projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: mgmt: Use __constant when dealing with constants
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
1da177e4
LT		 35
36#include <net/bluetooth/bluetooth.h>
37#include <net/bluetooth/hci_core.h>
38#include <net/bluetooth/l2cap.h>
b501d6a1 39#include <net/bluetooth/smp.h>
97e8e89d 40#include <net/bluetooth/a2mp.h>
1da177e4 41
d1de6d46 42bool disable_ertm;
f0709e03 43
47ec1dcd 44static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 45static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 46
b5ad8b7f
JB		 47static LIST_HEAD(chan_list);
48static DEFINE_RWLOCK(chan_list_lock);
1da177e4 49
1da177e4 50static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 51 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 52static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 53 void *data);
710f9b0a 54static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a 55static void l2cap_send_disconn_req(struct l2cap_conn *conn,
c5daa683 56 struct l2cap_chan *chan, int err);
1da177e4 57
d660366d 58static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 59 struct sk_buff_head *skbs, u8 event);
608bcc6d 60
0139418c 61/* ---- L2CAP channels ---- */
71ba0e56 62
2d792818
GP		 63static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
64 u16 cid)
0139418c 65{
3df91ea2 66 struct l2cap_chan *c;
3d57dc68 67
3df91ea2
AE		 68 list_for_each_entry(c, &conn->chan_l, list) {
69 if (c->dcid == cid)
70 return c;
0139418c 71 }
3df91ea2 72 return NULL;
0139418c
MH		 73}
74
2d792818
GP		 75static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
76 u16 cid)
0139418c 77{
3df91ea2 78 struct l2cap_chan *c;
3d57dc68 79
3df91ea2
AE		 80 list_for_each_entry(c, &conn->chan_l, list) {
81 if (c->scid == cid)
82 return c;
0139418c 83 }
3df91ea2 84 return NULL;
0139418c
MH		 85}
86
87/* Find channel with given SCID.
ef191ade 88 * Returns locked channel. */
2d792818
GP		 89static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
90 u16 cid)
0139418c 91{
48454079 92 struct l2cap_chan *c;
baa7e1fa 93
3df91ea2 94 mutex_lock(&conn->chan_lock);
baa7e1fa 95 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 96 if (c)
97 l2cap_chan_lock(c);
3df91ea2
AE		 98 mutex_unlock(&conn->chan_lock);
99
48454079 100 return c;
0139418c
MH		 101}
102
b1a130b7
MM		 103/* Find channel with given DCID.
104 * Returns locked channel.
105 */
106static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
107 u16 cid)
108{
109 struct l2cap_chan *c;
110
111 mutex_lock(&conn->chan_lock);
112 c = __l2cap_get_chan_by_dcid(conn, cid);
113 if (c)
114 l2cap_chan_lock(c);
115 mutex_unlock(&conn->chan_lock);
116
117 return c;
118}
119
2d792818
GP		 120static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
121 u8 ident)
0139418c 122{
3df91ea2 123 struct l2cap_chan *c;
3d57dc68 124
3df91ea2
AE		 125 list_for_each_entry(c, &conn->chan_l, list) {
126 if (c->ident == ident)
127 return c;
0139418c 128 }
3df91ea2 129 return NULL;
0139418c
MH		 130}
131
5b155ef9
MM		 132static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
133 u8 ident)
134{
135 struct l2cap_chan *c;
136
137 mutex_lock(&conn->chan_lock);
138 c = __l2cap_get_chan_by_ident(conn, ident);
139 if (c)
140 l2cap_chan_lock(c);
141 mutex_unlock(&conn->chan_lock);
142
143 return c;
144}
145
23691d75 146static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 147{
23691d75 148 struct l2cap_chan *c;
9e4425ff 149
23691d75
GP		 150 list_for_each_entry(c, &chan_list, global_l) {
151 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 152 return c;
9e4425ff 153 }
250938cb 154 return NULL;
9e4425ff
GP		 155}
156
157int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
158{
73b2ec18
GP		 159 int err;
160
333055f2 161 write_lock(&chan_list_lock);
9e4425ff 162
23691d75 163 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 164 err = -EADDRINUSE;
165 goto done;
9e4425ff
GP		 166 }
167
73b2ec18
GP		 168 if (psm) {
169 chan->psm = psm;
170 chan->sport = psm;
171 err = 0;
172 } else {
173 u16 p;
174
175 err = -EINVAL;
176 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 177 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 178 chan->psm = cpu_to_le16(p);
179 chan->sport = cpu_to_le16(p);
180 err = 0;
181 break;
182 }
183 }
9e4425ff 184
73b2ec18 185done:
333055f2 186 write_unlock(&chan_list_lock);
73b2ec18 187 return err;
9e4425ff
GP		 188}
189
190int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
191{
333055f2 192 write_lock(&chan_list_lock);
9e4425ff
GP		 193
194 chan->scid = scid;
195
333055f2 196 write_unlock(&chan_list_lock);
9e4425ff
GP		 197
198 return 0;
199}
200
baa7e1fa 201static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 202{
8db4dc46 203 u16 cid = L2CAP_CID_DYN_START;
0139418c 204
8db4dc46 205 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 206 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 207 return cid;
208 }
209
210 return 0;
211}
212
0e587be7 213static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 214{
42d2d87c 215 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 216 state_to_string(state));
badaaa00 217
89bc500e 218 chan->state = state;
80b98027 219 chan->ops->state_change(chan, state);
89bc500e
GP		 220}
221
0e587be7
AE		 222static void l2cap_state_change(struct l2cap_chan *chan, int state)
223{
224 struct sock *sk = chan->sk;
225
226 lock_sock(sk);
227 __l2cap_state_change(chan, state);
228 release_sock(sk);
229}
230
2e0052e4
AE		 231static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
232{
233 struct sock *sk = chan->sk;
234
235 sk->sk_err = err;
236}
237
238static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
239{
240 struct sock *sk = chan->sk;
241
242 lock_sock(sk);
243 __l2cap_chan_set_err(chan, err);
244 release_sock(sk);
245}
246
4239d16f
MM		 247static void __set_retrans_timer(struct l2cap_chan *chan)
248{
249 if (!delayed_work_pending(&chan->monitor_timer) &&
250 chan->retrans_timeout) {
251 l2cap_set_timer(chan, &chan->retrans_timer,
252 msecs_to_jiffies(chan->retrans_timeout));
253 }
254}
255
256static void __set_monitor_timer(struct l2cap_chan *chan)
257{
258 __clear_retrans_timer(chan);
259 if (chan->monitor_timeout) {
260 l2cap_set_timer(chan, &chan->monitor_timer,
261 msecs_to_jiffies(chan->monitor_timeout));
262 }
263}
264
608bcc6d
MM		 265static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
266 u16 seq)
267{
268 struct sk_buff *skb;
269
270 skb_queue_walk(head, skb) {
271 if (bt_cb(skb)->control.txseq == seq)
272 return skb;
273 }
274
275 return NULL;
276}
277
3c588192
MM		 278/* ---- L2CAP sequence number lists ---- */
279
280/* For ERTM, ordered lists of sequence numbers must be tracked for
281 * SREJ requests that are received and for frames that are to be
282 * retransmitted. These seq_list functions implement a singly-linked
283 * list in an array, where membership in the list can also be checked
284 * in constant time. Items can also be added to the tail of the list
285 * and removed from the head in constant time, without further memory
286 * allocs or frees.
287 */
288
289static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
290{
291 size_t alloc_size, i;
292
293 /* Allocated size is a power of 2 to map sequence numbers
294 * (which may be up to 14 bits) in to a smaller array that is
295 * sized for the negotiated ERTM transmit windows.
296 */
297 alloc_size = roundup_pow_of_two(size);
298
299 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
300 if (!seq_list->list)
301 return -ENOMEM;
302
303 seq_list->mask = alloc_size - 1;
304 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
305 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
306 for (i = 0; i < alloc_size; i++)
307 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
308
309 return 0;
310}
311
312static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
313{
314 kfree(seq_list->list);
315}
316
317static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
318 u16 seq)
319{
320 /* Constant-time check for list membership */
321 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
322}
323
324static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
325{
326 u16 mask = seq_list->mask;
327
328 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
329 /* In case someone tries to pop the head of an empty list */
330 return L2CAP_SEQ_LIST_CLEAR;
331 } else if (seq_list->head == seq) {
332 /* Head can be removed in constant time */
333 seq_list->head = seq_list->list[seq & mask];
334 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
335
336 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
337 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
338 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
339 }
340 } else {
341 /* Walk the list to find the sequence number */
342 u16 prev = seq_list->head;
343 while (seq_list->list[prev & mask] != seq) {
344 prev = seq_list->list[prev & mask];
345 if (prev == L2CAP_SEQ_LIST_TAIL)
346 return L2CAP_SEQ_LIST_CLEAR;
347 }
348
349 /* Unlink the number from the list and clear it */
350 seq_list->list[prev & mask] = seq_list->list[seq & mask];
351 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
352 if (seq_list->tail == seq)
353 seq_list->tail = prev;
354 }
355 return seq;
356}
357
358static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
359{
360 /* Remove the head in constant time */
361 return l2cap_seq_list_remove(seq_list, seq_list->head);
362}
363
364static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
365{
f522ae36 366 u16 i;
3c588192 367
f522ae36
GP		 368 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
369 return;
370
371 for (i = 0; i <= seq_list->mask; i++)
372 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
373
374 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
375 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 376}
377
378static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
379{
380 u16 mask = seq_list->mask;
381
382 /* All appends happen in constant time */
383
f522ae36
GP		 384 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
385 return;
3c588192 386
f522ae36
GP		 387 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
388 seq_list->head = seq;
389 else
390 seq_list->list[seq_list->tail & mask] = seq;
391
392 seq_list->tail = seq;
393 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 394}
395
721c4181 396static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 397{
721c4181 398 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 399 chan_timer.work);
3df91ea2 400 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 401 int reason;
402
e05dcc32 403 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 404
3df91ea2 405 mutex_lock(&conn->chan_lock);
6be36555 406 l2cap_chan_lock(chan);
ab07801d 407
89bc500e 408 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 409 reason = ECONNREFUSED;
89bc500e 410 else if (chan->state == BT_CONNECT &&
2d792818 411 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 412 reason = ECONNREFUSED;
413 else
414 reason = ETIMEDOUT;
415
0f852724 416 l2cap_chan_close(chan, reason);
ab07801d 417
6be36555 418 l2cap_chan_unlock(chan);
ab07801d 419
80b98027 420 chan->ops->close(chan);
3df91ea2
AE		 421 mutex_unlock(&conn->chan_lock);
422
371fd835 423 l2cap_chan_put(chan);
ab07801d
GP		 424}
425
eef1d9b6 426struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 427{
428 struct l2cap_chan *chan;
429
430 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
431 if (!chan)
432 return NULL;
433
c03b355e
AE		 434 mutex_init(&chan->lock);
435
333055f2 436 write_lock(&chan_list_lock);
23691d75 437 list_add(&chan->global_l, &chan_list);
333055f2 438 write_unlock(&chan_list_lock);
23691d75 439
721c4181 440 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 441
89bc500e
GP		 442 chan->state = BT_OPEN;
443
144ad330 444 kref_init(&chan->kref);
71ba0e56 445
2827011f
MM		 446 /* This flag is cleared in l2cap_chan_ready() */
447 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
448
eef1d9b6 449 BT_DBG("chan %p", chan);
abc545b8 450
48454079
GP		 451 return chan;
452}
453
144ad330 454static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 455{
144ad330
SS		 456 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
457
4af66c69
JK		 458 BT_DBG("chan %p", chan);
459
333055f2 460 write_lock(&chan_list_lock);
23691d75 461 list_del(&chan->global_l);
333055f2 462 write_unlock(&chan_list_lock);
23691d75 463
4af66c69 464 kfree(chan);
6ff5abbf
GP		 465}
466
30648372
JK		 467void l2cap_chan_hold(struct l2cap_chan *c)
468{
144ad330 469 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 470
144ad330 471 kref_get(&c->kref);
30648372
JK		 472}
473
474void l2cap_chan_put(struct l2cap_chan *c)
475{
144ad330 476 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 477
144ad330 478 kref_put(&c->kref, l2cap_chan_destroy);
30648372
JK		 479}
480
bd4b1653
AE		 481void l2cap_chan_set_defaults(struct l2cap_chan *chan)
482{
483 chan->fcs = L2CAP_FCS_CRC16;
484 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
485 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
486 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
c20f8e35 487 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653
AE		 488 chan->sec_level = BT_SECURITY_LOW;
489
490 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
491}
492
93c3e8f5 493void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 494{
af05b30b 495 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 496 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 497
9f5a0d7b 498 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 499
8c1d787b 500 chan->conn = conn;
0139418c 501
5491120e
AE		 502 switch (chan->chan_type) {
503 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 504 if (conn->hcon->type == LE_LINK) {
505 /* LE connection */
6fcb06a2 506 chan->omtu = L2CAP_DEFAULT_MTU;
fe4128e0
GP		 507 chan->scid = L2CAP_CID_LE_DATA;
508 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 509 } else {
510 /* Alloc CID for connection-oriented socket */
fe4128e0 511 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 512 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 513 }
5491120e
AE		 514 break;
515
516 case L2CAP_CHAN_CONN_LESS:
0139418c 517 /* Connectionless socket */
fe4128e0
GP		 518 chan->scid = L2CAP_CID_CONN_LESS;
519 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 520 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 521 break;
522
416fa752
AE		 523 case L2CAP_CHAN_CONN_FIX_A2MP:
524 chan->scid = L2CAP_CID_A2MP;
525 chan->dcid = L2CAP_CID_A2MP;
526 chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
527 chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
528 break;
529
5491120e 530 default:
0139418c 531 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 532 chan->scid = L2CAP_CID_SIGNALING;
533 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 534 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 535 }
536
8f7975b1
AE		 537 chan->local_id = L2CAP_BESTEFFORT_ID;
538 chan->local_stype = L2CAP_SERV_BESTEFFORT;
539 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
540 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
541 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 542 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 543
371fd835 544 l2cap_chan_hold(chan);
baa7e1fa 545
3df91ea2 546 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 547}
548
466f8004 549void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 550{
551 mutex_lock(&conn->chan_lock);
552 __l2cap_chan_add(conn, chan);
3df91ea2 553 mutex_unlock(&conn->chan_lock);
0139418c
MH		 554}
555
466f8004 556void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 557{
8c1d787b 558 struct l2cap_conn *conn = chan->conn;
0139418c 559
c9b66675 560 __clear_chan_timer(chan);
0139418c 561
49208c9c 562 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 563
8e87d142 564 if (conn) {
56f60984 565 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 566 /* Delete from channel list */
3df91ea2 567 list_del(&chan->list);
3d57dc68 568
371fd835 569 l2cap_chan_put(chan);
baa7e1fa 570
8c1d787b 571 chan->conn = NULL;
3cabbfda
AE		 572
573 if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
574 hci_conn_put(conn->hcon);
56f60984
AE		 575
576 if (mgr && mgr->bredr_chan == chan)
577 mgr->bredr_chan = NULL;
0139418c
MH		 578 }
579
b699ec0d 580 chan->ops->teardown(chan, err);
6be36555 581
2827011f 582 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 583 return;
2ead70b8 584
ee556f66
GP		 585 switch(chan->mode) {
586 case L2CAP_MODE_BASIC:
587 break;
c13ffa62 588
ee556f66 589 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 590 __clear_retrans_timer(chan);
591 __clear_monitor_timer(chan);
592 __clear_ack_timer(chan);
c13ffa62 593
f1c6775b 594 skb_queue_purge(&chan->srej_q);
c13ffa62 595
3c588192
MM		 596 l2cap_seq_list_free(&chan->srej_list);
597 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 598
599 /* fall through */
600
601 case L2CAP_MODE_STREAMING:
602 skb_queue_purge(&chan->tx_q);
603 break;
c13ffa62 604 }
ee556f66
GP		 605
606 return;
0139418c
MH		 607}
608
0f852724 609void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 610{
611 struct l2cap_conn *conn = chan->conn;
612 struct sock *sk = chan->sk;
613
2d792818
GP		 614 BT_DBG("chan %p state %s sk %p", chan, state_to_string(chan->state),
615 sk);
4519de9a 616
89bc500e 617 switch (chan->state) {
4519de9a 618 case BT_LISTEN:
b699ec0d 619 chan->ops->teardown(chan, 0);
4519de9a
GP		 620 break;
621
622 case BT_CONNECTED:
623 case BT_CONFIG:
715ec005 624 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
2d792818 625 conn->hcon->type == ACL_LINK) {
c9b66675 626 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 627 l2cap_send_disconn_req(conn, chan, reason);
628 } else
629 l2cap_chan_del(chan, reason);
630 break;
631
632 case BT_CONNECT2:
715ec005 633 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
2d792818 634 conn->hcon->type == ACL_LINK) {
4519de9a
GP		 635 struct l2cap_conn_rsp rsp;
636 __u16 result;
637
c5daa683 638 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
4519de9a
GP		 639 result = L2CAP_CR_SEC_BLOCK;
640 else
641 result = L2CAP_CR_BAD_PSM;
89bc500e 642 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 643
644 rsp.scid = cpu_to_le16(chan->dcid);
645 rsp.dcid = cpu_to_le16(chan->scid);
646 rsp.result = cpu_to_le16(result);
ac73498c 647 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4519de9a 648 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 649 sizeof(rsp), &rsp);
4519de9a
GP		 650 }
651
652 l2cap_chan_del(chan, reason);
653 break;
654
655 case BT_CONNECT:
656 case BT_DISCONN:
657 l2cap_chan_del(chan, reason);
658 break;
659
660 default:
b699ec0d 661 chan->ops->teardown(chan, 0);
4519de9a
GP		 662 break;
663 }
664}
665
4343478f 666static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 667{
715ec005 668 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 669 switch (chan->sec_level) {
8556edd3
JH		 670 case BT_SECURITY_HIGH:
671 return HCI_AT_DEDICATED_BONDING_MITM;
672 case BT_SECURITY_MEDIUM:
673 return HCI_AT_DEDICATED_BONDING;
674 default:
675 return HCI_AT_NO_BONDING;
676 }
2983fd68 677 } else if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
4343478f
GP		 678 if (chan->sec_level == BT_SECURITY_LOW)
679 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 680
4343478f 681 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 682 return HCI_AT_NO_BONDING_MITM;
00ae4af9 683 else
8556edd3 684 return HCI_AT_NO_BONDING;
00ae4af9 685 } else {
4343478f 686 switch (chan->sec_level) {
00ae4af9 687 case BT_SECURITY_HIGH:
8556edd3 688 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 689 case BT_SECURITY_MEDIUM:
8556edd3 690 return HCI_AT_GENERAL_BONDING;
00ae4af9 691 default:
8556edd3 692 return HCI_AT_NO_BONDING;
00ae4af9 693 }
0684e5f9 694 }
8556edd3
JH		 695}
696
697/* Service level security */
d45fc423 698int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 699{
8c1d787b 700 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 701 __u8 auth_type;
702
4343478f 703 auth_type = l2cap_get_auth_type(chan);
79d554a6 704
4343478f 705 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 706}
707
b5ad8b7f 708static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 709{
710 u8 id;
711
712 /* Get next available identificator.
713 * 1 - 128 are used by kernel.
714 * 129 - 199 are reserved.
715 * 200 - 254 are used by utilities like l2ping, etc.
716 */
717
333055f2 718 spin_lock(&conn->lock);
4e8402a3
MH		 719
720 if (++conn->tx_ident > 128)
721 conn->tx_ident = 1;
722
723 id = conn->tx_ident;
724
333055f2 725 spin_unlock(&conn->lock);
4e8402a3
MH		 726
727 return id;
728}
729
2d792818
GP		 730static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
731 void *data)
4e8402a3
MH		 732{
733 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 734 u8 flags;
4e8402a3
MH		 735
736 BT_DBG("code 0x%2.2x", code);
737
738 if (!skb)
9a9c6a34 739 return;
4e8402a3 740
e702112f
AE		 741 if (lmp_no_flush_capable(conn->hcon->hdev))
742 flags = ACL_START_NO_FLUSH;
743 else
744 flags = ACL_START;
745
14b12d0b 746 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 747 skb->priority = HCI_PRIO_MAX;
14b12d0b 748
73d80deb
LAD		 749 hci_send_acl(conn->hchan, skb, flags);
750}
751
02b0fbb9
MM		 752static bool __chan_is_moving(struct l2cap_chan *chan)
753{
754 return chan->move_state != L2CAP_MOVE_STABLE &&
755 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
756}
757
73d80deb
LAD		 758static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
759{
760 struct hci_conn *hcon = chan->conn->hcon;
761 u16 flags;
762
763 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 764 skb->priority);
73d80deb 765
d5f8a75d
MM		 766 if (chan->hs_hcon && !__chan_is_moving(chan)) {
767 if (chan->hs_hchan)
768 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
769 else
770 kfree_skb(skb);
771
772 return;
773 }
774
73d80deb 775 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
2d792818 776 lmp_no_flush_capable(hcon->hdev))
73d80deb
LAD		 777 flags = ACL_START_NO_FLUSH;
778 else
779 flags = ACL_START;
14b12d0b 780
73d80deb
LAD		 781 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
782 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 783}
784
b76bbd66
MM		 785static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
786{
787 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
788 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
789
790 if (enh & L2CAP_CTRL_FRAME_TYPE) {
791 /* S-Frame */
792 control->sframe = 1;
793 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
794 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
795
796 control->sar = 0;
797 control->txseq = 0;
798 } else {
799 /* I-Frame */
800 control->sframe = 0;
801 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
802 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
803
804 control->poll = 0;
805 control->super = 0;
806 }
807}
808
b76bbd66
MM		 809static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
810{
811 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
812 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
813
814 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
815 /* S-Frame */
816 control->sframe = 1;
817 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
818 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
819
820 control->sar = 0;
821 control->txseq = 0;
822 } else {
823 /* I-Frame */
824 control->sframe = 0;
825 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
826 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
827
828 control->poll = 0;
829 control->super = 0;
830 }
831}
832
833static inline void __unpack_control(struct l2cap_chan *chan,
834 struct sk_buff *skb)
835{
836 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
837 __unpack_extended_control(get_unaligned_le32(skb->data),
838 &bt_cb(skb)->control);
cec8ab6e 839 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 840 } else {
841 __unpack_enhanced_control(get_unaligned_le16(skb->data),
842 &bt_cb(skb)->control);
cec8ab6e 843 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 844 }
845}
846
b5c6aaed
MM		 847static u32 __pack_extended_control(struct l2cap_ctrl *control)
848{
849 u32 packed;
850
851 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
852 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
853
854 if (control->sframe) {
855 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
856 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
857 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
858 } else {
859 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
860 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
861 }
862
863 return packed;
864}
865
866static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
867{
868 u16 packed;
869
870 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
871 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
872
873 if (control->sframe) {
874 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
875 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
876 packed |= L2CAP_CTRL_FRAME_TYPE;
877 } else {
878 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
879 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
880 }
881
882 return packed;
883}
884
b76bbd66
MM		 885static inline void __pack_control(struct l2cap_chan *chan,
886 struct l2cap_ctrl *control,
887 struct sk_buff *skb)
888{
889 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
890 put_unaligned_le32(__pack_extended_control(control),
891 skb->data + L2CAP_HDR_SIZE);
892 } else {
893 put_unaligned_le16(__pack_enhanced_control(control),
894 skb->data + L2CAP_HDR_SIZE);
895 }
896}
897
ba7aa64f
GP		 898static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
899{
900 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
901 return L2CAP_EXT_HDR_SIZE;
902 else
903 return L2CAP_ENH_HDR_SIZE;
904}
905
a67d7f6f
MM		 906static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
907 u32 control)
b5c6aaed
MM		 908{
909 struct sk_buff *skb;
910 struct l2cap_hdr *lh;
ba7aa64f 911 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 912
913 if (chan->fcs == L2CAP_FCS_CRC16)
914 hlen += L2CAP_FCS_SIZE;
915
a67d7f6f 916 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 917
b5c6aaed 918 if (!skb)
a67d7f6f 919 return ERR_PTR(-ENOMEM);
b5c6aaed
MM		 920
921 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
922 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
923 lh->cid = cpu_to_le16(chan->dcid);
924
a67d7f6f
MM		 925 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
926 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
927 else
928 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 929
930 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 931 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 932 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
933 }
934
935 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 936 return skb;
937}
938
939static void l2cap_send_sframe(struct l2cap_chan *chan,
940 struct l2cap_ctrl *control)
941{
942 struct sk_buff *skb;
943 u32 control_field;
944
945 BT_DBG("chan %p, control %p", chan, control);
946
947 if (!control->sframe)
948 return;
949
b99e13ad
MM		 950 if (__chan_is_moving(chan))
951 return;
952
a67d7f6f
MM		 953 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
954 !control->poll)
955 control->final = 1;
956
957 if (control->super == L2CAP_SUPER_RR)
958 clear_bit(CONN_RNR_SENT, &chan->conn_state);
959 else if (control->super == L2CAP_SUPER_RNR)
960 set_bit(CONN_RNR_SENT, &chan->conn_state);
961
962 if (control->super != L2CAP_SUPER_SREJ) {
963 chan->last_acked_seq = control->reqseq;
964 __clear_ack_timer(chan);
965 }
966
967 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
968 control->final, control->poll, control->super);
969
970 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
971 control_field = __pack_extended_control(control);
972 else
973 control_field = __pack_enhanced_control(control);
974
975 skb = l2cap_create_sframe_pdu(chan, control_field);
976 if (!IS_ERR(skb))
977 l2cap_do_send(chan, skb);
b5c6aaed
MM		 978}
979
c9e3d5e0 980static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 981{
c9e3d5e0
MM		 982 struct l2cap_ctrl control;
983
984 BT_DBG("chan %p, poll %d", chan, poll);
985
986 memset(&control, 0, sizeof(control));
987 control.sframe = 1;
988 control.poll = poll;
989
990 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
991 control.super = L2CAP_SUPER_RNR;
992 else
993 control.super = L2CAP_SUPER_RR;
b5c6aaed 994
c9e3d5e0
MM		 995 control.reqseq = chan->buffer_seq;
996 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 997}
998
b4450035 999static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 1000{
c1360a1c 1001 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 1002}
1003
93c3e8f5
AE		 1004static bool __amp_capable(struct l2cap_chan *chan)
1005{
1006 struct l2cap_conn *conn = chan->conn;
1007
1008 if (enable_hs &&
1009 chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&
1010 conn->fixed_chan_mask & L2CAP_FC_A2MP)
1011 return true;
1012 else
1013 return false;
1014}
1015
2766be48 1016void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 1017{
1018 struct l2cap_conn *conn = chan->conn;
1019 struct l2cap_conn_req req;
1020
1021 req.scid = cpu_to_le16(chan->scid);
1022 req.psm = chan->psm;
1023
1024 chan->ident = l2cap_get_ident(conn);
1025
1026 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1027
1028 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1029}
1030
8eb200bd
MM		 1031static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1032{
1033 struct l2cap_create_chan_req req;
1034 req.scid = cpu_to_le16(chan->scid);
1035 req.psm = chan->psm;
1036 req.amp_id = amp_id;
1037
1038 chan->ident = l2cap_get_ident(chan->conn);
1039
1040 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1041 sizeof(req), &req);
1042}
1043
02b0fbb9
MM		 1044static void l2cap_move_setup(struct l2cap_chan *chan)
1045{
1046 struct sk_buff *skb;
1047
1048 BT_DBG("chan %p", chan);
1049
1050 if (chan->mode != L2CAP_MODE_ERTM)
1051 return;
1052
1053 __clear_retrans_timer(chan);
1054 __clear_monitor_timer(chan);
1055 __clear_ack_timer(chan);
1056
1057 chan->retry_count = 0;
1058 skb_queue_walk(&chan->tx_q, skb) {
1059 if (bt_cb(skb)->control.retries)
1060 bt_cb(skb)->control.retries = 1;
1061 else
1062 break;
1063 }
1064
1065 chan->expected_tx_seq = chan->buffer_seq;
1066
1067 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1068 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1069 l2cap_seq_list_clear(&chan->retrans_list);
1070 l2cap_seq_list_clear(&chan->srej_list);
1071 skb_queue_purge(&chan->srej_q);
1072
1073 chan->tx_state = L2CAP_TX_STATE_XMIT;
1074 chan->rx_state = L2CAP_RX_STATE_MOVE;
1075
1076 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1077}
1078
5f3847a4
MM		 1079static void l2cap_move_done(struct l2cap_chan *chan)
1080{
1081 u8 move_role = chan->move_role;
1082 BT_DBG("chan %p", chan);
1083
1084 chan->move_state = L2CAP_MOVE_STABLE;
1085 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1086
1087 if (chan->mode != L2CAP_MODE_ERTM)
1088 return;
1089
1090 switch (move_role) {
1091 case L2CAP_MOVE_ROLE_INITIATOR:
1092 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1093 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1094 break;
1095 case L2CAP_MOVE_ROLE_RESPONDER:
1096 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1097 break;
1098 }
1099}
1100
9f0caeb1
VCG		 1101static void l2cap_chan_ready(struct l2cap_chan *chan)
1102{
2827011f 1103 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 1104 chan->conf_state = 0;
1105 __clear_chan_timer(chan);
1106
54a59aa2 1107 chan->state = BT_CONNECTED;
9f0caeb1 1108
fd83e2c2 1109 chan->ops->ready(chan);
9f0caeb1
VCG		 1110}
1111
93c3e8f5
AE		 1112static void l2cap_start_connection(struct l2cap_chan *chan)
1113{
1114 if (__amp_capable(chan)) {
1115 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1116 a2mp_discover_amp(chan);
1117 } else {
1118 l2cap_send_conn_req(chan);
1119 }
1120}
1121
fc7f8a7e 1122static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1123{
8c1d787b 1124 struct l2cap_conn *conn = chan->conn;
79d554a6 1125
9f0caeb1
VCG		 1126 if (conn->hcon->type == LE_LINK) {
1127 l2cap_chan_ready(chan);
1128 return;
1129 }
1130
79d554a6 1131 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 1132 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1133 return;
1134
d45fc423 1135 if (l2cap_chan_check_security(chan) &&
2d792818 1136 __l2cap_no_conn_pending(chan)) {
93c3e8f5
AE		 1137 l2cap_start_connection(chan);
1138 }
79d554a6
MH		 1139 } else {
1140 struct l2cap_info_req req;
ac73498c 1141 req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 1142
1143 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1144 conn->info_ident = l2cap_get_ident(conn);
1145
ba13ccd9 1146 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 1147
2d792818
GP		 1148 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1149 sizeof(req), &req);
79d554a6
MH		 1150 }
1151}
1152
cf6c2c0b
GP		 1153static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1154{
1155 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1156 if (!disable_ertm)
cf6c2c0b
GP		 1157 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1158
1159 switch (mode) {
1160 case L2CAP_MODE_ERTM:
1161 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1162 case L2CAP_MODE_STREAMING:
1163 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1164 default:
1165 return 0x00;
1166 }
1167}
1168
2d792818
GP		 1169static void l2cap_send_disconn_req(struct l2cap_conn *conn,
1170 struct l2cap_chan *chan, int err)
22121fc9 1171{
6be36555 1172 struct sock *sk = chan->sk;
22121fc9
GP		 1173 struct l2cap_disconn_req req;
1174
c13ffa62
GP		 1175 if (!conn)
1176 return;
1177
aad3d0e3 1178 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1179 __clear_retrans_timer(chan);
1180 __clear_monitor_timer(chan);
1181 __clear_ack_timer(chan);
c13ffa62
GP		 1182 }
1183
416fa752 1184 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
d117773c 1185 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1186 return;
1187 }
1188
fe4128e0
GP		 1189 req.dcid = cpu_to_le16(chan->dcid);
1190 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1191 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1192 sizeof(req), &req);
c13ffa62 1193
6be36555 1194 lock_sock(sk);
0e587be7 1195 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1196 __l2cap_chan_set_err(chan, err);
6be36555 1197 release_sock(sk);
22121fc9
GP		 1198}
1199
1da177e4 1200/* ---- L2CAP connections ---- */
4e8402a3
MH		 1201static void l2cap_conn_start(struct l2cap_conn *conn)
1202{
3df91ea2 1203 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1204
1205 BT_DBG("conn %p", conn);
1206
3df91ea2 1207 mutex_lock(&conn->chan_lock);
4e8402a3 1208
3df91ea2 1209 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1210 struct sock *sk = chan->sk;
baa7e1fa 1211
6be36555 1212 l2cap_chan_lock(chan);
4e8402a3 1213
715ec005 1214 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1215 l2cap_chan_unlock(chan);
79d554a6
MH		 1216 continue;
1217 }
1218
89bc500e 1219 if (chan->state == BT_CONNECT) {
d45fc423 1220 if (!l2cap_chan_check_security(chan) ||
2d792818 1221 !__l2cap_no_conn_pending(chan)) {
6be36555 1222 l2cap_chan_unlock(chan);
47731de7
GP		 1223 continue;
1224 }
79d554a6 1225
c1360a1c 1226 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1227 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1228 &chan->conf_state)) {
89bc500e 1229 l2cap_chan_close(chan, ECONNRESET);
6be36555 1230 l2cap_chan_unlock(chan);
47731de7 1231 continue;
b1235d79 1232 }
47731de7 1233
93c3e8f5 1234 l2cap_start_connection(chan);
47731de7 1235
89bc500e 1236 } else if (chan->state == BT_CONNECT2) {
79d554a6 1237 struct l2cap_conn_rsp rsp;
e9aeb2dd 1238 char buf[128];
fe4128e0
GP		 1239 rsp.scid = cpu_to_le16(chan->dcid);
1240 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1241
d45fc423 1242 if (l2cap_chan_check_security(chan)) {
6be36555 1243 lock_sock(sk);
c5daa683
GP		 1244 if (test_bit(BT_SK_DEFER_SETUP,
1245 &bt_sk(sk)->flags)) {
ac73498c
AE		 1246 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1247 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1248 chan->ops->defer(chan);
f66dc81f
MH		 1249
1250 } else {
0e587be7 1251 __l2cap_state_change(chan, BT_CONFIG);
ac73498c
AE		 1252 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
1253 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1254 }
6be36555 1255 release_sock(sk);
79d554a6 1256 } else {
ac73498c
AE		 1257 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1258 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1259 }
1260
fc7f8a7e 1261 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1262 sizeof(rsp), &rsp);
e9aeb2dd 1263
c1360a1c 1264 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1265 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1266 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1267 continue;
1268 }
1269
c1360a1c 1270 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1271 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 1272 l2cap_build_conf_req(chan, buf), buf);
73ffa904 1273 chan->num_conf_req++;
4e8402a3
MH		 1274 }
1275
6be36555 1276 l2cap_chan_unlock(chan);
4e8402a3
MH		 1277 }
1278
3df91ea2 1279 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1280}
1281
c2287681 1282/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1283 * Returns closest match, locked.
1284 */
d9b88702 1285static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1286 bdaddr_t *src,
1287 bdaddr_t *dst)
b62f328b 1288{
23691d75 1289 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1290
23691d75 1291 read_lock(&chan_list_lock);
b62f328b 1292
23691d75
GP		 1293 list_for_each_entry(c, &chan_list, global_l) {
1294 struct sock *sk = c->sk;
fe4128e0 1295
89bc500e 1296 if (state && c->state != state)
b62f328b
VT		 1297 continue;
1298
23691d75 1299 if (c->scid == cid) {
c2287681
IY		 1300 int src_match, dst_match;
1301 int src_any, dst_any;
1302
b62f328b 1303 /* Exact match. */
c2287681
IY		 1304 src_match = !bacmp(&bt_sk(sk)->src, src);
1305 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1306 if (src_match && dst_match) {
23691d75
GP		 1307 read_unlock(&chan_list_lock);
1308 return c;
1309 }
b62f328b
VT		 1310
1311 /* Closest match */
c2287681
IY		 1312 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1313 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1314 if ((src_match && dst_any) || (src_any && dst_match) ||
1315 (src_any && dst_any))
23691d75 1316 c1 = c;
b62f328b
VT		 1317 }
1318 }
280f294f 1319
23691d75 1320 read_unlock(&chan_list_lock);
b62f328b 1321
23691d75 1322 return c1;
b62f328b
VT		 1323}
1324
1325static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1326{
c916fbe4 1327 struct sock *parent, *sk;
23691d75 1328 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1329
1330 BT_DBG("");
1331
1332 /* Check if we have socket listening on cid */
23691d75 1333 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1334 conn->src, conn->dst);
23691d75 1335 if (!pchan)
b62f328b
VT		 1336 return;
1337
23691d75
GP		 1338 parent = pchan->sk;
1339
aa2ac881 1340 lock_sock(parent);
62f3a2cf 1341
80b98027 1342 chan = pchan->ops->new_connection(pchan);
80808e43 1343 if (!chan)
b62f328b
VT		 1344 goto clean;
1345
80808e43 1346 sk = chan->sk;
5d41ce1d 1347
b62f328b 1348 hci_conn_hold(conn->hcon);
a9ea3ed9 1349 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
b62f328b 1350
b62f328b
VT		 1351 bacpy(&bt_sk(sk)->src, conn->src);
1352 bacpy(&bt_sk(sk)->dst, conn->dst);
1353
3d57dc68 1354 l2cap_chan_add(conn, chan);
48454079 1355
6754e0df 1356 l2cap_chan_ready(chan);
b62f328b 1357
b62f328b 1358clean:
aa2ac881 1359 release_sock(parent);
b62f328b
VT		 1360}
1361
4e8402a3
MH		 1362static void l2cap_conn_ready(struct l2cap_conn *conn)
1363{
48454079 1364 struct l2cap_chan *chan;
cc110922 1365 struct hci_conn *hcon = conn->hcon;
4e8402a3 1366
79d554a6 1367 BT_DBG("conn %p", conn);
4e8402a3 1368
cc110922 1369 if (!hcon->out && hcon->type == LE_LINK)
b62f328b
VT		 1370 l2cap_le_conn_ready(conn);
1371
cc110922
VCG		 1372 if (hcon->out && hcon->type == LE_LINK)
1373 smp_conn_security(hcon, hcon->pending_sec_level);
160dc6ac 1374
3df91ea2 1375 mutex_lock(&conn->chan_lock);
4e8402a3 1376
3df91ea2 1377 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1378
6be36555 1379 l2cap_chan_lock(chan);
4e8402a3 1380
416fa752
AE		 1381 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
1382 l2cap_chan_unlock(chan);
1383 continue;
1384 }
1385
cc110922
VCG		 1386 if (hcon->type == LE_LINK) {
1387 if (smp_conn_security(hcon, chan->sec_level))
cf4cd009 1388 l2cap_chan_ready(chan);
acd7d370 1389
63128451 1390 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1391 struct sock *sk = chan->sk;
c9b66675 1392 __clear_chan_timer(chan);
6be36555 1393 lock_sock(sk);
0e587be7 1394 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1395 sk->sk_state_change(sk);
6be36555 1396 release_sock(sk);
b501d6a1 1397
89bc500e 1398 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1399 l2cap_do_start(chan);
4e8402a3 1400
6be36555 1401 l2cap_chan_unlock(chan);
4e8402a3 1402 }
79d554a6 1403
3df91ea2 1404 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1405}
1406
1407/* Notify sockets that we cannot guaranty reliability anymore */
1408static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1409{
48454079 1410 struct l2cap_chan *chan;
4e8402a3
MH		 1411
1412 BT_DBG("conn %p", conn);
1413
3df91ea2 1414 mutex_lock(&conn->chan_lock);
4e8402a3 1415
3df91ea2 1416 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1417 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1418 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1419 }
1420
3df91ea2 1421 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1422}
1423
f878fcad 1424static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1425{
f878fcad 1426 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1427 info_timer.work);
4e8402a3 1428
984947dc 1429 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1430 conn->info_ident = 0;
984947dc 1431
4e8402a3
MH		 1432 l2cap_conn_start(conn);
1433}
1434
5d3de7df
VCG		 1435static void l2cap_conn_del(struct hci_conn *hcon, int err)
1436{
1437 struct l2cap_conn *conn = hcon->l2cap_data;
1438 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1439
1440 if (!conn)
1441 return;
1442
1443 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1444
1445 kfree_skb(conn->rx_skb);
1446
3df91ea2
AE		 1447 mutex_lock(&conn->chan_lock);
1448
5d3de7df
VCG		 1449 /* Kill channels */
1450 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1451 l2cap_chan_hold(chan);
6be36555
AE		 1452 l2cap_chan_lock(chan);
1453
5d3de7df 1454 l2cap_chan_del(chan, err);
6be36555
AE		 1455
1456 l2cap_chan_unlock(chan);
1457
80b98027 1458 chan->ops->close(chan);
61d6ef3e 1459 l2cap_chan_put(chan);
5d3de7df
VCG		 1460 }
1461
3df91ea2
AE		 1462 mutex_unlock(&conn->chan_lock);
1463
73d80deb
LAD		 1464 hci_chan_del(conn->hchan);
1465
5d3de7df 1466 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1467 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1468
51a8efd7 1469 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1470 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1471 smp_chan_destroy(conn);
d26a2345 1472 }
5d3de7df
VCG		 1473
1474 hcon->l2cap_data = NULL;
1475 kfree(conn);
1476}
1477
6c9d42a1 1478static void security_timeout(struct work_struct *work)
5d3de7df 1479{
6c9d42a1 1480 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1481 security_timer.work);
5d3de7df 1482
d06cc416
JH		 1483 BT_DBG("conn %p", conn);
1484
1485 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1486 smp_chan_destroy(conn);
1487 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1488 }
5d3de7df
VCG		 1489}
1490
1da177e4
LT		 1491static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1492{
0139418c 1493 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1494 struct hci_chan *hchan;
1da177e4 1495
0139418c 1496 if (conn || status)
1da177e4
LT		 1497 return conn;
1498
73d80deb
LAD		 1499 hchan = hci_chan_create(hcon);
1500 if (!hchan)
1501 return NULL;
1502
8bcde1f2 1503 conn = kzalloc(sizeof(struct l2cap_conn), GFP_KERNEL);
73d80deb
LAD		 1504 if (!conn) {
1505 hci_chan_del(hchan);
1da177e4 1506 return NULL;
73d80deb 1507 }
1da177e4
LT		 1508
1509 hcon->l2cap_data = conn;
1510 conn->hcon = hcon;
73d80deb 1511 conn->hchan = hchan;
1da177e4 1512
73d80deb 1513 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1514
dcc042d5
AE		 1515 switch (hcon->type) {
1516 case AMP_LINK:
1517 conn->mtu = hcon->hdev->block_mtu;
1518 break;
1519
1520 case LE_LINK:
1521 if (hcon->hdev->le_mtu) {
1522 conn->mtu = hcon->hdev->le_mtu;
1523 break;
1524 }
1525 /* fall through */
1526
1527 default:
acd7d370 1528 conn->mtu = hcon->hdev->acl_mtu;
dcc042d5
AE		 1529 break;
1530 }
acd7d370 1531
1da177e4
LT		 1532 conn->src = &hcon->hdev->bdaddr;
1533 conn->dst = &hcon->dst;
1534
4e8402a3
MH		 1535 conn->feat_mask = 0;
1536
1da177e4 1537 spin_lock_init(&conn->lock);
3df91ea2 1538 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1539
1540 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1541
5d3de7df 1542 if (hcon->type == LE_LINK)
6c9d42a1 1543 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1544 else
030013d8 1545 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1546
9f5a0d7b 1547 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1548
1da177e4
LT		 1549 return conn;
1550}
1551
1da177e4 1552/* ---- Socket interface ---- */
1da177e4 1553
c2287681 1554/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1555 * Returns closest match.
1556 */
c2287681
IY		 1557static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1558 bdaddr_t *src,
1559 bdaddr_t *dst)
1da177e4 1560{
23691d75 1561 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1562
23691d75 1563 read_lock(&chan_list_lock);
e0f0cb56 1564
23691d75
GP		 1565 list_for_each_entry(c, &chan_list, global_l) {
1566 struct sock *sk = c->sk;
fe4128e0 1567
89bc500e 1568 if (state && c->state != state)
1da177e4
LT		 1569 continue;
1570
23691d75 1571 if (c->psm == psm) {
c2287681
IY		 1572 int src_match, dst_match;
1573 int src_any, dst_any;
1574
1da177e4 1575 /* Exact match. */
c2287681
IY		 1576 src_match = !bacmp(&bt_sk(sk)->src, src);
1577 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1578 if (src_match && dst_match) {
a7567b20 1579 read_unlock(&chan_list_lock);
23691d75
GP		 1580 return c;
1581 }
1da177e4
LT		 1582
1583 /* Closest match */
c2287681
IY		 1584 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1585 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1586 if ((src_match && dst_any) || (src_any && dst_match) ||
1587 (src_any && dst_any))
23691d75 1588 c1 = c;
1da177e4
LT		 1589 }
1590 }
1da177e4 1591
23691d75 1592 read_unlock(&chan_list_lock);
e0f0cb56 1593
23691d75 1594 return c1;
1da177e4
LT		 1595}
1596
8e9f9892
AG		 1597int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1598 bdaddr_t *dst, u8 dst_type)
1da177e4 1599{
5d41ce1d 1600 struct sock *sk = chan->sk;
1da177e4 1601 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1602 struct l2cap_conn *conn;
1603 struct hci_conn *hcon;
1604 struct hci_dev *hdev;
09ab6f4c 1605 __u8 auth_type;
44d0e48e 1606 int err;
1da177e4 1607
6ed93dc6 1608 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", src, dst,
ab19516a 1609 dst_type, __le16_to_cpu(psm));
1da177e4 1610
af05b30b
GP		 1611 hdev = hci_get_route(dst, src);
1612 if (!hdev)
1da177e4
LT		 1613 return -EHOSTUNREACH;
1614
09fd0de5 1615 hci_dev_lock(hdev);
1da177e4 1616
6be36555 1617 l2cap_chan_lock(chan);
03a00194
GP		 1618
1619 /* PSM must be odd and lsb of upper byte must be 0 */
1620 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
2d792818 1621 chan->chan_type != L2CAP_CHAN_RAW) {
03a00194
GP		 1622 err = -EINVAL;
1623 goto done;
1624 }
1625
1626 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1627 err = -EINVAL;
1628 goto done;
1629 }
1630
1631 switch (chan->mode) {
1632 case L2CAP_MODE_BASIC:
1633 break;
1634 case L2CAP_MODE_ERTM:
1635 case L2CAP_MODE_STREAMING:
1636 if (!disable_ertm)
1637 break;
1638 /* fall through */
1639 default:
1640 err = -ENOTSUPP;
1641 goto done;
1642 }
1643
0797e01d 1644 switch (chan->state) {
03a00194
GP		 1645 case BT_CONNECT:
1646 case BT_CONNECT2:
1647 case BT_CONFIG:
1648 /* Already connecting */
1649 err = 0;
1650 goto done;
1651
1652 case BT_CONNECTED:
1653 /* Already connected */
1654 err = -EISCONN;
1655 goto done;
1656
1657 case BT_OPEN:
1658 case BT_BOUND:
1659 /* Can connect */
1660 break;
1661
1662 default:
1663 err = -EBADFD;
1664 goto done;
1665 }
1666
1667 /* Set destination address and psm */
0797e01d 1668 lock_sock(sk);
9219b2a0 1669 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1670 release_sock(sk);
1671
03a00194
GP		 1672 chan->psm = psm;
1673 chan->dcid = cid;
1da177e4 1674
4343478f 1675 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1676
fe4128e0 1677 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1678 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1679 chan->sec_level, auth_type);
acd7d370 1680 else
8e9f9892 1681 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1682 chan->sec_level, auth_type);
acd7d370 1683
30e76272
VT		 1684 if (IS_ERR(hcon)) {
1685 err = PTR_ERR(hcon);
1da177e4 1686 goto done;
30e76272 1687 }
1da177e4
LT		 1688
1689 conn = l2cap_conn_add(hcon, 0);
1690 if (!conn) {
1691 hci_conn_put(hcon);
30e76272 1692 err = -ENOMEM;
1da177e4
LT		 1693 goto done;
1694 }
1695
9f0caeb1
VCG		 1696 if (hcon->type == LE_LINK) {
1697 err = 0;
1698
1699 if (!list_empty(&conn->chan_l)) {
1700 err = -EBUSY;
1701 hci_conn_put(hcon);
1702 }
1703
1704 if (err)
1705 goto done;
1706 }
1707
1da177e4
LT		 1708 /* Update source addr of the socket */
1709 bacpy(src, conn->src);
1710
6be36555 1711 l2cap_chan_unlock(chan);
48454079 1712 l2cap_chan_add(conn, chan);
6be36555 1713 l2cap_chan_lock(chan);
48454079 1714
6be36555 1715 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1716 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1717
1718 if (hcon->state == BT_CONNECTED) {
715ec005 1719 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1720 __clear_chan_timer(chan);
d45fc423 1721 if (l2cap_chan_check_security(chan))
6be36555 1722 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1723 } else
fc7f8a7e 1724 l2cap_do_start(chan);
1da177e4
LT		 1725 }
1726
30e76272
VT		 1727 err = 0;
1728
1da177e4 1729done:
6be36555 1730 l2cap_chan_unlock(chan);
09fd0de5 1731 hci_dev_unlock(hdev);
1da177e4
LT		 1732 hci_dev_put(hdev);
1733 return err;
1734}
1735
dcba0dba 1736int __l2cap_wait_ack(struct sock *sk)
6161c038 1737{
8c1d787b 1738 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1739 DECLARE_WAITQUEUE(wait, current);
1740 int err = 0;
1741 int timeo = HZ/5;
1742
2b0b05dd 1743 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1744 set_current_state(TASK_INTERRUPTIBLE);
1745 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1746 if (!timeo)
1747 timeo = HZ/5;
1748
1749 if (signal_pending(current)) {
1750 err = sock_intr_errno(timeo);
1751 break;
1752 }
1753
1754 release_sock(sk);
1755 timeo = schedule_timeout(timeo);
1756 lock_sock(sk);
a71a0cf4 1757 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1758
1759 err = sock_error(sk);
1760 if (err)
1761 break;
1762 }
1763 set_current_state(TASK_RUNNING);
2b0b05dd 1764 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1765 return err;
1766}
1767
721c4181 1768static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1769{
721c4181 1770 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1771 monitor_timer.work);
e90bac06 1772
525cd185 1773 BT_DBG("chan %p", chan);
0e98958d 1774
6be36555
AE		 1775 l2cap_chan_lock(chan);
1776
80909e04 1777 if (!chan->conn) {
6be36555 1778 l2cap_chan_unlock(chan);
8d7e1c7f 1779 l2cap_chan_put(chan);
e90bac06
GP		 1780 return;
1781 }
1782
401bb1f7 1783 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1784
6be36555 1785 l2cap_chan_unlock(chan);
8d7e1c7f 1786 l2cap_chan_put(chan);
e90bac06
GP		 1787}
1788
721c4181 1789static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1790{
721c4181 1791 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1792 retrans_timer.work);
e90bac06 1793
49208c9c 1794 BT_DBG("chan %p", chan);
0e98958d 1795
6be36555
AE		 1796 l2cap_chan_lock(chan);
1797
80909e04
MM		 1798 if (!chan->conn) {
1799 l2cap_chan_unlock(chan);
1800 l2cap_chan_put(chan);
1801 return;
1802 }
6be36555 1803
401bb1f7 1804 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1805 l2cap_chan_unlock(chan);
8d7e1c7f 1806 l2cap_chan_put(chan);
e90bac06
GP		 1807}
1808
d660366d
GP		 1809static void l2cap_streaming_send(struct l2cap_chan *chan,
1810 struct sk_buff_head *skbs)
6840ed07 1811{
ccbb84af 1812 struct sk_buff *skb;
3733937d 1813 struct l2cap_ctrl *control;
6840ed07 1814
3733937d
MM		 1815 BT_DBG("chan %p, skbs %p", chan, skbs);
1816
b99e13ad
MM		 1817 if (__chan_is_moving(chan))
1818 return;
1819
3733937d
MM		 1820 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1821
1822 while (!skb_queue_empty(&chan->tx_q)) {
1823
1824 skb = skb_dequeue(&chan->tx_q);
1825
1826 bt_cb(skb)->control.retries = 1;
1827 control = &bt_cb(skb)->control;
1828
1829 control->reqseq = 0;
1830 control->txseq = chan->next_tx_seq;
1831
1832 __pack_control(chan, control, skb);
6840ed07 1833
47d1ec61 1834 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1835 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1836 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1837 }
1838
4343478f 1839 l2cap_do_send(chan, skb);
6840ed07 1840
b4400672 1841 BT_DBG("Sent txseq %u", control->txseq);
3733937d 1842
836be934 1843 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1844 chan->frames_sent++;
6840ed07 1845 }
6840ed07
GP		 1846}
1847
67c9e840 1848static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1849{
1850 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1851 struct l2cap_ctrl *control;
1852 int sent = 0;
1853
1854 BT_DBG("chan %p", chan);
1c2acffb 1855
89bc500e 1856 if (chan->state != BT_CONNECTED)
c13ffa62 1857 return -ENOTCONN;
e90bac06 1858
94122bbe
MM		 1859 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1860 return 0;
1861
b99e13ad
MM		 1862 if (__chan_is_moving(chan))
1863 return 0;
1864
18a48e76
MM		 1865 while (chan->tx_send_head &&
1866 chan->unacked_frames < chan->remote_tx_win &&
1867 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1868
18a48e76 1869 skb = chan->tx_send_head;
e90bac06 1870
18a48e76
MM		 1871 bt_cb(skb)->control.retries = 1;
1872 control = &bt_cb(skb)->control;
95ffa978 1873
e2ab4353 1874 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1875 control->final = 1;
e2ab4353 1876
18a48e76
MM		 1877 control->reqseq = chan->buffer_seq;
1878 chan->last_acked_seq = chan->buffer_seq;
1879 control->txseq = chan->next_tx_seq;
1c2acffb 1880
18a48e76 1881 __pack_control(chan, control, skb);
e90bac06 1882
47d1ec61 1883 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1884 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1885 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1886 }
1887
18a48e76
MM		 1888 /* Clone after data has been modified. Data is assumed to be
1889 read-only (for locking purposes) on cloned sk_buffs.
1890 */
1891 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1892
18a48e76
MM		 1893 if (!tx_skb)
1894 break;
1c2acffb 1895
18a48e76 1896 __set_retrans_timer(chan);
836be934
AE		 1897
1898 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1899 chan->unacked_frames++;
6a026610 1900 chan->frames_sent++;
18a48e76 1901 sent++;
1c2acffb 1902
58d35f87
GP		 1903 if (skb_queue_is_last(&chan->tx_q, skb))
1904 chan->tx_send_head = NULL;
1c2acffb 1905 else
58d35f87 1906 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1907
1908 l2cap_do_send(chan, tx_skb);
b4400672 1909 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 1910 }
1911
b4400672
AE		 1912 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1913 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 1914
1915 return sent;
9e917af1
GP		 1916}
1917
e1fbd4c1
MM		 1918static void l2cap_ertm_resend(struct l2cap_chan *chan)
1919{
1920 struct l2cap_ctrl control;
1921 struct sk_buff *skb;
1922 struct sk_buff *tx_skb;
1923 u16 seq;
1924
1925 BT_DBG("chan %p", chan);
1926
1927 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1928 return;
1929
b99e13ad
MM		 1930 if (__chan_is_moving(chan))
1931 return;
1932
e1fbd4c1
MM		 1933 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1934 seq = l2cap_seq_list_pop(&chan->retrans_list);
1935
1936 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1937 if (!skb) {
1938 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 1939 seq);
e1fbd4c1
MM		 1940 continue;
1941 }
1942
1943 bt_cb(skb)->control.retries++;
1944 control = bt_cb(skb)->control;
1945
1946 if (chan->max_tx != 0 &&
1947 bt_cb(skb)->control.retries > chan->max_tx) {
1948 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
1949 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
1950 l2cap_seq_list_clear(&chan->retrans_list);
1951 break;
1952 }
1953
1954 control.reqseq = chan->buffer_seq;
1955 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1956 control.final = 1;
1957 else
1958 control.final = 0;
1959
1960 if (skb_cloned(skb)) {
1961 /* Cloned sk_buffs are read-only, so we need a
1962 * writeable copy
1963 */
8bcde1f2 1964 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 1965 } else {
8bcde1f2 1966 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 1967 }
1968
1969 if (!tx_skb) {
1970 l2cap_seq_list_clear(&chan->retrans_list);
1971 break;
1972 }
1973
1974 /* Update skb contents */
1975 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1976 put_unaligned_le32(__pack_extended_control(&control),
1977 tx_skb->data + L2CAP_HDR_SIZE);
1978 } else {
1979 put_unaligned_le16(__pack_enhanced_control(&control),
1980 tx_skb->data + L2CAP_HDR_SIZE);
1981 }
1982
1983 if (chan->fcs == L2CAP_FCS_CRC16) {
1984 u16 fcs = crc16(0, (u8 *) tx_skb->data, tx_skb->len);
1985 put_unaligned_le16(fcs, skb_put(tx_skb,
1986 L2CAP_FCS_SIZE));
1987 }
1988
1989 l2cap_do_send(chan, tx_skb);
1990
1991 BT_DBG("Resent txseq %d", control.txseq);
1992
1993 chan->last_acked_seq = chan->buffer_seq;
1994 }
1995}
1996
f80842a8
MM		 1997static void l2cap_retransmit(struct l2cap_chan *chan,
1998 struct l2cap_ctrl *control)
1999{
2000 BT_DBG("chan %p, control %p", chan, control);
2001
2002 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2003 l2cap_ertm_resend(chan);
2004}
2005
d2a7ac5d
MM		 2006static void l2cap_retransmit_all(struct l2cap_chan *chan,
2007 struct l2cap_ctrl *control)
2008{
e1fbd4c1
MM		 2009 struct sk_buff *skb;
2010
2011 BT_DBG("chan %p, control %p", chan, control);
2012
2013 if (control->poll)
2014 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2015
2016 l2cap_seq_list_clear(&chan->retrans_list);
2017
2018 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2019 return;
2020
2021 if (chan->unacked_frames) {
2022 skb_queue_walk(&chan->tx_q, skb) {
2023 if (bt_cb(skb)->control.txseq == control->reqseq ||
2d792818 2024 skb == chan->tx_send_head)
e1fbd4c1
MM		 2025 break;
2026 }
2027
2028 skb_queue_walk_from(&chan->tx_q, skb) {
2029 if (skb == chan->tx_send_head)
2030 break;
2031
2032 l2cap_seq_list_append(&chan->retrans_list,
2033 bt_cb(skb)->control.txseq);
2034 }
2035
2036 l2cap_ertm_resend(chan);
2037 }
d2a7ac5d
MM		 2038}
2039
0a0aba42 2040static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 2041{
0a0aba42
MM		 2042 struct l2cap_ctrl control;
2043 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2044 chan->last_acked_seq);
2045 int threshold;
9e917af1 2046
0a0aba42
MM		 2047 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2048 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 2049
0a0aba42
MM		 2050 memset(&control, 0, sizeof(control));
2051 control.sframe = 1;
dfc909be 2052
0a0aba42
MM		 2053 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2054 chan->rx_state == L2CAP_RX_STATE_RECV) {
2055 __clear_ack_timer(chan);
2056 control.super = L2CAP_SUPER_RNR;
2057 control.reqseq = chan->buffer_seq;
2058 l2cap_send_sframe(chan, &control);
2059 } else {
2060 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2061 l2cap_ertm_send(chan);
2062 /* If any i-frames were sent, they included an ack */
2063 if (chan->buffer_seq == chan->last_acked_seq)
2064 frames_to_ack = 0;
2065 }
dfc909be 2066
c20f8e35 2067 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 2068 * Calculate without mul or div
2069 */
c20f8e35 2070 threshold = chan->ack_win;
0a0aba42
MM		 2071 threshold += threshold << 1;
2072 threshold >>= 2;
2073
b4400672 2074 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 2075 threshold);
2076
2077 if (frames_to_ack >= threshold) {
2078 __clear_ack_timer(chan);
2079 control.super = L2CAP_SUPER_RR;
2080 control.reqseq = chan->buffer_seq;
2081 l2cap_send_sframe(chan, &control);
2082 frames_to_ack = 0;
2083 }
1c2acffb 2084
0a0aba42
MM		 2085 if (frames_to_ack)
2086 __set_ack_timer(chan);
2087 }
b17e73bb
SJ		 2088}
2089
04124681
GP		 2090static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2091 struct msghdr *msg, int len,
2092 int count, struct sk_buff *skb)
1c2acffb 2093{
0952a57a 2094 struct l2cap_conn *conn = chan->conn;
1c2acffb 2095 struct sk_buff **frag;
90338947 2096 int sent = 0;
1da177e4 2097
59203a21 2098 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 2099 return -EFAULT;
1da177e4
LT		 2100
2101 sent += count;
2102 len -= count;
2103
2104 /* Continuation fragments (no L2CAP header) */
2105 frag = &skb_shinfo(skb)->frag_list;
2106 while (len) {
fbe00700
GP		 2107 struct sk_buff *tmp;
2108
1da177e4
LT		 2109 count = min_t(unsigned int, conn->mtu, len);
2110
fbe00700
GP		 2111 tmp = chan->ops->alloc_skb(chan, count,
2112 msg->msg_flags & MSG_DONTWAIT);
2113 if (IS_ERR(tmp))
2114 return PTR_ERR(tmp);
2115
2116 *frag = tmp;
2f7719ce 2117
1c2acffb
GP		 2118 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
2119 return -EFAULT;
1da177e4 2120
5e59b791
LAD		 2121 (*frag)->priority = skb->priority;
2122
1da177e4
LT		 2123 sent += count;
2124 len -= count;
2125
2d0ed3d5
GP		 2126 skb->len += (*frag)->len;
2127 skb->data_len += (*frag)->len;
2128
1da177e4
LT		 2129 frag = &(*frag)->next;
2130 }
1da177e4
LT		 2131
2132 return sent;
1c2acffb 2133}
1da177e4 2134
5e59b791 2135static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
b4400672
AE		 2136 struct msghdr *msg, size_t len,
2137 u32 priority)
1c2acffb 2138{
8c1d787b 2139 struct l2cap_conn *conn = chan->conn;
1c2acffb 2140 struct sk_buff *skb;
03a51213 2141 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2142 struct l2cap_hdr *lh;
2143
b4400672 2144 BT_DBG("chan %p len %zu priority %u", chan, len, priority);
1c2acffb
GP		 2145
2146 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2147
2148 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2149 msg->msg_flags & MSG_DONTWAIT);
2150 if (IS_ERR(skb))
2151 return skb;
1c2acffb 2152
5e59b791
LAD		 2153 skb->priority = priority;
2154
1c2acffb
GP		 2155 /* Create L2CAP header */
2156 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2157 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 2158 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2159 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2160
0952a57a 2161 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2162 if (unlikely(err < 0)) {
2163 kfree_skb(skb);
2164 return ERR_PTR(err);
2165 }
2166 return skb;
2167}
2168
5e59b791 2169static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
b4400672
AE		 2170 struct msghdr *msg, size_t len,
2171 u32 priority)
1c2acffb 2172{
8c1d787b 2173 struct l2cap_conn *conn = chan->conn;
1c2acffb 2174 struct sk_buff *skb;
f2ba7fae 2175 int err, count;
1c2acffb
GP		 2176 struct l2cap_hdr *lh;
2177
b4400672 2178 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2179
f2ba7fae 2180 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2181
f2ba7fae 2182 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 2183 msg->msg_flags & MSG_DONTWAIT);
2184 if (IS_ERR(skb))
2185 return skb;
1c2acffb 2186
5e59b791
LAD		 2187 skb->priority = priority;
2188
1c2acffb
GP		 2189 /* Create L2CAP header */
2190 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2191 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2192 lh->len = cpu_to_le16(len);
1c2acffb 2193
0952a57a 2194 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2195 if (unlikely(err < 0)) {
2196 kfree_skb(skb);
2197 return ERR_PTR(err);
2198 }
2199 return skb;
2200}
2201
ab0ff76d 2202static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2203 struct msghdr *msg, size_t len,
2204 u16 sdulen)
1c2acffb 2205{
8c1d787b 2206 struct l2cap_conn *conn = chan->conn;
1c2acffb 2207 struct sk_buff *skb;
e4ca6d98 2208 int err, count, hlen;
1c2acffb
GP		 2209 struct l2cap_hdr *lh;
2210
b4400672 2211 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2212
0ee0d208
GP		 2213 if (!conn)
2214 return ERR_PTR(-ENOTCONN);
2215
ba7aa64f 2216 hlen = __ertm_hdr_size(chan);
e4ca6d98 2217
c74e560c 2218 if (sdulen)
03a51213 2219 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2220
47d1ec61 2221 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2222 hlen += L2CAP_FCS_SIZE;
fcc203c3 2223
1c2acffb 2224 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2225
2226 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2227 msg->msg_flags & MSG_DONTWAIT);
2228 if (IS_ERR(skb))
2229 return skb;
1c2acffb
GP		 2230
2231 /* Create L2CAP header */
2232 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2233 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2234 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2235
18a48e76
MM		 2236 /* Control header is populated later */
2237 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2238 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2239 else
2240 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2241
c74e560c 2242 if (sdulen)
03a51213 2243 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2244
0952a57a 2245 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2246 if (unlikely(err < 0)) {
2247 kfree_skb(skb);
2248 return ERR_PTR(err);
2249 }
e90bac06 2250
18a48e76 2251 bt_cb(skb)->control.fcs = chan->fcs;
3ce3514f 2252 bt_cb(skb)->control.retries = 0;
1c2acffb 2253 return skb;
1da177e4
LT		 2254}
2255
94122bbe
MM		 2256static int l2cap_segment_sdu(struct l2cap_chan *chan,
2257 struct sk_buff_head *seg_queue,
2258 struct msghdr *msg, size_t len)
c74e560c 2259{
c74e560c 2260 struct sk_buff *skb;
94122bbe
MM		 2261 u16 sdu_len;
2262 size_t pdu_len;
94122bbe 2263 u8 sar;
c74e560c 2264
b4400672 2265 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2266
94122bbe
MM		 2267 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2268 * so fragmented skbs are not used. The HCI layer's handling
2269 * of fragmented skbs is not compatible with ERTM's queueing.
2270 */
c74e560c 2271
94122bbe
MM		 2272 /* PDU size is derived from the HCI MTU */
2273 pdu_len = chan->conn->mtu;
c74e560c 2274
a549574d
MM		 2275 /* Constrain PDU size for BR/EDR connections */
2276 if (!chan->hs_hcon)
2277 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
94122bbe
MM		 2278
2279 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2280 if (chan->fcs)
2281 pdu_len -= L2CAP_FCS_SIZE;
2282
ba7aa64f 2283 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2284
2285 /* Remote device may have requested smaller PDUs */
2286 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2287
2288 if (len <= pdu_len) {
2289 sar = L2CAP_SAR_UNSEGMENTED;
2290 sdu_len = 0;
2291 pdu_len = len;
2292 } else {
2293 sar = L2CAP_SAR_START;
2294 sdu_len = len;
2295 pdu_len -= L2CAP_SDULEN_SIZE;
2296 }
2297
2298 while (len > 0) {
2299 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2300
c74e560c 2301 if (IS_ERR(skb)) {
94122bbe 2302 __skb_queue_purge(seg_queue);
c74e560c
GP		 2303 return PTR_ERR(skb);
2304 }
2305
94122bbe
MM		 2306 bt_cb(skb)->control.sar = sar;
2307 __skb_queue_tail(seg_queue, skb);
2308
2309 len -= pdu_len;
2310 if (sdu_len) {
2311 sdu_len = 0;
2312 pdu_len += L2CAP_SDULEN_SIZE;
2313 }
2314
2315 if (len <= pdu_len) {
2316 sar = L2CAP_SAR_END;
2317 pdu_len = len;
2318 } else {
2319 sar = L2CAP_SAR_CONTINUE;
2320 }
c74e560c 2321 }
c74e560c 2322
f0f62799 2323 return 0;
c74e560c
GP		 2324}
2325
5e59b791 2326int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2d792818 2327 u32 priority)
9a91a04a 2328{
9a91a04a 2329 struct sk_buff *skb;
9a91a04a 2330 int err;
94122bbe 2331 struct sk_buff_head seg_queue;
9a91a04a
GP		 2332
2333 /* Connectionless channel */
715ec005 2334 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2335 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2336 if (IS_ERR(skb))
2337 return PTR_ERR(skb);
2338
2339 l2cap_do_send(chan, skb);
2340 return len;
2341 }
2342
2343 switch (chan->mode) {
2344 case L2CAP_MODE_BASIC:
2345 /* Check outgoing MTU */
2346 if (len > chan->omtu)
2347 return -EMSGSIZE;
2348
2349 /* Create a basic PDU */
5e59b791 2350 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2351 if (IS_ERR(skb))
2352 return PTR_ERR(skb);
2353
2354 l2cap_do_send(chan, skb);
2355 err = len;
2356 break;
2357
2358 case L2CAP_MODE_ERTM:
2359 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2360 /* Check outgoing MTU */
2361 if (len > chan->omtu) {
2362 err = -EMSGSIZE;
2363 break;
2364 }
9a91a04a 2365
94122bbe 2366 __skb_queue_head_init(&seg_queue);
9a91a04a 2367
94122bbe
MM		 2368 /* Do segmentation before calling in to the state machine,
2369 * since it's possible to block while waiting for memory
2370 * allocation.
2371 */
2372 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2373
94122bbe
MM		 2374 /* The channel could have been closed while segmenting,
2375 * check that it is still connected.
2376 */
2377 if (chan->state != BT_CONNECTED) {
2378 __skb_queue_purge(&seg_queue);
2379 err = -ENOTCONN;
9a91a04a
GP		 2380 }
2381
94122bbe 2382 if (err)
9a91a04a 2383 break;
9a91a04a 2384
3733937d 2385 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2386 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2387 else
d660366d 2388 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2389
d660366d 2390 err = len;
9a91a04a 2391
94122bbe
MM		 2392 /* If the skbs were not queued for sending, they'll still be in
2393 * seg_queue and need to be purged.
2394 */
2395 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2396 break;
2397
2398 default:
2399 BT_DBG("bad state %1.1x", chan->mode);
2400 err = -EBADFD;
2401 }
2402
2403 return err;
2404}
2405
d2a7ac5d
MM		 2406static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2407{
bed68bde
MM		 2408 struct l2cap_ctrl control;
2409 u16 seq;
2410
b4400672 2411 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2412
2413 memset(&control, 0, sizeof(control));
2414 control.sframe = 1;
2415 control.super = L2CAP_SUPER_SREJ;
2416
2417 for (seq = chan->expected_tx_seq; seq != txseq;
2418 seq = __next_seq(chan, seq)) {
2419 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2420 control.reqseq = seq;
2421 l2cap_send_sframe(chan, &control);
2422 l2cap_seq_list_append(&chan->srej_list, seq);
2423 }
2424 }
2425
2426 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2427}
2428
2429static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2430{
bed68bde
MM		 2431 struct l2cap_ctrl control;
2432
2433 BT_DBG("chan %p", chan);
2434
2435 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2436 return;
2437
2438 memset(&control, 0, sizeof(control));
2439 control.sframe = 1;
2440 control.super = L2CAP_SUPER_SREJ;
2441 control.reqseq = chan->srej_list.tail;
2442 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2443}
2444
2445static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2446{
bed68bde
MM		 2447 struct l2cap_ctrl control;
2448 u16 initial_head;
2449 u16 seq;
2450
b4400672 2451 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2452
2453 memset(&control, 0, sizeof(control));
2454 control.sframe = 1;
2455 control.super = L2CAP_SUPER_SREJ;
2456
2457 /* Capture initial list head to allow only one pass through the list. */
2458 initial_head = chan->srej_list.head;
2459
2460 do {
2461 seq = l2cap_seq_list_pop(&chan->srej_list);
2462 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2463 break;
2464
2465 control.reqseq = seq;
2466 l2cap_send_sframe(chan, &control);
2467 l2cap_seq_list_append(&chan->srej_list, seq);
2468 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2469}
2470
608bcc6d
MM		 2471static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2472{
2473 struct sk_buff *acked_skb;
2474 u16 ackseq;
2475
b4400672 2476 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2477
2478 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2479 return;
2480
b4400672 2481 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2482 chan->expected_ack_seq, chan->unacked_frames);
2483
2484 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2485 ackseq = __next_seq(chan, ackseq)) {
2486
2487 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2488 if (acked_skb) {
2489 skb_unlink(acked_skb, &chan->tx_q);
2490 kfree_skb(acked_skb);
2491 chan->unacked_frames--;
2492 }
2493 }
2494
2495 chan->expected_ack_seq = reqseq;
2496
2497 if (chan->unacked_frames == 0)
2498 __clear_retrans_timer(chan);
2499
b4400672 2500 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2501}
2502
2503static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2504{
2505 BT_DBG("chan %p", chan);
2506
2507 chan->expected_tx_seq = chan->buffer_seq;
2508 l2cap_seq_list_clear(&chan->srej_list);
2509 skb_queue_purge(&chan->srej_q);
2510 chan->rx_state = L2CAP_RX_STATE_RECV;
2511}
2512
d660366d
GP		 2513static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2514 struct l2cap_ctrl *control,
2515 struct sk_buff_head *skbs, u8 event)
608bcc6d 2516{
608bcc6d
MM		 2517 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2518 event);
2519
2520 switch (event) {
2521 case L2CAP_EV_DATA_REQUEST:
2522 if (chan->tx_send_head == NULL)
2523 chan->tx_send_head = skb_peek(skbs);
2524
2525 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2526 l2cap_ertm_send(chan);
2527 break;
2528 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2529 BT_DBG("Enter LOCAL_BUSY");
2530 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2531
2532 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2533 /* The SREJ_SENT state must be aborted if we are to
2534 * enter the LOCAL_BUSY state.
2535 */
2536 l2cap_abort_rx_srej_sent(chan);
2537 }
2538
2539 l2cap_send_ack(chan);
2540
2541 break;
2542 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2543 BT_DBG("Exit LOCAL_BUSY");
2544 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2545
2546 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2547 struct l2cap_ctrl local_control;
2548
2549 memset(&local_control, 0, sizeof(local_control));
2550 local_control.sframe = 1;
2551 local_control.super = L2CAP_SUPER_RR;
2552 local_control.poll = 1;
2553 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2554 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2555
2556 chan->retry_count = 1;
2557 __set_monitor_timer(chan);
2558 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2559 }
2560 break;
2561 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2562 l2cap_process_reqseq(chan, control->reqseq);
2563 break;
2564 case L2CAP_EV_EXPLICIT_POLL:
2565 l2cap_send_rr_or_rnr(chan, 1);
2566 chan->retry_count = 1;
2567 __set_monitor_timer(chan);
2568 __clear_ack_timer(chan);
2569 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2570 break;
2571 case L2CAP_EV_RETRANS_TO:
2572 l2cap_send_rr_or_rnr(chan, 1);
2573 chan->retry_count = 1;
2574 __set_monitor_timer(chan);
2575 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2576 break;
2577 case L2CAP_EV_RECV_FBIT:
2578 /* Nothing to process */
2579 break;
2580 default:
2581 break;
2582 }
608bcc6d
MM		 2583}
2584
d660366d
GP		 2585static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2586 struct l2cap_ctrl *control,
2587 struct sk_buff_head *skbs, u8 event)
608bcc6d 2588{
608bcc6d
MM		 2589 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2590 event);
2591
2592 switch (event) {
2593 case L2CAP_EV_DATA_REQUEST:
2594 if (chan->tx_send_head == NULL)
2595 chan->tx_send_head = skb_peek(skbs);
2596 /* Queue data, but don't send. */
2597 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2598 break;
2599 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2600 BT_DBG("Enter LOCAL_BUSY");
2601 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2602
2603 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2604 /* The SREJ_SENT state must be aborted if we are to
2605 * enter the LOCAL_BUSY state.
2606 */
2607 l2cap_abort_rx_srej_sent(chan);
2608 }
2609
2610 l2cap_send_ack(chan);
2611
2612 break;
2613 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2614 BT_DBG("Exit LOCAL_BUSY");
2615 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2616
2617 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2618 struct l2cap_ctrl local_control;
2619 memset(&local_control, 0, sizeof(local_control));
2620 local_control.sframe = 1;
2621 local_control.super = L2CAP_SUPER_RR;
2622 local_control.poll = 1;
2623 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2624 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2625
2626 chan->retry_count = 1;
2627 __set_monitor_timer(chan);
2628 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2629 }
2630 break;
2631 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2632 l2cap_process_reqseq(chan, control->reqseq);
2633
2634 /* Fall through */
2635
2636 case L2CAP_EV_RECV_FBIT:
2637 if (control && control->final) {
2638 __clear_monitor_timer(chan);
2639 if (chan->unacked_frames > 0)
2640 __set_retrans_timer(chan);
2641 chan->retry_count = 0;
2642 chan->tx_state = L2CAP_TX_STATE_XMIT;
2643 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2644 }
2645 break;
2646 case L2CAP_EV_EXPLICIT_POLL:
2647 /* Ignore */
2648 break;
2649 case L2CAP_EV_MONITOR_TO:
2650 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2651 l2cap_send_rr_or_rnr(chan, 1);
2652 __set_monitor_timer(chan);
2653 chan->retry_count++;
2654 } else {
2655 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
2656 }
2657 break;
2658 default:
2659 break;
2660 }
608bcc6d
MM		 2661}
2662
d660366d
GP		 2663static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2664 struct sk_buff_head *skbs, u8 event)
608bcc6d 2665{
608bcc6d
MM		 2666 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2667 chan, control, skbs, event, chan->tx_state);
2668
2669 switch (chan->tx_state) {
2670 case L2CAP_TX_STATE_XMIT:
d660366d 2671 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2672 break;
2673 case L2CAP_TX_STATE_WAIT_F:
d660366d 2674 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2675 break;
2676 default:
2677 /* Ignore event */
2678 break;
2679 }
608bcc6d
MM		 2680}
2681
4b51dae9
MM		 2682static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2683 struct l2cap_ctrl *control)
2684{
2685 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2686 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2687}
2688
f80842a8
MM		 2689static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2690 struct l2cap_ctrl *control)
2691{
2692 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2693 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2694}
2695
1da177e4
LT		 2696/* Copy frame to all raw sockets on that connection */
2697static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2698{
1da177e4 2699 struct sk_buff *nskb;
48454079 2700 struct l2cap_chan *chan;
1da177e4
LT		 2701
2702 BT_DBG("conn %p", conn);
2703
3df91ea2 2704 mutex_lock(&conn->chan_lock);
3d57dc68 2705
3df91ea2 2706 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2707 struct sock *sk = chan->sk;
715ec005 2708 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2709 continue;
2710
2711 /* Don't send frame to the socket it came from */
2712 if (skb->sk == sk)
2713 continue;
8bcde1f2 2714 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 2715 if (!nskb)
1da177e4
LT		 2716 continue;
2717
80b98027 2718 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 2719 kfree_skb(nskb);
2720 }
3d57dc68 2721
3df91ea2 2722 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2723}
2724
2725/* ---- L2CAP signalling commands ---- */
b4400672
AE		 2726static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2727 u8 ident, u16 dlen, void *data)
1da177e4
LT		 2728{
2729 struct sk_buff *skb, **frag;
2730 struct l2cap_cmd_hdr *cmd;
2731 struct l2cap_hdr *lh;
2732 int len, count;
2733
b4400672
AE		 2734 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2735 conn, code, ident, dlen);
1da177e4
LT		 2736
2737 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2738 count = min_t(unsigned int, conn->mtu, len);
2739
8bcde1f2 2740 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2741 if (!skb)
2742 return NULL;
2743
2744 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2745 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2746
2747 if (conn->hcon->type == LE_LINK)
ac73498c 2748 lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 2749 else
ac73498c 2750 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2751
2752 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2753 cmd->code = code;
2754 cmd->ident = ident;
aca3192c 2755 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2756
2757 if (dlen) {
2758 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2759 memcpy(skb_put(skb, count), data, count);
2760 data += count;
2761 }
2762
2763 len -= skb->len;
2764
2765 /* Continuation fragments (no L2CAP header) */
2766 frag = &skb_shinfo(skb)->frag_list;
2767 while (len) {
2768 count = min_t(unsigned int, conn->mtu, len);
2769
8bcde1f2 2770 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2771 if (!*frag)
2772 goto fail;
2773
2774 memcpy(skb_put(*frag, count), data, count);
2775
2776 len -= count;
2777 data += count;
2778
2779 frag = &(*frag)->next;
2780 }
2781
2782 return skb;
2783
2784fail:
2785 kfree_skb(skb);
2786 return NULL;
2787}
2788
2d792818
GP		 2789static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2790 unsigned long *val)
1da177e4
LT		 2791{
2792 struct l2cap_conf_opt *opt = *ptr;
2793 int len;
2794
2795 len = L2CAP_CONF_OPT_SIZE + opt->len;
2796 *ptr += len;
2797
2798 *type = opt->type;
2799 *olen = opt->len;
2800
2801 switch (opt->len) {
2802 case 1:
2803 *val = *((u8 *) opt->val);
2804 break;
2805
2806 case 2:
bfaaeb3e 2807 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2808 break;
2809
2810 case 4:
bfaaeb3e 2811 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2812 break;
2813
2814 default:
2815 *val = (unsigned long) opt->val;
2816 break;
2817 }
2818
b4400672 2819 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 2820 return len;
2821}
2822
1da177e4
LT		 2823static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2824{
2825 struct l2cap_conf_opt *opt = *ptr;
2826
b4400672 2827 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4
LT		 2828
2829 opt->type = type;
2830 opt->len = len;
2831
2832 switch (len) {
2833 case 1:
2834 *((u8 *) opt->val) = val;
2835 break;
2836
2837 case 2:
4f8b691c 2838 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2839 break;
2840
2841 case 4:
4f8b691c 2842 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2843 break;
2844
2845 default:
2846 memcpy(opt->val, (void *) val, len);
2847 break;
2848 }
2849
2850 *ptr += L2CAP_CONF_OPT_SIZE + len;
2851}
2852
f89cef09
AE		 2853static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2854{
2855 struct l2cap_conf_efs efs;
2856
1ec918ce 2857 switch (chan->mode) {
f89cef09
AE		 2858 case L2CAP_MODE_ERTM:
2859 efs.id = chan->local_id;
2860 efs.stype = chan->local_stype;
2861 efs.msdu = cpu_to_le16(chan->local_msdu);
2862 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
ac73498c 2863 efs.acc_lat = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
8936fa6d 2864 efs.flush_to = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 2865 break;
2866
2867 case L2CAP_MODE_STREAMING:
2868 efs.id = 1;
2869 efs.stype = L2CAP_SERV_BESTEFFORT;
2870 efs.msdu = cpu_to_le16(chan->local_msdu);
2871 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2872 efs.acc_lat = 0;
2873 efs.flush_to = 0;
2874 break;
2875
2876 default:
2877 return;
2878 }
2879
2880 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
8936fa6d 2881 (unsigned long) &efs);
f89cef09
AE		 2882}
2883
721c4181 2884static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2885{
721c4181 2886 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 2887 ack_timer.work);
2888 u16 frames_to_ack;
c1b4f43b 2889
2fb9b3d4
GP		 2890 BT_DBG("chan %p", chan);
2891
6be36555
AE		 2892 l2cap_chan_lock(chan);
2893
0362520b
MM		 2894 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2895 chan->last_acked_seq);
6be36555 2896
0362520b
MM		 2897 if (frames_to_ack)
2898 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 2899
0362520b 2900 l2cap_chan_unlock(chan);
09bfb2ee 2901 l2cap_chan_put(chan);
c1b4f43b
GP		 2902}
2903
466f8004 2904int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2905{
3c588192
MM		 2906 int err;
2907
105bdf9e
MM		 2908 chan->next_tx_seq = 0;
2909 chan->expected_tx_seq = 0;
42e5c802 2910 chan->expected_ack_seq = 0;
6a026610 2911 chan->unacked_frames = 0;
42e5c802 2912 chan->buffer_seq = 0;
6a026610 2913 chan->frames_sent = 0;
105bdf9e
MM		 2914 chan->last_acked_seq = 0;
2915 chan->sdu = NULL;
2916 chan->sdu_last_frag = NULL;
2917 chan->sdu_len = 0;
2918
d34c34fb
MM		 2919 skb_queue_head_init(&chan->tx_q);
2920
08333283
MM		 2921 chan->local_amp_id = 0;
2922 chan->move_id = 0;
2923 chan->move_state = L2CAP_MOVE_STABLE;
2924 chan->move_role = L2CAP_MOVE_ROLE_NONE;
2925
105bdf9e
MM		 2926 if (chan->mode != L2CAP_MODE_ERTM)
2927 return 0;
2928
2929 chan->rx_state = L2CAP_RX_STATE_RECV;
2930 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2931
721c4181
GP		 2932 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2933 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2934 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2935
f1c6775b 2936 skb_queue_head_init(&chan->srej_q);
1890d36b 2937
3c588192
MM		 2938 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2939 if (err < 0)
2940 return err;
2941
9dc9affc
MM		 2942 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
2943 if (err < 0)
2944 l2cap_seq_list_free(&chan->srej_list);
2945
2946 return err;
0565c1c2
GP		 2947}
2948
f2fcfcd6
GP		 2949static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2950{
2951 switch (mode) {
2952 case L2CAP_MODE_STREAMING:
2953 case L2CAP_MODE_ERTM:
2954 if (l2cap_mode_supported(mode, remote_feat_mask))
2955 return mode;
2956 /* fall through */
2957 default:
2958 return L2CAP_MODE_BASIC;
2959 }
2960}
2961
6327eb98
AE		 2962static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2963{
2964 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2965}
2966
f89cef09
AE		 2967static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2968{
2969 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2970}
2971
36c86c85
MM		 2972static void __l2cap_set_ertm_timeouts(struct l2cap_chan *chan,
2973 struct l2cap_conf_rfc *rfc)
2974{
2975 if (chan->local_amp_id && chan->hs_hcon) {
2976 u64 ertm_to = chan->hs_hcon->hdev->amp_be_flush_to;
2977
2978 /* Class 1 devices have must have ERTM timeouts
2979 * exceeding the Link Supervision Timeout. The
2980 * default Link Supervision Timeout for AMP
2981 * controllers is 10 seconds.
2982 *
2983 * Class 1 devices use 0xffffffff for their
2984 * best-effort flush timeout, so the clamping logic
2985 * will result in a timeout that meets the above
2986 * requirement. ERTM timeouts are 16-bit values, so
2987 * the maximum timeout is 65.535 seconds.
2988 */
2989
2990 /* Convert timeout to milliseconds and round */
2991 ertm_to = DIV_ROUND_UP_ULL(ertm_to, 1000);
2992
2993 /* This is the recommended formula for class 2 devices
2994 * that start ERTM timers when packets are sent to the
2995 * controller.
2996 */
2997 ertm_to = 3 * ertm_to + 500;
2998
2999 if (ertm_to > 0xffff)
3000 ertm_to = 0xffff;
3001
3002 rfc->retrans_timeout = cpu_to_le16((u16) ertm_to);
3003 rfc->monitor_timeout = rfc->retrans_timeout;
3004 } else {
3005 rfc->retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
3006 rfc->monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
3007 }
3008}
3009
6327eb98
AE		 3010static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
3011{
3012 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
2d792818 3013 __l2cap_ews_supported(chan)) {
6327eb98
AE		 3014 /* use extended control field */
3015 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 3016 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
3017 } else {
6327eb98 3018 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 3019 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 3020 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
3021 }
c20f8e35 3022 chan->ack_win = chan->tx_win;
6327eb98
AE		 3023}
3024
710f9b0a 3025static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3026{
1da177e4 3027 struct l2cap_conf_req *req = data;
0c1bc5c6 3028 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 3029 void *ptr = req->data;
c8f79162 3030 u16 size;
1da177e4 3031
49208c9c 3032 BT_DBG("chan %p", chan);
1da177e4 3033
73ffa904 3034 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 3035 goto done;
3036
0c1bc5c6 3037 switch (chan->mode) {
f2fcfcd6
GP		 3038 case L2CAP_MODE_STREAMING:
3039 case L2CAP_MODE_ERTM:
c1360a1c 3040 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 3041 break;
85eb53c6 3042
f89cef09
AE		 3043 if (__l2cap_efs_supported(chan))
3044 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3045
2ba13ed6 3046 /* fall through */
f2fcfcd6 3047 default:
8c1d787b 3048 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 3049 break;
3050 }
3051
3052done:
0c1bc5c6
GP		 3053 if (chan->imtu != L2CAP_DEFAULT_MTU)
3054 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 3055
0c1bc5c6 3056 switch (chan->mode) {
65c7c491 3057 case L2CAP_MODE_BASIC:
8c1d787b 3058 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 3059 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 3060 break;
3061
62547752
GP		 3062 rfc.mode = L2CAP_MODE_BASIC;
3063 rfc.txwin_size = 0;
3064 rfc.max_transmit = 0;
3065 rfc.retrans_timeout = 0;
3066 rfc.monitor_timeout = 0;
3067 rfc.max_pdu_size = 0;
3068
63406504 3069 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3070 (unsigned long) &rfc);
65c7c491
MH		 3071 break;
3072
3073 case L2CAP_MODE_ERTM:
3074 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 3075 rfc.max_transmit = chan->max_tx;
36c86c85
MM		 3076
3077 __l2cap_set_ertm_timeouts(chan, &rfc);
c8f79162
AE		 3078
3079 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3080 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3081 L2CAP_FCS_SIZE);
c8f79162 3082 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 3083
6327eb98
AE		 3084 l2cap_txwin_setup(chan);
3085
3086 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 3087 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 3088
63406504 3089 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3090 (unsigned long) &rfc);
63406504 3091
f89cef09
AE		 3092 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3093 l2cap_add_opt_efs(&ptr, chan);
3094
8c1d787b 3095 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 3096 break;
3097
47d1ec61 3098 if (chan->fcs == L2CAP_FCS_NONE ||
2d792818 3099 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 3100 chan->fcs = L2CAP_FCS_NONE;
3101 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 3102 }
6327eb98
AE		 3103
3104 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3105 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2d792818 3106 chan->tx_win);
f2fcfcd6
GP		 3107 break;
3108
3109 case L2CAP_MODE_STREAMING:
273759e2 3110 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 3111 rfc.mode = L2CAP_MODE_STREAMING;
3112 rfc.txwin_size = 0;
3113 rfc.max_transmit = 0;
3114 rfc.retrans_timeout = 0;
3115 rfc.monitor_timeout = 0;
c8f79162
AE		 3116
3117 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3118 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3119 L2CAP_FCS_SIZE);
c8f79162 3120 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 3121
63406504 3122 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3123 (unsigned long) &rfc);
63406504 3124
f89cef09
AE		 3125 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3126 l2cap_add_opt_efs(&ptr, chan);
3127
8c1d787b 3128 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 3129 break;
3130
47d1ec61 3131 if (chan->fcs == L2CAP_FCS_NONE ||
2d792818 3132 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 3133 chan->fcs = L2CAP_FCS_NONE;
3134 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 3135 }
65c7c491
MH		 3136 break;
3137 }
1da177e4 3138
fe4128e0 3139 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 3140 req->flags = __constant_cpu_to_le16(0);
1da177e4
LT		 3141
3142 return ptr - data;
3143}
3144
73ffa904 3145static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3146{
5dee9e7c
MH		 3147 struct l2cap_conf_rsp *rsp = data;
3148 void *ptr = rsp->data;
73ffa904
GP		 3149 void *req = chan->conf_req;
3150 int len = chan->conf_len;
5dee9e7c
MH		 3151 int type, hint, olen;
3152 unsigned long val;
6464f35f 3153 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 3154 struct l2cap_conf_efs efs;
3155 u8 remote_efs = 0;
861d6882 3156 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 3157 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 3158 u16 size;
1da177e4 3159
73ffa904 3160 BT_DBG("chan %p", chan);
820ae1b8 3161
5dee9e7c
MH		 3162 while (len >= L2CAP_CONF_OPT_SIZE) {
3163 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 3164
589d2746 3165 hint = type & L2CAP_CONF_HINT;
47ec1dcd 3166 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 3167
3168 switch (type) {
3169 case L2CAP_CONF_MTU:
861d6882 3170 mtu = val;
5dee9e7c
MH		 3171 break;
3172
3173 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3174 chan->flush_to = val;
5dee9e7c
MH		 3175 break;
3176
3177 case L2CAP_CONF_QOS:
3178 break;
3179
6464f35f
MH		 3180 case L2CAP_CONF_RFC:
3181 if (olen == sizeof(rfc))
3182 memcpy(&rfc, (void *) val, olen);
3183 break;
3184
fcc203c3
GP		 3185 case L2CAP_CONF_FCS:
3186 if (val == L2CAP_FCS_NONE)
c1360a1c 3187 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 3188 break;
fcc203c3 3189
42dceae2
AE		 3190 case L2CAP_CONF_EFS:
3191 remote_efs = 1;
3192 if (olen == sizeof(efs))
3193 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3194 break;
3195
6327eb98
AE		 3196 case L2CAP_CONF_EWS:
3197 if (!enable_hs)
3198 return -ECONNREFUSED;
fcc203c3 3199
6327eb98
AE		 3200 set_bit(FLAG_EXT_CTRL, &chan->flags);
3201 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3202 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3203 chan->remote_tx_win = val;
fcc203c3
GP		 3204 break;
3205
5dee9e7c
MH		 3206 default:
3207 if (hint)
3208 break;
3209
3210 result = L2CAP_CONF_UNKNOWN;
3211 *((u8 *) ptr++) = type;
3212 break;
3213 }
3214 }
3215
73ffa904 3216 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3217 goto done;
3218
0c1bc5c6 3219 switch (chan->mode) {
f2fcfcd6
GP		 3220 case L2CAP_MODE_STREAMING:
3221 case L2CAP_MODE_ERTM:
c1360a1c 3222 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3223 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3224 chan->conn->feat_mask);
85eb53c6
GP		 3225 break;
3226 }
3227
42dceae2
AE		 3228 if (remote_efs) {
3229 if (__l2cap_efs_supported(chan))
3230 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3231 else
3232 return -ECONNREFUSED;
3233 }
3234
0c1bc5c6 3235 if (chan->mode != rfc.mode)
f2fcfcd6 3236 return -ECONNREFUSED;
742e519b 3237
f2fcfcd6 3238 break;
f2fcfcd6
GP		 3239 }
3240
3241done:
0c1bc5c6 3242 if (chan->mode != rfc.mode) {
f2fcfcd6 3243 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3244 rfc.mode = chan->mode;
f2fcfcd6 3245
73ffa904 3246 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3247 return -ECONNREFUSED;
3248
2d792818
GP		 3249 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3250 (unsigned long) &rfc);
f2fcfcd6
GP		 3251 }
3252
5dee9e7c
MH		 3253 if (result == L2CAP_CONF_SUCCESS) {
3254 /* Configure output options and let the other side know
3255 * which ones we don't like. */
3256
f2fcfcd6
GP		 3257 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3258 result = L2CAP_CONF_UNACCEPT;
3259 else {
0c1bc5c6 3260 chan->omtu = mtu;
c1360a1c 3261 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3262 }
0c1bc5c6 3263 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 3264
42dceae2
AE		 3265 if (remote_efs) {
3266 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3267 efs.stype != L2CAP_SERV_NOTRAFIC &&
3268 efs.stype != chan->local_stype) {
42dceae2
AE		 3269
3270 result = L2CAP_CONF_UNACCEPT;
3271
3272 if (chan->num_conf_req >= 1)
3273 return -ECONNREFUSED;
3274
3275 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3276 sizeof(efs),
3277 (unsigned long) &efs);
0e8b207e 3278 } else {
3e6b3b95 3279 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3280 result = L2CAP_CONF_PENDING;
3281 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3282 }
3283 }
3284
f2fcfcd6
GP		 3285 switch (rfc.mode) {
3286 case L2CAP_MODE_BASIC:
47d1ec61 3287 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3288 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3289 break;
3290
3291 case L2CAP_MODE_ERTM:
6327eb98
AE		 3292 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3293 chan->remote_tx_win = rfc.txwin_size;
3294 else
3295 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3296
2c03a7a4 3297 chan->remote_max_tx = rfc.max_transmit;
1c762159 3298
c8f79162 3299 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3300 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3301 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3302 rfc.max_pdu_size = cpu_to_le16(size);
3303 chan->remote_mps = size;
f2fcfcd6 3304
36c86c85 3305 __l2cap_set_ertm_timeouts(chan, &rfc);
f2fcfcd6 3306
c1360a1c 3307 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3308
3309 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3310 sizeof(rfc), (unsigned long) &rfc);
68ae6639 3311
42dceae2
AE		 3312 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3313 chan->remote_id = efs.id;
3314 chan->remote_stype = efs.stype;
3315 chan->remote_msdu = le16_to_cpu(efs.msdu);
3316 chan->remote_flush_to =
2d792818 3317 le32_to_cpu(efs.flush_to);
42dceae2 3318 chan->remote_acc_lat =
2d792818 3319 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3320 chan->remote_sdu_itime =
3321 le32_to_cpu(efs.sdu_itime);
3322 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3323 sizeof(efs),
3324 (unsigned long) &efs);
42dceae2 3325 }
f2fcfcd6
GP		 3326 break;
3327
3328 case L2CAP_MODE_STREAMING:
c8f79162 3329 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3330 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3331 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3332 rfc.max_pdu_size = cpu_to_le16(size);
3333 chan->remote_mps = size;
f2fcfcd6 3334
c1360a1c 3335 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3336
2d792818
GP		 3337 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3338 (unsigned long) &rfc);
68ae6639 3339
f2fcfcd6
GP		 3340 break;
3341
3342 default:
5dee9e7c 3343 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3344
6464f35f 3345 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3346 rfc.mode = chan->mode;
f2fcfcd6 3347 }
6464f35f 3348
f2fcfcd6 3349 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3350 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3351 }
fe4128e0 3352 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3353 rsp->result = cpu_to_le16(result);
59e54bd1 3354 rsp->flags = __constant_cpu_to_le16(0);
5dee9e7c
MH		 3355
3356 return ptr - data;
1da177e4
LT		 3357}
3358
2d792818
GP		 3359static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3360 void *data, u16 *result)
f2fcfcd6 3361{
f2fcfcd6
GP		 3362 struct l2cap_conf_req *req = data;
3363 void *ptr = req->data;
3364 int type, olen;
3365 unsigned long val;
36e999a8 3366 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3367 struct l2cap_conf_efs efs;
f2fcfcd6 3368
fe4128e0 3369 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3370
3371 while (len >= L2CAP_CONF_OPT_SIZE) {
3372 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3373
3374 switch (type) {
3375 case L2CAP_CONF_MTU:
3376 if (val < L2CAP_DEFAULT_MIN_MTU) {
3377 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3378 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3379 } else
0c1bc5c6
GP		 3380 chan->imtu = val;
3381 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 3382 break;
3383
3384 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3385 chan->flush_to = val;
f2fcfcd6 3386 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2d792818 3387 2, chan->flush_to);
f2fcfcd6
GP		 3388 break;
3389
3390 case L2CAP_CONF_RFC:
3391 if (olen == sizeof(rfc))
3392 memcpy(&rfc, (void *)val, olen);
3393
c1360a1c 3394 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3395 rfc.mode != chan->mode)
f2fcfcd6
GP		 3396 return -ECONNREFUSED;
3397
47d1ec61 3398 chan->fcs = 0;
f2fcfcd6
GP		 3399
3400 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3401 sizeof(rfc), (unsigned long) &rfc);
f2fcfcd6 3402 break;
6327eb98
AE		 3403
3404 case L2CAP_CONF_EWS:
c20f8e35 3405 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3406 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
c20f8e35 3407 chan->tx_win);
6327eb98 3408 break;
66af7aaf
AE		 3409
3410 case L2CAP_CONF_EFS:
3411 if (olen == sizeof(efs))
3412 memcpy(&efs, (void *)val, olen);
3413
3414 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3415 efs.stype != L2CAP_SERV_NOTRAFIC &&
3416 efs.stype != chan->local_stype)
66af7aaf
AE		 3417 return -ECONNREFUSED;
3418
2d792818
GP		 3419 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3420 (unsigned long) &efs);
66af7aaf 3421 break;
f2fcfcd6
GP		 3422 }
3423 }
3424
0c1bc5c6 3425 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3426 return -ECONNREFUSED;
3427
0c1bc5c6 3428 chan->mode = rfc.mode;
6c2ea7a8 3429
0e8b207e 3430 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3431 switch (rfc.mode) {
3432 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3433 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3434 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3435 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3436 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3437 chan->ack_win = min_t(u16, chan->ack_win,
3438 rfc.txwin_size);
66af7aaf
AE		 3439
3440 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3441 chan->local_msdu = le16_to_cpu(efs.msdu);
3442 chan->local_sdu_itime =
2d792818 3443 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3444 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3445 chan->local_flush_to =
2d792818 3446 le32_to_cpu(efs.flush_to);
66af7aaf 3447 }
f2fcfcd6 3448 break;
66af7aaf 3449
f2fcfcd6 3450 case L2CAP_MODE_STREAMING:
47d1ec61 3451 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3452 }
3453 }
3454
fe4128e0 3455 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 3456 req->flags = __constant_cpu_to_le16(0);
f2fcfcd6
GP		 3457
3458 return ptr - data;
3459}
3460
2d792818
GP		 3461static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3462 u16 result, u16 flags)
1da177e4
LT		 3463{
3464 struct l2cap_conf_rsp *rsp = data;
3465 void *ptr = rsp->data;
1da177e4 3466
fe4128e0 3467 BT_DBG("chan %p", chan);
1da177e4 3468
fe4128e0 3469 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3470 rsp->result = cpu_to_le16(result);
aca3192c 3471 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3472
3473 return ptr - data;
3474}
3475
8c1d787b 3476void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3477{
3478 struct l2cap_conn_rsp rsp;
8c1d787b 3479 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 3480 u8 buf[128];
3481
fe4128e0
GP		 3482 rsp.scid = cpu_to_le16(chan->dcid);
3483 rsp.dcid = cpu_to_le16(chan->scid);
ac73498c
AE		 3484 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
3485 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
2d792818 3486 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
710f9b0a 3487
c1360a1c 3488 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3489 return;
3490
710f9b0a 3491 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3492 l2cap_build_conf_req(chan, buf), buf);
710f9b0a
GP		 3493 chan->num_conf_req++;
3494}
3495
47d1ec61 3496static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3497{
7b1c0049
GP		 3498 int type, olen;
3499 unsigned long val;
c20f8e35
MM		 3500 /* Use sane default values in case a misbehaving remote device
3501 * did not send an RFC or extended window size option.
3502 */
3503 u16 txwin_ext = chan->ack_win;
3504 struct l2cap_conf_rfc rfc = {
3505 .mode = chan->mode,
3506 .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3507 .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3508 .max_pdu_size = cpu_to_le16(chan->imtu),
3509 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3510 };
7b1c0049 3511
47d1ec61 3512 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3513
0c1bc5c6 3514 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3515 return;
3516
3517 while (len >= L2CAP_CONF_OPT_SIZE) {
3518 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3519
c20f8e35
MM		 3520 switch (type) {
3521 case L2CAP_CONF_RFC:
3522 if (olen == sizeof(rfc))
3523 memcpy(&rfc, (void *)val, olen);
8f321f85 3524 break;
c20f8e35
MM		 3525 case L2CAP_CONF_EWS:
3526 txwin_ext = val;
3527 break;
3528 }
7b1c0049
GP		 3529 }
3530
7b1c0049
GP		 3531 switch (rfc.mode) {
3532 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3533 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3534 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 3535 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3536 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3537 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3538 else
3539 chan->ack_win = min_t(u16, chan->ack_win,
3540 rfc.txwin_size);
7b1c0049
GP		 3541 break;
3542 case L2CAP_MODE_STREAMING:
47d1ec61 3543 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3544 }
3545}
3546
2d792818
GP		 3547static inline int l2cap_command_rej(struct l2cap_conn *conn,
3548 struct l2cap_cmd_hdr *cmd, u8 *data)
4e8402a3 3549{
e2fd318e 3550 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3551
e2fd318e 3552 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3553 return 0;
3554
3555 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 3556 cmd->ident == conn->info_ident) {
17cd3f37 3557 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3558
3559 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3560 conn->info_ident = 0;
984947dc 3561
4e8402a3
MH		 3562 l2cap_conn_start(conn);
3563 }
3564
3565 return 0;
3566}
3567
1700915f
MM		 3568static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3569 struct l2cap_cmd_hdr *cmd,
3570 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 3571{
1da177e4
LT		 3572 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3573 struct l2cap_conn_rsp rsp;
23691d75 3574 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 3575 struct sock *parent, *sk = NULL;
e7c29cb1 3576 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3577
3578 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3579 __le16 psm = req->psm;
1da177e4 3580
097db76c 3581 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3582
3583 /* Check if we have socket listening on psm */
c2287681 3584 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 3585 if (!pchan) {
1da177e4
LT		 3586 result = L2CAP_CR_BAD_PSM;
3587 goto sendresp;
3588 }
3589
23691d75
GP		 3590 parent = pchan->sk;
3591
3df91ea2 3592 mutex_lock(&conn->chan_lock);
aa2ac881 3593 lock_sock(parent);
e0f0cb56 3594
e7c29cb1 3595 /* Check if the ACL is secure enough (if not SDP) */
2983fd68 3596 if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 3597 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3598 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3599 result = L2CAP_CR_SEC_BLOCK;
3600 goto response;
3601 }
3602
1da177e4
LT		 3603 result = L2CAP_CR_NO_MEM;
3604
2dfa1003
GP		 3605 /* Check if we already have channel with that dcid */
3606 if (__l2cap_get_chan_by_dcid(conn, scid))
3607 goto response;
3608
80b98027 3609 chan = pchan->ops->new_connection(pchan);
80808e43 3610 if (!chan)
1da177e4
LT		 3611 goto response;
3612
80808e43
GP		 3613 sk = chan->sk;
3614
1da177e4
LT		 3615 hci_conn_hold(conn->hcon);
3616
1da177e4
LT		 3617 bacpy(&bt_sk(sk)->src, conn->src);
3618 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3619 chan->psm = psm;
3620 chan->dcid = scid;
1700915f 3621 chan->local_amp_id = amp_id;
1da177e4 3622
6be36555 3623 __l2cap_chan_add(conn, chan);
48454079 3624
fe4128e0 3625 dcid = chan->scid;
1da177e4 3626
c9b66675 3627 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3628
fc7f8a7e 3629 chan->ident = cmd->ident;
1da177e4 3630
984947dc 3631 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3632 if (l2cap_chan_check_security(chan)) {
c5daa683 3633 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
0e587be7 3634 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3635 result = L2CAP_CR_PEND;
3636 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 3637 chan->ops->defer(chan);
f66dc81f 3638 } else {
1700915f
MM		 3639 /* Force pending result for AMP controllers.
3640 * The connection will succeed after the
3641 * physical link is up.
3642 */
3643 if (amp_id) {
3644 __l2cap_state_change(chan, BT_CONNECT2);
3645 result = L2CAP_CR_PEND;
3646 } else {
3647 __l2cap_state_change(chan, BT_CONFIG);
3648 result = L2CAP_CR_SUCCESS;
3649 }
f66dc81f
MH		 3650 status = L2CAP_CS_NO_INFO;
3651 }
79d554a6 3652 } else {
0e587be7 3653 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3654 result = L2CAP_CR_PEND;
3655 status = L2CAP_CS_AUTHEN_PEND;
3656 }
3657 } else {
0e587be7 3658 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3659 result = L2CAP_CR_PEND;
3660 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3661 }
3662
1da177e4 3663response:
aa2ac881 3664 release_sock(parent);
3df91ea2 3665 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3666
3667sendresp:
aca3192c
YH		 3668 rsp.scid = cpu_to_le16(scid);
3669 rsp.dcid = cpu_to_le16(dcid);
3670 rsp.result = cpu_to_le16(result);
3671 rsp.status = cpu_to_le16(status);
4c89b6aa 3672 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 3673
3674 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3675 struct l2cap_info_req info;
ac73498c 3676 info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 3677
3678 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3679 conn->info_ident = l2cap_get_ident(conn);
3680
ba13ccd9 3681 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 3682
2d792818
GP		 3683 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3684 sizeof(info), &info);
79d554a6
MH		 3685 }
3686
c1360a1c 3687 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 3688 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 3689 u8 buf[128];
c1360a1c 3690 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3691 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3692 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3693 chan->num_conf_req++;
e9aeb2dd 3694 }
1700915f
MM		 3695
3696 return chan;
4c89b6aa 3697}
e9aeb2dd 3698
4c89b6aa
MM		 3699static int l2cap_connect_req(struct l2cap_conn *conn,
3700 struct l2cap_cmd_hdr *cmd, u8 *data)
3701{
300229f9 3702 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 3703 return 0;
3704}
3705
5909cf30 3706static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
2d792818 3707 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3708{
3709 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3710 u16 scid, dcid, result, status;
48454079 3711 struct l2cap_chan *chan;
1da177e4 3712 u8 req[128];
3df91ea2 3713 int err;
1da177e4
LT		 3714
3715 scid = __le16_to_cpu(rsp->scid);
3716 dcid = __le16_to_cpu(rsp->dcid);
3717 result = __le16_to_cpu(rsp->result);
3718 status = __le16_to_cpu(rsp->status);
3719
1b009c98 3720 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 3721 dcid, scid, result, status);
1da177e4 3722
3df91ea2
AE		 3723 mutex_lock(&conn->chan_lock);
3724
1da177e4 3725 if (scid) {
3df91ea2
AE		 3726 chan = __l2cap_get_chan_by_scid(conn, scid);
3727 if (!chan) {
3728 err = -EFAULT;
3729 goto unlock;
3730 }
1da177e4 3731 } else {
3df91ea2
AE		 3732 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3733 if (!chan) {
3734 err = -EFAULT;
3735 goto unlock;
3736 }
1da177e4
LT		 3737 }
3738
3df91ea2
AE		 3739 err = 0;
3740
6be36555 3741 l2cap_chan_lock(chan);
48454079 3742
1da177e4
LT		 3743 switch (result) {
3744 case L2CAP_CR_SUCCESS:
89bc500e 3745 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3746 chan->ident = 0;
fe4128e0 3747 chan->dcid = dcid;
c1360a1c 3748 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3749
c1360a1c 3750 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3751 break;
3752
1da177e4 3753 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3754 l2cap_build_conf_req(chan, req), req);
73ffa904 3755 chan->num_conf_req++;
1da177e4
LT		 3756 break;
3757
3758 case L2CAP_CR_PEND:
c1360a1c 3759 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3760 break;
3761
3762 default:
48454079 3763 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3764 break;
3765 }
3766
6be36555 3767 l2cap_chan_unlock(chan);
3df91ea2
AE		 3768
3769unlock:
3770 mutex_unlock(&conn->chan_lock);
3771
3772 return err;
1da177e4
LT		 3773}
3774
47d1ec61 3775static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3776{
3777 /* FCS is enabled only in ERTM or streaming mode, if one or both
3778 * sides request it.
3779 */
0c1bc5c6 3780 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3781 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3782 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3783 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3784}
3785
29d8a590
AE		 3786static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
3787 u8 ident, u16 flags)
3788{
3789 struct l2cap_conn *conn = chan->conn;
3790
3791 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
3792 flags);
3793
3794 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3795 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3796
3797 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
3798 l2cap_build_conf_rsp(chan, data,
3799 L2CAP_CONF_SUCCESS, flags), data);
3800}
3801
2d792818
GP		 3802static inline int l2cap_config_req(struct l2cap_conn *conn,
3803 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3804 u8 *data)
1da177e4
LT		 3805{
3806 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3807 u16 dcid, flags;
3808 u8 rsp[64];
48454079 3809 struct l2cap_chan *chan;
3c588192 3810 int len, err = 0;
1da177e4
LT		 3811
3812 dcid = __le16_to_cpu(req->dcid);
3813 flags = __le16_to_cpu(req->flags);
3814
3815 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3816
baa7e1fa 3817 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3818 if (!chan)
1da177e4
LT		 3819 return -ENOENT;
3820
033b1142 3821 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3822 struct l2cap_cmd_rej_cid rej;
3823
ac73498c 3824 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
e2fd318e
IK		 3825 rej.scid = cpu_to_le16(chan->scid);
3826 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3827
df6bd743 3828 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2d792818 3829 sizeof(rej), &rej);
354f60a9 3830 goto unlock;
df6bd743 3831 }
354f60a9 3832
5dee9e7c 3833 /* Reject if config buffer is too small. */
88219a0f 3834 len = cmd_len - sizeof(*req);
7ac28817 3835 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3836 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 3837 l2cap_build_conf_rsp(chan, rsp,
3838 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 3839 goto unlock;
3840 }
3841
3842 /* Store config. */
73ffa904
GP		 3843 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3844 chan->conf_len += len;
1da177e4 3845
59e54bd1 3846 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 3847 /* Incomplete config. Send empty response. */
3848 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 3849 l2cap_build_conf_rsp(chan, rsp,
3850 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 3851 goto unlock;
3852 }
3853
3854 /* Complete config. */
73ffa904 3855 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3856 if (len < 0) {
e92c8e70 3857 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3858 goto unlock;
f2fcfcd6 3859 }
1da177e4 3860
1500109b 3861 chan->ident = cmd->ident;
5dee9e7c 3862 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3863 chan->num_conf_rsp++;
5dee9e7c 3864
5dee9e7c 3865 /* Reset config buffer. */
73ffa904 3866 chan->conf_len = 0;
5dee9e7c 3867
c1360a1c 3868 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3869 goto unlock;
3870
c1360a1c 3871 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3872 set_default_fcs(chan);
fcc203c3 3873
105bdf9e
MM		 3874 if (chan->mode == L2CAP_MODE_ERTM ||
3875 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3876 err = l2cap_ertm_init(chan);
3877
3878 if (err < 0)
3879 l2cap_send_disconn_req(chan->conn, chan, -err);
3880 else
3881 l2cap_chan_ready(chan);
0565c1c2 3882
876d9484
MH		 3883 goto unlock;
3884 }
3885
c1360a1c 3886 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3887 u8 buf[64];
1da177e4 3888 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3889 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3890 chan->num_conf_req++;
1da177e4
LT		 3891 }
3892
0e8b207e
AE		 3893 /* Got Conf Rsp PENDING from remote side and asume we sent
3894 Conf Rsp PENDING in the code above */
3895 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 3896 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 3897
3898 /* check compatibility */
3899
79de886d
AE		 3900 /* Send rsp for BR/EDR channel */
3901 if (!chan->ctrl_id)
3902 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
3903 else
3904 chan->ident = cmd->ident;
0e8b207e
AE		 3905 }
3906
1da177e4 3907unlock:
6be36555 3908 l2cap_chan_unlock(chan);
3c588192 3909 return err;
1da177e4
LT		 3910}
3911
2d792818
GP		 3912static inline int l2cap_config_rsp(struct l2cap_conn *conn,
3913 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3914{
3915 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3916 u16 scid, flags, result;
48454079 3917 struct l2cap_chan *chan;
61386cba 3918 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3919 int err = 0;
1da177e4
LT		 3920
3921 scid = __le16_to_cpu(rsp->scid);
3922 flags = __le16_to_cpu(rsp->flags);
3923 result = __le16_to_cpu(rsp->result);
3924
61386cba
AE		 3925 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3926 result, len);
1da177e4 3927
baa7e1fa 3928 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3929 if (!chan)
1da177e4
LT		 3930 return 0;
3931
3932 switch (result) {
3933 case L2CAP_CONF_SUCCESS:
47d1ec61 3934 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3935 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3936 break;
3937
0e8b207e
AE		 3938 case L2CAP_CONF_PENDING:
3939 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3940
3941 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3942 char buf[64];
3943
3944 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 3945 buf, &result);
0e8b207e
AE		 3946 if (len < 0) {
3947 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3948 goto done;
3949 }
3950
3951 /* check compatibility */
3952
79de886d
AE		 3953 if (!chan->ctrl_id)
3954 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
3955 0);
3956 else
3957 chan->ident = cmd->ident;
0e8b207e
AE		 3958 }
3959 goto done;
3960
1da177e4 3961 case L2CAP_CONF_UNACCEPT:
73ffa904 3962 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3963 char req[64];
3964
c2c77ec8 3965 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3966 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3967 goto done;
3968 }
3969
f2fcfcd6
GP		 3970 /* throw out any old stored conf requests */
3971 result = L2CAP_CONF_SUCCESS;
b4450035 3972 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 3973 req, &result);
f2fcfcd6 3974 if (len < 0) {
e92c8e70 3975 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3976 goto done;
3977 }
3978
3979 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 3980 L2CAP_CONF_REQ, len, req);
73ffa904 3981 chan->num_conf_req++;
f2fcfcd6
GP		 3982 if (result != L2CAP_CONF_SUCCESS)
3983 goto done;
3984 break;
1da177e4
LT		 3985 }
3986
8e87d142 3987 default:
6be36555 3988 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3989
ba13ccd9 3990 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3991 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3992 goto done;
3993 }
3994
59e54bd1 3995 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 3996 goto done;
3997
c1360a1c 3998 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3999
c1360a1c 4000 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 4001 set_default_fcs(chan);
fcc203c3 4002
105bdf9e
MM		 4003 if (chan->mode == L2CAP_MODE_ERTM ||
4004 chan->mode == L2CAP_MODE_STREAMING)
3c588192 4005 err = l2cap_ertm_init(chan);
0565c1c2 4006
3c588192
MM		 4007 if (err < 0)
4008 l2cap_send_disconn_req(chan->conn, chan, -err);
4009 else
4010 l2cap_chan_ready(chan);
1da177e4
LT		 4011 }
4012
4013done:
6be36555 4014 l2cap_chan_unlock(chan);
3c588192 4015 return err;
1da177e4
LT		 4016}
4017
2d792818
GP		 4018static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
4019 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4020{
4021 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
4022 struct l2cap_disconn_rsp rsp;
4023 u16 dcid, scid;
48454079 4024 struct l2cap_chan *chan;
1da177e4
LT		 4025 struct sock *sk;
4026
4027 scid = __le16_to_cpu(req->scid);
4028 dcid = __le16_to_cpu(req->dcid);
4029
4030 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
4031
3df91ea2
AE		 4032 mutex_lock(&conn->chan_lock);
4033
4034 chan = __l2cap_get_chan_by_scid(conn, dcid);
4035 if (!chan) {
4036 mutex_unlock(&conn->chan_lock);
1da177e4 4037 return 0;
3df91ea2 4038 }
1da177e4 4039
6be36555
AE		 4040 l2cap_chan_lock(chan);
4041
48454079
GP		 4042 sk = chan->sk;
4043
fe4128e0
GP		 4044 rsp.dcid = cpu_to_le16(chan->scid);
4045 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 4046 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4047
6be36555 4048 lock_sock(sk);
1da177e4 4049 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 4050 release_sock(sk);
1da177e4 4051
61d6ef3e 4052 l2cap_chan_hold(chan);
48454079 4053 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 4054
4055 l2cap_chan_unlock(chan);
1da177e4 4056
80b98027 4057 chan->ops->close(chan);
61d6ef3e 4058 l2cap_chan_put(chan);
3df91ea2
AE		 4059
4060 mutex_unlock(&conn->chan_lock);
4061
1da177e4
LT		 4062 return 0;
4063}
4064
2d792818
GP		 4065static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4066 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4067{
4068 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4069 u16 dcid, scid;
48454079 4070 struct l2cap_chan *chan;
1da177e4
LT		 4071
4072 scid = __le16_to_cpu(rsp->scid);
4073 dcid = __le16_to_cpu(rsp->dcid);
4074
4075 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4076
3df91ea2
AE		 4077 mutex_lock(&conn->chan_lock);
4078
4079 chan = __l2cap_get_chan_by_scid(conn, scid);
4080 if (!chan) {
4081 mutex_unlock(&conn->chan_lock);
1da177e4 4082 return 0;
3df91ea2 4083 }
1da177e4 4084
6be36555 4085 l2cap_chan_lock(chan);
48454079 4086
61d6ef3e 4087 l2cap_chan_hold(chan);
48454079 4088 l2cap_chan_del(chan, 0);
6be36555
AE		 4089
4090 l2cap_chan_unlock(chan);
1da177e4 4091
80b98027 4092 chan->ops->close(chan);
61d6ef3e 4093 l2cap_chan_put(chan);
3df91ea2
AE		 4094
4095 mutex_unlock(&conn->chan_lock);
4096
1da177e4
LT		 4097 return 0;
4098}
4099
2d792818
GP		 4100static inline int l2cap_information_req(struct l2cap_conn *conn,
4101 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4102{
4103 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 4104 u16 type;
4105
4106 type = __le16_to_cpu(req->type);
4107
4108 BT_DBG("type 0x%4.4x", type);
4109
f0709e03
MH		 4110 if (type == L2CAP_IT_FEAT_MASK) {
4111 u8 buf[8];
44dd46de 4112 u32 feat_mask = l2cap_feat_mask;
f0709e03 4113 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
ac73498c
AE		 4114 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
4115 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 4116 if (!disable_ertm)
fcc203c3 4117 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 4118 | L2CAP_FEAT_FCS;
a5fd6f30 4119 if (enable_hs)
6327eb98 4120 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 4121 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 4122
1b7bf4ed 4123 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 4124 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4125 buf);
e1027a7c
MH		 4126 } else if (type == L2CAP_IT_FIXED_CHAN) {
4127 u8 buf[12];
4128 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 4129
4130 if (enable_hs)
4131 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
4132 else
4133 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
4134
ac73498c
AE		 4135 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4136 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 4137 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
2d792818
GP		 4138 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4139 buf);
f0709e03
MH		 4140 } else {
4141 struct l2cap_info_rsp rsp;
4142 rsp.type = cpu_to_le16(type);
ac73498c 4143 rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 4144 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4145 &rsp);
f0709e03 4146 }
1da177e4
LT		 4147
4148 return 0;
4149}
4150
2d792818
GP		 4151static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4152 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4153{
4154 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4155 u16 type, result;
4156
4157 type = __le16_to_cpu(rsp->type);
4158 result = __le16_to_cpu(rsp->result);
4159
4160 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4161
e90165be
AE		 4162 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4163 if (cmd->ident != conn->info_ident ||
2d792818 4164 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 4165 return 0;
4166
17cd3f37 4167 cancel_delayed_work(&conn->info_timer);
4e8402a3 4168
adb08ede
VT		 4169 if (result != L2CAP_IR_SUCCESS) {
4170 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4171 conn->info_ident = 0;
4172
4173 l2cap_conn_start(conn);
4174
4175 return 0;
4176 }
4177
978c93b9
AE		 4178 switch (type) {
4179 case L2CAP_IT_FEAT_MASK:
83985319 4180 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4181
47ec1dcd 4182 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4183 struct l2cap_info_req req;
ac73498c 4184 req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4185
4186 conn->info_ident = l2cap_get_ident(conn);
4187
4188 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4189 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4190 } else {
4191 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4192 conn->info_ident = 0;
4193
4194 l2cap_conn_start(conn);
4195 }
978c93b9
AE		 4196 break;
4197
4198 case L2CAP_IT_FIXED_CHAN:
4199 conn->fixed_chan_mask = rsp->data[0];
984947dc 4200 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4201 conn->info_ident = 0;
984947dc
MH		 4202
4203 l2cap_conn_start(conn);
978c93b9 4204 break;
984947dc 4205 }
4e8402a3 4206
1da177e4
LT		 4207 return 0;
4208}
4209
1700915f
MM		 4210static int l2cap_create_channel_req(struct l2cap_conn *conn,
4211 struct l2cap_cmd_hdr *cmd,
4212 u16 cmd_len, void *data)
f94ff6ff
MM		 4213{
4214 struct l2cap_create_chan_req *req = data;
1700915f 4215 struct l2cap_chan *chan;
f94ff6ff
MM		 4216 u16 psm, scid;
4217
4218 if (cmd_len != sizeof(*req))
4219 return -EPROTO;
4220
4221 if (!enable_hs)
4222 return -EINVAL;
4223
4224 psm = le16_to_cpu(req->psm);
4225 scid = le16_to_cpu(req->scid);
4226
ad0ac6ca 4227 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4228
1700915f
MM		 4229 if (req->amp_id) {
4230 struct hci_dev *hdev;
4231
4232 /* Validate AMP controller id */
4233 hdev = hci_dev_get(req->amp_id);
4234 if (!hdev || hdev->dev_type != HCI_AMP ||
4235 !test_bit(HCI_UP, &hdev->flags)) {
4236 struct l2cap_create_chan_rsp rsp;
4237
4238 rsp.dcid = 0;
4239 rsp.scid = cpu_to_le16(scid);
4240 rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP);
4241 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4242
4243 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4244 sizeof(rsp), &rsp);
4245
4246 if (hdev)
4247 hci_dev_put(hdev);
4248
4249 return 0;
4250 }
4251
4252 hci_dev_put(hdev);
4253 }
f94ff6ff 4254
1700915f
MM		 4255 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4256 req->amp_id);
f94ff6ff
MM		 4257
4258 return 0;
4259}
4260
8eb200bd
MM		 4261static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4262{
4263 struct l2cap_move_chan_req req;
4264 u8 ident;
4265
4266 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4267
4268 ident = l2cap_get_ident(chan->conn);
4269 chan->ident = ident;
4270
4271 req.icid = cpu_to_le16(chan->scid);
4272 req.dest_amp_id = dest_amp_id;
4273
4274 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4275 &req);
4276
4277 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4278}
4279
1500109b 4280static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4281{
4282 struct l2cap_move_chan_rsp rsp;
4283
1500109b 4284 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4285
1500109b 4286 rsp.icid = cpu_to_le16(chan->dcid);
8d5a04a1
MM		 4287 rsp.result = cpu_to_le16(result);
4288
1500109b
MM		 4289 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4290 sizeof(rsp), &rsp);
8d5a04a1
MM		 4291}
4292
5b155ef9 4293static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4294{
4295 struct l2cap_move_chan_cfm cfm;
8d5a04a1 4296
5b155ef9 4297 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4298
5b155ef9 4299 chan->ident = l2cap_get_ident(chan->conn);
8d5a04a1 4300
5b155ef9 4301 cfm.icid = cpu_to_le16(chan->scid);
8d5a04a1
MM		 4302 cfm.result = cpu_to_le16(result);
4303
5b155ef9
MM		 4304 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4305 sizeof(cfm), &cfm);
4306
4307 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4308}
4309
4310static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4311{
4312 struct l2cap_move_chan_cfm cfm;
4313
4314 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4315
4316 cfm.icid = cpu_to_le16(icid);
4317 cfm.result = __constant_cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4318
4319 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4320 sizeof(cfm), &cfm);
8d5a04a1
MM		 4321}
4322
4323static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4324 u16 icid)
8d5a04a1
MM		 4325{
4326 struct l2cap_move_chan_cfm_rsp rsp;
4327
ad0ac6ca 4328 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4329
4330 rsp.icid = cpu_to_le16(icid);
4331 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4332}
4333
5f3847a4
MM		 4334static void __release_logical_link(struct l2cap_chan *chan)
4335{
4336 chan->hs_hchan = NULL;
4337 chan->hs_hcon = NULL;
4338
4339 /* Placeholder - release the logical link */
4340}
4341
1500109b
MM		 4342static void l2cap_logical_fail(struct l2cap_chan *chan)
4343{
4344 /* Logical link setup failed */
4345 if (chan->state != BT_CONNECTED) {
4346 /* Create channel failure, disconnect */
4347 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4348 return;
4349 }
4350
4351 switch (chan->move_role) {
4352 case L2CAP_MOVE_ROLE_RESPONDER:
4353 l2cap_move_done(chan);
4354 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4355 break;
4356 case L2CAP_MOVE_ROLE_INITIATOR:
4357 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4358 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4359 /* Remote has only sent pending or
4360 * success responses, clean up
4361 */
4362 l2cap_move_done(chan);
4363 }
4364
4365 /* Other amp move states imply that the move
4366 * has already aborted
4367 */
4368 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4369 break;
4370 }
4371}
4372
4373static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4374 struct hci_chan *hchan)
4375{
4376 struct l2cap_conf_rsp rsp;
1500109b
MM		 4377
4378 chan->hs_hcon = hchan->conn;
4379 chan->hs_hcon->l2cap_data = chan->conn;
4380
35ba9561 4381 l2cap_send_efs_conf_rsp(chan, &rsp, chan->ident, 0);
1500109b
MM		 4382
4383 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
fe79c6fe 4384 int err;
1500109b
MM		 4385
4386 set_default_fcs(chan);
4387
4388 err = l2cap_ertm_init(chan);
4389 if (err < 0)
4390 l2cap_send_disconn_req(chan->conn, chan, -err);
4391 else
4392 l2cap_chan_ready(chan);
4393 }
4394}
4395
4396static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4397 struct hci_chan *hchan)
4398{
4399 chan->hs_hcon = hchan->conn;
4400 chan->hs_hcon->l2cap_data = chan->conn;
4401
4402 BT_DBG("move_state %d", chan->move_state);
4403
4404 switch (chan->move_state) {
4405 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4406 /* Move confirm will be sent after a success
4407 * response is received
4408 */
4409 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4410 break;
4411 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4412 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4413 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4414 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4415 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4416 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4417 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4418 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4419 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4420 }
4421 break;
4422 default:
4423 /* Move was not in expected state, free the channel */
4424 __release_logical_link(chan);
4425
4426 chan->move_state = L2CAP_MOVE_STABLE;
4427 }
4428}
4429
4430/* Call with chan locked */
27695fb4
AE		 4431void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4432 u8 status)
5b155ef9 4433{
1500109b
MM		 4434 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4435
4436 if (status) {
4437 l2cap_logical_fail(chan);
4438 __release_logical_link(chan);
4439 return;
4440 }
4441
4442 if (chan->state != BT_CONNECTED) {
4443 /* Ignore logical link if channel is on BR/EDR */
4444 if (chan->local_amp_id)
4445 l2cap_logical_finish_create(chan, hchan);
4446 } else {
4447 l2cap_logical_finish_move(chan, hchan);
4448 }
5b155ef9
MM		 4449}
4450
3f7a56c4
MM		 4451void l2cap_move_start(struct l2cap_chan *chan)
4452{
4453 BT_DBG("chan %p", chan);
4454
4455 if (chan->local_amp_id == HCI_BREDR_ID) {
4456 if (chan->chan_policy != BT_CHANNEL_POLICY_AMP_PREFERRED)
4457 return;
4458 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4459 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4460 /* Placeholder - start physical link setup */
4461 } else {
4462 chan->move_role = L2CAP_MOVE_ROLE_INITIATOR;
4463 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4464 chan->move_id = 0;
4465 l2cap_move_setup(chan);
4466 l2cap_send_move_chan_req(chan, 0);
4467 }
4468}
4469
8eb200bd
MM		 4470static void l2cap_do_create(struct l2cap_chan *chan, int result,
4471 u8 local_amp_id, u8 remote_amp_id)
4472{
4473 if (!test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
4474 struct l2cap_conn_rsp rsp;
4475 char buf[128];
4476 rsp.scid = cpu_to_le16(chan->dcid);
4477 rsp.dcid = cpu_to_le16(chan->scid);
4478
4479 /* Incoming channel on AMP */
4480 if (result == L2CAP_CR_SUCCESS) {
4481 /* Send successful response */
4482 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4483 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4484 } else {
4485 /* Send negative response */
4486 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4487 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4488 }
4489
4490 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4491 sizeof(rsp), &rsp);
4492
4493 if (result == L2CAP_CR_SUCCESS) {
4494 __l2cap_state_change(chan, BT_CONFIG);
4495 set_bit(CONF_REQ_SENT, &chan->conf_state);
4496 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4497 L2CAP_CONF_REQ,
4498 l2cap_build_conf_req(chan, buf), buf);
4499 chan->num_conf_req++;
4500 }
4501 } else {
4502 /* Outgoing channel on AMP */
4503 if (result == L2CAP_CR_SUCCESS) {
4504 chan->local_amp_id = local_amp_id;
4505 l2cap_send_create_chan_req(chan, remote_amp_id);
4506 } else {
4507 /* Revert to BR/EDR connect */
4508 l2cap_send_conn_req(chan);
4509 }
4510 }
4511}
4512
4513static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4514 u8 remote_amp_id)
4515{
4516 l2cap_move_setup(chan);
4517 chan->move_id = local_amp_id;
4518 chan->move_state = L2CAP_MOVE_WAIT_RSP;
4519
4520 l2cap_send_move_chan_req(chan, remote_amp_id);
4521}
4522
4523static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4524{
4525 struct hci_chan *hchan = NULL;
4526
4527 /* Placeholder - get hci_chan for logical link */
4528
4529 if (hchan) {
4530 if (hchan->state == BT_CONNECTED) {
4531 /* Logical link is ready to go */
4532 chan->hs_hcon = hchan->conn;
4533 chan->hs_hcon->l2cap_data = chan->conn;
4534 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4535 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4536
4537 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4538 } else {
4539 /* Wait for logical link to be ready */
4540 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4541 }
4542 } else {
4543 /* Logical link not available */
4544 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4545 }
4546}
4547
4548static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4549{
4550 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4551 u8 rsp_result;
4552 if (result == -EINVAL)
4553 rsp_result = L2CAP_MR_BAD_ID;
4554 else
4555 rsp_result = L2CAP_MR_NOT_ALLOWED;
4556
4557 l2cap_send_move_chan_rsp(chan, rsp_result);
4558 }
4559
4560 chan->move_role = L2CAP_MOVE_ROLE_NONE;
4561 chan->move_state = L2CAP_MOVE_STABLE;
4562
4563 /* Restart data transmission */
4564 l2cap_ertm_send(chan);
4565}
4566
4567void l2cap_physical_cfm(struct l2cap_chan *chan, int result, u8 local_amp_id,
4568 u8 remote_amp_id)
4569{
4570 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4571 chan, result, local_amp_id, remote_amp_id);
4572
4573 l2cap_chan_lock(chan);
4574
4575 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4576 l2cap_chan_unlock(chan);
4577 return;
4578 }
4579
4580 if (chan->state != BT_CONNECTED) {
4581 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4582 } else if (result != L2CAP_MR_SUCCESS) {
4583 l2cap_do_move_cancel(chan, result);
4584 } else {
4585 switch (chan->move_role) {
4586 case L2CAP_MOVE_ROLE_INITIATOR:
4587 l2cap_do_move_initiate(chan, local_amp_id,
4588 remote_amp_id);
4589 break;
4590 case L2CAP_MOVE_ROLE_RESPONDER:
4591 l2cap_do_move_respond(chan, result);
4592 break;
4593 default:
4594 l2cap_do_move_cancel(chan, result);
4595 break;
4596 }
4597 }
4598
4599 l2cap_chan_unlock(chan);
4600}
4601
8d5a04a1 4602static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 4603 struct l2cap_cmd_hdr *cmd,
4604 u16 cmd_len, void *data)
8d5a04a1
MM		 4605{
4606 struct l2cap_move_chan_req *req = data;
1500109b 4607 struct l2cap_move_chan_rsp rsp;
02b0fbb9 4608 struct l2cap_chan *chan;
8d5a04a1
MM		 4609 u16 icid = 0;
4610 u16 result = L2CAP_MR_NOT_ALLOWED;
4611
4612 if (cmd_len != sizeof(*req))
4613 return -EPROTO;
4614
4615 icid = le16_to_cpu(req->icid);
4616
ad0ac6ca 4617 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1
MM		 4618
4619 if (!enable_hs)
4620 return -EINVAL;
4621
02b0fbb9
MM		 4622 chan = l2cap_get_chan_by_dcid(conn, icid);
4623 if (!chan) {
1500109b
MM		 4624 rsp.icid = cpu_to_le16(icid);
4625 rsp.result = __constant_cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
4626 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4627 sizeof(rsp), &rsp);
02b0fbb9
MM		 4628 return 0;
4629 }
4630
1500109b
MM		 4631 chan->ident = cmd->ident;
4632
02b0fbb9
MM		 4633 if (chan->scid < L2CAP_CID_DYN_START ||
4634 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4635 (chan->mode != L2CAP_MODE_ERTM &&
4636 chan->mode != L2CAP_MODE_STREAMING)) {
4637 result = L2CAP_MR_NOT_ALLOWED;
4638 goto send_move_response;
4639 }
4640
4641 if (chan->local_amp_id == req->dest_amp_id) {
4642 result = L2CAP_MR_SAME_ID;
4643 goto send_move_response;
4644 }
4645
4646 if (req->dest_amp_id) {
4647 struct hci_dev *hdev;
4648 hdev = hci_dev_get(req->dest_amp_id);
4649 if (!hdev || hdev->dev_type != HCI_AMP ||
4650 !test_bit(HCI_UP, &hdev->flags)) {
4651 if (hdev)
4652 hci_dev_put(hdev);
4653
4654 result = L2CAP_MR_BAD_ID;
4655 goto send_move_response;
4656 }
4657 hci_dev_put(hdev);
4658 }
4659
4660 /* Detect a move collision. Only send a collision response
4661 * if this side has "lost", otherwise proceed with the move.
4662 * The winner has the larger bd_addr.
4663 */
4664 if ((__chan_is_moving(chan) ||
4665 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
4666 bacmp(conn->src, conn->dst) > 0) {
4667 result = L2CAP_MR_COLLISION;
4668 goto send_move_response;
4669 }
4670
02b0fbb9
MM		 4671 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4672 l2cap_move_setup(chan);
4673 chan->move_id = req->dest_amp_id;
4674 icid = chan->dcid;
4675
4676 if (!req->dest_amp_id) {
4677 /* Moving to BR/EDR */
4678 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4679 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4680 result = L2CAP_MR_PEND;
4681 } else {
4682 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4683 result = L2CAP_MR_SUCCESS;
4684 }
4685 } else {
4686 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4687 /* Placeholder - uncomment when amp functions are available */
4688 /*amp_accept_physical(chan, req->dest_amp_id);*/
4689 result = L2CAP_MR_PEND;
4690 }
4691
4692send_move_response:
1500109b 4693 l2cap_send_move_chan_rsp(chan, result);
8d5a04a1 4694
02b0fbb9
MM		 4695 l2cap_chan_unlock(chan);
4696
8d5a04a1
MM		 4697 return 0;
4698}
4699
5b155ef9
MM		 4700static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4701{
4702 struct l2cap_chan *chan;
4703 struct hci_chan *hchan = NULL;
4704
4705 chan = l2cap_get_chan_by_scid(conn, icid);
4706 if (!chan) {
4707 l2cap_send_move_chan_cfm_icid(conn, icid);
4708 return;
4709 }
4710
4711 __clear_chan_timer(chan);
4712 if (result == L2CAP_MR_PEND)
4713 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
4714
4715 switch (chan->move_state) {
4716 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4717 /* Move confirm will be sent when logical link
4718 * is complete.
4719 */
4720 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4721 break;
4722 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
4723 if (result == L2CAP_MR_PEND) {
4724 break;
4725 } else if (test_bit(CONN_LOCAL_BUSY,
4726 &chan->conn_state)) {
4727 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4728 } else {
4729 /* Logical link is up or moving to BR/EDR,
4730 * proceed with move
4731 */
4732 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4733 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4734 }
4735 break;
4736 case L2CAP_MOVE_WAIT_RSP:
4737 /* Moving to AMP */
4738 if (result == L2CAP_MR_SUCCESS) {
4739 /* Remote is ready, send confirm immediately
4740 * after logical link is ready
4741 */
4742 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4743 } else {
4744 /* Both logical link and move success
4745 * are required to confirm
4746 */
4747 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
4748 }
4749
4750 /* Placeholder - get hci_chan for logical link */
4751 if (!hchan) {
4752 /* Logical link not available */
4753 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4754 break;
4755 }
4756
4757 /* If the logical link is not yet connected, do not
4758 * send confirmation.
4759 */
4760 if (hchan->state != BT_CONNECTED)
4761 break;
4762
4763 /* Logical link is already ready to go */
4764
4765 chan->hs_hcon = hchan->conn;
4766 chan->hs_hcon->l2cap_data = chan->conn;
4767
4768 if (result == L2CAP_MR_SUCCESS) {
4769 /* Can confirm now */
4770 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4771 } else {
4772 /* Now only need move success
4773 * to confirm
4774 */
4775 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4776 }
4777
4778 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4779 break;
4780 default:
4781 /* Any other amp move state means the move failed. */
4782 chan->move_id = chan->local_amp_id;
4783 l2cap_move_done(chan);
4784 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4785 }
4786
4787 l2cap_chan_unlock(chan);
4788}
4789
4790static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
4791 u16 result)
4792{
4793 struct l2cap_chan *chan;
4794
4795 chan = l2cap_get_chan_by_ident(conn, ident);
4796 if (!chan) {
4797 /* Could not locate channel, icid is best guess */
4798 l2cap_send_move_chan_cfm_icid(conn, icid);
4799 return;
4800 }
4801
4802 __clear_chan_timer(chan);
4803
4804 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4805 if (result == L2CAP_MR_COLLISION) {
4806 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4807 } else {
4808 /* Cleanup - cancel move */
4809 chan->move_id = chan->local_amp_id;
4810 l2cap_move_done(chan);
4811 }
4812 }
4813
4814 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4815
4816 l2cap_chan_unlock(chan);
4817}
4818
4819static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
4820 struct l2cap_cmd_hdr *cmd,
4821 u16 cmd_len, void *data)
8d5a04a1
MM		 4822{
4823 struct l2cap_move_chan_rsp *rsp = data;
4824 u16 icid, result;
4825
4826 if (cmd_len != sizeof(*rsp))
4827 return -EPROTO;
4828
4829 icid = le16_to_cpu(rsp->icid);
4830 result = le16_to_cpu(rsp->result);
4831
ad0ac6ca 4832 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 4833
5b155ef9
MM		 4834 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
4835 l2cap_move_continue(conn, icid, result);
4836 else
4837 l2cap_move_fail(conn, cmd->ident, icid, result);
8d5a04a1
MM		 4838
4839 return 0;
4840}
4841
5f3847a4
MM		 4842static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
4843 struct l2cap_cmd_hdr *cmd,
4844 u16 cmd_len, void *data)
8d5a04a1
MM		 4845{
4846 struct l2cap_move_chan_cfm *cfm = data;
5f3847a4 4847 struct l2cap_chan *chan;
8d5a04a1
MM		 4848 u16 icid, result;
4849
4850 if (cmd_len != sizeof(*cfm))
4851 return -EPROTO;
4852
4853 icid = le16_to_cpu(cfm->icid);
4854 result = le16_to_cpu(cfm->result);
4855
ad0ac6ca 4856 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 4857
5f3847a4
MM		 4858 chan = l2cap_get_chan_by_dcid(conn, icid);
4859 if (!chan) {
4860 /* Spec requires a response even if the icid was not found */
4861 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
4862 return 0;
4863 }
4864
4865 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
4866 if (result == L2CAP_MC_CONFIRMED) {
4867 chan->local_amp_id = chan->move_id;
4868 if (!chan->local_amp_id)
4869 __release_logical_link(chan);
4870 } else {
4871 chan->move_id = chan->local_amp_id;
4872 }
4873
4874 l2cap_move_done(chan);
4875 }
4876
8d5a04a1
MM		 4877 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
4878
5f3847a4
MM		 4879 l2cap_chan_unlock(chan);
4880
8d5a04a1
MM		 4881 return 0;
4882}
4883
4884static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 4885 struct l2cap_cmd_hdr *cmd,
4886 u16 cmd_len, void *data)
8d5a04a1
MM		 4887{
4888 struct l2cap_move_chan_cfm_rsp *rsp = data;
3fd71a0a 4889 struct l2cap_chan *chan;
8d5a04a1
MM		 4890 u16 icid;
4891
4892 if (cmd_len != sizeof(*rsp))
4893 return -EPROTO;
4894
4895 icid = le16_to_cpu(rsp->icid);
4896
ad0ac6ca 4897 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1 4898
3fd71a0a
MM		 4899 chan = l2cap_get_chan_by_scid(conn, icid);
4900 if (!chan)
4901 return 0;
4902
4903 __clear_chan_timer(chan);
4904
4905 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
4906 chan->local_amp_id = chan->move_id;
4907
4908 if (!chan->local_amp_id && chan->hs_hchan)
4909 __release_logical_link(chan);
4910
4911 l2cap_move_done(chan);
4912 }
4913
4914 l2cap_chan_unlock(chan);
4915
8d5a04a1
MM		 4916 return 0;
4917}
4918
e2174ca4 4919static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
2d792818 4920 u16 to_multiplier)
de73115a
CT		 4921{
4922 u16 max_latency;
4923
4924 if (min > max || min < 6 || max > 3200)
4925 return -EINVAL;
4926
4927 if (to_multiplier < 10 || to_multiplier > 3200)
4928 return -EINVAL;
4929
4930 if (max >= to_multiplier * 8)
4931 return -EINVAL;
4932
4933 max_latency = (to_multiplier * 8 / max) - 1;
4934 if (latency > 499 || latency > max_latency)
4935 return -EINVAL;
4936
4937 return 0;
4938}
4939
4940static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818
GP		 4941 struct l2cap_cmd_hdr *cmd,
4942 u8 *data)
de73115a
CT		 4943{
4944 struct hci_conn *hcon = conn->hcon;
4945 struct l2cap_conn_param_update_req *req;
4946 struct l2cap_conn_param_update_rsp rsp;
4947 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 4948 int err;
de73115a
CT		 4949
4950 if (!(hcon->link_mode & HCI_LM_MASTER))
4951 return -EINVAL;
4952
4953 cmd_len = __le16_to_cpu(cmd->len);
4954 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4955 return -EPROTO;
4956
4957 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 4958 min = __le16_to_cpu(req->min);
4959 max = __le16_to_cpu(req->max);
de73115a
CT		 4960 latency = __le16_to_cpu(req->latency);
4961 to_multiplier = __le16_to_cpu(req->to_multiplier);
4962
4963 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 4964 min, max, latency, to_multiplier);
de73115a
CT		 4965
4966 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 4967
4968 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
4969 if (err)
ac73498c 4970 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 4971 else
ac73498c 4972 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 4973
4974 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 4975 sizeof(rsp), &rsp);
de73115a 4976
2ce603eb
CT		 4977 if (!err)
4978 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
4979
de73115a
CT		 4980 return 0;
4981}
4982
3300d9a9 4983static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 4984 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4985 u8 *data)
3300d9a9
CT		 4986{
4987 int err = 0;
4988
4989 switch (cmd->code) {
4990 case L2CAP_COMMAND_REJ:
4991 l2cap_command_rej(conn, cmd, data);
4992 break;
4993
4994 case L2CAP_CONN_REQ:
4995 err = l2cap_connect_req(conn, cmd, data);
4996 break;
4997
4998 case L2CAP_CONN_RSP:
f5a2598d 4999 case L2CAP_CREATE_CHAN_RSP:
5909cf30 5000 err = l2cap_connect_create_rsp(conn, cmd, data);
3300d9a9
CT		 5001 break;
5002
5003 case L2CAP_CONF_REQ:
5004 err = l2cap_config_req(conn, cmd, cmd_len, data);
5005 break;
5006
5007 case L2CAP_CONF_RSP:
5008 err = l2cap_config_rsp(conn, cmd, data);
5009 break;
5010
5011 case L2CAP_DISCONN_REQ:
5012 err = l2cap_disconnect_req(conn, cmd, data);
5013 break;
5014
5015 case L2CAP_DISCONN_RSP:
5016 err = l2cap_disconnect_rsp(conn, cmd, data);
5017 break;
5018
5019 case L2CAP_ECHO_REQ:
5020 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
5021 break;
5022
5023 case L2CAP_ECHO_RSP:
5024 break;
5025
5026 case L2CAP_INFO_REQ:
5027 err = l2cap_information_req(conn, cmd, data);
5028 break;
5029
5030 case L2CAP_INFO_RSP:
5031 err = l2cap_information_rsp(conn, cmd, data);
5032 break;
5033
f94ff6ff
MM		 5034 case L2CAP_CREATE_CHAN_REQ:
5035 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
5036 break;
5037
8d5a04a1
MM		 5038 case L2CAP_MOVE_CHAN_REQ:
5039 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
5040 break;
5041
5042 case L2CAP_MOVE_CHAN_RSP:
5043 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
5044 break;
5045
5046 case L2CAP_MOVE_CHAN_CFM:
5047 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
5048 break;
5049
5050 case L2CAP_MOVE_CHAN_CFM_RSP:
5051 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
5052 break;
5053
3300d9a9
CT		 5054 default:
5055 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5056 err = -EINVAL;
5057 break;
5058 }
5059
5060 return err;
5061}
5062
5063static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
2d792818 5064 struct l2cap_cmd_hdr *cmd, u8 *data)
3300d9a9
CT		 5065{
5066 switch (cmd->code) {
5067 case L2CAP_COMMAND_REJ:
5068 return 0;
5069
5070 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 5071 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 5072
5073 case L2CAP_CONN_PARAM_UPDATE_RSP:
5074 return 0;
5075
5076 default:
5077 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5078 return -EINVAL;
5079 }
5080}
5081
5082static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 5083 struct sk_buff *skb)
1da177e4
LT		 5084{
5085 u8 *data = skb->data;
5086 int len = skb->len;
5087 struct l2cap_cmd_hdr cmd;
3300d9a9 5088 int err;
1da177e4
LT		 5089
5090 l2cap_raw_recv(conn, skb);
5091
5092 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 5093 u16 cmd_len;
1da177e4
LT		 5094 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5095 data += L2CAP_CMD_HDR_SIZE;
5096 len -= L2CAP_CMD_HDR_SIZE;
5097
88219a0f 5098 cmd_len = le16_to_cpu(cmd.len);
1da177e4 5099
2d792818
GP		 5100 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5101 cmd.ident);
1da177e4 5102
88219a0f 5103 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 5104 BT_DBG("corrupted command");
5105 break;
5106 }
5107
3300d9a9
CT		 5108 if (conn->hcon->type == LE_LINK)
5109 err = l2cap_le_sig_cmd(conn, &cmd, data);
5110 else
5111 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 5112
5113 if (err) {
e2fd318e 5114 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 5115
5116 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 5117
5118 /* FIXME: Map err to a valid reason */
ac73498c 5119 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
2d792818
GP		 5120 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5121 sizeof(rej), &rej);
1da177e4
LT		 5122 }
5123
88219a0f
AV		 5124 data += cmd_len;
5125 len -= cmd_len;
1da177e4
LT		 5126 }
5127
5128 kfree_skb(skb);
5129}
5130
47d1ec61 5131static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 5132{
5133 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 5134 int hdr_size;
5135
5136 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5137 hdr_size = L2CAP_EXT_HDR_SIZE;
5138 else
5139 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 5140
47d1ec61 5141 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 5142 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 5143 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5144 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5145
5146 if (our_fcs != rcv_fcs)
7a560e5c 5147 return -EBADMSG;
fcc203c3
GP		 5148 }
5149 return 0;
5150}
5151
6ea00485 5152static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 5153{
e31f7633 5154 struct l2cap_ctrl control;
d5392c8f 5155
e31f7633 5156 BT_DBG("chan %p", chan);
d5392c8f 5157
e31f7633
MM		 5158 memset(&control, 0, sizeof(control));
5159 control.sframe = 1;
5160 control.final = 1;
5161 control.reqseq = chan->buffer_seq;
5162 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 5163
e2ab4353 5164 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 5165 control.super = L2CAP_SUPER_RNR;
5166 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5167 }
5168
e31f7633
MM		 5169 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5170 chan->unacked_frames > 0)
5171 __set_retrans_timer(chan);
d5392c8f 5172
e31f7633 5173 /* Send pending iframes */
525cd185 5174 l2cap_ertm_send(chan);
d5392c8f 5175
e2ab4353 5176 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 5177 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5178 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5179 * send it now.
5180 */
5181 control.super = L2CAP_SUPER_RR;
5182 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5183 }
5184}
5185
2d792818
GP		 5186static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5187 struct sk_buff **last_frag)
18778a63 5188{
84084a31
MM		 5189 /* skb->len reflects data in skb as well as all fragments
5190 * skb->data_len reflects only data in fragments
5191 */
5192 if (!skb_has_frag_list(skb))
5193 skb_shinfo(skb)->frag_list = new_frag;
5194
5195 new_frag->next = NULL;
5196
5197 (*last_frag)->next = new_frag;
5198 *last_frag = new_frag;
5199
5200 skb->len += new_frag->len;
5201 skb->data_len += new_frag->len;
5202 skb->truesize += new_frag->truesize;
5203}
5204
4b51dae9
MM		 5205static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5206 struct l2cap_ctrl *control)
84084a31
MM		 5207{
5208 int err = -EINVAL;
18778a63 5209
4b51dae9 5210 switch (control->sar) {
7e0ef6ee 5211 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 5212 if (chan->sdu)
5213 break;
18778a63 5214
80b98027 5215 err = chan->ops->recv(chan, skb);
84084a31 5216 break;
18778a63 5217
7e0ef6ee 5218 case L2CAP_SAR_START:
84084a31
MM		 5219 if (chan->sdu)
5220 break;
18778a63 5221
6f61fd47 5222 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 5223 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 5224
84084a31
MM		 5225 if (chan->sdu_len > chan->imtu) {
5226 err = -EMSGSIZE;
5227 break;
5228 }
1890d36b 5229
84084a31
MM		 5230 if (skb->len >= chan->sdu_len)
5231 break;
18778a63 5232
84084a31
MM		 5233 chan->sdu = skb;
5234 chan->sdu_last_frag = skb;
18778a63 5235
84084a31
MM		 5236 skb = NULL;
5237 err = 0;
18778a63
GP		 5238 break;
5239
7e0ef6ee 5240 case L2CAP_SAR_CONTINUE:
6f61fd47 5241 if (!chan->sdu)
84084a31 5242 break;
18778a63 5243
84084a31
MM		 5244 append_skb_frag(chan->sdu, skb,
5245 &chan->sdu_last_frag);
5246 skb = NULL;
18778a63 5247
84084a31
MM		 5248 if (chan->sdu->len >= chan->sdu_len)
5249 break;
4178ba46 5250
84084a31 5251 err = 0;
18778a63
GP		 5252 break;
5253
7e0ef6ee 5254 case L2CAP_SAR_END:
6f61fd47 5255 if (!chan->sdu)
84084a31 5256 break;
18778a63 5257
84084a31
MM		 5258 append_skb_frag(chan->sdu, skb,
5259 &chan->sdu_last_frag);
5260 skb = NULL;
4178ba46 5261
84084a31
MM		 5262 if (chan->sdu->len != chan->sdu_len)
5263 break;
18778a63 5264
80b98027 5265 err = chan->ops->recv(chan, chan->sdu);
1890d36b 5266
84084a31
MM		 5267 if (!err) {
5268 /* Reassembly complete */
5269 chan->sdu = NULL;
5270 chan->sdu_last_frag = NULL;
5271 chan->sdu_len = 0;
1890d36b 5272 }
18778a63
GP		 5273 break;
5274 }
5275
84084a31
MM		 5276 if (err) {
5277 kfree_skb(skb);
5278 kfree_skb(chan->sdu);
5279 chan->sdu = NULL;
5280 chan->sdu_last_frag = NULL;
5281 chan->sdu_len = 0;
5282 }
18778a63 5283
84084a31 5284 return err;
18778a63
GP		 5285}
5286
32b32735
MM		 5287static int l2cap_resegment(struct l2cap_chan *chan)
5288{
5289 /* Placeholder */
5290 return 0;
5291}
5292
61aa4f5b 5293void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 5294{
61aa4f5b 5295 u8 event;
712132eb 5296
61aa4f5b
MM		 5297 if (chan->mode != L2CAP_MODE_ERTM)
5298 return;
712132eb 5299
61aa4f5b 5300 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 5301 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 5302}
5303
d2a7ac5d
MM		 5304static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5305{
63838725
MM		 5306 int err = 0;
5307 /* Pass sequential frames to l2cap_reassemble_sdu()
5308 * until a gap is encountered.
5309 */
5310
5311 BT_DBG("chan %p", chan);
5312
5313 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5314 struct sk_buff *skb;
5315 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5316 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5317
5318 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5319
5320 if (!skb)
5321 break;
5322
5323 skb_unlink(skb, &chan->srej_q);
5324 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5325 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
5326 if (err)
5327 break;
5328 }
5329
5330 if (skb_queue_empty(&chan->srej_q)) {
5331 chan->rx_state = L2CAP_RX_STATE_RECV;
5332 l2cap_send_ack(chan);
5333 }
5334
5335 return err;
d2a7ac5d
MM		 5336}
5337
5338static void l2cap_handle_srej(struct l2cap_chan *chan,
5339 struct l2cap_ctrl *control)
5340{
f80842a8
MM		 5341 struct sk_buff *skb;
5342
5343 BT_DBG("chan %p, control %p", chan, control);
5344
5345 if (control->reqseq == chan->next_tx_seq) {
5346 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5347 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5348 return;
5349 }
5350
5351 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5352
5353 if (skb == NULL) {
5354 BT_DBG("Seq %d not available for retransmission",
5355 control->reqseq);
5356 return;
5357 }
5358
5359 if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
5360 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5361 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5362 return;
5363 }
5364
5365 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5366
5367 if (control->poll) {
5368 l2cap_pass_to_tx(chan, control);
5369
5370 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5371 l2cap_retransmit(chan, control);
5372 l2cap_ertm_send(chan);
5373
5374 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5375 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5376 chan->srej_save_reqseq = control->reqseq;
5377 }
5378 } else {
5379 l2cap_pass_to_tx_fbit(chan, control);
5380
5381 if (control->final) {
5382 if (chan->srej_save_reqseq != control->reqseq ||
5383 !test_and_clear_bit(CONN_SREJ_ACT,
5384 &chan->conn_state))
5385 l2cap_retransmit(chan, control);
5386 } else {
5387 l2cap_retransmit(chan, control);
5388 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5389 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5390 chan->srej_save_reqseq = control->reqseq;
5391 }
5392 }
5393 }
d2a7ac5d
MM		 5394}
5395
5396static void l2cap_handle_rej(struct l2cap_chan *chan,
5397 struct l2cap_ctrl *control)
5398{
fcd289df
MM		 5399 struct sk_buff *skb;
5400
5401 BT_DBG("chan %p, control %p", chan, control);
5402
5403 if (control->reqseq == chan->next_tx_seq) {
5404 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5405 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5406 return;
5407 }
5408
5409 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5410
5411 if (chan->max_tx && skb &&
5412 bt_cb(skb)->control.retries >= chan->max_tx) {
5413 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5414 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5415 return;
5416 }
5417
5418 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5419
5420 l2cap_pass_to_tx(chan, control);
5421
5422 if (control->final) {
5423 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5424 l2cap_retransmit_all(chan, control);
5425 } else {
5426 l2cap_retransmit_all(chan, control);
5427 l2cap_ertm_send(chan);
5428 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5429 set_bit(CONN_REJ_ACT, &chan->conn_state);
5430 }
d2a7ac5d
MM		 5431}
5432
4b51dae9
MM		 5433static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5434{
5435 BT_DBG("chan %p, txseq %d", chan, txseq);
5436
5437 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5438 chan->expected_tx_seq);
5439
5440 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5441 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 5442 chan->tx_win) {
4b51dae9
MM		 5443 /* See notes below regarding "double poll" and
5444 * invalid packets.
5445 */
5446 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5447 BT_DBG("Invalid/Ignore - after SREJ");
5448 return L2CAP_TXSEQ_INVALID_IGNORE;
5449 } else {
5450 BT_DBG("Invalid - in window after SREJ sent");
5451 return L2CAP_TXSEQ_INVALID;
5452 }
5453 }
5454
5455 if (chan->srej_list.head == txseq) {
5456 BT_DBG("Expected SREJ");
5457 return L2CAP_TXSEQ_EXPECTED_SREJ;
5458 }
5459
5460 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5461 BT_DBG("Duplicate SREJ - txseq already stored");
5462 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5463 }
5464
5465 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5466 BT_DBG("Unexpected SREJ - not requested");
5467 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5468 }
5469 }
5470
5471 if (chan->expected_tx_seq == txseq) {
5472 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5473 chan->tx_win) {
5474 BT_DBG("Invalid - txseq outside tx window");
5475 return L2CAP_TXSEQ_INVALID;
5476 } else {
5477 BT_DBG("Expected");
5478 return L2CAP_TXSEQ_EXPECTED;
5479 }
5480 }
5481
5482 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 5483 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 5484 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5485 return L2CAP_TXSEQ_DUPLICATE;
5486 }
5487
5488 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5489 /* A source of invalid packets is a "double poll" condition,
5490 * where delays cause us to send multiple poll packets. If
5491 * the remote stack receives and processes both polls,
5492 * sequence numbers can wrap around in such a way that a
5493 * resent frame has a sequence number that looks like new data
5494 * with a sequence gap. This would trigger an erroneous SREJ
5495 * request.
5496 *
5497 * Fortunately, this is impossible with a tx window that's
5498 * less than half of the maximum sequence number, which allows
5499 * invalid frames to be safely ignored.
5500 *
5501 * With tx window sizes greater than half of the tx window
5502 * maximum, the frame is invalid and cannot be ignored. This
5503 * causes a disconnect.
5504 */
5505
5506 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5507 BT_DBG("Invalid/Ignore - txseq outside tx window");
5508 return L2CAP_TXSEQ_INVALID_IGNORE;
5509 } else {
5510 BT_DBG("Invalid - txseq outside tx window");
5511 return L2CAP_TXSEQ_INVALID;
5512 }
5513 } else {
5514 BT_DBG("Unexpected - txseq indicates missing frames");
5515 return L2CAP_TXSEQ_UNEXPECTED;
5516 }
5517}
5518
d2a7ac5d
MM		 5519static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5520 struct l2cap_ctrl *control,
5521 struct sk_buff *skb, u8 event)
5522{
5523 int err = 0;
5524 bool skb_in_use = 0;
5525
5526 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5527 event);
5528
5529 switch (event) {
5530 case L2CAP_EV_RECV_IFRAME:
5531 switch (l2cap_classify_txseq(chan, control->txseq)) {
5532 case L2CAP_TXSEQ_EXPECTED:
5533 l2cap_pass_to_tx(chan, control);
5534
5535 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5536 BT_DBG("Busy, discarding expected seq %d",
5537 control->txseq);
5538 break;
5539 }
5540
5541 chan->expected_tx_seq = __next_seq(chan,
5542 control->txseq);
5543
5544 chan->buffer_seq = chan->expected_tx_seq;
5545 skb_in_use = 1;
5546
5547 err = l2cap_reassemble_sdu(chan, skb, control);
5548 if (err)
5549 break;
5550
5551 if (control->final) {
5552 if (!test_and_clear_bit(CONN_REJ_ACT,
5553 &chan->conn_state)) {
5554 control->final = 0;
5555 l2cap_retransmit_all(chan, control);
5556 l2cap_ertm_send(chan);
5557 }
5558 }
5559
5560 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
5561 l2cap_send_ack(chan);
5562 break;
5563 case L2CAP_TXSEQ_UNEXPECTED:
5564 l2cap_pass_to_tx(chan, control);
5565
5566 /* Can't issue SREJ frames in the local busy state.
5567 * Drop this frame, it will be seen as missing
5568 * when local busy is exited.
5569 */
5570 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5571 BT_DBG("Busy, discarding unexpected seq %d",
5572 control->txseq);
5573 break;
5574 }
5575
5576 /* There was a gap in the sequence, so an SREJ
5577 * must be sent for each missing frame. The
5578 * current frame is stored for later use.
5579 */
5580 skb_queue_tail(&chan->srej_q, skb);
5581 skb_in_use = 1;
5582 BT_DBG("Queued %p (queue len %d)", skb,
5583 skb_queue_len(&chan->srej_q));
5584
5585 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
5586 l2cap_seq_list_clear(&chan->srej_list);
5587 l2cap_send_srej(chan, control->txseq);
5588
5589 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
5590 break;
5591 case L2CAP_TXSEQ_DUPLICATE:
5592 l2cap_pass_to_tx(chan, control);
5593 break;
5594 case L2CAP_TXSEQ_INVALID_IGNORE:
5595 break;
5596 case L2CAP_TXSEQ_INVALID:
5597 default:
5598 l2cap_send_disconn_req(chan->conn, chan,
5599 ECONNRESET);
5600 break;
5601 }
5602 break;
5603 case L2CAP_EV_RECV_RR:
5604 l2cap_pass_to_tx(chan, control);
5605 if (control->final) {
5606 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5607
e6a3ee6e
MM		 5608 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state) &&
5609 !__chan_is_moving(chan)) {
d2a7ac5d
MM		 5610 control->final = 0;
5611 l2cap_retransmit_all(chan, control);
5612 }
5613
5614 l2cap_ertm_send(chan);
5615 } else if (control->poll) {
5616 l2cap_send_i_or_rr_or_rnr(chan);
5617 } else {
5618 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5619 &chan->conn_state) &&
5620 chan->unacked_frames)
5621 __set_retrans_timer(chan);
5622
5623 l2cap_ertm_send(chan);
5624 }
5625 break;
5626 case L2CAP_EV_RECV_RNR:
5627 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5628 l2cap_pass_to_tx(chan, control);
5629 if (control && control->poll) {
5630 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5631 l2cap_send_rr_or_rnr(chan, 0);
5632 }
5633 __clear_retrans_timer(chan);
5634 l2cap_seq_list_clear(&chan->retrans_list);
5635 break;
5636 case L2CAP_EV_RECV_REJ:
5637 l2cap_handle_rej(chan, control);
5638 break;
5639 case L2CAP_EV_RECV_SREJ:
5640 l2cap_handle_srej(chan, control);
5641 break;
5642 default:
5643 break;
5644 }
5645
5646 if (skb && !skb_in_use) {
5647 BT_DBG("Freeing %p", skb);
5648 kfree_skb(skb);
5649 }
5650
5651 return err;
5652}
5653
5654static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
5655 struct l2cap_ctrl *control,
5656 struct sk_buff *skb, u8 event)
5657{
5658 int err = 0;
5659 u16 txseq = control->txseq;
5660 bool skb_in_use = 0;
5661
5662 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5663 event);
5664
5665 switch (event) {
5666 case L2CAP_EV_RECV_IFRAME:
5667 switch (l2cap_classify_txseq(chan, txseq)) {
5668 case L2CAP_TXSEQ_EXPECTED:
5669 /* Keep frame for reassembly later */
5670 l2cap_pass_to_tx(chan, control);
5671 skb_queue_tail(&chan->srej_q, skb);
5672 skb_in_use = 1;
5673 BT_DBG("Queued %p (queue len %d)", skb,
5674 skb_queue_len(&chan->srej_q));
5675
5676 chan->expected_tx_seq = __next_seq(chan, txseq);
5677 break;
5678 case L2CAP_TXSEQ_EXPECTED_SREJ:
5679 l2cap_seq_list_pop(&chan->srej_list);
5680
5681 l2cap_pass_to_tx(chan, control);
5682 skb_queue_tail(&chan->srej_q, skb);
5683 skb_in_use = 1;
5684 BT_DBG("Queued %p (queue len %d)", skb,
5685 skb_queue_len(&chan->srej_q));
5686
5687 err = l2cap_rx_queued_iframes(chan);
5688 if (err)
5689 break;
5690
5691 break;
5692 case L2CAP_TXSEQ_UNEXPECTED:
5693 /* Got a frame that can't be reassembled yet.
5694 * Save it for later, and send SREJs to cover
5695 * the missing frames.
5696 */
5697 skb_queue_tail(&chan->srej_q, skb);
5698 skb_in_use = 1;
5699 BT_DBG("Queued %p (queue len %d)", skb,
5700 skb_queue_len(&chan->srej_q));
5701
5702 l2cap_pass_to_tx(chan, control);
5703 l2cap_send_srej(chan, control->txseq);
5704 break;
5705 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
5706 /* This frame was requested with an SREJ, but
5707 * some expected retransmitted frames are
5708 * missing. Request retransmission of missing
5709 * SREJ'd frames.
5710 */
5711 skb_queue_tail(&chan->srej_q, skb);
5712 skb_in_use = 1;
5713 BT_DBG("Queued %p (queue len %d)", skb,
5714 skb_queue_len(&chan->srej_q));
5715
5716 l2cap_pass_to_tx(chan, control);
5717 l2cap_send_srej_list(chan, control->txseq);
5718 break;
5719 case L2CAP_TXSEQ_DUPLICATE_SREJ:
5720 /* We've already queued this frame. Drop this copy. */
5721 l2cap_pass_to_tx(chan, control);
5722 break;
5723 case L2CAP_TXSEQ_DUPLICATE:
5724 /* Expecting a later sequence number, so this frame
5725 * was already received. Ignore it completely.
5726 */
5727 break;
5728 case L2CAP_TXSEQ_INVALID_IGNORE:
5729 break;
5730 case L2CAP_TXSEQ_INVALID:
5731 default:
5732 l2cap_send_disconn_req(chan->conn, chan,
5733 ECONNRESET);
5734 break;
5735 }
5736 break;
5737 case L2CAP_EV_RECV_RR:
5738 l2cap_pass_to_tx(chan, control);
5739 if (control->final) {
5740 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5741
5742 if (!test_and_clear_bit(CONN_REJ_ACT,
5743 &chan->conn_state)) {
5744 control->final = 0;
5745 l2cap_retransmit_all(chan, control);
5746 }
5747
5748 l2cap_ertm_send(chan);
5749 } else if (control->poll) {
5750 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5751 &chan->conn_state) &&
5752 chan->unacked_frames) {
5753 __set_retrans_timer(chan);
5754 }
5755
5756 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5757 l2cap_send_srej_tail(chan);
5758 } else {
5759 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5760 &chan->conn_state) &&
5761 chan->unacked_frames)
5762 __set_retrans_timer(chan);
5763
5764 l2cap_send_ack(chan);
5765 }
5766 break;
5767 case L2CAP_EV_RECV_RNR:
5768 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5769 l2cap_pass_to_tx(chan, control);
5770 if (control->poll) {
5771 l2cap_send_srej_tail(chan);
5772 } else {
5773 struct l2cap_ctrl rr_control;
5774 memset(&rr_control, 0, sizeof(rr_control));
5775 rr_control.sframe = 1;
5776 rr_control.super = L2CAP_SUPER_RR;
5777 rr_control.reqseq = chan->buffer_seq;
5778 l2cap_send_sframe(chan, &rr_control);
5779 }
5780
5781 break;
5782 case L2CAP_EV_RECV_REJ:
5783 l2cap_handle_rej(chan, control);
5784 break;
5785 case L2CAP_EV_RECV_SREJ:
5786 l2cap_handle_srej(chan, control);
5787 break;
5788 }
5789
5790 if (skb && !skb_in_use) {
5791 BT_DBG("Freeing %p", skb);
5792 kfree_skb(skb);
5793 }
5794
5795 return err;
5796}
5797
32b32735
MM		 5798static int l2cap_finish_move(struct l2cap_chan *chan)
5799{
5800 BT_DBG("chan %p", chan);
5801
5802 chan->rx_state = L2CAP_RX_STATE_RECV;
5803
5804 if (chan->hs_hcon)
5805 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
5806 else
5807 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
5808
5809 return l2cap_resegment(chan);
5810}
5811
5812static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
5813 struct l2cap_ctrl *control,
5814 struct sk_buff *skb, u8 event)
5815{
5816 int err;
5817
5818 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5819 event);
5820
5821 if (!control->poll)
5822 return -EPROTO;
5823
5824 l2cap_process_reqseq(chan, control->reqseq);
5825
5826 if (!skb_queue_empty(&chan->tx_q))
5827 chan->tx_send_head = skb_peek(&chan->tx_q);
5828 else
5829 chan->tx_send_head = NULL;
5830
5831 /* Rewind next_tx_seq to the point expected
5832 * by the receiver.
5833 */
5834 chan->next_tx_seq = control->reqseq;
5835 chan->unacked_frames = 0;
5836
5837 err = l2cap_finish_move(chan);
5838 if (err)
5839 return err;
5840
5841 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5842 l2cap_send_i_or_rr_or_rnr(chan);
5843
5844 if (event == L2CAP_EV_RECV_IFRAME)
5845 return -EPROTO;
5846
5847 return l2cap_rx_state_recv(chan, control, NULL, event);
5848}
5849
5850static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
5851 struct l2cap_ctrl *control,
5852 struct sk_buff *skb, u8 event)
5853{
5854 int err;
5855
5856 if (!control->final)
5857 return -EPROTO;
5858
5859 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5860
5861 chan->rx_state = L2CAP_RX_STATE_RECV;
5862 l2cap_process_reqseq(chan, control->reqseq);
5863
5864 if (!skb_queue_empty(&chan->tx_q))
5865 chan->tx_send_head = skb_peek(&chan->tx_q);
5866 else
5867 chan->tx_send_head = NULL;
5868
5869 /* Rewind next_tx_seq to the point expected
5870 * by the receiver.
5871 */
5872 chan->next_tx_seq = control->reqseq;
5873 chan->unacked_frames = 0;
5874
5875 if (chan->hs_hcon)
5876 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
5877 else
5878 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
5879
5880 err = l2cap_resegment(chan);
5881
5882 if (!err)
5883 err = l2cap_rx_state_recv(chan, control, skb, event);
5884
5885 return err;
5886}
5887
d2a7ac5d
MM		 5888static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
5889{
5890 /* Make sure reqseq is for a packet that has been sent but not acked */
5891 u16 unacked;
5892
5893 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
5894 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
5895}
5896
cec8ab6e
MM		 5897static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5898 struct sk_buff *skb, u8 event)
218bb9df 5899{
d2a7ac5d
MM		 5900 int err = 0;
5901
5902 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
5903 control, skb, event, chan->rx_state);
5904
5905 if (__valid_reqseq(chan, control->reqseq)) {
5906 switch (chan->rx_state) {
5907 case L2CAP_RX_STATE_RECV:
5908 err = l2cap_rx_state_recv(chan, control, skb, event);
5909 break;
5910 case L2CAP_RX_STATE_SREJ_SENT:
5911 err = l2cap_rx_state_srej_sent(chan, control, skb,
5912 event);
5913 break;
32b32735
MM		 5914 case L2CAP_RX_STATE_WAIT_P:
5915 err = l2cap_rx_state_wait_p(chan, control, skb, event);
5916 break;
5917 case L2CAP_RX_STATE_WAIT_F:
5918 err = l2cap_rx_state_wait_f(chan, control, skb, event);
5919 break;
d2a7ac5d
MM		 5920 default:
5921 /* shut it down */
5922 break;
5923 }
5924 } else {
5925 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
5926 control->reqseq, chan->next_tx_seq,
5927 chan->expected_ack_seq);
5928 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5929 }
5930
5931 return err;
cec8ab6e
MM		 5932}
5933
5934static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5935 struct sk_buff *skb)
5936{
4b51dae9
MM		 5937 int err = 0;
5938
5939 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
5940 chan->rx_state);
5941
5942 if (l2cap_classify_txseq(chan, control->txseq) ==
5943 L2CAP_TXSEQ_EXPECTED) {
5944 l2cap_pass_to_tx(chan, control);
5945
5946 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
5947 __next_seq(chan, chan->buffer_seq));
5948
5949 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5950
5951 l2cap_reassemble_sdu(chan, skb, control);
5952 } else {
5953 if (chan->sdu) {
5954 kfree_skb(chan->sdu);
5955 chan->sdu = NULL;
5956 }
5957 chan->sdu_last_frag = NULL;
5958 chan->sdu_len = 0;
5959
5960 if (skb) {
5961 BT_DBG("Freeing %p", skb);
5962 kfree_skb(skb);
5963 }
5964 }
5965
5966 chan->last_acked_seq = control->txseq;
5967 chan->expected_tx_seq = __next_seq(chan, control->txseq);
5968
5969 return err;
cec8ab6e
MM		 5970}
5971
5972static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
5973{
5974 struct l2cap_ctrl *control = &bt_cb(skb)->control;
5975 u16 len;
5976 u8 event;
218bb9df 5977
b76bbd66
MM		 5978 __unpack_control(chan, skb);
5979
218bb9df
GP		 5980 len = skb->len;
5981
5982 /*
5983 * We can just drop the corrupted I-frame here.
5984 * Receiver will miss it and start proper recovery
cec8ab6e 5985 * procedures and ask for retransmission.
218bb9df 5986 */
47d1ec61 5987 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 5988 goto drop;
5989
cec8ab6e 5990 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 5991 len -= L2CAP_SDULEN_SIZE;
218bb9df 5992
47d1ec61 5993 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 5994 len -= L2CAP_FCS_SIZE;
218bb9df 5995
47d1ec61 5996 if (len > chan->mps) {
8c1d787b 5997 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5998 goto drop;
5999 }
6000
cec8ab6e
MM		 6001 if (!control->sframe) {
6002 int err;
218bb9df 6003
cec8ab6e
MM		 6004 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
6005 control->sar, control->reqseq, control->final,
6006 control->txseq);
218bb9df 6007
cec8ab6e
MM		 6008 /* Validate F-bit - F=0 always valid, F=1 only
6009 * valid in TX WAIT_F
6010 */
6011 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 6012 goto drop;
cec8ab6e
MM		 6013
6014 if (chan->mode != L2CAP_MODE_STREAMING) {
6015 event = L2CAP_EV_RECV_IFRAME;
6016 err = l2cap_rx(chan, control, skb, event);
6017 } else {
6018 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 6019 }
6020
cec8ab6e
MM		 6021 if (err)
6022 l2cap_send_disconn_req(chan->conn, chan,
6023 ECONNRESET);
218bb9df 6024 } else {
cec8ab6e
MM		 6025 const u8 rx_func_to_event[4] = {
6026 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
6027 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
6028 };
6029
6030 /* Only I-frames are expected in streaming mode */
6031 if (chan->mode == L2CAP_MODE_STREAMING)
6032 goto drop;
6033
6034 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
6035 control->reqseq, control->final, control->poll,
6036 control->super);
6037
218bb9df
GP		 6038 if (len != 0) {
6039 BT_ERR("%d", len);
8c1d787b 6040 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 6041 goto drop;
6042 }
6043
cec8ab6e
MM		 6044 /* Validate F and P bits */
6045 if (control->final && (control->poll ||
6046 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
6047 goto drop;
6048
6049 event = rx_func_to_event[control->super];
6050 if (l2cap_rx(chan, control, skb, event))
6051 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 6052 }
6053
6054 return 0;
6055
6056drop:
6057 kfree_skb(skb);
6058 return 0;
6059}
6060
13ca56e0
AE		 6061static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6062 struct sk_buff *skb)
1da177e4 6063{
48454079 6064 struct l2cap_chan *chan;
1da177e4 6065
baa7e1fa 6066 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 6067 if (!chan) {
97e8e89d
AE		 6068 if (cid == L2CAP_CID_A2MP) {
6069 chan = a2mp_channel_create(conn, skb);
6070 if (!chan) {
6071 kfree_skb(skb);
13ca56e0 6072 return;
97e8e89d
AE		 6073 }
6074
6075 l2cap_chan_lock(chan);
6076 } else {
6077 BT_DBG("unknown cid 0x%4.4x", cid);
6078 /* Drop packet and return */
6079 kfree_skb(skb);
13ca56e0 6080 return;
97e8e89d 6081 }
1da177e4
LT		 6082 }
6083
49208c9c 6084 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6085
89bc500e 6086 if (chan->state != BT_CONNECTED)
1da177e4
LT		 6087 goto drop;
6088
0c1bc5c6 6089 switch (chan->mode) {
1c2acffb
GP		 6090 case L2CAP_MODE_BASIC:
6091 /* If socket recv buffers overflows we drop data here
6092 * which is *bad* because L2CAP has to be reliable.
6093 * But we don't have any other choice. L2CAP doesn't
6094 * provide flow control mechanism. */
1da177e4 6095
0c1bc5c6 6096 if (chan->imtu < skb->len)
1c2acffb 6097 goto drop;
1da177e4 6098
80b98027 6099 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 6100 goto done;
6101 break;
6102
6103 case L2CAP_MODE_ERTM:
6840ed07 6104 case L2CAP_MODE_STREAMING:
cec8ab6e 6105 l2cap_data_rcv(chan, skb);
6840ed07
GP		 6106 goto done;
6107
1c2acffb 6108 default:
0c1bc5c6 6109 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 6110 break;
6111 }
1da177e4
LT		 6112
6113drop:
6114 kfree_skb(skb);
6115
6116done:
6be36555 6117 l2cap_chan_unlock(chan);
1da177e4
LT		 6118}
6119
84104b24
AE		 6120static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6121 struct sk_buff *skb)
1da177e4 6122{
23691d75 6123 struct l2cap_chan *chan;
1da177e4 6124
c2287681 6125 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 6126 if (!chan)
1da177e4
LT		 6127 goto drop;
6128
5b4cedaa 6129 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6130
89bc500e 6131 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 6132 goto drop;
6133
e13e21dc 6134 if (chan->imtu < skb->len)
1da177e4
LT		 6135 goto drop;
6136
80b98027 6137 if (!chan->ops->recv(chan, skb))
84104b24 6138 return;
1da177e4
LT		 6139
6140drop:
6141 kfree_skb(skb);
1da177e4
LT		 6142}
6143
6810fca7
AE		 6144static void l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
6145 struct sk_buff *skb)
9f69bda6 6146{
23691d75 6147 struct l2cap_chan *chan;
9f69bda6 6148
c2287681 6149 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 6150 if (!chan)
9f69bda6
GP		 6151 goto drop;
6152
5b4cedaa 6153 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 6154
89bc500e 6155 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 6156 goto drop;
6157
e13e21dc 6158 if (chan->imtu < skb->len)
9f69bda6
GP		 6159 goto drop;
6160
80b98027 6161 if (!chan->ops->recv(chan, skb))
6810fca7 6162 return;
9f69bda6
GP		 6163
6164drop:
6165 kfree_skb(skb);
9f69bda6
GP		 6166}
6167
1da177e4
LT		 6168static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6169{
6170 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 6171 u16 cid, len;
6172 __le16 psm;
1da177e4
LT		 6173
6174 skb_pull(skb, L2CAP_HDR_SIZE);
6175 cid = __le16_to_cpu(lh->cid);
6176 len = __le16_to_cpu(lh->len);
6177
1c2acffb
GP		 6178 if (len != skb->len) {
6179 kfree_skb(skb);
6180 return;
6181 }
6182
1da177e4
LT		 6183 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6184
6185 switch (cid) {
3300d9a9 6186 case L2CAP_CID_LE_SIGNALING:
8db4dc46 6187 case L2CAP_CID_SIGNALING:
1da177e4
LT		 6188 l2cap_sig_channel(conn, skb);
6189 break;
6190
8db4dc46 6191 case L2CAP_CID_CONN_LESS:
097db76c 6192 psm = get_unaligned((__le16 *) skb->data);
0181a70f 6193 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 6194 l2cap_conless_channel(conn, psm, skb);
6195 break;
6196
9f69bda6
GP		 6197 case L2CAP_CID_LE_DATA:
6198 l2cap_att_channel(conn, cid, skb);
6199 break;
6200
b501d6a1
AB		 6201 case L2CAP_CID_SMP:
6202 if (smp_sig_channel(conn, skb))
6203 l2cap_conn_del(conn->hcon, EACCES);
6204 break;
6205
1da177e4
LT		 6206 default:
6207 l2cap_data_channel(conn, cid, skb);
6208 break;
6209 }
6210}
6211
6212/* ---- L2CAP interface with lower layer (HCI) ---- */
6213
686ebf28 6214int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 6215{
6216 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 6217 struct l2cap_chan *c;
1da177e4 6218
6ed93dc6 6219 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 6220
6221 /* Find listening sockets and check their link_mode */
23691d75
GP		 6222 read_lock(&chan_list_lock);
6223 list_for_each_entry(c, &chan_list, global_l) {
6224 struct sock *sk = c->sk;
4343478f 6225
89bc500e 6226 if (c->state != BT_LISTEN)
1da177e4
LT		 6227 continue;
6228
6229 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 6230 lm1 |= HCI_LM_ACCEPT;
43bd0f32 6231 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 6232 lm1 |= HCI_LM_MASTER;
1da177e4 6233 exact++;
2af6b9d5
MH		 6234 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
6235 lm2 |= HCI_LM_ACCEPT;
43bd0f32 6236 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 6237 lm2 |= HCI_LM_MASTER;
6238 }
1da177e4 6239 }
23691d75 6240 read_unlock(&chan_list_lock);
1da177e4
LT		 6241
6242 return exact ? lm1 : lm2;
6243}
6244
9e664631 6245void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 6246{
0139418c
MH		 6247 struct l2cap_conn *conn;
6248
6ed93dc6 6249 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 6250
1da177e4 6251 if (!status) {
1da177e4
LT		 6252 conn = l2cap_conn_add(hcon, status);
6253 if (conn)
6254 l2cap_conn_ready(conn);
0139418c 6255 } else
e175072f 6256 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4 6257
1da177e4
LT		 6258}
6259
686ebf28 6260int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 6261{
6262 struct l2cap_conn *conn = hcon->l2cap_data;
6263
6264 BT_DBG("hcon %p", hcon);
6265
686ebf28 6266 if (!conn)
9f5a0d7b 6267 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 6268 return conn->disc_reason;
6269}
6270
9e664631 6271void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 6272{
6273 BT_DBG("hcon %p reason %d", hcon, reason);
6274
e175072f 6275 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 6276}
6277
4343478f 6278static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 6279{
715ec005 6280 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 6281 return;
6282
f62e4323 6283 if (encrypt == 0x00) {
4343478f 6284 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 6285 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 6286 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 6287 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 6288 } else {
4343478f 6289 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 6290 __clear_chan_timer(chan);
f62e4323
MH		 6291 }
6292}
6293
686ebf28 6294int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 6295{
0139418c 6296 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 6297 struct l2cap_chan *chan;
1da177e4 6298
0139418c 6299 if (!conn)
1da177e4 6300 return 0;
0139418c 6301
89d8b407 6302 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 6303
160dc6ac 6304 if (hcon->type == LE_LINK) {
35d4adcc
HG		 6305 if (!status && encrypt)
6306 smp_distribute_keys(conn, 0);
17cd3f37 6307 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 6308 }
6309
3df91ea2 6310 mutex_lock(&conn->chan_lock);
1da177e4 6311
3df91ea2 6312 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 6313 l2cap_chan_lock(chan);
1da177e4 6314
89d8b407
AE		 6315 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
6316 state_to_string(chan->state));
f1cb9af5 6317
78eb2f98
AE		 6318 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
6319 l2cap_chan_unlock(chan);
6320 continue;
6321 }
6322
f1cb9af5
VCG		 6323 if (chan->scid == L2CAP_CID_LE_DATA) {
6324 if (!status && encrypt) {
6325 chan->sec_level = hcon->sec_level;
cf4cd009 6326 l2cap_chan_ready(chan);
f1cb9af5
VCG		 6327 }
6328
6be36555 6329 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 6330 continue;
6331 }
6332
c1360a1c 6333 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 6334 l2cap_chan_unlock(chan);
6a8d3010
MH		 6335 continue;
6336 }
6337
89bc500e 6338 if (!status && (chan->state == BT_CONNECTED ||
2d792818 6339 chan->state == BT_CONFIG)) {
a7d7723a
GP		 6340 struct sock *sk = chan->sk;
6341
c5daa683 6342 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
a7d7723a
GP		 6343 sk->sk_state_change(sk);
6344
4343478f 6345 l2cap_check_encryption(chan, encrypt);
6be36555 6346 l2cap_chan_unlock(chan);
9719f8af
MH		 6347 continue;
6348 }
6349
89bc500e 6350 if (chan->state == BT_CONNECT) {
b1235d79 6351 if (!status) {
93c3e8f5 6352 l2cap_start_connection(chan);
b1235d79 6353 } else {
ba13ccd9 6354 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 6355 }
89bc500e 6356 } else if (chan->state == BT_CONNECT2) {
6be36555 6357 struct sock *sk = chan->sk;
b1235d79 6358 struct l2cap_conn_rsp rsp;
df3c3931 6359 __u16 res, stat;
1da177e4 6360
6be36555
AE		 6361 lock_sock(sk);
6362
b1235d79 6363 if (!status) {
c5daa683
GP		 6364 if (test_bit(BT_SK_DEFER_SETUP,
6365 &bt_sk(sk)->flags)) {
df3c3931
JH		 6366 res = L2CAP_CR_PEND;
6367 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 6368 chan->ops->defer(chan);
df3c3931 6369 } else {
0e587be7 6370 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 6371 res = L2CAP_CR_SUCCESS;
6372 stat = L2CAP_CS_NO_INFO;
6373 }
b1235d79 6374 } else {
0e587be7 6375 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 6376 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 6377 res = L2CAP_CR_SEC_BLOCK;
6378 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 6379 }
6380
6be36555
AE		 6381 release_sock(sk);
6382
fe4128e0
GP		 6383 rsp.scid = cpu_to_le16(chan->dcid);
6384 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 6385 rsp.result = cpu_to_le16(res);
6386 rsp.status = cpu_to_le16(stat);
fc7f8a7e 6387 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 6388 sizeof(rsp), &rsp);
2d369359
MM		 6389
6390 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
6391 res == L2CAP_CR_SUCCESS) {
6392 char buf[128];
6393 set_bit(CONF_REQ_SENT, &chan->conf_state);
6394 l2cap_send_cmd(conn, l2cap_get_ident(conn),
6395 L2CAP_CONF_REQ,
6396 l2cap_build_conf_req(chan, buf),
6397 buf);
6398 chan->num_conf_req++;
6399 }
b1235d79 6400 }
1da177e4 6401
6be36555 6402 l2cap_chan_unlock(chan);
1da177e4
LT		 6403 }
6404
3df91ea2 6405 mutex_unlock(&conn->chan_lock);
b1235d79 6406
1da177e4
LT		 6407 return 0;
6408}
6409
686ebf28 6410int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 6411{
6412 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988
AE		 6413 struct l2cap_hdr *hdr;
6414 int len;
1da177e4 6415
1d13a254
AE		 6416 /* For AMP controller do not create l2cap conn */
6417 if (!conn && hcon->hdev->dev_type != HCI_BREDR)
6418 goto drop;
1da177e4 6419
5a08ecce
AE		 6420 if (!conn)
6421 conn = l2cap_conn_add(hcon, 0);
6422
6423 if (!conn)
1da177e4
LT		 6424 goto drop;
6425
6426 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
6427
d73a0988
AE		 6428 switch (flags) {
6429 case ACL_START:
6430 case ACL_START_NO_FLUSH:
6431 case ACL_COMPLETE:
1da177e4
LT		 6432 if (conn->rx_len) {
6433 BT_ERR("Unexpected start frame (len %d)", skb->len);
6434 kfree_skb(conn->rx_skb);
6435 conn->rx_skb = NULL;
6436 conn->rx_len = 0;
6437 l2cap_conn_unreliable(conn, ECOMM);
6438 }
6439
aae7fe22
AE		 6440 /* Start fragment always begin with Basic L2CAP header */
6441 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 6442 BT_ERR("Frame is too short (len %d)", skb->len);
6443 l2cap_conn_unreliable(conn, ECOMM);
6444 goto drop;
6445 }
6446
6447 hdr = (struct l2cap_hdr *) skb->data;
6448 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
6449
6450 if (len == skb->len) {
6451 /* Complete frame received */
6452 l2cap_recv_frame(conn, skb);
6453 return 0;
6454 }
6455
6456 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
6457
6458 if (skb->len > len) {
6459 BT_ERR("Frame is too long (len %d, expected len %d)",
2d792818 6460 skb->len, len);
1da177e4
LT		 6461 l2cap_conn_unreliable(conn, ECOMM);
6462 goto drop;
6463 }
6464
6465 /* Allocate skb for the complete frame (with header) */
8bcde1f2 6466 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
af05b30b 6467 if (!conn->rx_skb)
1da177e4
LT		 6468 goto drop;
6469
d626f62b 6470 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 6471 skb->len);
1da177e4 6472 conn->rx_len = len - skb->len;
d73a0988
AE		 6473 break;
6474
6475 case ACL_CONT:
1da177e4
LT		 6476 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
6477
6478 if (!conn->rx_len) {
6479 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
6480 l2cap_conn_unreliable(conn, ECOMM);
6481 goto drop;
6482 }
6483
6484 if (skb->len > conn->rx_len) {
6485 BT_ERR("Fragment is too long (len %d, expected %d)",
2d792818 6486 skb->len, conn->rx_len);
1da177e4
LT		 6487 kfree_skb(conn->rx_skb);
6488 conn->rx_skb = NULL;
6489 conn->rx_len = 0;
6490 l2cap_conn_unreliable(conn, ECOMM);
6491 goto drop;
6492 }
6493
d626f62b 6494 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 6495 skb->len);
1da177e4
LT		 6496 conn->rx_len -= skb->len;
6497
6498 if (!conn->rx_len) {
6499 /* Complete frame received */
6500 l2cap_recv_frame(conn, conn->rx_skb);
6501 conn->rx_skb = NULL;
6502 }
d73a0988 6503 break;
1da177e4
LT		 6504 }
6505
6506drop:
6507 kfree_skb(skb);
6508 return 0;
6509}
6510
aef7d97c 6511static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 6512{
23691d75 6513 struct l2cap_chan *c;
1da177e4 6514
333055f2 6515 read_lock(&chan_list_lock);
1da177e4 6516
23691d75
GP		 6517 list_for_each_entry(c, &chan_list, global_l) {
6518 struct sock *sk = c->sk;
101545f6 6519
fcb73338
AE		 6520 seq_printf(f, "%pMR %pMR %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
6521 &bt_sk(sk)->src, &bt_sk(sk)->dst,
6522 c->state, __le16_to_cpu(c->psm),
6523 c->scid, c->dcid, c->imtu, c->omtu,
6524 c->sec_level, c->mode);
61e1b4b7 6525 }
1da177e4 6526
333055f2 6527 read_unlock(&chan_list_lock);
1da177e4 6528
aef7d97c 6529 return 0;
1da177e4
LT		 6530}
6531
aef7d97c
MH		 6532static int l2cap_debugfs_open(struct inode *inode, struct file *file)
6533{
6534 return single_open(file, l2cap_debugfs_show, inode->i_private);
6535}
6536
6537static const struct file_operations l2cap_debugfs_fops = {
6538 .open = l2cap_debugfs_open,
6539 .read = seq_read,
6540 .llseek = seq_lseek,
6541 .release = single_release,
6542};
6543
6544static struct dentry *l2cap_debugfs;
1da177e4 6545
64274518 6546int __init l2cap_init(void)
1da177e4
LT		 6547{
6548 int err;
be9d1227 6549
bb58f747 6550 err = l2cap_init_sockets();
1da177e4
LT		 6551 if (err < 0)
6552 return err;
6553
aef7d97c 6554 if (bt_debugfs) {
2d792818
GP		 6555 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
6556 NULL, &l2cap_debugfs_fops);
aef7d97c
MH		 6557 if (!l2cap_debugfs)
6558 BT_ERR("Failed to create L2CAP debug file");
6559 }
1da177e4 6560
1da177e4 6561 return 0;
1da177e4
LT		 6562}
6563
64274518 6564void l2cap_exit(void)
1da177e4 6565{
aef7d97c 6566 debugfs_remove(l2cap_debugfs);
bb58f747 6567 l2cap_cleanup_sockets();
1da177e4
LT		 6568}
6569
d1c4a17d
GP		 6570module_param(disable_ertm, bool, 0644);
6571MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)