projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Change default state of ERTM disable flag
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
33#include <linux/types.h>
4fc268d2 34#include <linux/capability.h>
1da177e4
LT		 35#include <linux/errno.h>
36#include <linux/kernel.h>
1da177e4
LT		 37#include <linux/sched.h>
38#include <linux/slab.h>
39#include <linux/poll.h>
40#include <linux/fcntl.h>
41#include <linux/init.h>
42#include <linux/interrupt.h>
43#include <linux/socket.h>
44#include <linux/skbuff.h>
1da177e4 45#include <linux/list.h>
be9d1227 46#include <linux/device.h>
aef7d97c
MH		 47#include <linux/debugfs.h>
48#include <linux/seq_file.h>
af05b30b 49#include <linux/uaccess.h>
fcc203c3 50#include <linux/crc16.h>
1da177e4
LT		 51#include <net/sock.h>
52
1da177e4
LT		 53#include <asm/unaligned.h>
54
55#include <net/bluetooth/bluetooth.h>
56#include <net/bluetooth/hci_core.h>
57#include <net/bluetooth/l2cap.h>
b501d6a1 58#include <net/bluetooth/smp.h>
1da177e4 59
b191e031 60bool disable_ertm = 1;
f0709e03 61
47ec1dcd 62static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 63static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 64
b5ad8b7f
JB		 65static LIST_HEAD(chan_list);
66static DEFINE_RWLOCK(chan_list_lock);
1da177e4 67
1da177e4
LT		 68static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
69 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 70static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
71 void *data);
710f9b0a 72static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a 73static void l2cap_send_disconn_req(struct l2cap_conn *conn,
c5daa683 74 struct l2cap_chan *chan, int err);
1da177e4 75
0139418c 76/* ---- L2CAP channels ---- */
71ba0e56 77
baa7e1fa 78static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 79{
3df91ea2 80 struct l2cap_chan *c;
3d57dc68 81
3df91ea2
AE		 82 list_for_each_entry(c, &conn->chan_l, list) {
83 if (c->dcid == cid)
84 return c;
0139418c 85 }
3df91ea2 86 return NULL;
0139418c
MH		 87}
88
baa7e1fa 89static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 90{
3df91ea2 91 struct l2cap_chan *c;
3d57dc68 92
3df91ea2
AE		 93 list_for_each_entry(c, &conn->chan_l, list) {
94 if (c->scid == cid)
95 return c;
0139418c 96 }
3df91ea2 97 return NULL;
0139418c
MH		 98}
99
100/* Find channel with given SCID.
ef191ade 101 * Returns locked channel. */
baa7e1fa 102static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 103{
48454079 104 struct l2cap_chan *c;
baa7e1fa 105
3df91ea2 106 mutex_lock(&conn->chan_lock);
baa7e1fa 107 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 108 if (c)
109 l2cap_chan_lock(c);
3df91ea2
AE		 110 mutex_unlock(&conn->chan_lock);
111
48454079 112 return c;
0139418c
MH		 113}
114
baa7e1fa 115static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 116{
3df91ea2 117 struct l2cap_chan *c;
3d57dc68 118
3df91ea2
AE		 119 list_for_each_entry(c, &conn->chan_l, list) {
120 if (c->ident == ident)
121 return c;
0139418c 122 }
3df91ea2 123 return NULL;
0139418c
MH		 124}
125
23691d75 126static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 127{
23691d75 128 struct l2cap_chan *c;
9e4425ff 129
23691d75
GP		 130 list_for_each_entry(c, &chan_list, global_l) {
131 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 132 return c;
9e4425ff 133 }
250938cb 134 return NULL;
9e4425ff
GP		 135}
136
137int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
138{
73b2ec18
GP		 139 int err;
140
333055f2 141 write_lock(&chan_list_lock);
9e4425ff 142
23691d75 143 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 144 err = -EADDRINUSE;
145 goto done;
9e4425ff
GP		 146 }
147
73b2ec18
GP		 148 if (psm) {
149 chan->psm = psm;
150 chan->sport = psm;
151 err = 0;
152 } else {
153 u16 p;
154
155 err = -EINVAL;
156 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 157 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 158 chan->psm = cpu_to_le16(p);
159 chan->sport = cpu_to_le16(p);
160 err = 0;
161 break;
162 }
163 }
9e4425ff 164
73b2ec18 165done:
333055f2 166 write_unlock(&chan_list_lock);
73b2ec18 167 return err;
9e4425ff
GP		 168}
169
170int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
171{
333055f2 172 write_lock(&chan_list_lock);
9e4425ff
GP		 173
174 chan->scid = scid;
175
333055f2 176 write_unlock(&chan_list_lock);
9e4425ff
GP		 177
178 return 0;
179}
180
baa7e1fa 181static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 182{
8db4dc46 183 u16 cid = L2CAP_CID_DYN_START;
0139418c 184
8db4dc46 185 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 186 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 187 return cid;
188 }
189
190 return 0;
191}
192
0e587be7 193static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 194{
42d2d87c 195 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 196 state_to_string(state));
197
89bc500e
GP		 198 chan->state = state;
199 chan->ops->state_change(chan->data, state);
200}
201
0e587be7
AE		 202static void l2cap_state_change(struct l2cap_chan *chan, int state)
203{
204 struct sock *sk = chan->sk;
205
206 lock_sock(sk);
207 __l2cap_state_change(chan, state);
208 release_sock(sk);
209}
210
2e0052e4
AE		 211static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
212{
213 struct sock *sk = chan->sk;
214
215 sk->sk_err = err;
216}
217
218static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
219{
220 struct sock *sk = chan->sk;
221
222 lock_sock(sk);
223 __l2cap_chan_set_err(chan, err);
224 release_sock(sk);
225}
226
3c588192
MM		 227/* ---- L2CAP sequence number lists ---- */
228
229/* For ERTM, ordered lists of sequence numbers must be tracked for
230 * SREJ requests that are received and for frames that are to be
231 * retransmitted. These seq_list functions implement a singly-linked
232 * list in an array, where membership in the list can also be checked
233 * in constant time. Items can also be added to the tail of the list
234 * and removed from the head in constant time, without further memory
235 * allocs or frees.
236 */
237
238static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
239{
240 size_t alloc_size, i;
241
242 /* Allocated size is a power of 2 to map sequence numbers
243 * (which may be up to 14 bits) in to a smaller array that is
244 * sized for the negotiated ERTM transmit windows.
245 */
246 alloc_size = roundup_pow_of_two(size);
247
248 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
249 if (!seq_list->list)
250 return -ENOMEM;
251
252 seq_list->mask = alloc_size - 1;
253 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
254 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
255 for (i = 0; i < alloc_size; i++)
256 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
257
258 return 0;
259}
260
261static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
262{
263 kfree(seq_list->list);
264}
265
266static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
267 u16 seq)
268{
269 /* Constant-time check for list membership */
270 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
271}
272
273static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
274{
275 u16 mask = seq_list->mask;
276
277 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
278 /* In case someone tries to pop the head of an empty list */
279 return L2CAP_SEQ_LIST_CLEAR;
280 } else if (seq_list->head == seq) {
281 /* Head can be removed in constant time */
282 seq_list->head = seq_list->list[seq & mask];
283 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
284
285 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
286 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
287 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
288 }
289 } else {
290 /* Walk the list to find the sequence number */
291 u16 prev = seq_list->head;
292 while (seq_list->list[prev & mask] != seq) {
293 prev = seq_list->list[prev & mask];
294 if (prev == L2CAP_SEQ_LIST_TAIL)
295 return L2CAP_SEQ_LIST_CLEAR;
296 }
297
298 /* Unlink the number from the list and clear it */
299 seq_list->list[prev & mask] = seq_list->list[seq & mask];
300 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
301 if (seq_list->tail == seq)
302 seq_list->tail = prev;
303 }
304 return seq;
305}
306
307static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
308{
309 /* Remove the head in constant time */
310 return l2cap_seq_list_remove(seq_list, seq_list->head);
311}
312
313static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
314{
f522ae36 315 u16 i;
3c588192 316
f522ae36
GP		 317 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
318 return;
319
320 for (i = 0; i <= seq_list->mask; i++)
321 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
322
323 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
324 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 325}
326
327static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
328{
329 u16 mask = seq_list->mask;
330
331 /* All appends happen in constant time */
332
f522ae36
GP		 333 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
334 return;
3c588192 335
f522ae36
GP		 336 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
337 seq_list->head = seq;
338 else
339 seq_list->list[seq_list->tail & mask] = seq;
340
341 seq_list->tail = seq;
342 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 343}
344
721c4181 345static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 346{
721c4181
GP		 347 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
348 chan_timer.work);
3df91ea2 349 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 350 int reason;
351
e05dcc32 352 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 353
3df91ea2 354 mutex_lock(&conn->chan_lock);
6be36555 355 l2cap_chan_lock(chan);
ab07801d 356
89bc500e 357 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 358 reason = ECONNREFUSED;
89bc500e 359 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 360 chan->sec_level != BT_SECURITY_SDP)
361 reason = ECONNREFUSED;
362 else
363 reason = ETIMEDOUT;
364
0f852724 365 l2cap_chan_close(chan, reason);
ab07801d 366
6be36555 367 l2cap_chan_unlock(chan);
ab07801d 368
ba3bd0ee 369 chan->ops->close(chan->data);
3df91ea2
AE		 370 mutex_unlock(&conn->chan_lock);
371
371fd835 372 l2cap_chan_put(chan);
ab07801d
GP		 373}
374
eef1d9b6 375struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 376{
377 struct l2cap_chan *chan;
378
379 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
380 if (!chan)
381 return NULL;
382
c03b355e
AE		 383 mutex_init(&chan->lock);
384
333055f2 385 write_lock(&chan_list_lock);
23691d75 386 list_add(&chan->global_l, &chan_list);
333055f2 387 write_unlock(&chan_list_lock);
23691d75 388
721c4181 389 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 390
89bc500e
GP		 391 chan->state = BT_OPEN;
392
71ba0e56
GP		 393 atomic_set(&chan->refcnt, 1);
394
2827011f
MM		 395 /* This flag is cleared in l2cap_chan_ready() */
396 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
397
eef1d9b6 398 BT_DBG("chan %p", chan);
abc545b8 399
48454079
GP		 400 return chan;
401}
402
23691d75 403void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 404{
333055f2 405 write_lock(&chan_list_lock);
23691d75 406 list_del(&chan->global_l);
333055f2 407 write_unlock(&chan_list_lock);
23691d75 408
371fd835 409 l2cap_chan_put(chan);
6ff5abbf
GP		 410}
411
bd4b1653
AE		 412void l2cap_chan_set_defaults(struct l2cap_chan *chan)
413{
414 chan->fcs = L2CAP_FCS_CRC16;
415 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
416 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
417 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
418 chan->sec_level = BT_SECURITY_LOW;
419
420 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
421}
422
14a28491 423static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 424{
af05b30b 425 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 426 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 427
9f5a0d7b 428 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 429
8c1d787b 430 chan->conn = conn;
0139418c 431
5491120e
AE		 432 switch (chan->chan_type) {
433 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 434 if (conn->hcon->type == LE_LINK) {
435 /* LE connection */
0c1bc5c6 436 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 437 chan->scid = L2CAP_CID_LE_DATA;
438 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 439 } else {
440 /* Alloc CID for connection-oriented socket */
fe4128e0 441 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 442 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 443 }
5491120e
AE		 444 break;
445
446 case L2CAP_CHAN_CONN_LESS:
0139418c 447 /* Connectionless socket */
fe4128e0
GP		 448 chan->scid = L2CAP_CID_CONN_LESS;
449 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 450 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 451 break;
452
453 default:
0139418c 454 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 455 chan->scid = L2CAP_CID_SIGNALING;
456 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 457 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 458 }
459
8f7975b1
AE		 460 chan->local_id = L2CAP_BESTEFFORT_ID;
461 chan->local_stype = L2CAP_SERV_BESTEFFORT;
462 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
463 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
464 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
465 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
466
371fd835 467 l2cap_chan_hold(chan);
baa7e1fa 468
3df91ea2 469 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 470}
471
14a28491 472static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 473{
474 mutex_lock(&conn->chan_lock);
475 __l2cap_chan_add(conn, chan);
3df91ea2 476 mutex_unlock(&conn->chan_lock);
0139418c
MH		 477}
478
4519de9a 479static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 480{
48454079 481 struct sock *sk = chan->sk;
8c1d787b 482 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 483 struct sock *parent = bt_sk(sk)->parent;
484
c9b66675 485 __clear_chan_timer(chan);
0139418c 486
49208c9c 487 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 488
8e87d142 489 if (conn) {
baa7e1fa 490 /* Delete from channel list */
3df91ea2 491 list_del(&chan->list);
3d57dc68 492
371fd835 493 l2cap_chan_put(chan);
baa7e1fa 494
8c1d787b 495 chan->conn = NULL;
0139418c
MH		 496 hci_conn_put(conn->hcon);
497 }
498
6be36555
AE		 499 lock_sock(sk);
500
0e587be7 501 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 502 sock_set_flag(sk, SOCK_ZAPPED);
503
504 if (err)
2e0052e4 505 __l2cap_chan_set_err(chan, err);
0139418c
MH		 506
507 if (parent) {
508 bt_accept_unlink(sk);
509 parent->sk_data_ready(parent, 0);
510 } else
511 sk->sk_state_change(sk);
c13ffa62 512
6be36555
AE		 513 release_sock(sk);
514
2827011f 515 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 516 return;
2ead70b8 517
58d35f87 518 skb_queue_purge(&chan->tx_q);
c13ffa62 519
0c1bc5c6 520 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 521 struct srej_list *l, *tmp;
522
1a09bcb9
GP		 523 __clear_retrans_timer(chan);
524 __clear_monitor_timer(chan);
525 __clear_ack_timer(chan);
c13ffa62 526
f1c6775b 527 skb_queue_purge(&chan->srej_q);
c13ffa62 528
3c588192
MM		 529 l2cap_seq_list_free(&chan->srej_list);
530 l2cap_seq_list_free(&chan->retrans_list);
39d5a3ee 531 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 532 list_del(&l->list);
533 kfree(l);
534 }
535 }
0139418c
MH		 536}
537
4519de9a
GP		 538static void l2cap_chan_cleanup_listen(struct sock *parent)
539{
540 struct sock *sk;
541
542 BT_DBG("parent %p", parent);
543
544 /* Close not yet accepted channels */
0f852724 545 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 546 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 547
6be36555 548 l2cap_chan_lock(chan);
c9b66675 549 __clear_chan_timer(chan);
ba3bd0ee 550 l2cap_chan_close(chan, ECONNRESET);
6be36555 551 l2cap_chan_unlock(chan);
3df91ea2 552
ba3bd0ee 553 chan->ops->close(chan->data);
0f852724 554 }
4519de9a
GP		 555}
556
0f852724 557void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 558{
559 struct l2cap_conn *conn = chan->conn;
560 struct sock *sk = chan->sk;
561
e05dcc32
AE		 562 BT_DBG("chan %p state %s sk %p", chan,
563 state_to_string(chan->state), sk);
4519de9a 564
89bc500e 565 switch (chan->state) {
4519de9a 566 case BT_LISTEN:
6be36555 567 lock_sock(sk);
4519de9a 568 l2cap_chan_cleanup_listen(sk);
89bc500e 569
0e587be7 570 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 571 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 572 release_sock(sk);
4519de9a
GP		 573 break;
574
575 case BT_CONNECTED:
576 case BT_CONFIG:
715ec005 577 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 578 conn->hcon->type == ACL_LINK) {
c9b66675 579 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 580 l2cap_send_disconn_req(conn, chan, reason);
581 } else
582 l2cap_chan_del(chan, reason);
583 break;
584
585 case BT_CONNECT2:
715ec005 586 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 587 conn->hcon->type == ACL_LINK) {
588 struct l2cap_conn_rsp rsp;
589 __u16 result;
590
c5daa683 591 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
4519de9a
GP		 592 result = L2CAP_CR_SEC_BLOCK;
593 else
594 result = L2CAP_CR_BAD_PSM;
89bc500e 595 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 596
597 rsp.scid = cpu_to_le16(chan->dcid);
598 rsp.dcid = cpu_to_le16(chan->scid);
599 rsp.result = cpu_to_le16(result);
600 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
601 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
602 sizeof(rsp), &rsp);
603 }
604
605 l2cap_chan_del(chan, reason);
606 break;
607
608 case BT_CONNECT:
609 case BT_DISCONN:
610 l2cap_chan_del(chan, reason);
611 break;
612
613 default:
6be36555 614 lock_sock(sk);
4519de9a 615 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 616 release_sock(sk);
4519de9a
GP		 617 break;
618 }
619}
620
4343478f 621static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 622{
715ec005 623 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 624 switch (chan->sec_level) {
8556edd3
JH		 625 case BT_SECURITY_HIGH:
626 return HCI_AT_DEDICATED_BONDING_MITM;
627 case BT_SECURITY_MEDIUM:
628 return HCI_AT_DEDICATED_BONDING;
629 default:
630 return HCI_AT_NO_BONDING;
631 }
fe4128e0 632 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 633 if (chan->sec_level == BT_SECURITY_LOW)
634 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 635
4343478f 636 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 637 return HCI_AT_NO_BONDING_MITM;
00ae4af9 638 else
8556edd3 639 return HCI_AT_NO_BONDING;
00ae4af9 640 } else {
4343478f 641 switch (chan->sec_level) {
00ae4af9 642 case BT_SECURITY_HIGH:
8556edd3 643 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 644 case BT_SECURITY_MEDIUM:
8556edd3 645 return HCI_AT_GENERAL_BONDING;
00ae4af9 646 default:
8556edd3 647 return HCI_AT_NO_BONDING;
00ae4af9 648 }
0684e5f9 649 }
8556edd3
JH		 650}
651
652/* Service level security */
d45fc423 653int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 654{
8c1d787b 655 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 656 __u8 auth_type;
657
4343478f 658 auth_type = l2cap_get_auth_type(chan);
79d554a6 659
4343478f 660 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 661}
662
b5ad8b7f 663static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 664{
665 u8 id;
666
667 /* Get next available identificator.
668 * 1 - 128 are used by kernel.
669 * 129 - 199 are reserved.
670 * 200 - 254 are used by utilities like l2ping, etc.
671 */
672
333055f2 673 spin_lock(&conn->lock);
4e8402a3
MH		 674
675 if (++conn->tx_ident > 128)
676 conn->tx_ident = 1;
677
678 id = conn->tx_ident;
679
333055f2 680 spin_unlock(&conn->lock);
4e8402a3
MH		 681
682 return id;
683}
684
4519de9a 685static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 686{
687 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 688 u8 flags;
4e8402a3
MH		 689
690 BT_DBG("code 0x%2.2x", code);
691
692 if (!skb)
9a9c6a34 693 return;
4e8402a3 694
e702112f
AE		 695 if (lmp_no_flush_capable(conn->hcon->hdev))
696 flags = ACL_START_NO_FLUSH;
697 else
698 flags = ACL_START;
699
14b12d0b 700 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 701 skb->priority = HCI_PRIO_MAX;
14b12d0b 702
73d80deb
LAD		 703 hci_send_acl(conn->hchan, skb, flags);
704}
705
706static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
707{
708 struct hci_conn *hcon = chan->conn->hcon;
709 u16 flags;
710
711 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
712 skb->priority);
713
714 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
715 lmp_no_flush_capable(hcon->hdev))
716 flags = ACL_START_NO_FLUSH;
717 else
718 flags = ACL_START;
14b12d0b 719
73d80deb
LAD		 720 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
721 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 722}
723
b76bbd66
MM		 724static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
725{
726 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
727 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
728
729 if (enh & L2CAP_CTRL_FRAME_TYPE) {
730 /* S-Frame */
731 control->sframe = 1;
732 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
733 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
734
735 control->sar = 0;
736 control->txseq = 0;
737 } else {
738 /* I-Frame */
739 control->sframe = 0;
740 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
741 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
742
743 control->poll = 0;
744 control->super = 0;
745 }
746}
747
b76bbd66
MM		 748static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
749{
750 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
751 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
752
753 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
754 /* S-Frame */
755 control->sframe = 1;
756 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
757 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
758
759 control->sar = 0;
760 control->txseq = 0;
761 } else {
762 /* I-Frame */
763 control->sframe = 0;
764 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
765 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
766
767 control->poll = 0;
768 control->super = 0;
769 }
770}
771
772static inline void __unpack_control(struct l2cap_chan *chan,
773 struct sk_buff *skb)
774{
775 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
776 __unpack_extended_control(get_unaligned_le32(skb->data),
777 &bt_cb(skb)->control);
778 } else {
779 __unpack_enhanced_control(get_unaligned_le16(skb->data),
780 &bt_cb(skb)->control);
781 }
782}
783
b5c6aaed
MM		 784static u32 __pack_extended_control(struct l2cap_ctrl *control)
785{
786 u32 packed;
787
788 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
789 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
790
791 if (control->sframe) {
792 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
793 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
794 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
795 } else {
796 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
797 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
798 }
799
800 return packed;
801}
802
803static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
804{
805 u16 packed;
806
807 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
808 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
809
810 if (control->sframe) {
811 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
812 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
813 packed |= L2CAP_CTRL_FRAME_TYPE;
814 } else {
815 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
816 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
817 }
818
819 return packed;
820}
821
b76bbd66
MM		 822static inline void __pack_control(struct l2cap_chan *chan,
823 struct l2cap_ctrl *control,
824 struct sk_buff *skb)
825{
826 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
827 put_unaligned_le32(__pack_extended_control(control),
828 skb->data + L2CAP_HDR_SIZE);
829 } else {
830 put_unaligned_le16(__pack_enhanced_control(control),
831 skb->data + L2CAP_HDR_SIZE);
832 }
833}
834
b5c6aaed
MM		 835static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
836{
837 struct sk_buff *skb;
838 struct l2cap_hdr *lh;
839 struct l2cap_conn *conn = chan->conn;
840 int count, hlen;
841
842 if (chan->state != BT_CONNECTED)
843 return;
844
845 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
846 hlen = L2CAP_EXT_HDR_SIZE;
847 else
848 hlen = L2CAP_ENH_HDR_SIZE;
849
850 if (chan->fcs == L2CAP_FCS_CRC16)
851 hlen += L2CAP_FCS_SIZE;
852
853 BT_DBG("chan %p, control 0x%8.8x", chan, control);
854
855 count = min_t(unsigned int, conn->mtu, hlen);
856
857 control |= __set_sframe(chan);
858
859 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
860 control |= __set_ctrl_final(chan);
861
862 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
863 control |= __set_ctrl_poll(chan);
864
865 skb = bt_skb_alloc(count, GFP_ATOMIC);
866 if (!skb)
867 return;
868
869 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
870 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
871 lh->cid = cpu_to_le16(chan->dcid);
872
873 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
874
875 if (chan->fcs == L2CAP_FCS_CRC16) {
876 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
877 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
878 }
879
880 skb->priority = HCI_PRIO_MAX;
881 l2cap_do_send(chan, skb);
882}
883
884static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
885{
886 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
887 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
888 set_bit(CONN_RNR_SENT, &chan->conn_state);
889 } else
890 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
891
892 control |= __set_reqseq(chan, chan->buffer_seq);
893
894 l2cap_send_sframe(chan, control);
895}
896
b4450035 897static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 898{
c1360a1c 899 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 900}
901
9b27f350
AE		 902static void l2cap_send_conn_req(struct l2cap_chan *chan)
903{
904 struct l2cap_conn *conn = chan->conn;
905 struct l2cap_conn_req req;
906
907 req.scid = cpu_to_le16(chan->scid);
908 req.psm = chan->psm;
909
910 chan->ident = l2cap_get_ident(conn);
911
912 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
913
914 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
915}
916
9f0caeb1
VCG		 917static void l2cap_chan_ready(struct l2cap_chan *chan)
918{
919 struct sock *sk = chan->sk;
920 struct sock *parent;
921
922 lock_sock(sk);
923
924 parent = bt_sk(sk)->parent;
925
926 BT_DBG("sk %p, parent %p", sk, parent);
927
2827011f 928 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 929 chan->conf_state = 0;
930 __clear_chan_timer(chan);
931
932 __l2cap_state_change(chan, BT_CONNECTED);
933 sk->sk_state_change(sk);
934
935 if (parent)
936 parent->sk_data_ready(parent, 0);
937
938 release_sock(sk);
939}
940
fc7f8a7e 941static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 942{
8c1d787b 943 struct l2cap_conn *conn = chan->conn;
79d554a6 944
9f0caeb1
VCG		 945 if (conn->hcon->type == LE_LINK) {
946 l2cap_chan_ready(chan);
947 return;
948 }
949
79d554a6 950 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 951 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
952 return;
953
d45fc423 954 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 955 __l2cap_no_conn_pending(chan))
956 l2cap_send_conn_req(chan);
79d554a6
MH		 957 } else {
958 struct l2cap_info_req req;
959 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
960
961 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
962 conn->info_ident = l2cap_get_ident(conn);
963
ba13ccd9 964 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 965
966 l2cap_send_cmd(conn, conn->info_ident,
967 L2CAP_INFO_REQ, sizeof(req), &req);
968 }
969}
970
cf6c2c0b
GP		 971static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
972{
973 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 974 if (!disable_ertm)
cf6c2c0b
GP		 975 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
976
977 switch (mode) {
978 case L2CAP_MODE_ERTM:
979 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
980 case L2CAP_MODE_STREAMING:
981 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
982 default:
983 return 0x00;
984 }
985}
986
4519de9a 987static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 988{
6be36555 989 struct sock *sk = chan->sk;
22121fc9
GP		 990 struct l2cap_disconn_req req;
991
c13ffa62
GP		 992 if (!conn)
993 return;
994
0c1bc5c6 995 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 996 __clear_retrans_timer(chan);
997 __clear_monitor_timer(chan);
998 __clear_ack_timer(chan);
c13ffa62
GP		 999 }
1000
fe4128e0
GP		 1001 req.dcid = cpu_to_le16(chan->dcid);
1002 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 1003 l2cap_send_cmd(conn, l2cap_get_ident(conn),
1004 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 1005
6be36555 1006 lock_sock(sk);
0e587be7 1007 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1008 __l2cap_chan_set_err(chan, err);
6be36555 1009 release_sock(sk);
22121fc9
GP		 1010}
1011
1da177e4 1012/* ---- L2CAP connections ---- */
4e8402a3
MH		 1013static void l2cap_conn_start(struct l2cap_conn *conn)
1014{
3df91ea2 1015 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1016
1017 BT_DBG("conn %p", conn);
1018
3df91ea2 1019 mutex_lock(&conn->chan_lock);
4e8402a3 1020
3df91ea2 1021 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1022 struct sock *sk = chan->sk;
baa7e1fa 1023
6be36555 1024 l2cap_chan_lock(chan);
4e8402a3 1025
715ec005 1026 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1027 l2cap_chan_unlock(chan);
79d554a6
MH		 1028 continue;
1029 }
1030
89bc500e 1031 if (chan->state == BT_CONNECT) {
d45fc423 1032 if (!l2cap_chan_check_security(chan) ||
b4450035 1033 !__l2cap_no_conn_pending(chan)) {
6be36555 1034 l2cap_chan_unlock(chan);
47731de7
GP		 1035 continue;
1036 }
79d554a6 1037
c1360a1c
GP		 1038 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1039 && test_bit(CONF_STATE2_DEVICE,
1040 &chan->conf_state)) {
89bc500e 1041 l2cap_chan_close(chan, ECONNRESET);
6be36555 1042 l2cap_chan_unlock(chan);
47731de7 1043 continue;
b1235d79 1044 }
47731de7 1045
9b27f350 1046 l2cap_send_conn_req(chan);
47731de7 1047
89bc500e 1048 } else if (chan->state == BT_CONNECT2) {
79d554a6 1049 struct l2cap_conn_rsp rsp;
e9aeb2dd 1050 char buf[128];
fe4128e0
GP		 1051 rsp.scid = cpu_to_le16(chan->dcid);
1052 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1053
d45fc423 1054 if (l2cap_chan_check_security(chan)) {
6be36555 1055 lock_sock(sk);
c5daa683
GP		 1056 if (test_bit(BT_SK_DEFER_SETUP,
1057 &bt_sk(sk)->flags)) {
f66dc81f
MH		 1058 struct sock *parent = bt_sk(sk)->parent;
1059 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1060 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 1061 if (parent)
1062 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 1063
1064 } else {
0e587be7 1065 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 1066 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1067 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1068 }
6be36555 1069 release_sock(sk);
79d554a6
MH		 1070 } else {
1071 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1072 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1073 }
1074
fc7f8a7e
GP		 1075 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1076 sizeof(rsp), &rsp);
e9aeb2dd 1077
c1360a1c 1078 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 1079 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1080 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1081 continue;
1082 }
1083
c1360a1c 1084 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1085 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 1086 l2cap_build_conf_req(chan, buf), buf);
1087 chan->num_conf_req++;
4e8402a3
MH		 1088 }
1089
6be36555 1090 l2cap_chan_unlock(chan);
4e8402a3
MH		 1091 }
1092
3df91ea2 1093 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1094}
1095
c2287681 1096/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1097 * Returns closest match, locked.
1098 */
d9b88702 1099static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1100 bdaddr_t *src,
1101 bdaddr_t *dst)
b62f328b 1102{
23691d75 1103 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1104
23691d75 1105 read_lock(&chan_list_lock);
b62f328b 1106
23691d75
GP		 1107 list_for_each_entry(c, &chan_list, global_l) {
1108 struct sock *sk = c->sk;
fe4128e0 1109
89bc500e 1110 if (state && c->state != state)
b62f328b
VT		 1111 continue;
1112
23691d75 1113 if (c->scid == cid) {
c2287681
IY		 1114 int src_match, dst_match;
1115 int src_any, dst_any;
1116
b62f328b 1117 /* Exact match. */
c2287681
IY		 1118 src_match = !bacmp(&bt_sk(sk)->src, src);
1119 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1120 if (src_match && dst_match) {
23691d75
GP		 1121 read_unlock(&chan_list_lock);
1122 return c;
1123 }
b62f328b
VT		 1124
1125 /* Closest match */
c2287681
IY		 1126 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1127 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1128 if ((src_match && dst_any) || (src_any && dst_match) ||
1129 (src_any && dst_any))
23691d75 1130 c1 = c;
b62f328b
VT		 1131 }
1132 }
280f294f 1133
23691d75 1134 read_unlock(&chan_list_lock);
b62f328b 1135
23691d75 1136 return c1;
b62f328b
VT		 1137}
1138
1139static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1140{
c916fbe4 1141 struct sock *parent, *sk;
23691d75 1142 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1143
1144 BT_DBG("");
1145
1146 /* Check if we have socket listening on cid */
23691d75 1147 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1148 conn->src, conn->dst);
23691d75 1149 if (!pchan)
b62f328b
VT		 1150 return;
1151
23691d75
GP		 1152 parent = pchan->sk;
1153
aa2ac881 1154 lock_sock(parent);
62f3a2cf 1155
b62f328b
VT		 1156 /* Check for backlog size */
1157 if (sk_acceptq_is_full(parent)) {
1158 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1159 goto clean;
1160 }
1161
80808e43
GP		 1162 chan = pchan->ops->new_connection(pchan->data);
1163 if (!chan)
b62f328b
VT		 1164 goto clean;
1165
80808e43 1166 sk = chan->sk;
5d41ce1d 1167
b62f328b
VT		 1168 hci_conn_hold(conn->hcon);
1169
b62f328b
VT		 1170 bacpy(&bt_sk(sk)->src, conn->src);
1171 bacpy(&bt_sk(sk)->dst, conn->dst);
1172
d1010240
GP		 1173 bt_accept_enqueue(parent, sk);
1174
3d57dc68 1175 l2cap_chan_add(conn, chan);
48454079 1176
c9b66675 1177 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 1178
0e587be7 1179 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 1180 parent->sk_data_ready(parent, 0);
1181
b62f328b 1182clean:
aa2ac881 1183 release_sock(parent);
b62f328b
VT		 1184}
1185
4e8402a3
MH		 1186static void l2cap_conn_ready(struct l2cap_conn *conn)
1187{
48454079 1188 struct l2cap_chan *chan;
4e8402a3 1189
79d554a6 1190 BT_DBG("conn %p", conn);
4e8402a3 1191
b62f328b
VT		 1192 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
1193 l2cap_le_conn_ready(conn);
1194
160dc6ac
VCG		 1195 if (conn->hcon->out && conn->hcon->type == LE_LINK)
1196 smp_conn_security(conn, conn->hcon->pending_sec_level);
1197
3df91ea2 1198 mutex_lock(&conn->chan_lock);
4e8402a3 1199
3df91ea2 1200 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1201
6be36555 1202 l2cap_chan_lock(chan);
4e8402a3 1203
63128451 1204 if (conn->hcon->type == LE_LINK) {
b501d6a1 1205 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 1206 l2cap_chan_ready(chan);
acd7d370 1207
63128451 1208 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1209 struct sock *sk = chan->sk;
c9b66675 1210 __clear_chan_timer(chan);
6be36555 1211 lock_sock(sk);
0e587be7 1212 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1213 sk->sk_state_change(sk);
6be36555 1214 release_sock(sk);
b501d6a1 1215
89bc500e 1216 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1217 l2cap_do_start(chan);
4e8402a3 1218
6be36555 1219 l2cap_chan_unlock(chan);
4e8402a3 1220 }
79d554a6 1221
3df91ea2 1222 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1223}
1224
1225/* Notify sockets that we cannot guaranty reliability anymore */
1226static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1227{
48454079 1228 struct l2cap_chan *chan;
4e8402a3
MH		 1229
1230 BT_DBG("conn %p", conn);
1231
3df91ea2 1232 mutex_lock(&conn->chan_lock);
4e8402a3 1233
3df91ea2 1234 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1235 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 1236 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1237 }
1238
3df91ea2 1239 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1240}
1241
f878fcad 1242static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1243{
f878fcad 1244 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 1245 info_timer.work);
4e8402a3 1246
984947dc 1247 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1248 conn->info_ident = 0;
984947dc 1249
4e8402a3
MH		 1250 l2cap_conn_start(conn);
1251}
1252
5d3de7df
VCG		 1253static void l2cap_conn_del(struct hci_conn *hcon, int err)
1254{
1255 struct l2cap_conn *conn = hcon->l2cap_data;
1256 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1257
1258 if (!conn)
1259 return;
1260
1261 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1262
1263 kfree_skb(conn->rx_skb);
1264
3df91ea2
AE		 1265 mutex_lock(&conn->chan_lock);
1266
5d3de7df
VCG		 1267 /* Kill channels */
1268 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1269 l2cap_chan_hold(chan);
6be36555
AE		 1270 l2cap_chan_lock(chan);
1271
5d3de7df 1272 l2cap_chan_del(chan, err);
6be36555
AE		 1273
1274 l2cap_chan_unlock(chan);
1275
5d3de7df 1276 chan->ops->close(chan->data);
61d6ef3e 1277 l2cap_chan_put(chan);
5d3de7df
VCG		 1278 }
1279
3df91ea2
AE		 1280 mutex_unlock(&conn->chan_lock);
1281
73d80deb
LAD		 1282 hci_chan_del(conn->hchan);
1283
5d3de7df 1284 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1285 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1286
51a8efd7 1287 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1288 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1289 smp_chan_destroy(conn);
d26a2345 1290 }
5d3de7df
VCG		 1291
1292 hcon->l2cap_data = NULL;
1293 kfree(conn);
1294}
1295
6c9d42a1 1296static void security_timeout(struct work_struct *work)
5d3de7df 1297{
6c9d42a1
GP		 1298 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1299 security_timer.work);
5d3de7df
VCG		 1300
1301 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1302}
1303
1da177e4
LT		 1304static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1305{
0139418c 1306 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1307 struct hci_chan *hchan;
1da177e4 1308
0139418c 1309 if (conn || status)
1da177e4
LT		 1310 return conn;
1311
73d80deb
LAD		 1312 hchan = hci_chan_create(hcon);
1313 if (!hchan)
1314 return NULL;
1315
0139418c 1316 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1317 if (!conn) {
1318 hci_chan_del(hchan);
1da177e4 1319 return NULL;
73d80deb 1320 }
1da177e4
LT		 1321
1322 hcon->l2cap_data = conn;
1323 conn->hcon = hcon;
73d80deb 1324 conn->hchan = hchan;
1da177e4 1325
73d80deb 1326 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1327
acd7d370
VT		 1328 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1329 conn->mtu = hcon->hdev->le_mtu;
1330 else
1331 conn->mtu = hcon->hdev->acl_mtu;
1332
1da177e4
LT		 1333 conn->src = &hcon->hdev->bdaddr;
1334 conn->dst = &hcon->dst;
1335
4e8402a3
MH		 1336 conn->feat_mask = 0;
1337
1da177e4 1338 spin_lock_init(&conn->lock);
3df91ea2 1339 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1340
1341 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1342
5d3de7df 1343 if (hcon->type == LE_LINK)
6c9d42a1 1344 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1345 else
030013d8 1346 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1347
9f5a0d7b 1348 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1349
1da177e4
LT		 1350 return conn;
1351}
1352
1da177e4 1353/* ---- Socket interface ---- */
1da177e4 1354
c2287681 1355/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1356 * Returns closest match.
1357 */
c2287681
IY		 1358static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1359 bdaddr_t *src,
1360 bdaddr_t *dst)
1da177e4 1361{
23691d75 1362 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1363
23691d75 1364 read_lock(&chan_list_lock);
e0f0cb56 1365
23691d75
GP		 1366 list_for_each_entry(c, &chan_list, global_l) {
1367 struct sock *sk = c->sk;
fe4128e0 1368
89bc500e 1369 if (state && c->state != state)
1da177e4
LT		 1370 continue;
1371
23691d75 1372 if (c->psm == psm) {
c2287681
IY		 1373 int src_match, dst_match;
1374 int src_any, dst_any;
1375
1da177e4 1376 /* Exact match. */
c2287681
IY		 1377 src_match = !bacmp(&bt_sk(sk)->src, src);
1378 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1379 if (src_match && dst_match) {
a7567b20 1380 read_unlock(&chan_list_lock);
23691d75
GP		 1381 return c;
1382 }
1da177e4
LT		 1383
1384 /* Closest match */
c2287681
IY		 1385 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1386 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1387 if ((src_match && dst_any) || (src_any && dst_match) ||
1388 (src_any && dst_any))
23691d75 1389 c1 = c;
1da177e4
LT		 1390 }
1391 }
1da177e4 1392
23691d75 1393 read_unlock(&chan_list_lock);
e0f0cb56 1394
23691d75 1395 return c1;
1da177e4
LT		 1396}
1397
8e9f9892
AG		 1398int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1399 bdaddr_t *dst, u8 dst_type)
1da177e4 1400{
5d41ce1d 1401 struct sock *sk = chan->sk;
1da177e4 1402 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1403 struct l2cap_conn *conn;
1404 struct hci_conn *hcon;
1405 struct hci_dev *hdev;
09ab6f4c 1406 __u8 auth_type;
44d0e48e 1407 int err;
1da177e4 1408
8e9f9892
AG		 1409 BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
1410 dst_type, __le16_to_cpu(chan->psm));
1da177e4 1411
af05b30b
GP		 1412 hdev = hci_get_route(dst, src);
1413 if (!hdev)
1da177e4
LT		 1414 return -EHOSTUNREACH;
1415
09fd0de5 1416 hci_dev_lock(hdev);
1da177e4 1417
6be36555 1418 l2cap_chan_lock(chan);
03a00194
GP		 1419
1420 /* PSM must be odd and lsb of upper byte must be 0 */
1421 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1422 chan->chan_type != L2CAP_CHAN_RAW) {
1423 err = -EINVAL;
1424 goto done;
1425 }
1426
1427 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1428 err = -EINVAL;
1429 goto done;
1430 }
1431
1432 switch (chan->mode) {
1433 case L2CAP_MODE_BASIC:
1434 break;
1435 case L2CAP_MODE_ERTM:
1436 case L2CAP_MODE_STREAMING:
1437 if (!disable_ertm)
1438 break;
1439 /* fall through */
1440 default:
1441 err = -ENOTSUPP;
1442 goto done;
1443 }
1444
6be36555
AE		 1445 lock_sock(sk);
1446
03a00194
GP		 1447 switch (sk->sk_state) {
1448 case BT_CONNECT:
1449 case BT_CONNECT2:
1450 case BT_CONFIG:
1451 /* Already connecting */
1452 err = 0;
6be36555 1453 release_sock(sk);
03a00194
GP		 1454 goto done;
1455
1456 case BT_CONNECTED:
1457 /* Already connected */
1458 err = -EISCONN;
6be36555 1459 release_sock(sk);
03a00194
GP		 1460 goto done;
1461
1462 case BT_OPEN:
1463 case BT_BOUND:
1464 /* Can connect */
1465 break;
1466
1467 default:
1468 err = -EBADFD;
6be36555 1469 release_sock(sk);
03a00194
GP		 1470 goto done;
1471 }
1472
1473 /* Set destination address and psm */
9219b2a0 1474 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1475
1476 release_sock(sk);
1477
03a00194
GP		 1478 chan->psm = psm;
1479 chan->dcid = cid;
1da177e4 1480
4343478f 1481 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1482
fe4128e0 1483 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1484 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1485 chan->sec_level, auth_type);
acd7d370 1486 else
8e9f9892 1487 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1488 chan->sec_level, auth_type);
acd7d370 1489
30e76272
VT		 1490 if (IS_ERR(hcon)) {
1491 err = PTR_ERR(hcon);
1da177e4 1492 goto done;
30e76272 1493 }
1da177e4
LT		 1494
1495 conn = l2cap_conn_add(hcon, 0);
1496 if (!conn) {
1497 hci_conn_put(hcon);
30e76272 1498 err = -ENOMEM;
1da177e4
LT		 1499 goto done;
1500 }
1501
9f0caeb1
VCG		 1502 if (hcon->type == LE_LINK) {
1503 err = 0;
1504
1505 if (!list_empty(&conn->chan_l)) {
1506 err = -EBUSY;
1507 hci_conn_put(hcon);
1508 }
1509
1510 if (err)
1511 goto done;
1512 }
1513
1da177e4
LT		 1514 /* Update source addr of the socket */
1515 bacpy(src, conn->src);
1516
6be36555 1517 l2cap_chan_unlock(chan);
48454079 1518 l2cap_chan_add(conn, chan);
6be36555 1519 l2cap_chan_lock(chan);
48454079 1520
6be36555 1521 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1522 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1523
1524 if (hcon->state == BT_CONNECTED) {
715ec005 1525 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1526 __clear_chan_timer(chan);
d45fc423 1527 if (l2cap_chan_check_security(chan))
6be36555 1528 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1529 } else
fc7f8a7e 1530 l2cap_do_start(chan);
1da177e4
LT		 1531 }
1532
30e76272
VT		 1533 err = 0;
1534
1da177e4 1535done:
6be36555 1536 l2cap_chan_unlock(chan);
09fd0de5 1537 hci_dev_unlock(hdev);
1da177e4
LT		 1538 hci_dev_put(hdev);
1539 return err;
1540}
1541
dcba0dba 1542int __l2cap_wait_ack(struct sock *sk)
6161c038 1543{
8c1d787b 1544 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1545 DECLARE_WAITQUEUE(wait, current);
1546 int err = 0;
1547 int timeo = HZ/5;
1548
2b0b05dd 1549 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1550 set_current_state(TASK_INTERRUPTIBLE);
1551 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1552 if (!timeo)
1553 timeo = HZ/5;
1554
1555 if (signal_pending(current)) {
1556 err = sock_intr_errno(timeo);
1557 break;
1558 }
1559
1560 release_sock(sk);
1561 timeo = schedule_timeout(timeo);
1562 lock_sock(sk);
a71a0cf4 1563 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1564
1565 err = sock_error(sk);
1566 if (err)
1567 break;
1568 }
1569 set_current_state(TASK_RUNNING);
2b0b05dd 1570 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1571 return err;
1572}
1573
721c4181 1574static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1575{
721c4181
GP		 1576 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1577 monitor_timer.work);
e90bac06 1578
525cd185 1579 BT_DBG("chan %p", chan);
0e98958d 1580
6be36555
AE		 1581 l2cap_chan_lock(chan);
1582
2c03a7a4 1583 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1584 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
6be36555 1585 l2cap_chan_unlock(chan);
8d7e1c7f 1586 l2cap_chan_put(chan);
e90bac06
GP		 1587 return;
1588 }
1589
6a026610 1590 chan->retry_count++;
1a09bcb9 1591 __set_monitor_timer(chan);
e90bac06 1592
525cd185 1593 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555 1594 l2cap_chan_unlock(chan);
8d7e1c7f 1595 l2cap_chan_put(chan);
e90bac06
GP		 1596}
1597
721c4181 1598static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1599{
721c4181
GP		 1600 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1601 retrans_timer.work);
e90bac06 1602
49208c9c 1603 BT_DBG("chan %p", chan);
0e98958d 1604
6be36555
AE		 1605 l2cap_chan_lock(chan);
1606
6a026610 1607 chan->retry_count = 1;
1a09bcb9 1608 __set_monitor_timer(chan);
e90bac06 1609
e2ab4353 1610 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1611
525cd185 1612 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555
AE		 1613
1614 l2cap_chan_unlock(chan);
8d7e1c7f 1615 l2cap_chan_put(chan);
e90bac06
GP		 1616}
1617
42e5c802 1618static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1619{
1c2acffb 1620 struct sk_buff *skb;
1da177e4 1621
58d35f87 1622 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1623 chan->unacked_frames) {
3ce3514f 1624 if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
1c2acffb 1625 break;
1da177e4 1626
58d35f87 1627 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1628 kfree_skb(skb);
1da177e4 1629
6a026610 1630 chan->unacked_frames--;
1c2acffb 1631 }
1da177e4 1632
6a026610 1633 if (!chan->unacked_frames)
1a09bcb9 1634 __clear_retrans_timer(chan);
1c2acffb 1635}
1da177e4 1636
67c9e840 1637static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1638{
ccbb84af 1639 struct sk_buff *skb;
88843ab0
AE		 1640 u32 control;
1641 u16 fcs;
6840ed07 1642
58d35f87 1643 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1644 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1645 control |= __set_txseq(chan, chan->next_tx_seq);
94122bbe 1646 control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
88843ab0 1647 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1648
47d1ec61 1649 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1650 fcs = crc16(0, (u8 *)skb->data,
1651 skb->len - L2CAP_FCS_SIZE);
1652 put_unaligned_le16(fcs,
1653 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1654 }
1655
4343478f 1656 l2cap_do_send(chan, skb);
6840ed07 1657
836be934 1658 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1659 }
6840ed07
GP		 1660}
1661
fb45de7d 1662static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1663{
8f17154f 1664 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1665 u16 fcs;
1666 u32 control;
8f17154f 1667
58d35f87 1668 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1669 if (!skb)
1670 return;
8f17154f 1671
3ce3514f 1672 while (bt_cb(skb)->control.txseq != tx_seq) {
58d35f87 1673 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1674 return;
8f17154f 1675
d1726b6d
SJ		 1676 skb = skb_queue_next(&chan->tx_q, skb);
1677 }
8f17154f 1678
3ce3514f
MM		 1679 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1680 chan->remote_max_tx) {
8c1d787b 1681 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1682 return;
1683 }
1684
1685 tx_skb = skb_clone(skb, GFP_ATOMIC);
3ce3514f 1686 bt_cb(skb)->control.retries++;
88843ab0
AE		 1687
1688 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1689 control &= __get_sar_mask(chan);
3cb123d1 1690
e2ab4353 1691 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1692 control |= __set_ctrl_final(chan);
95ffa978 1693
0b209fae 1694 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1695 control |= __set_txseq(chan, tx_seq);
3cb123d1 1696
88843ab0 1697 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1698
47d1ec61 1699 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1700 fcs = crc16(0, (u8 *)tx_skb->data,
1701 tx_skb->len - L2CAP_FCS_SIZE);
1702 put_unaligned_le16(fcs,
1703 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1704 }
1705
4343478f 1706 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1707}
1708
67c9e840 1709static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1710{
1711 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1712 u16 fcs;
1713 u32 control;
9a9c6a34 1714 int nsent = 0;
1c2acffb 1715
89bc500e 1716 if (chan->state != BT_CONNECTED)
c13ffa62 1717 return -ENOTCONN;
e90bac06 1718
94122bbe
MM		 1719 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1720 return 0;
1721
58d35f87 1722 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1723
3ce3514f
MM		 1724 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1725 chan->remote_max_tx) {
8c1d787b 1726 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1727 break;
1728 }
1729
e420aba3
AE		 1730 tx_skb = skb_clone(skb, GFP_ATOMIC);
1731
3ce3514f 1732 bt_cb(skb)->control.retries++;
e90bac06 1733
88843ab0 1734 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1735 control &= __get_sar_mask(chan);
95ffa978 1736
e2ab4353 1737 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1738 control |= __set_ctrl_final(chan);
e2ab4353 1739
0b209fae 1740 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1741 control |= __set_txseq(chan, chan->next_tx_seq);
94122bbe 1742 control |= __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
1c2acffb 1743
88843ab0 1744 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1745
47d1ec61 1746 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1747 fcs = crc16(0, (u8 *)skb->data,
1748 tx_skb->len - L2CAP_FCS_SIZE);
1749 put_unaligned_le16(fcs, skb->data +
1750 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1751 }
1752
4343478f 1753 l2cap_do_send(chan, tx_skb);
9a9c6a34 1754
1a09bcb9 1755 __set_retrans_timer(chan);
1c2acffb 1756
3ce3514f 1757 bt_cb(skb)->control.txseq = chan->next_tx_seq;
836be934
AE		 1758
1759 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1760
3ce3514f 1761 if (bt_cb(skb)->control.retries == 1) {
6a026610 1762 chan->unacked_frames++;
930fa4ae
SJ		 1763
1764 if (!nsent++)
1765 __clear_ack_timer(chan);
8ed7a0ae 1766 }
23e9fde2 1767
6a026610 1768 chan->frames_sent++;
1c2acffb 1769
58d35f87
GP		 1770 if (skb_queue_is_last(&chan->tx_q, skb))
1771 chan->tx_send_head = NULL;
1c2acffb 1772 else
58d35f87 1773 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1c2acffb
GP		 1774 }
1775
9e917af1
GP		 1776 return nsent;
1777}
1778
525cd185 1779static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1780{
dfc909be
GP		 1781 int ret;
1782
58d35f87
GP		 1783 if (!skb_queue_empty(&chan->tx_q))
1784 chan->tx_send_head = chan->tx_q.next;
dfc909be 1785
42e5c802 1786 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1787 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1788 return ret;
1789}
1790
b17e73bb 1791static void __l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1792{
88843ab0 1793 u32 control = 0;
9e917af1 1794
0b209fae 1795 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1796
e2ab4353 1797 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1798 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1799 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1800 l2cap_send_sframe(chan, control);
9a9c6a34 1801 return;
9e917af1 1802 }
dfc909be 1803
525cd185 1804 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1805 return;
1806
ab784b73 1807 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1808 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1809}
1810
b17e73bb
SJ		 1811static void l2cap_send_ack(struct l2cap_chan *chan)
1812{
1813 __clear_ack_timer(chan);
1814 __l2cap_send_ack(chan);
1815}
1816
525cd185 1817static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1818{
1819 struct srej_list *tail;
88843ab0 1820 u32 control;
99b0d4b7 1821
ab784b73 1822 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1823 control |= __set_ctrl_final(chan);
99b0d4b7 1824
39d5a3ee 1825 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1826 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1827
525cd185 1828 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1829}
1830
04124681
GP		 1831static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1832 struct msghdr *msg, int len,
1833 int count, struct sk_buff *skb)
1c2acffb 1834{
0952a57a 1835 struct l2cap_conn *conn = chan->conn;
1c2acffb 1836 struct sk_buff **frag;
90338947 1837 int sent = 0;
1da177e4 1838
59203a21 1839 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1840 return -EFAULT;
1da177e4
LT		 1841
1842 sent += count;
1843 len -= count;
1844
1845 /* Continuation fragments (no L2CAP header) */
1846 frag = &skb_shinfo(skb)->frag_list;
1847 while (len) {
fbe00700
GP		 1848 struct sk_buff *tmp;
1849
1da177e4
LT		 1850 count = min_t(unsigned int, conn->mtu, len);
1851
fbe00700
GP		 1852 tmp = chan->ops->alloc_skb(chan, count,
1853 msg->msg_flags & MSG_DONTWAIT);
1854 if (IS_ERR(tmp))
1855 return PTR_ERR(tmp);
1856
1857 *frag = tmp;
2f7719ce 1858
1c2acffb
GP		 1859 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1860 return -EFAULT;
1da177e4 1861
5e59b791
LAD		 1862 (*frag)->priority = skb->priority;
1863
1da177e4
LT		 1864 sent += count;
1865 len -= count;
1866
2d0ed3d5
GP		 1867 skb->len += (*frag)->len;
1868 skb->data_len += (*frag)->len;
1869
1da177e4
LT		 1870 frag = &(*frag)->next;
1871 }
1da177e4
LT		 1872
1873 return sent;
1c2acffb 1874}
1da177e4 1875
5e59b791
LAD		 1876static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1877 struct msghdr *msg, size_t len,
1878 u32 priority)
1c2acffb 1879{
8c1d787b 1880 struct l2cap_conn *conn = chan->conn;
1c2acffb 1881 struct sk_buff *skb;
03a51213 1882 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1883 struct l2cap_hdr *lh;
1884
6d5922b0 1885 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1886
1887 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1888
1889 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1890 msg->msg_flags & MSG_DONTWAIT);
1891 if (IS_ERR(skb))
1892 return skb;
1c2acffb 1893
5e59b791
LAD		 1894 skb->priority = priority;
1895
1c2acffb
GP		 1896 /* Create L2CAP header */
1897 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1898 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 1899 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
1900 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 1901
0952a57a 1902 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1903 if (unlikely(err < 0)) {
1904 kfree_skb(skb);
1905 return ERR_PTR(err);
1906 }
1907 return skb;
1908}
1909
5e59b791
LAD		 1910static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1911 struct msghdr *msg, size_t len,
1912 u32 priority)
1c2acffb 1913{
8c1d787b 1914 struct l2cap_conn *conn = chan->conn;
1c2acffb 1915 struct sk_buff *skb;
f2ba7fae 1916 int err, count;
1c2acffb
GP		 1917 struct l2cap_hdr *lh;
1918
6d5922b0 1919 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1920
f2ba7fae 1921 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 1922
f2ba7fae 1923 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 1924 msg->msg_flags & MSG_DONTWAIT);
1925 if (IS_ERR(skb))
1926 return skb;
1c2acffb 1927
5e59b791
LAD		 1928 skb->priority = priority;
1929
1c2acffb
GP		 1930 /* Create L2CAP header */
1931 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1932 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 1933 lh->len = cpu_to_le16(len);
1c2acffb 1934
0952a57a 1935 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1936 if (unlikely(err < 0)) {
1937 kfree_skb(skb);
1938 return ERR_PTR(err);
1939 }
1940 return skb;
1941}
1942
ab0ff76d
LAD		 1943static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1944 struct msghdr *msg, size_t len,
94122bbe 1945 u16 sdulen)
1c2acffb 1946{
8c1d787b 1947 struct l2cap_conn *conn = chan->conn;
1c2acffb 1948 struct sk_buff *skb;
e4ca6d98 1949 int err, count, hlen;
1c2acffb
GP		 1950 struct l2cap_hdr *lh;
1951
6d5922b0 1952 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1953
0ee0d208
GP		 1954 if (!conn)
1955 return ERR_PTR(-ENOTCONN);
1956
e4ca6d98
AE		 1957 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1958 hlen = L2CAP_EXT_HDR_SIZE;
1959 else
1960 hlen = L2CAP_ENH_HDR_SIZE;
1961
c74e560c 1962 if (sdulen)
03a51213 1963 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1964
47d1ec61 1965 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1966 hlen += L2CAP_FCS_SIZE;
fcc203c3 1967
1c2acffb 1968 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1969
1970 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1971 msg->msg_flags & MSG_DONTWAIT);
1972 if (IS_ERR(skb))
1973 return skb;
1c2acffb
GP		 1974
1975 /* Create L2CAP header */
1976 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1977 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1978 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 1979
94122bbe 1980 __put_control(chan, 0, skb_put(skb, __ctrl_size(chan)));
88843ab0 1981
c74e560c 1982 if (sdulen)
03a51213 1983 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 1984
0952a57a 1985 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1986 if (unlikely(err < 0)) {
1987 kfree_skb(skb);
1988 return ERR_PTR(err);
1989 }
e90bac06 1990
47d1ec61 1991 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1992 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1993
3ce3514f 1994 bt_cb(skb)->control.retries = 0;
1c2acffb 1995 return skb;
1da177e4
LT		 1996}
1997
94122bbe
MM		 1998static int l2cap_segment_sdu(struct l2cap_chan *chan,
1999 struct sk_buff_head *seg_queue,
2000 struct msghdr *msg, size_t len)
c74e560c 2001{
c74e560c 2002 struct sk_buff *skb;
94122bbe
MM		 2003 u16 sdu_len;
2004 size_t pdu_len;
2005 int err = 0;
2006 u8 sar;
c74e560c 2007
94122bbe 2008 BT_DBG("chan %p, msg %p, len %d", chan, msg, (int)len);
c74e560c 2009
94122bbe
MM		 2010 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2011 * so fragmented skbs are not used. The HCI layer's handling
2012 * of fragmented skbs is not compatible with ERTM's queueing.
2013 */
c74e560c 2014
94122bbe
MM		 2015 /* PDU size is derived from the HCI MTU */
2016 pdu_len = chan->conn->mtu;
c74e560c 2017
94122bbe
MM		 2018 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2019
2020 /* Adjust for largest possible L2CAP overhead. */
2021 pdu_len -= L2CAP_EXT_HDR_SIZE + L2CAP_FCS_SIZE;
2022
2023 /* Remote device may have requested smaller PDUs */
2024 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2025
2026 if (len <= pdu_len) {
2027 sar = L2CAP_SAR_UNSEGMENTED;
2028 sdu_len = 0;
2029 pdu_len = len;
2030 } else {
2031 sar = L2CAP_SAR_START;
2032 sdu_len = len;
2033 pdu_len -= L2CAP_SDULEN_SIZE;
2034 }
2035
2036 while (len > 0) {
2037 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2038
c74e560c 2039 if (IS_ERR(skb)) {
94122bbe 2040 __skb_queue_purge(seg_queue);
c74e560c
GP		 2041 return PTR_ERR(skb);
2042 }
2043
94122bbe
MM		 2044 bt_cb(skb)->control.sar = sar;
2045 __skb_queue_tail(seg_queue, skb);
2046
2047 len -= pdu_len;
2048 if (sdu_len) {
2049 sdu_len = 0;
2050 pdu_len += L2CAP_SDULEN_SIZE;
2051 }
2052
2053 if (len <= pdu_len) {
2054 sar = L2CAP_SAR_END;
2055 pdu_len = len;
2056 } else {
2057 sar = L2CAP_SAR_CONTINUE;
2058 }
c74e560c 2059 }
c74e560c 2060
94122bbe 2061 return err;
c74e560c
GP		 2062}
2063
5e59b791
LAD		 2064int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2065 u32 priority)
9a91a04a 2066{
9a91a04a 2067 struct sk_buff *skb;
9a91a04a 2068 int err;
94122bbe 2069 struct sk_buff_head seg_queue;
9a91a04a
GP		 2070
2071 /* Connectionless channel */
715ec005 2072 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2073 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2074 if (IS_ERR(skb))
2075 return PTR_ERR(skb);
2076
2077 l2cap_do_send(chan, skb);
2078 return len;
2079 }
2080
2081 switch (chan->mode) {
2082 case L2CAP_MODE_BASIC:
2083 /* Check outgoing MTU */
2084 if (len > chan->omtu)
2085 return -EMSGSIZE;
2086
2087 /* Create a basic PDU */
5e59b791 2088 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2089 if (IS_ERR(skb))
2090 return PTR_ERR(skb);
2091
2092 l2cap_do_send(chan, skb);
2093 err = len;
2094 break;
2095
2096 case L2CAP_MODE_ERTM:
2097 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2098 /* Check outgoing MTU */
2099 if (len > chan->omtu) {
2100 err = -EMSGSIZE;
2101 break;
2102 }
9a91a04a 2103
94122bbe 2104 __skb_queue_head_init(&seg_queue);
9a91a04a 2105
94122bbe
MM		 2106 /* Do segmentation before calling in to the state machine,
2107 * since it's possible to block while waiting for memory
2108 * allocation.
2109 */
2110 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2111
94122bbe
MM		 2112 /* The channel could have been closed while segmenting,
2113 * check that it is still connected.
2114 */
2115 if (chan->state != BT_CONNECTED) {
2116 __skb_queue_purge(&seg_queue);
2117 err = -ENOTCONN;
9a91a04a
GP		 2118 }
2119
94122bbe 2120 if (err)
9a91a04a 2121 break;
9a91a04a 2122
577cfaeb
MM		 2123 if (chan->mode == L2CAP_MODE_ERTM && chan->tx_send_head == NULL)
2124 chan->tx_send_head = seg_queue.next;
94122bbe 2125 skb_queue_splice_tail_init(&seg_queue, &chan->tx_q);
577cfaeb 2126
94122bbe
MM		 2127 if (chan->mode == L2CAP_MODE_ERTM)
2128 err = l2cap_ertm_send(chan);
2129 else
2130 l2cap_streaming_send(chan);
9a91a04a 2131
9a91a04a
GP		 2132 if (err >= 0)
2133 err = len;
2134
94122bbe
MM		 2135 /* If the skbs were not queued for sending, they'll still be in
2136 * seg_queue and need to be purged.
2137 */
2138 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2139 break;
2140
2141 default:
2142 BT_DBG("bad state %1.1x", chan->mode);
2143 err = -EBADFD;
2144 }
2145
2146 return err;
2147}
2148
1da177e4
LT		 2149/* Copy frame to all raw sockets on that connection */
2150static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2151{
1da177e4 2152 struct sk_buff *nskb;
48454079 2153 struct l2cap_chan *chan;
1da177e4
LT		 2154
2155 BT_DBG("conn %p", conn);
2156
3df91ea2 2157 mutex_lock(&conn->chan_lock);
3d57dc68 2158
3df91ea2 2159 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2160 struct sock *sk = chan->sk;
715ec005 2161 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2162 continue;
2163
2164 /* Don't send frame to the socket it came from */
2165 if (skb->sk == sk)
2166 continue;
af05b30b
GP		 2167 nskb = skb_clone(skb, GFP_ATOMIC);
2168 if (!nskb)
1da177e4
LT		 2169 continue;
2170
23070494 2171 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 2172 kfree_skb(nskb);
2173 }
3d57dc68 2174
3df91ea2 2175 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2176}
2177
2178/* ---- L2CAP signalling commands ---- */
2179static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2180 u8 code, u8 ident, u16 dlen, void *data)
2181{
2182 struct sk_buff *skb, **frag;
2183 struct l2cap_cmd_hdr *cmd;
2184 struct l2cap_hdr *lh;
2185 int len, count;
2186
af05b30b
GP		 2187 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2188 conn, code, ident, dlen);
1da177e4
LT		 2189
2190 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2191 count = min_t(unsigned int, conn->mtu, len);
2192
2193 skb = bt_skb_alloc(count, GFP_ATOMIC);
2194 if (!skb)
2195 return NULL;
2196
2197 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2198 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2199
2200 if (conn->hcon->type == LE_LINK)
2201 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2202 else
2203 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2204
2205 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2206 cmd->code = code;
2207 cmd->ident = ident;
aca3192c 2208 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2209
2210 if (dlen) {
2211 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2212 memcpy(skb_put(skb, count), data, count);
2213 data += count;
2214 }
2215
2216 len -= skb->len;
2217
2218 /* Continuation fragments (no L2CAP header) */
2219 frag = &skb_shinfo(skb)->frag_list;
2220 while (len) {
2221 count = min_t(unsigned int, conn->mtu, len);
2222
2223 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2224 if (!*frag)
2225 goto fail;
2226
2227 memcpy(skb_put(*frag, count), data, count);
2228
2229 len -= count;
2230 data += count;
2231
2232 frag = &(*frag)->next;
2233 }
2234
2235 return skb;
2236
2237fail:
2238 kfree_skb(skb);
2239 return NULL;
2240}
2241
2242static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2243{
2244 struct l2cap_conf_opt *opt = *ptr;
2245 int len;
2246
2247 len = L2CAP_CONF_OPT_SIZE + opt->len;
2248 *ptr += len;
2249
2250 *type = opt->type;
2251 *olen = opt->len;
2252
2253 switch (opt->len) {
2254 case 1:
2255 *val = *((u8 *) opt->val);
2256 break;
2257
2258 case 2:
bfaaeb3e 2259 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2260 break;
2261
2262 case 4:
bfaaeb3e 2263 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2264 break;
2265
2266 default:
2267 *val = (unsigned long) opt->val;
2268 break;
2269 }
2270
2271 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2272 return len;
2273}
2274
1da177e4
LT		 2275static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2276{
2277 struct l2cap_conf_opt *opt = *ptr;
2278
2279 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2280
2281 opt->type = type;
2282 opt->len = len;
2283
2284 switch (len) {
2285 case 1:
2286 *((u8 *) opt->val) = val;
2287 break;
2288
2289 case 2:
4f8b691c 2290 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2291 break;
2292
2293 case 4:
4f8b691c 2294 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2295 break;
2296
2297 default:
2298 memcpy(opt->val, (void *) val, len);
2299 break;
2300 }
2301
2302 *ptr += L2CAP_CONF_OPT_SIZE + len;
2303}
2304
f89cef09
AE		 2305static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2306{
2307 struct l2cap_conf_efs efs;
2308
1ec918ce 2309 switch (chan->mode) {
f89cef09
AE		 2310 case L2CAP_MODE_ERTM:
2311 efs.id = chan->local_id;
2312 efs.stype = chan->local_stype;
2313 efs.msdu = cpu_to_le16(chan->local_msdu);
2314 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2315 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2316 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2317 break;
2318
2319 case L2CAP_MODE_STREAMING:
2320 efs.id = 1;
2321 efs.stype = L2CAP_SERV_BESTEFFORT;
2322 efs.msdu = cpu_to_le16(chan->local_msdu);
2323 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2324 efs.acc_lat = 0;
2325 efs.flush_to = 0;
2326 break;
2327
2328 default:
2329 return;
2330 }
2331
2332 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2333 (unsigned long) &efs);
2334}
2335
721c4181 2336static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2337{
721c4181
GP		 2338 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2339 ack_timer.work);
c1b4f43b 2340
2fb9b3d4
GP		 2341 BT_DBG("chan %p", chan);
2342
6be36555
AE		 2343 l2cap_chan_lock(chan);
2344
b17e73bb 2345 __l2cap_send_ack(chan);
6be36555
AE		 2346
2347 l2cap_chan_unlock(chan);
09bfb2ee
SJ		 2348
2349 l2cap_chan_put(chan);
c1b4f43b
GP		 2350}
2351
3c588192 2352static inline int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2353{
3c588192
MM		 2354 int err;
2355
105bdf9e
MM		 2356 chan->next_tx_seq = 0;
2357 chan->expected_tx_seq = 0;
42e5c802 2358 chan->expected_ack_seq = 0;
6a026610 2359 chan->unacked_frames = 0;
42e5c802 2360 chan->buffer_seq = 0;
6a026610
GP		 2361 chan->num_acked = 0;
2362 chan->frames_sent = 0;
105bdf9e
MM		 2363 chan->last_acked_seq = 0;
2364 chan->sdu = NULL;
2365 chan->sdu_last_frag = NULL;
2366 chan->sdu_len = 0;
2367
d34c34fb
MM		 2368 skb_queue_head_init(&chan->tx_q);
2369
105bdf9e
MM		 2370 if (chan->mode != L2CAP_MODE_ERTM)
2371 return 0;
2372
2373 chan->rx_state = L2CAP_RX_STATE_RECV;
2374 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2375
721c4181
GP		 2376 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2377 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2378 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2379
f1c6775b 2380 skb_queue_head_init(&chan->srej_q);
1890d36b 2381
39d5a3ee 2382 INIT_LIST_HEAD(&chan->srej_l);
3c588192
MM		 2383 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2384 if (err < 0)
2385 return err;
2386
9dc9affc
MM		 2387 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
2388 if (err < 0)
2389 l2cap_seq_list_free(&chan->srej_list);
2390
2391 return err;
0565c1c2
GP		 2392}
2393
f2fcfcd6
GP		 2394static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2395{
2396 switch (mode) {
2397 case L2CAP_MODE_STREAMING:
2398 case L2CAP_MODE_ERTM:
2399 if (l2cap_mode_supported(mode, remote_feat_mask))
2400 return mode;
2401 /* fall through */
2402 default:
2403 return L2CAP_MODE_BASIC;
2404 }
2405}
2406
6327eb98
AE		 2407static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2408{
2409 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2410}
2411
f89cef09
AE		 2412static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2413{
2414 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2415}
2416
6327eb98
AE		 2417static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2418{
2419 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2420 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2421 /* use extended control field */
2422 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2423 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2424 } else {
6327eb98
AE		 2425 chan->tx_win = min_t(u16, chan->tx_win,
2426 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2427 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2428 }
6327eb98
AE		 2429}
2430
710f9b0a 2431static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2432{
1da177e4 2433 struct l2cap_conf_req *req = data;
0c1bc5c6 2434 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2435 void *ptr = req->data;
c8f79162 2436 u16 size;
1da177e4 2437
49208c9c 2438 BT_DBG("chan %p", chan);
1da177e4 2439
73ffa904 2440 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2441 goto done;
2442
0c1bc5c6 2443 switch (chan->mode) {
f2fcfcd6
GP		 2444 case L2CAP_MODE_STREAMING:
2445 case L2CAP_MODE_ERTM:
c1360a1c 2446 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2447 break;
85eb53c6 2448
f89cef09
AE		 2449 if (__l2cap_efs_supported(chan))
2450 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2451
2ba13ed6 2452 /* fall through */
f2fcfcd6 2453 default:
8c1d787b 2454 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2455 break;
2456 }
2457
2458done:
0c1bc5c6
GP		 2459 if (chan->imtu != L2CAP_DEFAULT_MTU)
2460 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2461
0c1bc5c6 2462 switch (chan->mode) {
65c7c491 2463 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2464 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2465 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2466 break;
2467
62547752
GP		 2468 rfc.mode = L2CAP_MODE_BASIC;
2469 rfc.txwin_size = 0;
2470 rfc.max_transmit = 0;
2471 rfc.retrans_timeout = 0;
2472 rfc.monitor_timeout = 0;
2473 rfc.max_pdu_size = 0;
2474
63406504
GP		 2475 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2476 (unsigned long) &rfc);
65c7c491
MH		 2477 break;
2478
2479 case L2CAP_MODE_ERTM:
2480 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2481 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2482 rfc.retrans_timeout = 0;
2483 rfc.monitor_timeout = 0;
c8f79162
AE		 2484
2485 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2486 L2CAP_EXT_HDR_SIZE -
2487 L2CAP_SDULEN_SIZE -
2488 L2CAP_FCS_SIZE);
2489 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2490
6327eb98
AE		 2491 l2cap_txwin_setup(chan);
2492
2493 rfc.txwin_size = min_t(u16, chan->tx_win,
2494 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2495
63406504
GP		 2496 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2497 (unsigned long) &rfc);
2498
f89cef09
AE		 2499 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2500 l2cap_add_opt_efs(&ptr, chan);
2501
8c1d787b 2502 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2503 break;
2504
47d1ec61 2505 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2506 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2507 chan->fcs = L2CAP_FCS_NONE;
2508 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2509 }
6327eb98
AE		 2510
2511 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2512 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2513 chan->tx_win);
f2fcfcd6
GP		 2514 break;
2515
2516 case L2CAP_MODE_STREAMING:
2517 rfc.mode = L2CAP_MODE_STREAMING;
2518 rfc.txwin_size = 0;
2519 rfc.max_transmit = 0;
2520 rfc.retrans_timeout = 0;
2521 rfc.monitor_timeout = 0;
c8f79162
AE		 2522
2523 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2524 L2CAP_EXT_HDR_SIZE -
2525 L2CAP_SDULEN_SIZE -
2526 L2CAP_FCS_SIZE);
2527 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2528
63406504
GP		 2529 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2530 (unsigned long) &rfc);
2531
f89cef09
AE		 2532 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2533 l2cap_add_opt_efs(&ptr, chan);
2534
8c1d787b 2535 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2536 break;
2537
47d1ec61 2538 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2539 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2540 chan->fcs = L2CAP_FCS_NONE;
2541 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2542 }
65c7c491
MH		 2543 break;
2544 }
1da177e4 2545
fe4128e0 2546 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2547 req->flags = cpu_to_le16(0);
1da177e4
LT		 2548
2549 return ptr - data;
2550}
2551
73ffa904 2552static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2553{
5dee9e7c
MH		 2554 struct l2cap_conf_rsp *rsp = data;
2555 void *ptr = rsp->data;
73ffa904
GP		 2556 void *req = chan->conf_req;
2557 int len = chan->conf_len;
5dee9e7c
MH		 2558 int type, hint, olen;
2559 unsigned long val;
6464f35f 2560 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2561 struct l2cap_conf_efs efs;
2562 u8 remote_efs = 0;
861d6882 2563 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2564 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2565 u16 size;
1da177e4 2566
73ffa904 2567 BT_DBG("chan %p", chan);
820ae1b8 2568
5dee9e7c
MH		 2569 while (len >= L2CAP_CONF_OPT_SIZE) {
2570 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2571
589d2746 2572 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2573 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2574
2575 switch (type) {
2576 case L2CAP_CONF_MTU:
861d6882 2577 mtu = val;
5dee9e7c
MH		 2578 break;
2579
2580 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2581 chan->flush_to = val;
5dee9e7c
MH		 2582 break;
2583
2584 case L2CAP_CONF_QOS:
2585 break;
2586
6464f35f
MH		 2587 case L2CAP_CONF_RFC:
2588 if (olen == sizeof(rfc))
2589 memcpy(&rfc, (void *) val, olen);
2590 break;
2591
fcc203c3
GP		 2592 case L2CAP_CONF_FCS:
2593 if (val == L2CAP_FCS_NONE)
c1360a1c 2594 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2595 break;
fcc203c3 2596
42dceae2
AE		 2597 case L2CAP_CONF_EFS:
2598 remote_efs = 1;
2599 if (olen == sizeof(efs))
2600 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2601 break;
2602
6327eb98
AE		 2603 case L2CAP_CONF_EWS:
2604 if (!enable_hs)
2605 return -ECONNREFUSED;
fcc203c3 2606
6327eb98
AE		 2607 set_bit(FLAG_EXT_CTRL, &chan->flags);
2608 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2609 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2610 chan->remote_tx_win = val;
fcc203c3
GP		 2611 break;
2612
5dee9e7c
MH		 2613 default:
2614 if (hint)
2615 break;
2616
2617 result = L2CAP_CONF_UNKNOWN;
2618 *((u8 *) ptr++) = type;
2619 break;
2620 }
2621 }
2622
73ffa904 2623 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2624 goto done;
2625
0c1bc5c6 2626 switch (chan->mode) {
f2fcfcd6
GP		 2627 case L2CAP_MODE_STREAMING:
2628 case L2CAP_MODE_ERTM:
c1360a1c 2629 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2630 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2631 chan->conn->feat_mask);
85eb53c6
GP		 2632 break;
2633 }
2634
42dceae2
AE		 2635 if (remote_efs) {
2636 if (__l2cap_efs_supported(chan))
2637 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2638 else
2639 return -ECONNREFUSED;
2640 }
2641
0c1bc5c6 2642 if (chan->mode != rfc.mode)
f2fcfcd6 2643 return -ECONNREFUSED;
742e519b 2644
f2fcfcd6 2645 break;
f2fcfcd6
GP		 2646 }
2647
2648done:
0c1bc5c6 2649 if (chan->mode != rfc.mode) {
f2fcfcd6 2650 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2651 rfc.mode = chan->mode;
f2fcfcd6 2652
73ffa904 2653 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2654 return -ECONNREFUSED;
2655
2656 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2657 sizeof(rfc), (unsigned long) &rfc);
2658 }
2659
5dee9e7c
MH		 2660 if (result == L2CAP_CONF_SUCCESS) {
2661 /* Configure output options and let the other side know
2662 * which ones we don't like. */
2663
f2fcfcd6
GP		 2664 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2665 result = L2CAP_CONF_UNACCEPT;
2666 else {
0c1bc5c6 2667 chan->omtu = mtu;
c1360a1c 2668 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2669 }
0c1bc5c6 2670 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2671
42dceae2
AE		 2672 if (remote_efs) {
2673 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2674 efs.stype != L2CAP_SERV_NOTRAFIC &&
2675 efs.stype != chan->local_stype) {
2676
2677 result = L2CAP_CONF_UNACCEPT;
2678
2679 if (chan->num_conf_req >= 1)
2680 return -ECONNREFUSED;
2681
2682 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2683 sizeof(efs),
42dceae2 2684 (unsigned long) &efs);
0e8b207e 2685 } else {
3e6b3b95 2686 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2687 result = L2CAP_CONF_PENDING;
2688 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2689 }
2690 }
2691
f2fcfcd6
GP		 2692 switch (rfc.mode) {
2693 case L2CAP_MODE_BASIC:
47d1ec61 2694 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2695 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2696 break;
2697
2698 case L2CAP_MODE_ERTM:
6327eb98
AE		 2699 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2700 chan->remote_tx_win = rfc.txwin_size;
2701 else
2702 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2703
2c03a7a4 2704 chan->remote_max_tx = rfc.max_transmit;
1c762159 2705
c8f79162
AE		 2706 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2707 chan->conn->mtu -
2708 L2CAP_EXT_HDR_SIZE -
2709 L2CAP_SDULEN_SIZE -
2710 L2CAP_FCS_SIZE);
2711 rfc.max_pdu_size = cpu_to_le16(size);
2712 chan->remote_mps = size;
f2fcfcd6 2713
10467e9e 2714 rfc.retrans_timeout =
4fd21a88 2715 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 2716 rfc.monitor_timeout =
4fd21a88 2717 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2718
c1360a1c 2719 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2720
2721 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2722 sizeof(rfc), (unsigned long) &rfc);
2723
42dceae2
AE		 2724 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2725 chan->remote_id = efs.id;
2726 chan->remote_stype = efs.stype;
2727 chan->remote_msdu = le16_to_cpu(efs.msdu);
2728 chan->remote_flush_to =
2729 le32_to_cpu(efs.flush_to);
2730 chan->remote_acc_lat =
2731 le32_to_cpu(efs.acc_lat);
2732 chan->remote_sdu_itime =
2733 le32_to_cpu(efs.sdu_itime);
2734 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2735 sizeof(efs), (unsigned long) &efs);
2736 }
f2fcfcd6
GP		 2737 break;
2738
2739 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2740 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2741 chan->conn->mtu -
2742 L2CAP_EXT_HDR_SIZE -
2743 L2CAP_SDULEN_SIZE -
2744 L2CAP_FCS_SIZE);
2745 rfc.max_pdu_size = cpu_to_le16(size);
2746 chan->remote_mps = size;
f2fcfcd6 2747
c1360a1c 2748 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2749
2750 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2751 sizeof(rfc), (unsigned long) &rfc);
2752
f2fcfcd6
GP		 2753 break;
2754
2755 default:
5dee9e7c 2756 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2757
6464f35f 2758 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2759 rfc.mode = chan->mode;
f2fcfcd6 2760 }
6464f35f 2761
f2fcfcd6 2762 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2763 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2764 }
fe4128e0 2765 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2766 rsp->result = cpu_to_le16(result);
2767 rsp->flags = cpu_to_le16(0x0000);
2768
2769 return ptr - data;
1da177e4
LT		 2770}
2771
b4450035 2772static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2773{
f2fcfcd6
GP		 2774 struct l2cap_conf_req *req = data;
2775 void *ptr = req->data;
2776 int type, olen;
2777 unsigned long val;
36e999a8 2778 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 2779 struct l2cap_conf_efs efs;
f2fcfcd6 2780
fe4128e0 2781 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2782
2783 while (len >= L2CAP_CONF_OPT_SIZE) {
2784 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2785
2786 switch (type) {
2787 case L2CAP_CONF_MTU:
2788 if (val < L2CAP_DEFAULT_MIN_MTU) {
2789 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2790 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2791 } else
0c1bc5c6
GP		 2792 chan->imtu = val;
2793 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2794 break;
2795
2796 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2797 chan->flush_to = val;
f2fcfcd6 2798 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2799 2, chan->flush_to);
f2fcfcd6
GP		 2800 break;
2801
2802 case L2CAP_CONF_RFC:
2803 if (olen == sizeof(rfc))
2804 memcpy(&rfc, (void *)val, olen);
2805
c1360a1c 2806 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2807 rfc.mode != chan->mode)
f2fcfcd6
GP		 2808 return -ECONNREFUSED;
2809
47d1ec61 2810 chan->fcs = 0;
f2fcfcd6
GP		 2811
2812 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2813 sizeof(rfc), (unsigned long) &rfc);
2814 break;
6327eb98
AE		 2815
2816 case L2CAP_CONF_EWS:
2817 chan->tx_win = min_t(u16, val,
2818 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2819 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2820 chan->tx_win);
6327eb98 2821 break;
66af7aaf
AE		 2822
2823 case L2CAP_CONF_EFS:
2824 if (olen == sizeof(efs))
2825 memcpy(&efs, (void *)val, olen);
2826
2827 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2828 efs.stype != L2CAP_SERV_NOTRAFIC &&
2829 efs.stype != chan->local_stype)
2830 return -ECONNREFUSED;
2831
2832 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2833 sizeof(efs), (unsigned long) &efs);
2834 break;
f2fcfcd6
GP		 2835 }
2836 }
2837
0c1bc5c6 2838 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2839 return -ECONNREFUSED;
2840
0c1bc5c6 2841 chan->mode = rfc.mode;
6c2ea7a8 2842
0e8b207e 2843 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2844 switch (rfc.mode) {
2845 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2846 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2847 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2848 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2849
2850 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2851 chan->local_msdu = le16_to_cpu(efs.msdu);
2852 chan->local_sdu_itime =
2853 le32_to_cpu(efs.sdu_itime);
2854 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2855 chan->local_flush_to =
2856 le32_to_cpu(efs.flush_to);
2857 }
f2fcfcd6 2858 break;
66af7aaf 2859
f2fcfcd6 2860 case L2CAP_MODE_STREAMING:
47d1ec61 2861 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2862 }
2863 }
2864
fe4128e0 2865 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2866 req->flags = cpu_to_le16(0x0000);
2867
2868 return ptr - data;
2869}
2870
fe4128e0 2871static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2872{
2873 struct l2cap_conf_rsp *rsp = data;
2874 void *ptr = rsp->data;
1da177e4 2875
fe4128e0 2876 BT_DBG("chan %p", chan);
1da177e4 2877
fe4128e0 2878 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2879 rsp->result = cpu_to_le16(result);
aca3192c 2880 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2881
2882 return ptr - data;
2883}
2884
8c1d787b 2885void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2886{
2887 struct l2cap_conn_rsp rsp;
8c1d787b 2888 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2889 u8 buf[128];
2890
fe4128e0
GP		 2891 rsp.scid = cpu_to_le16(chan->dcid);
2892 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2893 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2894 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2895 l2cap_send_cmd(conn, chan->ident,
2896 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2897
c1360a1c 2898 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2899 return;
2900
710f9b0a
GP		 2901 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2902 l2cap_build_conf_req(chan, buf), buf);
2903 chan->num_conf_req++;
2904}
2905
47d1ec61 2906static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2907{
7b1c0049
GP		 2908 int type, olen;
2909 unsigned long val;
2910 struct l2cap_conf_rfc rfc;
2911
47d1ec61 2912 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2913
0c1bc5c6 2914 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2915 return;
2916
2917 while (len >= L2CAP_CONF_OPT_SIZE) {
2918 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2919
2920 switch (type) {
2921 case L2CAP_CONF_RFC:
2922 if (olen == sizeof(rfc))
2923 memcpy(&rfc, (void *)val, olen);
2924 goto done;
2925 }
2926 }
2927
36e999a8
MM		 2928 /* Use sane default values in case a misbehaving remote device
2929 * did not send an RFC option.
2930 */
2931 rfc.mode = chan->mode;
2932 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2933 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2934 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2935
2936 BT_ERR("Expected RFC option was not found, using defaults");
2937
7b1c0049
GP		 2938done:
2939 switch (rfc.mode) {
2940 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2941 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2942 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2943 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2944 break;
2945 case L2CAP_MODE_STREAMING:
47d1ec61 2946 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2947 }
2948}
2949
4e8402a3
MH		 2950static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2951{
e2fd318e 2952 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2953
e2fd318e 2954 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2955 return 0;
2956
2957 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2958 cmd->ident == conn->info_ident) {
17cd3f37 2959 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 2960
2961 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2962 conn->info_ident = 0;
984947dc 2963
4e8402a3
MH		 2964 l2cap_conn_start(conn);
2965 }
2966
2967 return 0;
2968}
2969
1da177e4
LT		 2970static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2971{
1da177e4
LT		 2972 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2973 struct l2cap_conn_rsp rsp;
23691d75 2974 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2975 struct sock *parent, *sk = NULL;
e7c29cb1 2976 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2977
2978 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2979 __le16 psm = req->psm;
1da177e4 2980
097db76c 2981 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 2982
2983 /* Check if we have socket listening on psm */
c2287681 2984 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 2985 if (!pchan) {
1da177e4
LT		 2986 result = L2CAP_CR_BAD_PSM;
2987 goto sendresp;
2988 }
2989
23691d75
GP		 2990 parent = pchan->sk;
2991
3df91ea2 2992 mutex_lock(&conn->chan_lock);
aa2ac881 2993 lock_sock(parent);
e0f0cb56 2994
e7c29cb1
MH		 2995 /* Check if the ACL is secure enough (if not SDP) */
2996 if (psm != cpu_to_le16(0x0001) &&
2997 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2998 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2999 result = L2CAP_CR_SEC_BLOCK;
3000 goto response;
3001 }
3002
1da177e4
LT		 3003 result = L2CAP_CR_NO_MEM;
3004
3005 /* Check for backlog size */
3006 if (sk_acceptq_is_full(parent)) {
8e87d142 3007 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 3008 goto response;
3009 }
3010
80808e43
GP		 3011 chan = pchan->ops->new_connection(pchan->data);
3012 if (!chan)
1da177e4
LT		 3013 goto response;
3014
80808e43
GP		 3015 sk = chan->sk;
3016
1da177e4 3017 /* Check if we already have channel with that dcid */
baa7e1fa 3018 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 3019 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 3020 chan->ops->close(chan->data);
1da177e4
LT		 3021 goto response;
3022 }
3023
3024 hci_conn_hold(conn->hcon);
3025
1da177e4
LT		 3026 bacpy(&bt_sk(sk)->src, conn->src);
3027 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3028 chan->psm = psm;
3029 chan->dcid = scid;
1da177e4 3030
d1010240
GP		 3031 bt_accept_enqueue(parent, sk);
3032
6be36555 3033 __l2cap_chan_add(conn, chan);
48454079 3034
fe4128e0 3035 dcid = chan->scid;
1da177e4 3036
c9b66675 3037 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3038
fc7f8a7e 3039 chan->ident = cmd->ident;
1da177e4 3040
984947dc 3041 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3042 if (l2cap_chan_check_security(chan)) {
c5daa683 3043 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
0e587be7 3044 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3045 result = L2CAP_CR_PEND;
3046 status = L2CAP_CS_AUTHOR_PEND;
3047 parent->sk_data_ready(parent, 0);
3048 } else {
0e587be7 3049 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 3050 result = L2CAP_CR_SUCCESS;
3051 status = L2CAP_CS_NO_INFO;
3052 }
79d554a6 3053 } else {
0e587be7 3054 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3055 result = L2CAP_CR_PEND;
3056 status = L2CAP_CS_AUTHEN_PEND;
3057 }
3058 } else {
0e587be7 3059 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3060 result = L2CAP_CR_PEND;
3061 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3062 }
3063
1da177e4 3064response:
aa2ac881 3065 release_sock(parent);
3df91ea2 3066 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3067
3068sendresp:
aca3192c
YH		 3069 rsp.scid = cpu_to_le16(scid);
3070 rsp.dcid = cpu_to_le16(dcid);
3071 rsp.result = cpu_to_le16(result);
3072 rsp.status = cpu_to_le16(status);
1da177e4 3073 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 3074
3075 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3076 struct l2cap_info_req info;
3077 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3078
3079 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3080 conn->info_ident = l2cap_get_ident(conn);
3081
ba13ccd9 3082 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 3083
3084 l2cap_send_cmd(conn, conn->info_ident,
3085 L2CAP_INFO_REQ, sizeof(info), &info);
3086 }
3087
c1360a1c 3088 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 3089 result == L2CAP_CR_SUCCESS) {
3090 u8 buf[128];
c1360a1c 3091 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3092 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3093 l2cap_build_conf_req(chan, buf), buf);
3094 chan->num_conf_req++;
e9aeb2dd
GP		 3095 }
3096
1da177e4
LT		 3097 return 0;
3098}
3099
3100static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3101{
3102 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3103 u16 scid, dcid, result, status;
48454079 3104 struct l2cap_chan *chan;
1da177e4 3105 u8 req[128];
3df91ea2 3106 int err;
1da177e4
LT		 3107
3108 scid = __le16_to_cpu(rsp->scid);
3109 dcid = __le16_to_cpu(rsp->dcid);
3110 result = __le16_to_cpu(rsp->result);
3111 status = __le16_to_cpu(rsp->status);
3112
1b009c98
AE		 3113 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3114 dcid, scid, result, status);
1da177e4 3115
3df91ea2
AE		 3116 mutex_lock(&conn->chan_lock);
3117
1da177e4 3118 if (scid) {
3df91ea2
AE		 3119 chan = __l2cap_get_chan_by_scid(conn, scid);
3120 if (!chan) {
3121 err = -EFAULT;
3122 goto unlock;
3123 }
1da177e4 3124 } else {
3df91ea2
AE		 3125 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3126 if (!chan) {
3127 err = -EFAULT;
3128 goto unlock;
3129 }
1da177e4
LT		 3130 }
3131
3df91ea2
AE		 3132 err = 0;
3133
6be36555 3134 l2cap_chan_lock(chan);
48454079 3135
1da177e4
LT		 3136 switch (result) {
3137 case L2CAP_CR_SUCCESS:
89bc500e 3138 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3139 chan->ident = 0;
fe4128e0 3140 chan->dcid = dcid;
c1360a1c 3141 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3142
c1360a1c 3143 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3144 break;
3145
1da177e4 3146 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3147 l2cap_build_conf_req(chan, req), req);
3148 chan->num_conf_req++;
1da177e4
LT		 3149 break;
3150
3151 case L2CAP_CR_PEND:
c1360a1c 3152 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3153 break;
3154
3155 default:
48454079 3156 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3157 break;
3158 }
3159
6be36555 3160 l2cap_chan_unlock(chan);
3df91ea2
AE		 3161
3162unlock:
3163 mutex_unlock(&conn->chan_lock);
3164
3165 return err;
1da177e4
LT		 3166}
3167
47d1ec61 3168static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3169{
3170 /* FCS is enabled only in ERTM or streaming mode, if one or both
3171 * sides request it.
3172 */
0c1bc5c6 3173 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3174 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3175 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3176 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3177}
3178
88219a0f 3179static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3180{
3181 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3182 u16 dcid, flags;
3183 u8 rsp[64];
48454079 3184 struct l2cap_chan *chan;
3c588192 3185 int len, err = 0;
1da177e4
LT		 3186
3187 dcid = __le16_to_cpu(req->dcid);
3188 flags = __le16_to_cpu(req->flags);
3189
3190 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3191
baa7e1fa 3192 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3193 if (!chan)
1da177e4
LT		 3194 return -ENOENT;
3195
033b1142 3196 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3197 struct l2cap_cmd_rej_cid rej;
3198
3199 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3200 rej.scid = cpu_to_le16(chan->scid);
3201 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3202
df6bd743
GP		 3203 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3204 sizeof(rej), &rej);
354f60a9 3205 goto unlock;
df6bd743 3206 }
354f60a9 3207
5dee9e7c 3208 /* Reject if config buffer is too small. */
88219a0f 3209 len = cmd_len - sizeof(*req);
7ac28817 3210 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3211 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3212 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 3213 L2CAP_CONF_REJECT, flags), rsp);
3214 goto unlock;
3215 }
3216
3217 /* Store config. */
73ffa904
GP		 3218 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3219 chan->conf_len += len;
1da177e4
LT		 3220
3221 if (flags & 0x0001) {
3222 /* Incomplete config. Send empty response. */
3223 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3224 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 3225 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 3226 goto unlock;
3227 }
3228
3229 /* Complete config. */
73ffa904 3230 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3231 if (len < 0) {
e92c8e70 3232 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3233 goto unlock;
f2fcfcd6 3234 }
1da177e4 3235
5dee9e7c 3236 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3237 chan->num_conf_rsp++;
5dee9e7c 3238
5dee9e7c 3239 /* Reset config buffer. */
73ffa904 3240 chan->conf_len = 0;
5dee9e7c 3241
c1360a1c 3242 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3243 goto unlock;
3244
c1360a1c 3245 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3246 set_default_fcs(chan);
fcc203c3 3247
89bc500e 3248 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 3249
105bdf9e
MM		 3250 if (chan->mode == L2CAP_MODE_ERTM ||
3251 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3252 err = l2cap_ertm_init(chan);
3253
3254 if (err < 0)
3255 l2cap_send_disconn_req(chan->conn, chan, -err);
3256 else
3257 l2cap_chan_ready(chan);
0565c1c2 3258
876d9484
MH		 3259 goto unlock;
3260 }
3261
c1360a1c 3262 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3263 u8 buf[64];
1da177e4 3264 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3265 l2cap_build_conf_req(chan, buf), buf);
3266 chan->num_conf_req++;
1da177e4
LT		 3267 }
3268
0e8b207e
AE		 3269 /* Got Conf Rsp PENDING from remote side and asume we sent
3270 Conf Rsp PENDING in the code above */
3271 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3272 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3273
3274 /* check compatibility */
3275
3276 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3277 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3278
3279 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3280 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 3281 L2CAP_CONF_SUCCESS, 0x0000), rsp);
3282 }
3283
1da177e4 3284unlock:
6be36555 3285 l2cap_chan_unlock(chan);
3c588192 3286 return err;
1da177e4
LT		 3287}
3288
3289static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3290{
3291 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3292 u16 scid, flags, result;
48454079 3293 struct l2cap_chan *chan;
61386cba 3294 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3295 int err = 0;
1da177e4
LT		 3296
3297 scid = __le16_to_cpu(rsp->scid);
3298 flags = __le16_to_cpu(rsp->flags);
3299 result = __le16_to_cpu(rsp->result);
3300
61386cba
AE		 3301 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3302 result, len);
1da177e4 3303
baa7e1fa 3304 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3305 if (!chan)
1da177e4
LT		 3306 return 0;
3307
3308 switch (result) {
3309 case L2CAP_CONF_SUCCESS:
47d1ec61 3310 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3311 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3312 break;
3313
0e8b207e
AE		 3314 case L2CAP_CONF_PENDING:
3315 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3316
3317 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3318 char buf[64];
3319
3320 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3321 buf, &result);
3322 if (len < 0) {
3323 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3324 goto done;
3325 }
3326
3327 /* check compatibility */
3328
3329 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3330 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3331
3332 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3333 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 3334 L2CAP_CONF_SUCCESS, 0x0000), buf);
3335 }
3336 goto done;
3337
1da177e4 3338 case L2CAP_CONF_UNACCEPT:
73ffa904 3339 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3340 char req[64];
3341
c2c77ec8 3342 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3343 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3344 goto done;
3345 }
3346
f2fcfcd6
GP		 3347 /* throw out any old stored conf requests */
3348 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3349 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3350 req, &result);
f2fcfcd6 3351 if (len < 0) {
e92c8e70 3352 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3353 goto done;
3354 }
3355
3356 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3357 L2CAP_CONF_REQ, len, req);
73ffa904 3358 chan->num_conf_req++;
f2fcfcd6
GP		 3359 if (result != L2CAP_CONF_SUCCESS)
3360 goto done;
3361 break;
1da177e4
LT		 3362 }
3363
8e87d142 3364 default:
6be36555 3365 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3366
ba13ccd9 3367 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3368 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3369 goto done;
3370 }
3371
3372 if (flags & 0x01)
3373 goto done;
3374
c1360a1c 3375 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3376
c1360a1c 3377 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3378 set_default_fcs(chan);
fcc203c3 3379
89bc500e 3380 l2cap_state_change(chan, BT_CONNECTED);
105bdf9e
MM		 3381 if (chan->mode == L2CAP_MODE_ERTM ||
3382 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3383 err = l2cap_ertm_init(chan);
0565c1c2 3384
3c588192
MM		 3385 if (err < 0)
3386 l2cap_send_disconn_req(chan->conn, chan, -err);
3387 else
3388 l2cap_chan_ready(chan);
1da177e4
LT		 3389 }
3390
3391done:
6be36555 3392 l2cap_chan_unlock(chan);
3c588192 3393 return err;
1da177e4
LT		 3394}
3395
3396static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3397{
3398 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3399 struct l2cap_disconn_rsp rsp;
3400 u16 dcid, scid;
48454079 3401 struct l2cap_chan *chan;
1da177e4
LT		 3402 struct sock *sk;
3403
3404 scid = __le16_to_cpu(req->scid);
3405 dcid = __le16_to_cpu(req->dcid);
3406
3407 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3408
3df91ea2
AE		 3409 mutex_lock(&conn->chan_lock);
3410
3411 chan = __l2cap_get_chan_by_scid(conn, dcid);
3412 if (!chan) {
3413 mutex_unlock(&conn->chan_lock);
1da177e4 3414 return 0;
3df91ea2 3415 }
1da177e4 3416
6be36555
AE		 3417 l2cap_chan_lock(chan);
3418
48454079
GP		 3419 sk = chan->sk;
3420
fe4128e0
GP		 3421 rsp.dcid = cpu_to_le16(chan->scid);
3422 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3423 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3424
6be36555 3425 lock_sock(sk);
1da177e4 3426 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3427 release_sock(sk);
1da177e4 3428
61d6ef3e 3429 l2cap_chan_hold(chan);
48454079 3430 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3431
3432 l2cap_chan_unlock(chan);
1da177e4 3433
ba3bd0ee 3434 chan->ops->close(chan->data);
61d6ef3e 3435 l2cap_chan_put(chan);
3df91ea2
AE		 3436
3437 mutex_unlock(&conn->chan_lock);
3438
1da177e4
LT		 3439 return 0;
3440}
3441
3442static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3443{
3444 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3445 u16 dcid, scid;
48454079 3446 struct l2cap_chan *chan;
1da177e4
LT		 3447
3448 scid = __le16_to_cpu(rsp->scid);
3449 dcid = __le16_to_cpu(rsp->dcid);
3450
3451 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3452
3df91ea2
AE		 3453 mutex_lock(&conn->chan_lock);
3454
3455 chan = __l2cap_get_chan_by_scid(conn, scid);
3456 if (!chan) {
3457 mutex_unlock(&conn->chan_lock);
1da177e4 3458 return 0;
3df91ea2 3459 }
1da177e4 3460
6be36555 3461 l2cap_chan_lock(chan);
48454079 3462
61d6ef3e 3463 l2cap_chan_hold(chan);
48454079 3464 l2cap_chan_del(chan, 0);
6be36555
AE		 3465
3466 l2cap_chan_unlock(chan);
1da177e4 3467
ba3bd0ee 3468 chan->ops->close(chan->data);
61d6ef3e 3469 l2cap_chan_put(chan);
3df91ea2
AE		 3470
3471 mutex_unlock(&conn->chan_lock);
3472
1da177e4
LT		 3473 return 0;
3474}
3475
3476static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3477{
3478 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3479 u16 type;
3480
3481 type = __le16_to_cpu(req->type);
3482
3483 BT_DBG("type 0x%4.4x", type);
3484
f0709e03
MH		 3485 if (type == L2CAP_IT_FEAT_MASK) {
3486 u8 buf[8];
44dd46de 3487 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3488 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3489 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3490 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3491 if (!disable_ertm)
fcc203c3
GP		 3492 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3493 | L2CAP_FEAT_FCS;
a5fd6f30 3494 if (enable_hs)
6327eb98
AE		 3495 feat_mask |= L2CAP_FEAT_EXT_FLOW
3496 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3497
1b7bf4ed 3498 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3499 l2cap_send_cmd(conn, cmd->ident,
3500 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3501 } else if (type == L2CAP_IT_FIXED_CHAN) {
3502 u8 buf[12];
3503 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3504
3505 if (enable_hs)
3506 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3507 else
3508 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3509
e1027a7c
MH		 3510 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3511 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3512 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3513 l2cap_send_cmd(conn, cmd->ident,
3514 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3515 } else {
3516 struct l2cap_info_rsp rsp;
3517 rsp.type = cpu_to_le16(type);
3518 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3519 l2cap_send_cmd(conn, cmd->ident,
3520 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3521 }
1da177e4
LT		 3522
3523 return 0;
3524}
3525
3526static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3527{
3528 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3529 u16 type, result;
3530
3531 type = __le16_to_cpu(rsp->type);
3532 result = __le16_to_cpu(rsp->result);
3533
3534 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3535
e90165be
AE		 3536 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3537 if (cmd->ident != conn->info_ident ||
3538 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3539 return 0;
3540
17cd3f37 3541 cancel_delayed_work(&conn->info_timer);
4e8402a3 3542
adb08ede
VT		 3543 if (result != L2CAP_IR_SUCCESS) {
3544 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3545 conn->info_ident = 0;
3546
3547 l2cap_conn_start(conn);
3548
3549 return 0;
3550 }
3551
978c93b9
AE		 3552 switch (type) {
3553 case L2CAP_IT_FEAT_MASK:
83985319 3554 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3555
47ec1dcd 3556 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3557 struct l2cap_info_req req;
3558 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3559
3560 conn->info_ident = l2cap_get_ident(conn);
3561
3562 l2cap_send_cmd(conn, conn->info_ident,
3563 L2CAP_INFO_REQ, sizeof(req), &req);
3564 } else {
3565 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3566 conn->info_ident = 0;
3567
3568 l2cap_conn_start(conn);
3569 }
978c93b9
AE		 3570 break;
3571
3572 case L2CAP_IT_FIXED_CHAN:
3573 conn->fixed_chan_mask = rsp->data[0];
984947dc 3574 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3575 conn->info_ident = 0;
984947dc
MH		 3576
3577 l2cap_conn_start(conn);
978c93b9 3578 break;
984947dc 3579 }
4e8402a3 3580
1da177e4
LT		 3581 return 0;
3582}
3583
f94ff6ff
MM		 3584static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3585 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3586 void *data)
3587{
3588 struct l2cap_create_chan_req *req = data;
3589 struct l2cap_create_chan_rsp rsp;
3590 u16 psm, scid;
3591
3592 if (cmd_len != sizeof(*req))
3593 return -EPROTO;
3594
3595 if (!enable_hs)
3596 return -EINVAL;
3597
3598 psm = le16_to_cpu(req->psm);
3599 scid = le16_to_cpu(req->scid);
3600
3601 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3602
3603 /* Placeholder: Always reject */
3604 rsp.dcid = 0;
3605 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 3606 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3607 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 3608
3609 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3610 sizeof(rsp), &rsp);
3611
3612 return 0;
3613}
3614
3615static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3616 struct l2cap_cmd_hdr *cmd, void *data)
3617{
3618 BT_DBG("conn %p", conn);
3619
3620 return l2cap_connect_rsp(conn, cmd, data);
3621}
3622
8d5a04a1
MM		 3623static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3624 u16 icid, u16 result)
3625{
3626 struct l2cap_move_chan_rsp rsp;
3627
3628 BT_DBG("icid %d, result %d", icid, result);
3629
3630 rsp.icid = cpu_to_le16(icid);
3631 rsp.result = cpu_to_le16(result);
3632
3633 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3634}
3635
3636static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3637 struct l2cap_chan *chan, u16 icid, u16 result)
3638{
3639 struct l2cap_move_chan_cfm cfm;
3640 u8 ident;
3641
3642 BT_DBG("icid %d, result %d", icid, result);
3643
3644 ident = l2cap_get_ident(conn);
3645 if (chan)
3646 chan->ident = ident;
3647
3648 cfm.icid = cpu_to_le16(icid);
3649 cfm.result = cpu_to_le16(result);
3650
3651 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3652}
3653
3654static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3655 u16 icid)
3656{
3657 struct l2cap_move_chan_cfm_rsp rsp;
3658
3659 BT_DBG("icid %d", icid);
3660
3661 rsp.icid = cpu_to_le16(icid);
3662 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3663}
3664
3665static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3666 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3667{
3668 struct l2cap_move_chan_req *req = data;
3669 u16 icid = 0;
3670 u16 result = L2CAP_MR_NOT_ALLOWED;
3671
3672 if (cmd_len != sizeof(*req))
3673 return -EPROTO;
3674
3675 icid = le16_to_cpu(req->icid);
3676
3677 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3678
3679 if (!enable_hs)
3680 return -EINVAL;
3681
3682 /* Placeholder: Always refuse */
3683 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3684
3685 return 0;
3686}
3687
3688static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3689 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3690{
3691 struct l2cap_move_chan_rsp *rsp = data;
3692 u16 icid, result;
3693
3694 if (cmd_len != sizeof(*rsp))
3695 return -EPROTO;
3696
3697 icid = le16_to_cpu(rsp->icid);
3698 result = le16_to_cpu(rsp->result);
3699
3700 BT_DBG("icid %d, result %d", icid, result);
3701
3702 /* Placeholder: Always unconfirmed */
3703 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3704
3705 return 0;
3706}
3707
3708static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3709 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3710{
3711 struct l2cap_move_chan_cfm *cfm = data;
3712 u16 icid, result;
3713
3714 if (cmd_len != sizeof(*cfm))
3715 return -EPROTO;
3716
3717 icid = le16_to_cpu(cfm->icid);
3718 result = le16_to_cpu(cfm->result);
3719
3720 BT_DBG("icid %d, result %d", icid, result);
3721
3722 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3723
3724 return 0;
3725}
3726
3727static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3728 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3729{
3730 struct l2cap_move_chan_cfm_rsp *rsp = data;
3731 u16 icid;
3732
3733 if (cmd_len != sizeof(*rsp))
3734 return -EPROTO;
3735
3736 icid = le16_to_cpu(rsp->icid);
3737
3738 BT_DBG("icid %d", icid);
3739
3740 return 0;
3741}
3742
e2174ca4 3743static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3744 u16 to_multiplier)
3745{
3746 u16 max_latency;
3747
3748 if (min > max || min < 6 || max > 3200)
3749 return -EINVAL;
3750
3751 if (to_multiplier < 10 || to_multiplier > 3200)
3752 return -EINVAL;
3753
3754 if (max >= to_multiplier * 8)
3755 return -EINVAL;
3756
3757 max_latency = (to_multiplier * 8 / max) - 1;
3758 if (latency > 499 || latency > max_latency)
3759 return -EINVAL;
3760
3761 return 0;
3762}
3763
3764static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3765 struct l2cap_cmd_hdr *cmd, u8 *data)
3766{
3767 struct hci_conn *hcon = conn->hcon;
3768 struct l2cap_conn_param_update_req *req;
3769 struct l2cap_conn_param_update_rsp rsp;
3770 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3771 int err;
de73115a
CT		 3772
3773 if (!(hcon->link_mode & HCI_LM_MASTER))
3774 return -EINVAL;
3775
3776 cmd_len = __le16_to_cpu(cmd->len);
3777 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3778 return -EPROTO;
3779
3780 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3781 min = __le16_to_cpu(req->min);
3782 max = __le16_to_cpu(req->max);
de73115a
CT		 3783 latency = __le16_to_cpu(req->latency);
3784 to_multiplier = __le16_to_cpu(req->to_multiplier);
3785
3786 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3787 min, max, latency, to_multiplier);
3788
3789 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3790
3791 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3792 if (err)
de73115a
CT		 3793 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3794 else
3795 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3796
3797 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3798 sizeof(rsp), &rsp);
3799
2ce603eb
CT		 3800 if (!err)
3801 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3802
de73115a
CT		 3803 return 0;
3804}
3805
3300d9a9
CT		 3806static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3807 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3808{
3809 int err = 0;
3810
3811 switch (cmd->code) {
3812 case L2CAP_COMMAND_REJ:
3813 l2cap_command_rej(conn, cmd, data);
3814 break;
3815
3816 case L2CAP_CONN_REQ:
3817 err = l2cap_connect_req(conn, cmd, data);
3818 break;
3819
3820 case L2CAP_CONN_RSP:
3821 err = l2cap_connect_rsp(conn, cmd, data);
3822 break;
3823
3824 case L2CAP_CONF_REQ:
3825 err = l2cap_config_req(conn, cmd, cmd_len, data);
3826 break;
3827
3828 case L2CAP_CONF_RSP:
3829 err = l2cap_config_rsp(conn, cmd, data);
3830 break;
3831
3832 case L2CAP_DISCONN_REQ:
3833 err = l2cap_disconnect_req(conn, cmd, data);
3834 break;
3835
3836 case L2CAP_DISCONN_RSP:
3837 err = l2cap_disconnect_rsp(conn, cmd, data);
3838 break;
3839
3840 case L2CAP_ECHO_REQ:
3841 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3842 break;
3843
3844 case L2CAP_ECHO_RSP:
3845 break;
3846
3847 case L2CAP_INFO_REQ:
3848 err = l2cap_information_req(conn, cmd, data);
3849 break;
3850
3851 case L2CAP_INFO_RSP:
3852 err = l2cap_information_rsp(conn, cmd, data);
3853 break;
3854
f94ff6ff
MM		 3855 case L2CAP_CREATE_CHAN_REQ:
3856 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3857 break;
3858
3859 case L2CAP_CREATE_CHAN_RSP:
3860 err = l2cap_create_channel_rsp(conn, cmd, data);
3861 break;
3862
8d5a04a1
MM		 3863 case L2CAP_MOVE_CHAN_REQ:
3864 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3865 break;
3866
3867 case L2CAP_MOVE_CHAN_RSP:
3868 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3869 break;
3870
3871 case L2CAP_MOVE_CHAN_CFM:
3872 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3873 break;
3874
3875 case L2CAP_MOVE_CHAN_CFM_RSP:
3876 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3877 break;
3878
3300d9a9
CT		 3879 default:
3880 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3881 err = -EINVAL;
3882 break;
3883 }
3884
3885 return err;
3886}
3887
3888static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3889 struct l2cap_cmd_hdr *cmd, u8 *data)
3890{
3891 switch (cmd->code) {
3892 case L2CAP_COMMAND_REJ:
3893 return 0;
3894
3895 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3896 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3897
3898 case L2CAP_CONN_PARAM_UPDATE_RSP:
3899 return 0;
3900
3901 default:
3902 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3903 return -EINVAL;
3904 }
3905}
3906
3907static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3908 struct sk_buff *skb)
1da177e4
LT		 3909{
3910 u8 *data = skb->data;
3911 int len = skb->len;
3912 struct l2cap_cmd_hdr cmd;
3300d9a9 3913 int err;
1da177e4
LT		 3914
3915 l2cap_raw_recv(conn, skb);
3916
3917 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3918 u16 cmd_len;
1da177e4
LT		 3919 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3920 data += L2CAP_CMD_HDR_SIZE;
3921 len -= L2CAP_CMD_HDR_SIZE;
3922
88219a0f 3923 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3924
88219a0f 3925 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3926
88219a0f 3927 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3928 BT_DBG("corrupted command");
3929 break;
3930 }
3931
3300d9a9
CT		 3932 if (conn->hcon->type == LE_LINK)
3933 err = l2cap_le_sig_cmd(conn, &cmd, data);
3934 else
3935 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3936
3937 if (err) {
e2fd318e 3938 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3939
3940 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3941
3942 /* FIXME: Map err to a valid reason */
e2fd318e 3943 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3944 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3945 }
3946
88219a0f
AV		 3947 data += cmd_len;
3948 len -= cmd_len;
1da177e4
LT		 3949 }
3950
3951 kfree_skb(skb);
3952}
3953
47d1ec61 3954static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3955{
3956 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3957 int hdr_size;
3958
3959 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3960 hdr_size = L2CAP_EXT_HDR_SIZE;
3961 else
3962 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3963
47d1ec61 3964 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3965 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3966 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3967 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3968
3969 if (our_fcs != rcv_fcs)
7a560e5c 3970 return -EBADMSG;
fcc203c3
GP		 3971 }
3972 return 0;
3973}
3974
525cd185 3975static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3976{
88843ab0 3977 u32 control = 0;
d5392c8f 3978
6a026610 3979 chan->frames_sent = 0;
d5392c8f 3980
0b209fae 3981 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3982
e2ab4353 3983 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3984 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3985 l2cap_send_sframe(chan, control);
e2ab4353 3986 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3987 }
3988
e2ab4353 3989 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3990 l2cap_retransmit_frames(chan);
d5392c8f 3991
525cd185 3992 l2cap_ertm_send(chan);
d5392c8f 3993
e2ab4353 3994 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3995 chan->frames_sent == 0) {
ab784b73 3996 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3997 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3998 }
3999}
4000
fb45de7d 4001static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 4002{
4003 struct sk_buff *next_skb;
bfbacc11 4004 int tx_seq_offset, next_tx_seq_offset;
8f17154f 4005
3ce3514f
MM		 4006 bt_cb(skb)->control.txseq = tx_seq;
4007 bt_cb(skb)->control.sar = sar;
8f17154f 4008
f1c6775b 4009 next_skb = skb_peek(&chan->srej_q);
8f17154f 4010
836be934 4011 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 4012
039d9572 4013 while (next_skb) {
3ce3514f 4014 if (bt_cb(next_skb)->control.txseq == tx_seq)
9b53350d
JPRV		 4015 return -EINVAL;
4016
836be934 4017 next_tx_seq_offset = __seq_offset(chan,
3ce3514f 4018 bt_cb(next_skb)->control.txseq, chan->buffer_seq);
bfbacc11
JPRV		 4019
4020 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 4021 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 4022 return 0;
8f17154f
GP		 4023 }
4024
f1c6775b 4025 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 4026 next_skb = NULL;
4027 else
4028 next_skb = skb_queue_next(&chan->srej_q, next_skb);
4029 }
8f17154f 4030
f1c6775b 4031 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 4032
4033 return 0;
8f17154f
GP		 4034}
4035
84084a31
MM		 4036static void append_skb_frag(struct sk_buff *skb,
4037 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 4038{
84084a31
MM		 4039 /* skb->len reflects data in skb as well as all fragments
4040 * skb->data_len reflects only data in fragments
4041 */
4042 if (!skb_has_frag_list(skb))
4043 skb_shinfo(skb)->frag_list = new_frag;
4044
4045 new_frag->next = NULL;
4046
4047 (*last_frag)->next = new_frag;
4048 *last_frag = new_frag;
4049
4050 skb->len += new_frag->len;
4051 skb->data_len += new_frag->len;
4052 skb->truesize += new_frag->truesize;
4053}
4054
88843ab0 4055static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 4056{
4057 int err = -EINVAL;
18778a63 4058
7e0ef6ee
AE		 4059 switch (__get_ctrl_sar(chan, control)) {
4060 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 4061 if (chan->sdu)
4062 break;
18778a63 4063
84084a31
MM		 4064 err = chan->ops->recv(chan->data, skb);
4065 break;
18778a63 4066
7e0ef6ee 4067 case L2CAP_SAR_START:
84084a31
MM		 4068 if (chan->sdu)
4069 break;
18778a63 4070
6f61fd47 4071 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 4072 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 4073
84084a31
MM		 4074 if (chan->sdu_len > chan->imtu) {
4075 err = -EMSGSIZE;
4076 break;
4077 }
1890d36b 4078
84084a31
MM		 4079 if (skb->len >= chan->sdu_len)
4080 break;
18778a63 4081
84084a31
MM		 4082 chan->sdu = skb;
4083 chan->sdu_last_frag = skb;
18778a63 4084
84084a31
MM		 4085 skb = NULL;
4086 err = 0;
18778a63
GP		 4087 break;
4088
7e0ef6ee 4089 case L2CAP_SAR_CONTINUE:
6f61fd47 4090 if (!chan->sdu)
84084a31 4091 break;
18778a63 4092
84084a31
MM		 4093 append_skb_frag(chan->sdu, skb,
4094 &chan->sdu_last_frag);
4095 skb = NULL;
18778a63 4096
84084a31
MM		 4097 if (chan->sdu->len >= chan->sdu_len)
4098 break;
4178ba46 4099
84084a31 4100 err = 0;
18778a63
GP		 4101 break;
4102
7e0ef6ee 4103 case L2CAP_SAR_END:
6f61fd47 4104 if (!chan->sdu)
84084a31 4105 break;
18778a63 4106
84084a31
MM		 4107 append_skb_frag(chan->sdu, skb,
4108 &chan->sdu_last_frag);
4109 skb = NULL;
4178ba46 4110
84084a31
MM		 4111 if (chan->sdu->len != chan->sdu_len)
4112 break;
18778a63 4113
84084a31 4114 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 4115
84084a31
MM		 4116 if (!err) {
4117 /* Reassembly complete */
4118 chan->sdu = NULL;
4119 chan->sdu_last_frag = NULL;
4120 chan->sdu_len = 0;
1890d36b 4121 }
18778a63
GP		 4122 break;
4123 }
4124
84084a31
MM		 4125 if (err) {
4126 kfree_skb(skb);
4127 kfree_skb(chan->sdu);
4128 chan->sdu = NULL;
4129 chan->sdu_last_frag = NULL;
4130 chan->sdu_len = 0;
4131 }
18778a63 4132
84084a31 4133 return err;
18778a63
GP		 4134}
4135
26f880d2 4136static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 4137{
26f880d2 4138 BT_DBG("chan %p, Enter local busy", chan);
712132eb 4139
26f880d2 4140 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3c588192 4141 l2cap_seq_list_clear(&chan->srej_list);
26f880d2 4142
77f918bc 4143 __set_ack_timer(chan);
26f880d2
MM		 4144}
4145
4146static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
4147{
88843ab0 4148 u32 control;
712132eb 4149
e2ab4353 4150 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 4151 goto done;
4152
0b209fae 4153 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 4154 control |= __set_ctrl_poll(chan);
ab784b73 4155 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 4156 l2cap_send_sframe(chan, control);
6a026610 4157 chan->retry_count = 1;
712132eb 4158
1a09bcb9
GP		 4159 __clear_retrans_timer(chan);
4160 __set_monitor_timer(chan);
712132eb 4161
e2ab4353 4162 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 4163
4164done:
e2ab4353
GP		 4165 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4166 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 4167
49208c9c 4168 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 4169}
4170
e328140f 4171void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 4172{
e328140f
MM		 4173 if (chan->mode == L2CAP_MODE_ERTM) {
4174 if (busy)
4175 l2cap_ertm_enter_local_busy(chan);
4176 else
4177 l2cap_ertm_exit_local_busy(chan);
1890d36b 4178 }
1890d36b
GP		 4179}
4180
fb45de7d 4181static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 4182{
4183 struct sk_buff *skb;
88843ab0 4184 u32 control;
8f17154f 4185
e328140f
MM		 4186 while ((skb = skb_peek(&chan->srej_q)) &&
4187 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4188 int err;
4189
3ce3514f 4190 if (bt_cb(skb)->control.txseq != tx_seq)
8f17154f
GP		 4191 break;
4192
f1c6775b 4193 skb = skb_dequeue(&chan->srej_q);
3ce3514f 4194 control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
84084a31 4195 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 4196
4197 if (err < 0) {
4198 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4199 break;
4200 }
4201
836be934
AE		 4202 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
4203 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 4204 }
4205}
4206
fb45de7d 4207static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4208{
8f17154f 4209 struct srej_list *l, *tmp;
88843ab0 4210 u32 control;
8f17154f 4211
39d5a3ee 4212 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 4213 if (l->tx_seq == tx_seq) {
4214 list_del(&l->list);
4215 kfree(l);
4216 return;
4217 }
ab784b73 4218 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4219 control |= __set_reqseq(chan, l->tx_seq);
525cd185 4220 l2cap_send_sframe(chan, control);
8f17154f 4221 list_del(&l->list);
39d5a3ee 4222 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 4223 }
4224}
4225
aef89f21 4226static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4227{
8f17154f 4228 struct srej_list *new;
88843ab0 4229 u32 control;
8f17154f 4230
42e5c802 4231 while (tx_seq != chan->expected_tx_seq) {
ab784b73 4232 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4233 control |= __set_reqseq(chan, chan->expected_tx_seq);
3c588192 4234 l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
525cd185 4235 l2cap_send_sframe(chan, control);
8f17154f
GP		 4236
4237 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 4238 if (!new)
4239 return -ENOMEM;
4240
42e5c802 4241 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 4242
4243 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4244
39d5a3ee 4245 list_add_tail(&new->list, &chan->srej_l);
8f17154f 4246 }
836be934
AE		 4247
4248 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 4249
4250 return 0;
8f17154f
GP		 4251}
4252
88843ab0 4253static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 4254{
fb45de7d 4255 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 4256 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 4257 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 4258 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 4259 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 4260 int err = 0;
4261
88843ab0 4262 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 4263 tx_seq, rx_control);
1c2acffb 4264
03f6715d 4265 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4266 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4267 __clear_monitor_timer(chan);
6a026610 4268 if (chan->unacked_frames > 0)
1a09bcb9 4269 __set_retrans_timer(chan);
e2ab4353 4270 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 4271 }
4272
42e5c802
GP		 4273 chan->expected_ack_seq = req_seq;
4274 l2cap_drop_acked_frames(chan);
9f121a5a 4275
836be934 4276 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4277
4278 /* invalid tx_seq */
47d1ec61 4279 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 4280 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 4281 goto drop;
4282 }
4283
77f918bc
SJ		 4284 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4285 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4286 l2cap_send_ack(chan);
1890d36b 4287 goto drop;
77f918bc 4288 }
1890d36b 4289
02f1b641
MM		 4290 if (tx_seq == chan->expected_tx_seq)
4291 goto expected;
4292
e2ab4353 4293 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 4294 struct srej_list *first;
30afb5b2 4295
39d5a3ee 4296 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 4297 struct srej_list, list);
4298 if (tx_seq == first->tx_seq) {
42e5c802 4299 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 4300 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 4301
4302 list_del(&first->list);
4303 kfree(first);
4304
39d5a3ee 4305 if (list_empty(&chan->srej_l)) {
42e5c802 4306 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 4307 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 4308 l2cap_send_ack(chan);
49208c9c 4309 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 4310 }
4311 } else {
4312 struct srej_list *l;
9b53350d
JPRV		 4313
4314 /* duplicated tx_seq */
42e5c802 4315 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 4316 goto drop;
8f17154f 4317
39d5a3ee 4318 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 4319 if (l->tx_seq == tx_seq) {
525cd185 4320 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 4321 return 0;
4322 }
4323 }
aef89f21
SJ		 4324
4325 err = l2cap_send_srejframe(chan, tx_seq);
4326 if (err < 0) {
4327 l2cap_send_disconn_req(chan->conn, chan, -err);
4328 return err;
4329 }
30afb5b2
GP		 4330 }
4331 } else {
836be934
AE		 4332 expected_tx_seq_offset = __seq_offset(chan,
4333 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4334
4335 /* duplicated tx_seq */
4336 if (tx_seq_offset < expected_tx_seq_offset)
4337 goto drop;
4338
e2ab4353 4339 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 4340
49208c9c 4341 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 4342
39d5a3ee 4343 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 4344 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 4345
f1c6775b 4346 __skb_queue_head_init(&chan->srej_q);
42e5c802 4347 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 4348
0ef3ef0f
SJ		 4349 /* Set P-bit only if there are some I-frames to ack. */
4350 if (__clear_ack_timer(chan))
4351 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 4352
aef89f21
SJ		 4353 err = l2cap_send_srejframe(chan, tx_seq);
4354 if (err < 0) {
4355 l2cap_send_disconn_req(chan->conn, chan, -err);
4356 return err;
4357 }
1c2acffb 4358 }
30afb5b2
GP		 4359 return 0;
4360
8f17154f 4361expected:
836be934 4362 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 4363
e2ab4353 4364 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3ce3514f
MM		 4365 bt_cb(skb)->control.txseq = tx_seq;
4366 bt_cb(skb)->control.sar = sar;
f1c6775b 4367 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 4368 return 0;
4369 }
4370
84084a31 4371 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 4372 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4373
e328140f
MM		 4374 if (err < 0) {
4375 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4376 return err;
4377 }
2ece3684 4378
03f6715d 4379 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4380 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4381 l2cap_retransmit_frames(chan);
4ec10d97
GP		 4382 }
4383
c1b4f43b 4384
6a026610
GP		 4385 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4386 if (chan->num_acked == num_to_ack - 1)
525cd185 4387 l2cap_send_ack(chan);
4d611e4d
GP		 4388 else
4389 __set_ack_timer(chan);
9e917af1 4390
8f17154f 4391 return 0;
9b53350d
JPRV		 4392
4393drop:
4394 kfree_skb(skb);
4395 return 0;
1c2acffb
GP		 4396}
4397
88843ab0 4398static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 4399{
88843ab0 4400 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 4401 __get_reqseq(chan, rx_control), rx_control);
0e98958d 4402
0b209fae 4403 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 4404 l2cap_drop_acked_frames(chan);
1c2acffb 4405
e3781735 4406 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 4407 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4408 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4409 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4410 (chan->unacked_frames > 0))
1a09bcb9 4411 __set_retrans_timer(chan);
05fbd89d 4412
e2ab4353 4413 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 4414 l2cap_send_srejtail(chan);
05fbd89d 4415 } else {
525cd185 4416 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 4417 }
1d8f5d16 4418
03f6715d 4419 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4420 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4421
e2ab4353 4422 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4423 l2cap_retransmit_frames(chan);
2246b2f1 4424
e072745f 4425 } else {
e2ab4353 4426 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4427 (chan->unacked_frames > 0))
1a09bcb9 4428 __set_retrans_timer(chan);
1c2acffb 4429
e2ab4353
GP		 4430 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4431 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4432 l2cap_send_ack(chan);
894718a6 4433 else
525cd185 4434 l2cap_ertm_send(chan);
e072745f
GP		 4435 }
4436}
2246b2f1 4437
88843ab0 4438static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4439{
0b209fae 4440 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4441
88843ab0 4442 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4443
e2ab4353 4444 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4445
42e5c802
GP		 4446 chan->expected_ack_seq = tx_seq;
4447 l2cap_drop_acked_frames(chan);
e072745f 4448
03f6715d 4449 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4450 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4451 l2cap_retransmit_frames(chan);
e072745f 4452 } else {
525cd185 4453 l2cap_retransmit_frames(chan);
30afb5b2 4454
e2ab4353
GP		 4455 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4456 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4457 }
4458}
88843ab0 4459static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4460{
0b209fae 4461 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4462
88843ab0 4463 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4464
e2ab4353 4465 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4466
e3781735 4467 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4468 chan->expected_ack_seq = tx_seq;
4469 l2cap_drop_acked_frames(chan);
3cb123d1 4470
e2ab4353 4471 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4472 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4473
525cd185 4474 l2cap_ertm_send(chan);
dfc909be 4475
e2ab4353 4476 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4477 chan->srej_save_reqseq = tx_seq;
e2ab4353 4478 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4479 }
03f6715d 4480 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4481 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4482 chan->srej_save_reqseq == tx_seq)
e2ab4353 4483 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4484 else
525cd185 4485 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4486 } else {
525cd185 4487 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4488 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4489 chan->srej_save_reqseq = tx_seq;
e2ab4353 4490 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4491 }
e072745f
GP		 4492 }
4493}
4494
88843ab0 4495static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4496{
0b209fae 4497 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4498
88843ab0 4499 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4500
e2ab4353 4501 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4502 chan->expected_ack_seq = tx_seq;
4503 l2cap_drop_acked_frames(chan);
e072745f 4504
e3781735 4505 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4506 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4507
e2ab4353 4508 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4509 __clear_retrans_timer(chan);
e3781735 4510 if (__is_ctrl_poll(chan, rx_control))
525cd185 4511 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4512 return;
e072745f 4513 }
99b0d4b7 4514
e3781735 4515 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4516 l2cap_send_srejtail(chan);
ab784b73
AE		 4517 } else {
4518 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4519 l2cap_send_sframe(chan, rx_control);
4520 }
e072745f
GP		 4521}
4522
88843ab0 4523static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4524{
88843ab0 4525 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4526
03f6715d 4527 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4528 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4529 __clear_monitor_timer(chan);
6a026610 4530 if (chan->unacked_frames > 0)
1a09bcb9 4531 __set_retrans_timer(chan);
e2ab4353 4532 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4533 }
4534
ab784b73
AE		 4535 switch (__get_ctrl_super(chan, rx_control)) {
4536 case L2CAP_SUPER_RR:
525cd185 4537 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4538 break;
4539
ab784b73 4540 case L2CAP_SUPER_REJ:
525cd185 4541 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4542 break;
2246b2f1 4543
ab784b73 4544 case L2CAP_SUPER_SREJ:
525cd185 4545 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4546 break;
4547
ab784b73 4548 case L2CAP_SUPER_RNR:
525cd185 4549 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4550 break;
4551 }
4552
faaebd19 4553 kfree_skb(skb);
1c2acffb
GP		 4554 return 0;
4555}
4556
cad8f1d0 4557static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
218bb9df 4558{
88843ab0 4559 u32 control;
0b209fae 4560 u16 req_seq;
218bb9df
GP		 4561 int len, next_tx_seq_offset, req_seq_offset;
4562
b76bbd66
MM		 4563 __unpack_control(chan, skb);
4564
88843ab0
AE		 4565 control = __get_control(chan, skb->data);
4566 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4567 len = skb->len;
4568
4569 /*
4570 * We can just drop the corrupted I-frame here.
4571 * Receiver will miss it and start proper recovery
4572 * procedures and ask retransmission.
4573 */
47d1ec61 4574 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4575 goto drop;
4576
793c2f1c 4577 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4578 len -= L2CAP_SDULEN_SIZE;
218bb9df 4579
47d1ec61 4580 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4581 len -= L2CAP_FCS_SIZE;
218bb9df 4582
47d1ec61 4583 if (len > chan->mps) {
8c1d787b 4584 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4585 goto drop;
4586 }
4587
0b209fae 4588 req_seq = __get_reqseq(chan, control);
218bb9df 4589
836be934
AE		 4590 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4591
4592 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4593 chan->expected_ack_seq);
218bb9df
GP		 4594
4595 /* check for invalid req-seq */
4596 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4597 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4598 goto drop;
4599 }
4600
793c2f1c 4601 if (!__is_sframe(chan, control)) {
218bb9df 4602 if (len < 0) {
8c1d787b 4603 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4604 goto drop;
4605 }
4606
525cd185 4607 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4608 } else {
4609 if (len != 0) {
4610 BT_ERR("%d", len);
8c1d787b 4611 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4612 goto drop;
4613 }
4614
525cd185 4615 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4616 }
4617
4618 return 0;
4619
4620drop:
4621 kfree_skb(skb);
4622 return 0;
4623}
4624
1da177e4
LT		 4625static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4626{
48454079 4627 struct l2cap_chan *chan;
88843ab0 4628 u32 control;
fb45de7d 4629 u16 tx_seq;
218bb9df 4630 int len;
1da177e4 4631
baa7e1fa 4632 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4633 if (!chan) {
1da177e4 4634 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 4635 /* Drop packet and return */
3379013b 4636 kfree_skb(skb);
6be36555 4637 return 0;
1da177e4
LT		 4638 }
4639
49208c9c 4640 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4641
89bc500e 4642 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4643 goto drop;
4644
0c1bc5c6 4645 switch (chan->mode) {
1c2acffb
GP		 4646 case L2CAP_MODE_BASIC:
4647 /* If socket recv buffers overflows we drop data here
4648 * which is *bad* because L2CAP has to be reliable.
4649 * But we don't have any other choice. L2CAP doesn't
4650 * provide flow control mechanism. */
1da177e4 4651
0c1bc5c6 4652 if (chan->imtu < skb->len)
1c2acffb 4653 goto drop;
1da177e4 4654
23070494 4655 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4656 goto done;
4657 break;
4658
4659 case L2CAP_MODE_ERTM:
5ef8cb9e 4660 l2cap_ertm_data_rcv(chan, skb);
1c2acffb 4661
fcafde2e 4662 goto done;
1c2acffb 4663
6840ed07 4664 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4665 control = __get_control(chan, skb->data);
4666 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4667 len = skb->len;
4668
47d1ec61 4669 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4670 goto drop;
4671
7e0ef6ee 4672 if (__is_sar_start(chan, control))
03a51213 4673 len -= L2CAP_SDULEN_SIZE;
6840ed07 4674
47d1ec61 4675 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4676 len -= L2CAP_FCS_SIZE;
fcc203c3 4677
793c2f1c 4678 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4679 goto drop;
4680
fb45de7d 4681 tx_seq = __get_txseq(chan, control);
6840ed07 4682
84084a31
MM		 4683 if (chan->expected_tx_seq != tx_seq) {
4684 /* Frame(s) missing - must discard partial SDU */
4685 kfree_skb(chan->sdu);
4686 chan->sdu = NULL;
4687 chan->sdu_last_frag = NULL;
4688 chan->sdu_len = 0;
6840ed07 4689
84084a31
MM		 4690 /* TODO: Notify userland of missing data */
4691 }
4692
836be934 4693 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4694
4695 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4696 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4697
4698 goto done;
4699
1c2acffb 4700 default:
0c1bc5c6 4701 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4702 break;
4703 }
1da177e4
LT		 4704
4705drop:
4706 kfree_skb(skb);
4707
4708done:
6be36555 4709 l2cap_chan_unlock(chan);
0139418c 4710
1da177e4
LT		 4711 return 0;
4712}
4713
8e036fc3 4714static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4715{
23691d75 4716 struct l2cap_chan *chan;
1da177e4 4717
c2287681 4718 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 4719 if (!chan)
1da177e4
LT		 4720 goto drop;
4721
5b4cedaa 4722 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4723
89bc500e 4724 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4725 goto drop;
4726
e13e21dc 4727 if (chan->imtu < skb->len)
1da177e4
LT		 4728 goto drop;
4729
23070494 4730 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4731 return 0;
1da177e4
LT		 4732
4733drop:
4734 kfree_skb(skb);
4735
1da177e4
LT		 4736 return 0;
4737}
4738
d9b88702
AE		 4739static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4740 struct sk_buff *skb)
9f69bda6 4741{
23691d75 4742 struct l2cap_chan *chan;
9f69bda6 4743
c2287681 4744 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 4745 if (!chan)
9f69bda6
GP		 4746 goto drop;
4747
5b4cedaa 4748 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 4749
89bc500e 4750 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4751 goto drop;
4752
e13e21dc 4753 if (chan->imtu < skb->len)
9f69bda6
GP		 4754 goto drop;
4755
23070494 4756 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4757 return 0;
9f69bda6
GP		 4758
4759drop:
4760 kfree_skb(skb);
4761
9f69bda6
GP		 4762 return 0;
4763}
4764
1da177e4
LT		 4765static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4766{
4767 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4768 u16 cid, len;
4769 __le16 psm;
1da177e4
LT		 4770
4771 skb_pull(skb, L2CAP_HDR_SIZE);
4772 cid = __le16_to_cpu(lh->cid);
4773 len = __le16_to_cpu(lh->len);
4774
1c2acffb
GP		 4775 if (len != skb->len) {
4776 kfree_skb(skb);
4777 return;
4778 }
4779
1da177e4
LT		 4780 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4781
4782 switch (cid) {
3300d9a9 4783 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4784 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4785 l2cap_sig_channel(conn, skb);
4786 break;
4787
8db4dc46 4788 case L2CAP_CID_CONN_LESS:
097db76c 4789 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 4790 skb_pull(skb, 2);
4791 l2cap_conless_channel(conn, psm, skb);
4792 break;
4793
9f69bda6
GP		 4794 case L2CAP_CID_LE_DATA:
4795 l2cap_att_channel(conn, cid, skb);
4796 break;
4797
b501d6a1
AB		 4798 case L2CAP_CID_SMP:
4799 if (smp_sig_channel(conn, skb))
4800 l2cap_conn_del(conn->hcon, EACCES);
4801 break;
4802
1da177e4
LT		 4803 default:
4804 l2cap_data_channel(conn, cid, skb);
4805 break;
4806 }
4807}
4808
4809/* ---- L2CAP interface with lower layer (HCI) ---- */
4810
686ebf28 4811int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 4812{
4813 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4814 struct l2cap_chan *c;
1da177e4 4815
1da177e4
LT		 4816 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4817
4818 /* Find listening sockets and check their link_mode */
23691d75
GP		 4819 read_lock(&chan_list_lock);
4820 list_for_each_entry(c, &chan_list, global_l) {
4821 struct sock *sk = c->sk;
4343478f 4822
89bc500e 4823 if (c->state != BT_LISTEN)
1da177e4
LT		 4824 continue;
4825
4826 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4827 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4828 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4829 lm1 |= HCI_LM_MASTER;
1da177e4 4830 exact++;
2af6b9d5
MH		 4831 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4832 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4833 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4834 lm2 |= HCI_LM_MASTER;
4835 }
1da177e4 4836 }
23691d75 4837 read_unlock(&chan_list_lock);
1da177e4
LT		 4838
4839 return exact ? lm1 : lm2;
4840}
4841
686ebf28 4842int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 4843{
0139418c
MH		 4844 struct l2cap_conn *conn;
4845
1da177e4
LT		 4846 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4847
1da177e4 4848 if (!status) {
1da177e4
LT		 4849 conn = l2cap_conn_add(hcon, status);
4850 if (conn)
4851 l2cap_conn_ready(conn);
0139418c 4852 } else
e175072f 4853 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4854
4855 return 0;
4856}
4857
686ebf28 4858int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 4859{
4860 struct l2cap_conn *conn = hcon->l2cap_data;
4861
4862 BT_DBG("hcon %p", hcon);
4863
686ebf28 4864 if (!conn)
9f5a0d7b 4865 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4866 return conn->disc_reason;
4867}
4868
686ebf28 4869int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4870{
4871 BT_DBG("hcon %p reason %d", hcon, reason);
4872
e175072f 4873 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 4874 return 0;
4875}
4876
4343478f 4877static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4878{
715ec005 4879 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4880 return;
4881
f62e4323 4882 if (encrypt == 0x00) {
4343478f 4883 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 4884 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4885 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4886 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4887 } else {
4343478f 4888 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4889 __clear_chan_timer(chan);
f62e4323
MH		 4890 }
4891}
4892
686ebf28 4893int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4894{
0139418c 4895 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4896 struct l2cap_chan *chan;
1da177e4 4897
0139418c 4898 if (!conn)
1da177e4 4899 return 0;
0139418c 4900
1da177e4
LT		 4901 BT_DBG("conn %p", conn);
4902
160dc6ac 4903 if (hcon->type == LE_LINK) {
35d4adcc
HG		 4904 if (!status && encrypt)
4905 smp_distribute_keys(conn, 0);
17cd3f37 4906 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 4907 }
4908
3df91ea2 4909 mutex_lock(&conn->chan_lock);
1da177e4 4910
3df91ea2 4911 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 4912 l2cap_chan_lock(chan);
1da177e4 4913
f1cb9af5
VCG		 4914 BT_DBG("chan->scid %d", chan->scid);
4915
4916 if (chan->scid == L2CAP_CID_LE_DATA) {
4917 if (!status && encrypt) {
4918 chan->sec_level = hcon->sec_level;
cf4cd009 4919 l2cap_chan_ready(chan);
f1cb9af5
VCG		 4920 }
4921
6be36555 4922 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 4923 continue;
4924 }
4925
c1360a1c 4926 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 4927 l2cap_chan_unlock(chan);
6a8d3010
MH		 4928 continue;
4929 }
4930
89bc500e
GP		 4931 if (!status && (chan->state == BT_CONNECTED ||
4932 chan->state == BT_CONFIG)) {
a7d7723a
GP		 4933 struct sock *sk = chan->sk;
4934
c5daa683 4935 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
a7d7723a
GP		 4936 sk->sk_state_change(sk);
4937
4343478f 4938 l2cap_check_encryption(chan, encrypt);
6be36555 4939 l2cap_chan_unlock(chan);
9719f8af
MH		 4940 continue;
4941 }
4942
89bc500e 4943 if (chan->state == BT_CONNECT) {
b1235d79 4944 if (!status) {
9b27f350 4945 l2cap_send_conn_req(chan);
b1235d79 4946 } else {
ba13ccd9 4947 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4948 }
89bc500e 4949 } else if (chan->state == BT_CONNECT2) {
6be36555 4950 struct sock *sk = chan->sk;
b1235d79 4951 struct l2cap_conn_rsp rsp;
df3c3931 4952 __u16 res, stat;
1da177e4 4953
6be36555
AE		 4954 lock_sock(sk);
4955
b1235d79 4956 if (!status) {
c5daa683
GP		 4957 if (test_bit(BT_SK_DEFER_SETUP,
4958 &bt_sk(sk)->flags)) {
df3c3931
JH		 4959 struct sock *parent = bt_sk(sk)->parent;
4960 res = L2CAP_CR_PEND;
4961 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4962 if (parent)
4963 parent->sk_data_ready(parent, 0);
df3c3931 4964 } else {
0e587be7 4965 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4966 res = L2CAP_CR_SUCCESS;
4967 stat = L2CAP_CS_NO_INFO;
4968 }
b1235d79 4969 } else {
0e587be7 4970 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 4971 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4972 res = L2CAP_CR_SEC_BLOCK;
4973 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4974 }
4975
6be36555
AE		 4976 release_sock(sk);
4977
fe4128e0
GP		 4978 rsp.scid = cpu_to_le16(chan->dcid);
4979 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4980 rsp.result = cpu_to_le16(res);
4981 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4982 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4983 sizeof(rsp), &rsp);
b1235d79 4984 }
1da177e4 4985
6be36555 4986 l2cap_chan_unlock(chan);
1da177e4
LT		 4987 }
4988
3df91ea2 4989 mutex_unlock(&conn->chan_lock);
b1235d79 4990
1da177e4
LT		 4991 return 0;
4992}
4993
686ebf28 4994int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 4995{
4996 struct l2cap_conn *conn = hcon->l2cap_data;
4997
5a08ecce
AE		 4998 if (!conn)
4999 conn = l2cap_conn_add(hcon, 0);
5000
5001 if (!conn)
1da177e4
LT		 5002 goto drop;
5003
5004 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
5005
e702112f 5006 if (!(flags & ACL_CONT)) {
1da177e4
LT		 5007 struct l2cap_hdr *hdr;
5008 int len;
5009
5010 if (conn->rx_len) {
5011 BT_ERR("Unexpected start frame (len %d)", skb->len);
5012 kfree_skb(conn->rx_skb);
5013 conn->rx_skb = NULL;
5014 conn->rx_len = 0;
5015 l2cap_conn_unreliable(conn, ECOMM);
5016 }
5017
aae7fe22
AE		 5018 /* Start fragment always begin with Basic L2CAP header */
5019 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 5020 BT_ERR("Frame is too short (len %d)", skb->len);
5021 l2cap_conn_unreliable(conn, ECOMM);
5022 goto drop;
5023 }
5024
5025 hdr = (struct l2cap_hdr *) skb->data;
5026 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
5027
5028 if (len == skb->len) {
5029 /* Complete frame received */
5030 l2cap_recv_frame(conn, skb);
5031 return 0;
5032 }
5033
5034 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
5035
5036 if (skb->len > len) {
5037 BT_ERR("Frame is too long (len %d, expected len %d)",
5038 skb->len, len);
5039 l2cap_conn_unreliable(conn, ECOMM);
5040 goto drop;
5041 }
5042
5043 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 5044 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
5045 if (!conn->rx_skb)
1da177e4
LT		 5046 goto drop;
5047
d626f62b 5048 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5049 skb->len);
1da177e4
LT		 5050 conn->rx_len = len - skb->len;
5051 } else {
5052 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5053
5054 if (!conn->rx_len) {
5055 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5056 l2cap_conn_unreliable(conn, ECOMM);
5057 goto drop;
5058 }
5059
5060 if (skb->len > conn->rx_len) {
5061 BT_ERR("Fragment is too long (len %d, expected %d)",
5062 skb->len, conn->rx_len);
5063 kfree_skb(conn->rx_skb);
5064 conn->rx_skb = NULL;
5065 conn->rx_len = 0;
5066 l2cap_conn_unreliable(conn, ECOMM);
5067 goto drop;
5068 }
5069
d626f62b 5070 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5071 skb->len);
1da177e4
LT		 5072 conn->rx_len -= skb->len;
5073
5074 if (!conn->rx_len) {
5075 /* Complete frame received */
5076 l2cap_recv_frame(conn, conn->rx_skb);
5077 conn->rx_skb = NULL;
5078 }
5079 }
5080
5081drop:
5082 kfree_skb(skb);
5083 return 0;
5084}
5085
aef7d97c 5086static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5087{
23691d75 5088 struct l2cap_chan *c;
1da177e4 5089
333055f2 5090 read_lock(&chan_list_lock);
1da177e4 5091
23691d75
GP		 5092 list_for_each_entry(c, &chan_list, global_l) {
5093 struct sock *sk = c->sk;
101545f6 5094
903d343e 5095 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 5096 batostr(&bt_sk(sk)->src),
5097 batostr(&bt_sk(sk)->dst),
89bc500e 5098 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 5099 c->scid, c->dcid, c->imtu, c->omtu,
5100 c->sec_level, c->mode);
61e1b4b7 5101 }
1da177e4 5102
333055f2 5103 read_unlock(&chan_list_lock);
1da177e4 5104
aef7d97c 5105 return 0;
1da177e4
LT		 5106}
5107
aef7d97c
MH		 5108static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5109{
5110 return single_open(file, l2cap_debugfs_show, inode->i_private);
5111}
5112
5113static const struct file_operations l2cap_debugfs_fops = {
5114 .open = l2cap_debugfs_open,
5115 .read = seq_read,
5116 .llseek = seq_lseek,
5117 .release = single_release,
5118};
5119
5120static struct dentry *l2cap_debugfs;
1da177e4 5121
64274518 5122int __init l2cap_init(void)
1da177e4
LT		 5123{
5124 int err;
be9d1227 5125
bb58f747 5126 err = l2cap_init_sockets();
1da177e4
LT		 5127 if (err < 0)
5128 return err;
5129
aef7d97c
MH		 5130 if (bt_debugfs) {
5131 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5132 bt_debugfs, NULL, &l2cap_debugfs_fops);
5133 if (!l2cap_debugfs)
5134 BT_ERR("Failed to create L2CAP debug file");
5135 }
1da177e4 5136
1da177e4 5137 return 0;
1da177e4
LT		 5138}
5139
64274518 5140void l2cap_exit(void)
1da177e4 5141{
aef7d97c 5142 debugfs_remove(l2cap_debugfs);
bb58f747 5143 l2cap_cleanup_sockets();
1da177e4
LT		 5144}
5145
d1c4a17d
GP		 5146module_param(disable_ertm, bool, 0644);
5147MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)