		 1264
1265 l2cap_chan_unlock(chan);
1266
5d3de7df 1267 chan->ops->close(chan->data);
61d6ef3e 1268 l2cap_chan_put(chan);
5d3de7df
VCG		 1269 }
1270
3df91ea2
AE		 1271 mutex_unlock(&conn->chan_lock);
1272
73d80deb
LAD		 1273 hci_chan_del(conn->hchan);
1274
5d3de7df 1275 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1276 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1277
51a8efd7 1278 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1279 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1280 smp_chan_destroy(conn);
d26a2345 1281 }
5d3de7df
VCG		 1282
1283 hcon->l2cap_data = NULL;
1284 kfree(conn);
1285}
1286
6c9d42a1 1287static void security_timeout(struct work_struct *work)
5d3de7df 1288{
6c9d42a1
GP		 1289 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1290 security_timer.work);
5d3de7df
VCG		 1291
1292 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1293}
1294
1da177e4
LT		 1295static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1296{
0139418c 1297 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1298 struct hci_chan *hchan;
1da177e4 1299
0139418c 1300 if (conn || status)
1da177e4
LT		 1301 return conn;
1302
73d80deb
LAD		 1303 hchan = hci_chan_create(hcon);
1304 if (!hchan)
1305 return NULL;
1306
0139418c 1307 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1308 if (!conn) {
1309 hci_chan_del(hchan);
1da177e4 1310 return NULL;
73d80deb 1311 }
1da177e4
LT		 1312
1313 hcon->l2cap_data = conn;
1314 conn->hcon = hcon;
73d80deb 1315 conn->hchan = hchan;
1da177e4 1316
73d80deb 1317 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1318
acd7d370
VT		 1319 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1320 conn->mtu = hcon->hdev->le_mtu;
1321 else
1322 conn->mtu = hcon->hdev->acl_mtu;
1323
1da177e4
LT		 1324 conn->src = &hcon->hdev->bdaddr;
1325 conn->dst = &hcon->dst;
1326
4e8402a3
MH		 1327 conn->feat_mask = 0;
1328
1da177e4 1329 spin_lock_init(&conn->lock);
3df91ea2 1330 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1331
1332 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1333
5d3de7df 1334 if (hcon->type == LE_LINK)
6c9d42a1 1335 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1336 else
030013d8 1337 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1338
9f5a0d7b 1339 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1340
1da177e4
LT		 1341 return conn;
1342}
1343
1da177e4 1344/* ---- Socket interface ---- */
1da177e4 1345
c2287681 1346/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1347 * Returns closest match.
1348 */
c2287681
IY		 1349static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1350 bdaddr_t *src,
1351 bdaddr_t *dst)
1da177e4 1352{
23691d75 1353 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1354
23691d75 1355 read_lock(&chan_list_lock);
e0f0cb56 1356
23691d75
GP		 1357 list_for_each_entry(c, &chan_list, global_l) {
1358 struct sock *sk = c->sk;
fe4128e0 1359
89bc500e 1360 if (state && c->state != state)
1da177e4
LT		 1361 continue;
1362
23691d75 1363 if (c->psm == psm) {
c2287681
IY		 1364 int src_match, dst_match;
1365 int src_any, dst_any;
1366
1da177e4 1367 /* Exact match. */
c2287681
IY		 1368 src_match = !bacmp(&bt_sk(sk)->src, src);
1369 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1370 if (src_match && dst_match) {
a7567b20 1371 read_unlock(&chan_list_lock);
23691d75
GP		 1372 return c;
1373 }
1da177e4
LT		 1374
1375 /* Closest match */
c2287681
IY		 1376 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1377 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1378 if ((src_match && dst_any) || (src_any && dst_match) ||
1379 (src_any && dst_any))
23691d75 1380 c1 = c;
1da177e4
LT		 1381 }
1382 }
1da177e4 1383
23691d75 1384 read_unlock(&chan_list_lock);
e0f0cb56 1385
23691d75 1386 return c1;
1da177e4
LT		 1387}
1388
8e9f9892
AG		 1389int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1390 bdaddr_t *dst, u8 dst_type)
1da177e4 1391{
5d41ce1d 1392 struct sock *sk = chan->sk;
1da177e4 1393 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1394 struct l2cap_conn *conn;
1395 struct hci_conn *hcon;
1396 struct hci_dev *hdev;
09ab6f4c 1397 __u8 auth_type;
44d0e48e 1398 int err;
1da177e4 1399
8e9f9892
AG		 1400 BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
1401 dst_type, __le16_to_cpu(chan->psm));
1da177e4 1402
af05b30b
GP		 1403 hdev = hci_get_route(dst, src);
1404 if (!hdev)
1da177e4
LT		 1405 return -EHOSTUNREACH;
1406
09fd0de5 1407 hci_dev_lock(hdev);
1da177e4 1408
6be36555 1409 l2cap_chan_lock(chan);
03a00194
GP		 1410
1411 /* PSM must be odd and lsb of upper byte must be 0 */
1412 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1413 chan->chan_type != L2CAP_CHAN_RAW) {
1414 err = -EINVAL;
1415 goto done;
1416 }
1417
1418 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1419 err = -EINVAL;
1420 goto done;
1421 }
1422
1423 switch (chan->mode) {
1424 case L2CAP_MODE_BASIC:
1425 break;
1426 case L2CAP_MODE_ERTM:
1427 case L2CAP_MODE_STREAMING:
1428 if (!disable_ertm)
1429 break;
1430 /* fall through */
1431 default:
1432 err = -ENOTSUPP;
1433 goto done;
1434 }
1435
6be36555
AE		 1436 lock_sock(sk);
1437
03a00194
GP		 1438 switch (sk->sk_state) {
1439 case BT_CONNECT:
1440 case BT_CONNECT2:
1441 case BT_CONFIG:
1442 /* Already connecting */
1443 err = 0;
6be36555 1444 release_sock(sk);
03a00194
GP		 1445 goto done;
1446
1447 case BT_CONNECTED:
1448 /* Already connected */
1449 err = -EISCONN;
6be36555 1450 release_sock(sk);
03a00194
GP		 1451 goto done;
1452
1453 case BT_OPEN:
1454 case BT_BOUND:
1455 /* Can connect */
1456 break;
1457
1458 default:
1459 err = -EBADFD;
6be36555 1460 release_sock(sk);
03a00194
GP		 1461 goto done;
1462 }
1463
1464 /* Set destination address and psm */
9219b2a0 1465 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1466
1467 release_sock(sk);
1468
03a00194
GP		 1469 chan->psm = psm;
1470 chan->dcid = cid;
1da177e4 1471
4343478f 1472 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1473
fe4128e0 1474 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1475 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1476 chan->sec_level, auth_type);
acd7d370 1477 else
8e9f9892 1478 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1479 chan->sec_level, auth_type);
acd7d370 1480
30e76272
VT		 1481 if (IS_ERR(hcon)) {
1482 err = PTR_ERR(hcon);
1da177e4 1483 goto done;
30e76272 1484 }
1da177e4
LT		 1485
1486 conn = l2cap_conn_add(hcon, 0);
1487 if (!conn) {
1488 hci_conn_put(hcon);
30e76272 1489 err = -ENOMEM;
1da177e4
LT		 1490 goto done;
1491 }
1492
9f0caeb1
VCG		 1493 if (hcon->type == LE_LINK) {
1494 err = 0;
1495
1496 if (!list_empty(&conn->chan_l)) {
1497 err = -EBUSY;
1498 hci_conn_put(hcon);
1499 }
1500
1501 if (err)
1502 goto done;
1503 }
1504
1da177e4
LT		 1505 /* Update source addr of the socket */
1506 bacpy(src, conn->src);
1507
6be36555 1508 l2cap_chan_unlock(chan);
48454079 1509 l2cap_chan_add(conn, chan);
6be36555 1510 l2cap_chan_lock(chan);
48454079 1511
6be36555 1512 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1513 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1514
1515 if (hcon->state == BT_CONNECTED) {
715ec005 1516 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1517 __clear_chan_timer(chan);
d45fc423 1518 if (l2cap_chan_check_security(chan))
6be36555 1519 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1520 } else
fc7f8a7e 1521 l2cap_do_start(chan);
1da177e4
LT		 1522 }
1523
30e76272
VT		 1524 err = 0;
1525
1da177e4 1526done:
6be36555 1527 l2cap_chan_unlock(chan);
09fd0de5 1528 hci_dev_unlock(hdev);
1da177e4
LT		 1529 hci_dev_put(hdev);
1530 return err;
1531}
1532
dcba0dba 1533int __l2cap_wait_ack(struct sock *sk)
6161c038 1534{
8c1d787b 1535 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1536 DECLARE_WAITQUEUE(wait, current);
1537 int err = 0;
1538 int timeo = HZ/5;
1539
2b0b05dd 1540 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1541 set_current_state(TASK_INTERRUPTIBLE);
1542 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1543 if (!timeo)
1544 timeo = HZ/5;
1545
1546 if (signal_pending(current)) {
1547 err = sock_intr_errno(timeo);
1548 break;
1549 }
1550
1551 release_sock(sk);
1552 timeo = schedule_timeout(timeo);
1553 lock_sock(sk);
a71a0cf4 1554 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1555
1556 err = sock_error(sk);
1557 if (err)
1558 break;
1559 }
1560 set_current_state(TASK_RUNNING);
2b0b05dd 1561 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1562 return err;
1563}
1564
721c4181 1565static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1566{
721c4181
GP		 1567 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1568 monitor_timer.work);
e90bac06 1569
525cd185 1570 BT_DBG("chan %p", chan);
0e98958d 1571
6be36555
AE		 1572 l2cap_chan_lock(chan);
1573
2c03a7a4 1574 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1575 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
6be36555 1576 l2cap_chan_unlock(chan);
8d7e1c7f 1577 l2cap_chan_put(chan);
e90bac06
GP		 1578 return;
1579 }
1580
6a026610 1581 chan->retry_count++;
1a09bcb9 1582 __set_monitor_timer(chan);
e90bac06 1583
525cd185 1584 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555 1585 l2cap_chan_unlock(chan);
8d7e1c7f 1586 l2cap_chan_put(chan);
e90bac06
GP		 1587}
1588
721c4181 1589static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1590{
721c4181
GP		 1591 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1592 retrans_timer.work);
e90bac06 1593
49208c9c 1594 BT_DBG("chan %p", chan);
0e98958d 1595
6be36555
AE		 1596 l2cap_chan_lock(chan);
1597
6a026610 1598 chan->retry_count = 1;
1a09bcb9 1599 __set_monitor_timer(chan);
e90bac06 1600
e2ab4353 1601 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1602
525cd185 1603 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555
AE		 1604
1605 l2cap_chan_unlock(chan);
8d7e1c7f 1606 l2cap_chan_put(chan);
e90bac06
GP		 1607}
1608
42e5c802 1609static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1610{
1c2acffb 1611 struct sk_buff *skb;
1da177e4 1612
58d35f87 1613 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1614 chan->unacked_frames) {
3ce3514f 1615 if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
1c2acffb 1616 break;
1da177e4 1617
58d35f87 1618 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1619 kfree_skb(skb);
1da177e4 1620
6a026610 1621 chan->unacked_frames--;
1c2acffb 1622 }
1da177e4 1623
6a026610 1624 if (!chan->unacked_frames)
1a09bcb9 1625 __clear_retrans_timer(chan);
1c2acffb 1626}
1da177e4 1627
67c9e840 1628static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1629{
ccbb84af 1630 struct sk_buff *skb;
88843ab0
AE		 1631 u32 control;
1632 u16 fcs;
6840ed07 1633
58d35f87 1634 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1635 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1636 control |= __set_txseq(chan, chan->next_tx_seq);
94122bbe 1637 control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
88843ab0 1638 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1639
47d1ec61 1640 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1641 fcs = crc16(0, (u8 *)skb->data,
1642 skb->len - L2CAP_FCS_SIZE);
1643 put_unaligned_le16(fcs,
1644 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1645 }
1646
4343478f 1647 l2cap_do_send(chan, skb);
6840ed07 1648
836be934 1649 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1650 }
6840ed07
GP		 1651}
1652
fb45de7d 1653static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1654{
8f17154f 1655 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1656 u16 fcs;
1657 u32 control;
8f17154f 1658
58d35f87 1659 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1660 if (!skb)
1661 return;
8f17154f 1662
3ce3514f 1663 while (bt_cb(skb)->control.txseq != tx_seq) {
58d35f87 1664 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1665 return;
8f17154f 1666
d1726b6d
SJ		 1667 skb = skb_queue_next(&chan->tx_q, skb);
1668 }
8f17154f 1669
3ce3514f
MM		 1670 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1671 chan->remote_max_tx) {
8c1d787b 1672 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1673 return;
1674 }
1675
1676 tx_skb = skb_clone(skb, GFP_ATOMIC);
3ce3514f 1677 bt_cb(skb)->control.retries++;
88843ab0
AE		 1678
1679 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1680 control &= __get_sar_mask(chan);
3cb123d1 1681
e2ab4353 1682 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1683 control |= __set_ctrl_final(chan);
95ffa978 1684
0b209fae 1685 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1686 control |= __set_txseq(chan, tx_seq);
3cb123d1 1687
88843ab0 1688 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1689
47d1ec61 1690 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1691 fcs = crc16(0, (u8 *)tx_skb->data,
1692 tx_skb->len - L2CAP_FCS_SIZE);
1693 put_unaligned_le16(fcs,
1694 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1695 }
1696
4343478f 1697 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1698}
1699
67c9e840 1700static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1701{
1702 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1703 u16 fcs;
1704 u32 control;
9a9c6a34 1705 int nsent = 0;
1c2acffb 1706
89bc500e 1707 if (chan->state != BT_CONNECTED)
c13ffa62 1708 return -ENOTCONN;
e90bac06 1709
94122bbe
MM		 1710 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1711 return 0;
1712
58d35f87 1713 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1714
3ce3514f
MM		 1715 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1716 chan->remote_max_tx) {
8c1d787b 1717 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1718 break;
1719 }
1720
e420aba3
AE		 1721 tx_skb = skb_clone(skb, GFP_ATOMIC);
1722
3ce3514f 1723 bt_cb(skb)->control.retries++;
e90bac06 1724
88843ab0 1725 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1726 control &= __get_sar_mask(chan);
95ffa978 1727
e2ab4353 1728 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1729 control |= __set_ctrl_final(chan);
e2ab4353 1730
0b209fae 1731 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1732 control |= __set_txseq(chan, chan->next_tx_seq);
94122bbe 1733 control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
1c2acffb 1734
88843ab0 1735 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1736
47d1ec61 1737 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1738 fcs = crc16(0, (u8 *)skb->data,
1739 tx_skb->len - L2CAP_FCS_SIZE);
1740 put_unaligned_le16(fcs, skb->data +
1741 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1742 }
1743
4343478f 1744 l2cap_do_send(chan, tx_skb);
9a9c6a34 1745
1a09bcb9 1746 __set_retrans_timer(chan);
1c2acffb 1747
3ce3514f 1748 bt_cb(skb)->control.txseq = chan->next_tx_seq;
836be934
AE		 1749
1750 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1751
3ce3514f 1752 if (bt_cb(skb)->control.retries == 1) {
6a026610 1753 chan->unacked_frames++;
930fa4ae
SJ		 1754
1755 if (!nsent++)
1756 __clear_ack_timer(chan);
8ed7a0ae 1757 }
23e9fde2 1758
6a026610 1759 chan->frames_sent++;
1c2acffb 1760
58d35f87
GP		 1761 if (skb_queue_is_last(&chan->tx_q, skb))
1762 chan->tx_send_head = NULL;
1c2acffb 1763 else
58d35f87 1764 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1c2acffb
GP		 1765 }
1766
9e917af1
GP		 1767 return nsent;
1768}
1769
525cd185 1770static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1771{
dfc909be
GP		 1772 int ret;
1773
58d35f87
GP		 1774 if (!skb_queue_empty(&chan->tx_q))
1775 chan->tx_send_head = chan->tx_q.next;
dfc909be 1776
42e5c802 1777 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1778 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1779 return ret;
1780}
1781
b17e73bb 1782static void __l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1783{
88843ab0 1784 u32 control = 0;
9e917af1 1785
0b209fae 1786 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1787
e2ab4353 1788 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1789 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1790 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1791 l2cap_send_sframe(chan, control);
9a9c6a34 1792 return;
9e917af1 1793 }
dfc909be 1794
525cd185 1795 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1796 return;
1797
ab784b73 1798 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1799 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1800}
1801
b17e73bb
SJ		 1802static void l2cap_send_ack(struct l2cap_chan *chan)
1803{
1804 __clear_ack_timer(chan);
1805 __l2cap_send_ack(chan);
1806}
1807
525cd185 1808static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1809{
1810 struct srej_list *tail;
88843ab0 1811 u32 control;
99b0d4b7 1812
ab784b73 1813 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1814 control |= __set_ctrl_final(chan);
99b0d4b7 1815
39d5a3ee 1816 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1817 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1818
525cd185 1819 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1820}
1821
04124681
GP		 1822static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1823 struct msghdr *msg, int len,
1824 int count, struct sk_buff *skb)
1c2acffb 1825{
0952a57a 1826 struct l2cap_conn *conn = chan->conn;
1c2acffb 1827 struct sk_buff **frag;
90338947 1828 int sent = 0;
1da177e4 1829
59203a21 1830 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1831 return -EFAULT;
1da177e4
LT		 1832
1833 sent += count;
1834 len -= count;
1835
1836 /* Continuation fragments (no L2CAP header) */
1837 frag = &skb_shinfo(skb)->frag_list;
1838 while (len) {
1839 count = min_t(unsigned int, conn->mtu, len);
1840
2f7719ce 1841 *frag = chan->ops->alloc_skb(chan, count,
90338947 1842 msg->msg_flags & MSG_DONTWAIT);
2f7719ce 1843
90338947
GP		 1844 if (IS_ERR(*frag))
1845 return PTR_ERR(*frag);
1c2acffb
GP		 1846 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1847 return -EFAULT;
1da177e4 1848
5e59b791
LAD		 1849 (*frag)->priority = skb->priority;
1850
1da177e4
LT		 1851 sent += count;
1852 len -= count;
1853
1854 frag = &(*frag)->next;
1855 }
1da177e4
LT		 1856
1857 return sent;
1c2acffb 1858}
1da177e4 1859
5e59b791
LAD		 1860static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1861 struct msghdr *msg, size_t len,
1862 u32 priority)
1c2acffb 1863{
8c1d787b 1864 struct l2cap_conn *conn = chan->conn;
1c2acffb 1865 struct sk_buff *skb;
03a51213 1866 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1867 struct l2cap_hdr *lh;
1868
6d5922b0 1869 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1870
1871 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1872
1873 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1874 msg->msg_flags & MSG_DONTWAIT);
1875 if (IS_ERR(skb))
1876 return skb;
1c2acffb 1877
5e59b791
LAD		 1878 skb->priority = priority;
1879
1c2acffb
GP		 1880 /* Create L2CAP header */
1881 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1882 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 1883 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
1884 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 1885
0952a57a 1886 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1887 if (unlikely(err < 0)) {
1888 kfree_skb(skb);
1889 return ERR_PTR(err);
1890 }
1891 return skb;
1892}
1893
5e59b791
LAD		 1894static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1895 struct msghdr *msg, size_t len,
1896 u32 priority)
1c2acffb 1897{
8c1d787b 1898 struct l2cap_conn *conn = chan->conn;
1c2acffb 1899 struct sk_buff *skb;
f2ba7fae 1900 int err, count;
1c2acffb
GP		 1901 struct l2cap_hdr *lh;
1902
6d5922b0 1903 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1904
f2ba7fae 1905 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 1906
f2ba7fae 1907 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 1908 msg->msg_flags & MSG_DONTWAIT);
1909 if (IS_ERR(skb))
1910 return skb;
1c2acffb 1911
5e59b791
LAD		 1912 skb->priority = priority;
1913
1c2acffb
GP		 1914 /* Create L2CAP header */
1915 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1916 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 1917 lh->len = cpu_to_le16(len);
1c2acffb 1918
0952a57a 1919 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1920 if (unlikely(err < 0)) {
1921 kfree_skb(skb);
1922 return ERR_PTR(err);
1923 }
1924 return skb;
1925}
1926
ab0ff76d
LAD		 1927static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1928 struct msghdr *msg, size_t len,
94122bbe 1929 u16 sdulen)
1c2acffb 1930{
8c1d787b 1931 struct l2cap_conn *conn = chan->conn;
1c2acffb 1932 struct sk_buff *skb;
e4ca6d98 1933 int err, count, hlen;
1c2acffb
GP		 1934 struct l2cap_hdr *lh;
1935
6d5922b0 1936 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1937
0ee0d208
GP		 1938 if (!conn)
1939 return ERR_PTR(-ENOTCONN);
1940
e4ca6d98
AE		 1941 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1942 hlen = L2CAP_EXT_HDR_SIZE;
1943 else
1944 hlen = L2CAP_ENH_HDR_SIZE;
1945
c74e560c 1946 if (sdulen)
03a51213 1947 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1948
47d1ec61 1949 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1950 hlen += L2CAP_FCS_SIZE;
fcc203c3 1951
1c2acffb 1952 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1953
1954 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1955 msg->msg_flags & MSG_DONTWAIT);
1956 if (IS_ERR(skb))
1957 return skb;
1c2acffb
GP		 1958
1959 /* Create L2CAP header */
1960 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1961 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1962 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 1963
94122bbe 1964 __put_control(chan, 0, skb_put(skb, __ctrl_size(chan)));
88843ab0 1965
c74e560c 1966 if (sdulen)
03a51213 1967 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 1968
0952a57a 1969 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1970 if (unlikely(err < 0)) {
1971 kfree_skb(skb);
1972 return ERR_PTR(err);
1973 }
e90bac06 1974
47d1ec61 1975 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1976 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1977
3ce3514f 1978 bt_cb(skb)->control.retries = 0;
1c2acffb 1979 return skb;
1da177e4
LT		 1980}
1981
94122bbe
MM		 1982static int l2cap_segment_sdu(struct l2cap_chan *chan,
1983 struct sk_buff_head *seg_queue,
1984 struct msghdr *msg, size_t len)
c74e560c 1985{
c74e560c 1986 struct sk_buff *skb;
94122bbe
MM		 1987 u16 sdu_len;
1988 size_t pdu_len;
1989 int err = 0;
1990 u8 sar;
c74e560c 1991
94122bbe 1992 BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
c74e560c 1993
94122bbe
MM		 1994 /* It is critical that ERTM PDUs fit in a single HCI fragment,
1995 * so fragmented skbs are not used. The HCI layer's handling
1996 * of fragmented skbs is not compatible with ERTM's queueing.
1997 */
c74e560c 1998
94122bbe
MM		 1999 /* PDU size is derived from the HCI MTU */
2000 pdu_len = chan->conn->mtu;
c74e560c 2001
94122bbe
MM		 2002 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2003
2004 /* Adjust for largest possible L2CAP overhead. */
2005 pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
2006
2007 /* Remote device may have requested smaller PDUs */
2008 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2009
2010 if (len <= pdu_len) {
2011 sar = L2CAP_SAR_UNSEGMENTED;
2012 sdu_len = 0;
2013 pdu_len = len;
2014 } else {
2015 sar = L2CAP_SAR_START;
2016 sdu_len = len;
2017 pdu_len -= L2CAP_SDULEN_SIZE;
2018 }
2019
2020 while (len > 0) {
2021 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2022
c74e560c 2023 if (IS_ERR(skb)) {
94122bbe 2024 __skb_queue_purge(seg_queue);
c74e560c
GP		 2025 return PTR_ERR(skb);
2026 }
2027
94122bbe
MM		 2028 bt_cb(skb)->control.sar = sar;
2029 __skb_queue_tail(seg_queue, skb);
2030
2031 len -= pdu_len;
2032 if (sdu_len) {
2033 sdu_len = 0;
2034 pdu_len += L2CAP_SDULEN_SIZE;
2035 }
2036
2037 if (len <= pdu_len) {
2038 sar = L2CAP_SAR_END;
2039 pdu_len = len;
2040 } else {
2041 sar = L2CAP_SAR_CONTINUE;
2042 }
c74e560c 2043 }
c74e560c 2044
94122bbe 2045 return err;
c74e560c
GP		 2046}
2047
5e59b791
LAD		 2048int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2049 u32 priority)
9a91a04a 2050{
9a91a04a 2051 struct sk_buff *skb;
9a91a04a 2052 int err;
94122bbe 2053 struct sk_buff_head seg_queue;
9a91a04a
GP		 2054
2055 /* Connectionless channel */
715ec005 2056 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2057 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2058 if (IS_ERR(skb))
2059 return PTR_ERR(skb);
2060
2061 l2cap_do_send(chan, skb);
2062 return len;
2063 }
2064
2065 switch (chan->mode) {
2066 case L2CAP_MODE_BASIC:
2067 /* Check outgoing MTU */
2068 if (len > chan->omtu)
2069 return -EMSGSIZE;
2070
2071 /* Create a basic PDU */
5e59b791 2072 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2073 if (IS_ERR(skb))
2074 return PTR_ERR(skb);
2075
2076 l2cap_do_send(chan, skb);
2077 err = len;
2078 break;
2079
2080 case L2CAP_MODE_ERTM:
2081 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2082 /* Check outgoing MTU */
2083 if (len > chan->omtu) {
2084 err = -EMSGSIZE;
2085 break;
2086 }
9a91a04a 2087
94122bbe 2088 __skb_queue_head_init(&seg_queue);
9a91a04a 2089
94122bbe
MM		 2090 /* Do segmentation before calling in to the state machine,
2091 * since it's possible to block while waiting for memory
2092 * allocation.
2093 */
2094 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2095
94122bbe
MM		 2096 /* The channel could have been closed while segmenting,
2097 * check that it is still connected.
2098 */
2099 if (chan->state != BT_CONNECTED) {
2100 __skb_queue_purge(&seg_queue);
2101 err = -ENOTCONN;
9a91a04a
GP		 2102 }
2103
94122bbe 2104 if (err)
9a91a04a 2105 break;
9a91a04a 2106
577cfaeb
MM		 2107 if (chan->mode == L2CAP_MODE_ERTM && chan->tx_send_head == NULL)
2108 chan->tx_send_head = seg_queue.next;
94122bbe 2109 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
577cfaeb 2110
94122bbe
MM		 2111 if (chan->mode == L2CAP_MODE_ERTM)
2112 err = l2cap_ertm_send(chan);
2113 else
2114 l2cap_streaming_send(chan);
9a91a04a 2115
9a91a04a
GP		 2116 if (err >= 0)
2117 err = len;
2118
94122bbe
MM		 2119 /* If the skbs were not queued for sending, they'll still be in
2120 * seg_queue and need to be purged.
2121 */
2122 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2123 break;
2124
2125 default:
2126 BT_DBG("bad state %1.1x", chan->mode);
2127 err = -EBADFD;
2128 }
2129
2130 return err;
2131}
2132
1da177e4
LT		 2133/* Copy frame to all raw sockets on that connection */
2134static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2135{
1da177e4 2136 struct sk_buff *nskb;
48454079 2137 struct l2cap_chan *chan;
1da177e4
LT		 2138
2139 BT_DBG("conn %p", conn);
2140
3df91ea2 2141 mutex_lock(&conn->chan_lock);
3d57dc68 2142
3df91ea2 2143 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2144 struct sock *sk = chan->sk;
715ec005 2145 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2146 continue;
2147
2148 /* Don't send frame to the socket it came from */
2149 if (skb->sk == sk)
2150 continue;
af05b30b
GP		 2151 nskb = skb_clone(skb, GFP_ATOMIC);
2152 if (!nskb)
1da177e4
LT		 2153 continue;
2154
23070494 2155 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 2156 kfree_skb(nskb);
2157 }
3d57dc68 2158
3df91ea2 2159 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2160}
2161
2162/* ---- L2CAP signalling commands ---- */
2163static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2164 u8 code, u8 ident, u16 dlen, void *data)
2165{
2166 struct sk_buff *skb, **frag;
2167 struct l2cap_cmd_hdr *cmd;
2168 struct l2cap_hdr *lh;
2169 int len, count;
2170
af05b30b
GP		 2171 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2172 conn, code, ident, dlen);
1da177e4
LT		 2173
2174 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2175 count = min_t(unsigned int, conn->mtu, len);
2176
2177 skb = bt_skb_alloc(count, GFP_ATOMIC);
2178 if (!skb)
2179 return NULL;
2180
2181 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2182 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2183
2184 if (conn->hcon->type == LE_LINK)
2185 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2186 else
2187 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2188
2189 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2190 cmd->code = code;
2191 cmd->ident = ident;
aca3192c 2192 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2193
2194 if (dlen) {
2195 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2196 memcpy(skb_put(skb, count), data, count);
2197 data += count;
2198 }
2199
2200 len -= skb->len;
2201
2202 /* Continuation fragments (no L2CAP header) */
2203 frag = &skb_shinfo(skb)->frag_list;
2204 while (len) {
2205 count = min_t(unsigned int, conn->mtu, len);
2206
2207 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2208 if (!*frag)
2209 goto fail;
2210
2211 memcpy(skb_put(*frag, count), data, count);
2212
2213 len -= count;
2214 data += count;
2215
2216 frag = &(*frag)->next;
2217 }
2218
2219 return skb;
2220
2221fail:
2222 kfree_skb(skb);
2223 return NULL;
2224}
2225
2226static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2227{
2228 struct l2cap_conf_opt *opt = *ptr;
2229 int len;
2230
2231 len = L2CAP_CONF_OPT_SIZE + opt->len;
2232 *ptr += len;
2233
2234 *type = opt->type;
2235 *olen = opt->len;
2236
2237 switch (opt->len) {
2238 case 1:
2239 *val = *((u8 *) opt->val);
2240 break;
2241
2242 case 2:
bfaaeb3e 2243 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2244 break;
2245
2246 case 4:
bfaaeb3e 2247 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2248 break;
2249
2250 default:
2251 *val = (unsigned long) opt->val;
2252 break;
2253 }
2254
2255 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2256 return len;
2257}
2258
1da177e4
LT		 2259static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2260{
2261 struct l2cap_conf_opt *opt = *ptr;
2262
2263 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2264
2265 opt->type = type;
2266 opt->len = len;
2267
2268 switch (len) {
2269 case 1:
2270 *((u8 *) opt->val) = val;
2271 break;
2272
2273 case 2:
4f8b691c 2274 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2275 break;
2276
2277 case 4:
4f8b691c 2278 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2279 break;
2280
2281 default:
2282 memcpy(opt->val, (void *) val, len);
2283 break;
2284 }
2285
2286 *ptr += L2CAP_CONF_OPT_SIZE + len;
2287}
2288
f89cef09
AE		 2289static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2290{
2291 struct l2cap_conf_efs efs;
2292
1ec918ce 2293 switch (chan->mode) {
f89cef09
AE		 2294 case L2CAP_MODE_ERTM:
2295 efs.id = chan->local_id;
2296 efs.stype = chan->local_stype;
2297 efs.msdu = cpu_to_le16(chan->local_msdu);
2298 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2299 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2300 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2301 break;
2302
2303 case L2CAP_MODE_STREAMING:
2304 efs.id = 1;
2305 efs.stype = L2CAP_SERV_BESTEFFORT;
2306 efs.msdu = cpu_to_le16(chan->local_msdu);
2307 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2308 efs.acc_lat = 0;
2309 efs.flush_to = 0;
2310 break;
2311
2312 default:
2313 return;
2314 }
2315
2316 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2317 (unsigned long) &efs);
2318}
2319
721c4181 2320static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2321{
721c4181
GP		 2322 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2323 ack_timer.work);
c1b4f43b 2324
2fb9b3d4
GP		 2325 BT_DBG("chan %p", chan);
2326
6be36555
AE		 2327 l2cap_chan_lock(chan);
2328
b17e73bb 2329 __l2cap_send_ack(chan);
6be36555
AE		 2330
2331 l2cap_chan_unlock(chan);
09bfb2ee
SJ		 2332
2333 l2cap_chan_put(chan);
c1b4f43b
GP		 2334}
2335
3c588192 2336static inline int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2337{
3c588192
MM		 2338 int err;
2339
105bdf9e
MM		 2340 chan->next_tx_seq = 0;
2341 chan->expected_tx_seq = 0;
42e5c802 2342 chan->expected_ack_seq = 0;
6a026610 2343 chan->unacked_frames = 0;
42e5c802 2344 chan->buffer_seq = 0;
6a026610
GP		 2345 chan->num_acked = 0;
2346 chan->frames_sent = 0;
105bdf9e
MM		 2347 chan->last_acked_seq = 0;
2348 chan->sdu = NULL;
2349 chan->sdu_last_frag = NULL;
2350 chan->sdu_len = 0;
2351
2352 if (chan->mode != L2CAP_MODE_ERTM)
2353 return 0;
2354
2355 chan->rx_state = L2CAP_RX_STATE_RECV;
2356 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2357
721c4181
GP		 2358 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2359 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2360 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2361
f1c6775b 2362 skb_queue_head_init(&chan->srej_q);
105bdf9e 2363 skb_queue_head_init(&chan->tx_q);
1890d36b 2364
39d5a3ee 2365 INIT_LIST_HEAD(&chan->srej_l);
3c588192
MM		 2366 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2367 if (err < 0)
2368 return err;
2369
2370 return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
0565c1c2
GP		 2371}
2372
f2fcfcd6
GP		 2373static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2374{
2375 switch (mode) {
2376 case L2CAP_MODE_STREAMING:
2377 case L2CAP_MODE_ERTM:
2378 if (l2cap_mode_supported(mode, remote_feat_mask))
2379 return mode;
2380 /* fall through */
2381 default:
2382 return L2CAP_MODE_BASIC;
2383 }
2384}
2385
6327eb98
AE		 2386static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2387{
2388 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2389}
2390
f89cef09
AE		 2391static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2392{
2393 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2394}
2395
6327eb98
AE		 2396static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2397{
2398 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2399 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2400 /* use extended control field */
2401 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2402 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2403 } else {
6327eb98
AE		 2404 chan->tx_win = min_t(u16, chan->tx_win,
2405 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2406 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2407 }
6327eb98
AE		 2408}
2409
710f9b0a 2410static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2411{
1da177e4 2412 struct l2cap_conf_req *req = data;
0c1bc5c6 2413 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2414 void *ptr = req->data;
c8f79162 2415 u16 size;
1da177e4 2416
49208c9c 2417 BT_DBG("chan %p", chan);
1da177e4 2418
73ffa904 2419 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2420 goto done;
2421
0c1bc5c6 2422 switch (chan->mode) {
f2fcfcd6
GP		 2423 case L2CAP_MODE_STREAMING:
2424 case L2CAP_MODE_ERTM:
c1360a1c 2425 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2426 break;
85eb53c6 2427
f89cef09
AE		 2428 if (__l2cap_efs_supported(chan))
2429 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2430
2ba13ed6 2431 /* fall through */
f2fcfcd6 2432 default:
8c1d787b 2433 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2434 break;
2435 }
2436
2437done:
0c1bc5c6
GP		 2438 if (chan->imtu != L2CAP_DEFAULT_MTU)
2439 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2440
0c1bc5c6 2441 switch (chan->mode) {
65c7c491 2442 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2443 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2444 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2445 break;
2446
62547752
GP		 2447 rfc.mode = L2CAP_MODE_BASIC;
2448 rfc.txwin_size = 0;
2449 rfc.max_transmit = 0;
2450 rfc.retrans_timeout = 0;
2451 rfc.monitor_timeout = 0;
2452 rfc.max_pdu_size = 0;
2453
63406504
GP		 2454 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2455 (unsigned long) &rfc);
65c7c491
MH		 2456 break;
2457
2458 case L2CAP_MODE_ERTM:
2459 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2460 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2461 rfc.retrans_timeout = 0;
2462 rfc.monitor_timeout = 0;
c8f79162
AE		 2463
2464 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2465 L2CAP_EXT_HDR_SIZE -
2466 L2CAP_SDULEN_SIZE -
2467 L2CAP_FCS_SIZE);
2468 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2469
6327eb98
AE		 2470 l2cap_txwin_setup(chan);
2471
2472 rfc.txwin_size = min_t(u16, chan->tx_win,
2473 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2474
63406504
GP		 2475 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2476 (unsigned long) &rfc);
2477
f89cef09
AE		 2478 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2479 l2cap_add_opt_efs(&ptr, chan);
2480
8c1d787b 2481 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2482 break;
2483
47d1ec61 2484 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2485 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2486 chan->fcs = L2CAP_FCS_NONE;
2487 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2488 }
6327eb98
AE		 2489
2490 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2491 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2492 chan->tx_win);
f2fcfcd6
GP		 2493 break;
2494
2495 case L2CAP_MODE_STREAMING:
2496 rfc.mode = L2CAP_MODE_STREAMING;
2497 rfc.txwin_size = 0;
2498 rfc.max_transmit = 0;
2499 rfc.retrans_timeout = 0;
2500 rfc.monitor_timeout = 0;
c8f79162
AE		 2501
2502 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2503 L2CAP_EXT_HDR_SIZE -
2504 L2CAP_SDULEN_SIZE -
2505 L2CAP_FCS_SIZE);
2506 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2507
63406504
GP		 2508 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2509 (unsigned long) &rfc);
2510
f89cef09
AE		 2511 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2512 l2cap_add_opt_efs(&ptr, chan);
2513
8c1d787b 2514 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2515 break;
2516
47d1ec61 2517 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2518 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2519 chan->fcs = L2CAP_FCS_NONE;
2520 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2521 }
65c7c491
MH		 2522 break;
2523 }
1da177e4 2524
fe4128e0 2525 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2526 req->flags = cpu_to_le16(0);
1da177e4
LT		 2527
2528 return ptr - data;
2529}
2530
73ffa904 2531static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2532{
5dee9e7c
MH		 2533 struct l2cap_conf_rsp *rsp = data;
2534 void *ptr = rsp->data;
73ffa904
GP		 2535 void *req = chan->conf_req;
2536 int len = chan->conf_len;
5dee9e7c
MH		 2537 int type, hint, olen;
2538 unsigned long val;
6464f35f 2539 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2540 struct l2cap_conf_efs efs;
2541 u8 remote_efs = 0;
861d6882 2542 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2543 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2544 u16 size;
1da177e4 2545
73ffa904 2546 BT_DBG("chan %p", chan);
820ae1b8 2547
5dee9e7c
MH		 2548 while (len >= L2CAP_CONF_OPT_SIZE) {
2549 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2550
589d2746 2551 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2552 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2553
2554 switch (type) {
2555 case L2CAP_CONF_MTU:
861d6882 2556 mtu = val;
5dee9e7c
MH		 2557 break;
2558
2559 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2560 chan->flush_to = val;
5dee9e7c
MH		 2561 break;
2562
2563 case L2CAP_CONF_QOS:
2564 break;
2565
6464f35f
MH		 2566 case L2CAP_CONF_RFC:
2567 if (olen == sizeof(rfc))
2568 memcpy(&rfc, (void *) val, olen);
2569 break;
2570
fcc203c3
GP		 2571 case L2CAP_CONF_FCS:
2572 if (val == L2CAP_FCS_NONE)
c1360a1c 2573 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2574 break;
fcc203c3 2575
42dceae2
AE		 2576 case L2CAP_CONF_EFS:
2577 remote_efs = 1;
2578 if (olen == sizeof(efs))
2579 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2580 break;
2581
6327eb98
AE		 2582 case L2CAP_CONF_EWS:
2583 if (!enable_hs)
2584 return -ECONNREFUSED;
fcc203c3 2585
6327eb98
AE		 2586 set_bit(FLAG_EXT_CTRL, &chan->flags);
2587 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2588 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2589 chan->remote_tx_win = val;
fcc203c3
GP		 2590 break;
2591
5dee9e7c
MH		 2592 default:
2593 if (hint)
2594 break;
2595
2596 result = L2CAP_CONF_UNKNOWN;
2597 *((u8 *) ptr++) = type;
2598 break;
2599 }
2600 }
2601
73ffa904 2602 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2603 goto done;
2604
0c1bc5c6 2605 switch (chan->mode) {
f2fcfcd6
GP		 2606 case L2CAP_MODE_STREAMING:
2607 case L2CAP_MODE_ERTM:
c1360a1c 2608 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2609 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2610 chan->conn->feat_mask);
85eb53c6
GP		 2611 break;
2612 }
2613
42dceae2
AE		 2614 if (remote_efs) {
2615 if (__l2cap_efs_supported(chan))
2616 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2617 else
2618 return -ECONNREFUSED;
2619 }
2620
0c1bc5c6 2621 if (chan->mode != rfc.mode)
f2fcfcd6 2622 return -ECONNREFUSED;
742e519b 2623
f2fcfcd6 2624 break;
f2fcfcd6
GP		 2625 }
2626
2627done:
0c1bc5c6 2628 if (chan->mode != rfc.mode) {
f2fcfcd6 2629 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2630 rfc.mode = chan->mode;
f2fcfcd6 2631
73ffa904 2632 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2633 return -ECONNREFUSED;
2634
2635 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2636 sizeof(rfc), (unsigned long) &rfc);
2637 }
2638
5dee9e7c
MH		 2639 if (result == L2CAP_CONF_SUCCESS) {
2640 /* Configure output options and let the other side know
2641 * which ones we don't like. */
2642
f2fcfcd6
GP		 2643 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2644 result = L2CAP_CONF_UNACCEPT;
2645 else {
0c1bc5c6 2646 chan->omtu = mtu;
c1360a1c 2647 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2648 }
0c1bc5c6 2649 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2650
42dceae2
AE		 2651 if (remote_efs) {
2652 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2653 efs.stype != L2CAP_SERV_NOTRAFIC &&
2654 efs.stype != chan->local_stype) {
2655
2656 result = L2CAP_CONF_UNACCEPT;
2657
2658 if (chan->num_conf_req >= 1)
2659 return -ECONNREFUSED;
2660
2661 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2662 sizeof(efs),
42dceae2 2663 (unsigned long) &efs);
0e8b207e 2664 } else {
3e6b3b95 2665 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2666 result = L2CAP_CONF_PENDING;
2667 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2668 }
2669 }
2670
f2fcfcd6
GP		 2671 switch (rfc.mode) {
2672 case L2CAP_MODE_BASIC:
47d1ec61 2673 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2674 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2675 break;
2676
2677 case L2CAP_MODE_ERTM:
6327eb98
AE		 2678 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2679 chan->remote_tx_win = rfc.txwin_size;
2680 else
2681 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2682
2c03a7a4 2683 chan->remote_max_tx = rfc.max_transmit;
1c762159 2684
c8f79162
AE		 2685 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2686 chan->conn->mtu -
2687 L2CAP_EXT_HDR_SIZE -
2688 L2CAP_SDULEN_SIZE -
2689 L2CAP_FCS_SIZE);
2690 rfc.max_pdu_size = cpu_to_le16(size);
2691 chan->remote_mps = size;
f2fcfcd6 2692
10467e9e 2693 rfc.retrans_timeout =
4fd21a88 2694 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 2695 rfc.monitor_timeout =
4fd21a88 2696 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2697
c1360a1c 2698 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2699
2700 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2701 sizeof(rfc), (unsigned long) &rfc);
2702
42dceae2
AE		 2703 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2704 chan->remote_id = efs.id;
2705 chan->remote_stype = efs.stype;
2706 chan->remote_msdu = le16_to_cpu(efs.msdu);
2707 chan->remote_flush_to =
2708 le32_to_cpu(efs.flush_to);
2709 chan->remote_acc_lat =
2710 le32_to_cpu(efs.acc_lat);
2711 chan->remote_sdu_itime =
2712 le32_to_cpu(efs.sdu_itime);
2713 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2714 sizeof(efs), (unsigned long) &efs);
2715 }
f2fcfcd6
GP		 2716 break;
2717
2718 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2719 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2720 chan->conn->mtu -
2721 L2CAP_EXT_HDR_SIZE -
2722 L2CAP_SDULEN_SIZE -
2723 L2CAP_FCS_SIZE);
2724 rfc.max_pdu_size = cpu_to_le16(size);
2725 chan->remote_mps = size;
f2fcfcd6 2726
c1360a1c 2727 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2728
2729 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2730 sizeof(rfc), (unsigned long) &rfc);
2731
f2fcfcd6
GP		 2732 break;
2733
2734 default:
5dee9e7c 2735 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2736
6464f35f 2737 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2738 rfc.mode = chan->mode;
f2fcfcd6 2739 }
6464f35f 2740
f2fcfcd6 2741 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2742 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2743 }
fe4128e0 2744 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2745 rsp->result = cpu_to_le16(result);
2746 rsp->flags = cpu_to_le16(0x0000);
2747
2748 return ptr - data;
1da177e4
LT		 2749}
2750
b4450035 2751static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2752{
f2fcfcd6
GP		 2753 struct l2cap_conf_req *req = data;
2754 void *ptr = req->data;
2755 int type, olen;
2756 unsigned long val;
36e999a8 2757 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 2758 struct l2cap_conf_efs efs;
f2fcfcd6 2759
fe4128e0 2760 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2761
2762 while (len >= L2CAP_CONF_OPT_SIZE) {
2763 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2764
2765 switch (type) {
2766 case L2CAP_CONF_MTU:
2767 if (val < L2CAP_DEFAULT_MIN_MTU) {
2768 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2769 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2770 } else
0c1bc5c6
GP		 2771 chan->imtu = val;
2772 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2773 break;
2774
2775 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2776 chan->flush_to = val;
f2fcfcd6 2777 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2778 2, chan->flush_to);
f2fcfcd6
GP		 2779 break;
2780
2781 case L2CAP_CONF_RFC:
2782 if (olen == sizeof(rfc))
2783 memcpy(&rfc, (void *)val, olen);
2784
c1360a1c 2785 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2786 rfc.mode != chan->mode)
f2fcfcd6
GP		 2787 return -ECONNREFUSED;
2788
47d1ec61 2789 chan->fcs = 0;
f2fcfcd6
GP		 2790
2791 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2792 sizeof(rfc), (unsigned long) &rfc);
2793 break;
6327eb98
AE		 2794
2795 case L2CAP_CONF_EWS:
2796 chan->tx_win = min_t(u16, val,
2797 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2798 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2799 chan->tx_win);
6327eb98 2800 break;
66af7aaf
AE		 2801
2802 case L2CAP_CONF_EFS:
2803 if (olen == sizeof(efs))
2804 memcpy(&efs, (void *)val, olen);
2805
2806 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2807 efs.stype != L2CAP_SERV_NOTRAFIC &&
2808 efs.stype != chan->local_stype)
2809 return -ECONNREFUSED;
2810
2811 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2812 sizeof(efs), (unsigned long) &efs);
2813 break;
f2fcfcd6
GP		 2814 }
2815 }
2816
0c1bc5c6 2817 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2818 return -ECONNREFUSED;
2819
0c1bc5c6 2820 chan->mode = rfc.mode;
6c2ea7a8 2821
0e8b207e 2822 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2823 switch (rfc.mode) {
2824 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2825 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2826 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2827 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2828
2829 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2830 chan->local_msdu = le16_to_cpu(efs.msdu);
2831 chan->local_sdu_itime =
2832 le32_to_cpu(efs.sdu_itime);
2833 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2834 chan->local_flush_to =
2835 le32_to_cpu(efs.flush_to);
2836 }
f2fcfcd6 2837 break;
66af7aaf 2838
f2fcfcd6 2839 case L2CAP_MODE_STREAMING:
47d1ec61 2840 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2841 }
2842 }
2843
fe4128e0 2844 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2845 req->flags = cpu_to_le16(0x0000);
2846
2847 return ptr - data;
2848}
2849
fe4128e0 2850static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2851{
2852 struct l2cap_conf_rsp *rsp = data;
2853 void *ptr = rsp->data;
1da177e4 2854
fe4128e0 2855 BT_DBG("chan %p", chan);
1da177e4 2856
fe4128e0 2857 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2858 rsp->result = cpu_to_le16(result);
aca3192c 2859 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2860
2861 return ptr - data;
2862}
2863
8c1d787b 2864void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2865{
2866 struct l2cap_conn_rsp rsp;
8c1d787b 2867 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2868 u8 buf[128];
2869
fe4128e0
GP		 2870 rsp.scid = cpu_to_le16(chan->dcid);
2871 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2872 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2873 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2874 l2cap_send_cmd(conn, chan->ident,
2875 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2876
c1360a1c 2877 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2878 return;
2879
710f9b0a
GP		 2880 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2881 l2cap_build_conf_req(chan, buf), buf);
2882 chan->num_conf_req++;
2883}
2884
47d1ec61 2885static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2886{
7b1c0049
GP		 2887 int type, olen;
2888 unsigned long val;
2889 struct l2cap_conf_rfc rfc;
2890
47d1ec61 2891 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2892
0c1bc5c6 2893 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2894 return;
2895
2896 while (len >= L2CAP_CONF_OPT_SIZE) {
2897 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2898
2899 switch (type) {
2900 case L2CAP_CONF_RFC:
2901 if (olen == sizeof(rfc))
2902 memcpy(&rfc, (void *)val, olen);
2903 goto done;
2904 }
2905 }
2906
36e999a8
MM		 2907 /* Use sane default values in case a misbehaving remote device
2908 * did not send an RFC option.
2909 */
2910 rfc.mode = chan->mode;
2911 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2912 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2913 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2914
2915 BT_ERR("Expected RFC option was not found, using defaults");
2916
7b1c0049
GP		 2917done:
2918 switch (rfc.mode) {
2919 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2920 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2921 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2922 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2923 break;
2924 case L2CAP_MODE_STREAMING:
47d1ec61 2925 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2926 }
2927}
2928
4e8402a3
MH		 2929static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2930{
e2fd318e 2931 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2932
e2fd318e 2933 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2934 return 0;
2935
2936 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2937 cmd->ident == conn->info_ident) {
17cd3f37 2938 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 2939
2940 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2941 conn->info_ident = 0;
984947dc 2942
4e8402a3
MH		 2943 l2cap_conn_start(conn);
2944 }
2945
2946 return 0;
2947}
2948
1da177e4
LT		 2949static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2950{
1da177e4
LT		 2951 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2952 struct l2cap_conn_rsp rsp;
23691d75 2953 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2954 struct sock *parent, *sk = NULL;
e7c29cb1 2955 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2956
2957 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2958 __le16 psm = req->psm;
1da177e4 2959
097db76c 2960 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 2961
2962 /* Check if we have socket listening on psm */
c2287681 2963 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 2964 if (!pchan) {
1da177e4
LT		 2965 result = L2CAP_CR_BAD_PSM;
2966 goto sendresp;
2967 }
2968
23691d75
GP		 2969 parent = pchan->sk;
2970
3df91ea2 2971 mutex_lock(&conn->chan_lock);
aa2ac881 2972 lock_sock(parent);
e0f0cb56 2973
e7c29cb1
MH		 2974 /* Check if the ACL is secure enough (if not SDP) */
2975 if (psm != cpu_to_le16(0x0001) &&
2976 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2977 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2978 result = L2CAP_CR_SEC_BLOCK;
2979 goto response;
2980 }
2981
1da177e4
LT		 2982 result = L2CAP_CR_NO_MEM;
2983
2984 /* Check for backlog size */
2985 if (sk_acceptq_is_full(parent)) {
8e87d142 2986 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2987 goto response;
2988 }
2989
80808e43
GP		 2990 chan = pchan->ops->new_connection(pchan->data);
2991 if (!chan)
1da177e4
LT		 2992 goto response;
2993
80808e43
GP		 2994 sk = chan->sk;
2995
1da177e4 2996 /* Check if we already have channel with that dcid */
baa7e1fa 2997 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 2998 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 2999 chan->ops->close(chan->data);
1da177e4
LT		 3000 goto response;
3001 }
3002
3003 hci_conn_hold(conn->hcon);
3004
1da177e4
LT		 3005 bacpy(&bt_sk(sk)->src, conn->src);
3006 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3007 chan->psm = psm;
3008 chan->dcid = scid;
1da177e4 3009
d1010240
GP		 3010 bt_accept_enqueue(parent, sk);
3011
6be36555 3012 __l2cap_chan_add(conn, chan);
48454079 3013
fe4128e0 3014 dcid = chan->scid;
1da177e4 3015
c9b66675 3016 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3017
fc7f8a7e 3018 chan->ident = cmd->ident;
1da177e4 3019
984947dc 3020 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3021 if (l2cap_chan_check_security(chan)) {
f66dc81f 3022 if (bt_sk(sk)->defer_setup) {
0e587be7 3023 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3024 result = L2CAP_CR_PEND;
3025 status = L2CAP_CS_AUTHOR_PEND;
3026 parent->sk_data_ready(parent, 0);
3027 } else {
0e587be7 3028 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 3029 result = L2CAP_CR_SUCCESS;
3030 status = L2CAP_CS_NO_INFO;
3031 }
79d554a6 3032 } else {
0e587be7 3033 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3034 result = L2CAP_CR_PEND;
3035 status = L2CAP_CS_AUTHEN_PEND;
3036 }
3037 } else {
0e587be7 3038 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3039 result = L2CAP_CR_PEND;
3040 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3041 }
3042
1da177e4 3043response:
aa2ac881 3044 release_sock(parent);
3df91ea2 3045 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3046
3047sendresp:
aca3192c
YH		 3048 rsp.scid = cpu_to_le16(scid);
3049 rsp.dcid = cpu_to_le16(dcid);
3050 rsp.result = cpu_to_le16(result);
3051 rsp.status = cpu_to_le16(status);
1da177e4 3052 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 3053
3054 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3055 struct l2cap_info_req info;
3056 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3057
3058 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3059 conn->info_ident = l2cap_get_ident(conn);
3060
ba13ccd9 3061 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 3062
3063 l2cap_send_cmd(conn, conn->info_ident,
3064 L2CAP_INFO_REQ, sizeof(info), &info);
3065 }
3066
c1360a1c 3067 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 3068 result == L2CAP_CR_SUCCESS) {
3069 u8 buf[128];
c1360a1c 3070 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3071 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3072 l2cap_build_conf_req(chan, buf), buf);
3073 chan->num_conf_req++;
e9aeb2dd
GP		 3074 }
3075
1da177e4
LT		 3076 return 0;
3077}
3078
3079static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3080{
3081 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3082 u16 scid, dcid, result, status;
48454079 3083 struct l2cap_chan *chan;
1da177e4 3084 u8 req[128];
3df91ea2 3085 int err;
1da177e4
LT		 3086
3087 scid = __le16_to_cpu(rsp->scid);
3088 dcid = __le16_to_cpu(rsp->dcid);
3089 result = __le16_to_cpu(rsp->result);
3090 status = __le16_to_cpu(rsp->status);
3091
1b009c98
AE		 3092 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3093 dcid, scid, result, status);
1da177e4 3094
3df91ea2
AE		 3095 mutex_lock(&conn->chan_lock);
3096
1da177e4 3097 if (scid) {
3df91ea2
AE		 3098 chan = __l2cap_get_chan_by_scid(conn, scid);
3099 if (!chan) {
3100 err = -EFAULT;
3101 goto unlock;
3102 }
1da177e4 3103 } else {
3df91ea2
AE		 3104 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3105 if (!chan) {
3106 err = -EFAULT;
3107 goto unlock;
3108 }
1da177e4
LT		 3109 }
3110
3df91ea2
AE		 3111 err = 0;
3112
6be36555 3113 l2cap_chan_lock(chan);
48454079 3114
1da177e4
LT		 3115 switch (result) {
3116 case L2CAP_CR_SUCCESS:
89bc500e 3117 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3118 chan->ident = 0;
fe4128e0 3119 chan->dcid = dcid;
c1360a1c 3120 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3121
c1360a1c 3122 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3123 break;
3124
1da177e4 3125 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3126 l2cap_build_conf_req(chan, req), req);
3127 chan->num_conf_req++;
1da177e4
LT		 3128 break;
3129
3130 case L2CAP_CR_PEND:
c1360a1c 3131 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3132 break;
3133
3134 default:
48454079 3135 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3136 break;
3137 }
3138
6be36555 3139 l2cap_chan_unlock(chan);
3df91ea2
AE		 3140
3141unlock:
3142 mutex_unlock(&conn->chan_lock);
3143
3144 return err;
1da177e4
LT		 3145}
3146
47d1ec61 3147static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3148{
3149 /* FCS is enabled only in ERTM or streaming mode, if one or both
3150 * sides request it.
3151 */
0c1bc5c6 3152 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3153 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3154 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3155 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3156}
3157
88219a0f 3158static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3159{
3160 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3161 u16 dcid, flags;
3162 u8 rsp[64];
48454079 3163 struct l2cap_chan *chan;
3c588192 3164 int len, err = 0;
1da177e4
LT		 3165
3166 dcid = __le16_to_cpu(req->dcid);
3167 flags = __le16_to_cpu(req->flags);
3168
3169 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3170
baa7e1fa 3171 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3172 if (!chan)
1da177e4
LT		 3173 return -ENOENT;
3174
6be36555 3175 l2cap_chan_lock(chan);
48454079 3176
033b1142 3177 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3178 struct l2cap_cmd_rej_cid rej;
3179
3180 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3181 rej.scid = cpu_to_le16(chan->scid);
3182 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3183
df6bd743
GP		 3184 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3185 sizeof(rej), &rej);
354f60a9 3186 goto unlock;
df6bd743 3187 }
354f60a9 3188
5dee9e7c 3189 /* Reject if config buffer is too small. */
88219a0f 3190 len = cmd_len - sizeof(*req);
7ac28817 3191 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3192 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3193 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 3194 L2CAP_CONF_REJECT, flags), rsp);
3195 goto unlock;
3196 }
3197
3198 /* Store config. */
73ffa904
GP		 3199 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3200 chan->conf_len += len;
1da177e4
LT		 3201
3202 if (flags & 0x0001) {
3203 /* Incomplete config. Send empty response. */
3204 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3205 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 3206 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 3207 goto unlock;
3208 }
3209
3210 /* Complete config. */
73ffa904 3211 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3212 if (len < 0) {
e92c8e70 3213 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3214 goto unlock;
f2fcfcd6 3215 }
1da177e4 3216
5dee9e7c 3217 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3218 chan->num_conf_rsp++;
5dee9e7c 3219
5dee9e7c 3220 /* Reset config buffer. */
73ffa904 3221 chan->conf_len = 0;
5dee9e7c 3222
c1360a1c 3223 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3224 goto unlock;
3225
c1360a1c 3226 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3227 set_default_fcs(chan);
fcc203c3 3228
89bc500e 3229 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 3230
105bdf9e
MM		 3231 if (chan->mode == L2CAP_MODE_ERTM ||
3232 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3233 err = l2cap_ertm_init(chan);
3234
3235 if (err < 0)
3236 l2cap_send_disconn_req(chan->conn, chan, -err);
3237 else
3238 l2cap_chan_ready(chan);
0565c1c2 3239
876d9484
MH		 3240 goto unlock;
3241 }
3242
c1360a1c 3243 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3244 u8 buf[64];
1da177e4 3245 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3246 l2cap_build_conf_req(chan, buf), buf);
3247 chan->num_conf_req++;
1da177e4
LT		 3248 }
3249
0e8b207e
AE		 3250 /* Got Conf Rsp PENDING from remote side and asume we sent
3251 Conf Rsp PENDING in the code above */
3252 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3253 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3254
3255 /* check compatibility */
3256
3257 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3258 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3259
3260 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3261 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 3262 L2CAP_CONF_SUCCESS, 0x0000), rsp);
3263 }
3264
1da177e4 3265unlock:
6be36555 3266 l2cap_chan_unlock(chan);
3c588192 3267 return err;
1da177e4
LT		 3268}
3269
3270static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3271{
3272 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3273 u16 scid, flags, result;
48454079 3274 struct l2cap_chan *chan;
61386cba 3275 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3276 int err = 0;
1da177e4
LT		 3277
3278 scid = __le16_to_cpu(rsp->scid);
3279 flags = __le16_to_cpu(rsp->flags);
3280 result = __le16_to_cpu(rsp->result);
3281
61386cba
AE		 3282 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3283 result, len);
1da177e4 3284
baa7e1fa 3285 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3286 if (!chan)
1da177e4
LT		 3287 return 0;
3288
6be36555 3289 l2cap_chan_lock(chan);
48454079 3290
1da177e4
LT		 3291 switch (result) {
3292 case L2CAP_CONF_SUCCESS:
47d1ec61 3293 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3294 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3295 break;
3296
0e8b207e
AE		 3297 case L2CAP_CONF_PENDING:
3298 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3299
3300 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3301 char buf[64];
3302
3303 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3304 buf, &result);
3305 if (len < 0) {
3306 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3307 goto done;
3308 }
3309
3310 /* check compatibility */
3311
3312 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3313 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3314
3315 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3316 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 3317 L2CAP_CONF_SUCCESS, 0x0000), buf);
3318 }
3319 goto done;
3320
1da177e4 3321 case L2CAP_CONF_UNACCEPT:
73ffa904 3322 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3323 char req[64];
3324
c2c77ec8 3325 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3326 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3327 goto done;
3328 }
3329
f2fcfcd6
GP		 3330 /* throw out any old stored conf requests */
3331 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3332 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3333 req, &result);
f2fcfcd6 3334 if (len < 0) {
e92c8e70 3335 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3336 goto done;
3337 }
3338
3339 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3340 L2CAP_CONF_REQ, len, req);
73ffa904 3341 chan->num_conf_req++;
f2fcfcd6
GP		 3342 if (result != L2CAP_CONF_SUCCESS)
3343 goto done;
3344 break;
1da177e4
LT		 3345 }
3346
8e87d142 3347 default:
6be36555 3348 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3349
ba13ccd9 3350 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3351 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3352 goto done;
3353 }
3354
3355 if (flags & 0x01)
3356 goto done;
3357
c1360a1c 3358 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3359
c1360a1c 3360 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3361 set_default_fcs(chan);
fcc203c3 3362
89bc500e 3363 l2cap_state_change(chan, BT_CONNECTED);
105bdf9e
MM		 3364 if (chan->mode == L2CAP_MODE_ERTM ||
3365 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3366 err = l2cap_ertm_init(chan);
0565c1c2 3367
3c588192
MM		 3368 if (err < 0)
3369 l2cap_send_disconn_req(chan->conn, chan, -err);
3370 else
3371 l2cap_chan_ready(chan);
1da177e4
LT		 3372 }
3373
3374done:
6be36555 3375 l2cap_chan_unlock(chan);
3c588192 3376 return err;
1da177e4
LT		 3377}
3378
3379static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3380{
3381 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3382 struct l2cap_disconn_rsp rsp;
3383 u16 dcid, scid;
48454079 3384 struct l2cap_chan *chan;
1da177e4
LT		 3385 struct sock *sk;
3386
3387 scid = __le16_to_cpu(req->scid);
3388 dcid = __le16_to_cpu(req->dcid);
3389
3390 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3391
3df91ea2
AE		 3392 mutex_lock(&conn->chan_lock);
3393
3394 chan = __l2cap_get_chan_by_scid(conn, dcid);
3395 if (!chan) {
3396 mutex_unlock(&conn->chan_lock);
1da177e4 3397 return 0;
3df91ea2 3398 }
1da177e4 3399
6be36555
AE		 3400 l2cap_chan_lock(chan);
3401
48454079
GP		 3402 sk = chan->sk;
3403
fe4128e0
GP		 3404 rsp.dcid = cpu_to_le16(chan->scid);
3405 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3406 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3407
6be36555 3408 lock_sock(sk);
1da177e4 3409 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3410 release_sock(sk);
1da177e4 3411
61d6ef3e 3412 l2cap_chan_hold(chan);
48454079 3413 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3414
3415 l2cap_chan_unlock(chan);
1da177e4 3416
ba3bd0ee 3417 chan->ops->close(chan->data);
61d6ef3e 3418 l2cap_chan_put(chan);
3df91ea2
AE		 3419
3420 mutex_unlock(&conn->chan_lock);
3421
1da177e4
LT		 3422 return 0;
3423}
3424
3425static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3426{
3427 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3428 u16 dcid, scid;
48454079 3429 struct l2cap_chan *chan;
1da177e4
LT		 3430
3431 scid = __le16_to_cpu(rsp->scid);
3432 dcid = __le16_to_cpu(rsp->dcid);
3433
3434 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3435
3df91ea2
AE		 3436 mutex_lock(&conn->chan_lock);
3437
3438 chan = __l2cap_get_chan_by_scid(conn, scid);
3439 if (!chan) {
3440 mutex_unlock(&conn->chan_lock);
1da177e4 3441 return 0;
3df91ea2 3442 }
1da177e4 3443
6be36555 3444 l2cap_chan_lock(chan);
48454079 3445
61d6ef3e 3446 l2cap_chan_hold(chan);
48454079 3447 l2cap_chan_del(chan, 0);
6be36555
AE		 3448
3449 l2cap_chan_unlock(chan);
1da177e4 3450
ba3bd0ee 3451 chan->ops->close(chan->data);
61d6ef3e 3452 l2cap_chan_put(chan);
3df91ea2
AE		 3453
3454 mutex_unlock(&conn->chan_lock);
3455
1da177e4
LT		 3456 return 0;
3457}
3458
3459static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3460{
3461 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3462 u16 type;
3463
3464 type = __le16_to_cpu(req->type);
3465
3466 BT_DBG("type 0x%4.4x", type);
3467
f0709e03
MH		 3468 if (type == L2CAP_IT_FEAT_MASK) {
3469 u8 buf[8];
44dd46de 3470 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3471 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3472 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3473 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3474 if (!disable_ertm)
fcc203c3
GP		 3475 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3476 | L2CAP_FEAT_FCS;
a5fd6f30 3477 if (enable_hs)
6327eb98
AE		 3478 feat_mask |= L2CAP_FEAT_EXT_FLOW
3479 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3480
1b7bf4ed 3481 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3482 l2cap_send_cmd(conn, cmd->ident,
3483 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3484 } else if (type == L2CAP_IT_FIXED_CHAN) {
3485 u8 buf[12];
3486 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3487
3488 if (enable_hs)
3489 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3490 else
3491 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3492
e1027a7c
MH		 3493 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3494 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3495 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3496 l2cap_send_cmd(conn, cmd->ident,
3497 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3498 } else {
3499 struct l2cap_info_rsp rsp;
3500 rsp.type = cpu_to_le16(type);
3501 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3502 l2cap_send_cmd(conn, cmd->ident,
3503 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3504 }
1da177e4
LT		 3505
3506 return 0;
3507}
3508
3509static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3510{
3511 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3512 u16 type, result;
3513
3514 type = __le16_to_cpu(rsp->type);
3515 result = __le16_to_cpu(rsp->result);
3516
3517 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3518
e90165be
AE		 3519 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3520 if (cmd->ident != conn->info_ident ||
3521 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3522 return 0;
3523
17cd3f37 3524 cancel_delayed_work(&conn->info_timer);
4e8402a3 3525
adb08ede
VT		 3526 if (result != L2CAP_IR_SUCCESS) {
3527 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3528 conn->info_ident = 0;
3529
3530 l2cap_conn_start(conn);
3531
3532 return 0;
3533 }
3534
978c93b9
AE		 3535 switch (type) {
3536 case L2CAP_IT_FEAT_MASK:
83985319 3537 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3538
47ec1dcd 3539 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3540 struct l2cap_info_req req;
3541 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3542
3543 conn->info_ident = l2cap_get_ident(conn);
3544
3545 l2cap_send_cmd(conn, conn->info_ident,
3546 L2CAP_INFO_REQ, sizeof(req), &req);
3547 } else {
3548 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3549 conn->info_ident = 0;
3550
3551 l2cap_conn_start(conn);
3552 }
978c93b9
AE		 3553 break;
3554
3555 case L2CAP_IT_FIXED_CHAN:
3556 conn->fixed_chan_mask = rsp->data[0];
984947dc 3557 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3558 conn->info_ident = 0;
984947dc
MH		 3559
3560 l2cap_conn_start(conn);
978c93b9 3561 break;
984947dc 3562 }
4e8402a3 3563
1da177e4
LT		 3564 return 0;
3565}
3566
f94ff6ff
MM		 3567static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3568 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3569 void *data)
3570{
3571 struct l2cap_create_chan_req *req = data;
3572 struct l2cap_create_chan_rsp rsp;
3573 u16 psm, scid;
3574
3575 if (cmd_len != sizeof(*req))
3576 return -EPROTO;
3577
3578 if (!enable_hs)
3579 return -EINVAL;
3580
3581 psm = le16_to_cpu(req->psm);
3582 scid = le16_to_cpu(req->scid);
3583
3584 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3585
3586 /* Placeholder: Always reject */
3587 rsp.dcid = 0;
3588 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 3589 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3590 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 3591
3592 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3593 sizeof(rsp), &rsp);
3594
3595 return 0;
3596}
3597
3598static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3599 struct l2cap_cmd_hdr *cmd, void *data)
3600{
3601 BT_DBG("conn %p", conn);
3602
3603 return l2cap_connect_rsp(conn, cmd, data);
3604}
3605
8d5a04a1
MM		 3606static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3607 u16 icid, u16 result)
3608{
3609 struct l2cap_move_chan_rsp rsp;
3610
3611 BT_DBG("icid %d, result %d", icid, result);
3612
3613 rsp.icid = cpu_to_le16(icid);
3614 rsp.result = cpu_to_le16(result);
3615
3616 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3617}
3618
3619static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3620 struct l2cap_chan *chan, u16 icid, u16 result)
3621{
3622 struct l2cap_move_chan_cfm cfm;
3623 u8 ident;
3624
3625 BT_DBG("icid %d, result %d", icid, result);
3626
3627 ident = l2cap_get_ident(conn);
3628 if (chan)
3629 chan->ident = ident;
3630
3631 cfm.icid = cpu_to_le16(icid);
3632 cfm.result = cpu_to_le16(result);
3633
3634 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3635}
3636
3637static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3638 u16 icid)
3639{
3640 struct l2cap_move_chan_cfm_rsp rsp;
3641
3642 BT_DBG("icid %d", icid);
3643
3644 rsp.icid = cpu_to_le16(icid);
3645 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3646}
3647
3648static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3649 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3650{
3651 struct l2cap_move_chan_req *req = data;
3652 u16 icid = 0;
3653 u16 result = L2CAP_MR_NOT_ALLOWED;
3654
3655 if (cmd_len != sizeof(*req))
3656 return -EPROTO;
3657
3658 icid = le16_to_cpu(req->icid);
3659
3660 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3661
3662 if (!enable_hs)
3663 return -EINVAL;
3664
3665 /* Placeholder: Always refuse */
3666 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3667
3668 return 0;
3669}
3670
3671static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3672 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3673{
3674 struct l2cap_move_chan_rsp *rsp = data;
3675 u16 icid, result;
3676
3677 if (cmd_len != sizeof(*rsp))
3678 return -EPROTO;
3679
3680 icid = le16_to_cpu(rsp->icid);
3681 result = le16_to_cpu(rsp->result);
3682
3683 BT_DBG("icid %d, result %d", icid, result);
3684
3685 /* Placeholder: Always unconfirmed */
3686 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3687
3688 return 0;
3689}
3690
3691static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3692 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3693{
3694 struct l2cap_move_chan_cfm *cfm = data;
3695 u16 icid, result;
3696
3697 if (cmd_len != sizeof(*cfm))
3698 return -EPROTO;
3699
3700 icid = le16_to_cpu(cfm->icid);
3701 result = le16_to_cpu(cfm->result);
3702
3703 BT_DBG("icid %d, result %d", icid, result);
3704
3705 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3706
3707 return 0;
3708}
3709
3710static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3711 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3712{
3713 struct l2cap_move_chan_cfm_rsp *rsp = data;
3714 u16 icid;
3715
3716 if (cmd_len != sizeof(*rsp))
3717 return -EPROTO;
3718
3719 icid = le16_to_cpu(rsp->icid);
3720
3721 BT_DBG("icid %d", icid);
3722
3723 return 0;
3724}
3725
e2174ca4 3726static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3727 u16 to_multiplier)
3728{
3729 u16 max_latency;
3730
3731 if (min > max || min < 6 || max > 3200)
3732 return -EINVAL;
3733
3734 if (to_multiplier < 10 || to_multiplier > 3200)
3735 return -EINVAL;
3736
3737 if (max >= to_multiplier * 8)
3738 return -EINVAL;
3739
3740 max_latency = (to_multiplier * 8 / max) - 1;
3741 if (latency > 499 || latency > max_latency)
3742 return -EINVAL;
3743
3744 return 0;
3745}
3746
3747static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3748 struct l2cap_cmd_hdr *cmd, u8 *data)
3749{
3750 struct hci_conn *hcon = conn->hcon;
3751 struct l2cap_conn_param_update_req *req;
3752 struct l2cap_conn_param_update_rsp rsp;
3753 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3754 int err;
de73115a
CT		 3755
3756 if (!(hcon->link_mode & HCI_LM_MASTER))
3757 return -EINVAL;
3758
3759 cmd_len = __le16_to_cpu(cmd->len);
3760 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3761 return -EPROTO;
3762
3763 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3764 min = __le16_to_cpu(req->min);
3765 max = __le16_to_cpu(req->max);
de73115a
CT		 3766 latency = __le16_to_cpu(req->latency);
3767 to_multiplier = __le16_to_cpu(req->to_multiplier);
3768
3769 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3770 min, max, latency, to_multiplier);
3771
3772 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3773
3774 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3775 if (err)
de73115a
CT		 3776 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3777 else
3778 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3779
3780 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3781 sizeof(rsp), &rsp);
3782
2ce603eb
CT		 3783 if (!err)
3784 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3785
de73115a
CT		 3786 return 0;
3787}
3788
3300d9a9
CT		 3789static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3790 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3791{
3792 int err = 0;
3793
3794 switch (cmd->code) {
3795 case L2CAP_COMMAND_REJ:
3796 l2cap_command_rej(conn, cmd, data);
3797 break;
3798
3799 case L2CAP_CONN_REQ:
3800 err = l2cap_connect_req(conn, cmd, data);
3801 break;
3802
3803 case L2CAP_CONN_RSP:
3804 err = l2cap_connect_rsp(conn, cmd, data);
3805 break;
3806
3807 case L2CAP_CONF_REQ:
3808 err = l2cap_config_req(conn, cmd, cmd_len, data);
3809 break;
3810
3811 case L2CAP_CONF_RSP:
3812 err = l2cap_config_rsp(conn, cmd, data);
3813 break;
3814
3815 case L2CAP_DISCONN_REQ:
3816 err = l2cap_disconnect_req(conn, cmd, data);
3817 break;
3818
3819 case L2CAP_DISCONN_RSP:
3820 err = l2cap_disconnect_rsp(conn, cmd, data);
3821 break;
3822
3823 case L2CAP_ECHO_REQ:
3824 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3825 break;
3826
3827 case L2CAP_ECHO_RSP:
3828 break;
3829
3830 case L2CAP_INFO_REQ:
3831 err = l2cap_information_req(conn, cmd, data);
3832 break;
3833
3834 case L2CAP_INFO_RSP:
3835 err = l2cap_information_rsp(conn, cmd, data);
3836 break;
3837
f94ff6ff
MM		 3838 case L2CAP_CREATE_CHAN_REQ:
3839 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3840 break;
3841
3842 case L2CAP_CREATE_CHAN_RSP:
3843 err = l2cap_create_channel_rsp(conn, cmd, data);
3844 break;
3845
8d5a04a1
MM		 3846 case L2CAP_MOVE_CHAN_REQ:
3847 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3848 break;
3849
3850 case L2CAP_MOVE_CHAN_RSP:
3851 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3852 break;
3853
3854 case L2CAP_MOVE_CHAN_CFM:
3855 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3856 break;
3857
3858 case L2CAP_MOVE_CHAN_CFM_RSP:
3859 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3860 break;
3861
3300d9a9
CT		 3862 default:
3863 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3864 err = -EINVAL;
3865 break;
3866 }
3867
3868 return err;
3869}
3870
3871static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3872 struct l2cap_cmd_hdr *cmd, u8 *data)
3873{
3874 switch (cmd->code) {
3875 case L2CAP_COMMAND_REJ:
3876 return 0;
3877
3878 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3879 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3880
3881 case L2CAP_CONN_PARAM_UPDATE_RSP:
3882 return 0;
3883
3884 default:
3885 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3886 return -EINVAL;
3887 }
3888}
3889
3890static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3891 struct sk_buff *skb)
1da177e4
LT		 3892{
3893 u8 *data = skb->data;
3894 int len = skb->len;
3895 struct l2cap_cmd_hdr cmd;
3300d9a9 3896 int err;
1da177e4
LT		 3897
3898 l2cap_raw_recv(conn, skb);
3899
3900 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3901 u16 cmd_len;
1da177e4
LT		 3902 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3903 data += L2CAP_CMD_HDR_SIZE;
3904 len -= L2CAP_CMD_HDR_SIZE;
3905
88219a0f 3906 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3907
88219a0f 3908 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3909
88219a0f 3910 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3911 BT_DBG("corrupted command");
3912 break;
3913 }
3914
3300d9a9
CT		 3915 if (conn->hcon->type == LE_LINK)
3916 err = l2cap_le_sig_cmd(conn, &cmd, data);
3917 else
3918 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3919
3920 if (err) {
e2fd318e 3921 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3922
3923 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3924
3925 /* FIXME: Map err to a valid reason */
e2fd318e 3926 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3927 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3928 }
3929
88219a0f
AV		 3930 data += cmd_len;
3931 len -= cmd_len;
1da177e4
LT		 3932 }
3933
3934 kfree_skb(skb);
3935}
3936
47d1ec61 3937static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3938{
3939 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3940 int hdr_size;
3941
3942 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3943 hdr_size = L2CAP_EXT_HDR_SIZE;
3944 else
3945 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3946
47d1ec61 3947 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3948 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3949 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3950 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3951
3952 if (our_fcs != rcv_fcs)
7a560e5c 3953 return -EBADMSG;
fcc203c3
GP		 3954 }
3955 return 0;
3956}
3957
525cd185 3958static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3959{
88843ab0 3960 u32 control = 0;
d5392c8f 3961
6a026610 3962 chan->frames_sent = 0;
d5392c8f 3963
0b209fae 3964 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3965
e2ab4353 3966 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3967 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3968 l2cap_send_sframe(chan, control);
e2ab4353 3969 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3970 }
3971
e2ab4353 3972 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3973 l2cap_retransmit_frames(chan);
d5392c8f 3974
525cd185 3975 l2cap_ertm_send(chan);
d5392c8f 3976
e2ab4353 3977 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3978 chan->frames_sent == 0) {
ab784b73 3979 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3980 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3981 }
3982}
3983
fb45de7d 3984static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 3985{
3986 struct sk_buff *next_skb;
bfbacc11 3987 int tx_seq_offset, next_tx_seq_offset;
8f17154f 3988
3ce3514f
MM		 3989 bt_cb(skb)->control.txseq = tx_seq;
3990 bt_cb(skb)->control.sar = sar;
8f17154f 3991
f1c6775b 3992 next_skb = skb_peek(&chan->srej_q);
8f17154f 3993
836be934 3994 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 3995
039d9572 3996 while (next_skb) {
3ce3514f 3997 if (bt_cb(next_skb)->control.txseq == tx_seq)
9b53350d
JPRV		 3998 return -EINVAL;
3999
836be934 4000 next_tx_seq_offset = __seq_offset(chan,
3ce3514f 4001 bt_cb(next_skb)->control.txseq, chan->buffer_seq);
bfbacc11
JPRV		 4002
4003 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 4004 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 4005 return 0;
8f17154f
GP		 4006 }
4007
f1c6775b 4008 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 4009 next_skb = NULL;
4010 else
4011 next_skb = skb_queue_next(&chan->srej_q, next_skb);
4012 }
8f17154f 4013
f1c6775b 4014 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 4015
4016 return 0;
8f17154f
GP		 4017}
4018
84084a31
MM		 4019static void append_skb_frag(struct sk_buff *skb,
4020 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 4021{
84084a31
MM		 4022 /* skb->len reflects data in skb as well as all fragments
4023 * skb->data_len reflects only data in fragments
4024 */
4025 if (!skb_has_frag_list(skb))
4026 skb_shinfo(skb)->frag_list = new_frag;
4027
4028 new_frag->next = NULL;
4029
4030 (*last_frag)->next = new_frag;
4031 *last_frag = new_frag;
4032
4033 skb->len += new_frag->len;
4034 skb->data_len += new_frag->len;
4035 skb->truesize += new_frag->truesize;
4036}
4037
88843ab0 4038static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 4039{
4040 int err = -EINVAL;
18778a63 4041
7e0ef6ee
AE		 4042 switch (__get_ctrl_sar(chan, control)) {
4043 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 4044 if (chan->sdu)
4045 break;
18778a63 4046
84084a31
MM		 4047 err = chan->ops->recv(chan->data, skb);
4048 break;
18778a63 4049
7e0ef6ee 4050 case L2CAP_SAR_START:
84084a31
MM		 4051 if (chan->sdu)
4052 break;
18778a63 4053
6f61fd47 4054 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 4055 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 4056
84084a31
MM		 4057 if (chan->sdu_len > chan->imtu) {
4058 err = -EMSGSIZE;
4059 break;
4060 }
1890d36b 4061
84084a31
MM		 4062 if (skb->len >= chan->sdu_len)
4063 break;
18778a63 4064
84084a31
MM		 4065 chan->sdu = skb;
4066 chan->sdu_last_frag = skb;
18778a63 4067
84084a31
MM		 4068 skb = NULL;
4069 err = 0;
18778a63
GP		 4070 break;
4071
7e0ef6ee 4072 case L2CAP_SAR_CONTINUE:
6f61fd47 4073 if (!chan->sdu)
84084a31 4074 break;
18778a63 4075
84084a31
MM		 4076 append_skb_frag(chan->sdu, skb,
4077 &chan->sdu_last_frag);
4078 skb = NULL;
18778a63 4079
84084a31
MM		 4080 if (chan->sdu->len >= chan->sdu_len)
4081 break;
4178ba46 4082
84084a31 4083 err = 0;
18778a63
GP		 4084 break;
4085
7e0ef6ee 4086 case L2CAP_SAR_END:
6f61fd47 4087 if (!chan->sdu)
84084a31 4088 break;
18778a63 4089
84084a31
MM		 4090 append_skb_frag(chan->sdu, skb,
4091 &chan->sdu_last_frag);
4092 skb = NULL;
4178ba46 4093
84084a31
MM		 4094 if (chan->sdu->len != chan->sdu_len)
4095 break;
18778a63 4096
84084a31 4097 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 4098
84084a31
MM		 4099 if (!err) {
4100 /* Reassembly complete */
4101 chan->sdu = NULL;
4102 chan->sdu_last_frag = NULL;
4103 chan->sdu_len = 0;
1890d36b 4104 }
18778a63
GP		 4105 break;
4106 }
4107
84084a31
MM		 4108 if (err) {
4109 kfree_skb(skb);
4110 kfree_skb(chan->sdu);
4111 chan->sdu = NULL;
4112 chan->sdu_last_frag = NULL;
4113 chan->sdu_len = 0;
4114 }
18778a63 4115
84084a31 4116 return err;
18778a63
GP		 4117}
4118
26f880d2 4119static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 4120{
26f880d2 4121 BT_DBG("chan %p, Enter local busy", chan);
712132eb 4122
26f880d2 4123 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3c588192 4124 l2cap_seq_list_clear(&chan->srej_list);
26f880d2 4125
77f918bc 4126 __set_ack_timer(chan);
26f880d2
MM		 4127}
4128
4129static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
4130{
88843ab0 4131 u32 control;
712132eb 4132
e2ab4353 4133 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 4134 goto done;
4135
0b209fae 4136 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 4137 control |= __set_ctrl_poll(chan);
ab784b73 4138 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 4139 l2cap_send_sframe(chan, control);
6a026610 4140 chan->retry_count = 1;
712132eb 4141
1a09bcb9
GP		 4142 __clear_retrans_timer(chan);
4143 __set_monitor_timer(chan);
712132eb 4144
e2ab4353 4145 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 4146
4147done:
e2ab4353
GP		 4148 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4149 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 4150
49208c9c 4151 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 4152}
4153
e328140f 4154void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 4155{
e328140f
MM		 4156 if (chan->mode == L2CAP_MODE_ERTM) {
4157 if (busy)
4158 l2cap_ertm_enter_local_busy(chan);
4159 else
4160 l2cap_ertm_exit_local_busy(chan);
1890d36b 4161 }
1890d36b
GP		 4162}
4163
fb45de7d 4164static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 4165{
4166 struct sk_buff *skb;
88843ab0 4167 u32 control;
8f17154f 4168
e328140f
MM		 4169 while ((skb = skb_peek(&chan->srej_q)) &&
4170 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4171 int err;
4172
3ce3514f 4173 if (bt_cb(skb)->control.txseq != tx_seq)
8f17154f
GP		 4174 break;
4175
f1c6775b 4176 skb = skb_dequeue(&chan->srej_q);
3ce3514f 4177 control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
84084a31 4178 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 4179
4180 if (err < 0) {
4181 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4182 break;
4183 }
4184
836be934
AE		 4185 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
4186 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 4187 }
4188}
4189
fb45de7d 4190static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4191{
8f17154f 4192 struct srej_list *l, *tmp;
88843ab0 4193 u32 control;
8f17154f 4194
39d5a3ee 4195 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 4196 if (l->tx_seq == tx_seq) {
4197 list_del(&l->list);
4198 kfree(l);
4199 return;
4200 }
ab784b73 4201 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4202 control |= __set_reqseq(chan, l->tx_seq);
525cd185 4203 l2cap_send_sframe(chan, control);
8f17154f 4204 list_del(&l->list);
39d5a3ee 4205 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 4206 }
4207}
4208
aef89f21 4209static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4210{
8f17154f 4211 struct srej_list *new;
88843ab0 4212 u32 control;
8f17154f 4213
42e5c802 4214 while (tx_seq != chan->expected_tx_seq) {
ab784b73 4215 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4216 control |= __set_reqseq(chan, chan->expected_tx_seq);
3c588192 4217 l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
525cd185 4218 l2cap_send_sframe(chan, control);
8f17154f
GP		 4219
4220 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 4221 if (!new)
4222 return -ENOMEM;
4223
42e5c802 4224 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 4225
4226 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4227
39d5a3ee 4228 list_add_tail(&new->list, &chan->srej_l);
8f17154f 4229 }
836be934
AE		 4230
4231 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 4232
4233 return 0;
8f17154f
GP		 4234}
4235
88843ab0 4236static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 4237{
fb45de7d 4238 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 4239 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 4240 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 4241 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 4242 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 4243 int err = 0;
4244
88843ab0 4245 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 4246 tx_seq, rx_control);
1c2acffb 4247
03f6715d 4248 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4249 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4250 __clear_monitor_timer(chan);
6a026610 4251 if (chan->unacked_frames > 0)
1a09bcb9 4252 __set_retrans_timer(chan);
e2ab4353 4253 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 4254 }
4255
42e5c802
GP		 4256 chan->expected_ack_seq = req_seq;
4257 l2cap_drop_acked_frames(chan);
9f121a5a 4258
836be934 4259 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4260
4261 /* invalid tx_seq */
47d1ec61 4262 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 4263 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 4264 goto drop;
4265 }
4266
77f918bc
SJ		 4267 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4268 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4269 l2cap_send_ack(chan);
1890d36b 4270 goto drop;
77f918bc 4271 }
1890d36b 4272
02f1b641
MM		 4273 if (tx_seq == chan->expected_tx_seq)
4274 goto expected;
4275
e2ab4353 4276 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 4277 struct srej_list *first;
30afb5b2 4278
39d5a3ee 4279 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 4280 struct srej_list, list);
4281 if (tx_seq == first->tx_seq) {
42e5c802 4282 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 4283 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 4284
4285 list_del(&first->list);
4286 kfree(first);
4287
39d5a3ee 4288 if (list_empty(&chan->srej_l)) {
42e5c802 4289 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 4290 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 4291 l2cap_send_ack(chan);
49208c9c 4292 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 4293 }
4294 } else {
4295 struct srej_list *l;
9b53350d
JPRV		 4296
4297 /* duplicated tx_seq */
42e5c802 4298 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 4299 goto drop;
8f17154f 4300
39d5a3ee 4301 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 4302 if (l->tx_seq == tx_seq) {
525cd185 4303 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 4304 return 0;
4305 }
4306 }
aef89f21
SJ		 4307
4308 err = l2cap_send_srejframe(chan, tx_seq);
4309 if (err < 0) {
4310 l2cap_send_disconn_req(chan->conn, chan, -err);
4311 return err;
4312 }
30afb5b2
GP		 4313 }
4314 } else {
836be934
AE		 4315 expected_tx_seq_offset = __seq_offset(chan,
4316 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4317
4318 /* duplicated tx_seq */
4319 if (tx_seq_offset < expected_tx_seq_offset)
4320 goto drop;
4321
e2ab4353 4322 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 4323
49208c9c 4324 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 4325
39d5a3ee 4326 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 4327 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 4328
f1c6775b 4329 __skb_queue_head_init(&chan->srej_q);
42e5c802 4330 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 4331
0ef3ef0f
SJ		 4332 /* Set P-bit only if there are some I-frames to ack. */
4333 if (__clear_ack_timer(chan))
4334 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 4335
aef89f21
SJ		 4336 err = l2cap_send_srejframe(chan, tx_seq);
4337 if (err < 0) {
4338 l2cap_send_disconn_req(chan->conn, chan, -err);
4339 return err;
4340 }
1c2acffb 4341 }
30afb5b2
GP		 4342 return 0;
4343
8f17154f 4344expected:
836be934 4345 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 4346
e2ab4353 4347 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3ce3514f
MM		 4348 bt_cb(skb)->control.txseq = tx_seq;
4349 bt_cb(skb)->control.sar = sar;
f1c6775b 4350 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 4351 return 0;
4352 }
4353
84084a31 4354 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 4355 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4356
e328140f
MM		 4357 if (err < 0) {
4358 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4359 return err;
4360 }
2ece3684 4361
03f6715d 4362 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4363 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4364 l2cap_retransmit_frames(chan);
4ec10d97
GP		 4365 }
4366
c1b4f43b 4367
6a026610
GP		 4368 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4369 if (chan->num_acked == num_to_ack - 1)
525cd185 4370 l2cap_send_ack(chan);
4d611e4d
GP		 4371 else
4372 __set_ack_timer(chan);
9e917af1 4373
8f17154f 4374 return 0;
9b53350d
JPRV		 4375
4376drop:
4377 kfree_skb(skb);
4378 return 0;
1c2acffb
GP		 4379}
4380
88843ab0 4381static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 4382{
88843ab0 4383 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 4384 __get_reqseq(chan, rx_control), rx_control);
0e98958d 4385
0b209fae 4386 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 4387 l2cap_drop_acked_frames(chan);
1c2acffb 4388
e3781735 4389 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 4390 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4391 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4392 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4393 (chan->unacked_frames > 0))
1a09bcb9 4394 __set_retrans_timer(chan);
05fbd89d 4395
e2ab4353 4396 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 4397 l2cap_send_srejtail(chan);
05fbd89d 4398 } else {
525cd185 4399 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 4400 }
1d8f5d16 4401
03f6715d 4402 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4403 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4404
e2ab4353 4405 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4406 l2cap_retransmit_frames(chan);
2246b2f1 4407
e072745f 4408 } else {
e2ab4353 4409 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4410 (chan->unacked_frames > 0))
1a09bcb9 4411 __set_retrans_timer(chan);
1c2acffb 4412
e2ab4353
GP		 4413 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4414 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4415 l2cap_send_ack(chan);
894718a6 4416 else
525cd185 4417 l2cap_ertm_send(chan);
e072745f
GP		 4418 }
4419}
2246b2f1 4420
88843ab0 4421static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4422{
0b209fae 4423 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4424
88843ab0 4425 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4426
e2ab4353 4427 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4428
42e5c802
GP		 4429 chan->expected_ack_seq = tx_seq;
4430 l2cap_drop_acked_frames(chan);
e072745f 4431
03f6715d 4432 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4433 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4434 l2cap_retransmit_frames(chan);
e072745f 4435 } else {
525cd185 4436 l2cap_retransmit_frames(chan);
30afb5b2 4437
e2ab4353
GP		 4438 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4439 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4440 }
4441}
88843ab0 4442static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4443{
0b209fae 4444 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4445
88843ab0 4446 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4447
e2ab4353 4448 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4449
e3781735 4450 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4451 chan->expected_ack_seq = tx_seq;
4452 l2cap_drop_acked_frames(chan);
3cb123d1 4453
e2ab4353 4454 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4455 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4456
525cd185 4457 l2cap_ertm_send(chan);
dfc909be 4458
e2ab4353 4459 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4460 chan->srej_save_reqseq = tx_seq;
e2ab4353 4461 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4462 }
03f6715d 4463 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4464 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4465 chan->srej_save_reqseq == tx_seq)
e2ab4353 4466 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4467 else
525cd185 4468 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4469 } else {
525cd185 4470 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4471 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4472 chan->srej_save_reqseq = tx_seq;
e2ab4353 4473 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4474 }
e072745f
GP		 4475 }
4476}
4477
88843ab0 4478static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4479{
0b209fae 4480 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4481
88843ab0 4482 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4483
e2ab4353 4484 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4485 chan->expected_ack_seq = tx_seq;
4486 l2cap_drop_acked_frames(chan);
e072745f 4487
e3781735 4488 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4489 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4490
e2ab4353 4491 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4492 __clear_retrans_timer(chan);
e3781735 4493 if (__is_ctrl_poll(chan, rx_control))
525cd185 4494 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4495 return;
e072745f 4496 }
99b0d4b7 4497
e3781735 4498 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4499 l2cap_send_srejtail(chan);
ab784b73
AE		 4500 } else {
4501 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4502 l2cap_send_sframe(chan, rx_control);
4503 }
e072745f
GP		 4504}
4505
88843ab0 4506static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4507{
88843ab0 4508 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4509
03f6715d 4510 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4511 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4512 __clear_monitor_timer(chan);
6a026610 4513 if (chan->unacked_frames > 0)
1a09bcb9 4514 __set_retrans_timer(chan);
e2ab4353 4515 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4516 }
4517
ab784b73
AE		 4518 switch (__get_ctrl_super(chan, rx_control)) {
4519 case L2CAP_SUPER_RR:
525cd185 4520 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4521 break;
4522
ab784b73 4523 case L2CAP_SUPER_REJ:
525cd185 4524 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4525 break;
2246b2f1 4526
ab784b73 4527 case L2CAP_SUPER_SREJ:
525cd185 4528 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4529 break;
4530
ab784b73 4531 case L2CAP_SUPER_RNR:
525cd185 4532 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4533 break;
4534 }
4535
faaebd19 4536 kfree_skb(skb);
1c2acffb
GP		 4537 return 0;
4538}
4539
cad8f1d0 4540static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
218bb9df 4541{
88843ab0 4542 u32 control;
0b209fae 4543 u16 req_seq;
218bb9df
GP		 4544 int len, next_tx_seq_offset, req_seq_offset;
4545
b76bbd66
MM		 4546 __unpack_control(chan, skb);
4547
88843ab0
AE		 4548 control = __get_control(chan, skb->data);
4549 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4550 len = skb->len;
4551
4552 /*
4553 * We can just drop the corrupted I-frame here.
4554 * Receiver will miss it and start proper recovery
4555 * procedures and ask retransmission.
4556 */
47d1ec61 4557 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4558 goto drop;
4559
793c2f1c 4560 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4561 len -= L2CAP_SDULEN_SIZE;
218bb9df 4562
47d1ec61 4563 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4564 len -= L2CAP_FCS_SIZE;
218bb9df 4565
47d1ec61 4566 if (len > chan->mps) {
8c1d787b 4567 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4568 goto drop;
4569 }
4570
0b209fae 4571 req_seq = __get_reqseq(chan, control);
218bb9df 4572
836be934
AE		 4573 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4574
4575 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4576 chan->expected_ack_seq);
218bb9df
GP		 4577
4578 /* check for invalid req-seq */
4579 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4580 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4581 goto drop;
4582 }
4583
793c2f1c 4584 if (!__is_sframe(chan, control)) {
218bb9df 4585 if (len < 0) {
8c1d787b 4586 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4587 goto drop;
4588 }
4589
525cd185 4590 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4591 } else {
4592 if (len != 0) {
4593 BT_ERR("%d", len);
8c1d787b 4594 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4595 goto drop;
4596 }
4597
525cd185 4598 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4599 }
4600
4601 return 0;
4602
4603drop:
4604 kfree_skb(skb);
4605 return 0;
4606}
4607
1da177e4
LT		 4608static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4609{
48454079 4610 struct l2cap_chan *chan;
88843ab0 4611 u32 control;
fb45de7d 4612 u16 tx_seq;
218bb9df 4613 int len;
1da177e4 4614
baa7e1fa 4615 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4616 if (!chan) {
1da177e4 4617 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 4618 /* Drop packet and return */
3379013b 4619 kfree_skb(skb);
6be36555 4620 return 0;
1da177e4
LT		 4621 }
4622
6be36555 4623 l2cap_chan_lock(chan);
6840ed07 4624
49208c9c 4625 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4626
89bc500e 4627 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4628 goto drop;
4629
0c1bc5c6 4630 switch (chan->mode) {
1c2acffb
GP		 4631 case L2CAP_MODE_BASIC:
4632 /* If socket recv buffers overflows we drop data here
4633 * which is *bad* because L2CAP has to be reliable.
4634 * But we don't have any other choice. L2CAP doesn't
4635 * provide flow control mechanism. */
1da177e4 4636
0c1bc5c6 4637 if (chan->imtu < skb->len)
1c2acffb 4638 goto drop;
1da177e4 4639
23070494 4640 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4641 goto done;
4642 break;
4643
4644 case L2CAP_MODE_ERTM:
5ef8cb9e 4645 l2cap_ertm_data_rcv(chan, skb);
1c2acffb 4646
fcafde2e 4647 goto done;
1c2acffb 4648
6840ed07 4649 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4650 control = __get_control(chan, skb->data);
4651 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4652 len = skb->len;
4653
47d1ec61 4654 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4655 goto drop;
4656
7e0ef6ee 4657 if (__is_sar_start(chan, control))
03a51213 4658 len -= L2CAP_SDULEN_SIZE;
6840ed07 4659
47d1ec61 4660 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4661 len -= L2CAP_FCS_SIZE;
fcc203c3 4662
793c2f1c 4663 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4664 goto drop;
4665
fb45de7d 4666 tx_seq = __get_txseq(chan, control);
6840ed07 4667
84084a31
MM		 4668 if (chan->expected_tx_seq != tx_seq) {
4669 /* Frame(s) missing - must discard partial SDU */
4670 kfree_skb(chan->sdu);
4671 chan->sdu = NULL;
4672 chan->sdu_last_frag = NULL;
4673 chan->sdu_len = 0;
6840ed07 4674
84084a31
MM		 4675 /* TODO: Notify userland of missing data */
4676 }
4677
836be934 4678 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4679
4680 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4681 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4682
4683 goto done;
4684
1c2acffb 4685 default:
0c1bc5c6 4686 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4687 break;
4688 }
1da177e4
LT		 4689
4690drop:
4691 kfree_skb(skb);
4692
4693done:
6be36555 4694 l2cap_chan_unlock(chan);
0139418c 4695
1da177e4
LT		 4696 return 0;
4697}
4698
8e036fc3 4699static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4700{
23691d75 4701 struct l2cap_chan *chan;
1da177e4 4702
c2287681 4703 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 4704 if (!chan)
1da177e4
LT		 4705 goto drop;
4706
5b4cedaa 4707 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4708
89bc500e 4709 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4710 goto drop;
4711
e13e21dc 4712 if (chan->imtu < skb->len)
1da177e4
LT		 4713 goto drop;
4714
23070494 4715 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4716 return 0;
1da177e4
LT		 4717
4718drop:
4719 kfree_skb(skb);
4720
1da177e4
LT		 4721 return 0;
4722}
4723
d9b88702
AE		 4724static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4725 struct sk_buff *skb)
9f69bda6 4726{
23691d75 4727 struct l2cap_chan *chan;
9f69bda6 4728
c2287681 4729 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 4730 if (!chan)
9f69bda6
GP		 4731 goto drop;
4732
5b4cedaa 4733 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 4734
89bc500e 4735 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4736 goto drop;
4737
e13e21dc 4738 if (chan->imtu < skb->len)
9f69bda6
GP		 4739 goto drop;
4740
23070494 4741 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4742 return 0;
9f69bda6
GP		 4743
4744drop:
4745 kfree_skb(skb);
4746
9f69bda6
GP		 4747 return 0;
4748}
4749
1da177e4
LT		 4750static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4751{
4752 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4753 u16 cid, len;
4754 __le16 psm;
1da177e4
LT		 4755
4756 skb_pull(skb, L2CAP_HDR_SIZE);
4757 cid = __le16_to_cpu(lh->cid);
4758 len = __le16_to_cpu(lh->len);
4759
1c2acffb
GP		 4760 if (len != skb->len) {
4761 kfree_skb(skb);
4762 return;
4763 }
4764
1da177e4
LT		 4765 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4766
4767 switch (cid) {
3300d9a9 4768 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4769 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4770 l2cap_sig_channel(conn, skb);
4771 break;
4772
8db4dc46 4773 case L2CAP_CID_CONN_LESS:
097db76c 4774 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 4775 skb_pull(skb, 2);
4776 l2cap_conless_channel(conn, psm, skb);
4777 break;
4778
9f69bda6
GP		 4779 case L2CAP_CID_LE_DATA:
4780 l2cap_att_channel(conn, cid, skb);
4781 break;
4782
b501d6a1
AB		 4783 case L2CAP_CID_SMP:
4784 if (smp_sig_channel(conn, skb))
4785 l2cap_conn_del(conn->hcon, EACCES);
4786 break;
4787
1da177e4
LT		 4788 default:
4789 l2cap_data_channel(conn, cid, skb);
4790 break;
4791 }
4792}
4793
4794/* ---- L2CAP interface with lower layer (HCI) ---- */
4795
686ebf28 4796int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 4797{
4798 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4799 struct l2cap_chan *c;
1da177e4 4800
1da177e4
LT		 4801 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4802
4803 /* Find listening sockets and check their link_mode */
23691d75
GP		 4804 read_lock(&chan_list_lock);
4805 list_for_each_entry(c, &chan_list, global_l) {
4806 struct sock *sk = c->sk;
4343478f 4807
89bc500e 4808 if (c->state != BT_LISTEN)
1da177e4
LT		 4809 continue;
4810
4811 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4812 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4813 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4814 lm1 |= HCI_LM_MASTER;
1da177e4 4815 exact++;
2af6b9d5
MH		 4816 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4817 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4818 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4819 lm2 |= HCI_LM_MASTER;
4820 }
1da177e4 4821 }
23691d75 4822 read_unlock(&chan_list_lock);
1da177e4
LT		 4823
4824 return exact ? lm1 : lm2;
4825}
4826
686ebf28 4827int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 4828{
0139418c
MH		 4829 struct l2cap_conn *conn;
4830
1da177e4
LT		 4831 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4832
1da177e4 4833 if (!status) {
1da177e4
LT		 4834 conn = l2cap_conn_add(hcon, status);
4835 if (conn)
4836 l2cap_conn_ready(conn);
0139418c 4837 } else
e175072f 4838 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4839
4840 return 0;
4841}
4842
686ebf28 4843int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 4844{
4845 struct l2cap_conn *conn = hcon->l2cap_data;
4846
4847 BT_DBG("hcon %p", hcon);
4848
686ebf28 4849 if (!conn)
9f5a0d7b 4850 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4851 return conn->disc_reason;
4852}
4853
686ebf28 4854int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4855{
4856 BT_DBG("hcon %p reason %d", hcon, reason);
4857
e175072f 4858 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 4859 return 0;
4860}
4861
4343478f 4862static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4863{
715ec005 4864 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4865 return;
4866
f62e4323 4867 if (encrypt == 0x00) {
4343478f 4868 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 4869 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4870 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4871 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4872 } else {
4343478f 4873 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4874 __clear_chan_timer(chan);
f62e4323
MH		 4875 }
4876}
4877
686ebf28 4878int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4879{
0139418c 4880 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4881 struct l2cap_chan *chan;
1da177e4 4882
0139418c 4883 if (!conn)
1da177e4 4884 return 0;
0139418c 4885
1da177e4
LT		 4886 BT_DBG("conn %p", conn);
4887
160dc6ac 4888 if (hcon->type == LE_LINK) {
35d4adcc
HG		 4889 if (!status && encrypt)
4890 smp_distribute_keys(conn, 0);
17cd3f37 4891 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 4892 }
4893
3df91ea2 4894 mutex_lock(&conn->chan_lock);
1da177e4 4895
3df91ea2 4896 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 4897 l2cap_chan_lock(chan);
1da177e4 4898
f1cb9af5
VCG		 4899 BT_DBG("chan->scid %d", chan->scid);
4900
4901 if (chan->scid == L2CAP_CID_LE_DATA) {
4902 if (!status && encrypt) {
4903 chan->sec_level = hcon->sec_level;
cf4cd009 4904 l2cap_chan_ready(chan);
f1cb9af5
VCG		 4905 }
4906
6be36555 4907 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 4908 continue;
4909 }
4910
c1360a1c 4911 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 4912 l2cap_chan_unlock(chan);
6a8d3010
MH		 4913 continue;
4914 }
4915
89bc500e
GP		 4916 if (!status && (chan->state == BT_CONNECTED ||
4917 chan->state == BT_CONFIG)) {
4343478f 4918 l2cap_check_encryption(chan, encrypt);
6be36555 4919 l2cap_chan_unlock(chan);
9719f8af
MH		 4920 continue;
4921 }
4922
89bc500e 4923 if (chan->state == BT_CONNECT) {
b1235d79 4924 if (!status) {
9b27f350 4925 l2cap_send_conn_req(chan);
b1235d79 4926 } else {
ba13ccd9 4927 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4928 }
89bc500e 4929 } else if (chan->state == BT_CONNECT2) {
6be36555 4930 struct sock *sk = chan->sk;
b1235d79 4931 struct l2cap_conn_rsp rsp;
df3c3931 4932 __u16 res, stat;
1da177e4 4933
6be36555
AE		 4934 lock_sock(sk);
4935
b1235d79 4936 if (!status) {
df3c3931
JH		 4937 if (bt_sk(sk)->defer_setup) {
4938 struct sock *parent = bt_sk(sk)->parent;
4939 res = L2CAP_CR_PEND;
4940 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4941 if (parent)
4942 parent->sk_data_ready(parent, 0);
df3c3931 4943 } else {
0e587be7 4944 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4945 res = L2CAP_CR_SUCCESS;
4946 stat = L2CAP_CS_NO_INFO;
4947 }
b1235d79 4948 } else {
0e587be7 4949 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 4950 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4951 res = L2CAP_CR_SEC_BLOCK;
4952 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4953 }
4954
6be36555
AE		 4955 release_sock(sk);
4956
fe4128e0
GP		 4957 rsp.scid = cpu_to_le16(chan->dcid);
4958 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4959 rsp.result = cpu_to_le16(res);
4960 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4961 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4962 sizeof(rsp), &rsp);
b1235d79 4963 }
1da177e4 4964
6be36555 4965 l2cap_chan_unlock(chan);
1da177e4
LT		 4966 }
4967
3df91ea2 4968 mutex_unlock(&conn->chan_lock);
b1235d79 4969
1da177e4
LT		 4970 return 0;
4971}
4972
686ebf28 4973int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 4974{
4975 struct l2cap_conn *conn = hcon->l2cap_data;
4976
5a08ecce
AE		 4977 if (!conn)
4978 conn = l2cap_conn_add(hcon, 0);
4979
4980 if (!conn)
1da177e4
LT		 4981 goto drop;
4982
4983 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4984
e702112f 4985 if (!(flags & ACL_CONT)) {
1da177e4 4986 struct l2cap_hdr *hdr;
48454079 4987 struct l2cap_chan *chan;
89794813 4988 u16 cid;
1da177e4
LT		 4989 int len;
4990
4991 if (conn->rx_len) {
4992 BT_ERR("Unexpected start frame (len %d)", skb->len);
4993 kfree_skb(conn->rx_skb);
4994 conn->rx_skb = NULL;
4995 conn->rx_len = 0;
4996 l2cap_conn_unreliable(conn, ECOMM);
4997 }
4998
aae7fe22
AE		 4999 /* Start fragment always begin with Basic L2CAP header */
5000 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 5001 BT_ERR("Frame is too short (len %d)", skb->len);
5002 l2cap_conn_unreliable(conn, ECOMM);
5003 goto drop;
5004 }
5005
5006 hdr = (struct l2cap_hdr *) skb->data;
5007 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 5008 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 5009
5010 if (len == skb->len) {
5011 /* Complete frame received */
5012 l2cap_recv_frame(conn, skb);
5013 return 0;
5014 }
5015
5016 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
5017
5018 if (skb->len > len) {
5019 BT_ERR("Frame is too long (len %d, expected len %d)",
5020 skb->len, len);
5021 l2cap_conn_unreliable(conn, ECOMM);
5022 goto drop;
5023 }
5024
baa7e1fa 5025 chan = l2cap_get_chan_by_scid(conn, cid);
89794813 5026
48454079
GP		 5027 if (chan && chan->sk) {
5028 struct sock *sk = chan->sk;
3df91ea2 5029 lock_sock(sk);
89794813 5030
0c1bc5c6 5031 if (chan->imtu < len - L2CAP_HDR_SIZE) {
48454079
GP		 5032 BT_ERR("Frame exceeding recv MTU (len %d, "
5033 "MTU %d)", len,
0c1bc5c6 5034 chan->imtu);
aa2ac881 5035 release_sock(sk);
48454079
GP		 5036 l2cap_conn_unreliable(conn, ECOMM);
5037 goto drop;
5038 }
aa2ac881 5039 release_sock(sk);
48454079 5040 }
89794813 5041
1da177e4 5042 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 5043 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
5044 if (!conn->rx_skb)
1da177e4
LT		 5045 goto drop;
5046
d626f62b 5047 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5048 skb->len);
1da177e4
LT		 5049 conn->rx_len = len - skb->len;
5050 } else {
5051 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5052
5053 if (!conn->rx_len) {
5054 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5055 l2cap_conn_unreliable(conn, ECOMM);
5056 goto drop;
5057 }
5058
5059 if (skb->len > conn->rx_len) {
5060 BT_ERR("Fragment is too long (len %d, expected %d)",
5061 skb->len, conn->rx_len);
5062 kfree_skb(conn->rx_skb);
5063 conn->rx_skb = NULL;
5064 conn->rx_len = 0;
5065 l2cap_conn_unreliable(conn, ECOMM);
5066 goto drop;
5067 }
5068
d626f62b 5069 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5070 skb->len);
1da177e4
LT		 5071 conn->rx_len -= skb->len;
5072
5073 if (!conn->rx_len) {
5074 /* Complete frame received */
5075 l2cap_recv_frame(conn, conn->rx_skb);
5076 conn->rx_skb = NULL;
5077 }
5078 }
5079
5080drop:
5081 kfree_skb(skb);
5082 return 0;
5083}
5084
aef7d97c 5085static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5086{
23691d75 5087 struct l2cap_chan *c;
1da177e4 5088
333055f2 5089 read_lock(&chan_list_lock);
1da177e4 5090
23691d75
GP		 5091 list_for_each_entry(c, &chan_list, global_l) {
5092 struct sock *sk = c->sk;
101545f6 5093
903d343e 5094 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 5095 batostr(&bt_sk(sk)->src),
5096 batostr(&bt_sk(sk)->dst),
89bc500e 5097 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 5098 c->scid, c->dcid, c->imtu, c->omtu,
5099 c->sec_level, c->mode);
61e1b4b7 5100 }
1da177e4 5101
333055f2 5102 read_unlock(&chan_list_lock);
1da177e4 5103
aef7d97c 5104 return 0;
1da177e4
LT		 5105}
5106
aef7d97c
MH		 5107static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5108{
5109 return single_open(file, l2cap_debugfs_show, inode->i_private);
5110}
5111
5112static const struct file_operations l2cap_debugfs_fops = {
5113 .open = l2cap_debugfs_open,
5114 .read = seq_read,
5115 .llseek = seq_lseek,
5116 .release = single_release,
5117};
5118
5119static struct dentry *l2cap_debugfs;
1da177e4 5120
64274518 5121int __init l2cap_init(void)
1da177e4
LT		 5122{
5123 int err;
be9d1227 5124
bb58f747 5125 err = l2cap_init_sockets();
1da177e4
LT		 5126 if (err < 0)
5127 return err;
5128
aef7d97c
MH		 5129 if (bt_debugfs) {
5130 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5131 bt_debugfs, NULL, &l2cap_debugfs_fops);
5132 if (!l2cap_debugfs)
5133 BT_ERR("Failed to create L2CAP debug file");
5134 }
1da177e4 5135
1da177e4 5136 return 0;
1da177e4
LT		 5137}
5138
64274518 5139void l2cap_exit(void)
1da177e4 5140{
aef7d97c 5141 debugfs_remove(l2cap_debugfs);
bb58f747 5142 l2cap_cleanup_sockets();
1da177e4
LT		 5143}
5144
d1c4a17d
GP		 5145module_param(disable_ertm, bool, 0644);
5146MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)