projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Define L2CAP conf continuation flag
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
1da177e4
LT		 35
36#include <net/bluetooth/bluetooth.h>
37#include <net/bluetooth/hci_core.h>
38#include <net/bluetooth/l2cap.h>
b501d6a1 39#include <net/bluetooth/smp.h>
1da177e4 40
d1de6d46 41bool disable_ertm;
f0709e03 42
47ec1dcd 43static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 44static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 45
b5ad8b7f
JB		 46static LIST_HEAD(chan_list);
47static DEFINE_RWLOCK(chan_list_lock);
1da177e4 48
1da177e4
LT		 49static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
50 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 51static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
52 void *data);
710f9b0a 53static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a 54static void l2cap_send_disconn_req(struct l2cap_conn *conn,
c5daa683 55 struct l2cap_chan *chan, int err);
1da177e4 56
d660366d 57static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
608bcc6d
MM		 58 struct sk_buff_head *skbs, u8 event);
59
0139418c 60/* ---- L2CAP channels ---- */
71ba0e56 61
baa7e1fa 62static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 63{
3df91ea2 64 struct l2cap_chan *c;
3d57dc68 65
3df91ea2
AE		 66 list_for_each_entry(c, &conn->chan_l, list) {
67 if (c->dcid == cid)
68 return c;
0139418c 69 }
3df91ea2 70 return NULL;
0139418c
MH		 71}
72
baa7e1fa 73static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 74{
3df91ea2 75 struct l2cap_chan *c;
3d57dc68 76
3df91ea2
AE		 77 list_for_each_entry(c, &conn->chan_l, list) {
78 if (c->scid == cid)
79 return c;
0139418c 80 }
3df91ea2 81 return NULL;
0139418c
MH		 82}
83
84/* Find channel with given SCID.
ef191ade 85 * Returns locked channel. */
baa7e1fa 86static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 87{
48454079 88 struct l2cap_chan *c;
baa7e1fa 89
3df91ea2 90 mutex_lock(&conn->chan_lock);
baa7e1fa 91 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 92 if (c)
93 l2cap_chan_lock(c);
3df91ea2
AE		 94 mutex_unlock(&conn->chan_lock);
95
48454079 96 return c;
0139418c
MH		 97}
98
baa7e1fa 99static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 100{
3df91ea2 101 struct l2cap_chan *c;
3d57dc68 102
3df91ea2
AE		 103 list_for_each_entry(c, &conn->chan_l, list) {
104 if (c->ident == ident)
105 return c;
0139418c 106 }
3df91ea2 107 return NULL;
0139418c
MH		 108}
109
23691d75 110static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 111{
23691d75 112 struct l2cap_chan *c;
9e4425ff 113
23691d75
GP		 114 list_for_each_entry(c, &chan_list, global_l) {
115 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 116 return c;
9e4425ff 117 }
250938cb 118 return NULL;
9e4425ff
GP		 119}
120
121int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
122{
73b2ec18
GP		 123 int err;
124
333055f2 125 write_lock(&chan_list_lock);
9e4425ff 126
23691d75 127 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 128 err = -EADDRINUSE;
129 goto done;
9e4425ff
GP		 130 }
131
73b2ec18
GP		 132 if (psm) {
133 chan->psm = psm;
134 chan->sport = psm;
135 err = 0;
136 } else {
137 u16 p;
138
139 err = -EINVAL;
140 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 141 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 142 chan->psm = cpu_to_le16(p);
143 chan->sport = cpu_to_le16(p);
144 err = 0;
145 break;
146 }
147 }
9e4425ff 148
73b2ec18 149done:
333055f2 150 write_unlock(&chan_list_lock);
73b2ec18 151 return err;
9e4425ff
GP		 152}
153
154int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
155{
333055f2 156 write_lock(&chan_list_lock);
9e4425ff
GP		 157
158 chan->scid = scid;
159
333055f2 160 write_unlock(&chan_list_lock);
9e4425ff
GP		 161
162 return 0;
163}
164
baa7e1fa 165static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 166{
8db4dc46 167 u16 cid = L2CAP_CID_DYN_START;
0139418c 168
8db4dc46 169 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 170 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 171 return cid;
172 }
173
174 return 0;
175}
176
0e587be7 177static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 178{
42d2d87c 179 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 180 state_to_string(state));
181
89bc500e
GP		 182 chan->state = state;
183 chan->ops->state_change(chan->data, state);
184}
185
0e587be7
AE		 186static void l2cap_state_change(struct l2cap_chan *chan, int state)
187{
188 struct sock *sk = chan->sk;
189
190 lock_sock(sk);
191 __l2cap_state_change(chan, state);
192 release_sock(sk);
193}
194
2e0052e4
AE		 195static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
196{
197 struct sock *sk = chan->sk;
198
199 sk->sk_err = err;
200}
201
202static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
203{
204 struct sock *sk = chan->sk;
205
206 lock_sock(sk);
207 __l2cap_chan_set_err(chan, err);
208 release_sock(sk);
209}
210
4239d16f
MM		 211static void __set_retrans_timer(struct l2cap_chan *chan)
212{
213 if (!delayed_work_pending(&chan->monitor_timer) &&
214 chan->retrans_timeout) {
215 l2cap_set_timer(chan, &chan->retrans_timer,
216 msecs_to_jiffies(chan->retrans_timeout));
217 }
218}
219
220static void __set_monitor_timer(struct l2cap_chan *chan)
221{
222 __clear_retrans_timer(chan);
223 if (chan->monitor_timeout) {
224 l2cap_set_timer(chan, &chan->monitor_timer,
225 msecs_to_jiffies(chan->monitor_timeout));
226 }
227}
228
608bcc6d
MM		 229static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
230 u16 seq)
231{
232 struct sk_buff *skb;
233
234 skb_queue_walk(head, skb) {
235 if (bt_cb(skb)->control.txseq == seq)
236 return skb;
237 }
238
239 return NULL;
240}
241
3c588192
MM		 242/* ---- L2CAP sequence number lists ---- */
243
244/* For ERTM, ordered lists of sequence numbers must be tracked for
245 * SREJ requests that are received and for frames that are to be
246 * retransmitted. These seq_list functions implement a singly-linked
247 * list in an array, where membership in the list can also be checked
248 * in constant time. Items can also be added to the tail of the list
249 * and removed from the head in constant time, without further memory
250 * allocs or frees.
251 */
252
253static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
254{
255 size_t alloc_size, i;
256
257 /* Allocated size is a power of 2 to map sequence numbers
258 * (which may be up to 14 bits) in to a smaller array that is
259 * sized for the negotiated ERTM transmit windows.
260 */
261 alloc_size = roundup_pow_of_two(size);
262
263 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
264 if (!seq_list->list)
265 return -ENOMEM;
266
267 seq_list->mask = alloc_size - 1;
268 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
269 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
270 for (i = 0; i < alloc_size; i++)
271 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
272
273 return 0;
274}
275
276static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
277{
278 kfree(seq_list->list);
279}
280
281static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
282 u16 seq)
283{
284 /* Constant-time check for list membership */
285 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
286}
287
288static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
289{
290 u16 mask = seq_list->mask;
291
292 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
293 /* In case someone tries to pop the head of an empty list */
294 return L2CAP_SEQ_LIST_CLEAR;
295 } else if (seq_list->head == seq) {
296 /* Head can be removed in constant time */
297 seq_list->head = seq_list->list[seq & mask];
298 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
299
300 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
301 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
302 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
303 }
304 } else {
305 /* Walk the list to find the sequence number */
306 u16 prev = seq_list->head;
307 while (seq_list->list[prev & mask] != seq) {
308 prev = seq_list->list[prev & mask];
309 if (prev == L2CAP_SEQ_LIST_TAIL)
310 return L2CAP_SEQ_LIST_CLEAR;
311 }
312
313 /* Unlink the number from the list and clear it */
314 seq_list->list[prev & mask] = seq_list->list[seq & mask];
315 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
316 if (seq_list->tail == seq)
317 seq_list->tail = prev;
318 }
319 return seq;
320}
321
322static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
323{
324 /* Remove the head in constant time */
325 return l2cap_seq_list_remove(seq_list, seq_list->head);
326}
327
328static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
329{
f522ae36 330 u16 i;
3c588192 331
f522ae36
GP		 332 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
333 return;
334
335 for (i = 0; i <= seq_list->mask; i++)
336 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
337
338 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
339 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 340}
341
342static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
343{
344 u16 mask = seq_list->mask;
345
346 /* All appends happen in constant time */
347
f522ae36
GP		 348 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
349 return;
3c588192 350
f522ae36
GP		 351 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
352 seq_list->head = seq;
353 else
354 seq_list->list[seq_list->tail & mask] = seq;
355
356 seq_list->tail = seq;
357 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 358}
359
721c4181 360static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 361{
721c4181
GP		 362 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
363 chan_timer.work);
3df91ea2 364 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 365 int reason;
366
e05dcc32 367 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 368
3df91ea2 369 mutex_lock(&conn->chan_lock);
6be36555 370 l2cap_chan_lock(chan);
ab07801d 371
89bc500e 372 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 373 reason = ECONNREFUSED;
89bc500e 374 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 375 chan->sec_level != BT_SECURITY_SDP)
376 reason = ECONNREFUSED;
377 else
378 reason = ETIMEDOUT;
379
0f852724 380 l2cap_chan_close(chan, reason);
ab07801d 381
6be36555 382 l2cap_chan_unlock(chan);
ab07801d 383
ba3bd0ee 384 chan->ops->close(chan->data);
3df91ea2
AE		 385 mutex_unlock(&conn->chan_lock);
386
371fd835 387 l2cap_chan_put(chan);
ab07801d
GP		 388}
389
eef1d9b6 390struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 391{
392 struct l2cap_chan *chan;
393
394 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
395 if (!chan)
396 return NULL;
397
c03b355e
AE		 398 mutex_init(&chan->lock);
399
333055f2 400 write_lock(&chan_list_lock);
23691d75 401 list_add(&chan->global_l, &chan_list);
333055f2 402 write_unlock(&chan_list_lock);
23691d75 403
721c4181 404 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 405
89bc500e
GP		 406 chan->state = BT_OPEN;
407
71ba0e56
GP		 408 atomic_set(&chan->refcnt, 1);
409
2827011f
MM		 410 /* This flag is cleared in l2cap_chan_ready() */
411 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
412
eef1d9b6 413 BT_DBG("chan %p", chan);
abc545b8 414
48454079
GP		 415 return chan;
416}
417
23691d75 418void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 419{
333055f2 420 write_lock(&chan_list_lock);
23691d75 421 list_del(&chan->global_l);
333055f2 422 write_unlock(&chan_list_lock);
23691d75 423
371fd835 424 l2cap_chan_put(chan);
6ff5abbf
GP		 425}
426
bd4b1653
AE		 427void l2cap_chan_set_defaults(struct l2cap_chan *chan)
428{
429 chan->fcs = L2CAP_FCS_CRC16;
430 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
431 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
432 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
433 chan->sec_level = BT_SECURITY_LOW;
434
435 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
436}
437
14a28491 438static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 439{
af05b30b 440 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 441 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 442
9f5a0d7b 443 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 444
8c1d787b 445 chan->conn = conn;
0139418c 446
5491120e
AE		 447 switch (chan->chan_type) {
448 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 449 if (conn->hcon->type == LE_LINK) {
450 /* LE connection */
0c1bc5c6 451 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 452 chan->scid = L2CAP_CID_LE_DATA;
453 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 454 } else {
455 /* Alloc CID for connection-oriented socket */
fe4128e0 456 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 457 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 458 }
5491120e
AE		 459 break;
460
461 case L2CAP_CHAN_CONN_LESS:
0139418c 462 /* Connectionless socket */
fe4128e0
GP		 463 chan->scid = L2CAP_CID_CONN_LESS;
464 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 465 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 466 break;
467
468 default:
0139418c 469 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 470 chan->scid = L2CAP_CID_SIGNALING;
471 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 472 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 473 }
474
8f7975b1
AE		 475 chan->local_id = L2CAP_BESTEFFORT_ID;
476 chan->local_stype = L2CAP_SERV_BESTEFFORT;
477 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
478 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
479 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
480 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
481
371fd835 482 l2cap_chan_hold(chan);
baa7e1fa 483
3df91ea2 484 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 485}
486
14a28491 487static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 488{
489 mutex_lock(&conn->chan_lock);
490 __l2cap_chan_add(conn, chan);
3df91ea2 491 mutex_unlock(&conn->chan_lock);
0139418c
MH		 492}
493
4519de9a 494static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 495{
48454079 496 struct sock *sk = chan->sk;
8c1d787b 497 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 498 struct sock *parent = bt_sk(sk)->parent;
499
c9b66675 500 __clear_chan_timer(chan);
0139418c 501
49208c9c 502 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 503
8e87d142 504 if (conn) {
baa7e1fa 505 /* Delete from channel list */
3df91ea2 506 list_del(&chan->list);
3d57dc68 507
371fd835 508 l2cap_chan_put(chan);
baa7e1fa 509
8c1d787b 510 chan->conn = NULL;
0139418c
MH		 511 hci_conn_put(conn->hcon);
512 }
513
6be36555
AE		 514 lock_sock(sk);
515
0e587be7 516 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 517 sock_set_flag(sk, SOCK_ZAPPED);
518
519 if (err)
2e0052e4 520 __l2cap_chan_set_err(chan, err);
0139418c
MH		 521
522 if (parent) {
523 bt_accept_unlink(sk);
524 parent->sk_data_ready(parent, 0);
525 } else
526 sk->sk_state_change(sk);
c13ffa62 527
6be36555
AE		 528 release_sock(sk);
529
2827011f 530 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 531 return;
2ead70b8 532
ee556f66
GP		 533 switch(chan->mode) {
534 case L2CAP_MODE_BASIC:
535 break;
c13ffa62 536
ee556f66 537 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 538 __clear_retrans_timer(chan);
539 __clear_monitor_timer(chan);
540 __clear_ack_timer(chan);
c13ffa62 541
f1c6775b 542 skb_queue_purge(&chan->srej_q);
c13ffa62 543
3c588192
MM		 544 l2cap_seq_list_free(&chan->srej_list);
545 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 546
547 /* fall through */
548
549 case L2CAP_MODE_STREAMING:
550 skb_queue_purge(&chan->tx_q);
551 break;
c13ffa62 552 }
ee556f66
GP		 553
554 return;
0139418c
MH		 555}
556
4519de9a
GP		 557static void l2cap_chan_cleanup_listen(struct sock *parent)
558{
559 struct sock *sk;
560
561 BT_DBG("parent %p", parent);
562
563 /* Close not yet accepted channels */
0f852724 564 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 565 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 566
6be36555 567 l2cap_chan_lock(chan);
c9b66675 568 __clear_chan_timer(chan);
ba3bd0ee 569 l2cap_chan_close(chan, ECONNRESET);
6be36555 570 l2cap_chan_unlock(chan);
3df91ea2 571
ba3bd0ee 572 chan->ops->close(chan->data);
0f852724 573 }
4519de9a
GP		 574}
575
0f852724 576void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 577{
578 struct l2cap_conn *conn = chan->conn;
579 struct sock *sk = chan->sk;
580
e05dcc32
AE		 581 BT_DBG("chan %p state %s sk %p", chan,
582 state_to_string(chan->state), sk);
4519de9a 583
89bc500e 584 switch (chan->state) {
4519de9a 585 case BT_LISTEN:
6be36555 586 lock_sock(sk);
4519de9a 587 l2cap_chan_cleanup_listen(sk);
89bc500e 588
0e587be7 589 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 590 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 591 release_sock(sk);
4519de9a
GP		 592 break;
593
594 case BT_CONNECTED:
595 case BT_CONFIG:
715ec005 596 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 597 conn->hcon->type == ACL_LINK) {
c9b66675 598 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 599 l2cap_send_disconn_req(conn, chan, reason);
600 } else
601 l2cap_chan_del(chan, reason);
602 break;
603
604 case BT_CONNECT2:
715ec005 605 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 606 conn->hcon->type == ACL_LINK) {
607 struct l2cap_conn_rsp rsp;
608 __u16 result;
609
c5daa683 610 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
4519de9a
GP		 611 result = L2CAP_CR_SEC_BLOCK;
612 else
613 result = L2CAP_CR_BAD_PSM;
89bc500e 614 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 615
616 rsp.scid = cpu_to_le16(chan->dcid);
617 rsp.dcid = cpu_to_le16(chan->scid);
618 rsp.result = cpu_to_le16(result);
619 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
620 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
621 sizeof(rsp), &rsp);
622 }
623
624 l2cap_chan_del(chan, reason);
625 break;
626
627 case BT_CONNECT:
628 case BT_DISCONN:
629 l2cap_chan_del(chan, reason);
630 break;
631
632 default:
6be36555 633 lock_sock(sk);
4519de9a 634 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 635 release_sock(sk);
4519de9a
GP		 636 break;
637 }
638}
639
4343478f 640static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 641{
715ec005 642 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 643 switch (chan->sec_level) {
8556edd3
JH		 644 case BT_SECURITY_HIGH:
645 return HCI_AT_DEDICATED_BONDING_MITM;
646 case BT_SECURITY_MEDIUM:
647 return HCI_AT_DEDICATED_BONDING;
648 default:
649 return HCI_AT_NO_BONDING;
650 }
fe4128e0 651 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 652 if (chan->sec_level == BT_SECURITY_LOW)
653 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 654
4343478f 655 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 656 return HCI_AT_NO_BONDING_MITM;
00ae4af9 657 else
8556edd3 658 return HCI_AT_NO_BONDING;
00ae4af9 659 } else {
4343478f 660 switch (chan->sec_level) {
00ae4af9 661 case BT_SECURITY_HIGH:
8556edd3 662 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 663 case BT_SECURITY_MEDIUM:
8556edd3 664 return HCI_AT_GENERAL_BONDING;
00ae4af9 665 default:
8556edd3 666 return HCI_AT_NO_BONDING;
00ae4af9 667 }
0684e5f9 668 }
8556edd3
JH		 669}
670
671/* Service level security */
d45fc423 672int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 673{
8c1d787b 674 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 675 __u8 auth_type;
676
4343478f 677 auth_type = l2cap_get_auth_type(chan);
79d554a6 678
4343478f 679 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 680}
681
b5ad8b7f 682static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 683{
684 u8 id;
685
686 /* Get next available identificator.
687 * 1 - 128 are used by kernel.
688 * 129 - 199 are reserved.
689 * 200 - 254 are used by utilities like l2ping, etc.
690 */
691
333055f2 692 spin_lock(&conn->lock);
4e8402a3
MH		 693
694 if (++conn->tx_ident > 128)
695 conn->tx_ident = 1;
696
697 id = conn->tx_ident;
698
333055f2 699 spin_unlock(&conn->lock);
4e8402a3
MH		 700
701 return id;
702}
703
4519de9a 704static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 705{
706 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 707 u8 flags;
4e8402a3
MH		 708
709 BT_DBG("code 0x%2.2x", code);
710
711 if (!skb)
9a9c6a34 712 return;
4e8402a3 713
e702112f
AE		 714 if (lmp_no_flush_capable(conn->hcon->hdev))
715 flags = ACL_START_NO_FLUSH;
716 else
717 flags = ACL_START;
718
14b12d0b 719 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 720 skb->priority = HCI_PRIO_MAX;
14b12d0b 721
73d80deb
LAD		 722 hci_send_acl(conn->hchan, skb, flags);
723}
724
725static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
726{
727 struct hci_conn *hcon = chan->conn->hcon;
728 u16 flags;
729
730 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
731 skb->priority);
732
733 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
734 lmp_no_flush_capable(hcon->hdev))
735 flags = ACL_START_NO_FLUSH;
736 else
737 flags = ACL_START;
14b12d0b 738
73d80deb
LAD		 739 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
740 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 741}
742
b76bbd66
MM		 743static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
744{
745 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
746 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
747
748 if (enh & L2CAP_CTRL_FRAME_TYPE) {
749 /* S-Frame */
750 control->sframe = 1;
751 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
752 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
753
754 control->sar = 0;
755 control->txseq = 0;
756 } else {
757 /* I-Frame */
758 control->sframe = 0;
759 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
760 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
761
762 control->poll = 0;
763 control->super = 0;
764 }
765}
766
b76bbd66
MM		 767static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
768{
769 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
770 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
771
772 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
773 /* S-Frame */
774 control->sframe = 1;
775 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
776 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
777
778 control->sar = 0;
779 control->txseq = 0;
780 } else {
781 /* I-Frame */
782 control->sframe = 0;
783 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
784 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
785
786 control->poll = 0;
787 control->super = 0;
788 }
789}
790
791static inline void __unpack_control(struct l2cap_chan *chan,
792 struct sk_buff *skb)
793{
794 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
795 __unpack_extended_control(get_unaligned_le32(skb->data),
796 &bt_cb(skb)->control);
cec8ab6e 797 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 798 } else {
799 __unpack_enhanced_control(get_unaligned_le16(skb->data),
800 &bt_cb(skb)->control);
cec8ab6e 801 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 802 }
803}
804
b5c6aaed
MM		 805static u32 __pack_extended_control(struct l2cap_ctrl *control)
806{
807 u32 packed;
808
809 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
810 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
811
812 if (control->sframe) {
813 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
814 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
815 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
816 } else {
817 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
818 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
819 }
820
821 return packed;
822}
823
824static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
825{
826 u16 packed;
827
828 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
829 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
830
831 if (control->sframe) {
832 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
833 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
834 packed |= L2CAP_CTRL_FRAME_TYPE;
835 } else {
836 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
837 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
838 }
839
840 return packed;
841}
842
b76bbd66
MM		 843static inline void __pack_control(struct l2cap_chan *chan,
844 struct l2cap_ctrl *control,
845 struct sk_buff *skb)
846{
847 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
848 put_unaligned_le32(__pack_extended_control(control),
849 skb->data + L2CAP_HDR_SIZE);
850 } else {
851 put_unaligned_le16(__pack_enhanced_control(control),
852 skb->data + L2CAP_HDR_SIZE);
853 }
854}
855
a67d7f6f
MM		 856static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
857 u32 control)
b5c6aaed
MM		 858{
859 struct sk_buff *skb;
860 struct l2cap_hdr *lh;
a67d7f6f 861 int hlen;
b5c6aaed
MM		 862
863 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
864 hlen = L2CAP_EXT_HDR_SIZE;
865 else
866 hlen = L2CAP_ENH_HDR_SIZE;
867
868 if (chan->fcs == L2CAP_FCS_CRC16)
869 hlen += L2CAP_FCS_SIZE;
870
a67d7f6f 871 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 872
b5c6aaed 873 if (!skb)
a67d7f6f 874 return ERR_PTR(-ENOMEM);
b5c6aaed
MM		 875
876 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
877 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
878 lh->cid = cpu_to_le16(chan->dcid);
879
a67d7f6f
MM		 880 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
881 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
882 else
883 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 884
885 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 886 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 887 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
888 }
889
890 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 891 return skb;
892}
893
894static void l2cap_send_sframe(struct l2cap_chan *chan,
895 struct l2cap_ctrl *control)
896{
897 struct sk_buff *skb;
898 u32 control_field;
899
900 BT_DBG("chan %p, control %p", chan, control);
901
902 if (!control->sframe)
903 return;
904
905 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
906 !control->poll)
907 control->final = 1;
908
909 if (control->super == L2CAP_SUPER_RR)
910 clear_bit(CONN_RNR_SENT, &chan->conn_state);
911 else if (control->super == L2CAP_SUPER_RNR)
912 set_bit(CONN_RNR_SENT, &chan->conn_state);
913
914 if (control->super != L2CAP_SUPER_SREJ) {
915 chan->last_acked_seq = control->reqseq;
916 __clear_ack_timer(chan);
917 }
918
919 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
920 control->final, control->poll, control->super);
921
922 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
923 control_field = __pack_extended_control(control);
924 else
925 control_field = __pack_enhanced_control(control);
926
927 skb = l2cap_create_sframe_pdu(chan, control_field);
928 if (!IS_ERR(skb))
929 l2cap_do_send(chan, skb);
b5c6aaed
MM		 930}
931
c9e3d5e0 932static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 933{
c9e3d5e0
MM		 934 struct l2cap_ctrl control;
935
936 BT_DBG("chan %p, poll %d", chan, poll);
937
938 memset(&control, 0, sizeof(control));
939 control.sframe = 1;
940 control.poll = poll;
941
942 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
943 control.super = L2CAP_SUPER_RNR;
944 else
945 control.super = L2CAP_SUPER_RR;
b5c6aaed 946
c9e3d5e0
MM		 947 control.reqseq = chan->buffer_seq;
948 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 949}
950
b4450035 951static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 952{
c1360a1c 953 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 954}
955
9b27f350
AE		 956static void l2cap_send_conn_req(struct l2cap_chan *chan)
957{
958 struct l2cap_conn *conn = chan->conn;
959 struct l2cap_conn_req req;
960
961 req.scid = cpu_to_le16(chan->scid);
962 req.psm = chan->psm;
963
964 chan->ident = l2cap_get_ident(conn);
965
966 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
967
968 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
969}
970
9f0caeb1
VCG		 971static void l2cap_chan_ready(struct l2cap_chan *chan)
972{
973 struct sock *sk = chan->sk;
974 struct sock *parent;
975
976 lock_sock(sk);
977
978 parent = bt_sk(sk)->parent;
979
980 BT_DBG("sk %p, parent %p", sk, parent);
981
2827011f 982 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 983 chan->conf_state = 0;
984 __clear_chan_timer(chan);
985
986 __l2cap_state_change(chan, BT_CONNECTED);
987 sk->sk_state_change(sk);
988
989 if (parent)
990 parent->sk_data_ready(parent, 0);
991
992 release_sock(sk);
993}
994
fc7f8a7e 995static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 996{
8c1d787b 997 struct l2cap_conn *conn = chan->conn;
79d554a6 998
9f0caeb1
VCG		 999 if (conn->hcon->type == LE_LINK) {
1000 l2cap_chan_ready(chan);
1001 return;
1002 }
1003
79d554a6 1004 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 1005 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1006 return;
1007
d45fc423 1008 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 1009 __l2cap_no_conn_pending(chan))
1010 l2cap_send_conn_req(chan);
79d554a6
MH		 1011 } else {
1012 struct l2cap_info_req req;
1013 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1014
1015 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1016 conn->info_ident = l2cap_get_ident(conn);
1017
ba13ccd9 1018 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 1019
1020 l2cap_send_cmd(conn, conn->info_ident,
1021 L2CAP_INFO_REQ, sizeof(req), &req);
1022 }
1023}
1024
cf6c2c0b
GP		 1025static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1026{
1027 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1028 if (!disable_ertm)
cf6c2c0b
GP		 1029 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1030
1031 switch (mode) {
1032 case L2CAP_MODE_ERTM:
1033 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1034 case L2CAP_MODE_STREAMING:
1035 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1036 default:
1037 return 0x00;
1038 }
1039}
1040
4519de9a 1041static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 1042{
6be36555 1043 struct sock *sk = chan->sk;
22121fc9
GP		 1044 struct l2cap_disconn_req req;
1045
c13ffa62
GP		 1046 if (!conn)
1047 return;
1048
0c1bc5c6 1049 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 1050 __clear_retrans_timer(chan);
1051 __clear_monitor_timer(chan);
1052 __clear_ack_timer(chan);
c13ffa62
GP		 1053 }
1054
fe4128e0
GP		 1055 req.dcid = cpu_to_le16(chan->dcid);
1056 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 1057 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1058 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 1059
6be36555 1060 lock_sock(sk);
0e587be7 1061 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1062 __l2cap_chan_set_err(chan, err);
6be36555 1063 release_sock(sk);
22121fc9
GP		 1064}
1065
1da177e4 1066/* ---- L2CAP connections ---- */
4e8402a3
MH		 1067static void l2cap_conn_start(struct l2cap_conn *conn)
1068{
3df91ea2 1069 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1070
1071 BT_DBG("conn %p", conn);
1072
3df91ea2 1073 mutex_lock(&conn->chan_lock);
4e8402a3 1074
3df91ea2 1075 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1076 struct sock *sk = chan->sk;
baa7e1fa 1077
6be36555 1078 l2cap_chan_lock(chan);
4e8402a3 1079
715ec005 1080 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1081 l2cap_chan_unlock(chan);
79d554a6
MH		 1082 continue;
1083 }
1084
89bc500e 1085 if (chan->state == BT_CONNECT) {
d45fc423 1086 if (!l2cap_chan_check_security(chan) ||
b4450035 1087 !__l2cap_no_conn_pending(chan)) {
6be36555 1088 l2cap_chan_unlock(chan);
47731de7
GP		 1089 continue;
1090 }
79d554a6 1091
c1360a1c
GP		 1092 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1093 && test_bit(CONF_STATE2_DEVICE,
1094 &chan->conf_state)) {
89bc500e 1095 l2cap_chan_close(chan, ECONNRESET);
6be36555 1096 l2cap_chan_unlock(chan);
47731de7 1097 continue;
b1235d79 1098 }
47731de7 1099
9b27f350 1100 l2cap_send_conn_req(chan);
47731de7 1101
89bc500e 1102 } else if (chan->state == BT_CONNECT2) {
79d554a6 1103 struct l2cap_conn_rsp rsp;
e9aeb2dd 1104 char buf[128];
fe4128e0
GP		 1105 rsp.scid = cpu_to_le16(chan->dcid);
1106 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1107
d45fc423 1108 if (l2cap_chan_check_security(chan)) {
6be36555 1109 lock_sock(sk);
c5daa683
GP		 1110 if (test_bit(BT_SK_DEFER_SETUP,
1111 &bt_sk(sk)->flags)) {
f66dc81f
MH		 1112 struct sock *parent = bt_sk(sk)->parent;
1113 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1114 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 1115 if (parent)
1116 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 1117
1118 } else {
0e587be7 1119 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 1120 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1121 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1122 }
6be36555 1123 release_sock(sk);
79d554a6
MH		 1124 } else {
1125 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1126 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1127 }
1128
fc7f8a7e
GP		 1129 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1130 sizeof(rsp), &rsp);
e9aeb2dd 1131
c1360a1c 1132 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 1133 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1134 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1135 continue;
1136 }
1137
c1360a1c 1138 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1139 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 1140 l2cap_build_conf_req(chan, buf), buf);
1141 chan->num_conf_req++;
4e8402a3
MH		 1142 }
1143
6be36555 1144 l2cap_chan_unlock(chan);
4e8402a3
MH		 1145 }
1146
3df91ea2 1147 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1148}
1149
c2287681 1150/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1151 * Returns closest match, locked.
1152 */
d9b88702 1153static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1154 bdaddr_t *src,
1155 bdaddr_t *dst)
b62f328b 1156{
23691d75 1157 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1158
23691d75 1159 read_lock(&chan_list_lock);
b62f328b 1160
23691d75
GP		 1161 list_for_each_entry(c, &chan_list, global_l) {
1162 struct sock *sk = c->sk;
fe4128e0 1163
89bc500e 1164 if (state && c->state != state)
b62f328b
VT		 1165 continue;
1166
23691d75 1167 if (c->scid == cid) {
c2287681
IY		 1168 int src_match, dst_match;
1169 int src_any, dst_any;
1170
b62f328b 1171 /* Exact match. */
c2287681
IY		 1172 src_match = !bacmp(&bt_sk(sk)->src, src);
1173 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1174 if (src_match && dst_match) {
23691d75
GP		 1175 read_unlock(&chan_list_lock);
1176 return c;
1177 }
b62f328b
VT		 1178
1179 /* Closest match */
c2287681
IY		 1180 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1181 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1182 if ((src_match && dst_any) || (src_any && dst_match) ||
1183 (src_any && dst_any))
23691d75 1184 c1 = c;
b62f328b
VT		 1185 }
1186 }
280f294f 1187
23691d75 1188 read_unlock(&chan_list_lock);
b62f328b 1189
23691d75 1190 return c1;
b62f328b
VT		 1191}
1192
1193static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1194{
c916fbe4 1195 struct sock *parent, *sk;
23691d75 1196 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1197
1198 BT_DBG("");
1199
1200 /* Check if we have socket listening on cid */
23691d75 1201 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1202 conn->src, conn->dst);
23691d75 1203 if (!pchan)
b62f328b
VT		 1204 return;
1205
23691d75
GP		 1206 parent = pchan->sk;
1207
aa2ac881 1208 lock_sock(parent);
62f3a2cf 1209
b62f328b
VT		 1210 /* Check for backlog size */
1211 if (sk_acceptq_is_full(parent)) {
1212 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1213 goto clean;
1214 }
1215
80808e43
GP		 1216 chan = pchan->ops->new_connection(pchan->data);
1217 if (!chan)
b62f328b
VT		 1218 goto clean;
1219
80808e43 1220 sk = chan->sk;
5d41ce1d 1221
b62f328b
VT		 1222 hci_conn_hold(conn->hcon);
1223
b62f328b
VT		 1224 bacpy(&bt_sk(sk)->src, conn->src);
1225 bacpy(&bt_sk(sk)->dst, conn->dst);
1226
d1010240
GP		 1227 bt_accept_enqueue(parent, sk);
1228
3d57dc68 1229 l2cap_chan_add(conn, chan);
48454079 1230
c9b66675 1231 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 1232
0e587be7 1233 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 1234 parent->sk_data_ready(parent, 0);
1235
b62f328b 1236clean:
aa2ac881 1237 release_sock(parent);
b62f328b
VT		 1238}
1239
4e8402a3
MH		 1240static void l2cap_conn_ready(struct l2cap_conn *conn)
1241{
48454079 1242 struct l2cap_chan *chan;
4e8402a3 1243
79d554a6 1244 BT_DBG("conn %p", conn);
4e8402a3 1245
b62f328b
VT		 1246 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
1247 l2cap_le_conn_ready(conn);
1248
160dc6ac
VCG		 1249 if (conn->hcon->out && conn->hcon->type == LE_LINK)
1250 smp_conn_security(conn, conn->hcon->pending_sec_level);
1251
3df91ea2 1252 mutex_lock(&conn->chan_lock);
4e8402a3 1253
3df91ea2 1254 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1255
6be36555 1256 l2cap_chan_lock(chan);
4e8402a3 1257
63128451 1258 if (conn->hcon->type == LE_LINK) {
b501d6a1 1259 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 1260 l2cap_chan_ready(chan);
acd7d370 1261
63128451 1262 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1263 struct sock *sk = chan->sk;
c9b66675 1264 __clear_chan_timer(chan);
6be36555 1265 lock_sock(sk);
0e587be7 1266 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1267 sk->sk_state_change(sk);
6be36555 1268 release_sock(sk);
b501d6a1 1269
89bc500e 1270 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1271 l2cap_do_start(chan);
4e8402a3 1272
6be36555 1273 l2cap_chan_unlock(chan);
4e8402a3 1274 }
79d554a6 1275
3df91ea2 1276 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1277}
1278
1279/* Notify sockets that we cannot guaranty reliability anymore */
1280static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1281{
48454079 1282 struct l2cap_chan *chan;
4e8402a3
MH		 1283
1284 BT_DBG("conn %p", conn);
1285
3df91ea2 1286 mutex_lock(&conn->chan_lock);
4e8402a3 1287
3df91ea2 1288 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1289 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 1290 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1291 }
1292
3df91ea2 1293 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1294}
1295
f878fcad 1296static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1297{
f878fcad 1298 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 1299 info_timer.work);
4e8402a3 1300
984947dc 1301 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1302 conn->info_ident = 0;
984947dc 1303
4e8402a3
MH		 1304 l2cap_conn_start(conn);
1305}
1306
5d3de7df
VCG		 1307static void l2cap_conn_del(struct hci_conn *hcon, int err)
1308{
1309 struct l2cap_conn *conn = hcon->l2cap_data;
1310 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1311
1312 if (!conn)
1313 return;
1314
1315 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1316
1317 kfree_skb(conn->rx_skb);
1318
3df91ea2
AE		 1319 mutex_lock(&conn->chan_lock);
1320
5d3de7df
VCG		 1321 /* Kill channels */
1322 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1323 l2cap_chan_hold(chan);
6be36555
AE		 1324 l2cap_chan_lock(chan);
1325
5d3de7df 1326 l2cap_chan_del(chan, err);
6be36555
AE		 1327
1328 l2cap_chan_unlock(chan);
1329
5d3de7df 1330 chan->ops->close(chan->data);
61d6ef3e 1331 l2cap_chan_put(chan);
5d3de7df
VCG		 1332 }
1333
3df91ea2
AE		 1334 mutex_unlock(&conn->chan_lock);
1335
73d80deb
LAD		 1336 hci_chan_del(conn->hchan);
1337
5d3de7df 1338 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1339 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1340
51a8efd7 1341 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1342 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1343 smp_chan_destroy(conn);
d26a2345 1344 }
5d3de7df
VCG		 1345
1346 hcon->l2cap_data = NULL;
1347 kfree(conn);
1348}
1349
6c9d42a1 1350static void security_timeout(struct work_struct *work)
5d3de7df 1351{
6c9d42a1
GP		 1352 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1353 security_timer.work);
5d3de7df
VCG		 1354
1355 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1356}
1357
1da177e4
LT		 1358static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1359{
0139418c 1360 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1361 struct hci_chan *hchan;
1da177e4 1362
0139418c 1363 if (conn || status)
1da177e4
LT		 1364 return conn;
1365
73d80deb
LAD		 1366 hchan = hci_chan_create(hcon);
1367 if (!hchan)
1368 return NULL;
1369
0139418c 1370 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1371 if (!conn) {
1372 hci_chan_del(hchan);
1da177e4 1373 return NULL;
73d80deb 1374 }
1da177e4
LT		 1375
1376 hcon->l2cap_data = conn;
1377 conn->hcon = hcon;
73d80deb 1378 conn->hchan = hchan;
1da177e4 1379
73d80deb 1380 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1381
acd7d370
VT		 1382 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1383 conn->mtu = hcon->hdev->le_mtu;
1384 else
1385 conn->mtu = hcon->hdev->acl_mtu;
1386
1da177e4
LT		 1387 conn->src = &hcon->hdev->bdaddr;
1388 conn->dst = &hcon->dst;
1389
4e8402a3
MH		 1390 conn->feat_mask = 0;
1391
1da177e4 1392 spin_lock_init(&conn->lock);
3df91ea2 1393 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1394
1395 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1396
5d3de7df 1397 if (hcon->type == LE_LINK)
6c9d42a1 1398 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1399 else
030013d8 1400 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1401
9f5a0d7b 1402 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1403
1da177e4
LT		 1404 return conn;
1405}
1406
1da177e4 1407/* ---- Socket interface ---- */
1da177e4 1408
c2287681 1409/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1410 * Returns closest match.
1411 */
c2287681
IY		 1412static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1413 bdaddr_t *src,
1414 bdaddr_t *dst)
1da177e4 1415{
23691d75 1416 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1417
23691d75 1418 read_lock(&chan_list_lock);
e0f0cb56 1419
23691d75
GP		 1420 list_for_each_entry(c, &chan_list, global_l) {
1421 struct sock *sk = c->sk;
fe4128e0 1422
89bc500e 1423 if (state && c->state != state)
1da177e4
LT		 1424 continue;
1425
23691d75 1426 if (c->psm == psm) {
c2287681
IY		 1427 int src_match, dst_match;
1428 int src_any, dst_any;
1429
1da177e4 1430 /* Exact match. */
c2287681
IY		 1431 src_match = !bacmp(&bt_sk(sk)->src, src);
1432 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1433 if (src_match && dst_match) {
a7567b20 1434 read_unlock(&chan_list_lock);
23691d75
GP		 1435 return c;
1436 }
1da177e4
LT		 1437
1438 /* Closest match */
c2287681
IY		 1439 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1440 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1441 if ((src_match && dst_any) || (src_any && dst_match) ||
1442 (src_any && dst_any))
23691d75 1443 c1 = c;
1da177e4
LT		 1444 }
1445 }
1da177e4 1446
23691d75 1447 read_unlock(&chan_list_lock);
e0f0cb56 1448
23691d75 1449 return c1;
1da177e4
LT		 1450}
1451
8e9f9892
AG		 1452int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1453 bdaddr_t *dst, u8 dst_type)
1da177e4 1454{
5d41ce1d 1455 struct sock *sk = chan->sk;
1da177e4 1456 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1457 struct l2cap_conn *conn;
1458 struct hci_conn *hcon;
1459 struct hci_dev *hdev;
09ab6f4c 1460 __u8 auth_type;
44d0e48e 1461 int err;
1da177e4 1462
8e9f9892
AG		 1463 BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
1464 dst_type, __le16_to_cpu(chan->psm));
1da177e4 1465
af05b30b
GP		 1466 hdev = hci_get_route(dst, src);
1467 if (!hdev)
1da177e4
LT		 1468 return -EHOSTUNREACH;
1469
09fd0de5 1470 hci_dev_lock(hdev);
1da177e4 1471
6be36555 1472 l2cap_chan_lock(chan);
03a00194
GP		 1473
1474 /* PSM must be odd and lsb of upper byte must be 0 */
1475 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1476 chan->chan_type != L2CAP_CHAN_RAW) {
1477 err = -EINVAL;
1478 goto done;
1479 }
1480
1481 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1482 err = -EINVAL;
1483 goto done;
1484 }
1485
1486 switch (chan->mode) {
1487 case L2CAP_MODE_BASIC:
1488 break;
1489 case L2CAP_MODE_ERTM:
1490 case L2CAP_MODE_STREAMING:
1491 if (!disable_ertm)
1492 break;
1493 /* fall through */
1494 default:
1495 err = -ENOTSUPP;
1496 goto done;
1497 }
1498
6be36555
AE		 1499 lock_sock(sk);
1500
03a00194
GP		 1501 switch (sk->sk_state) {
1502 case BT_CONNECT:
1503 case BT_CONNECT2:
1504 case BT_CONFIG:
1505 /* Already connecting */
1506 err = 0;
6be36555 1507 release_sock(sk);
03a00194
GP		 1508 goto done;
1509
1510 case BT_CONNECTED:
1511 /* Already connected */
1512 err = -EISCONN;
6be36555 1513 release_sock(sk);
03a00194
GP		 1514 goto done;
1515
1516 case BT_OPEN:
1517 case BT_BOUND:
1518 /* Can connect */
1519 break;
1520
1521 default:
1522 err = -EBADFD;
6be36555 1523 release_sock(sk);
03a00194
GP		 1524 goto done;
1525 }
1526
1527 /* Set destination address and psm */
9219b2a0 1528 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1529
1530 release_sock(sk);
1531
03a00194
GP		 1532 chan->psm = psm;
1533 chan->dcid = cid;
1da177e4 1534
4343478f 1535 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1536
fe4128e0 1537 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1538 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1539 chan->sec_level, auth_type);
acd7d370 1540 else
8e9f9892 1541 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1542 chan->sec_level, auth_type);
acd7d370 1543
30e76272
VT		 1544 if (IS_ERR(hcon)) {
1545 err = PTR_ERR(hcon);
1da177e4 1546 goto done;
30e76272 1547 }
1da177e4
LT		 1548
1549 conn = l2cap_conn_add(hcon, 0);
1550 if (!conn) {
1551 hci_conn_put(hcon);
30e76272 1552 err = -ENOMEM;
1da177e4
LT		 1553 goto done;
1554 }
1555
9f0caeb1
VCG		 1556 if (hcon->type == LE_LINK) {
1557 err = 0;
1558
1559 if (!list_empty(&conn->chan_l)) {
1560 err = -EBUSY;
1561 hci_conn_put(hcon);
1562 }
1563
1564 if (err)
1565 goto done;
1566 }
1567
1da177e4
LT		 1568 /* Update source addr of the socket */
1569 bacpy(src, conn->src);
1570
6be36555 1571 l2cap_chan_unlock(chan);
48454079 1572 l2cap_chan_add(conn, chan);
6be36555 1573 l2cap_chan_lock(chan);
48454079 1574
6be36555 1575 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1576 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1577
1578 if (hcon->state == BT_CONNECTED) {
715ec005 1579 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1580 __clear_chan_timer(chan);
d45fc423 1581 if (l2cap_chan_check_security(chan))
6be36555 1582 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1583 } else
fc7f8a7e 1584 l2cap_do_start(chan);
1da177e4
LT		 1585 }
1586
30e76272
VT		 1587 err = 0;
1588
1da177e4 1589done:
6be36555 1590 l2cap_chan_unlock(chan);
09fd0de5 1591 hci_dev_unlock(hdev);
1da177e4
LT		 1592 hci_dev_put(hdev);
1593 return err;
1594}
1595
dcba0dba 1596int __l2cap_wait_ack(struct sock *sk)
6161c038 1597{
8c1d787b 1598 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1599 DECLARE_WAITQUEUE(wait, current);
1600 int err = 0;
1601 int timeo = HZ/5;
1602
2b0b05dd 1603 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1604 set_current_state(TASK_INTERRUPTIBLE);
1605 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1606 if (!timeo)
1607 timeo = HZ/5;
1608
1609 if (signal_pending(current)) {
1610 err = sock_intr_errno(timeo);
1611 break;
1612 }
1613
1614 release_sock(sk);
1615 timeo = schedule_timeout(timeo);
1616 lock_sock(sk);
a71a0cf4 1617 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1618
1619 err = sock_error(sk);
1620 if (err)
1621 break;
1622 }
1623 set_current_state(TASK_RUNNING);
2b0b05dd 1624 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1625 return err;
1626}
1627
721c4181 1628static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1629{
721c4181 1630 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1631 monitor_timer.work);
e90bac06 1632
525cd185 1633 BT_DBG("chan %p", chan);
0e98958d 1634
6be36555
AE		 1635 l2cap_chan_lock(chan);
1636
80909e04 1637 if (!chan->conn) {
6be36555 1638 l2cap_chan_unlock(chan);
8d7e1c7f 1639 l2cap_chan_put(chan);
e90bac06
GP		 1640 return;
1641 }
1642
401bb1f7 1643 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1644
6be36555 1645 l2cap_chan_unlock(chan);
8d7e1c7f 1646 l2cap_chan_put(chan);
e90bac06
GP		 1647}
1648
721c4181 1649static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1650{
721c4181 1651 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1652 retrans_timer.work);
e90bac06 1653
49208c9c 1654 BT_DBG("chan %p", chan);
0e98958d 1655
6be36555
AE		 1656 l2cap_chan_lock(chan);
1657
80909e04
MM		 1658 if (!chan->conn) {
1659 l2cap_chan_unlock(chan);
1660 l2cap_chan_put(chan);
1661 return;
1662 }
6be36555 1663
401bb1f7 1664 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1665 l2cap_chan_unlock(chan);
8d7e1c7f 1666 l2cap_chan_put(chan);
e90bac06
GP		 1667}
1668
d660366d
GP		 1669static void l2cap_streaming_send(struct l2cap_chan *chan,
1670 struct sk_buff_head *skbs)
6840ed07 1671{
ccbb84af 1672 struct sk_buff *skb;
3733937d 1673 struct l2cap_ctrl *control;
6840ed07 1674
3733937d
MM		 1675 BT_DBG("chan %p, skbs %p", chan, skbs);
1676
3733937d
MM		 1677 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1678
1679 while (!skb_queue_empty(&chan->tx_q)) {
1680
1681 skb = skb_dequeue(&chan->tx_q);
1682
1683 bt_cb(skb)->control.retries = 1;
1684 control = &bt_cb(skb)->control;
1685
1686 control->reqseq = 0;
1687 control->txseq = chan->next_tx_seq;
1688
1689 __pack_control(chan, control, skb);
6840ed07 1690
47d1ec61 1691 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1692 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1693 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1694 }
1695
4343478f 1696 l2cap_do_send(chan, skb);
6840ed07 1697
3733937d
MM		 1698 BT_DBG("Sent txseq %d", (int)control->txseq);
1699
836be934 1700 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1701 chan->frames_sent++;
6840ed07 1702 }
6840ed07
GP		 1703}
1704
67c9e840 1705static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1706{
1707 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1708 struct l2cap_ctrl *control;
1709 int sent = 0;
1710
1711 BT_DBG("chan %p", chan);
1c2acffb 1712
89bc500e 1713 if (chan->state != BT_CONNECTED)
c13ffa62 1714 return -ENOTCONN;
e90bac06 1715
94122bbe
MM		 1716 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1717 return 0;
1718
18a48e76
MM		 1719 while (chan->tx_send_head &&
1720 chan->unacked_frames < chan->remote_tx_win &&
1721 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1722
18a48e76 1723 skb = chan->tx_send_head;
e90bac06 1724
18a48e76
MM		 1725 bt_cb(skb)->control.retries = 1;
1726 control = &bt_cb(skb)->control;
95ffa978 1727
e2ab4353 1728 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1729 control->final = 1;
e2ab4353 1730
18a48e76
MM		 1731 control->reqseq = chan->buffer_seq;
1732 chan->last_acked_seq = chan->buffer_seq;
1733 control->txseq = chan->next_tx_seq;
1c2acffb 1734
18a48e76 1735 __pack_control(chan, control, skb);
e90bac06 1736
47d1ec61 1737 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1738 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1739 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1740 }
1741
18a48e76
MM		 1742 /* Clone after data has been modified. Data is assumed to be
1743 read-only (for locking purposes) on cloned sk_buffs.
1744 */
1745 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1746
18a48e76
MM		 1747 if (!tx_skb)
1748 break;
1c2acffb 1749
18a48e76 1750 __set_retrans_timer(chan);
836be934
AE		 1751
1752 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1753 chan->unacked_frames++;
6a026610 1754 chan->frames_sent++;
18a48e76 1755 sent++;
1c2acffb 1756
58d35f87
GP		 1757 if (skb_queue_is_last(&chan->tx_q, skb))
1758 chan->tx_send_head = NULL;
1c2acffb 1759 else
58d35f87 1760 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1761
1762 l2cap_do_send(chan, tx_skb);
1763 BT_DBG("Sent txseq %d", (int)control->txseq);
1c2acffb
GP		 1764 }
1765
18a48e76
MM		 1766 BT_DBG("Sent %d, %d unacked, %d in ERTM queue", sent,
1767 (int) chan->unacked_frames, skb_queue_len(&chan->tx_q));
1768
1769 return sent;
9e917af1
GP		 1770}
1771
e1fbd4c1
MM		 1772static void l2cap_ertm_resend(struct l2cap_chan *chan)
1773{
1774 struct l2cap_ctrl control;
1775 struct sk_buff *skb;
1776 struct sk_buff *tx_skb;
1777 u16 seq;
1778
1779 BT_DBG("chan %p", chan);
1780
1781 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1782 return;
1783
1784 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1785 seq = l2cap_seq_list_pop(&chan->retrans_list);
1786
1787 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1788 if (!skb) {
1789 BT_DBG("Error: Can't retransmit seq %d, frame missing",
1790 seq);
1791 continue;
1792 }
1793
1794 bt_cb(skb)->control.retries++;
1795 control = bt_cb(skb)->control;
1796
1797 if (chan->max_tx != 0 &&
1798 bt_cb(skb)->control.retries > chan->max_tx) {
1799 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
1800 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
1801 l2cap_seq_list_clear(&chan->retrans_list);
1802 break;
1803 }
1804
1805 control.reqseq = chan->buffer_seq;
1806 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1807 control.final = 1;
1808 else
1809 control.final = 0;
1810
1811 if (skb_cloned(skb)) {
1812 /* Cloned sk_buffs are read-only, so we need a
1813 * writeable copy
1814 */
1815 tx_skb = skb_copy(skb, GFP_ATOMIC);
1816 } else {
1817 tx_skb = skb_clone(skb, GFP_ATOMIC);
1818 }
1819
1820 if (!tx_skb) {
1821 l2cap_seq_list_clear(&chan->retrans_list);
1822 break;
1823 }
1824
1825 /* Update skb contents */
1826 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1827 put_unaligned_le32(__pack_extended_control(&control),
1828 tx_skb->data + L2CAP_HDR_SIZE);
1829 } else {
1830 put_unaligned_le16(__pack_enhanced_control(&control),
1831 tx_skb->data + L2CAP_HDR_SIZE);
1832 }
1833
1834 if (chan->fcs == L2CAP_FCS_CRC16) {
1835 u16 fcs = crc16(0, (u8 *) tx_skb->data, tx_skb->len);
1836 put_unaligned_le16(fcs, skb_put(tx_skb,
1837 L2CAP_FCS_SIZE));
1838 }
1839
1840 l2cap_do_send(chan, tx_skb);
1841
1842 BT_DBG("Resent txseq %d", control.txseq);
1843
1844 chan->last_acked_seq = chan->buffer_seq;
1845 }
1846}
1847
f80842a8
MM		 1848static void l2cap_retransmit(struct l2cap_chan *chan,
1849 struct l2cap_ctrl *control)
1850{
1851 BT_DBG("chan %p, control %p", chan, control);
1852
1853 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
1854 l2cap_ertm_resend(chan);
1855}
1856
d2a7ac5d
MM		 1857static void l2cap_retransmit_all(struct l2cap_chan *chan,
1858 struct l2cap_ctrl *control)
1859{
e1fbd4c1
MM		 1860 struct sk_buff *skb;
1861
1862 BT_DBG("chan %p, control %p", chan, control);
1863
1864 if (control->poll)
1865 set_bit(CONN_SEND_FBIT, &chan->conn_state);
1866
1867 l2cap_seq_list_clear(&chan->retrans_list);
1868
1869 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1870 return;
1871
1872 if (chan->unacked_frames) {
1873 skb_queue_walk(&chan->tx_q, skb) {
1874 if (bt_cb(skb)->control.txseq == control->reqseq ||
1875 skb == chan->tx_send_head)
1876 break;
1877 }
1878
1879 skb_queue_walk_from(&chan->tx_q, skb) {
1880 if (skb == chan->tx_send_head)
1881 break;
1882
1883 l2cap_seq_list_append(&chan->retrans_list,
1884 bt_cb(skb)->control.txseq);
1885 }
1886
1887 l2cap_ertm_resend(chan);
1888 }
d2a7ac5d
MM		 1889}
1890
0a0aba42 1891static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1892{
0a0aba42
MM		 1893 struct l2cap_ctrl control;
1894 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
1895 chan->last_acked_seq);
1896 int threshold;
9e917af1 1897
0a0aba42
MM		 1898 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
1899 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 1900
0a0aba42
MM		 1901 memset(&control, 0, sizeof(control));
1902 control.sframe = 1;
dfc909be 1903
0a0aba42
MM		 1904 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
1905 chan->rx_state == L2CAP_RX_STATE_RECV) {
1906 __clear_ack_timer(chan);
1907 control.super = L2CAP_SUPER_RNR;
1908 control.reqseq = chan->buffer_seq;
1909 l2cap_send_sframe(chan, &control);
1910 } else {
1911 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
1912 l2cap_ertm_send(chan);
1913 /* If any i-frames were sent, they included an ack */
1914 if (chan->buffer_seq == chan->last_acked_seq)
1915 frames_to_ack = 0;
1916 }
dfc909be 1917
0a0aba42
MM		 1918 /* Ack now if the tx window is 3/4ths full.
1919 * Calculate without mul or div
1920 */
1921 threshold = chan->tx_win;
1922 threshold += threshold << 1;
1923 threshold >>= 2;
1924
1925 BT_DBG("frames_to_ack %d, threshold %d", (int)frames_to_ack,
1926 threshold);
1927
1928 if (frames_to_ack >= threshold) {
1929 __clear_ack_timer(chan);
1930 control.super = L2CAP_SUPER_RR;
1931 control.reqseq = chan->buffer_seq;
1932 l2cap_send_sframe(chan, &control);
1933 frames_to_ack = 0;
1934 }
1c2acffb 1935
0a0aba42
MM		 1936 if (frames_to_ack)
1937 __set_ack_timer(chan);
1938 }
b17e73bb
SJ		 1939}
1940
04124681
GP		 1941static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1942 struct msghdr *msg, int len,
1943 int count, struct sk_buff *skb)
1c2acffb 1944{
0952a57a 1945 struct l2cap_conn *conn = chan->conn;
1c2acffb 1946 struct sk_buff **frag;
90338947 1947 int sent = 0;
1da177e4 1948
59203a21 1949 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1950 return -EFAULT;
1da177e4
LT		 1951
1952 sent += count;
1953 len -= count;
1954
1955 /* Continuation fragments (no L2CAP header) */
1956 frag = &skb_shinfo(skb)->frag_list;
1957 while (len) {
fbe00700
GP		 1958 struct sk_buff *tmp;
1959
1da177e4
LT		 1960 count = min_t(unsigned int, conn->mtu, len);
1961
fbe00700
GP		 1962 tmp = chan->ops->alloc_skb(chan, count,
1963 msg->msg_flags & MSG_DONTWAIT);
1964 if (IS_ERR(tmp))
1965 return PTR_ERR(tmp);
1966
1967 *frag = tmp;
2f7719ce 1968
1c2acffb
GP		 1969 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1970 return -EFAULT;
1da177e4 1971
5e59b791
LAD		 1972 (*frag)->priority = skb->priority;
1973
1da177e4
LT		 1974 sent += count;
1975 len -= count;
1976
2d0ed3d5
GP		 1977 skb->len += (*frag)->len;
1978 skb->data_len += (*frag)->len;
1979
1da177e4
LT		 1980 frag = &(*frag)->next;
1981 }
1da177e4
LT		 1982
1983 return sent;
1c2acffb 1984}
1da177e4 1985
5e59b791
LAD		 1986static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1987 struct msghdr *msg, size_t len,
1988 u32 priority)
1c2acffb 1989{
8c1d787b 1990 struct l2cap_conn *conn = chan->conn;
1c2acffb 1991 struct sk_buff *skb;
03a51213 1992 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1993 struct l2cap_hdr *lh;
1994
6d5922b0 1995 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1996
1997 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1998
1999 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2000 msg->msg_flags & MSG_DONTWAIT);
2001 if (IS_ERR(skb))
2002 return skb;
1c2acffb 2003
5e59b791
LAD		 2004 skb->priority = priority;
2005
1c2acffb
GP		 2006 /* Create L2CAP header */
2007 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2008 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 2009 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2010 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2011
0952a57a 2012 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2013 if (unlikely(err < 0)) {
2014 kfree_skb(skb);
2015 return ERR_PTR(err);
2016 }
2017 return skb;
2018}
2019
5e59b791
LAD		 2020static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
2021 struct msghdr *msg, size_t len,
2022 u32 priority)
1c2acffb 2023{
8c1d787b 2024 struct l2cap_conn *conn = chan->conn;
1c2acffb 2025 struct sk_buff *skb;
f2ba7fae 2026 int err, count;
1c2acffb
GP		 2027 struct l2cap_hdr *lh;
2028
6d5922b0 2029 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 2030
f2ba7fae 2031 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2032
f2ba7fae 2033 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 2034 msg->msg_flags & MSG_DONTWAIT);
2035 if (IS_ERR(skb))
2036 return skb;
1c2acffb 2037
5e59b791
LAD		 2038 skb->priority = priority;
2039
1c2acffb
GP		 2040 /* Create L2CAP header */
2041 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2042 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2043 lh->len = cpu_to_le16(len);
1c2acffb 2044
0952a57a 2045 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2046 if (unlikely(err < 0)) {
2047 kfree_skb(skb);
2048 return ERR_PTR(err);
2049 }
2050 return skb;
2051}
2052
ab0ff76d
LAD		 2053static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
2054 struct msghdr *msg, size_t len,
94122bbe 2055 u16 sdulen)
1c2acffb 2056{
8c1d787b 2057 struct l2cap_conn *conn = chan->conn;
1c2acffb 2058 struct sk_buff *skb;
e4ca6d98 2059 int err, count, hlen;
1c2acffb
GP		 2060 struct l2cap_hdr *lh;
2061
6d5922b0 2062 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 2063
0ee0d208
GP		 2064 if (!conn)
2065 return ERR_PTR(-ENOTCONN);
2066
e4ca6d98
AE		 2067 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2068 hlen = L2CAP_EXT_HDR_SIZE;
2069 else
2070 hlen = L2CAP_ENH_HDR_SIZE;
2071
c74e560c 2072 if (sdulen)
03a51213 2073 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2074
47d1ec61 2075 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2076 hlen += L2CAP_FCS_SIZE;
fcc203c3 2077
1c2acffb 2078 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2079
2080 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2081 msg->msg_flags & MSG_DONTWAIT);
2082 if (IS_ERR(skb))
2083 return skb;
1c2acffb
GP		 2084
2085 /* Create L2CAP header */
2086 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2087 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2088 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2089
18a48e76
MM		 2090 /* Control header is populated later */
2091 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2092 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2093 else
2094 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2095
c74e560c 2096 if (sdulen)
03a51213 2097 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2098
0952a57a 2099 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2100 if (unlikely(err < 0)) {
2101 kfree_skb(skb);
2102 return ERR_PTR(err);
2103 }
e90bac06 2104
18a48e76 2105 bt_cb(skb)->control.fcs = chan->fcs;
3ce3514f 2106 bt_cb(skb)->control.retries = 0;
1c2acffb 2107 return skb;
1da177e4
LT		 2108}
2109
94122bbe
MM		 2110static int l2cap_segment_sdu(struct l2cap_chan *chan,
2111 struct sk_buff_head *seg_queue,
2112 struct msghdr *msg, size_t len)
c74e560c 2113{
c74e560c 2114 struct sk_buff *skb;
94122bbe
MM		 2115 u16 sdu_len;
2116 size_t pdu_len;
2117 int err = 0;
2118 u8 sar;
c74e560c 2119
94122bbe 2120 BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
c74e560c 2121
94122bbe
MM		 2122 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2123 * so fragmented skbs are not used. The HCI layer's handling
2124 * of fragmented skbs is not compatible with ERTM's queueing.
2125 */
c74e560c 2126
94122bbe
MM		 2127 /* PDU size is derived from the HCI MTU */
2128 pdu_len = chan->conn->mtu;
c74e560c 2129
94122bbe
MM		 2130 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2131
2132 /* Adjust for largest possible L2CAP overhead. */
2133 pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
2134
2135 /* Remote device may have requested smaller PDUs */
2136 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2137
2138 if (len <= pdu_len) {
2139 sar = L2CAP_SAR_UNSEGMENTED;
2140 sdu_len = 0;
2141 pdu_len = len;
2142 } else {
2143 sar = L2CAP_SAR_START;
2144 sdu_len = len;
2145 pdu_len -= L2CAP_SDULEN_SIZE;
2146 }
2147
2148 while (len > 0) {
2149 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2150
c74e560c 2151 if (IS_ERR(skb)) {
94122bbe 2152 __skb_queue_purge(seg_queue);
c74e560c
GP		 2153 return PTR_ERR(skb);
2154 }
2155
94122bbe
MM		 2156 bt_cb(skb)->control.sar = sar;
2157 __skb_queue_tail(seg_queue, skb);
2158
2159 len -= pdu_len;
2160 if (sdu_len) {
2161 sdu_len = 0;
2162 pdu_len += L2CAP_SDULEN_SIZE;
2163 }
2164
2165 if (len <= pdu_len) {
2166 sar = L2CAP_SAR_END;
2167 pdu_len = len;
2168 } else {
2169 sar = L2CAP_SAR_CONTINUE;
2170 }
c74e560c 2171 }
c74e560c 2172
94122bbe 2173 return err;
c74e560c
GP		 2174}
2175
5e59b791
LAD		 2176int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2177 u32 priority)
9a91a04a 2178{
9a91a04a 2179 struct sk_buff *skb;
9a91a04a 2180 int err;
94122bbe 2181 struct sk_buff_head seg_queue;
9a91a04a
GP		 2182
2183 /* Connectionless channel */
715ec005 2184 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2185 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2186 if (IS_ERR(skb))
2187 return PTR_ERR(skb);
2188
2189 l2cap_do_send(chan, skb);
2190 return len;
2191 }
2192
2193 switch (chan->mode) {
2194 case L2CAP_MODE_BASIC:
2195 /* Check outgoing MTU */
2196 if (len > chan->omtu)
2197 return -EMSGSIZE;
2198
2199 /* Create a basic PDU */
5e59b791 2200 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2201 if (IS_ERR(skb))
2202 return PTR_ERR(skb);
2203
2204 l2cap_do_send(chan, skb);
2205 err = len;
2206 break;
2207
2208 case L2CAP_MODE_ERTM:
2209 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2210 /* Check outgoing MTU */
2211 if (len > chan->omtu) {
2212 err = -EMSGSIZE;
2213 break;
2214 }
9a91a04a 2215
94122bbe 2216 __skb_queue_head_init(&seg_queue);
9a91a04a 2217
94122bbe
MM		 2218 /* Do segmentation before calling in to the state machine,
2219 * since it's possible to block while waiting for memory
2220 * allocation.
2221 */
2222 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2223
94122bbe
MM		 2224 /* The channel could have been closed while segmenting,
2225 * check that it is still connected.
2226 */
2227 if (chan->state != BT_CONNECTED) {
2228 __skb_queue_purge(&seg_queue);
2229 err = -ENOTCONN;
9a91a04a
GP		 2230 }
2231
94122bbe 2232 if (err)
9a91a04a 2233 break;
9a91a04a 2234
3733937d 2235 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2236 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2237 else
d660366d 2238 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2239
d660366d 2240 err = len;
9a91a04a 2241
94122bbe
MM		 2242 /* If the skbs were not queued for sending, they'll still be in
2243 * seg_queue and need to be purged.
2244 */
2245 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2246 break;
2247
2248 default:
2249 BT_DBG("bad state %1.1x", chan->mode);
2250 err = -EBADFD;
2251 }
2252
2253 return err;
2254}
2255
d2a7ac5d
MM		 2256static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2257{
bed68bde
MM		 2258 struct l2cap_ctrl control;
2259 u16 seq;
2260
2261 BT_DBG("chan %p, txseq %d", chan, txseq);
2262
2263 memset(&control, 0, sizeof(control));
2264 control.sframe = 1;
2265 control.super = L2CAP_SUPER_SREJ;
2266
2267 for (seq = chan->expected_tx_seq; seq != txseq;
2268 seq = __next_seq(chan, seq)) {
2269 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2270 control.reqseq = seq;
2271 l2cap_send_sframe(chan, &control);
2272 l2cap_seq_list_append(&chan->srej_list, seq);
2273 }
2274 }
2275
2276 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2277}
2278
2279static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2280{
bed68bde
MM		 2281 struct l2cap_ctrl control;
2282
2283 BT_DBG("chan %p", chan);
2284
2285 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2286 return;
2287
2288 memset(&control, 0, sizeof(control));
2289 control.sframe = 1;
2290 control.super = L2CAP_SUPER_SREJ;
2291 control.reqseq = chan->srej_list.tail;
2292 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2293}
2294
2295static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2296{
bed68bde
MM		 2297 struct l2cap_ctrl control;
2298 u16 initial_head;
2299 u16 seq;
2300
2301 BT_DBG("chan %p, txseq %d", chan, txseq);
2302
2303 memset(&control, 0, sizeof(control));
2304 control.sframe = 1;
2305 control.super = L2CAP_SUPER_SREJ;
2306
2307 /* Capture initial list head to allow only one pass through the list. */
2308 initial_head = chan->srej_list.head;
2309
2310 do {
2311 seq = l2cap_seq_list_pop(&chan->srej_list);
2312 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2313 break;
2314
2315 control.reqseq = seq;
2316 l2cap_send_sframe(chan, &control);
2317 l2cap_seq_list_append(&chan->srej_list, seq);
2318 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2319}
2320
608bcc6d
MM		 2321static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2322{
2323 struct sk_buff *acked_skb;
2324 u16 ackseq;
2325
2326 BT_DBG("chan %p, reqseq %d", chan, reqseq);
2327
2328 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2329 return;
2330
2331 BT_DBG("expected_ack_seq %d, unacked_frames %d",
2332 chan->expected_ack_seq, chan->unacked_frames);
2333
2334 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2335 ackseq = __next_seq(chan, ackseq)) {
2336
2337 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2338 if (acked_skb) {
2339 skb_unlink(acked_skb, &chan->tx_q);
2340 kfree_skb(acked_skb);
2341 chan->unacked_frames--;
2342 }
2343 }
2344
2345 chan->expected_ack_seq = reqseq;
2346
2347 if (chan->unacked_frames == 0)
2348 __clear_retrans_timer(chan);
2349
2350 BT_DBG("unacked_frames %d", (int) chan->unacked_frames);
2351}
2352
2353static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2354{
2355 BT_DBG("chan %p", chan);
2356
2357 chan->expected_tx_seq = chan->buffer_seq;
2358 l2cap_seq_list_clear(&chan->srej_list);
2359 skb_queue_purge(&chan->srej_q);
2360 chan->rx_state = L2CAP_RX_STATE_RECV;
2361}
2362
d660366d
GP		 2363static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2364 struct l2cap_ctrl *control,
2365 struct sk_buff_head *skbs, u8 event)
608bcc6d 2366{
608bcc6d
MM		 2367 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2368 event);
2369
2370 switch (event) {
2371 case L2CAP_EV_DATA_REQUEST:
2372 if (chan->tx_send_head == NULL)
2373 chan->tx_send_head = skb_peek(skbs);
2374
2375 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2376 l2cap_ertm_send(chan);
2377 break;
2378 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2379 BT_DBG("Enter LOCAL_BUSY");
2380 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2381
2382 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2383 /* The SREJ_SENT state must be aborted if we are to
2384 * enter the LOCAL_BUSY state.
2385 */
2386 l2cap_abort_rx_srej_sent(chan);
2387 }
2388
2389 l2cap_send_ack(chan);
2390
2391 break;
2392 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2393 BT_DBG("Exit LOCAL_BUSY");
2394 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2395
2396 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2397 struct l2cap_ctrl local_control;
2398
2399 memset(&local_control, 0, sizeof(local_control));
2400 local_control.sframe = 1;
2401 local_control.super = L2CAP_SUPER_RR;
2402 local_control.poll = 1;
2403 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2404 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2405
2406 chan->retry_count = 1;
2407 __set_monitor_timer(chan);
2408 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2409 }
2410 break;
2411 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2412 l2cap_process_reqseq(chan, control->reqseq);
2413 break;
2414 case L2CAP_EV_EXPLICIT_POLL:
2415 l2cap_send_rr_or_rnr(chan, 1);
2416 chan->retry_count = 1;
2417 __set_monitor_timer(chan);
2418 __clear_ack_timer(chan);
2419 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2420 break;
2421 case L2CAP_EV_RETRANS_TO:
2422 l2cap_send_rr_or_rnr(chan, 1);
2423 chan->retry_count = 1;
2424 __set_monitor_timer(chan);
2425 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2426 break;
2427 case L2CAP_EV_RECV_FBIT:
2428 /* Nothing to process */
2429 break;
2430 default:
2431 break;
2432 }
608bcc6d
MM		 2433}
2434
d660366d
GP		 2435static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2436 struct l2cap_ctrl *control,
2437 struct sk_buff_head *skbs, u8 event)
608bcc6d 2438{
608bcc6d
MM		 2439 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2440 event);
2441
2442 switch (event) {
2443 case L2CAP_EV_DATA_REQUEST:
2444 if (chan->tx_send_head == NULL)
2445 chan->tx_send_head = skb_peek(skbs);
2446 /* Queue data, but don't send. */
2447 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2448 break;
2449 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2450 BT_DBG("Enter LOCAL_BUSY");
2451 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2452
2453 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2454 /* The SREJ_SENT state must be aborted if we are to
2455 * enter the LOCAL_BUSY state.
2456 */
2457 l2cap_abort_rx_srej_sent(chan);
2458 }
2459
2460 l2cap_send_ack(chan);
2461
2462 break;
2463 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2464 BT_DBG("Exit LOCAL_BUSY");
2465 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2466
2467 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2468 struct l2cap_ctrl local_control;
2469 memset(&local_control, 0, sizeof(local_control));
2470 local_control.sframe = 1;
2471 local_control.super = L2CAP_SUPER_RR;
2472 local_control.poll = 1;
2473 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2474 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2475
2476 chan->retry_count = 1;
2477 __set_monitor_timer(chan);
2478 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2479 }
2480 break;
2481 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2482 l2cap_process_reqseq(chan, control->reqseq);
2483
2484 /* Fall through */
2485
2486 case L2CAP_EV_RECV_FBIT:
2487 if (control && control->final) {
2488 __clear_monitor_timer(chan);
2489 if (chan->unacked_frames > 0)
2490 __set_retrans_timer(chan);
2491 chan->retry_count = 0;
2492 chan->tx_state = L2CAP_TX_STATE_XMIT;
2493 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2494 }
2495 break;
2496 case L2CAP_EV_EXPLICIT_POLL:
2497 /* Ignore */
2498 break;
2499 case L2CAP_EV_MONITOR_TO:
2500 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2501 l2cap_send_rr_or_rnr(chan, 1);
2502 __set_monitor_timer(chan);
2503 chan->retry_count++;
2504 } else {
2505 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
2506 }
2507 break;
2508 default:
2509 break;
2510 }
608bcc6d
MM		 2511}
2512
d660366d
GP		 2513static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2514 struct sk_buff_head *skbs, u8 event)
608bcc6d 2515{
608bcc6d
MM		 2516 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2517 chan, control, skbs, event, chan->tx_state);
2518
2519 switch (chan->tx_state) {
2520 case L2CAP_TX_STATE_XMIT:
d660366d 2521 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2522 break;
2523 case L2CAP_TX_STATE_WAIT_F:
d660366d 2524 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2525 break;
2526 default:
2527 /* Ignore event */
2528 break;
2529 }
608bcc6d
MM		 2530}
2531
4b51dae9
MM		 2532static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2533 struct l2cap_ctrl *control)
2534{
2535 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2536 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2537}
2538
f80842a8
MM		 2539static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2540 struct l2cap_ctrl *control)
2541{
2542 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2543 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2544}
2545
1da177e4
LT		 2546/* Copy frame to all raw sockets on that connection */
2547static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2548{
1da177e4 2549 struct sk_buff *nskb;
48454079 2550 struct l2cap_chan *chan;
1da177e4
LT		 2551
2552 BT_DBG("conn %p", conn);
2553
3df91ea2 2554 mutex_lock(&conn->chan_lock);
3d57dc68 2555
3df91ea2 2556 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2557 struct sock *sk = chan->sk;
715ec005 2558 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2559 continue;
2560
2561 /* Don't send frame to the socket it came from */
2562 if (skb->sk == sk)
2563 continue;
af05b30b
GP		 2564 nskb = skb_clone(skb, GFP_ATOMIC);
2565 if (!nskb)
1da177e4
LT		 2566 continue;
2567
23070494 2568 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 2569 kfree_skb(nskb);
2570 }
3d57dc68 2571
3df91ea2 2572 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2573}
2574
2575/* ---- L2CAP signalling commands ---- */
2576static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2577 u8 code, u8 ident, u16 dlen, void *data)
2578{
2579 struct sk_buff *skb, **frag;
2580 struct l2cap_cmd_hdr *cmd;
2581 struct l2cap_hdr *lh;
2582 int len, count;
2583
af05b30b
GP		 2584 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2585 conn, code, ident, dlen);
1da177e4
LT		 2586
2587 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2588 count = min_t(unsigned int, conn->mtu, len);
2589
2590 skb = bt_skb_alloc(count, GFP_ATOMIC);
2591 if (!skb)
2592 return NULL;
2593
2594 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2595 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2596
2597 if (conn->hcon->type == LE_LINK)
2598 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2599 else
2600 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2601
2602 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2603 cmd->code = code;
2604 cmd->ident = ident;
aca3192c 2605 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2606
2607 if (dlen) {
2608 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2609 memcpy(skb_put(skb, count), data, count);
2610 data += count;
2611 }
2612
2613 len -= skb->len;
2614
2615 /* Continuation fragments (no L2CAP header) */
2616 frag = &skb_shinfo(skb)->frag_list;
2617 while (len) {
2618 count = min_t(unsigned int, conn->mtu, len);
2619
2620 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2621 if (!*frag)
2622 goto fail;
2623
2624 memcpy(skb_put(*frag, count), data, count);
2625
2626 len -= count;
2627 data += count;
2628
2629 frag = &(*frag)->next;
2630 }
2631
2632 return skb;
2633
2634fail:
2635 kfree_skb(skb);
2636 return NULL;
2637}
2638
2639static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2640{
2641 struct l2cap_conf_opt *opt = *ptr;
2642 int len;
2643
2644 len = L2CAP_CONF_OPT_SIZE + opt->len;
2645 *ptr += len;
2646
2647 *type = opt->type;
2648 *olen = opt->len;
2649
2650 switch (opt->len) {
2651 case 1:
2652 *val = *((u8 *) opt->val);
2653 break;
2654
2655 case 2:
bfaaeb3e 2656 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2657 break;
2658
2659 case 4:
bfaaeb3e 2660 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2661 break;
2662
2663 default:
2664 *val = (unsigned long) opt->val;
2665 break;
2666 }
2667
2668 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2669 return len;
2670}
2671
1da177e4
LT		 2672static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2673{
2674 struct l2cap_conf_opt *opt = *ptr;
2675
2676 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2677
2678 opt->type = type;
2679 opt->len = len;
2680
2681 switch (len) {
2682 case 1:
2683 *((u8 *) opt->val) = val;
2684 break;
2685
2686 case 2:
4f8b691c 2687 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2688 break;
2689
2690 case 4:
4f8b691c 2691 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2692 break;
2693
2694 default:
2695 memcpy(opt->val, (void *) val, len);
2696 break;
2697 }
2698
2699 *ptr += L2CAP_CONF_OPT_SIZE + len;
2700}
2701
f89cef09
AE		 2702static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2703{
2704 struct l2cap_conf_efs efs;
2705
1ec918ce 2706 switch (chan->mode) {
f89cef09
AE		 2707 case L2CAP_MODE_ERTM:
2708 efs.id = chan->local_id;
2709 efs.stype = chan->local_stype;
2710 efs.msdu = cpu_to_le16(chan->local_msdu);
2711 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2712 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2713 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2714 break;
2715
2716 case L2CAP_MODE_STREAMING:
2717 efs.id = 1;
2718 efs.stype = L2CAP_SERV_BESTEFFORT;
2719 efs.msdu = cpu_to_le16(chan->local_msdu);
2720 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2721 efs.acc_lat = 0;
2722 efs.flush_to = 0;
2723 break;
2724
2725 default:
2726 return;
2727 }
2728
2729 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2730 (unsigned long) &efs);
2731}
2732
721c4181 2733static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2734{
721c4181 2735 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 2736 ack_timer.work);
2737 u16 frames_to_ack;
c1b4f43b 2738
2fb9b3d4
GP		 2739 BT_DBG("chan %p", chan);
2740
6be36555
AE		 2741 l2cap_chan_lock(chan);
2742
0362520b
MM		 2743 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2744 chan->last_acked_seq);
6be36555 2745
0362520b
MM		 2746 if (frames_to_ack)
2747 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 2748
0362520b 2749 l2cap_chan_unlock(chan);
09bfb2ee 2750 l2cap_chan_put(chan);
c1b4f43b
GP		 2751}
2752
3c588192 2753static inline int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2754{
3c588192
MM		 2755 int err;
2756
105bdf9e
MM		 2757 chan->next_tx_seq = 0;
2758 chan->expected_tx_seq = 0;
42e5c802 2759 chan->expected_ack_seq = 0;
6a026610 2760 chan->unacked_frames = 0;
42e5c802 2761 chan->buffer_seq = 0;
6a026610 2762 chan->frames_sent = 0;
105bdf9e
MM		 2763 chan->last_acked_seq = 0;
2764 chan->sdu = NULL;
2765 chan->sdu_last_frag = NULL;
2766 chan->sdu_len = 0;
2767
d34c34fb
MM		 2768 skb_queue_head_init(&chan->tx_q);
2769
105bdf9e
MM		 2770 if (chan->mode != L2CAP_MODE_ERTM)
2771 return 0;
2772
2773 chan->rx_state = L2CAP_RX_STATE_RECV;
2774 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2775
721c4181
GP		 2776 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2777 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2778 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2779
f1c6775b 2780 skb_queue_head_init(&chan->srej_q);
1890d36b 2781
3c588192
MM		 2782 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2783 if (err < 0)
2784 return err;
2785
9dc9affc
MM		 2786 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
2787 if (err < 0)
2788 l2cap_seq_list_free(&chan->srej_list);
2789
2790 return err;
0565c1c2
GP		 2791}
2792
f2fcfcd6
GP		 2793static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2794{
2795 switch (mode) {
2796 case L2CAP_MODE_STREAMING:
2797 case L2CAP_MODE_ERTM:
2798 if (l2cap_mode_supported(mode, remote_feat_mask))
2799 return mode;
2800 /* fall through */
2801 default:
2802 return L2CAP_MODE_BASIC;
2803 }
2804}
2805
6327eb98
AE		 2806static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2807{
2808 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2809}
2810
f89cef09
AE		 2811static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2812{
2813 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2814}
2815
6327eb98
AE		 2816static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2817{
2818 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2819 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2820 /* use extended control field */
2821 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2822 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2823 } else {
6327eb98
AE		 2824 chan->tx_win = min_t(u16, chan->tx_win,
2825 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2826 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2827 }
6327eb98
AE		 2828}
2829
710f9b0a 2830static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2831{
1da177e4 2832 struct l2cap_conf_req *req = data;
0c1bc5c6 2833 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2834 void *ptr = req->data;
c8f79162 2835 u16 size;
1da177e4 2836
49208c9c 2837 BT_DBG("chan %p", chan);
1da177e4 2838
73ffa904 2839 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2840 goto done;
2841
0c1bc5c6 2842 switch (chan->mode) {
f2fcfcd6
GP		 2843 case L2CAP_MODE_STREAMING:
2844 case L2CAP_MODE_ERTM:
c1360a1c 2845 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2846 break;
85eb53c6 2847
f89cef09
AE		 2848 if (__l2cap_efs_supported(chan))
2849 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2850
2ba13ed6 2851 /* fall through */
f2fcfcd6 2852 default:
8c1d787b 2853 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2854 break;
2855 }
2856
2857done:
0c1bc5c6
GP		 2858 if (chan->imtu != L2CAP_DEFAULT_MTU)
2859 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2860
0c1bc5c6 2861 switch (chan->mode) {
65c7c491 2862 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2863 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2864 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2865 break;
2866
62547752
GP		 2867 rfc.mode = L2CAP_MODE_BASIC;
2868 rfc.txwin_size = 0;
2869 rfc.max_transmit = 0;
2870 rfc.retrans_timeout = 0;
2871 rfc.monitor_timeout = 0;
2872 rfc.max_pdu_size = 0;
2873
63406504
GP		 2874 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2875 (unsigned long) &rfc);
65c7c491
MH		 2876 break;
2877
2878 case L2CAP_MODE_ERTM:
2879 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2880 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2881 rfc.retrans_timeout = 0;
2882 rfc.monitor_timeout = 0;
c8f79162
AE		 2883
2884 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2885 L2CAP_EXT_HDR_SIZE -
2886 L2CAP_SDULEN_SIZE -
2887 L2CAP_FCS_SIZE);
2888 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2889
6327eb98
AE		 2890 l2cap_txwin_setup(chan);
2891
2892 rfc.txwin_size = min_t(u16, chan->tx_win,
2893 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2894
63406504
GP		 2895 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2896 (unsigned long) &rfc);
2897
f89cef09
AE		 2898 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2899 l2cap_add_opt_efs(&ptr, chan);
2900
8c1d787b 2901 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2902 break;
2903
47d1ec61 2904 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2905 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2906 chan->fcs = L2CAP_FCS_NONE;
2907 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2908 }
6327eb98
AE		 2909
2910 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2911 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2912 chan->tx_win);
f2fcfcd6
GP		 2913 break;
2914
2915 case L2CAP_MODE_STREAMING:
273759e2 2916 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 2917 rfc.mode = L2CAP_MODE_STREAMING;
2918 rfc.txwin_size = 0;
2919 rfc.max_transmit = 0;
2920 rfc.retrans_timeout = 0;
2921 rfc.monitor_timeout = 0;
c8f79162
AE		 2922
2923 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2924 L2CAP_EXT_HDR_SIZE -
2925 L2CAP_SDULEN_SIZE -
2926 L2CAP_FCS_SIZE);
2927 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2928
63406504
GP		 2929 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2930 (unsigned long) &rfc);
2931
f89cef09
AE		 2932 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2933 l2cap_add_opt_efs(&ptr, chan);
2934
8c1d787b 2935 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2936 break;
2937
47d1ec61 2938 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2939 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2940 chan->fcs = L2CAP_FCS_NONE;
2941 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2942 }
65c7c491
MH		 2943 break;
2944 }
1da177e4 2945
fe4128e0 2946 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 2947 req->flags = __constant_cpu_to_le16(0);
1da177e4
LT		 2948
2949 return ptr - data;
2950}
2951
73ffa904 2952static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2953{
5dee9e7c
MH		 2954 struct l2cap_conf_rsp *rsp = data;
2955 void *ptr = rsp->data;
73ffa904
GP		 2956 void *req = chan->conf_req;
2957 int len = chan->conf_len;
5dee9e7c
MH		 2958 int type, hint, olen;
2959 unsigned long val;
6464f35f 2960 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2961 struct l2cap_conf_efs efs;
2962 u8 remote_efs = 0;
861d6882 2963 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2964 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2965 u16 size;
1da177e4 2966
73ffa904 2967 BT_DBG("chan %p", chan);
820ae1b8 2968
5dee9e7c
MH		 2969 while (len >= L2CAP_CONF_OPT_SIZE) {
2970 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2971
589d2746 2972 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2973 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2974
2975 switch (type) {
2976 case L2CAP_CONF_MTU:
861d6882 2977 mtu = val;
5dee9e7c
MH		 2978 break;
2979
2980 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2981 chan->flush_to = val;
5dee9e7c
MH		 2982 break;
2983
2984 case L2CAP_CONF_QOS:
2985 break;
2986
6464f35f
MH		 2987 case L2CAP_CONF_RFC:
2988 if (olen == sizeof(rfc))
2989 memcpy(&rfc, (void *) val, olen);
2990 break;
2991
fcc203c3
GP		 2992 case L2CAP_CONF_FCS:
2993 if (val == L2CAP_FCS_NONE)
c1360a1c 2994 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2995 break;
fcc203c3 2996
42dceae2
AE		 2997 case L2CAP_CONF_EFS:
2998 remote_efs = 1;
2999 if (olen == sizeof(efs))
3000 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3001 break;
3002
6327eb98
AE		 3003 case L2CAP_CONF_EWS:
3004 if (!enable_hs)
3005 return -ECONNREFUSED;
fcc203c3 3006
6327eb98
AE		 3007 set_bit(FLAG_EXT_CTRL, &chan->flags);
3008 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3009 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3010 chan->remote_tx_win = val;
fcc203c3
GP		 3011 break;
3012
5dee9e7c
MH		 3013 default:
3014 if (hint)
3015 break;
3016
3017 result = L2CAP_CONF_UNKNOWN;
3018 *((u8 *) ptr++) = type;
3019 break;
3020 }
3021 }
3022
73ffa904 3023 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3024 goto done;
3025
0c1bc5c6 3026 switch (chan->mode) {
f2fcfcd6
GP		 3027 case L2CAP_MODE_STREAMING:
3028 case L2CAP_MODE_ERTM:
c1360a1c 3029 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3030 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 3031 chan->conn->feat_mask);
85eb53c6
GP		 3032 break;
3033 }
3034
42dceae2
AE		 3035 if (remote_efs) {
3036 if (__l2cap_efs_supported(chan))
3037 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3038 else
3039 return -ECONNREFUSED;
3040 }
3041
0c1bc5c6 3042 if (chan->mode != rfc.mode)
f2fcfcd6 3043 return -ECONNREFUSED;
742e519b 3044
f2fcfcd6 3045 break;
f2fcfcd6
GP		 3046 }
3047
3048done:
0c1bc5c6 3049 if (chan->mode != rfc.mode) {
f2fcfcd6 3050 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3051 rfc.mode = chan->mode;
f2fcfcd6 3052
73ffa904 3053 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3054 return -ECONNREFUSED;
3055
3056 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3057 sizeof(rfc), (unsigned long) &rfc);
3058 }
3059
5dee9e7c
MH		 3060 if (result == L2CAP_CONF_SUCCESS) {
3061 /* Configure output options and let the other side know
3062 * which ones we don't like. */
3063
f2fcfcd6
GP		 3064 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3065 result = L2CAP_CONF_UNACCEPT;
3066 else {
0c1bc5c6 3067 chan->omtu = mtu;
c1360a1c 3068 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3069 }
0c1bc5c6 3070 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 3071
42dceae2
AE		 3072 if (remote_efs) {
3073 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3074 efs.stype != L2CAP_SERV_NOTRAFIC &&
3075 efs.stype != chan->local_stype) {
3076
3077 result = L2CAP_CONF_UNACCEPT;
3078
3079 if (chan->num_conf_req >= 1)
3080 return -ECONNREFUSED;
3081
3082 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 3083 sizeof(efs),
42dceae2 3084 (unsigned long) &efs);
0e8b207e 3085 } else {
3e6b3b95 3086 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3087 result = L2CAP_CONF_PENDING;
3088 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3089 }
3090 }
3091
f2fcfcd6
GP		 3092 switch (rfc.mode) {
3093 case L2CAP_MODE_BASIC:
47d1ec61 3094 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3095 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3096 break;
3097
3098 case L2CAP_MODE_ERTM:
6327eb98
AE		 3099 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3100 chan->remote_tx_win = rfc.txwin_size;
3101 else
3102 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3103
2c03a7a4 3104 chan->remote_max_tx = rfc.max_transmit;
1c762159 3105
c8f79162
AE		 3106 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3107 chan->conn->mtu -
3108 L2CAP_EXT_HDR_SIZE -
3109 L2CAP_SDULEN_SIZE -
3110 L2CAP_FCS_SIZE);
3111 rfc.max_pdu_size = cpu_to_le16(size);
3112 chan->remote_mps = size;
f2fcfcd6 3113
10467e9e 3114 rfc.retrans_timeout =
4fd21a88 3115 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 3116 rfc.monitor_timeout =
4fd21a88 3117 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 3118
c1360a1c 3119 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3120
3121 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3122 sizeof(rfc), (unsigned long) &rfc);
3123
42dceae2
AE		 3124 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3125 chan->remote_id = efs.id;
3126 chan->remote_stype = efs.stype;
3127 chan->remote_msdu = le16_to_cpu(efs.msdu);
3128 chan->remote_flush_to =
3129 le32_to_cpu(efs.flush_to);
3130 chan->remote_acc_lat =
3131 le32_to_cpu(efs.acc_lat);
3132 chan->remote_sdu_itime =
3133 le32_to_cpu(efs.sdu_itime);
3134 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3135 sizeof(efs), (unsigned long) &efs);
3136 }
f2fcfcd6
GP		 3137 break;
3138
3139 case L2CAP_MODE_STREAMING:
c8f79162
AE		 3140 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
3141 chan->conn->mtu -
3142 L2CAP_EXT_HDR_SIZE -
3143 L2CAP_SDULEN_SIZE -
3144 L2CAP_FCS_SIZE);
3145 rfc.max_pdu_size = cpu_to_le16(size);
3146 chan->remote_mps = size;
f2fcfcd6 3147
c1360a1c 3148 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3149
3150 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3151 sizeof(rfc), (unsigned long) &rfc);
3152
f2fcfcd6
GP		 3153 break;
3154
3155 default:
5dee9e7c 3156 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3157
6464f35f 3158 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3159 rfc.mode = chan->mode;
f2fcfcd6 3160 }
6464f35f 3161
f2fcfcd6 3162 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3163 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3164 }
fe4128e0 3165 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3166 rsp->result = cpu_to_le16(result);
59e54bd1 3167 rsp->flags = __constant_cpu_to_le16(0);
5dee9e7c
MH		 3168
3169 return ptr - data;
1da177e4
LT		 3170}
3171
b4450035 3172static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 3173{
f2fcfcd6
GP		 3174 struct l2cap_conf_req *req = data;
3175 void *ptr = req->data;
3176 int type, olen;
3177 unsigned long val;
36e999a8 3178 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3179 struct l2cap_conf_efs efs;
f2fcfcd6 3180
fe4128e0 3181 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3182
3183 while (len >= L2CAP_CONF_OPT_SIZE) {
3184 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3185
3186 switch (type) {
3187 case L2CAP_CONF_MTU:
3188 if (val < L2CAP_DEFAULT_MIN_MTU) {
3189 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3190 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3191 } else
0c1bc5c6
GP		 3192 chan->imtu = val;
3193 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 3194 break;
3195
3196 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3197 chan->flush_to = val;
f2fcfcd6 3198 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 3199 2, chan->flush_to);
f2fcfcd6
GP		 3200 break;
3201
3202 case L2CAP_CONF_RFC:
3203 if (olen == sizeof(rfc))
3204 memcpy(&rfc, (void *)val, olen);
3205
c1360a1c 3206 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 3207 rfc.mode != chan->mode)
f2fcfcd6
GP		 3208 return -ECONNREFUSED;
3209
47d1ec61 3210 chan->fcs = 0;
f2fcfcd6
GP		 3211
3212 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
3213 sizeof(rfc), (unsigned long) &rfc);
3214 break;
6327eb98
AE		 3215
3216 case L2CAP_CONF_EWS:
3217 chan->tx_win = min_t(u16, val,
3218 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 3219 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
3220 chan->tx_win);
6327eb98 3221 break;
66af7aaf
AE		 3222
3223 case L2CAP_CONF_EFS:
3224 if (olen == sizeof(efs))
3225 memcpy(&efs, (void *)val, olen);
3226
3227 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
3228 efs.stype != L2CAP_SERV_NOTRAFIC &&
3229 efs.stype != chan->local_stype)
3230 return -ECONNREFUSED;
3231
3232 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3233 sizeof(efs), (unsigned long) &efs);
3234 break;
f2fcfcd6
GP		 3235 }
3236 }
3237
0c1bc5c6 3238 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3239 return -ECONNREFUSED;
3240
0c1bc5c6 3241 chan->mode = rfc.mode;
6c2ea7a8 3242
0e8b207e 3243 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3244 switch (rfc.mode) {
3245 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3246 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3247 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3248 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 3249
3250 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3251 chan->local_msdu = le16_to_cpu(efs.msdu);
3252 chan->local_sdu_itime =
3253 le32_to_cpu(efs.sdu_itime);
3254 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3255 chan->local_flush_to =
3256 le32_to_cpu(efs.flush_to);
3257 }
f2fcfcd6 3258 break;
66af7aaf 3259
f2fcfcd6 3260 case L2CAP_MODE_STREAMING:
47d1ec61 3261 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3262 }
3263 }
3264
fe4128e0 3265 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 3266 req->flags = __constant_cpu_to_le16(0);
f2fcfcd6
GP		 3267
3268 return ptr - data;
3269}
3270
fe4128e0 3271static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 3272{
3273 struct l2cap_conf_rsp *rsp = data;
3274 void *ptr = rsp->data;
1da177e4 3275
fe4128e0 3276 BT_DBG("chan %p", chan);
1da177e4 3277
fe4128e0 3278 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3279 rsp->result = cpu_to_le16(result);
aca3192c 3280 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3281
3282 return ptr - data;
3283}
3284
8c1d787b 3285void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3286{
3287 struct l2cap_conn_rsp rsp;
8c1d787b 3288 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 3289 u8 buf[128];
3290
fe4128e0
GP		 3291 rsp.scid = cpu_to_le16(chan->dcid);
3292 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 3293 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
3294 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
3295 l2cap_send_cmd(conn, chan->ident,
3296 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
3297
c1360a1c 3298 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3299 return;
3300
710f9b0a
GP		 3301 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3302 l2cap_build_conf_req(chan, buf), buf);
3303 chan->num_conf_req++;
3304}
3305
47d1ec61 3306static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3307{
7b1c0049
GP		 3308 int type, olen;
3309 unsigned long val;
3310 struct l2cap_conf_rfc rfc;
3311
47d1ec61 3312 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3313
0c1bc5c6 3314 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3315 return;
3316
3317 while (len >= L2CAP_CONF_OPT_SIZE) {
3318 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3319
3320 switch (type) {
3321 case L2CAP_CONF_RFC:
3322 if (olen == sizeof(rfc))
3323 memcpy(&rfc, (void *)val, olen);
3324 goto done;
3325 }
3326 }
3327
36e999a8
MM		 3328 /* Use sane default values in case a misbehaving remote device
3329 * did not send an RFC option.
3330 */
3331 rfc.mode = chan->mode;
3332 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3333 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3334 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
3335
3336 BT_ERR("Expected RFC option was not found, using defaults");
3337
7b1c0049
GP		 3338done:
3339 switch (rfc.mode) {
3340 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3341 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3342 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3343 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3344 break;
3345 case L2CAP_MODE_STREAMING:
47d1ec61 3346 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3347 }
3348}
3349
4e8402a3
MH		 3350static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3351{
e2fd318e 3352 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3353
e2fd318e 3354 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3355 return 0;
3356
3357 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
3358 cmd->ident == conn->info_ident) {
17cd3f37 3359 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3360
3361 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3362 conn->info_ident = 0;
984947dc 3363
4e8402a3
MH		 3364 l2cap_conn_start(conn);
3365 }
3366
3367 return 0;
3368}
3369
1da177e4
LT		 3370static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3371{
1da177e4
LT		 3372 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3373 struct l2cap_conn_rsp rsp;
23691d75 3374 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 3375 struct sock *parent, *sk = NULL;
e7c29cb1 3376 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3377
3378 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3379 __le16 psm = req->psm;
1da177e4 3380
097db76c 3381 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3382
3383 /* Check if we have socket listening on psm */
c2287681 3384 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 3385 if (!pchan) {
1da177e4
LT		 3386 result = L2CAP_CR_BAD_PSM;
3387 goto sendresp;
3388 }
3389
23691d75
GP		 3390 parent = pchan->sk;
3391
3df91ea2 3392 mutex_lock(&conn->chan_lock);
aa2ac881 3393 lock_sock(parent);
e0f0cb56 3394
e7c29cb1
MH		 3395 /* Check if the ACL is secure enough (if not SDP) */
3396 if (psm != cpu_to_le16(0x0001) &&
3397 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3398 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3399 result = L2CAP_CR_SEC_BLOCK;
3400 goto response;
3401 }
3402
1da177e4
LT		 3403 result = L2CAP_CR_NO_MEM;
3404
3405 /* Check for backlog size */
3406 if (sk_acceptq_is_full(parent)) {
8e87d142 3407 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 3408 goto response;
3409 }
3410
80808e43
GP		 3411 chan = pchan->ops->new_connection(pchan->data);
3412 if (!chan)
1da177e4
LT		 3413 goto response;
3414
80808e43
GP		 3415 sk = chan->sk;
3416
1da177e4 3417 /* Check if we already have channel with that dcid */
baa7e1fa 3418 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 3419 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 3420 chan->ops->close(chan->data);
1da177e4
LT		 3421 goto response;
3422 }
3423
3424 hci_conn_hold(conn->hcon);
3425
1da177e4
LT		 3426 bacpy(&bt_sk(sk)->src, conn->src);
3427 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3428 chan->psm = psm;
3429 chan->dcid = scid;
1da177e4 3430
d1010240
GP		 3431 bt_accept_enqueue(parent, sk);
3432
6be36555 3433 __l2cap_chan_add(conn, chan);
48454079 3434
fe4128e0 3435 dcid = chan->scid;
1da177e4 3436
c9b66675 3437 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3438
fc7f8a7e 3439 chan->ident = cmd->ident;
1da177e4 3440
984947dc 3441 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3442 if (l2cap_chan_check_security(chan)) {
c5daa683 3443 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
0e587be7 3444 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3445 result = L2CAP_CR_PEND;
3446 status = L2CAP_CS_AUTHOR_PEND;
3447 parent->sk_data_ready(parent, 0);
3448 } else {
0e587be7 3449 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 3450 result = L2CAP_CR_SUCCESS;
3451 status = L2CAP_CS_NO_INFO;
3452 }
79d554a6 3453 } else {
0e587be7 3454 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3455 result = L2CAP_CR_PEND;
3456 status = L2CAP_CS_AUTHEN_PEND;
3457 }
3458 } else {
0e587be7 3459 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3460 result = L2CAP_CR_PEND;
3461 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3462 }
3463
1da177e4 3464response:
aa2ac881 3465 release_sock(parent);
3df91ea2 3466 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3467
3468sendresp:
aca3192c
YH		 3469 rsp.scid = cpu_to_le16(scid);
3470 rsp.dcid = cpu_to_le16(dcid);
3471 rsp.result = cpu_to_le16(result);
3472 rsp.status = cpu_to_le16(status);
1da177e4 3473 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 3474
3475 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3476 struct l2cap_info_req info;
3477 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3478
3479 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3480 conn->info_ident = l2cap_get_ident(conn);
3481
ba13ccd9 3482 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 3483
3484 l2cap_send_cmd(conn, conn->info_ident,
3485 L2CAP_INFO_REQ, sizeof(info), &info);
3486 }
3487
c1360a1c 3488 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 3489 result == L2CAP_CR_SUCCESS) {
3490 u8 buf[128];
c1360a1c 3491 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3492 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3493 l2cap_build_conf_req(chan, buf), buf);
3494 chan->num_conf_req++;
e9aeb2dd
GP		 3495 }
3496
1da177e4
LT		 3497 return 0;
3498}
3499
3500static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3501{
3502 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3503 u16 scid, dcid, result, status;
48454079 3504 struct l2cap_chan *chan;
1da177e4 3505 u8 req[128];
3df91ea2 3506 int err;
1da177e4
LT		 3507
3508 scid = __le16_to_cpu(rsp->scid);
3509 dcid = __le16_to_cpu(rsp->dcid);
3510 result = __le16_to_cpu(rsp->result);
3511 status = __le16_to_cpu(rsp->status);
3512
1b009c98
AE		 3513 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3514 dcid, scid, result, status);
1da177e4 3515
3df91ea2
AE		 3516 mutex_lock(&conn->chan_lock);
3517
1da177e4 3518 if (scid) {
3df91ea2
AE		 3519 chan = __l2cap_get_chan_by_scid(conn, scid);
3520 if (!chan) {
3521 err = -EFAULT;
3522 goto unlock;
3523 }
1da177e4 3524 } else {
3df91ea2
AE		 3525 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3526 if (!chan) {
3527 err = -EFAULT;
3528 goto unlock;
3529 }
1da177e4
LT		 3530 }
3531
3df91ea2
AE		 3532 err = 0;
3533
6be36555 3534 l2cap_chan_lock(chan);
48454079 3535
1da177e4
LT		 3536 switch (result) {
3537 case L2CAP_CR_SUCCESS:
89bc500e 3538 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3539 chan->ident = 0;
fe4128e0 3540 chan->dcid = dcid;
c1360a1c 3541 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3542
c1360a1c 3543 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3544 break;
3545
1da177e4 3546 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3547 l2cap_build_conf_req(chan, req), req);
3548 chan->num_conf_req++;
1da177e4
LT		 3549 break;
3550
3551 case L2CAP_CR_PEND:
c1360a1c 3552 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3553 break;
3554
3555 default:
48454079 3556 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3557 break;
3558 }
3559
6be36555 3560 l2cap_chan_unlock(chan);
3df91ea2
AE		 3561
3562unlock:
3563 mutex_unlock(&conn->chan_lock);
3564
3565 return err;
1da177e4
LT		 3566}
3567
47d1ec61 3568static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3569{
3570 /* FCS is enabled only in ERTM or streaming mode, if one or both
3571 * sides request it.
3572 */
0c1bc5c6 3573 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3574 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3575 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3576 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3577}
3578
88219a0f 3579static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3580{
3581 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3582 u16 dcid, flags;
3583 u8 rsp[64];
48454079 3584 struct l2cap_chan *chan;
3c588192 3585 int len, err = 0;
1da177e4
LT		 3586
3587 dcid = __le16_to_cpu(req->dcid);
3588 flags = __le16_to_cpu(req->flags);
3589
3590 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3591
baa7e1fa 3592 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3593 if (!chan)
1da177e4
LT		 3594 return -ENOENT;
3595
033b1142 3596 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3597 struct l2cap_cmd_rej_cid rej;
3598
3599 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3600 rej.scid = cpu_to_le16(chan->scid);
3601 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3602
df6bd743
GP		 3603 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3604 sizeof(rej), &rej);
354f60a9 3605 goto unlock;
df6bd743 3606 }
354f60a9 3607
5dee9e7c 3608 /* Reject if config buffer is too small. */
88219a0f 3609 len = cmd_len - sizeof(*req);
7ac28817 3610 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3611 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3612 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 3613 L2CAP_CONF_REJECT, flags), rsp);
3614 goto unlock;
3615 }
3616
3617 /* Store config. */
73ffa904
GP		 3618 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3619 chan->conf_len += len;
1da177e4 3620
59e54bd1 3621 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 3622 /* Incomplete config. Send empty response. */
3623 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3624 l2cap_build_conf_rsp(chan, rsp,
5325e5bb 3625 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 3626 goto unlock;
3627 }
3628
3629 /* Complete config. */
73ffa904 3630 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3631 if (len < 0) {
e92c8e70 3632 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3633 goto unlock;
f2fcfcd6 3634 }
1da177e4 3635
5dee9e7c 3636 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3637 chan->num_conf_rsp++;
5dee9e7c 3638
5dee9e7c 3639 /* Reset config buffer. */
73ffa904 3640 chan->conf_len = 0;
5dee9e7c 3641
c1360a1c 3642 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3643 goto unlock;
3644
c1360a1c 3645 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3646 set_default_fcs(chan);
fcc203c3 3647
89bc500e 3648 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 3649
105bdf9e
MM		 3650 if (chan->mode == L2CAP_MODE_ERTM ||
3651 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3652 err = l2cap_ertm_init(chan);
3653
3654 if (err < 0)
3655 l2cap_send_disconn_req(chan->conn, chan, -err);
3656 else
3657 l2cap_chan_ready(chan);
0565c1c2 3658
876d9484
MH		 3659 goto unlock;
3660 }
3661
c1360a1c 3662 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3663 u8 buf[64];
1da177e4 3664 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3665 l2cap_build_conf_req(chan, buf), buf);
3666 chan->num_conf_req++;
1da177e4
LT		 3667 }
3668
0e8b207e
AE		 3669 /* Got Conf Rsp PENDING from remote side and asume we sent
3670 Conf Rsp PENDING in the code above */
3671 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3672 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3673
3674 /* check compatibility */
3675
3676 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3677 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3678
3679 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3680 l2cap_build_conf_rsp(chan, rsp,
5325e5bb 3681 L2CAP_CONF_SUCCESS, flags), rsp);
0e8b207e
AE		 3682 }
3683
1da177e4 3684unlock:
6be36555 3685 l2cap_chan_unlock(chan);
3c588192 3686 return err;
1da177e4
LT		 3687}
3688
3689static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3690{
3691 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3692 u16 scid, flags, result;
48454079 3693 struct l2cap_chan *chan;
61386cba 3694 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3695 int err = 0;
1da177e4
LT		 3696
3697 scid = __le16_to_cpu(rsp->scid);
3698 flags = __le16_to_cpu(rsp->flags);
3699 result = __le16_to_cpu(rsp->result);
3700
61386cba
AE		 3701 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3702 result, len);
1da177e4 3703
baa7e1fa 3704 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3705 if (!chan)
1da177e4
LT		 3706 return 0;
3707
3708 switch (result) {
3709 case L2CAP_CONF_SUCCESS:
47d1ec61 3710 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3711 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3712 break;
3713
0e8b207e
AE		 3714 case L2CAP_CONF_PENDING:
3715 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3716
3717 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3718 char buf[64];
3719
3720 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3721 buf, &result);
3722 if (len < 0) {
3723 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3724 goto done;
3725 }
3726
3727 /* check compatibility */
3728
3729 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3730 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3731
3732 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3733 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 3734 L2CAP_CONF_SUCCESS, 0x0000), buf);
3735 }
3736 goto done;
3737
1da177e4 3738 case L2CAP_CONF_UNACCEPT:
73ffa904 3739 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3740 char req[64];
3741
c2c77ec8 3742 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3743 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3744 goto done;
3745 }
3746
f2fcfcd6
GP		 3747 /* throw out any old stored conf requests */
3748 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3749 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3750 req, &result);
f2fcfcd6 3751 if (len < 0) {
e92c8e70 3752 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3753 goto done;
3754 }
3755
3756 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3757 L2CAP_CONF_REQ, len, req);
73ffa904 3758 chan->num_conf_req++;
f2fcfcd6
GP		 3759 if (result != L2CAP_CONF_SUCCESS)
3760 goto done;
3761 break;
1da177e4
LT		 3762 }
3763
8e87d142 3764 default:
6be36555 3765 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3766
ba13ccd9 3767 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3768 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3769 goto done;
3770 }
3771
59e54bd1 3772 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 3773 goto done;
3774
c1360a1c 3775 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3776
c1360a1c 3777 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3778 set_default_fcs(chan);
fcc203c3 3779
89bc500e 3780 l2cap_state_change(chan, BT_CONNECTED);
105bdf9e
MM		 3781 if (chan->mode == L2CAP_MODE_ERTM ||
3782 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3783 err = l2cap_ertm_init(chan);
0565c1c2 3784
3c588192
MM		 3785 if (err < 0)
3786 l2cap_send_disconn_req(chan->conn, chan, -err);
3787 else
3788 l2cap_chan_ready(chan);
1da177e4
LT		 3789 }
3790
3791done:
6be36555 3792 l2cap_chan_unlock(chan);
3c588192 3793 return err;
1da177e4
LT		 3794}
3795
3796static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3797{
3798 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3799 struct l2cap_disconn_rsp rsp;
3800 u16 dcid, scid;
48454079 3801 struct l2cap_chan *chan;
1da177e4
LT		 3802 struct sock *sk;
3803
3804 scid = __le16_to_cpu(req->scid);
3805 dcid = __le16_to_cpu(req->dcid);
3806
3807 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3808
3df91ea2
AE		 3809 mutex_lock(&conn->chan_lock);
3810
3811 chan = __l2cap_get_chan_by_scid(conn, dcid);
3812 if (!chan) {
3813 mutex_unlock(&conn->chan_lock);
1da177e4 3814 return 0;
3df91ea2 3815 }
1da177e4 3816
6be36555
AE		 3817 l2cap_chan_lock(chan);
3818
48454079
GP		 3819 sk = chan->sk;
3820
fe4128e0
GP		 3821 rsp.dcid = cpu_to_le16(chan->scid);
3822 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3823 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3824
6be36555 3825 lock_sock(sk);
1da177e4 3826 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3827 release_sock(sk);
1da177e4 3828
61d6ef3e 3829 l2cap_chan_hold(chan);
48454079 3830 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3831
3832 l2cap_chan_unlock(chan);
1da177e4 3833
ba3bd0ee 3834 chan->ops->close(chan->data);
61d6ef3e 3835 l2cap_chan_put(chan);
3df91ea2
AE		 3836
3837 mutex_unlock(&conn->chan_lock);
3838
1da177e4
LT		 3839 return 0;
3840}
3841
3842static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3843{
3844 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3845 u16 dcid, scid;
48454079 3846 struct l2cap_chan *chan;
1da177e4
LT		 3847
3848 scid = __le16_to_cpu(rsp->scid);
3849 dcid = __le16_to_cpu(rsp->dcid);
3850
3851 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3852
3df91ea2
AE		 3853 mutex_lock(&conn->chan_lock);
3854
3855 chan = __l2cap_get_chan_by_scid(conn, scid);
3856 if (!chan) {
3857 mutex_unlock(&conn->chan_lock);
1da177e4 3858 return 0;
3df91ea2 3859 }
1da177e4 3860
6be36555 3861 l2cap_chan_lock(chan);
48454079 3862
61d6ef3e 3863 l2cap_chan_hold(chan);
48454079 3864 l2cap_chan_del(chan, 0);
6be36555
AE		 3865
3866 l2cap_chan_unlock(chan);
1da177e4 3867
ba3bd0ee 3868 chan->ops->close(chan->data);
61d6ef3e 3869 l2cap_chan_put(chan);
3df91ea2
AE		 3870
3871 mutex_unlock(&conn->chan_lock);
3872
1da177e4
LT		 3873 return 0;
3874}
3875
3876static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3877{
3878 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3879 u16 type;
3880
3881 type = __le16_to_cpu(req->type);
3882
3883 BT_DBG("type 0x%4.4x", type);
3884
f0709e03
MH		 3885 if (type == L2CAP_IT_FEAT_MASK) {
3886 u8 buf[8];
44dd46de 3887 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3888 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3889 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3890 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3891 if (!disable_ertm)
fcc203c3
GP		 3892 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3893 | L2CAP_FEAT_FCS;
a5fd6f30 3894 if (enable_hs)
6327eb98
AE		 3895 feat_mask |= L2CAP_FEAT_EXT_FLOW
3896 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3897
1b7bf4ed 3898 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3899 l2cap_send_cmd(conn, cmd->ident,
3900 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3901 } else if (type == L2CAP_IT_FIXED_CHAN) {
3902 u8 buf[12];
3903 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3904
3905 if (enable_hs)
3906 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3907 else
3908 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3909
e1027a7c
MH		 3910 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3911 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3912 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3913 l2cap_send_cmd(conn, cmd->ident,
3914 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3915 } else {
3916 struct l2cap_info_rsp rsp;
3917 rsp.type = cpu_to_le16(type);
3918 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3919 l2cap_send_cmd(conn, cmd->ident,
3920 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3921 }
1da177e4
LT		 3922
3923 return 0;
3924}
3925
3926static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3927{
3928 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3929 u16 type, result;
3930
3931 type = __le16_to_cpu(rsp->type);
3932 result = __le16_to_cpu(rsp->result);
3933
3934 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3935
e90165be
AE		 3936 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3937 if (cmd->ident != conn->info_ident ||
3938 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3939 return 0;
3940
17cd3f37 3941 cancel_delayed_work(&conn->info_timer);
4e8402a3 3942
adb08ede
VT		 3943 if (result != L2CAP_IR_SUCCESS) {
3944 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3945 conn->info_ident = 0;
3946
3947 l2cap_conn_start(conn);
3948
3949 return 0;
3950 }
3951
978c93b9
AE		 3952 switch (type) {
3953 case L2CAP_IT_FEAT_MASK:
83985319 3954 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3955
47ec1dcd 3956 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3957 struct l2cap_info_req req;
3958 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3959
3960 conn->info_ident = l2cap_get_ident(conn);
3961
3962 l2cap_send_cmd(conn, conn->info_ident,
3963 L2CAP_INFO_REQ, sizeof(req), &req);
3964 } else {
3965 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3966 conn->info_ident = 0;
3967
3968 l2cap_conn_start(conn);
3969 }
978c93b9
AE		 3970 break;
3971
3972 case L2CAP_IT_FIXED_CHAN:
3973 conn->fixed_chan_mask = rsp->data[0];
984947dc 3974 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3975 conn->info_ident = 0;
984947dc
MH		 3976
3977 l2cap_conn_start(conn);
978c93b9 3978 break;
984947dc 3979 }
4e8402a3 3980
1da177e4
LT		 3981 return 0;
3982}
3983
f94ff6ff
MM		 3984static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3985 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3986 void *data)
3987{
3988 struct l2cap_create_chan_req *req = data;
3989 struct l2cap_create_chan_rsp rsp;
3990 u16 psm, scid;
3991
3992 if (cmd_len != sizeof(*req))
3993 return -EPROTO;
3994
3995 if (!enable_hs)
3996 return -EINVAL;
3997
3998 psm = le16_to_cpu(req->psm);
3999 scid = le16_to_cpu(req->scid);
4000
4001 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
4002
4003 /* Placeholder: Always reject */
4004 rsp.dcid = 0;
4005 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 4006 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
4007 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 4008
4009 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4010 sizeof(rsp), &rsp);
4011
4012 return 0;
4013}
4014
4015static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
4016 struct l2cap_cmd_hdr *cmd, void *data)
4017{
4018 BT_DBG("conn %p", conn);
4019
4020 return l2cap_connect_rsp(conn, cmd, data);
4021}
4022
8d5a04a1
MM		 4023static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
4024 u16 icid, u16 result)
4025{
4026 struct l2cap_move_chan_rsp rsp;
4027
4028 BT_DBG("icid %d, result %d", icid, result);
4029
4030 rsp.icid = cpu_to_le16(icid);
4031 rsp.result = cpu_to_le16(result);
4032
4033 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
4034}
4035
4036static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
4037 struct l2cap_chan *chan, u16 icid, u16 result)
4038{
4039 struct l2cap_move_chan_cfm cfm;
4040 u8 ident;
4041
4042 BT_DBG("icid %d, result %d", icid, result);
4043
4044 ident = l2cap_get_ident(conn);
4045 if (chan)
4046 chan->ident = ident;
4047
4048 cfm.icid = cpu_to_le16(icid);
4049 cfm.result = cpu_to_le16(result);
4050
4051 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
4052}
4053
4054static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
4055 u16 icid)
4056{
4057 struct l2cap_move_chan_cfm_rsp rsp;
4058
4059 BT_DBG("icid %d", icid);
4060
4061 rsp.icid = cpu_to_le16(icid);
4062 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4063}
4064
4065static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
4066 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
4067{
4068 struct l2cap_move_chan_req *req = data;
4069 u16 icid = 0;
4070 u16 result = L2CAP_MR_NOT_ALLOWED;
4071
4072 if (cmd_len != sizeof(*req))
4073 return -EPROTO;
4074
4075 icid = le16_to_cpu(req->icid);
4076
4077 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
4078
4079 if (!enable_hs)
4080 return -EINVAL;
4081
4082 /* Placeholder: Always refuse */
4083 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
4084
4085 return 0;
4086}
4087
4088static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
4089 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
4090{
4091 struct l2cap_move_chan_rsp *rsp = data;
4092 u16 icid, result;
4093
4094 if (cmd_len != sizeof(*rsp))
4095 return -EPROTO;
4096
4097 icid = le16_to_cpu(rsp->icid);
4098 result = le16_to_cpu(rsp->result);
4099
4100 BT_DBG("icid %d, result %d", icid, result);
4101
4102 /* Placeholder: Always unconfirmed */
4103 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
4104
4105 return 0;
4106}
4107
4108static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
4109 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
4110{
4111 struct l2cap_move_chan_cfm *cfm = data;
4112 u16 icid, result;
4113
4114 if (cmd_len != sizeof(*cfm))
4115 return -EPROTO;
4116
4117 icid = le16_to_cpu(cfm->icid);
4118 result = le16_to_cpu(cfm->result);
4119
4120 BT_DBG("icid %d, result %d", icid, result);
4121
4122 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
4123
4124 return 0;
4125}
4126
4127static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
4128 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
4129{
4130 struct l2cap_move_chan_cfm_rsp *rsp = data;
4131 u16 icid;
4132
4133 if (cmd_len != sizeof(*rsp))
4134 return -EPROTO;
4135
4136 icid = le16_to_cpu(rsp->icid);
4137
4138 BT_DBG("icid %d", icid);
4139
4140 return 0;
4141}
4142
e2174ca4 4143static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 4144 u16 to_multiplier)
4145{
4146 u16 max_latency;
4147
4148 if (min > max || min < 6 || max > 3200)
4149 return -EINVAL;
4150
4151 if (to_multiplier < 10 || to_multiplier > 3200)
4152 return -EINVAL;
4153
4154 if (max >= to_multiplier * 8)
4155 return -EINVAL;
4156
4157 max_latency = (to_multiplier * 8 / max) - 1;
4158 if (latency > 499 || latency > max_latency)
4159 return -EINVAL;
4160
4161 return 0;
4162}
4163
4164static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
4165 struct l2cap_cmd_hdr *cmd, u8 *data)
4166{
4167 struct hci_conn *hcon = conn->hcon;
4168 struct l2cap_conn_param_update_req *req;
4169 struct l2cap_conn_param_update_rsp rsp;
4170 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 4171 int err;
de73115a
CT		 4172
4173 if (!(hcon->link_mode & HCI_LM_MASTER))
4174 return -EINVAL;
4175
4176 cmd_len = __le16_to_cpu(cmd->len);
4177 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4178 return -EPROTO;
4179
4180 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 4181 min = __le16_to_cpu(req->min);
4182 max = __le16_to_cpu(req->max);
de73115a
CT		 4183 latency = __le16_to_cpu(req->latency);
4184 to_multiplier = __le16_to_cpu(req->to_multiplier);
4185
4186 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
4187 min, max, latency, to_multiplier);
4188
4189 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 4190
4191 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
4192 if (err)
de73115a
CT		 4193 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
4194 else
4195 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
4196
4197 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
4198 sizeof(rsp), &rsp);
4199
2ce603eb
CT		 4200 if (!err)
4201 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
4202
de73115a
CT		 4203 return 0;
4204}
4205
3300d9a9
CT		 4206static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
4207 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
4208{
4209 int err = 0;
4210
4211 switch (cmd->code) {
4212 case L2CAP_COMMAND_REJ:
4213 l2cap_command_rej(conn, cmd, data);
4214 break;
4215
4216 case L2CAP_CONN_REQ:
4217 err = l2cap_connect_req(conn, cmd, data);
4218 break;
4219
4220 case L2CAP_CONN_RSP:
4221 err = l2cap_connect_rsp(conn, cmd, data);
4222 break;
4223
4224 case L2CAP_CONF_REQ:
4225 err = l2cap_config_req(conn, cmd, cmd_len, data);
4226 break;
4227
4228 case L2CAP_CONF_RSP:
4229 err = l2cap_config_rsp(conn, cmd, data);
4230 break;
4231
4232 case L2CAP_DISCONN_REQ:
4233 err = l2cap_disconnect_req(conn, cmd, data);
4234 break;
4235
4236 case L2CAP_DISCONN_RSP:
4237 err = l2cap_disconnect_rsp(conn, cmd, data);
4238 break;
4239
4240 case L2CAP_ECHO_REQ:
4241 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4242 break;
4243
4244 case L2CAP_ECHO_RSP:
4245 break;
4246
4247 case L2CAP_INFO_REQ:
4248 err = l2cap_information_req(conn, cmd, data);
4249 break;
4250
4251 case L2CAP_INFO_RSP:
4252 err = l2cap_information_rsp(conn, cmd, data);
4253 break;
4254
f94ff6ff
MM		 4255 case L2CAP_CREATE_CHAN_REQ:
4256 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
4257 break;
4258
4259 case L2CAP_CREATE_CHAN_RSP:
4260 err = l2cap_create_channel_rsp(conn, cmd, data);
4261 break;
4262
8d5a04a1
MM		 4263 case L2CAP_MOVE_CHAN_REQ:
4264 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
4265 break;
4266
4267 case L2CAP_MOVE_CHAN_RSP:
4268 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
4269 break;
4270
4271 case L2CAP_MOVE_CHAN_CFM:
4272 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
4273 break;
4274
4275 case L2CAP_MOVE_CHAN_CFM_RSP:
4276 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
4277 break;
4278
3300d9a9
CT		 4279 default:
4280 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
4281 err = -EINVAL;
4282 break;
4283 }
4284
4285 return err;
4286}
4287
4288static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
4289 struct l2cap_cmd_hdr *cmd, u8 *data)
4290{
4291 switch (cmd->code) {
4292 case L2CAP_COMMAND_REJ:
4293 return 0;
4294
4295 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 4296 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 4297
4298 case L2CAP_CONN_PARAM_UPDATE_RSP:
4299 return 0;
4300
4301 default:
4302 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
4303 return -EINVAL;
4304 }
4305}
4306
4307static inline void l2cap_sig_channel(struct l2cap_conn *conn,
4308 struct sk_buff *skb)
1da177e4
LT		 4309{
4310 u8 *data = skb->data;
4311 int len = skb->len;
4312 struct l2cap_cmd_hdr cmd;
3300d9a9 4313 int err;
1da177e4
LT		 4314
4315 l2cap_raw_recv(conn, skb);
4316
4317 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 4318 u16 cmd_len;
1da177e4
LT		 4319 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
4320 data += L2CAP_CMD_HDR_SIZE;
4321 len -= L2CAP_CMD_HDR_SIZE;
4322
88219a0f 4323 cmd_len = le16_to_cpu(cmd.len);
1da177e4 4324
88219a0f 4325 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 4326
88219a0f 4327 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 4328 BT_DBG("corrupted command");
4329 break;
4330 }
4331
3300d9a9
CT		 4332 if (conn->hcon->type == LE_LINK)
4333 err = l2cap_le_sig_cmd(conn, &cmd, data);
4334 else
4335 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 4336
4337 if (err) {
e2fd318e 4338 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 4339
4340 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 4341
4342 /* FIXME: Map err to a valid reason */
e2fd318e 4343 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 4344 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
4345 }
4346
88219a0f
AV		 4347 data += cmd_len;
4348 len -= cmd_len;
1da177e4
LT		 4349 }
4350
4351 kfree_skb(skb);
4352}
4353
47d1ec61 4354static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 4355{
4356 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 4357 int hdr_size;
4358
4359 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
4360 hdr_size = L2CAP_EXT_HDR_SIZE;
4361 else
4362 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 4363
47d1ec61 4364 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 4365 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 4366 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
4367 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
4368
4369 if (our_fcs != rcv_fcs)
7a560e5c 4370 return -EBADMSG;
fcc203c3
GP		 4371 }
4372 return 0;
4373}
4374
6ea00485 4375static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 4376{
e31f7633 4377 struct l2cap_ctrl control;
d5392c8f 4378
e31f7633 4379 BT_DBG("chan %p", chan);
d5392c8f 4380
e31f7633
MM		 4381 memset(&control, 0, sizeof(control));
4382 control.sframe = 1;
4383 control.final = 1;
4384 control.reqseq = chan->buffer_seq;
4385 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 4386
e2ab4353 4387 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 4388 control.super = L2CAP_SUPER_RNR;
4389 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 4390 }
4391
e31f7633
MM		 4392 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
4393 chan->unacked_frames > 0)
4394 __set_retrans_timer(chan);
d5392c8f 4395
e31f7633 4396 /* Send pending iframes */
525cd185 4397 l2cap_ertm_send(chan);
d5392c8f 4398
e2ab4353 4399 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 4400 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
4401 /* F-bit wasn't sent in an s-frame or i-frame yet, so
4402 * send it now.
4403 */
4404 control.super = L2CAP_SUPER_RR;
4405 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 4406 }
4407}
4408
84084a31
MM		 4409static void append_skb_frag(struct sk_buff *skb,
4410 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 4411{
84084a31
MM		 4412 /* skb->len reflects data in skb as well as all fragments
4413 * skb->data_len reflects only data in fragments
4414 */
4415 if (!skb_has_frag_list(skb))
4416 skb_shinfo(skb)->frag_list = new_frag;
4417
4418 new_frag->next = NULL;
4419
4420 (*last_frag)->next = new_frag;
4421 *last_frag = new_frag;
4422
4423 skb->len += new_frag->len;
4424 skb->data_len += new_frag->len;
4425 skb->truesize += new_frag->truesize;
4426}
4427
4b51dae9
MM		 4428static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
4429 struct l2cap_ctrl *control)
84084a31
MM		 4430{
4431 int err = -EINVAL;
18778a63 4432
4b51dae9 4433 switch (control->sar) {
7e0ef6ee 4434 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 4435 if (chan->sdu)
4436 break;
18778a63 4437
84084a31
MM		 4438 err = chan->ops->recv(chan->data, skb);
4439 break;
18778a63 4440
7e0ef6ee 4441 case L2CAP_SAR_START:
84084a31
MM		 4442 if (chan->sdu)
4443 break;
18778a63 4444
6f61fd47 4445 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 4446 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 4447
84084a31
MM		 4448 if (chan->sdu_len > chan->imtu) {
4449 err = -EMSGSIZE;
4450 break;
4451 }
1890d36b 4452
84084a31
MM		 4453 if (skb->len >= chan->sdu_len)
4454 break;
18778a63 4455
84084a31
MM		 4456 chan->sdu = skb;
4457 chan->sdu_last_frag = skb;
18778a63 4458
84084a31
MM		 4459 skb = NULL;
4460 err = 0;
18778a63
GP		 4461 break;
4462
7e0ef6ee 4463 case L2CAP_SAR_CONTINUE:
6f61fd47 4464 if (!chan->sdu)
84084a31 4465 break;
18778a63 4466
84084a31
MM		 4467 append_skb_frag(chan->sdu, skb,
4468 &chan->sdu_last_frag);
4469 skb = NULL;
18778a63 4470
84084a31
MM		 4471 if (chan->sdu->len >= chan->sdu_len)
4472 break;
4178ba46 4473
84084a31 4474 err = 0;
18778a63
GP		 4475 break;
4476
7e0ef6ee 4477 case L2CAP_SAR_END:
6f61fd47 4478 if (!chan->sdu)
84084a31 4479 break;
18778a63 4480
84084a31
MM		 4481 append_skb_frag(chan->sdu, skb,
4482 &chan->sdu_last_frag);
4483 skb = NULL;
4178ba46 4484
84084a31
MM		 4485 if (chan->sdu->len != chan->sdu_len)
4486 break;
18778a63 4487
84084a31 4488 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 4489
84084a31
MM		 4490 if (!err) {
4491 /* Reassembly complete */
4492 chan->sdu = NULL;
4493 chan->sdu_last_frag = NULL;
4494 chan->sdu_len = 0;
1890d36b 4495 }
18778a63
GP		 4496 break;
4497 }
4498
84084a31
MM		 4499 if (err) {
4500 kfree_skb(skb);
4501 kfree_skb(chan->sdu);
4502 chan->sdu = NULL;
4503 chan->sdu_last_frag = NULL;
4504 chan->sdu_len = 0;
4505 }
18778a63 4506
84084a31 4507 return err;
18778a63
GP		 4508}
4509
61aa4f5b 4510void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 4511{
61aa4f5b 4512 u8 event;
712132eb 4513
61aa4f5b
MM		 4514 if (chan->mode != L2CAP_MODE_ERTM)
4515 return;
712132eb 4516
61aa4f5b 4517 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 4518 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 4519}
4520
d2a7ac5d
MM		 4521static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
4522{
63838725
MM		 4523 int err = 0;
4524 /* Pass sequential frames to l2cap_reassemble_sdu()
4525 * until a gap is encountered.
4526 */
4527
4528 BT_DBG("chan %p", chan);
4529
4530 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4531 struct sk_buff *skb;
4532 BT_DBG("Searching for skb with txseq %d (queue len %d)",
4533 chan->buffer_seq, skb_queue_len(&chan->srej_q));
4534
4535 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
4536
4537 if (!skb)
4538 break;
4539
4540 skb_unlink(skb, &chan->srej_q);
4541 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4542 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
4543 if (err)
4544 break;
4545 }
4546
4547 if (skb_queue_empty(&chan->srej_q)) {
4548 chan->rx_state = L2CAP_RX_STATE_RECV;
4549 l2cap_send_ack(chan);
4550 }
4551
4552 return err;
d2a7ac5d
MM		 4553}
4554
4555static void l2cap_handle_srej(struct l2cap_chan *chan,
4556 struct l2cap_ctrl *control)
4557{
f80842a8
MM		 4558 struct sk_buff *skb;
4559
4560 BT_DBG("chan %p, control %p", chan, control);
4561
4562 if (control->reqseq == chan->next_tx_seq) {
4563 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
4564 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4565 return;
4566 }
4567
4568 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
4569
4570 if (skb == NULL) {
4571 BT_DBG("Seq %d not available for retransmission",
4572 control->reqseq);
4573 return;
4574 }
4575
4576 if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
4577 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
4578 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4579 return;
4580 }
4581
4582 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4583
4584 if (control->poll) {
4585 l2cap_pass_to_tx(chan, control);
4586
4587 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4588 l2cap_retransmit(chan, control);
4589 l2cap_ertm_send(chan);
4590
4591 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
4592 set_bit(CONN_SREJ_ACT, &chan->conn_state);
4593 chan->srej_save_reqseq = control->reqseq;
4594 }
4595 } else {
4596 l2cap_pass_to_tx_fbit(chan, control);
4597
4598 if (control->final) {
4599 if (chan->srej_save_reqseq != control->reqseq ||
4600 !test_and_clear_bit(CONN_SREJ_ACT,
4601 &chan->conn_state))
4602 l2cap_retransmit(chan, control);
4603 } else {
4604 l2cap_retransmit(chan, control);
4605 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
4606 set_bit(CONN_SREJ_ACT, &chan->conn_state);
4607 chan->srej_save_reqseq = control->reqseq;
4608 }
4609 }
4610 }
d2a7ac5d
MM		 4611}
4612
4613static void l2cap_handle_rej(struct l2cap_chan *chan,
4614 struct l2cap_ctrl *control)
4615{
fcd289df
MM		 4616 struct sk_buff *skb;
4617
4618 BT_DBG("chan %p, control %p", chan, control);
4619
4620 if (control->reqseq == chan->next_tx_seq) {
4621 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
4622 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4623 return;
4624 }
4625
4626 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
4627
4628 if (chan->max_tx && skb &&
4629 bt_cb(skb)->control.retries >= chan->max_tx) {
4630 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
4631 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4632 return;
4633 }
4634
4635 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4636
4637 l2cap_pass_to_tx(chan, control);
4638
4639 if (control->final) {
4640 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
4641 l2cap_retransmit_all(chan, control);
4642 } else {
4643 l2cap_retransmit_all(chan, control);
4644 l2cap_ertm_send(chan);
4645 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
4646 set_bit(CONN_REJ_ACT, &chan->conn_state);
4647 }
d2a7ac5d
MM		 4648}
4649
4b51dae9
MM		 4650static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
4651{
4652 BT_DBG("chan %p, txseq %d", chan, txseq);
4653
4654 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
4655 chan->expected_tx_seq);
4656
4657 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
4658 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
4659 chan->tx_win) {
4660 /* See notes below regarding "double poll" and
4661 * invalid packets.
4662 */
4663 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
4664 BT_DBG("Invalid/Ignore - after SREJ");
4665 return L2CAP_TXSEQ_INVALID_IGNORE;
4666 } else {
4667 BT_DBG("Invalid - in window after SREJ sent");
4668 return L2CAP_TXSEQ_INVALID;
4669 }
4670 }
4671
4672 if (chan->srej_list.head == txseq) {
4673 BT_DBG("Expected SREJ");
4674 return L2CAP_TXSEQ_EXPECTED_SREJ;
4675 }
4676
4677 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
4678 BT_DBG("Duplicate SREJ - txseq already stored");
4679 return L2CAP_TXSEQ_DUPLICATE_SREJ;
4680 }
4681
4682 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
4683 BT_DBG("Unexpected SREJ - not requested");
4684 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
4685 }
4686 }
4687
4688 if (chan->expected_tx_seq == txseq) {
4689 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
4690 chan->tx_win) {
4691 BT_DBG("Invalid - txseq outside tx window");
4692 return L2CAP_TXSEQ_INVALID;
4693 } else {
4694 BT_DBG("Expected");
4695 return L2CAP_TXSEQ_EXPECTED;
4696 }
4697 }
4698
4699 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
4700 __seq_offset(chan, chan->expected_tx_seq,
4701 chan->last_acked_seq)){
4702 BT_DBG("Duplicate - expected_tx_seq later than txseq");
4703 return L2CAP_TXSEQ_DUPLICATE;
4704 }
4705
4706 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
4707 /* A source of invalid packets is a "double poll" condition,
4708 * where delays cause us to send multiple poll packets. If
4709 * the remote stack receives and processes both polls,
4710 * sequence numbers can wrap around in such a way that a
4711 * resent frame has a sequence number that looks like new data
4712 * with a sequence gap. This would trigger an erroneous SREJ
4713 * request.
4714 *
4715 * Fortunately, this is impossible with a tx window that's
4716 * less than half of the maximum sequence number, which allows
4717 * invalid frames to be safely ignored.
4718 *
4719 * With tx window sizes greater than half of the tx window
4720 * maximum, the frame is invalid and cannot be ignored. This
4721 * causes a disconnect.
4722 */
4723
4724 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
4725 BT_DBG("Invalid/Ignore - txseq outside tx window");
4726 return L2CAP_TXSEQ_INVALID_IGNORE;
4727 } else {
4728 BT_DBG("Invalid - txseq outside tx window");
4729 return L2CAP_TXSEQ_INVALID;
4730 }
4731 } else {
4732 BT_DBG("Unexpected - txseq indicates missing frames");
4733 return L2CAP_TXSEQ_UNEXPECTED;
4734 }
4735}
4736
d2a7ac5d
MM		 4737static int l2cap_rx_state_recv(struct l2cap_chan *chan,
4738 struct l2cap_ctrl *control,
4739 struct sk_buff *skb, u8 event)
4740{
4741 int err = 0;
4742 bool skb_in_use = 0;
4743
4744 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
4745 event);
4746
4747 switch (event) {
4748 case L2CAP_EV_RECV_IFRAME:
4749 switch (l2cap_classify_txseq(chan, control->txseq)) {
4750 case L2CAP_TXSEQ_EXPECTED:
4751 l2cap_pass_to_tx(chan, control);
4752
4753 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4754 BT_DBG("Busy, discarding expected seq %d",
4755 control->txseq);
4756 break;
4757 }
4758
4759 chan->expected_tx_seq = __next_seq(chan,
4760 control->txseq);
4761
4762 chan->buffer_seq = chan->expected_tx_seq;
4763 skb_in_use = 1;
4764
4765 err = l2cap_reassemble_sdu(chan, skb, control);
4766 if (err)
4767 break;
4768
4769 if (control->final) {
4770 if (!test_and_clear_bit(CONN_REJ_ACT,
4771 &chan->conn_state)) {
4772 control->final = 0;
4773 l2cap_retransmit_all(chan, control);
4774 l2cap_ertm_send(chan);
4775 }
4776 }
4777
4778 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
4779 l2cap_send_ack(chan);
4780 break;
4781 case L2CAP_TXSEQ_UNEXPECTED:
4782 l2cap_pass_to_tx(chan, control);
4783
4784 /* Can't issue SREJ frames in the local busy state.
4785 * Drop this frame, it will be seen as missing
4786 * when local busy is exited.
4787 */
4788 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4789 BT_DBG("Busy, discarding unexpected seq %d",
4790 control->txseq);
4791 break;
4792 }
4793
4794 /* There was a gap in the sequence, so an SREJ
4795 * must be sent for each missing frame. The
4796 * current frame is stored for later use.
4797 */
4798 skb_queue_tail(&chan->srej_q, skb);
4799 skb_in_use = 1;
4800 BT_DBG("Queued %p (queue len %d)", skb,
4801 skb_queue_len(&chan->srej_q));
4802
4803 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
4804 l2cap_seq_list_clear(&chan->srej_list);
4805 l2cap_send_srej(chan, control->txseq);
4806
4807 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
4808 break;
4809 case L2CAP_TXSEQ_DUPLICATE:
4810 l2cap_pass_to_tx(chan, control);
4811 break;
4812 case L2CAP_TXSEQ_INVALID_IGNORE:
4813 break;
4814 case L2CAP_TXSEQ_INVALID:
4815 default:
4816 l2cap_send_disconn_req(chan->conn, chan,
4817 ECONNRESET);
4818 break;
4819 }
4820 break;
4821 case L2CAP_EV_RECV_RR:
4822 l2cap_pass_to_tx(chan, control);
4823 if (control->final) {
4824 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4825
4826 if (!test_and_clear_bit(CONN_REJ_ACT,
4827 &chan->conn_state)) {
4828 control->final = 0;
4829 l2cap_retransmit_all(chan, control);
4830 }
4831
4832 l2cap_ertm_send(chan);
4833 } else if (control->poll) {
4834 l2cap_send_i_or_rr_or_rnr(chan);
4835 } else {
4836 if (test_and_clear_bit(CONN_REMOTE_BUSY,
4837 &chan->conn_state) &&
4838 chan->unacked_frames)
4839 __set_retrans_timer(chan);
4840
4841 l2cap_ertm_send(chan);
4842 }
4843 break;
4844 case L2CAP_EV_RECV_RNR:
4845 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4846 l2cap_pass_to_tx(chan, control);
4847 if (control && control->poll) {
4848 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4849 l2cap_send_rr_or_rnr(chan, 0);
4850 }
4851 __clear_retrans_timer(chan);
4852 l2cap_seq_list_clear(&chan->retrans_list);
4853 break;
4854 case L2CAP_EV_RECV_REJ:
4855 l2cap_handle_rej(chan, control);
4856 break;
4857 case L2CAP_EV_RECV_SREJ:
4858 l2cap_handle_srej(chan, control);
4859 break;
4860 default:
4861 break;
4862 }
4863
4864 if (skb && !skb_in_use) {
4865 BT_DBG("Freeing %p", skb);
4866 kfree_skb(skb);
4867 }
4868
4869 return err;
4870}
4871
4872static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
4873 struct l2cap_ctrl *control,
4874 struct sk_buff *skb, u8 event)
4875{
4876 int err = 0;
4877 u16 txseq = control->txseq;
4878 bool skb_in_use = 0;
4879
4880 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
4881 event);
4882
4883 switch (event) {
4884 case L2CAP_EV_RECV_IFRAME:
4885 switch (l2cap_classify_txseq(chan, txseq)) {
4886 case L2CAP_TXSEQ_EXPECTED:
4887 /* Keep frame for reassembly later */
4888 l2cap_pass_to_tx(chan, control);
4889 skb_queue_tail(&chan->srej_q, skb);
4890 skb_in_use = 1;
4891 BT_DBG("Queued %p (queue len %d)", skb,
4892 skb_queue_len(&chan->srej_q));
4893
4894 chan->expected_tx_seq = __next_seq(chan, txseq);
4895 break;
4896 case L2CAP_TXSEQ_EXPECTED_SREJ:
4897 l2cap_seq_list_pop(&chan->srej_list);
4898
4899 l2cap_pass_to_tx(chan, control);
4900 skb_queue_tail(&chan->srej_q, skb);
4901 skb_in_use = 1;
4902 BT_DBG("Queued %p (queue len %d)", skb,
4903 skb_queue_len(&chan->srej_q));
4904
4905 err = l2cap_rx_queued_iframes(chan);
4906 if (err)
4907 break;
4908
4909 break;
4910 case L2CAP_TXSEQ_UNEXPECTED:
4911 /* Got a frame that can't be reassembled yet.
4912 * Save it for later, and send SREJs to cover
4913 * the missing frames.
4914 */
4915 skb_queue_tail(&chan->srej_q, skb);
4916 skb_in_use = 1;
4917 BT_DBG("Queued %p (queue len %d)", skb,
4918 skb_queue_len(&chan->srej_q));
4919
4920 l2cap_pass_to_tx(chan, control);
4921 l2cap_send_srej(chan, control->txseq);
4922 break;
4923 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
4924 /* This frame was requested with an SREJ, but
4925 * some expected retransmitted frames are
4926 * missing. Request retransmission of missing
4927 * SREJ'd frames.
4928 */
4929 skb_queue_tail(&chan->srej_q, skb);
4930 skb_in_use = 1;
4931 BT_DBG("Queued %p (queue len %d)", skb,
4932 skb_queue_len(&chan->srej_q));
4933
4934 l2cap_pass_to_tx(chan, control);
4935 l2cap_send_srej_list(chan, control->txseq);
4936 break;
4937 case L2CAP_TXSEQ_DUPLICATE_SREJ:
4938 /* We've already queued this frame. Drop this copy. */
4939 l2cap_pass_to_tx(chan, control);
4940 break;
4941 case L2CAP_TXSEQ_DUPLICATE:
4942 /* Expecting a later sequence number, so this frame
4943 * was already received. Ignore it completely.
4944 */
4945 break;
4946 case L2CAP_TXSEQ_INVALID_IGNORE:
4947 break;
4948 case L2CAP_TXSEQ_INVALID:
4949 default:
4950 l2cap_send_disconn_req(chan->conn, chan,
4951 ECONNRESET);
4952 break;
4953 }
4954 break;
4955 case L2CAP_EV_RECV_RR:
4956 l2cap_pass_to_tx(chan, control);
4957 if (control->final) {
4958 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4959
4960 if (!test_and_clear_bit(CONN_REJ_ACT,
4961 &chan->conn_state)) {
4962 control->final = 0;
4963 l2cap_retransmit_all(chan, control);
4964 }
4965
4966 l2cap_ertm_send(chan);
4967 } else if (control->poll) {
4968 if (test_and_clear_bit(CONN_REMOTE_BUSY,
4969 &chan->conn_state) &&
4970 chan->unacked_frames) {
4971 __set_retrans_timer(chan);
4972 }
4973
4974 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4975 l2cap_send_srej_tail(chan);
4976 } else {
4977 if (test_and_clear_bit(CONN_REMOTE_BUSY,
4978 &chan->conn_state) &&
4979 chan->unacked_frames)
4980 __set_retrans_timer(chan);
4981
4982 l2cap_send_ack(chan);
4983 }
4984 break;
4985 case L2CAP_EV_RECV_RNR:
4986 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4987 l2cap_pass_to_tx(chan, control);
4988 if (control->poll) {
4989 l2cap_send_srej_tail(chan);
4990 } else {
4991 struct l2cap_ctrl rr_control;
4992 memset(&rr_control, 0, sizeof(rr_control));
4993 rr_control.sframe = 1;
4994 rr_control.super = L2CAP_SUPER_RR;
4995 rr_control.reqseq = chan->buffer_seq;
4996 l2cap_send_sframe(chan, &rr_control);
4997 }
4998
4999 break;
5000 case L2CAP_EV_RECV_REJ:
5001 l2cap_handle_rej(chan, control);
5002 break;
5003 case L2CAP_EV_RECV_SREJ:
5004 l2cap_handle_srej(chan, control);
5005 break;
5006 }
5007
5008 if (skb && !skb_in_use) {
5009 BT_DBG("Freeing %p", skb);
5010 kfree_skb(skb);
5011 }
5012
5013 return err;
5014}
5015
5016static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
5017{
5018 /* Make sure reqseq is for a packet that has been sent but not acked */
5019 u16 unacked;
5020
5021 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
5022 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
5023}
5024
cec8ab6e
MM		 5025static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5026 struct sk_buff *skb, u8 event)
218bb9df 5027{
d2a7ac5d
MM		 5028 int err = 0;
5029
5030 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
5031 control, skb, event, chan->rx_state);
5032
5033 if (__valid_reqseq(chan, control->reqseq)) {
5034 switch (chan->rx_state) {
5035 case L2CAP_RX_STATE_RECV:
5036 err = l2cap_rx_state_recv(chan, control, skb, event);
5037 break;
5038 case L2CAP_RX_STATE_SREJ_SENT:
5039 err = l2cap_rx_state_srej_sent(chan, control, skb,
5040 event);
5041 break;
5042 default:
5043 /* shut it down */
5044 break;
5045 }
5046 } else {
5047 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
5048 control->reqseq, chan->next_tx_seq,
5049 chan->expected_ack_seq);
5050 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5051 }
5052
5053 return err;
cec8ab6e
MM		 5054}
5055
5056static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5057 struct sk_buff *skb)
5058{
4b51dae9
MM		 5059 int err = 0;
5060
5061 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
5062 chan->rx_state);
5063
5064 if (l2cap_classify_txseq(chan, control->txseq) ==
5065 L2CAP_TXSEQ_EXPECTED) {
5066 l2cap_pass_to_tx(chan, control);
5067
5068 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
5069 __next_seq(chan, chan->buffer_seq));
5070
5071 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5072
5073 l2cap_reassemble_sdu(chan, skb, control);
5074 } else {
5075 if (chan->sdu) {
5076 kfree_skb(chan->sdu);
5077 chan->sdu = NULL;
5078 }
5079 chan->sdu_last_frag = NULL;
5080 chan->sdu_len = 0;
5081
5082 if (skb) {
5083 BT_DBG("Freeing %p", skb);
5084 kfree_skb(skb);
5085 }
5086 }
5087
5088 chan->last_acked_seq = control->txseq;
5089 chan->expected_tx_seq = __next_seq(chan, control->txseq);
5090
5091 return err;
cec8ab6e
MM		 5092}
5093
5094static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
5095{
5096 struct l2cap_ctrl *control = &bt_cb(skb)->control;
5097 u16 len;
5098 u8 event;
218bb9df 5099
b76bbd66
MM		 5100 __unpack_control(chan, skb);
5101
218bb9df
GP		 5102 len = skb->len;
5103
5104 /*
5105 * We can just drop the corrupted I-frame here.
5106 * Receiver will miss it and start proper recovery
cec8ab6e 5107 * procedures and ask for retransmission.
218bb9df 5108 */
47d1ec61 5109 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 5110 goto drop;
5111
cec8ab6e 5112 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 5113 len -= L2CAP_SDULEN_SIZE;
218bb9df 5114
47d1ec61 5115 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 5116 len -= L2CAP_FCS_SIZE;
218bb9df 5117
47d1ec61 5118 if (len > chan->mps) {
8c1d787b 5119 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5120 goto drop;
5121 }
5122
cec8ab6e
MM		 5123 if (!control->sframe) {
5124 int err;
218bb9df 5125
cec8ab6e
MM		 5126 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
5127 control->sar, control->reqseq, control->final,
5128 control->txseq);
218bb9df 5129
cec8ab6e
MM		 5130 /* Validate F-bit - F=0 always valid, F=1 only
5131 * valid in TX WAIT_F
5132 */
5133 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 5134 goto drop;
cec8ab6e
MM		 5135
5136 if (chan->mode != L2CAP_MODE_STREAMING) {
5137 event = L2CAP_EV_RECV_IFRAME;
5138 err = l2cap_rx(chan, control, skb, event);
5139 } else {
5140 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 5141 }
5142
cec8ab6e
MM		 5143 if (err)
5144 l2cap_send_disconn_req(chan->conn, chan,
5145 ECONNRESET);
218bb9df 5146 } else {
cec8ab6e
MM		 5147 const u8 rx_func_to_event[4] = {
5148 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
5149 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
5150 };
5151
5152 /* Only I-frames are expected in streaming mode */
5153 if (chan->mode == L2CAP_MODE_STREAMING)
5154 goto drop;
5155
5156 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
5157 control->reqseq, control->final, control->poll,
5158 control->super);
5159
218bb9df
GP		 5160 if (len != 0) {
5161 BT_ERR("%d", len);
8c1d787b 5162 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5163 goto drop;
5164 }
5165
cec8ab6e
MM		 5166 /* Validate F and P bits */
5167 if (control->final && (control->poll ||
5168 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
5169 goto drop;
5170
5171 event = rx_func_to_event[control->super];
5172 if (l2cap_rx(chan, control, skb, event))
5173 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5174 }
5175
5176 return 0;
5177
5178drop:
5179 kfree_skb(skb);
5180 return 0;
5181}
5182
1da177e4
LT		 5183static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
5184{
48454079 5185 struct l2cap_chan *chan;
1da177e4 5186
baa7e1fa 5187 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 5188 if (!chan) {
1da177e4 5189 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 5190 /* Drop packet and return */
3379013b 5191 kfree_skb(skb);
6be36555 5192 return 0;
1da177e4
LT		 5193 }
5194
49208c9c 5195 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 5196
89bc500e 5197 if (chan->state != BT_CONNECTED)
1da177e4
LT		 5198 goto drop;
5199
0c1bc5c6 5200 switch (chan->mode) {
1c2acffb
GP		 5201 case L2CAP_MODE_BASIC:
5202 /* If socket recv buffers overflows we drop data here
5203 * which is *bad* because L2CAP has to be reliable.
5204 * But we don't have any other choice. L2CAP doesn't
5205 * provide flow control mechanism. */
1da177e4 5206
0c1bc5c6 5207 if (chan->imtu < skb->len)
1c2acffb 5208 goto drop;
1da177e4 5209
23070494 5210 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 5211 goto done;
5212 break;
5213
5214 case L2CAP_MODE_ERTM:
6840ed07 5215 case L2CAP_MODE_STREAMING:
cec8ab6e 5216 l2cap_data_rcv(chan, skb);
6840ed07
GP		 5217 goto done;
5218
1c2acffb 5219 default:
0c1bc5c6 5220 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 5221 break;
5222 }
1da177e4
LT		 5223
5224drop:
5225 kfree_skb(skb);
5226
5227done:
6be36555 5228 l2cap_chan_unlock(chan);
0139418c 5229
1da177e4
LT		 5230 return 0;
5231}
5232
8e036fc3 5233static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 5234{
23691d75 5235 struct l2cap_chan *chan;
1da177e4 5236
c2287681 5237 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 5238 if (!chan)
1da177e4
LT		 5239 goto drop;
5240
5b4cedaa 5241 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 5242
89bc500e 5243 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 5244 goto drop;
5245
e13e21dc 5246 if (chan->imtu < skb->len)
1da177e4
LT		 5247 goto drop;
5248
23070494 5249 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 5250 return 0;
1da177e4
LT		 5251
5252drop:
5253 kfree_skb(skb);
5254
1da177e4
LT		 5255 return 0;
5256}
5257
d9b88702
AE		 5258static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
5259 struct sk_buff *skb)
9f69bda6 5260{
23691d75 5261 struct l2cap_chan *chan;
9f69bda6 5262
c2287681 5263 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 5264 if (!chan)
9f69bda6
GP		 5265 goto drop;
5266
5b4cedaa 5267 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 5268
89bc500e 5269 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 5270 goto drop;
5271
e13e21dc 5272 if (chan->imtu < skb->len)
9f69bda6
GP		 5273 goto drop;
5274
23070494 5275 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 5276 return 0;
9f69bda6
GP		 5277
5278drop:
5279 kfree_skb(skb);
5280
9f69bda6
GP		 5281 return 0;
5282}
5283
1da177e4
LT		 5284static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
5285{
5286 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 5287 u16 cid, len;
5288 __le16 psm;
1da177e4
LT		 5289
5290 skb_pull(skb, L2CAP_HDR_SIZE);
5291 cid = __le16_to_cpu(lh->cid);
5292 len = __le16_to_cpu(lh->len);
5293
1c2acffb
GP		 5294 if (len != skb->len) {
5295 kfree_skb(skb);
5296 return;
5297 }
5298
1da177e4
LT		 5299 BT_DBG("len %d, cid 0x%4.4x", len, cid);
5300
5301 switch (cid) {
3300d9a9 5302 case L2CAP_CID_LE_SIGNALING:
8db4dc46 5303 case L2CAP_CID_SIGNALING:
1da177e4
LT		 5304 l2cap_sig_channel(conn, skb);
5305 break;
5306
8db4dc46 5307 case L2CAP_CID_CONN_LESS:
097db76c 5308 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 5309 skb_pull(skb, 2);
5310 l2cap_conless_channel(conn, psm, skb);
5311 break;
5312
9f69bda6
GP		 5313 case L2CAP_CID_LE_DATA:
5314 l2cap_att_channel(conn, cid, skb);
5315 break;
5316
b501d6a1
AB		 5317 case L2CAP_CID_SMP:
5318 if (smp_sig_channel(conn, skb))
5319 l2cap_conn_del(conn->hcon, EACCES);
5320 break;
5321
1da177e4
LT		 5322 default:
5323 l2cap_data_channel(conn, cid, skb);
5324 break;
5325 }
5326}
5327
5328/* ---- L2CAP interface with lower layer (HCI) ---- */
5329
686ebf28 5330int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 5331{
5332 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 5333 struct l2cap_chan *c;
1da177e4 5334
1da177e4
LT		 5335 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
5336
5337 /* Find listening sockets and check their link_mode */
23691d75
GP		 5338 read_lock(&chan_list_lock);
5339 list_for_each_entry(c, &chan_list, global_l) {
5340 struct sock *sk = c->sk;
4343478f 5341
89bc500e 5342 if (c->state != BT_LISTEN)
1da177e4
LT		 5343 continue;
5344
5345 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 5346 lm1 |= HCI_LM_ACCEPT;
43bd0f32 5347 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 5348 lm1 |= HCI_LM_MASTER;
1da177e4 5349 exact++;
2af6b9d5
MH		 5350 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
5351 lm2 |= HCI_LM_ACCEPT;
43bd0f32 5352 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 5353 lm2 |= HCI_LM_MASTER;
5354 }
1da177e4 5355 }
23691d75 5356 read_unlock(&chan_list_lock);
1da177e4
LT		 5357
5358 return exact ? lm1 : lm2;
5359}
5360
686ebf28 5361int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 5362{
0139418c
MH		 5363 struct l2cap_conn *conn;
5364
1da177e4
LT		 5365 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
5366
1da177e4 5367 if (!status) {
1da177e4
LT		 5368 conn = l2cap_conn_add(hcon, status);
5369 if (conn)
5370 l2cap_conn_ready(conn);
0139418c 5371 } else
e175072f 5372 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 5373
5374 return 0;
5375}
5376
686ebf28 5377int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 5378{
5379 struct l2cap_conn *conn = hcon->l2cap_data;
5380
5381 BT_DBG("hcon %p", hcon);
5382
686ebf28 5383 if (!conn)
9f5a0d7b 5384 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 5385 return conn->disc_reason;
5386}
5387
686ebf28 5388int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 5389{
5390 BT_DBG("hcon %p reason %d", hcon, reason);
5391
e175072f 5392 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 5393 return 0;
5394}
5395
4343478f 5396static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 5397{
715ec005 5398 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 5399 return;
5400
f62e4323 5401 if (encrypt == 0x00) {
4343478f 5402 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 5403 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 5404 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 5405 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 5406 } else {
4343478f 5407 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 5408 __clear_chan_timer(chan);
f62e4323
MH		 5409 }
5410}
5411
686ebf28 5412int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 5413{
0139418c 5414 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 5415 struct l2cap_chan *chan;
1da177e4 5416
0139418c 5417 if (!conn)
1da177e4 5418 return 0;
0139418c 5419
1da177e4
LT		 5420 BT_DBG("conn %p", conn);
5421
160dc6ac 5422 if (hcon->type == LE_LINK) {
35d4adcc
HG		 5423 if (!status && encrypt)
5424 smp_distribute_keys(conn, 0);
17cd3f37 5425 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 5426 }
5427
3df91ea2 5428 mutex_lock(&conn->chan_lock);
1da177e4 5429
3df91ea2 5430 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 5431 l2cap_chan_lock(chan);
1da177e4 5432
f1cb9af5
VCG		 5433 BT_DBG("chan->scid %d", chan->scid);
5434
5435 if (chan->scid == L2CAP_CID_LE_DATA) {
5436 if (!status && encrypt) {
5437 chan->sec_level = hcon->sec_level;
cf4cd009 5438 l2cap_chan_ready(chan);
f1cb9af5
VCG		 5439 }
5440
6be36555 5441 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 5442 continue;
5443 }
5444
c1360a1c 5445 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 5446 l2cap_chan_unlock(chan);
6a8d3010
MH		 5447 continue;
5448 }
5449
89bc500e
GP		 5450 if (!status && (chan->state == BT_CONNECTED ||
5451 chan->state == BT_CONFIG)) {
a7d7723a
GP		 5452 struct sock *sk = chan->sk;
5453
c5daa683 5454 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
a7d7723a
GP		 5455 sk->sk_state_change(sk);
5456
4343478f 5457 l2cap_check_encryption(chan, encrypt);
6be36555 5458 l2cap_chan_unlock(chan);
9719f8af
MH		 5459 continue;
5460 }
5461
89bc500e 5462 if (chan->state == BT_CONNECT) {
b1235d79 5463 if (!status) {
9b27f350 5464 l2cap_send_conn_req(chan);
b1235d79 5465 } else {
ba13ccd9 5466 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 5467 }
89bc500e 5468 } else if (chan->state == BT_CONNECT2) {
6be36555 5469 struct sock *sk = chan->sk;
b1235d79 5470 struct l2cap_conn_rsp rsp;
df3c3931 5471 __u16 res, stat;
1da177e4 5472
6be36555
AE		 5473 lock_sock(sk);
5474
b1235d79 5475 if (!status) {
c5daa683
GP		 5476 if (test_bit(BT_SK_DEFER_SETUP,
5477 &bt_sk(sk)->flags)) {
df3c3931
JH		 5478 struct sock *parent = bt_sk(sk)->parent;
5479 res = L2CAP_CR_PEND;
5480 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 5481 if (parent)
5482 parent->sk_data_ready(parent, 0);
df3c3931 5483 } else {
0e587be7 5484 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 5485 res = L2CAP_CR_SUCCESS;
5486 stat = L2CAP_CS_NO_INFO;
5487 }
b1235d79 5488 } else {
0e587be7 5489 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 5490 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 5491 res = L2CAP_CR_SEC_BLOCK;
5492 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 5493 }
5494
6be36555
AE		 5495 release_sock(sk);
5496
fe4128e0
GP		 5497 rsp.scid = cpu_to_le16(chan->dcid);
5498 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 5499 rsp.result = cpu_to_le16(res);
5500 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 5501 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
5502 sizeof(rsp), &rsp);
b1235d79 5503 }
1da177e4 5504
6be36555 5505 l2cap_chan_unlock(chan);
1da177e4
LT		 5506 }
5507
3df91ea2 5508 mutex_unlock(&conn->chan_lock);
b1235d79 5509
1da177e4
LT		 5510 return 0;
5511}
5512
686ebf28 5513int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 5514{
5515 struct l2cap_conn *conn = hcon->l2cap_data;
5516
5a08ecce
AE		 5517 if (!conn)
5518 conn = l2cap_conn_add(hcon, 0);
5519
5520 if (!conn)
1da177e4
LT		 5521 goto drop;
5522
5523 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
5524
e702112f 5525 if (!(flags & ACL_CONT)) {
1da177e4
LT		 5526 struct l2cap_hdr *hdr;
5527 int len;
5528
5529 if (conn->rx_len) {
5530 BT_ERR("Unexpected start frame (len %d)", skb->len);
5531 kfree_skb(conn->rx_skb);
5532 conn->rx_skb = NULL;
5533 conn->rx_len = 0;
5534 l2cap_conn_unreliable(conn, ECOMM);
5535 }
5536
aae7fe22
AE		 5537 /* Start fragment always begin with Basic L2CAP header */
5538 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 5539 BT_ERR("Frame is too short (len %d)", skb->len);
5540 l2cap_conn_unreliable(conn, ECOMM);
5541 goto drop;
5542 }
5543
5544 hdr = (struct l2cap_hdr *) skb->data;
5545 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
5546
5547 if (len == skb->len) {
5548 /* Complete frame received */
5549 l2cap_recv_frame(conn, skb);
5550 return 0;
5551 }
5552
5553 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
5554
5555 if (skb->len > len) {
5556 BT_ERR("Frame is too long (len %d, expected len %d)",
5557 skb->len, len);
5558 l2cap_conn_unreliable(conn, ECOMM);
5559 goto drop;
5560 }
5561
5562 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 5563 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
5564 if (!conn->rx_skb)
1da177e4
LT		 5565 goto drop;
5566
d626f62b 5567 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5568 skb->len);
1da177e4
LT		 5569 conn->rx_len = len - skb->len;
5570 } else {
5571 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5572
5573 if (!conn->rx_len) {
5574 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5575 l2cap_conn_unreliable(conn, ECOMM);
5576 goto drop;
5577 }
5578
5579 if (skb->len > conn->rx_len) {
5580 BT_ERR("Fragment is too long (len %d, expected %d)",
5581 skb->len, conn->rx_len);
5582 kfree_skb(conn->rx_skb);
5583 conn->rx_skb = NULL;
5584 conn->rx_len = 0;
5585 l2cap_conn_unreliable(conn, ECOMM);
5586 goto drop;
5587 }
5588
d626f62b 5589 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5590 skb->len);
1da177e4
LT		 5591 conn->rx_len -= skb->len;
5592
5593 if (!conn->rx_len) {
5594 /* Complete frame received */
5595 l2cap_recv_frame(conn, conn->rx_skb);
5596 conn->rx_skb = NULL;
5597 }
5598 }
5599
5600drop:
5601 kfree_skb(skb);
5602 return 0;
5603}
5604
aef7d97c 5605static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5606{
23691d75 5607 struct l2cap_chan *c;
1da177e4 5608
333055f2 5609 read_lock(&chan_list_lock);
1da177e4 5610
23691d75
GP		 5611 list_for_each_entry(c, &chan_list, global_l) {
5612 struct sock *sk = c->sk;
101545f6 5613
903d343e 5614 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 5615 batostr(&bt_sk(sk)->src),
5616 batostr(&bt_sk(sk)->dst),
89bc500e 5617 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 5618 c->scid, c->dcid, c->imtu, c->omtu,
5619 c->sec_level, c->mode);
61e1b4b7 5620 }
1da177e4 5621
333055f2 5622 read_unlock(&chan_list_lock);
1da177e4 5623
aef7d97c 5624 return 0;
1da177e4
LT		 5625}
5626
aef7d97c
MH		 5627static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5628{
5629 return single_open(file, l2cap_debugfs_show, inode->i_private);
5630}
5631
5632static const struct file_operations l2cap_debugfs_fops = {
5633 .open = l2cap_debugfs_open,
5634 .read = seq_read,
5635 .llseek = seq_lseek,
5636 .release = single_release,
5637};
5638
5639static struct dentry *l2cap_debugfs;
1da177e4 5640
64274518 5641int __init l2cap_init(void)
1da177e4
LT		 5642{
5643 int err;
be9d1227 5644
bb58f747 5645 err = l2cap_init_sockets();
1da177e4
LT		 5646 if (err < 0)
5647 return err;
5648
aef7d97c
MH		 5649 if (bt_debugfs) {
5650 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5651 bt_debugfs, NULL, &l2cap_debugfs_fops);
5652 if (!l2cap_debugfs)
5653 BT_ERR("Failed to create L2CAP debug file");
5654 }
1da177e4 5655
1da177e4 5656 return 0;
1da177e4
LT		 5657}
5658
64274518 5659void l2cap_exit(void)
1da177e4 5660{
aef7d97c 5661 debugfs_remove(l2cap_debugfs);
bb58f747 5662 l2cap_cleanup_sockets();
1da177e4
LT		 5663}
5664
d1c4a17d
GP		 5665module_param(disable_ertm, bool, 0644);
5666MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)