projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add Read Local AMP Info to init
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 7
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
13
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22
8e87d142
YH		 23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 25 SOFTWARE IS DISCLAIMED.
26*/
27
bb58f747 28/* Bluetooth L2CAP core. */
1da177e4 29
1da177e4
LT		 30#include <linux/module.h>
31
32#include <linux/types.h>
4fc268d2 33#include <linux/capability.h>
1da177e4
LT		 34#include <linux/errno.h>
35#include <linux/kernel.h>
1da177e4
LT		 36#include <linux/sched.h>
37#include <linux/slab.h>
38#include <linux/poll.h>
39#include <linux/fcntl.h>
40#include <linux/init.h>
41#include <linux/interrupt.h>
42#include <linux/socket.h>
43#include <linux/skbuff.h>
1da177e4 44#include <linux/list.h>
be9d1227 45#include <linux/device.h>
aef7d97c
MH		 46#include <linux/debugfs.h>
47#include <linux/seq_file.h>
af05b30b 48#include <linux/uaccess.h>
fcc203c3 49#include <linux/crc16.h>
1da177e4
LT		 50#include <net/sock.h>
51
1da177e4
LT		 52#include <asm/unaligned.h>
53
54#include <net/bluetooth/bluetooth.h>
55#include <net/bluetooth/hci_core.h>
56#include <net/bluetooth/l2cap.h>
b501d6a1 57#include <net/bluetooth/smp.h>
1da177e4 58
eb939922 59bool disable_ertm;
f0709e03 60
47ec1dcd 61static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 62static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 63
b5ad8b7f
JB		 64static LIST_HEAD(chan_list);
65static DEFINE_RWLOCK(chan_list_lock);
1da177e4 66
1da177e4
LT		 67static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
68 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 69static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
70 void *data);
710f9b0a 71static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a
GP		 72static void l2cap_send_disconn_req(struct l2cap_conn *conn,
73 struct l2cap_chan *chan, int err);
1da177e4 74
0139418c 75/* ---- L2CAP channels ---- */
71ba0e56 76
baa7e1fa 77static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 78{
3df91ea2 79 struct l2cap_chan *c;
3d57dc68 80
3df91ea2
AE		 81 list_for_each_entry(c, &conn->chan_l, list) {
82 if (c->dcid == cid)
83 return c;
0139418c 84 }
3df91ea2 85 return NULL;
0139418c
MH		 86}
87
baa7e1fa 88static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 89{
3df91ea2 90 struct l2cap_chan *c;
3d57dc68 91
3df91ea2
AE		 92 list_for_each_entry(c, &conn->chan_l, list) {
93 if (c->scid == cid)
94 return c;
0139418c 95 }
3df91ea2 96 return NULL;
0139418c
MH		 97}
98
99/* Find channel with given SCID.
100 * Returns locked socket */
baa7e1fa 101static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 102{
48454079 103 struct l2cap_chan *c;
baa7e1fa 104
3df91ea2 105 mutex_lock(&conn->chan_lock);
baa7e1fa 106 c = __l2cap_get_chan_by_scid(conn, cid);
3df91ea2
AE		 107 mutex_unlock(&conn->chan_lock);
108
48454079 109 return c;
0139418c
MH		 110}
111
baa7e1fa 112static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 113{
3df91ea2 114 struct l2cap_chan *c;
3d57dc68 115
3df91ea2
AE		 116 list_for_each_entry(c, &conn->chan_l, list) {
117 if (c->ident == ident)
118 return c;
0139418c 119 }
3df91ea2 120 return NULL;
0139418c
MH		 121}
122
baa7e1fa 123static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 124{
48454079 125 struct l2cap_chan *c;
baa7e1fa 126
3df91ea2 127 mutex_lock(&conn->chan_lock);
baa7e1fa 128 c = __l2cap_get_chan_by_ident(conn, ident);
3df91ea2
AE		 129 mutex_unlock(&conn->chan_lock);
130
48454079 131 return c;
0139418c
MH		 132}
133
23691d75 134static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 135{
23691d75 136 struct l2cap_chan *c;
9e4425ff 137
23691d75
GP		 138 list_for_each_entry(c, &chan_list, global_l) {
139 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 140 return c;
9e4425ff 141 }
250938cb 142 return NULL;
9e4425ff
GP		 143}
144
145int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
146{
73b2ec18
GP		 147 int err;
148
333055f2 149 write_lock(&chan_list_lock);
9e4425ff 150
23691d75 151 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 152 err = -EADDRINUSE;
153 goto done;
9e4425ff
GP		 154 }
155
73b2ec18
GP		 156 if (psm) {
157 chan->psm = psm;
158 chan->sport = psm;
159 err = 0;
160 } else {
161 u16 p;
162
163 err = -EINVAL;
164 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 165 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 166 chan->psm = cpu_to_le16(p);
167 chan->sport = cpu_to_le16(p);
168 err = 0;
169 break;
170 }
171 }
9e4425ff 172
73b2ec18 173done:
333055f2 174 write_unlock(&chan_list_lock);
73b2ec18 175 return err;
9e4425ff
GP		 176}
177
178int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
179{
333055f2 180 write_lock(&chan_list_lock);
9e4425ff
GP		 181
182 chan->scid = scid;
183
333055f2 184 write_unlock(&chan_list_lock);
9e4425ff
GP		 185
186 return 0;
187}
188
baa7e1fa 189static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 190{
8db4dc46 191 u16 cid = L2CAP_CID_DYN_START;
0139418c 192
8db4dc46 193 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 194 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 195 return cid;
196 }
197
198 return 0;
199}
200
0e587be7 201static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 202{
42d2d87c 203 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 204 state_to_string(state));
205
89bc500e
GP		 206 chan->state = state;
207 chan->ops->state_change(chan->data, state);
208}
209
0e587be7
AE		 210static void l2cap_state_change(struct l2cap_chan *chan, int state)
211{
212 struct sock *sk = chan->sk;
213
214 lock_sock(sk);
215 __l2cap_state_change(chan, state);
216 release_sock(sk);
217}
218
2e0052e4
AE		 219static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
220{
221 struct sock *sk = chan->sk;
222
223 sk->sk_err = err;
224}
225
226static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
227{
228 struct sock *sk = chan->sk;
229
230 lock_sock(sk);
231 __l2cap_chan_set_err(chan, err);
232 release_sock(sk);
233}
234
721c4181 235static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 236{
721c4181
GP		 237 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
238 chan_timer.work);
3df91ea2 239 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 240 int reason;
241
e05dcc32 242 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 243
3df91ea2 244 mutex_lock(&conn->chan_lock);
6be36555 245 l2cap_chan_lock(chan);
ab07801d 246
89bc500e 247 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 248 reason = ECONNREFUSED;
89bc500e 249 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 250 chan->sec_level != BT_SECURITY_SDP)
251 reason = ECONNREFUSED;
252 else
253 reason = ETIMEDOUT;
254
0f852724 255 l2cap_chan_close(chan, reason);
ab07801d 256
6be36555 257 l2cap_chan_unlock(chan);
ab07801d 258
ba3bd0ee 259 chan->ops->close(chan->data);
3df91ea2
AE		 260 mutex_unlock(&conn->chan_lock);
261
371fd835 262 l2cap_chan_put(chan);
ab07801d
GP		 263}
264
eef1d9b6 265struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 266{
267 struct l2cap_chan *chan;
268
269 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
270 if (!chan)
271 return NULL;
272
c03b355e
AE		 273 mutex_init(&chan->lock);
274
333055f2 275 write_lock(&chan_list_lock);
23691d75 276 list_add(&chan->global_l, &chan_list);
333055f2 277 write_unlock(&chan_list_lock);
23691d75 278
721c4181 279 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 280
89bc500e
GP		 281 chan->state = BT_OPEN;
282
71ba0e56
GP		 283 atomic_set(&chan->refcnt, 1);
284
eef1d9b6 285 BT_DBG("chan %p", chan);
abc545b8 286
48454079
GP		 287 return chan;
288}
289
23691d75 290void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 291{
333055f2 292 write_lock(&chan_list_lock);
23691d75 293 list_del(&chan->global_l);
333055f2 294 write_unlock(&chan_list_lock);
23691d75 295
371fd835 296 l2cap_chan_put(chan);
6ff5abbf
GP		 297}
298
14a28491 299static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 300{
af05b30b 301 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 302 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 303
9f5a0d7b 304 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 305
8c1d787b 306 chan->conn = conn;
0139418c 307
5491120e
AE		 308 switch (chan->chan_type) {
309 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 310 if (conn->hcon->type == LE_LINK) {
311 /* LE connection */
0c1bc5c6 312 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 313 chan->scid = L2CAP_CID_LE_DATA;
314 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 315 } else {
316 /* Alloc CID for connection-oriented socket */
fe4128e0 317 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 318 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 319 }
5491120e
AE		 320 break;
321
322 case L2CAP_CHAN_CONN_LESS:
0139418c 323 /* Connectionless socket */
fe4128e0
GP		 324 chan->scid = L2CAP_CID_CONN_LESS;
325 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 326 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 327 break;
328
329 default:
0139418c 330 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 331 chan->scid = L2CAP_CID_SIGNALING;
332 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 333 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 334 }
335
8f7975b1
AE		 336 chan->local_id = L2CAP_BESTEFFORT_ID;
337 chan->local_stype = L2CAP_SERV_BESTEFFORT;
338 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
339 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
340 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
341 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
342
371fd835 343 l2cap_chan_hold(chan);
baa7e1fa 344
3df91ea2 345 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 346}
347
14a28491 348static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 349{
350 mutex_lock(&conn->chan_lock);
351 __l2cap_chan_add(conn, chan);
3df91ea2 352 mutex_unlock(&conn->chan_lock);
0139418c
MH		 353}
354
4519de9a 355static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 356{
48454079 357 struct sock *sk = chan->sk;
8c1d787b 358 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 359 struct sock *parent = bt_sk(sk)->parent;
360
c9b66675 361 __clear_chan_timer(chan);
0139418c 362
49208c9c 363 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 364
8e87d142 365 if (conn) {
baa7e1fa 366 /* Delete from channel list */
3df91ea2 367 list_del(&chan->list);
3d57dc68 368
371fd835 369 l2cap_chan_put(chan);
baa7e1fa 370
8c1d787b 371 chan->conn = NULL;
0139418c
MH		 372 hci_conn_put(conn->hcon);
373 }
374
6be36555
AE		 375 lock_sock(sk);
376
0e587be7 377 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 378 sock_set_flag(sk, SOCK_ZAPPED);
379
380 if (err)
2e0052e4 381 __l2cap_chan_set_err(chan, err);
0139418c
MH		 382
383 if (parent) {
384 bt_accept_unlink(sk);
385 parent->sk_data_ready(parent, 0);
386 } else
387 sk->sk_state_change(sk);
c13ffa62 388
6be36555
AE		 389 release_sock(sk);
390
c1360a1c
GP		 391 if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
392 test_bit(CONF_INPUT_DONE, &chan->conf_state)))
6ff5abbf 393 return;
2ead70b8 394
58d35f87 395 skb_queue_purge(&chan->tx_q);
c13ffa62 396
0c1bc5c6 397 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 398 struct srej_list *l, *tmp;
399
1a09bcb9
GP		 400 __clear_retrans_timer(chan);
401 __clear_monitor_timer(chan);
402 __clear_ack_timer(chan);
c13ffa62 403
f1c6775b 404 skb_queue_purge(&chan->srej_q);
c13ffa62 405
39d5a3ee 406 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 407 list_del(&l->list);
408 kfree(l);
409 }
410 }
0139418c
MH		 411}
412
4519de9a
GP		 413static void l2cap_chan_cleanup_listen(struct sock *parent)
414{
415 struct sock *sk;
416
417 BT_DBG("parent %p", parent);
418
419 /* Close not yet accepted channels */
0f852724 420 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 421 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 422
6be36555 423 l2cap_chan_lock(chan);
c9b66675 424 __clear_chan_timer(chan);
ba3bd0ee 425 l2cap_chan_close(chan, ECONNRESET);
6be36555 426 l2cap_chan_unlock(chan);
3df91ea2 427
ba3bd0ee 428 chan->ops->close(chan->data);
0f852724 429 }
4519de9a
GP		 430}
431
0f852724 432void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 433{
434 struct l2cap_conn *conn = chan->conn;
435 struct sock *sk = chan->sk;
436
e05dcc32
AE		 437 BT_DBG("chan %p state %s sk %p", chan,
438 state_to_string(chan->state), sk);
4519de9a 439
89bc500e 440 switch (chan->state) {
4519de9a 441 case BT_LISTEN:
6be36555 442 lock_sock(sk);
4519de9a 443 l2cap_chan_cleanup_listen(sk);
89bc500e 444
0e587be7 445 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 446 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 447 release_sock(sk);
4519de9a
GP		 448 break;
449
450 case BT_CONNECTED:
451 case BT_CONFIG:
715ec005 452 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 453 conn->hcon->type == ACL_LINK) {
c9b66675 454 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 455 l2cap_send_disconn_req(conn, chan, reason);
456 } else
457 l2cap_chan_del(chan, reason);
458 break;
459
460 case BT_CONNECT2:
715ec005 461 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 462 conn->hcon->type == ACL_LINK) {
463 struct l2cap_conn_rsp rsp;
464 __u16 result;
465
466 if (bt_sk(sk)->defer_setup)
467 result = L2CAP_CR_SEC_BLOCK;
468 else
469 result = L2CAP_CR_BAD_PSM;
89bc500e 470 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 471
472 rsp.scid = cpu_to_le16(chan->dcid);
473 rsp.dcid = cpu_to_le16(chan->scid);
474 rsp.result = cpu_to_le16(result);
475 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
476 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
477 sizeof(rsp), &rsp);
478 }
479
480 l2cap_chan_del(chan, reason);
481 break;
482
483 case BT_CONNECT:
484 case BT_DISCONN:
485 l2cap_chan_del(chan, reason);
486 break;
487
488 default:
6be36555 489 lock_sock(sk);
4519de9a 490 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 491 release_sock(sk);
4519de9a
GP		 492 break;
493 }
494}
495
4343478f 496static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 497{
715ec005 498 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 499 switch (chan->sec_level) {
8556edd3
JH		 500 case BT_SECURITY_HIGH:
501 return HCI_AT_DEDICATED_BONDING_MITM;
502 case BT_SECURITY_MEDIUM:
503 return HCI_AT_DEDICATED_BONDING;
504 default:
505 return HCI_AT_NO_BONDING;
506 }
fe4128e0 507 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 508 if (chan->sec_level == BT_SECURITY_LOW)
509 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 510
4343478f 511 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 512 return HCI_AT_NO_BONDING_MITM;
00ae4af9 513 else
8556edd3 514 return HCI_AT_NO_BONDING;
00ae4af9 515 } else {
4343478f 516 switch (chan->sec_level) {
00ae4af9 517 case BT_SECURITY_HIGH:
8556edd3 518 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 519 case BT_SECURITY_MEDIUM:
8556edd3 520 return HCI_AT_GENERAL_BONDING;
00ae4af9 521 default:
8556edd3 522 return HCI_AT_NO_BONDING;
00ae4af9 523 }
0684e5f9 524 }
8556edd3
JH		 525}
526
527/* Service level security */
d45fc423 528int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 529{
8c1d787b 530 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 531 __u8 auth_type;
532
4343478f 533 auth_type = l2cap_get_auth_type(chan);
79d554a6 534
4343478f 535 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 536}
537
b5ad8b7f 538static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 539{
540 u8 id;
541
542 /* Get next available identificator.
543 * 1 - 128 are used by kernel.
544 * 129 - 199 are reserved.
545 * 200 - 254 are used by utilities like l2ping, etc.
546 */
547
333055f2 548 spin_lock(&conn->lock);
4e8402a3
MH		 549
550 if (++conn->tx_ident > 128)
551 conn->tx_ident = 1;
552
553 id = conn->tx_ident;
554
333055f2 555 spin_unlock(&conn->lock);
4e8402a3
MH		 556
557 return id;
558}
559
4519de9a 560static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 561{
562 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 563 u8 flags;
4e8402a3
MH		 564
565 BT_DBG("code 0x%2.2x", code);
566
567 if (!skb)
9a9c6a34 568 return;
4e8402a3 569
e702112f
AE		 570 if (lmp_no_flush_capable(conn->hcon->hdev))
571 flags = ACL_START_NO_FLUSH;
572 else
573 flags = ACL_START;
574
14b12d0b 575 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 576 skb->priority = HCI_PRIO_MAX;
14b12d0b 577
73d80deb
LAD		 578 hci_send_acl(conn->hchan, skb, flags);
579}
580
581static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
582{
583 struct hci_conn *hcon = chan->conn->hcon;
584 u16 flags;
585
586 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
587 skb->priority);
588
589 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
590 lmp_no_flush_capable(hcon->hdev))
591 flags = ACL_START_NO_FLUSH;
592 else
593 flags = ACL_START;
14b12d0b 594
73d80deb
LAD		 595 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
596 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 597}
598
88843ab0 599static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
1c2acffb
GP		 600{
601 struct sk_buff *skb;
602 struct l2cap_hdr *lh;
8c1d787b 603 struct l2cap_conn *conn = chan->conn;
e4ca6d98 604 int count, hlen;
fcc203c3 605
89bc500e 606 if (chan->state != BT_CONNECTED)
c13ffa62
GP		 607 return;
608
e4ca6d98
AE		 609 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
610 hlen = L2CAP_EXT_HDR_SIZE;
611 else
612 hlen = L2CAP_ENH_HDR_SIZE;
613
47d1ec61 614 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 615 hlen += L2CAP_FCS_SIZE;
1c2acffb 616
88843ab0 617 BT_DBG("chan %p, control 0x%8.8x", chan, control);
1c2acffb 618
fcc203c3 619 count = min_t(unsigned int, conn->mtu, hlen);
793c2f1c
AE		 620
621 control |= __set_sframe(chan);
1c2acffb 622
e2ab4353 623 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 624 control |= __set_ctrl_final(chan);
9e917af1 625
e2ab4353 626 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
e3781735 627 control |= __set_ctrl_poll(chan);
f0946ccf 628
1c2acffb
GP		 629 skb = bt_skb_alloc(count, GFP_ATOMIC);
630 if (!skb)
9a9c6a34 631 return;
1c2acffb
GP		 632
633 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fcc203c3 634 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
fe4128e0 635 lh->cid = cpu_to_le16(chan->dcid);
88843ab0
AE		 636
637 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1c2acffb 638
47d1ec61 639 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 640 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
641 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 642 }
643
73d80deb
LAD		 644 skb->priority = HCI_PRIO_MAX;
645 l2cap_do_send(chan, skb);
1c2acffb
GP		 646}
647
88843ab0 648static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
7e743090 649{
e2ab4353 650 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 651 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 652 set_bit(CONN_RNR_SENT, &chan->conn_state);
1890d36b 653 } else
ab784b73 654 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
7e743090 655
0b209fae 656 control |= __set_reqseq(chan, chan->buffer_seq);
2ab25cdd 657
525cd185 658 l2cap_send_sframe(chan, control);
7e743090
GP		 659}
660
b4450035 661static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 662{
c1360a1c 663 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 664}
665
9b27f350
AE		 666static void l2cap_send_conn_req(struct l2cap_chan *chan)
667{
668 struct l2cap_conn *conn = chan->conn;
669 struct l2cap_conn_req req;
670
671 req.scid = cpu_to_le16(chan->scid);
672 req.psm = chan->psm;
673
674 chan->ident = l2cap_get_ident(conn);
675
676 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
677
678 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
679}
680
fc7f8a7e 681static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 682{
8c1d787b 683 struct l2cap_conn *conn = chan->conn;
79d554a6
MH		 684
685 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 686 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
687 return;
688
d45fc423 689 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 690 __l2cap_no_conn_pending(chan))
691 l2cap_send_conn_req(chan);
79d554a6
MH		 692 } else {
693 struct l2cap_info_req req;
694 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
695
696 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
697 conn->info_ident = l2cap_get_ident(conn);
698
ba13ccd9 699 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 700
701 l2cap_send_cmd(conn, conn->info_ident,
702 L2CAP_INFO_REQ, sizeof(req), &req);
703 }
704}
705
cf6c2c0b
GP		 706static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
707{
708 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 709 if (!disable_ertm)
cf6c2c0b
GP		 710 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
711
712 switch (mode) {
713 case L2CAP_MODE_ERTM:
714 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
715 case L2CAP_MODE_STREAMING:
716 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
717 default:
718 return 0x00;
719 }
720}
721
4519de9a 722static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 723{
6be36555 724 struct sock *sk = chan->sk;
22121fc9
GP		 725 struct l2cap_disconn_req req;
726
c13ffa62
GP		 727 if (!conn)
728 return;
729
0c1bc5c6 730 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 731 __clear_retrans_timer(chan);
732 __clear_monitor_timer(chan);
733 __clear_ack_timer(chan);
c13ffa62
GP		 734 }
735
fe4128e0
GP		 736 req.dcid = cpu_to_le16(chan->dcid);
737 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 738 l2cap_send_cmd(conn, l2cap_get_ident(conn),
739 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 740
6be36555 741 lock_sock(sk);
0e587be7 742 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 743 __l2cap_chan_set_err(chan, err);
6be36555 744 release_sock(sk);
22121fc9
GP		 745}
746
1da177e4 747/* ---- L2CAP connections ---- */
4e8402a3
MH		 748static void l2cap_conn_start(struct l2cap_conn *conn)
749{
3df91ea2 750 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 751
752 BT_DBG("conn %p", conn);
753
3df91ea2 754 mutex_lock(&conn->chan_lock);
4e8402a3 755
3df91ea2 756 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 757 struct sock *sk = chan->sk;
baa7e1fa 758
6be36555 759 l2cap_chan_lock(chan);
4e8402a3 760
715ec005 761 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 762 l2cap_chan_unlock(chan);
79d554a6
MH		 763 continue;
764 }
765
89bc500e 766 if (chan->state == BT_CONNECT) {
d45fc423 767 if (!l2cap_chan_check_security(chan) ||
b4450035 768 !__l2cap_no_conn_pending(chan)) {
6be36555 769 l2cap_chan_unlock(chan);
47731de7
GP		 770 continue;
771 }
79d554a6 772
c1360a1c
GP		 773 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
774 && test_bit(CONF_STATE2_DEVICE,
775 &chan->conf_state)) {
89bc500e 776 l2cap_chan_close(chan, ECONNRESET);
6be36555 777 l2cap_chan_unlock(chan);
47731de7 778 continue;
b1235d79 779 }
47731de7 780
9b27f350 781 l2cap_send_conn_req(chan);
47731de7 782
89bc500e 783 } else if (chan->state == BT_CONNECT2) {
79d554a6 784 struct l2cap_conn_rsp rsp;
e9aeb2dd 785 char buf[128];
fe4128e0
GP		 786 rsp.scid = cpu_to_le16(chan->dcid);
787 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 788
d45fc423 789 if (l2cap_chan_check_security(chan)) {
6be36555 790 lock_sock(sk);
f66dc81f
MH		 791 if (bt_sk(sk)->defer_setup) {
792 struct sock *parent = bt_sk(sk)->parent;
793 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
794 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 795 if (parent)
796 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 797
798 } else {
0e587be7 799 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 800 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
801 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
802 }
6be36555 803 release_sock(sk);
79d554a6
MH		 804 } else {
805 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
806 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
807 }
808
fc7f8a7e
GP		 809 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
810 sizeof(rsp), &rsp);
e9aeb2dd 811
c1360a1c 812 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 813 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 814 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 815 continue;
816 }
817
c1360a1c 818 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 819 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 820 l2cap_build_conf_req(chan, buf), buf);
821 chan->num_conf_req++;
4e8402a3
MH		 822 }
823
6be36555 824 l2cap_chan_unlock(chan);
4e8402a3
MH		 825 }
826
3df91ea2 827 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 828}
829
b62f328b
VT		 830/* Find socket with cid and source bdaddr.
831 * Returns closest match, locked.
832 */
d9b88702
AE		 833static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
834 bdaddr_t *src)
b62f328b 835{
23691d75 836 struct l2cap_chan *c, *c1 = NULL;
b62f328b 837
23691d75 838 read_lock(&chan_list_lock);
b62f328b 839
23691d75
GP		 840 list_for_each_entry(c, &chan_list, global_l) {
841 struct sock *sk = c->sk;
fe4128e0 842
89bc500e 843 if (state && c->state != state)
b62f328b
VT		 844 continue;
845
23691d75 846 if (c->scid == cid) {
b62f328b 847 /* Exact match. */
23691d75
GP		 848 if (!bacmp(&bt_sk(sk)->src, src)) {
849 read_unlock(&chan_list_lock);
850 return c;
851 }
b62f328b
VT		 852
853 /* Closest match */
854 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
23691d75 855 c1 = c;
b62f328b
VT		 856 }
857 }
280f294f 858
23691d75 859 read_unlock(&chan_list_lock);
b62f328b 860
23691d75 861 return c1;
b62f328b
VT		 862}
863
864static void l2cap_le_conn_ready(struct l2cap_conn *conn)
865{
c916fbe4 866 struct sock *parent, *sk;
23691d75 867 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 868
869 BT_DBG("");
870
871 /* Check if we have socket listening on cid */
23691d75 872 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
b62f328b 873 conn->src);
23691d75 874 if (!pchan)
b62f328b
VT		 875 return;
876
23691d75
GP		 877 parent = pchan->sk;
878
aa2ac881 879 lock_sock(parent);
62f3a2cf 880
b62f328b
VT		 881 /* Check for backlog size */
882 if (sk_acceptq_is_full(parent)) {
883 BT_DBG("backlog full %d", parent->sk_ack_backlog);
884 goto clean;
885 }
886
80808e43
GP		 887 chan = pchan->ops->new_connection(pchan->data);
888 if (!chan)
b62f328b
VT		 889 goto clean;
890
80808e43 891 sk = chan->sk;
5d41ce1d 892
b62f328b
VT		 893 hci_conn_hold(conn->hcon);
894
b62f328b
VT		 895 bacpy(&bt_sk(sk)->src, conn->src);
896 bacpy(&bt_sk(sk)->dst, conn->dst);
897
d1010240
GP		 898 bt_accept_enqueue(parent, sk);
899
3d57dc68 900 l2cap_chan_add(conn, chan);
48454079 901
c9b66675 902 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 903
0e587be7 904 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 905 parent->sk_data_ready(parent, 0);
906
b62f328b 907clean:
aa2ac881 908 release_sock(parent);
b62f328b
VT		 909}
910
cf4cd009 911static void l2cap_chan_ready(struct l2cap_chan *chan)
f1cb9af5 912{
cf4cd009 913 struct sock *sk = chan->sk;
6be36555
AE		 914 struct sock *parent;
915
916 lock_sock(sk);
917
918 parent = bt_sk(sk)->parent;
f1cb9af5
VCG		 919
920 BT_DBG("sk %p, parent %p", sk, parent);
921
922 chan->conf_state = 0;
923 __clear_chan_timer(chan);
924
0e587be7 925 __l2cap_state_change(chan, BT_CONNECTED);
f1cb9af5
VCG		 926 sk->sk_state_change(sk);
927
928 if (parent)
929 parent->sk_data_ready(parent, 0);
6be36555
AE		 930
931 release_sock(sk);
f1cb9af5
VCG		 932}
933
4e8402a3
MH		 934static void l2cap_conn_ready(struct l2cap_conn *conn)
935{
48454079 936 struct l2cap_chan *chan;
4e8402a3 937
79d554a6 938 BT_DBG("conn %p", conn);
4e8402a3 939
b62f328b
VT		 940 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
941 l2cap_le_conn_ready(conn);
942
160dc6ac
VCG		 943 if (conn->hcon->out && conn->hcon->type == LE_LINK)
944 smp_conn_security(conn, conn->hcon->pending_sec_level);
945
3df91ea2 946 mutex_lock(&conn->chan_lock);
4e8402a3 947
3df91ea2 948 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 949
6be36555 950 l2cap_chan_lock(chan);
4e8402a3 951
63128451 952 if (conn->hcon->type == LE_LINK) {
b501d6a1 953 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 954 l2cap_chan_ready(chan);
acd7d370 955
63128451 956 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 957 struct sock *sk = chan->sk;
c9b66675 958 __clear_chan_timer(chan);
6be36555 959 lock_sock(sk);
0e587be7 960 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 961 sk->sk_state_change(sk);
6be36555 962 release_sock(sk);
b501d6a1 963
89bc500e 964 } else if (chan->state == BT_CONNECT)
fc7f8a7e 965 l2cap_do_start(chan);
4e8402a3 966
6be36555 967 l2cap_chan_unlock(chan);
4e8402a3 968 }
79d554a6 969
3df91ea2 970 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 971}
972
973/* Notify sockets that we cannot guaranty reliability anymore */
974static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
975{
48454079 976 struct l2cap_chan *chan;
4e8402a3
MH		 977
978 BT_DBG("conn %p", conn);
979
3df91ea2 980 mutex_lock(&conn->chan_lock);
4e8402a3 981
3df91ea2 982 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 983 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 984 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 985 }
986
3df91ea2 987 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 988}
989
f878fcad 990static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 991{
f878fcad 992 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 993 info_timer.work);
4e8402a3 994
984947dc 995 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 996 conn->info_ident = 0;
984947dc 997
4e8402a3
MH		 998 l2cap_conn_start(conn);
999}
1000
5d3de7df
VCG		 1001static void l2cap_conn_del(struct hci_conn *hcon, int err)
1002{
1003 struct l2cap_conn *conn = hcon->l2cap_data;
1004 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1005
1006 if (!conn)
1007 return;
1008
1009 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1010
1011 kfree_skb(conn->rx_skb);
1012
3df91ea2
AE		 1013 mutex_lock(&conn->chan_lock);
1014
5d3de7df
VCG		 1015 /* Kill channels */
1016 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
6be36555
AE		 1017 l2cap_chan_lock(chan);
1018
5d3de7df 1019 l2cap_chan_del(chan, err);
6be36555
AE		 1020
1021 l2cap_chan_unlock(chan);
1022
5d3de7df
VCG		 1023 chan->ops->close(chan->data);
1024 }
1025
3df91ea2
AE		 1026 mutex_unlock(&conn->chan_lock);
1027
73d80deb
LAD		 1028 hci_chan_del(conn->hchan);
1029
5d3de7df 1030 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1031 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1032
51a8efd7 1033 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1034 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1035 smp_chan_destroy(conn);
d26a2345 1036 }
5d3de7df
VCG		 1037
1038 hcon->l2cap_data = NULL;
1039 kfree(conn);
1040}
1041
6c9d42a1 1042static void security_timeout(struct work_struct *work)
5d3de7df 1043{
6c9d42a1
GP		 1044 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1045 security_timer.work);
5d3de7df
VCG		 1046
1047 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1048}
1049
1da177e4
LT		 1050static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1051{
0139418c 1052 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1053 struct hci_chan *hchan;
1da177e4 1054
0139418c 1055 if (conn || status)
1da177e4
LT		 1056 return conn;
1057
73d80deb
LAD		 1058 hchan = hci_chan_create(hcon);
1059 if (!hchan)
1060 return NULL;
1061
0139418c 1062 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1063 if (!conn) {
1064 hci_chan_del(hchan);
1da177e4 1065 return NULL;
73d80deb 1066 }
1da177e4
LT		 1067
1068 hcon->l2cap_data = conn;
1069 conn->hcon = hcon;
73d80deb 1070 conn->hchan = hchan;
1da177e4 1071
73d80deb 1072 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1073
acd7d370
VT		 1074 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1075 conn->mtu = hcon->hdev->le_mtu;
1076 else
1077 conn->mtu = hcon->hdev->acl_mtu;
1078
1da177e4
LT		 1079 conn->src = &hcon->hdev->bdaddr;
1080 conn->dst = &hcon->dst;
1081
4e8402a3
MH		 1082 conn->feat_mask = 0;
1083
1da177e4 1084 spin_lock_init(&conn->lock);
3df91ea2 1085 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1086
1087 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1088
5d3de7df 1089 if (hcon->type == LE_LINK)
6c9d42a1 1090 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1091 else
030013d8 1092 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1093
9f5a0d7b 1094 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1095
1da177e4
LT		 1096 return conn;
1097}
1098
1da177e4 1099/* ---- Socket interface ---- */
1da177e4
LT		 1100
1101/* Find socket with psm and source bdaddr.
1102 * Returns closest match.
1103 */
23691d75 1104static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4 1105{
23691d75 1106 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1107
23691d75 1108 read_lock(&chan_list_lock);
e0f0cb56 1109
23691d75
GP		 1110 list_for_each_entry(c, &chan_list, global_l) {
1111 struct sock *sk = c->sk;
fe4128e0 1112
89bc500e 1113 if (state && c->state != state)
1da177e4
LT		 1114 continue;
1115
23691d75 1116 if (c->psm == psm) {
1da177e4 1117 /* Exact match. */
23691d75 1118 if (!bacmp(&bt_sk(sk)->src, src)) {
a7567b20 1119 read_unlock(&chan_list_lock);
23691d75
GP		 1120 return c;
1121 }
1da177e4
LT		 1122
1123 /* Closest match */
1124 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
23691d75 1125 c1 = c;
1da177e4
LT		 1126 }
1127 }
1da177e4 1128
23691d75 1129 read_unlock(&chan_list_lock);
e0f0cb56 1130
23691d75 1131 return c1;
1da177e4
LT		 1132}
1133
cbe8fed4 1134int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
1da177e4 1135{
5d41ce1d 1136 struct sock *sk = chan->sk;
1da177e4 1137 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1138 struct l2cap_conn *conn;
1139 struct hci_conn *hcon;
1140 struct hci_dev *hdev;
09ab6f4c 1141 __u8 auth_type;
44d0e48e 1142 int err;
1da177e4 1143
f29972de 1144 BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
097db76c 1145 __le16_to_cpu(chan->psm));
1da177e4 1146
af05b30b
GP		 1147 hdev = hci_get_route(dst, src);
1148 if (!hdev)
1da177e4
LT		 1149 return -EHOSTUNREACH;
1150
09fd0de5 1151 hci_dev_lock(hdev);
1da177e4 1152
6be36555 1153 l2cap_chan_lock(chan);
03a00194
GP		 1154
1155 /* PSM must be odd and lsb of upper byte must be 0 */
1156 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1157 chan->chan_type != L2CAP_CHAN_RAW) {
1158 err = -EINVAL;
1159 goto done;
1160 }
1161
1162 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1163 err = -EINVAL;
1164 goto done;
1165 }
1166
1167 switch (chan->mode) {
1168 case L2CAP_MODE_BASIC:
1169 break;
1170 case L2CAP_MODE_ERTM:
1171 case L2CAP_MODE_STREAMING:
1172 if (!disable_ertm)
1173 break;
1174 /* fall through */
1175 default:
1176 err = -ENOTSUPP;
1177 goto done;
1178 }
1179
6be36555
AE		 1180 lock_sock(sk);
1181
03a00194
GP		 1182 switch (sk->sk_state) {
1183 case BT_CONNECT:
1184 case BT_CONNECT2:
1185 case BT_CONFIG:
1186 /* Already connecting */
1187 err = 0;
6be36555 1188 release_sock(sk);
03a00194
GP		 1189 goto done;
1190
1191 case BT_CONNECTED:
1192 /* Already connected */
1193 err = -EISCONN;
6be36555 1194 release_sock(sk);
03a00194
GP		 1195 goto done;
1196
1197 case BT_OPEN:
1198 case BT_BOUND:
1199 /* Can connect */
1200 break;
1201
1202 default:
1203 err = -EBADFD;
6be36555 1204 release_sock(sk);
03a00194
GP		 1205 goto done;
1206 }
1207
1208 /* Set destination address and psm */
9219b2a0 1209 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1210
1211 release_sock(sk);
1212
03a00194
GP		 1213 chan->psm = psm;
1214 chan->dcid = cid;
1da177e4 1215
4343478f 1216 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1217
fe4128e0 1218 if (chan->dcid == L2CAP_CID_LE_DATA)
acd7d370 1219 hcon = hci_connect(hdev, LE_LINK, dst,
4343478f 1220 chan->sec_level, auth_type);
acd7d370
VT		 1221 else
1222 hcon = hci_connect(hdev, ACL_LINK, dst,
4343478f 1223 chan->sec_level, auth_type);
acd7d370 1224
30e76272
VT		 1225 if (IS_ERR(hcon)) {
1226 err = PTR_ERR(hcon);
1da177e4 1227 goto done;
30e76272 1228 }
1da177e4
LT		 1229
1230 conn = l2cap_conn_add(hcon, 0);
1231 if (!conn) {
1232 hci_conn_put(hcon);
30e76272 1233 err = -ENOMEM;
1da177e4
LT		 1234 goto done;
1235 }
1236
1da177e4
LT		 1237 /* Update source addr of the socket */
1238 bacpy(src, conn->src);
1239
6be36555 1240 l2cap_chan_unlock(chan);
48454079 1241 l2cap_chan_add(conn, chan);
6be36555 1242 l2cap_chan_lock(chan);
48454079 1243
6be36555 1244 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1245 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1246
1247 if (hcon->state == BT_CONNECTED) {
715ec005 1248 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1249 __clear_chan_timer(chan);
d45fc423 1250 if (l2cap_chan_check_security(chan))
6be36555 1251 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1252 } else
fc7f8a7e 1253 l2cap_do_start(chan);
1da177e4
LT		 1254 }
1255
30e76272
VT		 1256 err = 0;
1257
1da177e4 1258done:
6be36555 1259 l2cap_chan_unlock(chan);
09fd0de5 1260 hci_dev_unlock(hdev);
1da177e4
LT		 1261 hci_dev_put(hdev);
1262 return err;
1263}
1264
dcba0dba 1265int __l2cap_wait_ack(struct sock *sk)
6161c038 1266{
8c1d787b 1267 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1268 DECLARE_WAITQUEUE(wait, current);
1269 int err = 0;
1270 int timeo = HZ/5;
1271
2b0b05dd 1272 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1273 set_current_state(TASK_INTERRUPTIBLE);
1274 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1275 if (!timeo)
1276 timeo = HZ/5;
1277
1278 if (signal_pending(current)) {
1279 err = sock_intr_errno(timeo);
1280 break;
1281 }
1282
1283 release_sock(sk);
1284 timeo = schedule_timeout(timeo);
1285 lock_sock(sk);
a71a0cf4 1286 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1287
1288 err = sock_error(sk);
1289 if (err)
1290 break;
1291 }
1292 set_current_state(TASK_RUNNING);
2b0b05dd 1293 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1294 return err;
1295}
1296
721c4181 1297static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1298{
721c4181
GP		 1299 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1300 monitor_timer.work);
e90bac06 1301
525cd185 1302 BT_DBG("chan %p", chan);
0e98958d 1303
6be36555
AE		 1304 l2cap_chan_lock(chan);
1305
2c03a7a4 1306 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1307 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
6be36555 1308 l2cap_chan_unlock(chan);
8d7e1c7f 1309 l2cap_chan_put(chan);
e90bac06
GP		 1310 return;
1311 }
1312
6a026610 1313 chan->retry_count++;
1a09bcb9 1314 __set_monitor_timer(chan);
e90bac06 1315
525cd185 1316 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555 1317 l2cap_chan_unlock(chan);
8d7e1c7f 1318 l2cap_chan_put(chan);
e90bac06
GP		 1319}
1320
721c4181 1321static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1322{
721c4181
GP		 1323 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1324 retrans_timer.work);
e90bac06 1325
49208c9c 1326 BT_DBG("chan %p", chan);
0e98958d 1327
6be36555
AE		 1328 l2cap_chan_lock(chan);
1329
6a026610 1330 chan->retry_count = 1;
1a09bcb9 1331 __set_monitor_timer(chan);
e90bac06 1332
e2ab4353 1333 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1334
525cd185 1335 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555
AE		 1336
1337 l2cap_chan_unlock(chan);
8d7e1c7f 1338 l2cap_chan_put(chan);
e90bac06
GP		 1339}
1340
42e5c802 1341static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1342{
1c2acffb 1343 struct sk_buff *skb;
1da177e4 1344
58d35f87 1345 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1346 chan->unacked_frames) {
42e5c802 1347 if (bt_cb(skb)->tx_seq == chan->expected_ack_seq)
1c2acffb 1348 break;
1da177e4 1349
58d35f87 1350 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1351 kfree_skb(skb);
1da177e4 1352
6a026610 1353 chan->unacked_frames--;
1c2acffb 1354 }
1da177e4 1355
6a026610 1356 if (!chan->unacked_frames)
1a09bcb9 1357 __clear_retrans_timer(chan);
1c2acffb 1358}
1da177e4 1359
67c9e840 1360static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1361{
ccbb84af 1362 struct sk_buff *skb;
88843ab0
AE		 1363 u32 control;
1364 u16 fcs;
6840ed07 1365
58d35f87 1366 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1367 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1368 control |= __set_txseq(chan, chan->next_tx_seq);
88843ab0 1369 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1370
47d1ec61 1371 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1372 fcs = crc16(0, (u8 *)skb->data,
1373 skb->len - L2CAP_FCS_SIZE);
1374 put_unaligned_le16(fcs,
1375 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1376 }
1377
4343478f 1378 l2cap_do_send(chan, skb);
6840ed07 1379
836be934 1380 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1381 }
6840ed07
GP		 1382}
1383
fb45de7d 1384static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1385{
8f17154f 1386 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1387 u16 fcs;
1388 u32 control;
8f17154f 1389
58d35f87 1390 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1391 if (!skb)
1392 return;
8f17154f 1393
d1726b6d 1394 while (bt_cb(skb)->tx_seq != tx_seq) {
58d35f87 1395 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1396 return;
8f17154f 1397
d1726b6d
SJ		 1398 skb = skb_queue_next(&chan->tx_q, skb);
1399 }
8f17154f 1400
2c03a7a4
GP		 1401 if (chan->remote_max_tx &&
1402 bt_cb(skb)->retries == chan->remote_max_tx) {
8c1d787b 1403 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1404 return;
1405 }
1406
1407 tx_skb = skb_clone(skb, GFP_ATOMIC);
1408 bt_cb(skb)->retries++;
88843ab0
AE		 1409
1410 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1411 control &= __get_sar_mask(chan);
3cb123d1 1412
e2ab4353 1413 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1414 control |= __set_ctrl_final(chan);
95ffa978 1415
0b209fae 1416 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1417 control |= __set_txseq(chan, tx_seq);
3cb123d1 1418
88843ab0 1419 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1420
47d1ec61 1421 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1422 fcs = crc16(0, (u8 *)tx_skb->data,
1423 tx_skb->len - L2CAP_FCS_SIZE);
1424 put_unaligned_le16(fcs,
1425 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1426 }
1427
4343478f 1428 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1429}
1430
67c9e840 1431static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1432{
1433 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1434 u16 fcs;
1435 u32 control;
9a9c6a34 1436 int nsent = 0;
1c2acffb 1437
89bc500e 1438 if (chan->state != BT_CONNECTED)
c13ffa62 1439 return -ENOTCONN;
e90bac06 1440
58d35f87 1441 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1442
2c03a7a4
GP		 1443 if (chan->remote_max_tx &&
1444 bt_cb(skb)->retries == chan->remote_max_tx) {
8c1d787b 1445 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1446 break;
1447 }
1448
e420aba3
AE		 1449 tx_skb = skb_clone(skb, GFP_ATOMIC);
1450
e90bac06
GP		 1451 bt_cb(skb)->retries++;
1452
88843ab0 1453 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1454 control &= __get_sar_mask(chan);
95ffa978 1455
e2ab4353 1456 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1457 control |= __set_ctrl_final(chan);
e2ab4353 1458
0b209fae 1459 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1460 control |= __set_txseq(chan, chan->next_tx_seq);
1c2acffb 1461
88843ab0 1462 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1463
47d1ec61 1464 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1465 fcs = crc16(0, (u8 *)skb->data,
1466 tx_skb->len - L2CAP_FCS_SIZE);
1467 put_unaligned_le16(fcs, skb->data +
1468 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1469 }
1470
4343478f 1471 l2cap_do_send(chan, tx_skb);
9a9c6a34 1472
1a09bcb9 1473 __set_retrans_timer(chan);
1c2acffb 1474
42e5c802 1475 bt_cb(skb)->tx_seq = chan->next_tx_seq;
836be934
AE		 1476
1477 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1478
8ed7a0ae 1479 if (bt_cb(skb)->retries == 1) {
6a026610 1480 chan->unacked_frames++;
930fa4ae
SJ		 1481
1482 if (!nsent++)
1483 __clear_ack_timer(chan);
8ed7a0ae 1484 }
23e9fde2 1485
6a026610 1486 chan->frames_sent++;
1c2acffb 1487
58d35f87
GP		 1488 if (skb_queue_is_last(&chan->tx_q, skb))
1489 chan->tx_send_head = NULL;
1c2acffb 1490 else
58d35f87 1491 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1c2acffb
GP		 1492 }
1493
9e917af1
GP		 1494 return nsent;
1495}
1496
525cd185 1497static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1498{
dfc909be
GP		 1499 int ret;
1500
58d35f87
GP		 1501 if (!skb_queue_empty(&chan->tx_q))
1502 chan->tx_send_head = chan->tx_q.next;
dfc909be 1503
42e5c802 1504 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1505 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1506 return ret;
1507}
1508
b17e73bb 1509static void __l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1510{
88843ab0 1511 u32 control = 0;
9e917af1 1512
0b209fae 1513 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1514
e2ab4353 1515 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1516 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1517 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1518 l2cap_send_sframe(chan, control);
9a9c6a34 1519 return;
9e917af1 1520 }
dfc909be 1521
525cd185 1522 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1523 return;
1524
ab784b73 1525 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1526 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1527}
1528
b17e73bb
SJ		 1529static void l2cap_send_ack(struct l2cap_chan *chan)
1530{
1531 __clear_ack_timer(chan);
1532 __l2cap_send_ack(chan);
1533}
1534
525cd185 1535static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1536{
1537 struct srej_list *tail;
88843ab0 1538 u32 control;
99b0d4b7 1539
ab784b73 1540 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1541 control |= __set_ctrl_final(chan);
99b0d4b7 1542
39d5a3ee 1543 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1544 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1545
525cd185 1546 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1547}
1548
04124681
GP		 1549static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1550 struct msghdr *msg, int len,
1551 int count, struct sk_buff *skb)
1c2acffb 1552{
0952a57a 1553 struct l2cap_conn *conn = chan->conn;
1c2acffb
GP		 1554 struct sk_buff **frag;
1555 int err, sent = 0;
1da177e4 1556
59203a21 1557 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1558 return -EFAULT;
1da177e4
LT		 1559
1560 sent += count;
1561 len -= count;
1562
1563 /* Continuation fragments (no L2CAP header) */
1564 frag = &skb_shinfo(skb)->frag_list;
1565 while (len) {
1566 count = min_t(unsigned int, conn->mtu, len);
1567
2f7719ce 1568 *frag = chan->ops->alloc_skb(chan, count,
04124681
GP		 1569 msg->msg_flags & MSG_DONTWAIT,
1570 &err);
2f7719ce 1571
1da177e4 1572 if (!*frag)
0175d629 1573 return err;
1c2acffb
GP		 1574 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1575 return -EFAULT;
1da177e4 1576
5e59b791
LAD		 1577 (*frag)->priority = skb->priority;
1578
1da177e4
LT		 1579 sent += count;
1580 len -= count;
1581
1582 frag = &(*frag)->next;
1583 }
1da177e4
LT		 1584
1585 return sent;
1c2acffb 1586}
1da177e4 1587
5e59b791
LAD		 1588static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1589 struct msghdr *msg, size_t len,
1590 u32 priority)
1c2acffb 1591{
8c1d787b 1592 struct l2cap_conn *conn = chan->conn;
1c2acffb 1593 struct sk_buff *skb;
03a51213 1594 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1595 struct l2cap_hdr *lh;
1596
6d5922b0 1597 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1598
1599 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1600
1601 skb = chan->ops->alloc_skb(chan, count + hlen,
04124681 1602 msg->msg_flags & MSG_DONTWAIT, &err);
2f7719ce 1603
1c2acffb 1604 if (!skb)
0175d629 1605 return ERR_PTR(err);
1c2acffb 1606
5e59b791
LAD		 1607 skb->priority = priority;
1608
1c2acffb
GP		 1609 /* Create L2CAP header */
1610 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1611 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1612 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
097db76c 1613 put_unaligned(chan->psm, skb_put(skb, 2));
1c2acffb 1614
0952a57a 1615 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1616 if (unlikely(err < 0)) {
1617 kfree_skb(skb);
1618 return ERR_PTR(err);
1619 }
1620 return skb;
1621}
1622
5e59b791
LAD		 1623static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1624 struct msghdr *msg, size_t len,
1625 u32 priority)
1c2acffb 1626{
8c1d787b 1627 struct l2cap_conn *conn = chan->conn;
1c2acffb
GP		 1628 struct sk_buff *skb;
1629 int err, count, hlen = L2CAP_HDR_SIZE;
1630 struct l2cap_hdr *lh;
1631
6d5922b0 1632 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb
GP		 1633
1634 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1635
1636 skb = chan->ops->alloc_skb(chan, count + hlen,
04124681 1637 msg->msg_flags & MSG_DONTWAIT, &err);
2f7719ce 1638
1c2acffb 1639 if (!skb)
0175d629 1640 return ERR_PTR(err);
1c2acffb 1641
5e59b791
LAD		 1642 skb->priority = priority;
1643
1c2acffb
GP		 1644 /* Create L2CAP header */
1645 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1646 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb
GP		 1647 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1648
0952a57a 1649 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1650 if (unlikely(err < 0)) {
1651 kfree_skb(skb);
1652 return ERR_PTR(err);
1653 }
1654 return skb;
1655}
1656
ab0ff76d
LAD		 1657static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1658 struct msghdr *msg, size_t len,
88843ab0 1659 u32 control, u16 sdulen)
1c2acffb 1660{
8c1d787b 1661 struct l2cap_conn *conn = chan->conn;
1c2acffb 1662 struct sk_buff *skb;
e4ca6d98 1663 int err, count, hlen;
1c2acffb
GP		 1664 struct l2cap_hdr *lh;
1665
6d5922b0 1666 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1667
0ee0d208
GP		 1668 if (!conn)
1669 return ERR_PTR(-ENOTCONN);
1670
e4ca6d98
AE		 1671 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1672 hlen = L2CAP_EXT_HDR_SIZE;
1673 else
1674 hlen = L2CAP_ENH_HDR_SIZE;
1675
c74e560c 1676 if (sdulen)
03a51213 1677 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1678
47d1ec61 1679 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1680 hlen += L2CAP_FCS_SIZE;
fcc203c3 1681
1c2acffb 1682 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1683
1684 skb = chan->ops->alloc_skb(chan, count + hlen,
1685 msg->msg_flags & MSG_DONTWAIT, &err);
1686
1c2acffb 1687 if (!skb)
0175d629 1688 return ERR_PTR(err);
1c2acffb
GP		 1689
1690 /* Create L2CAP header */
1691 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1692 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1693 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0
AE		 1694
1695 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1696
c74e560c 1697 if (sdulen)
03a51213 1698 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 1699
0952a57a 1700 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1701 if (unlikely(err < 0)) {
1702 kfree_skb(skb);
1703 return ERR_PTR(err);
1704 }
e90bac06 1705
47d1ec61 1706 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1707 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1708
e90bac06 1709 bt_cb(skb)->retries = 0;
1c2acffb 1710 return skb;
1da177e4
LT		 1711}
1712
67c9e840 1713static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
c74e560c 1714{
c74e560c
GP		 1715 struct sk_buff *skb;
1716 struct sk_buff_head sar_queue;
88843ab0 1717 u32 control;
c74e560c
GP		 1718 size_t size = 0;
1719
ff12fd64 1720 skb_queue_head_init(&sar_queue);
7e0ef6ee 1721 control = __set_ctrl_sar(chan, L2CAP_SAR_START);
47d1ec61 1722 skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
c74e560c
GP		 1723 if (IS_ERR(skb))
1724 return PTR_ERR(skb);
1725
1726 __skb_queue_tail(&sar_queue, skb);
2c03a7a4
GP		 1727 len -= chan->remote_mps;
1728 size += chan->remote_mps;
c74e560c
GP		 1729
1730 while (len > 0) {
1731 size_t buflen;
1732
2c03a7a4 1733 if (len > chan->remote_mps) {
7e0ef6ee 1734 control = __set_ctrl_sar(chan, L2CAP_SAR_CONTINUE);
2c03a7a4 1735 buflen = chan->remote_mps;
c74e560c 1736 } else {
7e0ef6ee 1737 control = __set_ctrl_sar(chan, L2CAP_SAR_END);
c74e560c
GP		 1738 buflen = len;
1739 }
1740
47d1ec61 1741 skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
c74e560c
GP		 1742 if (IS_ERR(skb)) {
1743 skb_queue_purge(&sar_queue);
1744 return PTR_ERR(skb);
1745 }
1746
1747 __skb_queue_tail(&sar_queue, skb);
1748 len -= buflen;
1749 size += buflen;
c74e560c 1750 }
58d35f87
GP		 1751 skb_queue_splice_tail(&sar_queue, &chan->tx_q);
1752 if (chan->tx_send_head == NULL)
1753 chan->tx_send_head = sar_queue.next;
c74e560c
GP		 1754
1755 return size;
1756}
1757
5e59b791
LAD		 1758int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
1759 u32 priority)
9a91a04a 1760{
9a91a04a 1761 struct sk_buff *skb;
88843ab0 1762 u32 control;
9a91a04a
GP		 1763 int err;
1764
1765 /* Connectionless channel */
715ec005 1766 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 1767 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 1768 if (IS_ERR(skb))
1769 return PTR_ERR(skb);
1770
1771 l2cap_do_send(chan, skb);
1772 return len;
1773 }
1774
1775 switch (chan->mode) {
1776 case L2CAP_MODE_BASIC:
1777 /* Check outgoing MTU */
1778 if (len > chan->omtu)
1779 return -EMSGSIZE;
1780
1781 /* Create a basic PDU */
5e59b791 1782 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 1783 if (IS_ERR(skb))
1784 return PTR_ERR(skb);
1785
1786 l2cap_do_send(chan, skb);
1787 err = len;
1788 break;
1789
1790 case L2CAP_MODE_ERTM:
1791 case L2CAP_MODE_STREAMING:
1792 /* Entire SDU fits into one PDU */
1793 if (len <= chan->remote_mps) {
7e0ef6ee 1794 control = __set_ctrl_sar(chan, L2CAP_SAR_UNSEGMENTED);
9a91a04a
GP		 1795 skb = l2cap_create_iframe_pdu(chan, msg, len, control,
1796 0);
1797 if (IS_ERR(skb))
1798 return PTR_ERR(skb);
1799
1800 __skb_queue_tail(&chan->tx_q, skb);
1801
1802 if (chan->tx_send_head == NULL)
1803 chan->tx_send_head = skb;
1804
1805 } else {
1806 /* Segment SDU into multiples PDUs */
1807 err = l2cap_sar_segment_sdu(chan, msg, len);
1808 if (err < 0)
1809 return err;
1810 }
1811
1812 if (chan->mode == L2CAP_MODE_STREAMING) {
1813 l2cap_streaming_send(chan);
1814 err = len;
1815 break;
1816 }
1817
e2ab4353
GP		 1818 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
1819 test_bit(CONN_WAIT_F, &chan->conn_state)) {
9a91a04a
GP		 1820 err = len;
1821 break;
1822 }
1823
1824 err = l2cap_ertm_send(chan);
1825 if (err >= 0)
1826 err = len;
1827
1828 break;
1829
1830 default:
1831 BT_DBG("bad state %1.1x", chan->mode);
1832 err = -EBADFD;
1833 }
1834
1835 return err;
1836}
1837
1da177e4
LT		 1838/* Copy frame to all raw sockets on that connection */
1839static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1840{
1da177e4 1841 struct sk_buff *nskb;
48454079 1842 struct l2cap_chan *chan;
1da177e4
LT		 1843
1844 BT_DBG("conn %p", conn);
1845
3df91ea2 1846 mutex_lock(&conn->chan_lock);
3d57dc68 1847
3df91ea2 1848 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 1849 struct sock *sk = chan->sk;
715ec005 1850 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 1851 continue;
1852
1853 /* Don't send frame to the socket it came from */
1854 if (skb->sk == sk)
1855 continue;
af05b30b
GP		 1856 nskb = skb_clone(skb, GFP_ATOMIC);
1857 if (!nskb)
1da177e4
LT		 1858 continue;
1859
23070494 1860 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 1861 kfree_skb(nskb);
1862 }
3d57dc68 1863
3df91ea2 1864 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 1865}
1866
1867/* ---- L2CAP signalling commands ---- */
1868static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1869 u8 code, u8 ident, u16 dlen, void *data)
1870{
1871 struct sk_buff *skb, **frag;
1872 struct l2cap_cmd_hdr *cmd;
1873 struct l2cap_hdr *lh;
1874 int len, count;
1875
af05b30b
GP		 1876 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
1877 conn, code, ident, dlen);
1da177e4
LT		 1878
1879 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1880 count = min_t(unsigned int, conn->mtu, len);
1881
1882 skb = bt_skb_alloc(count, GFP_ATOMIC);
1883 if (!skb)
1884 return NULL;
1885
1886 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 1887 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 1888
1889 if (conn->hcon->type == LE_LINK)
1890 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
1891 else
1892 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 1893
1894 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1895 cmd->code = code;
1896 cmd->ident = ident;
aca3192c 1897 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 1898
1899 if (dlen) {
1900 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1901 memcpy(skb_put(skb, count), data, count);
1902 data += count;
1903 }
1904
1905 len -= skb->len;
1906
1907 /* Continuation fragments (no L2CAP header) */
1908 frag = &skb_shinfo(skb)->frag_list;
1909 while (len) {
1910 count = min_t(unsigned int, conn->mtu, len);
1911
1912 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1913 if (!*frag)
1914 goto fail;
1915
1916 memcpy(skb_put(*frag, count), data, count);
1917
1918 len -= count;
1919 data += count;
1920
1921 frag = &(*frag)->next;
1922 }
1923
1924 return skb;
1925
1926fail:
1927 kfree_skb(skb);
1928 return NULL;
1929}
1930
1931static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1932{
1933 struct l2cap_conf_opt *opt = *ptr;
1934 int len;
1935
1936 len = L2CAP_CONF_OPT_SIZE + opt->len;
1937 *ptr += len;
1938
1939 *type = opt->type;
1940 *olen = opt->len;
1941
1942 switch (opt->len) {
1943 case 1:
1944 *val = *((u8 *) opt->val);
1945 break;
1946
1947 case 2:
bfaaeb3e 1948 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 1949 break;
1950
1951 case 4:
bfaaeb3e 1952 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 1953 break;
1954
1955 default:
1956 *val = (unsigned long) opt->val;
1957 break;
1958 }
1959
1960 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1961 return len;
1962}
1963
1da177e4
LT		 1964static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1965{
1966 struct l2cap_conf_opt *opt = *ptr;
1967
1968 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1969
1970 opt->type = type;
1971 opt->len = len;
1972
1973 switch (len) {
1974 case 1:
1975 *((u8 *) opt->val) = val;
1976 break;
1977
1978 case 2:
4f8b691c 1979 put_unaligned_le16(val, opt->val);
1da177e4
LT		 1980 break;
1981
1982 case 4:
4f8b691c 1983 put_unaligned_le32(val, opt->val);
1da177e4
LT		 1984 break;
1985
1986 default:
1987 memcpy(opt->val, (void *) val, len);
1988 break;
1989 }
1990
1991 *ptr += L2CAP_CONF_OPT_SIZE + len;
1992}
1993
f89cef09
AE		 1994static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
1995{
1996 struct l2cap_conf_efs efs;
1997
1ec918ce 1998 switch (chan->mode) {
f89cef09
AE		 1999 case L2CAP_MODE_ERTM:
2000 efs.id = chan->local_id;
2001 efs.stype = chan->local_stype;
2002 efs.msdu = cpu_to_le16(chan->local_msdu);
2003 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2004 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2005 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2006 break;
2007
2008 case L2CAP_MODE_STREAMING:
2009 efs.id = 1;
2010 efs.stype = L2CAP_SERV_BESTEFFORT;
2011 efs.msdu = cpu_to_le16(chan->local_msdu);
2012 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2013 efs.acc_lat = 0;
2014 efs.flush_to = 0;
2015 break;
2016
2017 default:
2018 return;
2019 }
2020
2021 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2022 (unsigned long) &efs);
2023}
2024
721c4181 2025static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2026{
721c4181
GP		 2027 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2028 ack_timer.work);
c1b4f43b 2029
2fb9b3d4
GP		 2030 BT_DBG("chan %p", chan);
2031
6be36555
AE		 2032 l2cap_chan_lock(chan);
2033
b17e73bb 2034 __l2cap_send_ack(chan);
6be36555
AE		 2035
2036 l2cap_chan_unlock(chan);
09bfb2ee
SJ		 2037
2038 l2cap_chan_put(chan);
c1b4f43b
GP		 2039}
2040
525cd185 2041static inline void l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2042{
42e5c802 2043 chan->expected_ack_seq = 0;
6a026610 2044 chan->unacked_frames = 0;
42e5c802 2045 chan->buffer_seq = 0;
6a026610
GP		 2046 chan->num_acked = 0;
2047 chan->frames_sent = 0;
0565c1c2 2048
721c4181
GP		 2049 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2050 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2051 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2052
f1c6775b 2053 skb_queue_head_init(&chan->srej_q);
1890d36b 2054
39d5a3ee 2055 INIT_LIST_HEAD(&chan->srej_l);
0565c1c2
GP		 2056}
2057
f2fcfcd6
GP		 2058static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2059{
2060 switch (mode) {
2061 case L2CAP_MODE_STREAMING:
2062 case L2CAP_MODE_ERTM:
2063 if (l2cap_mode_supported(mode, remote_feat_mask))
2064 return mode;
2065 /* fall through */
2066 default:
2067 return L2CAP_MODE_BASIC;
2068 }
2069}
2070
6327eb98
AE		 2071static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2072{
2073 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2074}
2075
f89cef09
AE		 2076static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2077{
2078 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2079}
2080
6327eb98
AE		 2081static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2082{
2083 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2084 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2085 /* use extended control field */
2086 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2087 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2088 } else {
6327eb98
AE		 2089 chan->tx_win = min_t(u16, chan->tx_win,
2090 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2091 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2092 }
6327eb98
AE		 2093}
2094
710f9b0a 2095static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2096{
1da177e4 2097 struct l2cap_conf_req *req = data;
0c1bc5c6 2098 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2099 void *ptr = req->data;
c8f79162 2100 u16 size;
1da177e4 2101
49208c9c 2102 BT_DBG("chan %p", chan);
1da177e4 2103
73ffa904 2104 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2105 goto done;
2106
0c1bc5c6 2107 switch (chan->mode) {
f2fcfcd6
GP		 2108 case L2CAP_MODE_STREAMING:
2109 case L2CAP_MODE_ERTM:
c1360a1c 2110 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2111 break;
85eb53c6 2112
f89cef09
AE		 2113 if (__l2cap_efs_supported(chan))
2114 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2115
2ba13ed6 2116 /* fall through */
f2fcfcd6 2117 default:
8c1d787b 2118 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2119 break;
2120 }
2121
2122done:
0c1bc5c6
GP		 2123 if (chan->imtu != L2CAP_DEFAULT_MTU)
2124 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2125
0c1bc5c6 2126 switch (chan->mode) {
65c7c491 2127 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2128 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2129 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2130 break;
2131
62547752
GP		 2132 rfc.mode = L2CAP_MODE_BASIC;
2133 rfc.txwin_size = 0;
2134 rfc.max_transmit = 0;
2135 rfc.retrans_timeout = 0;
2136 rfc.monitor_timeout = 0;
2137 rfc.max_pdu_size = 0;
2138
63406504
GP		 2139 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2140 (unsigned long) &rfc);
65c7c491
MH		 2141 break;
2142
2143 case L2CAP_MODE_ERTM:
2144 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2145 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2146 rfc.retrans_timeout = 0;
2147 rfc.monitor_timeout = 0;
c8f79162
AE		 2148
2149 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2150 L2CAP_EXT_HDR_SIZE -
2151 L2CAP_SDULEN_SIZE -
2152 L2CAP_FCS_SIZE);
2153 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2154
6327eb98
AE		 2155 l2cap_txwin_setup(chan);
2156
2157 rfc.txwin_size = min_t(u16, chan->tx_win,
2158 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2159
63406504
GP		 2160 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2161 (unsigned long) &rfc);
2162
f89cef09
AE		 2163 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2164 l2cap_add_opt_efs(&ptr, chan);
2165
8c1d787b 2166 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2167 break;
2168
47d1ec61 2169 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2170 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2171 chan->fcs = L2CAP_FCS_NONE;
2172 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2173 }
6327eb98
AE		 2174
2175 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2176 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2177 chan->tx_win);
f2fcfcd6
GP		 2178 break;
2179
2180 case L2CAP_MODE_STREAMING:
2181 rfc.mode = L2CAP_MODE_STREAMING;
2182 rfc.txwin_size = 0;
2183 rfc.max_transmit = 0;
2184 rfc.retrans_timeout = 0;
2185 rfc.monitor_timeout = 0;
c8f79162
AE		 2186
2187 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2188 L2CAP_EXT_HDR_SIZE -
2189 L2CAP_SDULEN_SIZE -
2190 L2CAP_FCS_SIZE);
2191 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2192
63406504
GP		 2193 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2194 (unsigned long) &rfc);
2195
f89cef09
AE		 2196 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2197 l2cap_add_opt_efs(&ptr, chan);
2198
8c1d787b 2199 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2200 break;
2201
47d1ec61 2202 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2203 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2204 chan->fcs = L2CAP_FCS_NONE;
2205 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2206 }
65c7c491
MH		 2207 break;
2208 }
1da177e4 2209
fe4128e0 2210 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2211 req->flags = cpu_to_le16(0);
1da177e4
LT		 2212
2213 return ptr - data;
2214}
2215
73ffa904 2216static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2217{
5dee9e7c
MH		 2218 struct l2cap_conf_rsp *rsp = data;
2219 void *ptr = rsp->data;
73ffa904
GP		 2220 void *req = chan->conf_req;
2221 int len = chan->conf_len;
5dee9e7c
MH		 2222 int type, hint, olen;
2223 unsigned long val;
6464f35f 2224 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2225 struct l2cap_conf_efs efs;
2226 u8 remote_efs = 0;
861d6882 2227 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2228 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2229 u16 size;
1da177e4 2230
73ffa904 2231 BT_DBG("chan %p", chan);
820ae1b8 2232
5dee9e7c
MH		 2233 while (len >= L2CAP_CONF_OPT_SIZE) {
2234 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2235
589d2746 2236 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2237 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2238
2239 switch (type) {
2240 case L2CAP_CONF_MTU:
861d6882 2241 mtu = val;
5dee9e7c
MH		 2242 break;
2243
2244 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2245 chan->flush_to = val;
5dee9e7c
MH		 2246 break;
2247
2248 case L2CAP_CONF_QOS:
2249 break;
2250
6464f35f
MH		 2251 case L2CAP_CONF_RFC:
2252 if (olen == sizeof(rfc))
2253 memcpy(&rfc, (void *) val, olen);
2254 break;
2255
fcc203c3
GP		 2256 case L2CAP_CONF_FCS:
2257 if (val == L2CAP_FCS_NONE)
c1360a1c 2258 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2259 break;
fcc203c3 2260
42dceae2
AE		 2261 case L2CAP_CONF_EFS:
2262 remote_efs = 1;
2263 if (olen == sizeof(efs))
2264 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2265 break;
2266
6327eb98
AE		 2267 case L2CAP_CONF_EWS:
2268 if (!enable_hs)
2269 return -ECONNREFUSED;
fcc203c3 2270
6327eb98
AE		 2271 set_bit(FLAG_EXT_CTRL, &chan->flags);
2272 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2273 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2274 chan->remote_tx_win = val;
fcc203c3
GP		 2275 break;
2276
5dee9e7c
MH		 2277 default:
2278 if (hint)
2279 break;
2280
2281 result = L2CAP_CONF_UNKNOWN;
2282 *((u8 *) ptr++) = type;
2283 break;
2284 }
2285 }
2286
73ffa904 2287 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2288 goto done;
2289
0c1bc5c6 2290 switch (chan->mode) {
f2fcfcd6
GP		 2291 case L2CAP_MODE_STREAMING:
2292 case L2CAP_MODE_ERTM:
c1360a1c 2293 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2294 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2295 chan->conn->feat_mask);
85eb53c6
GP		 2296 break;
2297 }
2298
42dceae2
AE		 2299 if (remote_efs) {
2300 if (__l2cap_efs_supported(chan))
2301 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2302 else
2303 return -ECONNREFUSED;
2304 }
2305
0c1bc5c6 2306 if (chan->mode != rfc.mode)
f2fcfcd6 2307 return -ECONNREFUSED;
742e519b 2308
f2fcfcd6 2309 break;
f2fcfcd6
GP		 2310 }
2311
2312done:
0c1bc5c6 2313 if (chan->mode != rfc.mode) {
f2fcfcd6 2314 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2315 rfc.mode = chan->mode;
f2fcfcd6 2316
73ffa904 2317 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2318 return -ECONNREFUSED;
2319
2320 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2321 sizeof(rfc), (unsigned long) &rfc);
2322 }
2323
5dee9e7c
MH		 2324 if (result == L2CAP_CONF_SUCCESS) {
2325 /* Configure output options and let the other side know
2326 * which ones we don't like. */
2327
f2fcfcd6
GP		 2328 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2329 result = L2CAP_CONF_UNACCEPT;
2330 else {
0c1bc5c6 2331 chan->omtu = mtu;
c1360a1c 2332 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2333 }
0c1bc5c6 2334 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2335
42dceae2
AE		 2336 if (remote_efs) {
2337 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2338 efs.stype != L2CAP_SERV_NOTRAFIC &&
2339 efs.stype != chan->local_stype) {
2340
2341 result = L2CAP_CONF_UNACCEPT;
2342
2343 if (chan->num_conf_req >= 1)
2344 return -ECONNREFUSED;
2345
2346 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2347 sizeof(efs),
42dceae2 2348 (unsigned long) &efs);
0e8b207e 2349 } else {
3e6b3b95 2350 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2351 result = L2CAP_CONF_PENDING;
2352 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2353 }
2354 }
2355
f2fcfcd6
GP		 2356 switch (rfc.mode) {
2357 case L2CAP_MODE_BASIC:
47d1ec61 2358 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2359 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2360 break;
2361
2362 case L2CAP_MODE_ERTM:
6327eb98
AE		 2363 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2364 chan->remote_tx_win = rfc.txwin_size;
2365 else
2366 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2367
2c03a7a4 2368 chan->remote_max_tx = rfc.max_transmit;
1c762159 2369
c8f79162
AE		 2370 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2371 chan->conn->mtu -
2372 L2CAP_EXT_HDR_SIZE -
2373 L2CAP_SDULEN_SIZE -
2374 L2CAP_FCS_SIZE);
2375 rfc.max_pdu_size = cpu_to_le16(size);
2376 chan->remote_mps = size;
f2fcfcd6 2377
10467e9e 2378 rfc.retrans_timeout =
4fd21a88 2379 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 2380 rfc.monitor_timeout =
4fd21a88 2381 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2382
c1360a1c 2383 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2384
2385 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2386 sizeof(rfc), (unsigned long) &rfc);
2387
42dceae2
AE		 2388 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2389 chan->remote_id = efs.id;
2390 chan->remote_stype = efs.stype;
2391 chan->remote_msdu = le16_to_cpu(efs.msdu);
2392 chan->remote_flush_to =
2393 le32_to_cpu(efs.flush_to);
2394 chan->remote_acc_lat =
2395 le32_to_cpu(efs.acc_lat);
2396 chan->remote_sdu_itime =
2397 le32_to_cpu(efs.sdu_itime);
2398 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2399 sizeof(efs), (unsigned long) &efs);
2400 }
f2fcfcd6
GP		 2401 break;
2402
2403 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2404 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2405 chan->conn->mtu -
2406 L2CAP_EXT_HDR_SIZE -
2407 L2CAP_SDULEN_SIZE -
2408 L2CAP_FCS_SIZE);
2409 rfc.max_pdu_size = cpu_to_le16(size);
2410 chan->remote_mps = size;
f2fcfcd6 2411
c1360a1c 2412 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2413
2414 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2415 sizeof(rfc), (unsigned long) &rfc);
2416
f2fcfcd6
GP		 2417 break;
2418
2419 default:
5dee9e7c 2420 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2421
6464f35f 2422 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2423 rfc.mode = chan->mode;
f2fcfcd6 2424 }
6464f35f 2425
f2fcfcd6 2426 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2427 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2428 }
fe4128e0 2429 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2430 rsp->result = cpu_to_le16(result);
2431 rsp->flags = cpu_to_le16(0x0000);
2432
2433 return ptr - data;
1da177e4
LT		 2434}
2435
b4450035 2436static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2437{
f2fcfcd6
GP		 2438 struct l2cap_conf_req *req = data;
2439 void *ptr = req->data;
2440 int type, olen;
2441 unsigned long val;
36e999a8 2442 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 2443 struct l2cap_conf_efs efs;
f2fcfcd6 2444
fe4128e0 2445 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2446
2447 while (len >= L2CAP_CONF_OPT_SIZE) {
2448 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2449
2450 switch (type) {
2451 case L2CAP_CONF_MTU:
2452 if (val < L2CAP_DEFAULT_MIN_MTU) {
2453 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2454 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2455 } else
0c1bc5c6
GP		 2456 chan->imtu = val;
2457 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2458 break;
2459
2460 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2461 chan->flush_to = val;
f2fcfcd6 2462 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2463 2, chan->flush_to);
f2fcfcd6
GP		 2464 break;
2465
2466 case L2CAP_CONF_RFC:
2467 if (olen == sizeof(rfc))
2468 memcpy(&rfc, (void *)val, olen);
2469
c1360a1c 2470 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2471 rfc.mode != chan->mode)
f2fcfcd6
GP		 2472 return -ECONNREFUSED;
2473
47d1ec61 2474 chan->fcs = 0;
f2fcfcd6
GP		 2475
2476 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2477 sizeof(rfc), (unsigned long) &rfc);
2478 break;
6327eb98
AE		 2479
2480 case L2CAP_CONF_EWS:
2481 chan->tx_win = min_t(u16, val,
2482 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2483 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2484 chan->tx_win);
6327eb98 2485 break;
66af7aaf
AE		 2486
2487 case L2CAP_CONF_EFS:
2488 if (olen == sizeof(efs))
2489 memcpy(&efs, (void *)val, olen);
2490
2491 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2492 efs.stype != L2CAP_SERV_NOTRAFIC &&
2493 efs.stype != chan->local_stype)
2494 return -ECONNREFUSED;
2495
2496 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2497 sizeof(efs), (unsigned long) &efs);
2498 break;
f2fcfcd6
GP		 2499 }
2500 }
2501
0c1bc5c6 2502 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2503 return -ECONNREFUSED;
2504
0c1bc5c6 2505 chan->mode = rfc.mode;
6c2ea7a8 2506
0e8b207e 2507 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2508 switch (rfc.mode) {
2509 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2510 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2511 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2512 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2513
2514 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2515 chan->local_msdu = le16_to_cpu(efs.msdu);
2516 chan->local_sdu_itime =
2517 le32_to_cpu(efs.sdu_itime);
2518 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2519 chan->local_flush_to =
2520 le32_to_cpu(efs.flush_to);
2521 }
f2fcfcd6 2522 break;
66af7aaf 2523
f2fcfcd6 2524 case L2CAP_MODE_STREAMING:
47d1ec61 2525 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2526 }
2527 }
2528
fe4128e0 2529 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2530 req->flags = cpu_to_le16(0x0000);
2531
2532 return ptr - data;
2533}
2534
fe4128e0 2535static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2536{
2537 struct l2cap_conf_rsp *rsp = data;
2538 void *ptr = rsp->data;
1da177e4 2539
fe4128e0 2540 BT_DBG("chan %p", chan);
1da177e4 2541
fe4128e0 2542 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2543 rsp->result = cpu_to_le16(result);
aca3192c 2544 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2545
2546 return ptr - data;
2547}
2548
8c1d787b 2549void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2550{
2551 struct l2cap_conn_rsp rsp;
8c1d787b 2552 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2553 u8 buf[128];
2554
fe4128e0
GP		 2555 rsp.scid = cpu_to_le16(chan->dcid);
2556 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2557 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2558 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2559 l2cap_send_cmd(conn, chan->ident,
2560 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2561
c1360a1c 2562 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2563 return;
2564
710f9b0a
GP		 2565 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2566 l2cap_build_conf_req(chan, buf), buf);
2567 chan->num_conf_req++;
2568}
2569
47d1ec61 2570static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2571{
7b1c0049
GP		 2572 int type, olen;
2573 unsigned long val;
2574 struct l2cap_conf_rfc rfc;
2575
47d1ec61 2576 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2577
0c1bc5c6 2578 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2579 return;
2580
2581 while (len >= L2CAP_CONF_OPT_SIZE) {
2582 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2583
2584 switch (type) {
2585 case L2CAP_CONF_RFC:
2586 if (olen == sizeof(rfc))
2587 memcpy(&rfc, (void *)val, olen);
2588 goto done;
2589 }
2590 }
2591
36e999a8
MM		 2592 /* Use sane default values in case a misbehaving remote device
2593 * did not send an RFC option.
2594 */
2595 rfc.mode = chan->mode;
2596 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2597 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2598 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2599
2600 BT_ERR("Expected RFC option was not found, using defaults");
2601
7b1c0049
GP		 2602done:
2603 switch (rfc.mode) {
2604 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2605 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2606 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2607 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2608 break;
2609 case L2CAP_MODE_STREAMING:
47d1ec61 2610 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2611 }
2612}
2613
4e8402a3
MH		 2614static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2615{
e2fd318e 2616 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2617
e2fd318e 2618 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2619 return 0;
2620
2621 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2622 cmd->ident == conn->info_ident) {
17cd3f37 2623 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 2624
2625 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2626 conn->info_ident = 0;
984947dc 2627
4e8402a3
MH		 2628 l2cap_conn_start(conn);
2629 }
2630
2631 return 0;
2632}
2633
1da177e4
LT		 2634static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2635{
1da177e4
LT		 2636 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2637 struct l2cap_conn_rsp rsp;
23691d75 2638 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2639 struct sock *parent, *sk = NULL;
e7c29cb1 2640 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2641
2642 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2643 __le16 psm = req->psm;
1da177e4 2644
097db76c 2645 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 2646
2647 /* Check if we have socket listening on psm */
23691d75
GP		 2648 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src);
2649 if (!pchan) {
1da177e4
LT		 2650 result = L2CAP_CR_BAD_PSM;
2651 goto sendresp;
2652 }
2653
23691d75
GP		 2654 parent = pchan->sk;
2655
3df91ea2 2656 mutex_lock(&conn->chan_lock);
aa2ac881 2657 lock_sock(parent);
e0f0cb56 2658
e7c29cb1
MH		 2659 /* Check if the ACL is secure enough (if not SDP) */
2660 if (psm != cpu_to_le16(0x0001) &&
2661 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2662 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2663 result = L2CAP_CR_SEC_BLOCK;
2664 goto response;
2665 }
2666
1da177e4
LT		 2667 result = L2CAP_CR_NO_MEM;
2668
2669 /* Check for backlog size */
2670 if (sk_acceptq_is_full(parent)) {
8e87d142 2671 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2672 goto response;
2673 }
2674
80808e43
GP		 2675 chan = pchan->ops->new_connection(pchan->data);
2676 if (!chan)
1da177e4
LT		 2677 goto response;
2678
80808e43
GP		 2679 sk = chan->sk;
2680
1da177e4 2681 /* Check if we already have channel with that dcid */
baa7e1fa 2682 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 2683 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 2684 chan->ops->close(chan->data);
1da177e4
LT		 2685 goto response;
2686 }
2687
2688 hci_conn_hold(conn->hcon);
2689
1da177e4
LT		 2690 bacpy(&bt_sk(sk)->src, conn->src);
2691 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 2692 chan->psm = psm;
2693 chan->dcid = scid;
1da177e4 2694
d1010240
GP		 2695 bt_accept_enqueue(parent, sk);
2696
6be36555 2697 __l2cap_chan_add(conn, chan);
48454079 2698
fe4128e0 2699 dcid = chan->scid;
1da177e4 2700
c9b66675 2701 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 2702
fc7f8a7e 2703 chan->ident = cmd->ident;
1da177e4 2704
984947dc 2705 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 2706 if (l2cap_chan_check_security(chan)) {
f66dc81f 2707 if (bt_sk(sk)->defer_setup) {
0e587be7 2708 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 2709 result = L2CAP_CR_PEND;
2710 status = L2CAP_CS_AUTHOR_PEND;
2711 parent->sk_data_ready(parent, 0);
2712 } else {
0e587be7 2713 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 2714 result = L2CAP_CR_SUCCESS;
2715 status = L2CAP_CS_NO_INFO;
2716 }
79d554a6 2717 } else {
0e587be7 2718 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 2719 result = L2CAP_CR_PEND;
2720 status = L2CAP_CS_AUTHEN_PEND;
2721 }
2722 } else {
0e587be7 2723 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 2724 result = L2CAP_CR_PEND;
2725 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2726 }
2727
1da177e4 2728response:
aa2ac881 2729 release_sock(parent);
3df91ea2 2730 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2731
2732sendresp:
aca3192c
YH		 2733 rsp.scid = cpu_to_le16(scid);
2734 rsp.dcid = cpu_to_le16(dcid);
2735 rsp.result = cpu_to_le16(result);
2736 rsp.status = cpu_to_le16(status);
1da177e4 2737 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 2738
2739 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
2740 struct l2cap_info_req info;
2741 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2742
2743 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
2744 conn->info_ident = l2cap_get_ident(conn);
2745
ba13ccd9 2746 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 2747
2748 l2cap_send_cmd(conn, conn->info_ident,
2749 L2CAP_INFO_REQ, sizeof(info), &info);
2750 }
2751
c1360a1c 2752 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 2753 result == L2CAP_CR_SUCCESS) {
2754 u8 buf[128];
c1360a1c 2755 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 2756 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2757 l2cap_build_conf_req(chan, buf), buf);
2758 chan->num_conf_req++;
e9aeb2dd
GP		 2759 }
2760
1da177e4
LT		 2761 return 0;
2762}
2763
2764static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2765{
2766 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
2767 u16 scid, dcid, result, status;
48454079 2768 struct l2cap_chan *chan;
1da177e4 2769 u8 req[128];
3df91ea2 2770 int err;
1da177e4
LT		 2771
2772 scid = __le16_to_cpu(rsp->scid);
2773 dcid = __le16_to_cpu(rsp->dcid);
2774 result = __le16_to_cpu(rsp->result);
2775 status = __le16_to_cpu(rsp->status);
2776
1b009c98
AE		 2777 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2778 dcid, scid, result, status);
1da177e4 2779
3df91ea2
AE		 2780 mutex_lock(&conn->chan_lock);
2781
1da177e4 2782 if (scid) {
3df91ea2
AE		 2783 chan = __l2cap_get_chan_by_scid(conn, scid);
2784 if (!chan) {
2785 err = -EFAULT;
2786 goto unlock;
2787 }
1da177e4 2788 } else {
3df91ea2
AE		 2789 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
2790 if (!chan) {
2791 err = -EFAULT;
2792 goto unlock;
2793 }
1da177e4
LT		 2794 }
2795
3df91ea2
AE		 2796 err = 0;
2797
6be36555 2798 l2cap_chan_lock(chan);
48454079 2799
1da177e4
LT		 2800 switch (result) {
2801 case L2CAP_CR_SUCCESS:
89bc500e 2802 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 2803 chan->ident = 0;
fe4128e0 2804 chan->dcid = dcid;
c1360a1c 2805 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 2806
c1360a1c 2807 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 2808 break;
2809
1da177e4 2810 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2811 l2cap_build_conf_req(chan, req), req);
2812 chan->num_conf_req++;
1da177e4
LT		 2813 break;
2814
2815 case L2CAP_CR_PEND:
c1360a1c 2816 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 2817 break;
2818
2819 default:
48454079 2820 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 2821 break;
2822 }
2823
6be36555 2824 l2cap_chan_unlock(chan);
3df91ea2
AE		 2825
2826unlock:
2827 mutex_unlock(&conn->chan_lock);
2828
2829 return err;
1da177e4
LT		 2830}
2831
47d1ec61 2832static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 2833{
2834 /* FCS is enabled only in ERTM or streaming mode, if one or both
2835 * sides request it.
2836 */
0c1bc5c6 2837 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 2838 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2839 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 2840 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 2841}
2842
88219a0f 2843static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 2844{
2845 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2846 u16 dcid, flags;
2847 u8 rsp[64];
48454079 2848 struct l2cap_chan *chan;
5dee9e7c 2849 int len;
1da177e4
LT		 2850
2851 dcid = __le16_to_cpu(req->dcid);
2852 flags = __le16_to_cpu(req->flags);
2853
2854 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2855
baa7e1fa 2856 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 2857 if (!chan)
1da177e4
LT		 2858 return -ENOENT;
2859
6be36555 2860 l2cap_chan_lock(chan);
48454079 2861
033b1142 2862 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 2863 struct l2cap_cmd_rej_cid rej;
2864
2865 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
2866 rej.scid = cpu_to_le16(chan->scid);
2867 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 2868
df6bd743
GP		 2869 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2870 sizeof(rej), &rej);
354f60a9 2871 goto unlock;
df6bd743 2872 }
354f60a9 2873
5dee9e7c 2874 /* Reject if config buffer is too small. */
88219a0f 2875 len = cmd_len - sizeof(*req);
7ac28817 2876 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 2877 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 2878 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 2879 L2CAP_CONF_REJECT, flags), rsp);
2880 goto unlock;
2881 }
2882
2883 /* Store config. */
73ffa904
GP		 2884 memcpy(chan->conf_req + chan->conf_len, req->data, len);
2885 chan->conf_len += len;
1da177e4
LT		 2886
2887 if (flags & 0x0001) {
2888 /* Incomplete config. Send empty response. */
2889 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 2890 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 2891 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 2892 goto unlock;
2893 }
2894
2895 /* Complete config. */
73ffa904 2896 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 2897 if (len < 0) {
e92c8e70 2898 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 2899 goto unlock;
f2fcfcd6 2900 }
1da177e4 2901
5dee9e7c 2902 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 2903 chan->num_conf_rsp++;
5dee9e7c 2904
5dee9e7c 2905 /* Reset config buffer. */
73ffa904 2906 chan->conf_len = 0;
5dee9e7c 2907
c1360a1c 2908 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 2909 goto unlock;
2910
c1360a1c 2911 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 2912 set_default_fcs(chan);
fcc203c3 2913
89bc500e 2914 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 2915
42e5c802
GP		 2916 chan->next_tx_seq = 0;
2917 chan->expected_tx_seq = 0;
58d35f87 2918 skb_queue_head_init(&chan->tx_q);
0c1bc5c6 2919 if (chan->mode == L2CAP_MODE_ERTM)
525cd185 2920 l2cap_ertm_init(chan);
0565c1c2 2921
cf4cd009 2922 l2cap_chan_ready(chan);
876d9484
MH		 2923 goto unlock;
2924 }
2925
c1360a1c 2926 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 2927 u8 buf[64];
1da177e4 2928 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2929 l2cap_build_conf_req(chan, buf), buf);
2930 chan->num_conf_req++;
1da177e4
LT		 2931 }
2932
0e8b207e
AE		 2933 /* Got Conf Rsp PENDING from remote side and asume we sent
2934 Conf Rsp PENDING in the code above */
2935 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
2936 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
2937
2938 /* check compatibility */
2939
2940 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
2941 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
2942
2943 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 2944 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 2945 L2CAP_CONF_SUCCESS, 0x0000), rsp);
2946 }
2947
1da177e4 2948unlock:
6be36555 2949 l2cap_chan_unlock(chan);
1da177e4
LT		 2950 return 0;
2951}
2952
2953static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2954{
2955 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2956 u16 scid, flags, result;
48454079 2957 struct l2cap_chan *chan;
61386cba 2958 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
1da177e4
LT		 2959
2960 scid = __le16_to_cpu(rsp->scid);
2961 flags = __le16_to_cpu(rsp->flags);
2962 result = __le16_to_cpu(rsp->result);
2963
61386cba
AE		 2964 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
2965 result, len);
1da177e4 2966
baa7e1fa 2967 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 2968 if (!chan)
1da177e4
LT		 2969 return 0;
2970
6be36555 2971 l2cap_chan_lock(chan);
48454079 2972
1da177e4
LT		 2973 switch (result) {
2974 case L2CAP_CONF_SUCCESS:
47d1ec61 2975 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 2976 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 2977 break;
2978
0e8b207e
AE		 2979 case L2CAP_CONF_PENDING:
2980 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
2981
2982 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
2983 char buf[64];
2984
2985 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2986 buf, &result);
2987 if (len < 0) {
2988 l2cap_send_disconn_req(conn, chan, ECONNRESET);
2989 goto done;
2990 }
2991
2992 /* check compatibility */
2993
2994 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
2995 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
2996
2997 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 2998 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 2999 L2CAP_CONF_SUCCESS, 0x0000), buf);
3000 }
3001 goto done;
3002
1da177e4 3003 case L2CAP_CONF_UNACCEPT:
73ffa904 3004 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3005 char req[64];
3006
c2c77ec8 3007 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3008 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3009 goto done;
3010 }
3011
f2fcfcd6
GP		 3012 /* throw out any old stored conf requests */
3013 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3014 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3015 req, &result);
f2fcfcd6 3016 if (len < 0) {
e92c8e70 3017 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3018 goto done;
3019 }
3020
3021 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3022 L2CAP_CONF_REQ, len, req);
73ffa904 3023 chan->num_conf_req++;
f2fcfcd6
GP		 3024 if (result != L2CAP_CONF_SUCCESS)
3025 goto done;
3026 break;
1da177e4
LT		 3027 }
3028
8e87d142 3029 default:
6be36555 3030 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3031
ba13ccd9 3032 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3033 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3034 goto done;
3035 }
3036
3037 if (flags & 0x01)
3038 goto done;
3039
c1360a1c 3040 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3041
c1360a1c 3042 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3043 set_default_fcs(chan);
fcc203c3 3044
89bc500e 3045 l2cap_state_change(chan, BT_CONNECTED);
42e5c802
GP		 3046 chan->next_tx_seq = 0;
3047 chan->expected_tx_seq = 0;
58d35f87 3048 skb_queue_head_init(&chan->tx_q);
0c1bc5c6 3049 if (chan->mode == L2CAP_MODE_ERTM)
525cd185 3050 l2cap_ertm_init(chan);
0565c1c2 3051
cf4cd009 3052 l2cap_chan_ready(chan);
1da177e4
LT		 3053 }
3054
3055done:
6be36555 3056 l2cap_chan_unlock(chan);
1da177e4
LT		 3057 return 0;
3058}
3059
3060static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3061{
3062 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3063 struct l2cap_disconn_rsp rsp;
3064 u16 dcid, scid;
48454079 3065 struct l2cap_chan *chan;
1da177e4
LT		 3066 struct sock *sk;
3067
3068 scid = __le16_to_cpu(req->scid);
3069 dcid = __le16_to_cpu(req->dcid);
3070
3071 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3072
3df91ea2
AE		 3073 mutex_lock(&conn->chan_lock);
3074
3075 chan = __l2cap_get_chan_by_scid(conn, dcid);
3076 if (!chan) {
3077 mutex_unlock(&conn->chan_lock);
1da177e4 3078 return 0;
3df91ea2 3079 }
1da177e4 3080
6be36555
AE		 3081 l2cap_chan_lock(chan);
3082
48454079
GP		 3083 sk = chan->sk;
3084
fe4128e0
GP		 3085 rsp.dcid = cpu_to_le16(chan->scid);
3086 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3087 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3088
6be36555 3089 lock_sock(sk);
1da177e4 3090 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3091 release_sock(sk);
1da177e4 3092
48454079 3093 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3094
3095 l2cap_chan_unlock(chan);
1da177e4 3096
ba3bd0ee 3097 chan->ops->close(chan->data);
3df91ea2
AE		 3098
3099 mutex_unlock(&conn->chan_lock);
3100
1da177e4
LT		 3101 return 0;
3102}
3103
3104static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3105{
3106 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3107 u16 dcid, scid;
48454079 3108 struct l2cap_chan *chan;
1da177e4
LT		 3109
3110 scid = __le16_to_cpu(rsp->scid);
3111 dcid = __le16_to_cpu(rsp->dcid);
3112
3113 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3114
3df91ea2
AE		 3115 mutex_lock(&conn->chan_lock);
3116
3117 chan = __l2cap_get_chan_by_scid(conn, scid);
3118 if (!chan) {
3119 mutex_unlock(&conn->chan_lock);
1da177e4 3120 return 0;
3df91ea2 3121 }
1da177e4 3122
6be36555 3123 l2cap_chan_lock(chan);
48454079 3124
48454079 3125 l2cap_chan_del(chan, 0);
6be36555
AE		 3126
3127 l2cap_chan_unlock(chan);
1da177e4 3128
ba3bd0ee 3129 chan->ops->close(chan->data);
3df91ea2
AE		 3130
3131 mutex_unlock(&conn->chan_lock);
3132
1da177e4
LT		 3133 return 0;
3134}
3135
3136static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3137{
3138 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3139 u16 type;
3140
3141 type = __le16_to_cpu(req->type);
3142
3143 BT_DBG("type 0x%4.4x", type);
3144
f0709e03
MH		 3145 if (type == L2CAP_IT_FEAT_MASK) {
3146 u8 buf[8];
44dd46de 3147 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3148 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3149 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3150 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3151 if (!disable_ertm)
fcc203c3
GP		 3152 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3153 | L2CAP_FEAT_FCS;
a5fd6f30 3154 if (enable_hs)
6327eb98
AE		 3155 feat_mask |= L2CAP_FEAT_EXT_FLOW
3156 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3157
1b7bf4ed 3158 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3159 l2cap_send_cmd(conn, cmd->ident,
3160 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3161 } else if (type == L2CAP_IT_FIXED_CHAN) {
3162 u8 buf[12];
3163 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3164
3165 if (enable_hs)
3166 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3167 else
3168 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3169
e1027a7c
MH		 3170 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3171 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3172 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3173 l2cap_send_cmd(conn, cmd->ident,
3174 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3175 } else {
3176 struct l2cap_info_rsp rsp;
3177 rsp.type = cpu_to_le16(type);
3178 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3179 l2cap_send_cmd(conn, cmd->ident,
3180 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3181 }
1da177e4
LT		 3182
3183 return 0;
3184}
3185
3186static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3187{
3188 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3189 u16 type, result;
3190
3191 type = __le16_to_cpu(rsp->type);
3192 result = __le16_to_cpu(rsp->result);
3193
3194 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3195
e90165be
AE		 3196 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3197 if (cmd->ident != conn->info_ident ||
3198 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3199 return 0;
3200
17cd3f37 3201 cancel_delayed_work(&conn->info_timer);
4e8402a3 3202
adb08ede
VT		 3203 if (result != L2CAP_IR_SUCCESS) {
3204 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3205 conn->info_ident = 0;
3206
3207 l2cap_conn_start(conn);
3208
3209 return 0;
3210 }
3211
978c93b9
AE		 3212 switch (type) {
3213 case L2CAP_IT_FEAT_MASK:
83985319 3214 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3215
47ec1dcd 3216 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3217 struct l2cap_info_req req;
3218 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3219
3220 conn->info_ident = l2cap_get_ident(conn);
3221
3222 l2cap_send_cmd(conn, conn->info_ident,
3223 L2CAP_INFO_REQ, sizeof(req), &req);
3224 } else {
3225 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3226 conn->info_ident = 0;
3227
3228 l2cap_conn_start(conn);
3229 }
978c93b9
AE		 3230 break;
3231
3232 case L2CAP_IT_FIXED_CHAN:
3233 conn->fixed_chan_mask = rsp->data[0];
984947dc 3234 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3235 conn->info_ident = 0;
984947dc
MH		 3236
3237 l2cap_conn_start(conn);
978c93b9 3238 break;
984947dc 3239 }
4e8402a3 3240
1da177e4
LT		 3241 return 0;
3242}
3243
f94ff6ff
MM		 3244static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3245 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3246 void *data)
3247{
3248 struct l2cap_create_chan_req *req = data;
3249 struct l2cap_create_chan_rsp rsp;
3250 u16 psm, scid;
3251
3252 if (cmd_len != sizeof(*req))
3253 return -EPROTO;
3254
3255 if (!enable_hs)
3256 return -EINVAL;
3257
3258 psm = le16_to_cpu(req->psm);
3259 scid = le16_to_cpu(req->scid);
3260
3261 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3262
3263 /* Placeholder: Always reject */
3264 rsp.dcid = 0;
3265 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 3266 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3267 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 3268
3269 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3270 sizeof(rsp), &rsp);
3271
3272 return 0;
3273}
3274
3275static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3276 struct l2cap_cmd_hdr *cmd, void *data)
3277{
3278 BT_DBG("conn %p", conn);
3279
3280 return l2cap_connect_rsp(conn, cmd, data);
3281}
3282
8d5a04a1
MM		 3283static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3284 u16 icid, u16 result)
3285{
3286 struct l2cap_move_chan_rsp rsp;
3287
3288 BT_DBG("icid %d, result %d", icid, result);
3289
3290 rsp.icid = cpu_to_le16(icid);
3291 rsp.result = cpu_to_le16(result);
3292
3293 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3294}
3295
3296static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3297 struct l2cap_chan *chan, u16 icid, u16 result)
3298{
3299 struct l2cap_move_chan_cfm cfm;
3300 u8 ident;
3301
3302 BT_DBG("icid %d, result %d", icid, result);
3303
3304 ident = l2cap_get_ident(conn);
3305 if (chan)
3306 chan->ident = ident;
3307
3308 cfm.icid = cpu_to_le16(icid);
3309 cfm.result = cpu_to_le16(result);
3310
3311 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3312}
3313
3314static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3315 u16 icid)
3316{
3317 struct l2cap_move_chan_cfm_rsp rsp;
3318
3319 BT_DBG("icid %d", icid);
3320
3321 rsp.icid = cpu_to_le16(icid);
3322 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3323}
3324
3325static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3326 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3327{
3328 struct l2cap_move_chan_req *req = data;
3329 u16 icid = 0;
3330 u16 result = L2CAP_MR_NOT_ALLOWED;
3331
3332 if (cmd_len != sizeof(*req))
3333 return -EPROTO;
3334
3335 icid = le16_to_cpu(req->icid);
3336
3337 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3338
3339 if (!enable_hs)
3340 return -EINVAL;
3341
3342 /* Placeholder: Always refuse */
3343 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3344
3345 return 0;
3346}
3347
3348static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3349 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3350{
3351 struct l2cap_move_chan_rsp *rsp = data;
3352 u16 icid, result;
3353
3354 if (cmd_len != sizeof(*rsp))
3355 return -EPROTO;
3356
3357 icid = le16_to_cpu(rsp->icid);
3358 result = le16_to_cpu(rsp->result);
3359
3360 BT_DBG("icid %d, result %d", icid, result);
3361
3362 /* Placeholder: Always unconfirmed */
3363 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3364
3365 return 0;
3366}
3367
3368static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3369 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3370{
3371 struct l2cap_move_chan_cfm *cfm = data;
3372 u16 icid, result;
3373
3374 if (cmd_len != sizeof(*cfm))
3375 return -EPROTO;
3376
3377 icid = le16_to_cpu(cfm->icid);
3378 result = le16_to_cpu(cfm->result);
3379
3380 BT_DBG("icid %d, result %d", icid, result);
3381
3382 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3383
3384 return 0;
3385}
3386
3387static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3388 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3389{
3390 struct l2cap_move_chan_cfm_rsp *rsp = data;
3391 u16 icid;
3392
3393 if (cmd_len != sizeof(*rsp))
3394 return -EPROTO;
3395
3396 icid = le16_to_cpu(rsp->icid);
3397
3398 BT_DBG("icid %d", icid);
3399
3400 return 0;
3401}
3402
e2174ca4 3403static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3404 u16 to_multiplier)
3405{
3406 u16 max_latency;
3407
3408 if (min > max || min < 6 || max > 3200)
3409 return -EINVAL;
3410
3411 if (to_multiplier < 10 || to_multiplier > 3200)
3412 return -EINVAL;
3413
3414 if (max >= to_multiplier * 8)
3415 return -EINVAL;
3416
3417 max_latency = (to_multiplier * 8 / max) - 1;
3418 if (latency > 499 || latency > max_latency)
3419 return -EINVAL;
3420
3421 return 0;
3422}
3423
3424static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3425 struct l2cap_cmd_hdr *cmd, u8 *data)
3426{
3427 struct hci_conn *hcon = conn->hcon;
3428 struct l2cap_conn_param_update_req *req;
3429 struct l2cap_conn_param_update_rsp rsp;
3430 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3431 int err;
de73115a
CT		 3432
3433 if (!(hcon->link_mode & HCI_LM_MASTER))
3434 return -EINVAL;
3435
3436 cmd_len = __le16_to_cpu(cmd->len);
3437 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3438 return -EPROTO;
3439
3440 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3441 min = __le16_to_cpu(req->min);
3442 max = __le16_to_cpu(req->max);
de73115a
CT		 3443 latency = __le16_to_cpu(req->latency);
3444 to_multiplier = __le16_to_cpu(req->to_multiplier);
3445
3446 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3447 min, max, latency, to_multiplier);
3448
3449 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3450
3451 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3452 if (err)
de73115a
CT		 3453 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3454 else
3455 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3456
3457 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3458 sizeof(rsp), &rsp);
3459
2ce603eb
CT		 3460 if (!err)
3461 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3462
de73115a
CT		 3463 return 0;
3464}
3465
3300d9a9
CT		 3466static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3467 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3468{
3469 int err = 0;
3470
3471 switch (cmd->code) {
3472 case L2CAP_COMMAND_REJ:
3473 l2cap_command_rej(conn, cmd, data);
3474 break;
3475
3476 case L2CAP_CONN_REQ:
3477 err = l2cap_connect_req(conn, cmd, data);
3478 break;
3479
3480 case L2CAP_CONN_RSP:
3481 err = l2cap_connect_rsp(conn, cmd, data);
3482 break;
3483
3484 case L2CAP_CONF_REQ:
3485 err = l2cap_config_req(conn, cmd, cmd_len, data);
3486 break;
3487
3488 case L2CAP_CONF_RSP:
3489 err = l2cap_config_rsp(conn, cmd, data);
3490 break;
3491
3492 case L2CAP_DISCONN_REQ:
3493 err = l2cap_disconnect_req(conn, cmd, data);
3494 break;
3495
3496 case L2CAP_DISCONN_RSP:
3497 err = l2cap_disconnect_rsp(conn, cmd, data);
3498 break;
3499
3500 case L2CAP_ECHO_REQ:
3501 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3502 break;
3503
3504 case L2CAP_ECHO_RSP:
3505 break;
3506
3507 case L2CAP_INFO_REQ:
3508 err = l2cap_information_req(conn, cmd, data);
3509 break;
3510
3511 case L2CAP_INFO_RSP:
3512 err = l2cap_information_rsp(conn, cmd, data);
3513 break;
3514
f94ff6ff
MM		 3515 case L2CAP_CREATE_CHAN_REQ:
3516 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3517 break;
3518
3519 case L2CAP_CREATE_CHAN_RSP:
3520 err = l2cap_create_channel_rsp(conn, cmd, data);
3521 break;
3522
8d5a04a1
MM		 3523 case L2CAP_MOVE_CHAN_REQ:
3524 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3525 break;
3526
3527 case L2CAP_MOVE_CHAN_RSP:
3528 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3529 break;
3530
3531 case L2CAP_MOVE_CHAN_CFM:
3532 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3533 break;
3534
3535 case L2CAP_MOVE_CHAN_CFM_RSP:
3536 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3537 break;
3538
3300d9a9
CT		 3539 default:
3540 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3541 err = -EINVAL;
3542 break;
3543 }
3544
3545 return err;
3546}
3547
3548static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3549 struct l2cap_cmd_hdr *cmd, u8 *data)
3550{
3551 switch (cmd->code) {
3552 case L2CAP_COMMAND_REJ:
3553 return 0;
3554
3555 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3556 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3557
3558 case L2CAP_CONN_PARAM_UPDATE_RSP:
3559 return 0;
3560
3561 default:
3562 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3563 return -EINVAL;
3564 }
3565}
3566
3567static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3568 struct sk_buff *skb)
1da177e4
LT		 3569{
3570 u8 *data = skb->data;
3571 int len = skb->len;
3572 struct l2cap_cmd_hdr cmd;
3300d9a9 3573 int err;
1da177e4
LT		 3574
3575 l2cap_raw_recv(conn, skb);
3576
3577 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3578 u16 cmd_len;
1da177e4
LT		 3579 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3580 data += L2CAP_CMD_HDR_SIZE;
3581 len -= L2CAP_CMD_HDR_SIZE;
3582
88219a0f 3583 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3584
88219a0f 3585 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3586
88219a0f 3587 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3588 BT_DBG("corrupted command");
3589 break;
3590 }
3591
3300d9a9
CT		 3592 if (conn->hcon->type == LE_LINK)
3593 err = l2cap_le_sig_cmd(conn, &cmd, data);
3594 else
3595 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3596
3597 if (err) {
e2fd318e 3598 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3599
3600 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3601
3602 /* FIXME: Map err to a valid reason */
e2fd318e 3603 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3604 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3605 }
3606
88219a0f
AV		 3607 data += cmd_len;
3608 len -= cmd_len;
1da177e4
LT		 3609 }
3610
3611 kfree_skb(skb);
3612}
3613
47d1ec61 3614static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3615{
3616 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3617 int hdr_size;
3618
3619 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3620 hdr_size = L2CAP_EXT_HDR_SIZE;
3621 else
3622 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3623
47d1ec61 3624 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3625 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3626 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3627 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3628
3629 if (our_fcs != rcv_fcs)
7a560e5c 3630 return -EBADMSG;
fcc203c3
GP		 3631 }
3632 return 0;
3633}
3634
525cd185 3635static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3636{
88843ab0 3637 u32 control = 0;
d5392c8f 3638
6a026610 3639 chan->frames_sent = 0;
d5392c8f 3640
0b209fae 3641 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3642
e2ab4353 3643 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3644 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3645 l2cap_send_sframe(chan, control);
e2ab4353 3646 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3647 }
3648
e2ab4353 3649 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3650 l2cap_retransmit_frames(chan);
d5392c8f 3651
525cd185 3652 l2cap_ertm_send(chan);
d5392c8f 3653
e2ab4353 3654 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3655 chan->frames_sent == 0) {
ab784b73 3656 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3657 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3658 }
3659}
3660
fb45de7d 3661static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 3662{
3663 struct sk_buff *next_skb;
bfbacc11 3664 int tx_seq_offset, next_tx_seq_offset;
8f17154f
GP		 3665
3666 bt_cb(skb)->tx_seq = tx_seq;
3667 bt_cb(skb)->sar = sar;
3668
f1c6775b 3669 next_skb = skb_peek(&chan->srej_q);
8f17154f 3670
836be934 3671 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 3672
039d9572 3673 while (next_skb) {
9b53350d
JPRV		 3674 if (bt_cb(next_skb)->tx_seq == tx_seq)
3675 return -EINVAL;
3676
836be934
AE		 3677 next_tx_seq_offset = __seq_offset(chan,
3678 bt_cb(next_skb)->tx_seq, chan->buffer_seq);
bfbacc11
JPRV		 3679
3680 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 3681 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 3682 return 0;
8f17154f
GP		 3683 }
3684
f1c6775b 3685 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 3686 next_skb = NULL;
3687 else
3688 next_skb = skb_queue_next(&chan->srej_q, next_skb);
3689 }
8f17154f 3690
f1c6775b 3691 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 3692
3693 return 0;
8f17154f
GP		 3694}
3695
84084a31
MM		 3696static void append_skb_frag(struct sk_buff *skb,
3697 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 3698{
84084a31
MM		 3699 /* skb->len reflects data in skb as well as all fragments
3700 * skb->data_len reflects only data in fragments
3701 */
3702 if (!skb_has_frag_list(skb))
3703 skb_shinfo(skb)->frag_list = new_frag;
3704
3705 new_frag->next = NULL;
3706
3707 (*last_frag)->next = new_frag;
3708 *last_frag = new_frag;
3709
3710 skb->len += new_frag->len;
3711 skb->data_len += new_frag->len;
3712 skb->truesize += new_frag->truesize;
3713}
3714
88843ab0 3715static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 3716{
3717 int err = -EINVAL;
18778a63 3718
7e0ef6ee
AE		 3719 switch (__get_ctrl_sar(chan, control)) {
3720 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 3721 if (chan->sdu)
3722 break;
18778a63 3723
84084a31
MM		 3724 err = chan->ops->recv(chan->data, skb);
3725 break;
18778a63 3726
7e0ef6ee 3727 case L2CAP_SAR_START:
84084a31
MM		 3728 if (chan->sdu)
3729 break;
18778a63 3730
6f61fd47 3731 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 3732 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 3733
84084a31
MM		 3734 if (chan->sdu_len > chan->imtu) {
3735 err = -EMSGSIZE;
3736 break;
3737 }
1890d36b 3738
84084a31
MM		 3739 if (skb->len >= chan->sdu_len)
3740 break;
18778a63 3741
84084a31
MM		 3742 chan->sdu = skb;
3743 chan->sdu_last_frag = skb;
18778a63 3744
84084a31
MM		 3745 skb = NULL;
3746 err = 0;
18778a63
GP		 3747 break;
3748
7e0ef6ee 3749 case L2CAP_SAR_CONTINUE:
6f61fd47 3750 if (!chan->sdu)
84084a31 3751 break;
18778a63 3752
84084a31
MM		 3753 append_skb_frag(chan->sdu, skb,
3754 &chan->sdu_last_frag);
3755 skb = NULL;
18778a63 3756
84084a31
MM		 3757 if (chan->sdu->len >= chan->sdu_len)
3758 break;
4178ba46 3759
84084a31 3760 err = 0;
18778a63
GP		 3761 break;
3762
7e0ef6ee 3763 case L2CAP_SAR_END:
6f61fd47 3764 if (!chan->sdu)
84084a31 3765 break;
18778a63 3766
84084a31
MM		 3767 append_skb_frag(chan->sdu, skb,
3768 &chan->sdu_last_frag);
3769 skb = NULL;
4178ba46 3770
84084a31
MM		 3771 if (chan->sdu->len != chan->sdu_len)
3772 break;
18778a63 3773
84084a31 3774 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 3775
84084a31
MM		 3776 if (!err) {
3777 /* Reassembly complete */
3778 chan->sdu = NULL;
3779 chan->sdu_last_frag = NULL;
3780 chan->sdu_len = 0;
1890d36b 3781 }
18778a63
GP		 3782 break;
3783 }
3784
84084a31
MM		 3785 if (err) {
3786 kfree_skb(skb);
3787 kfree_skb(chan->sdu);
3788 chan->sdu = NULL;
3789 chan->sdu_last_frag = NULL;
3790 chan->sdu_len = 0;
3791 }
18778a63 3792
84084a31 3793 return err;
18778a63
GP		 3794}
3795
26f880d2 3796static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 3797{
26f880d2 3798 BT_DBG("chan %p, Enter local busy", chan);
712132eb 3799
26f880d2
MM		 3800 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3801
77f918bc 3802 __set_ack_timer(chan);
26f880d2
MM		 3803}
3804
3805static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
3806{
88843ab0 3807 u32 control;
712132eb 3808
e2ab4353 3809 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 3810 goto done;
3811
0b209fae 3812 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 3813 control |= __set_ctrl_poll(chan);
ab784b73 3814 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3815 l2cap_send_sframe(chan, control);
6a026610 3816 chan->retry_count = 1;
712132eb 3817
1a09bcb9
GP		 3818 __clear_retrans_timer(chan);
3819 __set_monitor_timer(chan);
712132eb 3820
e2ab4353 3821 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 3822
3823done:
e2ab4353
GP		 3824 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3825 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 3826
49208c9c 3827 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 3828}
3829
e328140f 3830void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 3831{
e328140f
MM		 3832 if (chan->mode == L2CAP_MODE_ERTM) {
3833 if (busy)
3834 l2cap_ertm_enter_local_busy(chan);
3835 else
3836 l2cap_ertm_exit_local_busy(chan);
1890d36b 3837 }
1890d36b
GP		 3838}
3839
fb45de7d 3840static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 3841{
3842 struct sk_buff *skb;
88843ab0 3843 u32 control;
8f17154f 3844
e328140f
MM		 3845 while ((skb = skb_peek(&chan->srej_q)) &&
3846 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
3847 int err;
3848
8f17154f
GP		 3849 if (bt_cb(skb)->tx_seq != tx_seq)
3850 break;
3851
f1c6775b 3852 skb = skb_dequeue(&chan->srej_q);
7e0ef6ee 3853 control = __set_ctrl_sar(chan, bt_cb(skb)->sar);
84084a31 3854 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 3855
3856 if (err < 0) {
3857 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
3858 break;
3859 }
3860
836be934
AE		 3861 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
3862 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 3863 }
3864}
3865
fb45de7d 3866static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 3867{
8f17154f 3868 struct srej_list *l, *tmp;
88843ab0 3869 u32 control;
8f17154f 3870
39d5a3ee 3871 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 3872 if (l->tx_seq == tx_seq) {
3873 list_del(&l->list);
3874 kfree(l);
3875 return;
3876 }
ab784b73 3877 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 3878 control |= __set_reqseq(chan, l->tx_seq);
525cd185 3879 l2cap_send_sframe(chan, control);
8f17154f 3880 list_del(&l->list);
39d5a3ee 3881 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 3882 }
3883}
3884
aef89f21 3885static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 3886{
8f17154f 3887 struct srej_list *new;
88843ab0 3888 u32 control;
8f17154f 3889
42e5c802 3890 while (tx_seq != chan->expected_tx_seq) {
ab784b73 3891 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 3892 control |= __set_reqseq(chan, chan->expected_tx_seq);
525cd185 3893 l2cap_send_sframe(chan, control);
8f17154f
GP		 3894
3895 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 3896 if (!new)
3897 return -ENOMEM;
3898
42e5c802 3899 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 3900
3901 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
3902
39d5a3ee 3903 list_add_tail(&new->list, &chan->srej_l);
8f17154f 3904 }
836be934
AE		 3905
3906 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 3907
3908 return 0;
8f17154f
GP		 3909}
3910
88843ab0 3911static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 3912{
fb45de7d 3913 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 3914 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 3915 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 3916 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 3917 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 3918 int err = 0;
3919
88843ab0 3920 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 3921 tx_seq, rx_control);
1c2acffb 3922
03f6715d 3923 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 3924 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 3925 __clear_monitor_timer(chan);
6a026610 3926 if (chan->unacked_frames > 0)
1a09bcb9 3927 __set_retrans_timer(chan);
e2ab4353 3928 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 3929 }
3930
42e5c802
GP		 3931 chan->expected_ack_seq = req_seq;
3932 l2cap_drop_acked_frames(chan);
9f121a5a 3933
836be934 3934 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 3935
3936 /* invalid tx_seq */
47d1ec61 3937 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 3938 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 3939 goto drop;
3940 }
3941
77f918bc
SJ		 3942 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
3943 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
3944 l2cap_send_ack(chan);
1890d36b 3945 goto drop;
77f918bc 3946 }
1890d36b 3947
02f1b641
MM		 3948 if (tx_seq == chan->expected_tx_seq)
3949 goto expected;
3950
e2ab4353 3951 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 3952 struct srej_list *first;
30afb5b2 3953
39d5a3ee 3954 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 3955 struct srej_list, list);
3956 if (tx_seq == first->tx_seq) {
42e5c802 3957 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 3958 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 3959
3960 list_del(&first->list);
3961 kfree(first);
3962
39d5a3ee 3963 if (list_empty(&chan->srej_l)) {
42e5c802 3964 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 3965 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 3966 l2cap_send_ack(chan);
49208c9c 3967 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 3968 }
3969 } else {
3970 struct srej_list *l;
9b53350d
JPRV		 3971
3972 /* duplicated tx_seq */
42e5c802 3973 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 3974 goto drop;
8f17154f 3975
39d5a3ee 3976 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 3977 if (l->tx_seq == tx_seq) {
525cd185 3978 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 3979 return 0;
3980 }
3981 }
aef89f21
SJ		 3982
3983 err = l2cap_send_srejframe(chan, tx_seq);
3984 if (err < 0) {
3985 l2cap_send_disconn_req(chan->conn, chan, -err);
3986 return err;
3987 }
30afb5b2
GP		 3988 }
3989 } else {
836be934
AE		 3990 expected_tx_seq_offset = __seq_offset(chan,
3991 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 3992
3993 /* duplicated tx_seq */
3994 if (tx_seq_offset < expected_tx_seq_offset)
3995 goto drop;
3996
e2ab4353 3997 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 3998
49208c9c 3999 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 4000
39d5a3ee 4001 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 4002 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 4003
f1c6775b 4004 __skb_queue_head_init(&chan->srej_q);
42e5c802 4005 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 4006
0ef3ef0f
SJ		 4007 /* Set P-bit only if there are some I-frames to ack. */
4008 if (__clear_ack_timer(chan))
4009 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 4010
aef89f21
SJ		 4011 err = l2cap_send_srejframe(chan, tx_seq);
4012 if (err < 0) {
4013 l2cap_send_disconn_req(chan->conn, chan, -err);
4014 return err;
4015 }
1c2acffb 4016 }
30afb5b2
GP		 4017 return 0;
4018
8f17154f 4019expected:
836be934 4020 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 4021
e2ab4353 4022 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3b1a9f3f
GP		 4023 bt_cb(skb)->tx_seq = tx_seq;
4024 bt_cb(skb)->sar = sar;
f1c6775b 4025 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 4026 return 0;
4027 }
4028
84084a31 4029 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 4030 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4031
e328140f
MM		 4032 if (err < 0) {
4033 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4034 return err;
4035 }
2ece3684 4036
03f6715d 4037 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4038 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4039 l2cap_retransmit_frames(chan);
4ec10d97
GP		 4040 }
4041
c1b4f43b 4042
6a026610
GP		 4043 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4044 if (chan->num_acked == num_to_ack - 1)
525cd185 4045 l2cap_send_ack(chan);
4d611e4d
GP		 4046 else
4047 __set_ack_timer(chan);
9e917af1 4048
8f17154f 4049 return 0;
9b53350d
JPRV		 4050
4051drop:
4052 kfree_skb(skb);
4053 return 0;
1c2acffb
GP		 4054}
4055
88843ab0 4056static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 4057{
88843ab0 4058 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 4059 __get_reqseq(chan, rx_control), rx_control);
0e98958d 4060
0b209fae 4061 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 4062 l2cap_drop_acked_frames(chan);
1c2acffb 4063
e3781735 4064 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 4065 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4066 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4067 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4068 (chan->unacked_frames > 0))
1a09bcb9 4069 __set_retrans_timer(chan);
05fbd89d 4070
e2ab4353 4071 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 4072 l2cap_send_srejtail(chan);
05fbd89d 4073 } else {
525cd185 4074 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 4075 }
1d8f5d16 4076
03f6715d 4077 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4078 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4079
e2ab4353 4080 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4081 l2cap_retransmit_frames(chan);
2246b2f1 4082
e072745f 4083 } else {
e2ab4353 4084 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4085 (chan->unacked_frames > 0))
1a09bcb9 4086 __set_retrans_timer(chan);
1c2acffb 4087
e2ab4353
GP		 4088 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4089 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4090 l2cap_send_ack(chan);
894718a6 4091 else
525cd185 4092 l2cap_ertm_send(chan);
e072745f
GP		 4093 }
4094}
2246b2f1 4095
88843ab0 4096static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4097{
0b209fae 4098 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4099
88843ab0 4100 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4101
e2ab4353 4102 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4103
42e5c802
GP		 4104 chan->expected_ack_seq = tx_seq;
4105 l2cap_drop_acked_frames(chan);
e072745f 4106
03f6715d 4107 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4108 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4109 l2cap_retransmit_frames(chan);
e072745f 4110 } else {
525cd185 4111 l2cap_retransmit_frames(chan);
30afb5b2 4112
e2ab4353
GP		 4113 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4114 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4115 }
4116}
88843ab0 4117static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4118{
0b209fae 4119 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4120
88843ab0 4121 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4122
e2ab4353 4123 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4124
e3781735 4125 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4126 chan->expected_ack_seq = tx_seq;
4127 l2cap_drop_acked_frames(chan);
3cb123d1 4128
e2ab4353 4129 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4130 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4131
525cd185 4132 l2cap_ertm_send(chan);
dfc909be 4133
e2ab4353 4134 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4135 chan->srej_save_reqseq = tx_seq;
e2ab4353 4136 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4137 }
03f6715d 4138 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4139 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4140 chan->srej_save_reqseq == tx_seq)
e2ab4353 4141 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4142 else
525cd185 4143 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4144 } else {
525cd185 4145 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4146 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4147 chan->srej_save_reqseq = tx_seq;
e2ab4353 4148 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4149 }
e072745f
GP		 4150 }
4151}
4152
88843ab0 4153static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4154{
0b209fae 4155 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4156
88843ab0 4157 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4158
e2ab4353 4159 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4160 chan->expected_ack_seq = tx_seq;
4161 l2cap_drop_acked_frames(chan);
e072745f 4162
e3781735 4163 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4164 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4165
e2ab4353 4166 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4167 __clear_retrans_timer(chan);
e3781735 4168 if (__is_ctrl_poll(chan, rx_control))
525cd185 4169 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4170 return;
e072745f 4171 }
99b0d4b7 4172
e3781735 4173 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4174 l2cap_send_srejtail(chan);
ab784b73
AE		 4175 } else {
4176 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4177 l2cap_send_sframe(chan, rx_control);
4178 }
e072745f
GP		 4179}
4180
88843ab0 4181static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4182{
88843ab0 4183 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4184
03f6715d 4185 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4186 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4187 __clear_monitor_timer(chan);
6a026610 4188 if (chan->unacked_frames > 0)
1a09bcb9 4189 __set_retrans_timer(chan);
e2ab4353 4190 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4191 }
4192
ab784b73
AE		 4193 switch (__get_ctrl_super(chan, rx_control)) {
4194 case L2CAP_SUPER_RR:
525cd185 4195 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4196 break;
4197
ab784b73 4198 case L2CAP_SUPER_REJ:
525cd185 4199 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4200 break;
2246b2f1 4201
ab784b73 4202 case L2CAP_SUPER_SREJ:
525cd185 4203 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4204 break;
4205
ab784b73 4206 case L2CAP_SUPER_RNR:
525cd185 4207 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4208 break;
4209 }
4210
faaebd19 4211 kfree_skb(skb);
1c2acffb
GP		 4212 return 0;
4213}
4214
cad8f1d0 4215static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
218bb9df 4216{
88843ab0 4217 u32 control;
0b209fae 4218 u16 req_seq;
218bb9df
GP		 4219 int len, next_tx_seq_offset, req_seq_offset;
4220
88843ab0
AE		 4221 control = __get_control(chan, skb->data);
4222 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4223 len = skb->len;
4224
4225 /*
4226 * We can just drop the corrupted I-frame here.
4227 * Receiver will miss it and start proper recovery
4228 * procedures and ask retransmission.
4229 */
47d1ec61 4230 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4231 goto drop;
4232
793c2f1c 4233 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4234 len -= L2CAP_SDULEN_SIZE;
218bb9df 4235
47d1ec61 4236 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4237 len -= L2CAP_FCS_SIZE;
218bb9df 4238
47d1ec61 4239 if (len > chan->mps) {
8c1d787b 4240 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4241 goto drop;
4242 }
4243
0b209fae 4244 req_seq = __get_reqseq(chan, control);
218bb9df 4245
836be934
AE		 4246 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4247
4248 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4249 chan->expected_ack_seq);
218bb9df
GP		 4250
4251 /* check for invalid req-seq */
4252 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4253 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4254 goto drop;
4255 }
4256
793c2f1c 4257 if (!__is_sframe(chan, control)) {
218bb9df 4258 if (len < 0) {
8c1d787b 4259 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4260 goto drop;
4261 }
4262
525cd185 4263 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4264 } else {
4265 if (len != 0) {
4266 BT_ERR("%d", len);
8c1d787b 4267 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4268 goto drop;
4269 }
4270
525cd185 4271 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4272 }
4273
4274 return 0;
4275
4276drop:
4277 kfree_skb(skb);
4278 return 0;
4279}
4280
1da177e4
LT		 4281static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4282{
48454079 4283 struct l2cap_chan *chan;
88843ab0 4284 u32 control;
fb45de7d 4285 u16 tx_seq;
218bb9df 4286 int len;
1da177e4 4287
baa7e1fa 4288 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4289 if (!chan) {
1da177e4 4290 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 4291 /* Drop packet and return */
3379013b 4292 kfree_skb(skb);
6be36555 4293 return 0;
1da177e4
LT		 4294 }
4295
6be36555 4296 l2cap_chan_lock(chan);
6840ed07 4297
49208c9c 4298 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4299
89bc500e 4300 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4301 goto drop;
4302
0c1bc5c6 4303 switch (chan->mode) {
1c2acffb
GP		 4304 case L2CAP_MODE_BASIC:
4305 /* If socket recv buffers overflows we drop data here
4306 * which is *bad* because L2CAP has to be reliable.
4307 * But we don't have any other choice. L2CAP doesn't
4308 * provide flow control mechanism. */
1da177e4 4309
0c1bc5c6 4310 if (chan->imtu < skb->len)
1c2acffb 4311 goto drop;
1da177e4 4312
23070494 4313 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4314 goto done;
4315 break;
4316
4317 case L2CAP_MODE_ERTM:
5ef8cb9e 4318 l2cap_ertm_data_rcv(chan, skb);
1c2acffb 4319
fcafde2e 4320 goto done;
1c2acffb 4321
6840ed07 4322 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4323 control = __get_control(chan, skb->data);
4324 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4325 len = skb->len;
4326
47d1ec61 4327 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4328 goto drop;
4329
7e0ef6ee 4330 if (__is_sar_start(chan, control))
03a51213 4331 len -= L2CAP_SDULEN_SIZE;
6840ed07 4332
47d1ec61 4333 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4334 len -= L2CAP_FCS_SIZE;
fcc203c3 4335
793c2f1c 4336 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4337 goto drop;
4338
fb45de7d 4339 tx_seq = __get_txseq(chan, control);
6840ed07 4340
84084a31
MM		 4341 if (chan->expected_tx_seq != tx_seq) {
4342 /* Frame(s) missing - must discard partial SDU */
4343 kfree_skb(chan->sdu);
4344 chan->sdu = NULL;
4345 chan->sdu_last_frag = NULL;
4346 chan->sdu_len = 0;
6840ed07 4347
84084a31
MM		 4348 /* TODO: Notify userland of missing data */
4349 }
4350
836be934 4351 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4352
4353 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4354 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4355
4356 goto done;
4357
1c2acffb 4358 default:
0c1bc5c6 4359 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4360 break;
4361 }
1da177e4
LT		 4362
4363drop:
4364 kfree_skb(skb);
4365
4366done:
6be36555 4367 l2cap_chan_unlock(chan);
0139418c 4368
1da177e4
LT		 4369 return 0;
4370}
4371
8e036fc3 4372static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4373{
23691d75 4374 struct l2cap_chan *chan;
1da177e4 4375
23691d75
GP		 4376 chan = l2cap_global_chan_by_psm(0, psm, conn->src);
4377 if (!chan)
1da177e4
LT		 4378 goto drop;
4379
5b4cedaa 4380 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4381
89bc500e 4382 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4383 goto drop;
4384
e13e21dc 4385 if (chan->imtu < skb->len)
1da177e4
LT		 4386 goto drop;
4387
23070494 4388 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4389 return 0;
1da177e4
LT		 4390
4391drop:
4392 kfree_skb(skb);
4393
1da177e4
LT		 4394 return 0;
4395}
4396
d9b88702
AE		 4397static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4398 struct sk_buff *skb)
9f69bda6 4399{
23691d75 4400 struct l2cap_chan *chan;
9f69bda6 4401
23691d75
GP		 4402 chan = l2cap_global_chan_by_scid(0, cid, conn->src);
4403 if (!chan)
9f69bda6
GP		 4404 goto drop;
4405
5b4cedaa 4406 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 4407
89bc500e 4408 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4409 goto drop;
4410
e13e21dc 4411 if (chan->imtu < skb->len)
9f69bda6
GP		 4412 goto drop;
4413
23070494 4414 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4415 return 0;
9f69bda6
GP		 4416
4417drop:
4418 kfree_skb(skb);
4419
9f69bda6
GP		 4420 return 0;
4421}
4422
1da177e4
LT		 4423static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4424{
4425 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4426 u16 cid, len;
4427 __le16 psm;
1da177e4
LT		 4428
4429 skb_pull(skb, L2CAP_HDR_SIZE);
4430 cid = __le16_to_cpu(lh->cid);
4431 len = __le16_to_cpu(lh->len);
4432
1c2acffb
GP		 4433 if (len != skb->len) {
4434 kfree_skb(skb);
4435 return;
4436 }
4437
1da177e4
LT		 4438 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4439
4440 switch (cid) {
3300d9a9 4441 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4442 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4443 l2cap_sig_channel(conn, skb);
4444 break;
4445
8db4dc46 4446 case L2CAP_CID_CONN_LESS:
097db76c 4447 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 4448 skb_pull(skb, 2);
4449 l2cap_conless_channel(conn, psm, skb);
4450 break;
4451
9f69bda6
GP		 4452 case L2CAP_CID_LE_DATA:
4453 l2cap_att_channel(conn, cid, skb);
4454 break;
4455
b501d6a1
AB		 4456 case L2CAP_CID_SMP:
4457 if (smp_sig_channel(conn, skb))
4458 l2cap_conn_del(conn->hcon, EACCES);
4459 break;
4460
1da177e4
LT		 4461 default:
4462 l2cap_data_channel(conn, cid, skb);
4463 break;
4464 }
4465}
4466
4467/* ---- L2CAP interface with lower layer (HCI) ---- */
4468
686ebf28 4469int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 4470{
4471 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4472 struct l2cap_chan *c;
1da177e4 4473
1da177e4
LT		 4474 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4475
4476 /* Find listening sockets and check their link_mode */
23691d75
GP		 4477 read_lock(&chan_list_lock);
4478 list_for_each_entry(c, &chan_list, global_l) {
4479 struct sock *sk = c->sk;
4343478f 4480
89bc500e 4481 if (c->state != BT_LISTEN)
1da177e4
LT		 4482 continue;
4483
4484 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4485 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4486 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4487 lm1 |= HCI_LM_MASTER;
1da177e4 4488 exact++;
2af6b9d5
MH		 4489 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4490 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4491 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4492 lm2 |= HCI_LM_MASTER;
4493 }
1da177e4 4494 }
23691d75 4495 read_unlock(&chan_list_lock);
1da177e4
LT		 4496
4497 return exact ? lm1 : lm2;
4498}
4499
686ebf28 4500int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 4501{
0139418c
MH		 4502 struct l2cap_conn *conn;
4503
1da177e4
LT		 4504 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4505
1da177e4 4506 if (!status) {
1da177e4
LT		 4507 conn = l2cap_conn_add(hcon, status);
4508 if (conn)
4509 l2cap_conn_ready(conn);
0139418c 4510 } else
e175072f 4511 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4512
4513 return 0;
4514}
4515
686ebf28 4516int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 4517{
4518 struct l2cap_conn *conn = hcon->l2cap_data;
4519
4520 BT_DBG("hcon %p", hcon);
4521
686ebf28 4522 if (!conn)
9f5a0d7b 4523 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4524 return conn->disc_reason;
4525}
4526
686ebf28 4527int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4528{
4529 BT_DBG("hcon %p reason %d", hcon, reason);
4530
e175072f 4531 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 4532 return 0;
4533}
4534
4343478f 4535static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4536{
715ec005 4537 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4538 return;
4539
f62e4323 4540 if (encrypt == 0x00) {
4343478f 4541 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 4542 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4543 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4544 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4545 } else {
4343478f 4546 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4547 __clear_chan_timer(chan);
f62e4323
MH		 4548 }
4549}
4550
686ebf28 4551int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4552{
0139418c 4553 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4554 struct l2cap_chan *chan;
1da177e4 4555
0139418c 4556 if (!conn)
1da177e4 4557 return 0;
0139418c 4558
1da177e4
LT		 4559 BT_DBG("conn %p", conn);
4560
160dc6ac
VCG		 4561 if (hcon->type == LE_LINK) {
4562 smp_distribute_keys(conn, 0);
17cd3f37 4563 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 4564 }
4565
3df91ea2 4566 mutex_lock(&conn->chan_lock);
1da177e4 4567
3df91ea2 4568 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 4569 l2cap_chan_lock(chan);
1da177e4 4570
f1cb9af5
VCG		 4571 BT_DBG("chan->scid %d", chan->scid);
4572
4573 if (chan->scid == L2CAP_CID_LE_DATA) {
4574 if (!status && encrypt) {
4575 chan->sec_level = hcon->sec_level;
cf4cd009 4576 l2cap_chan_ready(chan);
f1cb9af5
VCG		 4577 }
4578
6be36555 4579 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 4580 continue;
4581 }
4582
c1360a1c 4583 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 4584 l2cap_chan_unlock(chan);
6a8d3010
MH		 4585 continue;
4586 }
4587
89bc500e
GP		 4588 if (!status && (chan->state == BT_CONNECTED ||
4589 chan->state == BT_CONFIG)) {
4343478f 4590 l2cap_check_encryption(chan, encrypt);
6be36555 4591 l2cap_chan_unlock(chan);
9719f8af
MH		 4592 continue;
4593 }
4594
89bc500e 4595 if (chan->state == BT_CONNECT) {
b1235d79 4596 if (!status) {
9b27f350 4597 l2cap_send_conn_req(chan);
b1235d79 4598 } else {
ba13ccd9 4599 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4600 }
89bc500e 4601 } else if (chan->state == BT_CONNECT2) {
6be36555 4602 struct sock *sk = chan->sk;
b1235d79 4603 struct l2cap_conn_rsp rsp;
df3c3931 4604 __u16 res, stat;
1da177e4 4605
6be36555
AE		 4606 lock_sock(sk);
4607
b1235d79 4608 if (!status) {
df3c3931
JH		 4609 if (bt_sk(sk)->defer_setup) {
4610 struct sock *parent = bt_sk(sk)->parent;
4611 res = L2CAP_CR_PEND;
4612 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4613 if (parent)
4614 parent->sk_data_ready(parent, 0);
df3c3931 4615 } else {
0e587be7 4616 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4617 res = L2CAP_CR_SUCCESS;
4618 stat = L2CAP_CS_NO_INFO;
4619 }
b1235d79 4620 } else {
0e587be7 4621 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 4622 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4623 res = L2CAP_CR_SEC_BLOCK;
4624 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4625 }
4626
6be36555
AE		 4627 release_sock(sk);
4628
fe4128e0
GP		 4629 rsp.scid = cpu_to_le16(chan->dcid);
4630 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4631 rsp.result = cpu_to_le16(res);
4632 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4633 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4634 sizeof(rsp), &rsp);
b1235d79 4635 }
1da177e4 4636
6be36555 4637 l2cap_chan_unlock(chan);
1da177e4
LT		 4638 }
4639
3df91ea2 4640 mutex_unlock(&conn->chan_lock);
b1235d79 4641
1da177e4
LT		 4642 return 0;
4643}
4644
686ebf28 4645int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 4646{
4647 struct l2cap_conn *conn = hcon->l2cap_data;
4648
5a08ecce
AE		 4649 if (!conn)
4650 conn = l2cap_conn_add(hcon, 0);
4651
4652 if (!conn)
1da177e4
LT		 4653 goto drop;
4654
4655 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4656
e702112f 4657 if (!(flags & ACL_CONT)) {
1da177e4 4658 struct l2cap_hdr *hdr;
48454079 4659 struct l2cap_chan *chan;
89794813 4660 u16 cid;
1da177e4
LT		 4661 int len;
4662
4663 if (conn->rx_len) {
4664 BT_ERR("Unexpected start frame (len %d)", skb->len);
4665 kfree_skb(conn->rx_skb);
4666 conn->rx_skb = NULL;
4667 conn->rx_len = 0;
4668 l2cap_conn_unreliable(conn, ECOMM);
4669 }
4670
aae7fe22
AE		 4671 /* Start fragment always begin with Basic L2CAP header */
4672 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 4673 BT_ERR("Frame is too short (len %d)", skb->len);
4674 l2cap_conn_unreliable(conn, ECOMM);
4675 goto drop;
4676 }
4677
4678 hdr = (struct l2cap_hdr *) skb->data;
4679 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 4680 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 4681
4682 if (len == skb->len) {
4683 /* Complete frame received */
4684 l2cap_recv_frame(conn, skb);
4685 return 0;
4686 }
4687
4688 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
4689
4690 if (skb->len > len) {
4691 BT_ERR("Frame is too long (len %d, expected len %d)",
4692 skb->len, len);
4693 l2cap_conn_unreliable(conn, ECOMM);
4694 goto drop;
4695 }
4696
baa7e1fa 4697 chan = l2cap_get_chan_by_scid(conn, cid);
89794813 4698
48454079
GP		 4699 if (chan && chan->sk) {
4700 struct sock *sk = chan->sk;
3df91ea2 4701 lock_sock(sk);
89794813 4702
0c1bc5c6 4703 if (chan->imtu < len - L2CAP_HDR_SIZE) {
48454079
GP		 4704 BT_ERR("Frame exceeding recv MTU (len %d, "
4705 "MTU %d)", len,
0c1bc5c6 4706 chan->imtu);
aa2ac881 4707 release_sock(sk);
48454079
GP		 4708 l2cap_conn_unreliable(conn, ECOMM);
4709 goto drop;
4710 }
aa2ac881 4711 release_sock(sk);
48454079 4712 }
89794813 4713
1da177e4 4714 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 4715 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
4716 if (!conn->rx_skb)
1da177e4
LT		 4717 goto drop;
4718
d626f62b 4719 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4720 skb->len);
1da177e4
LT		 4721 conn->rx_len = len - skb->len;
4722 } else {
4723 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
4724
4725 if (!conn->rx_len) {
4726 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
4727 l2cap_conn_unreliable(conn, ECOMM);
4728 goto drop;
4729 }
4730
4731 if (skb->len > conn->rx_len) {
4732 BT_ERR("Fragment is too long (len %d, expected %d)",
4733 skb->len, conn->rx_len);
4734 kfree_skb(conn->rx_skb);
4735 conn->rx_skb = NULL;
4736 conn->rx_len = 0;
4737 l2cap_conn_unreliable(conn, ECOMM);
4738 goto drop;
4739 }
4740
d626f62b 4741 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4742 skb->len);
1da177e4
LT		 4743 conn->rx_len -= skb->len;
4744
4745 if (!conn->rx_len) {
4746 /* Complete frame received */
4747 l2cap_recv_frame(conn, conn->rx_skb);
4748 conn->rx_skb = NULL;
4749 }
4750 }
4751
4752drop:
4753 kfree_skb(skb);
4754 return 0;
4755}
4756
aef7d97c 4757static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 4758{
23691d75 4759 struct l2cap_chan *c;
1da177e4 4760
333055f2 4761 read_lock(&chan_list_lock);
1da177e4 4762
23691d75
GP		 4763 list_for_each_entry(c, &chan_list, global_l) {
4764 struct sock *sk = c->sk;
101545f6 4765
903d343e 4766 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 4767 batostr(&bt_sk(sk)->src),
4768 batostr(&bt_sk(sk)->dst),
89bc500e 4769 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 4770 c->scid, c->dcid, c->imtu, c->omtu,
4771 c->sec_level, c->mode);
61e1b4b7 4772 }
1da177e4 4773
333055f2 4774 read_unlock(&chan_list_lock);
1da177e4 4775
aef7d97c 4776 return 0;
1da177e4
LT		 4777}
4778
aef7d97c
MH		 4779static int l2cap_debugfs_open(struct inode *inode, struct file *file)
4780{
4781 return single_open(file, l2cap_debugfs_show, inode->i_private);
4782}
4783
4784static const struct file_operations l2cap_debugfs_fops = {
4785 .open = l2cap_debugfs_open,
4786 .read = seq_read,
4787 .llseek = seq_lseek,
4788 .release = single_release,
4789};
4790
4791static struct dentry *l2cap_debugfs;
1da177e4 4792
64274518 4793int __init l2cap_init(void)
1da177e4
LT		 4794{
4795 int err;
be9d1227 4796
bb58f747 4797 err = l2cap_init_sockets();
1da177e4
LT		 4798 if (err < 0)
4799 return err;
4800
aef7d97c
MH		 4801 if (bt_debugfs) {
4802 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
4803 bt_debugfs, NULL, &l2cap_debugfs_fops);
4804 if (!l2cap_debugfs)
4805 BT_ERR("Failed to create L2CAP debug file");
4806 }
1da177e4 4807
1da177e4 4808 return 0;
1da177e4
LT		 4809}
4810
64274518 4811void l2cap_exit(void)
1da177e4 4812{
aef7d97c 4813 debugfs_remove(l2cap_debugfs);
bb58f747 4814 l2cap_cleanup_sockets();
1da177e4
LT		 4815}
4816
d1c4a17d
GP		 4817module_param(disable_ertm, bool, 0644);
4818MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)