projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Do not send data during channel move
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
aef7d97c 33#include <linux/debugfs.h>
fcc203c3 34#include <linux/crc16.h>
1da177e4
LT		 35
36#include <net/bluetooth/bluetooth.h>
37#include <net/bluetooth/hci_core.h>
38#include <net/bluetooth/l2cap.h>
b501d6a1 39#include <net/bluetooth/smp.h>
97e8e89d 40#include <net/bluetooth/a2mp.h>
1da177e4 41
d1de6d46 42bool disable_ertm;
f0709e03 43
47ec1dcd 44static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 45static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 46
b5ad8b7f
JB		 47static LIST_HEAD(chan_list);
48static DEFINE_RWLOCK(chan_list_lock);
1da177e4 49
1da177e4 50static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2d792818 51 u8 code, u8 ident, u16 dlen, void *data);
4519de9a 52static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
2d792818 53 void *data);
710f9b0a 54static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a 55static void l2cap_send_disconn_req(struct l2cap_conn *conn,
c5daa683 56 struct l2cap_chan *chan, int err);
1da177e4 57
d660366d 58static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2d792818 59 struct sk_buff_head *skbs, u8 event);
608bcc6d 60
0139418c 61/* ---- L2CAP channels ---- */
71ba0e56 62
2d792818
GP		 63static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
64 u16 cid)
0139418c 65{
3df91ea2 66 struct l2cap_chan *c;
3d57dc68 67
3df91ea2
AE		 68 list_for_each_entry(c, &conn->chan_l, list) {
69 if (c->dcid == cid)
70 return c;
0139418c 71 }
3df91ea2 72 return NULL;
0139418c
MH		 73}
74
2d792818
GP		 75static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn,
76 u16 cid)
0139418c 77{
3df91ea2 78 struct l2cap_chan *c;
3d57dc68 79
3df91ea2
AE		 80 list_for_each_entry(c, &conn->chan_l, list) {
81 if (c->scid == cid)
82 return c;
0139418c 83 }
3df91ea2 84 return NULL;
0139418c
MH		 85}
86
87/* Find channel with given SCID.
ef191ade 88 * Returns locked channel. */
2d792818
GP		 89static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn,
90 u16 cid)
0139418c 91{
48454079 92 struct l2cap_chan *c;
baa7e1fa 93
3df91ea2 94 mutex_lock(&conn->chan_lock);
baa7e1fa 95 c = __l2cap_get_chan_by_scid(conn, cid);
ef191ade
MM		 96 if (c)
97 l2cap_chan_lock(c);
3df91ea2
AE		 98 mutex_unlock(&conn->chan_lock);
99
48454079 100 return c;
0139418c
MH		 101}
102
b1a130b7
MM		 103/* Find channel with given DCID.
104 * Returns locked channel.
105 */
106static struct l2cap_chan *l2cap_get_chan_by_dcid(struct l2cap_conn *conn,
107 u16 cid)
108{
109 struct l2cap_chan *c;
110
111 mutex_lock(&conn->chan_lock);
112 c = __l2cap_get_chan_by_dcid(conn, cid);
113 if (c)
114 l2cap_chan_lock(c);
115 mutex_unlock(&conn->chan_lock);
116
117 return c;
118}
119
2d792818
GP		 120static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn,
121 u8 ident)
0139418c 122{
3df91ea2 123 struct l2cap_chan *c;
3d57dc68 124
3df91ea2
AE		 125 list_for_each_entry(c, &conn->chan_l, list) {
126 if (c->ident == ident)
127 return c;
0139418c 128 }
3df91ea2 129 return NULL;
0139418c
MH		 130}
131
5b155ef9
MM		 132static struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn,
133 u8 ident)
134{
135 struct l2cap_chan *c;
136
137 mutex_lock(&conn->chan_lock);
138 c = __l2cap_get_chan_by_ident(conn, ident);
139 if (c)
140 l2cap_chan_lock(c);
141 mutex_unlock(&conn->chan_lock);
142
143 return c;
144}
145
23691d75 146static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 147{
23691d75 148 struct l2cap_chan *c;
9e4425ff 149
23691d75
GP		 150 list_for_each_entry(c, &chan_list, global_l) {
151 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 152 return c;
9e4425ff 153 }
250938cb 154 return NULL;
9e4425ff
GP		 155}
156
157int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
158{
73b2ec18
GP		 159 int err;
160
333055f2 161 write_lock(&chan_list_lock);
9e4425ff 162
23691d75 163 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 164 err = -EADDRINUSE;
165 goto done;
9e4425ff
GP		 166 }
167
73b2ec18
GP		 168 if (psm) {
169 chan->psm = psm;
170 chan->sport = psm;
171 err = 0;
172 } else {
173 u16 p;
174
175 err = -EINVAL;
176 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 177 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 178 chan->psm = cpu_to_le16(p);
179 chan->sport = cpu_to_le16(p);
180 err = 0;
181 break;
182 }
183 }
9e4425ff 184
73b2ec18 185done:
333055f2 186 write_unlock(&chan_list_lock);
73b2ec18 187 return err;
9e4425ff
GP		 188}
189
190int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
191{
333055f2 192 write_lock(&chan_list_lock);
9e4425ff
GP		 193
194 chan->scid = scid;
195
333055f2 196 write_unlock(&chan_list_lock);
9e4425ff
GP		 197
198 return 0;
199}
200
baa7e1fa 201static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 202{
8db4dc46 203 u16 cid = L2CAP_CID_DYN_START;
0139418c 204
8db4dc46 205 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 206 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 207 return cid;
208 }
209
210 return 0;
211}
212
0e587be7 213static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 214{
42d2d87c 215 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
2d792818 216 state_to_string(state));
badaaa00 217
89bc500e 218 chan->state = state;
80b98027 219 chan->ops->state_change(chan, state);
89bc500e
GP		 220}
221
0e587be7
AE		 222static void l2cap_state_change(struct l2cap_chan *chan, int state)
223{
224 struct sock *sk = chan->sk;
225
226 lock_sock(sk);
227 __l2cap_state_change(chan, state);
228 release_sock(sk);
229}
230
2e0052e4
AE		 231static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
232{
233 struct sock *sk = chan->sk;
234
235 sk->sk_err = err;
236}
237
238static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
239{
240 struct sock *sk = chan->sk;
241
242 lock_sock(sk);
243 __l2cap_chan_set_err(chan, err);
244 release_sock(sk);
245}
246
4239d16f
MM		 247static void __set_retrans_timer(struct l2cap_chan *chan)
248{
249 if (!delayed_work_pending(&chan->monitor_timer) &&
250 chan->retrans_timeout) {
251 l2cap_set_timer(chan, &chan->retrans_timer,
252 msecs_to_jiffies(chan->retrans_timeout));
253 }
254}
255
256static void __set_monitor_timer(struct l2cap_chan *chan)
257{
258 __clear_retrans_timer(chan);
259 if (chan->monitor_timeout) {
260 l2cap_set_timer(chan, &chan->monitor_timer,
261 msecs_to_jiffies(chan->monitor_timeout));
262 }
263}
264
608bcc6d
MM		 265static struct sk_buff *l2cap_ertm_seq_in_queue(struct sk_buff_head *head,
266 u16 seq)
267{
268 struct sk_buff *skb;
269
270 skb_queue_walk(head, skb) {
271 if (bt_cb(skb)->control.txseq == seq)
272 return skb;
273 }
274
275 return NULL;
276}
277
3c588192
MM		 278/* ---- L2CAP sequence number lists ---- */
279
280/* For ERTM, ordered lists of sequence numbers must be tracked for
281 * SREJ requests that are received and for frames that are to be
282 * retransmitted. These seq_list functions implement a singly-linked
283 * list in an array, where membership in the list can also be checked
284 * in constant time. Items can also be added to the tail of the list
285 * and removed from the head in constant time, without further memory
286 * allocs or frees.
287 */
288
289static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
290{
291 size_t alloc_size, i;
292
293 /* Allocated size is a power of 2 to map sequence numbers
294 * (which may be up to 14 bits) in to a smaller array that is
295 * sized for the negotiated ERTM transmit windows.
296 */
297 alloc_size = roundup_pow_of_two(size);
298
299 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
300 if (!seq_list->list)
301 return -ENOMEM;
302
303 seq_list->mask = alloc_size - 1;
304 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
305 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
306 for (i = 0; i < alloc_size; i++)
307 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
308
309 return 0;
310}
311
312static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
313{
314 kfree(seq_list->list);
315}
316
317static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
318 u16 seq)
319{
320 /* Constant-time check for list membership */
321 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
322}
323
324static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
325{
326 u16 mask = seq_list->mask;
327
328 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
329 /* In case someone tries to pop the head of an empty list */
330 return L2CAP_SEQ_LIST_CLEAR;
331 } else if (seq_list->head == seq) {
332 /* Head can be removed in constant time */
333 seq_list->head = seq_list->list[seq & mask];
334 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
335
336 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
337 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
338 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
339 }
340 } else {
341 /* Walk the list to find the sequence number */
342 u16 prev = seq_list->head;
343 while (seq_list->list[prev & mask] != seq) {
344 prev = seq_list->list[prev & mask];
345 if (prev == L2CAP_SEQ_LIST_TAIL)
346 return L2CAP_SEQ_LIST_CLEAR;
347 }
348
349 /* Unlink the number from the list and clear it */
350 seq_list->list[prev & mask] = seq_list->list[seq & mask];
351 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
352 if (seq_list->tail == seq)
353 seq_list->tail = prev;
354 }
355 return seq;
356}
357
358static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
359{
360 /* Remove the head in constant time */
361 return l2cap_seq_list_remove(seq_list, seq_list->head);
362}
363
364static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
365{
f522ae36 366 u16 i;
3c588192 367
f522ae36
GP		 368 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR)
369 return;
370
371 for (i = 0; i <= seq_list->mask; i++)
372 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
373
374 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
375 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
3c588192
MM		 376}
377
378static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
379{
380 u16 mask = seq_list->mask;
381
382 /* All appends happen in constant time */
383
f522ae36
GP		 384 if (seq_list->list[seq & mask] != L2CAP_SEQ_LIST_CLEAR)
385 return;
3c588192 386
f522ae36
GP		 387 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
388 seq_list->head = seq;
389 else
390 seq_list->list[seq_list->tail & mask] = seq;
391
392 seq_list->tail = seq;
393 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
3c588192
MM		 394}
395
721c4181 396static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 397{
721c4181 398 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2d792818 399 chan_timer.work);
3df91ea2 400 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 401 int reason;
402
e05dcc32 403 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 404
3df91ea2 405 mutex_lock(&conn->chan_lock);
6be36555 406 l2cap_chan_lock(chan);
ab07801d 407
89bc500e 408 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 409 reason = ECONNREFUSED;
89bc500e 410 else if (chan->state == BT_CONNECT &&
2d792818 411 chan->sec_level != BT_SECURITY_SDP)
ab07801d
GP		 412 reason = ECONNREFUSED;
413 else
414 reason = ETIMEDOUT;
415
0f852724 416 l2cap_chan_close(chan, reason);
ab07801d 417
6be36555 418 l2cap_chan_unlock(chan);
ab07801d 419
80b98027 420 chan->ops->close(chan);
3df91ea2
AE		 421 mutex_unlock(&conn->chan_lock);
422
371fd835 423 l2cap_chan_put(chan);
ab07801d
GP		 424}
425
eef1d9b6 426struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 427{
428 struct l2cap_chan *chan;
429
430 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
431 if (!chan)
432 return NULL;
433
c03b355e
AE		 434 mutex_init(&chan->lock);
435
333055f2 436 write_lock(&chan_list_lock);
23691d75 437 list_add(&chan->global_l, &chan_list);
333055f2 438 write_unlock(&chan_list_lock);
23691d75 439
721c4181 440 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 441
89bc500e
GP		 442 chan->state = BT_OPEN;
443
144ad330 444 kref_init(&chan->kref);
71ba0e56 445
2827011f
MM		 446 /* This flag is cleared in l2cap_chan_ready() */
447 set_bit(CONF_NOT_COMPLETE, &chan->conf_state);
448
eef1d9b6 449 BT_DBG("chan %p", chan);
abc545b8 450
48454079
GP		 451 return chan;
452}
453
144ad330 454static void l2cap_chan_destroy(struct kref *kref)
6ff5abbf 455{
144ad330
SS		 456 struct l2cap_chan *chan = container_of(kref, struct l2cap_chan, kref);
457
4af66c69
JK		 458 BT_DBG("chan %p", chan);
459
333055f2 460 write_lock(&chan_list_lock);
23691d75 461 list_del(&chan->global_l);
333055f2 462 write_unlock(&chan_list_lock);
23691d75 463
4af66c69 464 kfree(chan);
6ff5abbf
GP		 465}
466
30648372
JK		 467void l2cap_chan_hold(struct l2cap_chan *c)
468{
144ad330 469 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 470
144ad330 471 kref_get(&c->kref);
30648372
JK		 472}
473
474void l2cap_chan_put(struct l2cap_chan *c)
475{
144ad330 476 BT_DBG("chan %p orig refcnt %d", c, atomic_read(&c->kref.refcount));
30648372 477
144ad330 478 kref_put(&c->kref, l2cap_chan_destroy);
30648372
JK		 479}
480
bd4b1653
AE		 481void l2cap_chan_set_defaults(struct l2cap_chan *chan)
482{
483 chan->fcs = L2CAP_FCS_CRC16;
484 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
485 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
486 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
c20f8e35 487 chan->ack_win = L2CAP_DEFAULT_TX_WINDOW;
bd4b1653
AE		 488 chan->sec_level = BT_SECURITY_LOW;
489
490 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
491}
492
93c3e8f5 493void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 494{
af05b30b 495 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 496 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 497
9f5a0d7b 498 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 499
8c1d787b 500 chan->conn = conn;
0139418c 501
5491120e
AE		 502 switch (chan->chan_type) {
503 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 504 if (conn->hcon->type == LE_LINK) {
505 /* LE connection */
6fcb06a2 506 chan->omtu = L2CAP_DEFAULT_MTU;
fe4128e0
GP		 507 chan->scid = L2CAP_CID_LE_DATA;
508 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 509 } else {
510 /* Alloc CID for connection-oriented socket */
fe4128e0 511 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 512 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 513 }
5491120e
AE		 514 break;
515
516 case L2CAP_CHAN_CONN_LESS:
0139418c 517 /* Connectionless socket */
fe4128e0
GP		 518 chan->scid = L2CAP_CID_CONN_LESS;
519 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 520 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 521 break;
522
416fa752
AE		 523 case L2CAP_CHAN_CONN_FIX_A2MP:
524 chan->scid = L2CAP_CID_A2MP;
525 chan->dcid = L2CAP_CID_A2MP;
526 chan->omtu = L2CAP_A2MP_DEFAULT_MTU;
527 chan->imtu = L2CAP_A2MP_DEFAULT_MTU;
528 break;
529
5491120e 530 default:
0139418c 531 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 532 chan->scid = L2CAP_CID_SIGNALING;
533 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 534 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 535 }
536
8f7975b1
AE		 537 chan->local_id = L2CAP_BESTEFFORT_ID;
538 chan->local_stype = L2CAP_SERV_BESTEFFORT;
539 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
540 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
541 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
8936fa6d 542 chan->local_flush_to = L2CAP_EFS_DEFAULT_FLUSH_TO;
8f7975b1 543
371fd835 544 l2cap_chan_hold(chan);
baa7e1fa 545
3df91ea2 546 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 547}
548
466f8004 549void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 550{
551 mutex_lock(&conn->chan_lock);
552 __l2cap_chan_add(conn, chan);
3df91ea2 553 mutex_unlock(&conn->chan_lock);
0139418c
MH		 554}
555
466f8004 556void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 557{
8c1d787b 558 struct l2cap_conn *conn = chan->conn;
0139418c 559
c9b66675 560 __clear_chan_timer(chan);
0139418c 561
49208c9c 562 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 563
8e87d142 564 if (conn) {
56f60984 565 struct amp_mgr *mgr = conn->hcon->amp_mgr;
baa7e1fa 566 /* Delete from channel list */
3df91ea2 567 list_del(&chan->list);
3d57dc68 568
371fd835 569 l2cap_chan_put(chan);
baa7e1fa 570
8c1d787b 571 chan->conn = NULL;
3cabbfda
AE		 572
573 if (chan->chan_type != L2CAP_CHAN_CONN_FIX_A2MP)
574 hci_conn_put(conn->hcon);
56f60984
AE		 575
576 if (mgr && mgr->bredr_chan == chan)
577 mgr->bredr_chan = NULL;
0139418c
MH		 578 }
579
b699ec0d 580 chan->ops->teardown(chan, err);
6be36555 581
2827011f 582 if (test_bit(CONF_NOT_COMPLETE, &chan->conf_state))
6ff5abbf 583 return;
2ead70b8 584
ee556f66
GP		 585 switch(chan->mode) {
586 case L2CAP_MODE_BASIC:
587 break;
c13ffa62 588
ee556f66 589 case L2CAP_MODE_ERTM:
1a09bcb9
GP		 590 __clear_retrans_timer(chan);
591 __clear_monitor_timer(chan);
592 __clear_ack_timer(chan);
c13ffa62 593
f1c6775b 594 skb_queue_purge(&chan->srej_q);
c13ffa62 595
3c588192
MM		 596 l2cap_seq_list_free(&chan->srej_list);
597 l2cap_seq_list_free(&chan->retrans_list);
ee556f66
GP		 598
599 /* fall through */
600
601 case L2CAP_MODE_STREAMING:
602 skb_queue_purge(&chan->tx_q);
603 break;
c13ffa62 604 }
ee556f66
GP		 605
606 return;
0139418c
MH		 607}
608
0f852724 609void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 610{
611 struct l2cap_conn *conn = chan->conn;
612 struct sock *sk = chan->sk;
613
2d792818
GP		 614 BT_DBG("chan %p state %s sk %p", chan, state_to_string(chan->state),
615 sk);
4519de9a 616
89bc500e 617 switch (chan->state) {
4519de9a 618 case BT_LISTEN:
b699ec0d 619 chan->ops->teardown(chan, 0);
4519de9a
GP		 620 break;
621
622 case BT_CONNECTED:
623 case BT_CONFIG:
715ec005 624 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
2d792818 625 conn->hcon->type == ACL_LINK) {
c9b66675 626 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 627 l2cap_send_disconn_req(conn, chan, reason);
628 } else
629 l2cap_chan_del(chan, reason);
630 break;
631
632 case BT_CONNECT2:
715ec005 633 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
2d792818 634 conn->hcon->type == ACL_LINK) {
4519de9a
GP		 635 struct l2cap_conn_rsp rsp;
636 __u16 result;
637
c5daa683 638 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))
4519de9a
GP		 639 result = L2CAP_CR_SEC_BLOCK;
640 else
641 result = L2CAP_CR_BAD_PSM;
89bc500e 642 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 643
644 rsp.scid = cpu_to_le16(chan->dcid);
645 rsp.dcid = cpu_to_le16(chan->scid);
646 rsp.result = cpu_to_le16(result);
ac73498c 647 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4519de9a 648 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 649 sizeof(rsp), &rsp);
4519de9a
GP		 650 }
651
652 l2cap_chan_del(chan, reason);
653 break;
654
655 case BT_CONNECT:
656 case BT_DISCONN:
657 l2cap_chan_del(chan, reason);
658 break;
659
660 default:
b699ec0d 661 chan->ops->teardown(chan, 0);
4519de9a
GP		 662 break;
663 }
664}
665
4343478f 666static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 667{
715ec005 668 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 669 switch (chan->sec_level) {
8556edd3
JH		 670 case BT_SECURITY_HIGH:
671 return HCI_AT_DEDICATED_BONDING_MITM;
672 case BT_SECURITY_MEDIUM:
673 return HCI_AT_DEDICATED_BONDING;
674 default:
675 return HCI_AT_NO_BONDING;
676 }
2983fd68 677 } else if (chan->psm == __constant_cpu_to_le16(L2CAP_PSM_SDP)) {
4343478f
GP		 678 if (chan->sec_level == BT_SECURITY_LOW)
679 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 680
4343478f 681 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 682 return HCI_AT_NO_BONDING_MITM;
00ae4af9 683 else
8556edd3 684 return HCI_AT_NO_BONDING;
00ae4af9 685 } else {
4343478f 686 switch (chan->sec_level) {
00ae4af9 687 case BT_SECURITY_HIGH:
8556edd3 688 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 689 case BT_SECURITY_MEDIUM:
8556edd3 690 return HCI_AT_GENERAL_BONDING;
00ae4af9 691 default:
8556edd3 692 return HCI_AT_NO_BONDING;
00ae4af9 693 }
0684e5f9 694 }
8556edd3
JH		 695}
696
697/* Service level security */
d45fc423 698int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 699{
8c1d787b 700 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 701 __u8 auth_type;
702
4343478f 703 auth_type = l2cap_get_auth_type(chan);
79d554a6 704
4343478f 705 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 706}
707
b5ad8b7f 708static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 709{
710 u8 id;
711
712 /* Get next available identificator.
713 * 1 - 128 are used by kernel.
714 * 129 - 199 are reserved.
715 * 200 - 254 are used by utilities like l2ping, etc.
716 */
717
333055f2 718 spin_lock(&conn->lock);
4e8402a3
MH		 719
720 if (++conn->tx_ident > 128)
721 conn->tx_ident = 1;
722
723 id = conn->tx_ident;
724
333055f2 725 spin_unlock(&conn->lock);
4e8402a3
MH		 726
727 return id;
728}
729
2d792818
GP		 730static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
731 void *data)
4e8402a3
MH		 732{
733 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 734 u8 flags;
4e8402a3
MH		 735
736 BT_DBG("code 0x%2.2x", code);
737
738 if (!skb)
9a9c6a34 739 return;
4e8402a3 740
e702112f
AE		 741 if (lmp_no_flush_capable(conn->hcon->hdev))
742 flags = ACL_START_NO_FLUSH;
743 else
744 flags = ACL_START;
745
14b12d0b 746 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 747 skb->priority = HCI_PRIO_MAX;
14b12d0b 748
73d80deb
LAD		 749 hci_send_acl(conn->hchan, skb, flags);
750}
751
02b0fbb9
MM		 752static bool __chan_is_moving(struct l2cap_chan *chan)
753{
754 return chan->move_state != L2CAP_MOVE_STABLE &&
755 chan->move_state != L2CAP_MOVE_WAIT_PREPARE;
756}
757
73d80deb
LAD		 758static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
759{
760 struct hci_conn *hcon = chan->conn->hcon;
761 u16 flags;
762
763 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
2d792818 764 skb->priority);
73d80deb 765
d5f8a75d
MM		 766 if (chan->hs_hcon && !__chan_is_moving(chan)) {
767 if (chan->hs_hchan)
768 hci_send_acl(chan->hs_hchan, skb, ACL_COMPLETE);
769 else
770 kfree_skb(skb);
771
772 return;
773 }
774
73d80deb 775 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
2d792818 776 lmp_no_flush_capable(hcon->hdev))
73d80deb
LAD		 777 flags = ACL_START_NO_FLUSH;
778 else
779 flags = ACL_START;
14b12d0b 780
73d80deb
LAD		 781 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
782 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 783}
784
b76bbd66
MM		 785static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
786{
787 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
788 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
789
790 if (enh & L2CAP_CTRL_FRAME_TYPE) {
791 /* S-Frame */
792 control->sframe = 1;
793 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
794 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
795
796 control->sar = 0;
797 control->txseq = 0;
798 } else {
799 /* I-Frame */
800 control->sframe = 0;
801 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
802 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
803
804 control->poll = 0;
805 control->super = 0;
806 }
807}
808
b76bbd66
MM		 809static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
810{
811 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
812 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
813
814 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
815 /* S-Frame */
816 control->sframe = 1;
817 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
818 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
819
820 control->sar = 0;
821 control->txseq = 0;
822 } else {
823 /* I-Frame */
824 control->sframe = 0;
825 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
826 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
827
828 control->poll = 0;
829 control->super = 0;
830 }
831}
832
833static inline void __unpack_control(struct l2cap_chan *chan,
834 struct sk_buff *skb)
835{
836 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
837 __unpack_extended_control(get_unaligned_le32(skb->data),
838 &bt_cb(skb)->control);
cec8ab6e 839 skb_pull(skb, L2CAP_EXT_CTRL_SIZE);
b76bbd66
MM		 840 } else {
841 __unpack_enhanced_control(get_unaligned_le16(skb->data),
842 &bt_cb(skb)->control);
cec8ab6e 843 skb_pull(skb, L2CAP_ENH_CTRL_SIZE);
b76bbd66
MM		 844 }
845}
846
b5c6aaed
MM		 847static u32 __pack_extended_control(struct l2cap_ctrl *control)
848{
849 u32 packed;
850
851 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
852 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
853
854 if (control->sframe) {
855 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
856 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
857 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
858 } else {
859 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
860 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
861 }
862
863 return packed;
864}
865
866static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
867{
868 u16 packed;
869
870 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
871 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
872
873 if (control->sframe) {
874 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
875 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
876 packed |= L2CAP_CTRL_FRAME_TYPE;
877 } else {
878 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
879 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
880 }
881
882 return packed;
883}
884
b76bbd66
MM		 885static inline void __pack_control(struct l2cap_chan *chan,
886 struct l2cap_ctrl *control,
887 struct sk_buff *skb)
888{
889 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
890 put_unaligned_le32(__pack_extended_control(control),
891 skb->data + L2CAP_HDR_SIZE);
892 } else {
893 put_unaligned_le16(__pack_enhanced_control(control),
894 skb->data + L2CAP_HDR_SIZE);
895 }
896}
897
ba7aa64f
GP		 898static inline unsigned int __ertm_hdr_size(struct l2cap_chan *chan)
899{
900 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
901 return L2CAP_EXT_HDR_SIZE;
902 else
903 return L2CAP_ENH_HDR_SIZE;
904}
905
a67d7f6f
MM		 906static struct sk_buff *l2cap_create_sframe_pdu(struct l2cap_chan *chan,
907 u32 control)
b5c6aaed
MM		 908{
909 struct sk_buff *skb;
910 struct l2cap_hdr *lh;
ba7aa64f 911 int hlen = __ertm_hdr_size(chan);
b5c6aaed
MM		 912
913 if (chan->fcs == L2CAP_FCS_CRC16)
914 hlen += L2CAP_FCS_SIZE;
915
a67d7f6f 916 skb = bt_skb_alloc(hlen, GFP_KERNEL);
b5c6aaed 917
b5c6aaed 918 if (!skb)
a67d7f6f 919 return ERR_PTR(-ENOMEM);
b5c6aaed
MM		 920
921 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
922 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
923 lh->cid = cpu_to_le16(chan->dcid);
924
a67d7f6f
MM		 925 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
926 put_unaligned_le32(control, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
927 else
928 put_unaligned_le16(control, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
b5c6aaed
MM		 929
930 if (chan->fcs == L2CAP_FCS_CRC16) {
a67d7f6f 931 u16 fcs = crc16(0, (u8 *)skb->data, skb->len);
b5c6aaed
MM		 932 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
933 }
934
935 skb->priority = HCI_PRIO_MAX;
a67d7f6f
MM		 936 return skb;
937}
938
939static void l2cap_send_sframe(struct l2cap_chan *chan,
940 struct l2cap_ctrl *control)
941{
942 struct sk_buff *skb;
943 u32 control_field;
944
945 BT_DBG("chan %p, control %p", chan, control);
946
947 if (!control->sframe)
948 return;
949
b99e13ad
MM		 950 if (__chan_is_moving(chan))
951 return;
952
a67d7f6f
MM		 953 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state) &&
954 !control->poll)
955 control->final = 1;
956
957 if (control->super == L2CAP_SUPER_RR)
958 clear_bit(CONN_RNR_SENT, &chan->conn_state);
959 else if (control->super == L2CAP_SUPER_RNR)
960 set_bit(CONN_RNR_SENT, &chan->conn_state);
961
962 if (control->super != L2CAP_SUPER_SREJ) {
963 chan->last_acked_seq = control->reqseq;
964 __clear_ack_timer(chan);
965 }
966
967 BT_DBG("reqseq %d, final %d, poll %d, super %d", control->reqseq,
968 control->final, control->poll, control->super);
969
970 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
971 control_field = __pack_extended_control(control);
972 else
973 control_field = __pack_enhanced_control(control);
974
975 skb = l2cap_create_sframe_pdu(chan, control_field);
976 if (!IS_ERR(skb))
977 l2cap_do_send(chan, skb);
b5c6aaed
MM		 978}
979
c9e3d5e0 980static void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, bool poll)
b5c6aaed 981{
c9e3d5e0
MM		 982 struct l2cap_ctrl control;
983
984 BT_DBG("chan %p, poll %d", chan, poll);
985
986 memset(&control, 0, sizeof(control));
987 control.sframe = 1;
988 control.poll = poll;
989
990 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
991 control.super = L2CAP_SUPER_RNR;
992 else
993 control.super = L2CAP_SUPER_RR;
b5c6aaed 994
c9e3d5e0
MM		 995 control.reqseq = chan->buffer_seq;
996 l2cap_send_sframe(chan, &control);
b5c6aaed
MM		 997}
998
b4450035 999static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 1000{
c1360a1c 1001 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 1002}
1003
93c3e8f5
AE		 1004static bool __amp_capable(struct l2cap_chan *chan)
1005{
1006 struct l2cap_conn *conn = chan->conn;
1007
1008 if (enable_hs &&
1009 chan->chan_policy == BT_CHANNEL_POLICY_AMP_PREFERRED &&
1010 conn->fixed_chan_mask & L2CAP_FC_A2MP)
1011 return true;
1012 else
1013 return false;
1014}
1015
2766be48 1016void l2cap_send_conn_req(struct l2cap_chan *chan)
9b27f350
AE		 1017{
1018 struct l2cap_conn *conn = chan->conn;
1019 struct l2cap_conn_req req;
1020
1021 req.scid = cpu_to_le16(chan->scid);
1022 req.psm = chan->psm;
1023
1024 chan->ident = l2cap_get_ident(conn);
1025
1026 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1027
1028 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
1029}
1030
8eb200bd
MM		 1031static void l2cap_send_create_chan_req(struct l2cap_chan *chan, u8 amp_id)
1032{
1033 struct l2cap_create_chan_req req;
1034 req.scid = cpu_to_le16(chan->scid);
1035 req.psm = chan->psm;
1036 req.amp_id = amp_id;
1037
1038 chan->ident = l2cap_get_ident(chan->conn);
1039
1040 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_REQ,
1041 sizeof(req), &req);
1042}
1043
02b0fbb9
MM		 1044static void l2cap_move_setup(struct l2cap_chan *chan)
1045{
1046 struct sk_buff *skb;
1047
1048 BT_DBG("chan %p", chan);
1049
1050 if (chan->mode != L2CAP_MODE_ERTM)
1051 return;
1052
1053 __clear_retrans_timer(chan);
1054 __clear_monitor_timer(chan);
1055 __clear_ack_timer(chan);
1056
1057 chan->retry_count = 0;
1058 skb_queue_walk(&chan->tx_q, skb) {
1059 if (bt_cb(skb)->control.retries)
1060 bt_cb(skb)->control.retries = 1;
1061 else
1062 break;
1063 }
1064
1065 chan->expected_tx_seq = chan->buffer_seq;
1066
1067 clear_bit(CONN_REJ_ACT, &chan->conn_state);
1068 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
1069 l2cap_seq_list_clear(&chan->retrans_list);
1070 l2cap_seq_list_clear(&chan->srej_list);
1071 skb_queue_purge(&chan->srej_q);
1072
1073 chan->tx_state = L2CAP_TX_STATE_XMIT;
1074 chan->rx_state = L2CAP_RX_STATE_MOVE;
1075
1076 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
1077}
1078
5f3847a4
MM		 1079static void l2cap_move_done(struct l2cap_chan *chan)
1080{
1081 u8 move_role = chan->move_role;
1082 BT_DBG("chan %p", chan);
1083
1084 chan->move_state = L2CAP_MOVE_STABLE;
1085 chan->move_role = L2CAP_MOVE_ROLE_NONE;
1086
1087 if (chan->mode != L2CAP_MODE_ERTM)
1088 return;
1089
1090 switch (move_role) {
1091 case L2CAP_MOVE_ROLE_INITIATOR:
1092 l2cap_tx(chan, NULL, NULL, L2CAP_EV_EXPLICIT_POLL);
1093 chan->rx_state = L2CAP_RX_STATE_WAIT_F;
1094 break;
1095 case L2CAP_MOVE_ROLE_RESPONDER:
1096 chan->rx_state = L2CAP_RX_STATE_WAIT_P;
1097 break;
1098 }
1099}
1100
9f0caeb1
VCG		 1101static void l2cap_chan_ready(struct l2cap_chan *chan)
1102{
2827011f 1103 /* This clears all conf flags, including CONF_NOT_COMPLETE */
9f0caeb1
VCG		 1104 chan->conf_state = 0;
1105 __clear_chan_timer(chan);
1106
54a59aa2 1107 chan->state = BT_CONNECTED;
9f0caeb1 1108
fd83e2c2 1109 chan->ops->ready(chan);
9f0caeb1
VCG		 1110}
1111
93c3e8f5
AE		 1112static void l2cap_start_connection(struct l2cap_chan *chan)
1113{
1114 if (__amp_capable(chan)) {
1115 BT_DBG("chan %p AMP capable: discover AMPs", chan);
1116 a2mp_discover_amp(chan);
1117 } else {
1118 l2cap_send_conn_req(chan);
1119 }
1120}
1121
fc7f8a7e 1122static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 1123{
8c1d787b 1124 struct l2cap_conn *conn = chan->conn;
79d554a6 1125
9f0caeb1
VCG		 1126 if (conn->hcon->type == LE_LINK) {
1127 l2cap_chan_ready(chan);
1128 return;
1129 }
1130
79d554a6 1131 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 1132 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
1133 return;
1134
d45fc423 1135 if (l2cap_chan_check_security(chan) &&
2d792818 1136 __l2cap_no_conn_pending(chan)) {
93c3e8f5
AE		 1137 l2cap_start_connection(chan);
1138 }
79d554a6
MH		 1139 } else {
1140 struct l2cap_info_req req;
ac73498c 1141 req.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 1142
1143 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1144 conn->info_ident = l2cap_get_ident(conn);
1145
ba13ccd9 1146 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 1147
2d792818
GP		 1148 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
1149 sizeof(req), &req);
79d554a6
MH		 1150 }
1151}
1152
cf6c2c0b
GP		 1153static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
1154{
1155 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 1156 if (!disable_ertm)
cf6c2c0b
GP		 1157 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
1158
1159 switch (mode) {
1160 case L2CAP_MODE_ERTM:
1161 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
1162 case L2CAP_MODE_STREAMING:
1163 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
1164 default:
1165 return 0x00;
1166 }
1167}
1168
2d792818
GP		 1169static void l2cap_send_disconn_req(struct l2cap_conn *conn,
1170 struct l2cap_chan *chan, int err)
22121fc9 1171{
6be36555 1172 struct sock *sk = chan->sk;
22121fc9
GP		 1173 struct l2cap_disconn_req req;
1174
c13ffa62
GP		 1175 if (!conn)
1176 return;
1177
aad3d0e3 1178 if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
1a09bcb9
GP		 1179 __clear_retrans_timer(chan);
1180 __clear_monitor_timer(chan);
1181 __clear_ack_timer(chan);
c13ffa62
GP		 1182 }
1183
416fa752 1184 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
d117773c 1185 l2cap_state_change(chan, BT_DISCONN);
416fa752
AE		 1186 return;
1187 }
1188
fe4128e0
GP		 1189 req.dcid = cpu_to_le16(chan->dcid);
1190 req.scid = cpu_to_le16(chan->scid);
2d792818
GP		 1191 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_DISCONN_REQ,
1192 sizeof(req), &req);
c13ffa62 1193
6be36555 1194 lock_sock(sk);
0e587be7 1195 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1196 __l2cap_chan_set_err(chan, err);
6be36555 1197 release_sock(sk);
22121fc9
GP		 1198}
1199
1da177e4 1200/* ---- L2CAP connections ---- */
4e8402a3
MH		 1201static void l2cap_conn_start(struct l2cap_conn *conn)
1202{
3df91ea2 1203 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1204
1205 BT_DBG("conn %p", conn);
1206
3df91ea2 1207 mutex_lock(&conn->chan_lock);
4e8402a3 1208
3df91ea2 1209 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1210 struct sock *sk = chan->sk;
baa7e1fa 1211
6be36555 1212 l2cap_chan_lock(chan);
4e8402a3 1213
715ec005 1214 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1215 l2cap_chan_unlock(chan);
79d554a6
MH		 1216 continue;
1217 }
1218
89bc500e 1219 if (chan->state == BT_CONNECT) {
d45fc423 1220 if (!l2cap_chan_check_security(chan) ||
2d792818 1221 !__l2cap_no_conn_pending(chan)) {
6be36555 1222 l2cap_chan_unlock(chan);
47731de7
GP		 1223 continue;
1224 }
79d554a6 1225
c1360a1c 1226 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
2d792818 1227 && test_bit(CONF_STATE2_DEVICE,
c1360a1c 1228 &chan->conf_state)) {
89bc500e 1229 l2cap_chan_close(chan, ECONNRESET);
6be36555 1230 l2cap_chan_unlock(chan);
47731de7 1231 continue;
b1235d79 1232 }
47731de7 1233
93c3e8f5 1234 l2cap_start_connection(chan);
47731de7 1235
89bc500e 1236 } else if (chan->state == BT_CONNECT2) {
79d554a6 1237 struct l2cap_conn_rsp rsp;
e9aeb2dd 1238 char buf[128];
fe4128e0
GP		 1239 rsp.scid = cpu_to_le16(chan->dcid);
1240 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1241
d45fc423 1242 if (l2cap_chan_check_security(chan)) {
6be36555 1243 lock_sock(sk);
c5daa683
GP		 1244 if (test_bit(BT_SK_DEFER_SETUP,
1245 &bt_sk(sk)->flags)) {
ac73498c
AE		 1246 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1247 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
2dc4e510 1248 chan->ops->defer(chan);
f66dc81f
MH		 1249
1250 } else {
0e587be7 1251 __l2cap_state_change(chan, BT_CONFIG);
ac73498c
AE		 1252 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
1253 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f66dc81f 1254 }
6be36555 1255 release_sock(sk);
79d554a6 1256 } else {
ac73498c
AE		 1257 rsp.result = __constant_cpu_to_le16(L2CAP_CR_PEND);
1258 rsp.status = __constant_cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
79d554a6
MH		 1259 }
1260
fc7f8a7e 1261 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 1262 sizeof(rsp), &rsp);
e9aeb2dd 1263
c1360a1c 1264 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
2d792818 1265 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1266 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1267 continue;
1268 }
1269
c1360a1c 1270 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1271 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 1272 l2cap_build_conf_req(chan, buf), buf);
73ffa904 1273 chan->num_conf_req++;
4e8402a3
MH		 1274 }
1275
6be36555 1276 l2cap_chan_unlock(chan);
4e8402a3
MH		 1277 }
1278
3df91ea2 1279 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1280}
1281
c2287681 1282/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1283 * Returns closest match, locked.
1284 */
d9b88702 1285static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1286 bdaddr_t *src,
1287 bdaddr_t *dst)
b62f328b 1288{
23691d75 1289 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1290
23691d75 1291 read_lock(&chan_list_lock);
b62f328b 1292
23691d75
GP		 1293 list_for_each_entry(c, &chan_list, global_l) {
1294 struct sock *sk = c->sk;
fe4128e0 1295
89bc500e 1296 if (state && c->state != state)
b62f328b
VT		 1297 continue;
1298
23691d75 1299 if (c->scid == cid) {
c2287681
IY		 1300 int src_match, dst_match;
1301 int src_any, dst_any;
1302
b62f328b 1303 /* Exact match. */
c2287681
IY		 1304 src_match = !bacmp(&bt_sk(sk)->src, src);
1305 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1306 if (src_match && dst_match) {
23691d75
GP		 1307 read_unlock(&chan_list_lock);
1308 return c;
1309 }
b62f328b
VT		 1310
1311 /* Closest match */
c2287681
IY		 1312 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1313 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1314 if ((src_match && dst_any) || (src_any && dst_match) ||
1315 (src_any && dst_any))
23691d75 1316 c1 = c;
b62f328b
VT		 1317 }
1318 }
280f294f 1319
23691d75 1320 read_unlock(&chan_list_lock);
b62f328b 1321
23691d75 1322 return c1;
b62f328b
VT		 1323}
1324
1325static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1326{
c916fbe4 1327 struct sock *parent, *sk;
23691d75 1328 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1329
1330 BT_DBG("");
1331
1332 /* Check if we have socket listening on cid */
23691d75 1333 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1334 conn->src, conn->dst);
23691d75 1335 if (!pchan)
b62f328b
VT		 1336 return;
1337
23691d75
GP		 1338 parent = pchan->sk;
1339
aa2ac881 1340 lock_sock(parent);
62f3a2cf 1341
80b98027 1342 chan = pchan->ops->new_connection(pchan);
80808e43 1343 if (!chan)
b62f328b
VT		 1344 goto clean;
1345
80808e43 1346 sk = chan->sk;
5d41ce1d 1347
b62f328b 1348 hci_conn_hold(conn->hcon);
a9ea3ed9 1349 conn->hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
b62f328b 1350
b62f328b
VT		 1351 bacpy(&bt_sk(sk)->src, conn->src);
1352 bacpy(&bt_sk(sk)->dst, conn->dst);
1353
3d57dc68 1354 l2cap_chan_add(conn, chan);
48454079 1355
6754e0df 1356 l2cap_chan_ready(chan);
b62f328b 1357
b62f328b 1358clean:
aa2ac881 1359 release_sock(parent);
b62f328b
VT		 1360}
1361
4e8402a3
MH		 1362static void l2cap_conn_ready(struct l2cap_conn *conn)
1363{
48454079 1364 struct l2cap_chan *chan;
cc110922 1365 struct hci_conn *hcon = conn->hcon;
4e8402a3 1366
79d554a6 1367 BT_DBG("conn %p", conn);
4e8402a3 1368
cc110922 1369 if (!hcon->out && hcon->type == LE_LINK)
b62f328b
VT		 1370 l2cap_le_conn_ready(conn);
1371
cc110922
VCG		 1372 if (hcon->out && hcon->type == LE_LINK)
1373 smp_conn_security(hcon, hcon->pending_sec_level);
160dc6ac 1374
3df91ea2 1375 mutex_lock(&conn->chan_lock);
4e8402a3 1376
3df91ea2 1377 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1378
6be36555 1379 l2cap_chan_lock(chan);
4e8402a3 1380
416fa752
AE		 1381 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
1382 l2cap_chan_unlock(chan);
1383 continue;
1384 }
1385
cc110922
VCG		 1386 if (hcon->type == LE_LINK) {
1387 if (smp_conn_security(hcon, chan->sec_level))
cf4cd009 1388 l2cap_chan_ready(chan);
acd7d370 1389
63128451 1390 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1391 struct sock *sk = chan->sk;
c9b66675 1392 __clear_chan_timer(chan);
6be36555 1393 lock_sock(sk);
0e587be7 1394 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1395 sk->sk_state_change(sk);
6be36555 1396 release_sock(sk);
b501d6a1 1397
89bc500e 1398 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1399 l2cap_do_start(chan);
4e8402a3 1400
6be36555 1401 l2cap_chan_unlock(chan);
4e8402a3 1402 }
79d554a6 1403
3df91ea2 1404 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1405}
1406
1407/* Notify sockets that we cannot guaranty reliability anymore */
1408static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1409{
48454079 1410 struct l2cap_chan *chan;
4e8402a3
MH		 1411
1412 BT_DBG("conn %p", conn);
1413
3df91ea2 1414 mutex_lock(&conn->chan_lock);
4e8402a3 1415
3df91ea2 1416 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1417 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
1d8b1fd5 1418 l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1419 }
1420
3df91ea2 1421 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1422}
1423
f878fcad 1424static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1425{
f878fcad 1426 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1427 info_timer.work);
4e8402a3 1428
984947dc 1429 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1430 conn->info_ident = 0;
984947dc 1431
4e8402a3
MH		 1432 l2cap_conn_start(conn);
1433}
1434
5d3de7df
VCG		 1435static void l2cap_conn_del(struct hci_conn *hcon, int err)
1436{
1437 struct l2cap_conn *conn = hcon->l2cap_data;
1438 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1439
1440 if (!conn)
1441 return;
1442
1443 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1444
1445 kfree_skb(conn->rx_skb);
1446
3df91ea2
AE		 1447 mutex_lock(&conn->chan_lock);
1448
5d3de7df
VCG		 1449 /* Kill channels */
1450 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1451 l2cap_chan_hold(chan);
6be36555
AE		 1452 l2cap_chan_lock(chan);
1453
5d3de7df 1454 l2cap_chan_del(chan, err);
6be36555
AE		 1455
1456 l2cap_chan_unlock(chan);
1457
80b98027 1458 chan->ops->close(chan);
61d6ef3e 1459 l2cap_chan_put(chan);
5d3de7df
VCG		 1460 }
1461
3df91ea2
AE		 1462 mutex_unlock(&conn->chan_lock);
1463
73d80deb
LAD		 1464 hci_chan_del(conn->hchan);
1465
5d3de7df 1466 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1467 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1468
51a8efd7 1469 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1470 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1471 smp_chan_destroy(conn);
d26a2345 1472 }
5d3de7df
VCG		 1473
1474 hcon->l2cap_data = NULL;
1475 kfree(conn);
1476}
1477
6c9d42a1 1478static void security_timeout(struct work_struct *work)
5d3de7df 1479{
6c9d42a1 1480 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
2d792818 1481 security_timer.work);
5d3de7df 1482
d06cc416
JH		 1483 BT_DBG("conn %p", conn);
1484
1485 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1486 smp_chan_destroy(conn);
1487 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1488 }
5d3de7df
VCG		 1489}
1490
1da177e4
LT		 1491static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1492{
0139418c 1493 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1494 struct hci_chan *hchan;
1da177e4 1495
0139418c 1496 if (conn || status)
1da177e4
LT		 1497 return conn;
1498
73d80deb
LAD		 1499 hchan = hci_chan_create(hcon);
1500 if (!hchan)
1501 return NULL;
1502
8bcde1f2 1503 conn = kzalloc(sizeof(struct l2cap_conn), GFP_KERNEL);
73d80deb
LAD		 1504 if (!conn) {
1505 hci_chan_del(hchan);
1da177e4 1506 return NULL;
73d80deb 1507 }
1da177e4
LT		 1508
1509 hcon->l2cap_data = conn;
1510 conn->hcon = hcon;
73d80deb 1511 conn->hchan = hchan;
1da177e4 1512
73d80deb 1513 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1514
dcc042d5
AE		 1515 switch (hcon->type) {
1516 case AMP_LINK:
1517 conn->mtu = hcon->hdev->block_mtu;
1518 break;
1519
1520 case LE_LINK:
1521 if (hcon->hdev->le_mtu) {
1522 conn->mtu = hcon->hdev->le_mtu;
1523 break;
1524 }
1525 /* fall through */
1526
1527 default:
acd7d370 1528 conn->mtu = hcon->hdev->acl_mtu;
dcc042d5
AE		 1529 break;
1530 }
acd7d370 1531
1da177e4
LT		 1532 conn->src = &hcon->hdev->bdaddr;
1533 conn->dst = &hcon->dst;
1534
4e8402a3
MH		 1535 conn->feat_mask = 0;
1536
1da177e4 1537 spin_lock_init(&conn->lock);
3df91ea2 1538 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1539
1540 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1541
5d3de7df 1542 if (hcon->type == LE_LINK)
6c9d42a1 1543 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1544 else
030013d8 1545 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1546
9f5a0d7b 1547 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1548
1da177e4
LT		 1549 return conn;
1550}
1551
1da177e4 1552/* ---- Socket interface ---- */
1da177e4 1553
c2287681 1554/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1555 * Returns closest match.
1556 */
c2287681
IY		 1557static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1558 bdaddr_t *src,
1559 bdaddr_t *dst)
1da177e4 1560{
23691d75 1561 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1562
23691d75 1563 read_lock(&chan_list_lock);
e0f0cb56 1564
23691d75
GP		 1565 list_for_each_entry(c, &chan_list, global_l) {
1566 struct sock *sk = c->sk;
fe4128e0 1567
89bc500e 1568 if (state && c->state != state)
1da177e4
LT		 1569 continue;
1570
23691d75 1571 if (c->psm == psm) {
c2287681
IY		 1572 int src_match, dst_match;
1573 int src_any, dst_any;
1574
1da177e4 1575 /* Exact match. */
c2287681
IY		 1576 src_match = !bacmp(&bt_sk(sk)->src, src);
1577 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1578 if (src_match && dst_match) {
a7567b20 1579 read_unlock(&chan_list_lock);
23691d75
GP		 1580 return c;
1581 }
1da177e4
LT		 1582
1583 /* Closest match */
c2287681
IY		 1584 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1585 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1586 if ((src_match && dst_any) || (src_any && dst_match) ||
1587 (src_any && dst_any))
23691d75 1588 c1 = c;
1da177e4
LT		 1589 }
1590 }
1da177e4 1591
23691d75 1592 read_unlock(&chan_list_lock);
e0f0cb56 1593
23691d75 1594 return c1;
1da177e4
LT		 1595}
1596
8e9f9892
AG		 1597int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1598 bdaddr_t *dst, u8 dst_type)
1da177e4 1599{
5d41ce1d 1600 struct sock *sk = chan->sk;
1da177e4 1601 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1602 struct l2cap_conn *conn;
1603 struct hci_conn *hcon;
1604 struct hci_dev *hdev;
09ab6f4c 1605 __u8 auth_type;
44d0e48e 1606 int err;
1da177e4 1607
6ed93dc6 1608 BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", src, dst,
ab19516a 1609 dst_type, __le16_to_cpu(psm));
1da177e4 1610
af05b30b
GP		 1611 hdev = hci_get_route(dst, src);
1612 if (!hdev)
1da177e4
LT		 1613 return -EHOSTUNREACH;
1614
09fd0de5 1615 hci_dev_lock(hdev);
1da177e4 1616
6be36555 1617 l2cap_chan_lock(chan);
03a00194
GP		 1618
1619 /* PSM must be odd and lsb of upper byte must be 0 */
1620 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
2d792818 1621 chan->chan_type != L2CAP_CHAN_RAW) {
03a00194
GP		 1622 err = -EINVAL;
1623 goto done;
1624 }
1625
1626 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1627 err = -EINVAL;
1628 goto done;
1629 }
1630
1631 switch (chan->mode) {
1632 case L2CAP_MODE_BASIC:
1633 break;
1634 case L2CAP_MODE_ERTM:
1635 case L2CAP_MODE_STREAMING:
1636 if (!disable_ertm)
1637 break;
1638 /* fall through */
1639 default:
1640 err = -ENOTSUPP;
1641 goto done;
1642 }
1643
0797e01d 1644 switch (chan->state) {
03a00194
GP		 1645 case BT_CONNECT:
1646 case BT_CONNECT2:
1647 case BT_CONFIG:
1648 /* Already connecting */
1649 err = 0;
1650 goto done;
1651
1652 case BT_CONNECTED:
1653 /* Already connected */
1654 err = -EISCONN;
1655 goto done;
1656
1657 case BT_OPEN:
1658 case BT_BOUND:
1659 /* Can connect */
1660 break;
1661
1662 default:
1663 err = -EBADFD;
1664 goto done;
1665 }
1666
1667 /* Set destination address and psm */
0797e01d 1668 lock_sock(sk);
9219b2a0 1669 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1670 release_sock(sk);
1671
03a00194
GP		 1672 chan->psm = psm;
1673 chan->dcid = cid;
1da177e4 1674
4343478f 1675 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1676
fe4128e0 1677 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1678 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1679 chan->sec_level, auth_type);
acd7d370 1680 else
8e9f9892 1681 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1682 chan->sec_level, auth_type);
acd7d370 1683
30e76272
VT		 1684 if (IS_ERR(hcon)) {
1685 err = PTR_ERR(hcon);
1da177e4 1686 goto done;
30e76272 1687 }
1da177e4
LT		 1688
1689 conn = l2cap_conn_add(hcon, 0);
1690 if (!conn) {
1691 hci_conn_put(hcon);
30e76272 1692 err = -ENOMEM;
1da177e4
LT		 1693 goto done;
1694 }
1695
9f0caeb1
VCG		 1696 if (hcon->type == LE_LINK) {
1697 err = 0;
1698
1699 if (!list_empty(&conn->chan_l)) {
1700 err = -EBUSY;
1701 hci_conn_put(hcon);
1702 }
1703
1704 if (err)
1705 goto done;
1706 }
1707
1da177e4
LT		 1708 /* Update source addr of the socket */
1709 bacpy(src, conn->src);
1710
6be36555 1711 l2cap_chan_unlock(chan);
48454079 1712 l2cap_chan_add(conn, chan);
6be36555 1713 l2cap_chan_lock(chan);
48454079 1714
6be36555 1715 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1716 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1717
1718 if (hcon->state == BT_CONNECTED) {
715ec005 1719 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1720 __clear_chan_timer(chan);
d45fc423 1721 if (l2cap_chan_check_security(chan))
6be36555 1722 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1723 } else
fc7f8a7e 1724 l2cap_do_start(chan);
1da177e4
LT		 1725 }
1726
30e76272
VT		 1727 err = 0;
1728
1da177e4 1729done:
6be36555 1730 l2cap_chan_unlock(chan);
09fd0de5 1731 hci_dev_unlock(hdev);
1da177e4
LT		 1732 hci_dev_put(hdev);
1733 return err;
1734}
1735
dcba0dba 1736int __l2cap_wait_ack(struct sock *sk)
6161c038 1737{
8c1d787b 1738 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1739 DECLARE_WAITQUEUE(wait, current);
1740 int err = 0;
1741 int timeo = HZ/5;
1742
2b0b05dd 1743 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1744 set_current_state(TASK_INTERRUPTIBLE);
1745 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1746 if (!timeo)
1747 timeo = HZ/5;
1748
1749 if (signal_pending(current)) {
1750 err = sock_intr_errno(timeo);
1751 break;
1752 }
1753
1754 release_sock(sk);
1755 timeo = schedule_timeout(timeo);
1756 lock_sock(sk);
a71a0cf4 1757 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1758
1759 err = sock_error(sk);
1760 if (err)
1761 break;
1762 }
1763 set_current_state(TASK_RUNNING);
2b0b05dd 1764 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1765 return err;
1766}
1767
721c4181 1768static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1769{
721c4181 1770 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1771 monitor_timer.work);
e90bac06 1772
525cd185 1773 BT_DBG("chan %p", chan);
0e98958d 1774
6be36555
AE		 1775 l2cap_chan_lock(chan);
1776
80909e04 1777 if (!chan->conn) {
6be36555 1778 l2cap_chan_unlock(chan);
8d7e1c7f 1779 l2cap_chan_put(chan);
e90bac06
GP		 1780 return;
1781 }
1782
401bb1f7 1783 l2cap_tx(chan, NULL, NULL, L2CAP_EV_MONITOR_TO);
e90bac06 1784
6be36555 1785 l2cap_chan_unlock(chan);
8d7e1c7f 1786 l2cap_chan_put(chan);
e90bac06
GP		 1787}
1788
721c4181 1789static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1790{
721c4181 1791 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
4239d16f 1792 retrans_timer.work);
e90bac06 1793
49208c9c 1794 BT_DBG("chan %p", chan);
0e98958d 1795
6be36555
AE		 1796 l2cap_chan_lock(chan);
1797
80909e04
MM		 1798 if (!chan->conn) {
1799 l2cap_chan_unlock(chan);
1800 l2cap_chan_put(chan);
1801 return;
1802 }
6be36555 1803
401bb1f7 1804 l2cap_tx(chan, NULL, NULL, L2CAP_EV_RETRANS_TO);
6be36555 1805 l2cap_chan_unlock(chan);
8d7e1c7f 1806 l2cap_chan_put(chan);
e90bac06
GP		 1807}
1808
d660366d
GP		 1809static void l2cap_streaming_send(struct l2cap_chan *chan,
1810 struct sk_buff_head *skbs)
6840ed07 1811{
ccbb84af 1812 struct sk_buff *skb;
3733937d 1813 struct l2cap_ctrl *control;
6840ed07 1814
3733937d
MM		 1815 BT_DBG("chan %p, skbs %p", chan, skbs);
1816
b99e13ad
MM		 1817 if (__chan_is_moving(chan))
1818 return;
1819
3733937d
MM		 1820 skb_queue_splice_tail_init(skbs, &chan->tx_q);
1821
1822 while (!skb_queue_empty(&chan->tx_q)) {
1823
1824 skb = skb_dequeue(&chan->tx_q);
1825
1826 bt_cb(skb)->control.retries = 1;
1827 control = &bt_cb(skb)->control;
1828
1829 control->reqseq = 0;
1830 control->txseq = chan->next_tx_seq;
1831
1832 __pack_control(chan, control, skb);
6840ed07 1833
47d1ec61 1834 if (chan->fcs == L2CAP_FCS_CRC16) {
3733937d
MM		 1835 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1836 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1837 }
1838
4343478f 1839 l2cap_do_send(chan, skb);
6840ed07 1840
b4400672 1841 BT_DBG("Sent txseq %u", control->txseq);
3733937d 1842
836be934 1843 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
3733937d 1844 chan->frames_sent++;
6840ed07 1845 }
6840ed07
GP		 1846}
1847
67c9e840 1848static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1849{
1850 struct sk_buff *skb, *tx_skb;
18a48e76
MM		 1851 struct l2cap_ctrl *control;
1852 int sent = 0;
1853
1854 BT_DBG("chan %p", chan);
1c2acffb 1855
89bc500e 1856 if (chan->state != BT_CONNECTED)
c13ffa62 1857 return -ENOTCONN;
e90bac06 1858
94122bbe
MM		 1859 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1860 return 0;
1861
b99e13ad
MM		 1862 if (__chan_is_moving(chan))
1863 return 0;
1864
18a48e76
MM		 1865 while (chan->tx_send_head &&
1866 chan->unacked_frames < chan->remote_tx_win &&
1867 chan->tx_state == L2CAP_TX_STATE_XMIT) {
e420aba3 1868
18a48e76 1869 skb = chan->tx_send_head;
e90bac06 1870
18a48e76
MM		 1871 bt_cb(skb)->control.retries = 1;
1872 control = &bt_cb(skb)->control;
95ffa978 1873
e2ab4353 1874 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
18a48e76 1875 control->final = 1;
e2ab4353 1876
18a48e76
MM		 1877 control->reqseq = chan->buffer_seq;
1878 chan->last_acked_seq = chan->buffer_seq;
1879 control->txseq = chan->next_tx_seq;
1c2acffb 1880
18a48e76 1881 __pack_control(chan, control, skb);
e90bac06 1882
47d1ec61 1883 if (chan->fcs == L2CAP_FCS_CRC16) {
18a48e76
MM		 1884 u16 fcs = crc16(0, (u8 *) skb->data, skb->len);
1885 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 1886 }
1887
18a48e76
MM		 1888 /* Clone after data has been modified. Data is assumed to be
1889 read-only (for locking purposes) on cloned sk_buffs.
1890 */
1891 tx_skb = skb_clone(skb, GFP_KERNEL);
9a9c6a34 1892
18a48e76
MM		 1893 if (!tx_skb)
1894 break;
1c2acffb 1895
18a48e76 1896 __set_retrans_timer(chan);
836be934
AE		 1897
1898 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
18a48e76 1899 chan->unacked_frames++;
6a026610 1900 chan->frames_sent++;
18a48e76 1901 sent++;
1c2acffb 1902
58d35f87
GP		 1903 if (skb_queue_is_last(&chan->tx_q, skb))
1904 chan->tx_send_head = NULL;
1c2acffb 1905 else
58d35f87 1906 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
18a48e76
MM		 1907
1908 l2cap_do_send(chan, tx_skb);
b4400672 1909 BT_DBG("Sent txseq %u", control->txseq);
1c2acffb
GP		 1910 }
1911
b4400672
AE		 1912 BT_DBG("Sent %d, %u unacked, %u in ERTM queue", sent,
1913 chan->unacked_frames, skb_queue_len(&chan->tx_q));
18a48e76
MM		 1914
1915 return sent;
9e917af1
GP		 1916}
1917
e1fbd4c1
MM		 1918static void l2cap_ertm_resend(struct l2cap_chan *chan)
1919{
1920 struct l2cap_ctrl control;
1921 struct sk_buff *skb;
1922 struct sk_buff *tx_skb;
1923 u16 seq;
1924
1925 BT_DBG("chan %p", chan);
1926
1927 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
1928 return;
1929
b99e13ad
MM		 1930 if (__chan_is_moving(chan))
1931 return;
1932
e1fbd4c1
MM		 1933 while (chan->retrans_list.head != L2CAP_SEQ_LIST_CLEAR) {
1934 seq = l2cap_seq_list_pop(&chan->retrans_list);
1935
1936 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, seq);
1937 if (!skb) {
1938 BT_DBG("Error: Can't retransmit seq %d, frame missing",
2d792818 1939 seq);
e1fbd4c1
MM		 1940 continue;
1941 }
1942
1943 bt_cb(skb)->control.retries++;
1944 control = bt_cb(skb)->control;
1945
1946 if (chan->max_tx != 0 &&
1947 bt_cb(skb)->control.retries > chan->max_tx) {
1948 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
1949 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
1950 l2cap_seq_list_clear(&chan->retrans_list);
1951 break;
1952 }
1953
1954 control.reqseq = chan->buffer_seq;
1955 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
1956 control.final = 1;
1957 else
1958 control.final = 0;
1959
1960 if (skb_cloned(skb)) {
1961 /* Cloned sk_buffs are read-only, so we need a
1962 * writeable copy
1963 */
8bcde1f2 1964 tx_skb = skb_copy(skb, GFP_KERNEL);
e1fbd4c1 1965 } else {
8bcde1f2 1966 tx_skb = skb_clone(skb, GFP_KERNEL);
e1fbd4c1
MM		 1967 }
1968
1969 if (!tx_skb) {
1970 l2cap_seq_list_clear(&chan->retrans_list);
1971 break;
1972 }
1973
1974 /* Update skb contents */
1975 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
1976 put_unaligned_le32(__pack_extended_control(&control),
1977 tx_skb->data + L2CAP_HDR_SIZE);
1978 } else {
1979 put_unaligned_le16(__pack_enhanced_control(&control),
1980 tx_skb->data + L2CAP_HDR_SIZE);
1981 }
1982
1983 if (chan->fcs == L2CAP_FCS_CRC16) {
1984 u16 fcs = crc16(0, (u8 *) tx_skb->data, tx_skb->len);
1985 put_unaligned_le16(fcs, skb_put(tx_skb,
1986 L2CAP_FCS_SIZE));
1987 }
1988
1989 l2cap_do_send(chan, tx_skb);
1990
1991 BT_DBG("Resent txseq %d", control.txseq);
1992
1993 chan->last_acked_seq = chan->buffer_seq;
1994 }
1995}
1996
f80842a8
MM		 1997static void l2cap_retransmit(struct l2cap_chan *chan,
1998 struct l2cap_ctrl *control)
1999{
2000 BT_DBG("chan %p, control %p", chan, control);
2001
2002 l2cap_seq_list_append(&chan->retrans_list, control->reqseq);
2003 l2cap_ertm_resend(chan);
2004}
2005
d2a7ac5d
MM		 2006static void l2cap_retransmit_all(struct l2cap_chan *chan,
2007 struct l2cap_ctrl *control)
2008{
e1fbd4c1
MM		 2009 struct sk_buff *skb;
2010
2011 BT_DBG("chan %p, control %p", chan, control);
2012
2013 if (control->poll)
2014 set_bit(CONN_SEND_FBIT, &chan->conn_state);
2015
2016 l2cap_seq_list_clear(&chan->retrans_list);
2017
2018 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
2019 return;
2020
2021 if (chan->unacked_frames) {
2022 skb_queue_walk(&chan->tx_q, skb) {
2023 if (bt_cb(skb)->control.txseq == control->reqseq ||
2d792818 2024 skb == chan->tx_send_head)
e1fbd4c1
MM		 2025 break;
2026 }
2027
2028 skb_queue_walk_from(&chan->tx_q, skb) {
2029 if (skb == chan->tx_send_head)
2030 break;
2031
2032 l2cap_seq_list_append(&chan->retrans_list,
2033 bt_cb(skb)->control.txseq);
2034 }
2035
2036 l2cap_ertm_resend(chan);
2037 }
d2a7ac5d
MM		 2038}
2039
0a0aba42 2040static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 2041{
0a0aba42
MM		 2042 struct l2cap_ctrl control;
2043 u16 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2044 chan->last_acked_seq);
2045 int threshold;
9e917af1 2046
0a0aba42
MM		 2047 BT_DBG("chan %p last_acked_seq %d buffer_seq %d",
2048 chan, chan->last_acked_seq, chan->buffer_seq);
9e917af1 2049
0a0aba42
MM		 2050 memset(&control, 0, sizeof(control));
2051 control.sframe = 1;
dfc909be 2052
0a0aba42
MM		 2053 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
2054 chan->rx_state == L2CAP_RX_STATE_RECV) {
2055 __clear_ack_timer(chan);
2056 control.super = L2CAP_SUPER_RNR;
2057 control.reqseq = chan->buffer_seq;
2058 l2cap_send_sframe(chan, &control);
2059 } else {
2060 if (!test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) {
2061 l2cap_ertm_send(chan);
2062 /* If any i-frames were sent, they included an ack */
2063 if (chan->buffer_seq == chan->last_acked_seq)
2064 frames_to_ack = 0;
2065 }
dfc909be 2066
c20f8e35 2067 /* Ack now if the window is 3/4ths full.
0a0aba42
MM		 2068 * Calculate without mul or div
2069 */
c20f8e35 2070 threshold = chan->ack_win;
0a0aba42
MM		 2071 threshold += threshold << 1;
2072 threshold >>= 2;
2073
b4400672 2074 BT_DBG("frames_to_ack %u, threshold %d", frames_to_ack,
0a0aba42
MM		 2075 threshold);
2076
2077 if (frames_to_ack >= threshold) {
2078 __clear_ack_timer(chan);
2079 control.super = L2CAP_SUPER_RR;
2080 control.reqseq = chan->buffer_seq;
2081 l2cap_send_sframe(chan, &control);
2082 frames_to_ack = 0;
2083 }
1c2acffb 2084
0a0aba42
MM		 2085 if (frames_to_ack)
2086 __set_ack_timer(chan);
2087 }
b17e73bb
SJ		 2088}
2089
04124681
GP		 2090static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
2091 struct msghdr *msg, int len,
2092 int count, struct sk_buff *skb)
1c2acffb 2093{
0952a57a 2094 struct l2cap_conn *conn = chan->conn;
1c2acffb 2095 struct sk_buff **frag;
90338947 2096 int sent = 0;
1da177e4 2097
59203a21 2098 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 2099 return -EFAULT;
1da177e4
LT		 2100
2101 sent += count;
2102 len -= count;
2103
2104 /* Continuation fragments (no L2CAP header) */
2105 frag = &skb_shinfo(skb)->frag_list;
2106 while (len) {
fbe00700
GP		 2107 struct sk_buff *tmp;
2108
1da177e4
LT		 2109 count = min_t(unsigned int, conn->mtu, len);
2110
fbe00700
GP		 2111 tmp = chan->ops->alloc_skb(chan, count,
2112 msg->msg_flags & MSG_DONTWAIT);
2113 if (IS_ERR(tmp))
2114 return PTR_ERR(tmp);
2115
2116 *frag = tmp;
2f7719ce 2117
1c2acffb
GP		 2118 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
2119 return -EFAULT;
1da177e4 2120
5e59b791
LAD		 2121 (*frag)->priority = skb->priority;
2122
1da177e4
LT		 2123 sent += count;
2124 len -= count;
2125
2d0ed3d5
GP		 2126 skb->len += (*frag)->len;
2127 skb->data_len += (*frag)->len;
2128
1da177e4
LT		 2129 frag = &(*frag)->next;
2130 }
1da177e4
LT		 2131
2132 return sent;
1c2acffb 2133}
1da177e4 2134
5e59b791 2135static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
b4400672
AE		 2136 struct msghdr *msg, size_t len,
2137 u32 priority)
1c2acffb 2138{
8c1d787b 2139 struct l2cap_conn *conn = chan->conn;
1c2acffb 2140 struct sk_buff *skb;
03a51213 2141 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 2142 struct l2cap_hdr *lh;
2143
b4400672 2144 BT_DBG("chan %p len %zu priority %u", chan, len, priority);
1c2acffb
GP		 2145
2146 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2147
2148 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2149 msg->msg_flags & MSG_DONTWAIT);
2150 if (IS_ERR(skb))
2151 return skb;
1c2acffb 2152
5e59b791
LAD		 2153 skb->priority = priority;
2154
1c2acffb
GP		 2155 /* Create L2CAP header */
2156 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2157 lh->cid = cpu_to_le16(chan->dcid);
daf6a78c
AE		 2158 lh->len = cpu_to_le16(len + L2CAP_PSMLEN_SIZE);
2159 put_unaligned(chan->psm, skb_put(skb, L2CAP_PSMLEN_SIZE));
1c2acffb 2160
0952a57a 2161 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2162 if (unlikely(err < 0)) {
2163 kfree_skb(skb);
2164 return ERR_PTR(err);
2165 }
2166 return skb;
2167}
2168
5e59b791 2169static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
b4400672
AE		 2170 struct msghdr *msg, size_t len,
2171 u32 priority)
1c2acffb 2172{
8c1d787b 2173 struct l2cap_conn *conn = chan->conn;
1c2acffb 2174 struct sk_buff *skb;
f2ba7fae 2175 int err, count;
1c2acffb
GP		 2176 struct l2cap_hdr *lh;
2177
b4400672 2178 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2179
f2ba7fae 2180 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 2181
f2ba7fae 2182 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 2183 msg->msg_flags & MSG_DONTWAIT);
2184 if (IS_ERR(skb))
2185 return skb;
1c2acffb 2186
5e59b791
LAD		 2187 skb->priority = priority;
2188
1c2acffb
GP		 2189 /* Create L2CAP header */
2190 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2191 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 2192 lh->len = cpu_to_le16(len);
1c2acffb 2193
0952a57a 2194 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2195 if (unlikely(err < 0)) {
2196 kfree_skb(skb);
2197 return ERR_PTR(err);
2198 }
2199 return skb;
2200}
2201
ab0ff76d 2202static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
b4400672
AE		 2203 struct msghdr *msg, size_t len,
2204 u16 sdulen)
1c2acffb 2205{
8c1d787b 2206 struct l2cap_conn *conn = chan->conn;
1c2acffb 2207 struct sk_buff *skb;
e4ca6d98 2208 int err, count, hlen;
1c2acffb
GP		 2209 struct l2cap_hdr *lh;
2210
b4400672 2211 BT_DBG("chan %p len %zu", chan, len);
1c2acffb 2212
0ee0d208
GP		 2213 if (!conn)
2214 return ERR_PTR(-ENOTCONN);
2215
ba7aa64f 2216 hlen = __ertm_hdr_size(chan);
e4ca6d98 2217
c74e560c 2218 if (sdulen)
03a51213 2219 hlen += L2CAP_SDULEN_SIZE;
c74e560c 2220
47d1ec61 2221 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 2222 hlen += L2CAP_FCS_SIZE;
fcc203c3 2223
1c2acffb 2224 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 2225
2226 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 2227 msg->msg_flags & MSG_DONTWAIT);
2228 if (IS_ERR(skb))
2229 return skb;
1c2acffb
GP		 2230
2231 /* Create L2CAP header */
2232 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 2233 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 2234 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0 2235
18a48e76
MM		 2236 /* Control header is populated later */
2237 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2238 put_unaligned_le32(0, skb_put(skb, L2CAP_EXT_CTRL_SIZE));
2239 else
2240 put_unaligned_le16(0, skb_put(skb, L2CAP_ENH_CTRL_SIZE));
88843ab0 2241
c74e560c 2242 if (sdulen)
03a51213 2243 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 2244
0952a57a 2245 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 2246 if (unlikely(err < 0)) {
2247 kfree_skb(skb);
2248 return ERR_PTR(err);
2249 }
e90bac06 2250
18a48e76 2251 bt_cb(skb)->control.fcs = chan->fcs;
3ce3514f 2252 bt_cb(skb)->control.retries = 0;
1c2acffb 2253 return skb;
1da177e4
LT		 2254}
2255
94122bbe
MM		 2256static int l2cap_segment_sdu(struct l2cap_chan *chan,
2257 struct sk_buff_head *seg_queue,
2258 struct msghdr *msg, size_t len)
c74e560c 2259{
c74e560c 2260 struct sk_buff *skb;
94122bbe
MM		 2261 u16 sdu_len;
2262 size_t pdu_len;
94122bbe 2263 u8 sar;
c74e560c 2264
b4400672 2265 BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
c74e560c 2266
94122bbe
MM		 2267 /* It is critical that ERTM PDUs fit in a single HCI fragment,
2268 * so fragmented skbs are not used. The HCI layer's handling
2269 * of fragmented skbs is not compatible with ERTM's queueing.
2270 */
c74e560c 2271
94122bbe
MM		 2272 /* PDU size is derived from the HCI MTU */
2273 pdu_len = chan->conn->mtu;
c74e560c 2274
94122bbe
MM		 2275 pdu_len = min_t(size_t, pdu_len, L2CAP_BREDR_MAX_PAYLOAD);
2276
2277 /* Adjust for largest possible L2CAP overhead. */
35d401df
GP		 2278 if (chan->fcs)
2279 pdu_len -= L2CAP_FCS_SIZE;
2280
ba7aa64f 2281 pdu_len -= __ertm_hdr_size(chan);
94122bbe
MM		 2282
2283 /* Remote device may have requested smaller PDUs */
2284 pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
2285
2286 if (len <= pdu_len) {
2287 sar = L2CAP_SAR_UNSEGMENTED;
2288 sdu_len = 0;
2289 pdu_len = len;
2290 } else {
2291 sar = L2CAP_SAR_START;
2292 sdu_len = len;
2293 pdu_len -= L2CAP_SDULEN_SIZE;
2294 }
2295
2296 while (len > 0) {
2297 skb = l2cap_create_iframe_pdu(chan, msg, pdu_len, sdu_len);
c74e560c 2298
c74e560c 2299 if (IS_ERR(skb)) {
94122bbe 2300 __skb_queue_purge(seg_queue);
c74e560c
GP		 2301 return PTR_ERR(skb);
2302 }
2303
94122bbe
MM		 2304 bt_cb(skb)->control.sar = sar;
2305 __skb_queue_tail(seg_queue, skb);
2306
2307 len -= pdu_len;
2308 if (sdu_len) {
2309 sdu_len = 0;
2310 pdu_len += L2CAP_SDULEN_SIZE;
2311 }
2312
2313 if (len <= pdu_len) {
2314 sar = L2CAP_SAR_END;
2315 pdu_len = len;
2316 } else {
2317 sar = L2CAP_SAR_CONTINUE;
2318 }
c74e560c 2319 }
c74e560c 2320
f0f62799 2321 return 0;
c74e560c
GP		 2322}
2323
5e59b791 2324int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2d792818 2325 u32 priority)
9a91a04a 2326{
9a91a04a 2327 struct sk_buff *skb;
9a91a04a 2328 int err;
94122bbe 2329 struct sk_buff_head seg_queue;
9a91a04a
GP		 2330
2331 /* Connectionless channel */
715ec005 2332 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2333 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2334 if (IS_ERR(skb))
2335 return PTR_ERR(skb);
2336
2337 l2cap_do_send(chan, skb);
2338 return len;
2339 }
2340
2341 switch (chan->mode) {
2342 case L2CAP_MODE_BASIC:
2343 /* Check outgoing MTU */
2344 if (len > chan->omtu)
2345 return -EMSGSIZE;
2346
2347 /* Create a basic PDU */
5e59b791 2348 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2349 if (IS_ERR(skb))
2350 return PTR_ERR(skb);
2351
2352 l2cap_do_send(chan, skb);
2353 err = len;
2354 break;
2355
2356 case L2CAP_MODE_ERTM:
2357 case L2CAP_MODE_STREAMING:
94122bbe
MM		 2358 /* Check outgoing MTU */
2359 if (len > chan->omtu) {
2360 err = -EMSGSIZE;
2361 break;
2362 }
9a91a04a 2363
94122bbe 2364 __skb_queue_head_init(&seg_queue);
9a91a04a 2365
94122bbe
MM		 2366 /* Do segmentation before calling in to the state machine,
2367 * since it's possible to block while waiting for memory
2368 * allocation.
2369 */
2370 err = l2cap_segment_sdu(chan, &seg_queue, msg, len);
9a91a04a 2371
94122bbe
MM		 2372 /* The channel could have been closed while segmenting,
2373 * check that it is still connected.
2374 */
2375 if (chan->state != BT_CONNECTED) {
2376 __skb_queue_purge(&seg_queue);
2377 err = -ENOTCONN;
9a91a04a
GP		 2378 }
2379
94122bbe 2380 if (err)
9a91a04a 2381 break;
9a91a04a 2382
3733937d 2383 if (chan->mode == L2CAP_MODE_ERTM)
d660366d 2384 l2cap_tx(chan, NULL, &seg_queue, L2CAP_EV_DATA_REQUEST);
3733937d 2385 else
d660366d 2386 l2cap_streaming_send(chan, &seg_queue);
9a91a04a 2387
d660366d 2388 err = len;
9a91a04a 2389
94122bbe
MM		 2390 /* If the skbs were not queued for sending, they'll still be in
2391 * seg_queue and need to be purged.
2392 */
2393 __skb_queue_purge(&seg_queue);
9a91a04a
GP		 2394 break;
2395
2396 default:
2397 BT_DBG("bad state %1.1x", chan->mode);
2398 err = -EBADFD;
2399 }
2400
2401 return err;
2402}
2403
d2a7ac5d
MM		 2404static void l2cap_send_srej(struct l2cap_chan *chan, u16 txseq)
2405{
bed68bde
MM		 2406 struct l2cap_ctrl control;
2407 u16 seq;
2408
b4400672 2409 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2410
2411 memset(&control, 0, sizeof(control));
2412 control.sframe = 1;
2413 control.super = L2CAP_SUPER_SREJ;
2414
2415 for (seq = chan->expected_tx_seq; seq != txseq;
2416 seq = __next_seq(chan, seq)) {
2417 if (!l2cap_ertm_seq_in_queue(&chan->srej_q, seq)) {
2418 control.reqseq = seq;
2419 l2cap_send_sframe(chan, &control);
2420 l2cap_seq_list_append(&chan->srej_list, seq);
2421 }
2422 }
2423
2424 chan->expected_tx_seq = __next_seq(chan, txseq);
d2a7ac5d
MM		 2425}
2426
2427static void l2cap_send_srej_tail(struct l2cap_chan *chan)
2428{
bed68bde
MM		 2429 struct l2cap_ctrl control;
2430
2431 BT_DBG("chan %p", chan);
2432
2433 if (chan->srej_list.tail == L2CAP_SEQ_LIST_CLEAR)
2434 return;
2435
2436 memset(&control, 0, sizeof(control));
2437 control.sframe = 1;
2438 control.super = L2CAP_SUPER_SREJ;
2439 control.reqseq = chan->srej_list.tail;
2440 l2cap_send_sframe(chan, &control);
d2a7ac5d
MM		 2441}
2442
2443static void l2cap_send_srej_list(struct l2cap_chan *chan, u16 txseq)
2444{
bed68bde
MM		 2445 struct l2cap_ctrl control;
2446 u16 initial_head;
2447 u16 seq;
2448
b4400672 2449 BT_DBG("chan %p, txseq %u", chan, txseq);
bed68bde
MM		 2450
2451 memset(&control, 0, sizeof(control));
2452 control.sframe = 1;
2453 control.super = L2CAP_SUPER_SREJ;
2454
2455 /* Capture initial list head to allow only one pass through the list. */
2456 initial_head = chan->srej_list.head;
2457
2458 do {
2459 seq = l2cap_seq_list_pop(&chan->srej_list);
2460 if (seq == txseq || seq == L2CAP_SEQ_LIST_CLEAR)
2461 break;
2462
2463 control.reqseq = seq;
2464 l2cap_send_sframe(chan, &control);
2465 l2cap_seq_list_append(&chan->srej_list, seq);
2466 } while (chan->srej_list.head != initial_head);
d2a7ac5d
MM		 2467}
2468
608bcc6d
MM		 2469static void l2cap_process_reqseq(struct l2cap_chan *chan, u16 reqseq)
2470{
2471 struct sk_buff *acked_skb;
2472 u16 ackseq;
2473
b4400672 2474 BT_DBG("chan %p, reqseq %u", chan, reqseq);
608bcc6d
MM		 2475
2476 if (chan->unacked_frames == 0 || reqseq == chan->expected_ack_seq)
2477 return;
2478
b4400672 2479 BT_DBG("expected_ack_seq %u, unacked_frames %u",
608bcc6d
MM		 2480 chan->expected_ack_seq, chan->unacked_frames);
2481
2482 for (ackseq = chan->expected_ack_seq; ackseq != reqseq;
2483 ackseq = __next_seq(chan, ackseq)) {
2484
2485 acked_skb = l2cap_ertm_seq_in_queue(&chan->tx_q, ackseq);
2486 if (acked_skb) {
2487 skb_unlink(acked_skb, &chan->tx_q);
2488 kfree_skb(acked_skb);
2489 chan->unacked_frames--;
2490 }
2491 }
2492
2493 chan->expected_ack_seq = reqseq;
2494
2495 if (chan->unacked_frames == 0)
2496 __clear_retrans_timer(chan);
2497
b4400672 2498 BT_DBG("unacked_frames %u", chan->unacked_frames);
608bcc6d
MM		 2499}
2500
2501static void l2cap_abort_rx_srej_sent(struct l2cap_chan *chan)
2502{
2503 BT_DBG("chan %p", chan);
2504
2505 chan->expected_tx_seq = chan->buffer_seq;
2506 l2cap_seq_list_clear(&chan->srej_list);
2507 skb_queue_purge(&chan->srej_q);
2508 chan->rx_state = L2CAP_RX_STATE_RECV;
2509}
2510
d660366d
GP		 2511static void l2cap_tx_state_xmit(struct l2cap_chan *chan,
2512 struct l2cap_ctrl *control,
2513 struct sk_buff_head *skbs, u8 event)
608bcc6d 2514{
608bcc6d
MM		 2515 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2516 event);
2517
2518 switch (event) {
2519 case L2CAP_EV_DATA_REQUEST:
2520 if (chan->tx_send_head == NULL)
2521 chan->tx_send_head = skb_peek(skbs);
2522
2523 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2524 l2cap_ertm_send(chan);
2525 break;
2526 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2527 BT_DBG("Enter LOCAL_BUSY");
2528 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2529
2530 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2531 /* The SREJ_SENT state must be aborted if we are to
2532 * enter the LOCAL_BUSY state.
2533 */
2534 l2cap_abort_rx_srej_sent(chan);
2535 }
2536
2537 l2cap_send_ack(chan);
2538
2539 break;
2540 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2541 BT_DBG("Exit LOCAL_BUSY");
2542 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2543
2544 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2545 struct l2cap_ctrl local_control;
2546
2547 memset(&local_control, 0, sizeof(local_control));
2548 local_control.sframe = 1;
2549 local_control.super = L2CAP_SUPER_RR;
2550 local_control.poll = 1;
2551 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2552 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2553
2554 chan->retry_count = 1;
2555 __set_monitor_timer(chan);
2556 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2557 }
2558 break;
2559 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2560 l2cap_process_reqseq(chan, control->reqseq);
2561 break;
2562 case L2CAP_EV_EXPLICIT_POLL:
2563 l2cap_send_rr_or_rnr(chan, 1);
2564 chan->retry_count = 1;
2565 __set_monitor_timer(chan);
2566 __clear_ack_timer(chan);
2567 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2568 break;
2569 case L2CAP_EV_RETRANS_TO:
2570 l2cap_send_rr_or_rnr(chan, 1);
2571 chan->retry_count = 1;
2572 __set_monitor_timer(chan);
2573 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2574 break;
2575 case L2CAP_EV_RECV_FBIT:
2576 /* Nothing to process */
2577 break;
2578 default:
2579 break;
2580 }
608bcc6d
MM		 2581}
2582
d660366d
GP		 2583static void l2cap_tx_state_wait_f(struct l2cap_chan *chan,
2584 struct l2cap_ctrl *control,
2585 struct sk_buff_head *skbs, u8 event)
608bcc6d 2586{
608bcc6d
MM		 2587 BT_DBG("chan %p, control %p, skbs %p, event %d", chan, control, skbs,
2588 event);
2589
2590 switch (event) {
2591 case L2CAP_EV_DATA_REQUEST:
2592 if (chan->tx_send_head == NULL)
2593 chan->tx_send_head = skb_peek(skbs);
2594 /* Queue data, but don't send. */
2595 skb_queue_splice_tail_init(skbs, &chan->tx_q);
2596 break;
2597 case L2CAP_EV_LOCAL_BUSY_DETECTED:
2598 BT_DBG("Enter LOCAL_BUSY");
2599 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2600
2601 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
2602 /* The SREJ_SENT state must be aborted if we are to
2603 * enter the LOCAL_BUSY state.
2604 */
2605 l2cap_abort_rx_srej_sent(chan);
2606 }
2607
2608 l2cap_send_ack(chan);
2609
2610 break;
2611 case L2CAP_EV_LOCAL_BUSY_CLEAR:
2612 BT_DBG("Exit LOCAL_BUSY");
2613 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
2614
2615 if (test_bit(CONN_RNR_SENT, &chan->conn_state)) {
2616 struct l2cap_ctrl local_control;
2617 memset(&local_control, 0, sizeof(local_control));
2618 local_control.sframe = 1;
2619 local_control.super = L2CAP_SUPER_RR;
2620 local_control.poll = 1;
2621 local_control.reqseq = chan->buffer_seq;
a67d7f6f 2622 l2cap_send_sframe(chan, &local_control);
608bcc6d
MM		 2623
2624 chan->retry_count = 1;
2625 __set_monitor_timer(chan);
2626 chan->tx_state = L2CAP_TX_STATE_WAIT_F;
2627 }
2628 break;
2629 case L2CAP_EV_RECV_REQSEQ_AND_FBIT:
2630 l2cap_process_reqseq(chan, control->reqseq);
2631
2632 /* Fall through */
2633
2634 case L2CAP_EV_RECV_FBIT:
2635 if (control && control->final) {
2636 __clear_monitor_timer(chan);
2637 if (chan->unacked_frames > 0)
2638 __set_retrans_timer(chan);
2639 chan->retry_count = 0;
2640 chan->tx_state = L2CAP_TX_STATE_XMIT;
2641 BT_DBG("recv fbit tx_state 0x2.2%x", chan->tx_state);
2642 }
2643 break;
2644 case L2CAP_EV_EXPLICIT_POLL:
2645 /* Ignore */
2646 break;
2647 case L2CAP_EV_MONITOR_TO:
2648 if (chan->max_tx == 0 || chan->retry_count < chan->max_tx) {
2649 l2cap_send_rr_or_rnr(chan, 1);
2650 __set_monitor_timer(chan);
2651 chan->retry_count++;
2652 } else {
2653 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
2654 }
2655 break;
2656 default:
2657 break;
2658 }
608bcc6d
MM		 2659}
2660
d660366d
GP		 2661static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
2662 struct sk_buff_head *skbs, u8 event)
608bcc6d 2663{
608bcc6d
MM		 2664 BT_DBG("chan %p, control %p, skbs %p, event %d, state %d",
2665 chan, control, skbs, event, chan->tx_state);
2666
2667 switch (chan->tx_state) {
2668 case L2CAP_TX_STATE_XMIT:
d660366d 2669 l2cap_tx_state_xmit(chan, control, skbs, event);
608bcc6d
MM		 2670 break;
2671 case L2CAP_TX_STATE_WAIT_F:
d660366d 2672 l2cap_tx_state_wait_f(chan, control, skbs, event);
608bcc6d
MM		 2673 break;
2674 default:
2675 /* Ignore event */
2676 break;
2677 }
608bcc6d
MM		 2678}
2679
4b51dae9
MM		 2680static void l2cap_pass_to_tx(struct l2cap_chan *chan,
2681 struct l2cap_ctrl *control)
2682{
2683 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2684 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_REQSEQ_AND_FBIT);
4b51dae9
MM		 2685}
2686
f80842a8
MM		 2687static void l2cap_pass_to_tx_fbit(struct l2cap_chan *chan,
2688 struct l2cap_ctrl *control)
2689{
2690 BT_DBG("chan %p, control %p", chan, control);
401bb1f7 2691 l2cap_tx(chan, control, NULL, L2CAP_EV_RECV_FBIT);
f80842a8
MM		 2692}
2693
1da177e4
LT		 2694/* Copy frame to all raw sockets on that connection */
2695static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2696{
1da177e4 2697 struct sk_buff *nskb;
48454079 2698 struct l2cap_chan *chan;
1da177e4
LT		 2699
2700 BT_DBG("conn %p", conn);
2701
3df91ea2 2702 mutex_lock(&conn->chan_lock);
3d57dc68 2703
3df91ea2 2704 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2705 struct sock *sk = chan->sk;
715ec005 2706 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2707 continue;
2708
2709 /* Don't send frame to the socket it came from */
2710 if (skb->sk == sk)
2711 continue;
8bcde1f2 2712 nskb = skb_clone(skb, GFP_KERNEL);
af05b30b 2713 if (!nskb)
1da177e4
LT		 2714 continue;
2715
80b98027 2716 if (chan->ops->recv(chan, nskb))
1da177e4
LT		 2717 kfree_skb(nskb);
2718 }
3d57dc68 2719
3df91ea2 2720 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2721}
2722
2723/* ---- L2CAP signalling commands ---- */
b4400672
AE		 2724static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, u8 code,
2725 u8 ident, u16 dlen, void *data)
1da177e4
LT		 2726{
2727 struct sk_buff *skb, **frag;
2728 struct l2cap_cmd_hdr *cmd;
2729 struct l2cap_hdr *lh;
2730 int len, count;
2731
b4400672
AE		 2732 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %u",
2733 conn, code, ident, dlen);
1da177e4
LT		 2734
2735 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2736 count = min_t(unsigned int, conn->mtu, len);
2737
8bcde1f2 2738 skb = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2739 if (!skb)
2740 return NULL;
2741
2742 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2743 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2744
2745 if (conn->hcon->type == LE_LINK)
ac73498c 2746 lh->cid = __constant_cpu_to_le16(L2CAP_CID_LE_SIGNALING);
3300d9a9 2747 else
ac73498c 2748 lh->cid = __constant_cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2749
2750 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2751 cmd->code = code;
2752 cmd->ident = ident;
aca3192c 2753 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2754
2755 if (dlen) {
2756 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2757 memcpy(skb_put(skb, count), data, count);
2758 data += count;
2759 }
2760
2761 len -= skb->len;
2762
2763 /* Continuation fragments (no L2CAP header) */
2764 frag = &skb_shinfo(skb)->frag_list;
2765 while (len) {
2766 count = min_t(unsigned int, conn->mtu, len);
2767
8bcde1f2 2768 *frag = bt_skb_alloc(count, GFP_KERNEL);
1da177e4
LT		 2769 if (!*frag)
2770 goto fail;
2771
2772 memcpy(skb_put(*frag, count), data, count);
2773
2774 len -= count;
2775 data += count;
2776
2777 frag = &(*frag)->next;
2778 }
2779
2780 return skb;
2781
2782fail:
2783 kfree_skb(skb);
2784 return NULL;
2785}
2786
2d792818
GP		 2787static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen,
2788 unsigned long *val)
1da177e4
LT		 2789{
2790 struct l2cap_conf_opt *opt = *ptr;
2791 int len;
2792
2793 len = L2CAP_CONF_OPT_SIZE + opt->len;
2794 *ptr += len;
2795
2796 *type = opt->type;
2797 *olen = opt->len;
2798
2799 switch (opt->len) {
2800 case 1:
2801 *val = *((u8 *) opt->val);
2802 break;
2803
2804 case 2:
bfaaeb3e 2805 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2806 break;
2807
2808 case 4:
bfaaeb3e 2809 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2810 break;
2811
2812 default:
2813 *val = (unsigned long) opt->val;
2814 break;
2815 }
2816
b4400672 2817 BT_DBG("type 0x%2.2x len %u val 0x%lx", *type, opt->len, *val);
1da177e4
LT		 2818 return len;
2819}
2820
1da177e4
LT		 2821static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2822{
2823 struct l2cap_conf_opt *opt = *ptr;
2824
b4400672 2825 BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val);
1da177e4
LT		 2826
2827 opt->type = type;
2828 opt->len = len;
2829
2830 switch (len) {
2831 case 1:
2832 *((u8 *) opt->val) = val;
2833 break;
2834
2835 case 2:
4f8b691c 2836 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2837 break;
2838
2839 case 4:
4f8b691c 2840 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2841 break;
2842
2843 default:
2844 memcpy(opt->val, (void *) val, len);
2845 break;
2846 }
2847
2848 *ptr += L2CAP_CONF_OPT_SIZE + len;
2849}
2850
f89cef09
AE		 2851static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2852{
2853 struct l2cap_conf_efs efs;
2854
1ec918ce 2855 switch (chan->mode) {
f89cef09
AE		 2856 case L2CAP_MODE_ERTM:
2857 efs.id = chan->local_id;
2858 efs.stype = chan->local_stype;
2859 efs.msdu = cpu_to_le16(chan->local_msdu);
2860 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
ac73498c 2861 efs.acc_lat = __constant_cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
8936fa6d 2862 efs.flush_to = __constant_cpu_to_le32(L2CAP_EFS_DEFAULT_FLUSH_TO);
f89cef09
AE		 2863 break;
2864
2865 case L2CAP_MODE_STREAMING:
2866 efs.id = 1;
2867 efs.stype = L2CAP_SERV_BESTEFFORT;
2868 efs.msdu = cpu_to_le16(chan->local_msdu);
2869 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2870 efs.acc_lat = 0;
2871 efs.flush_to = 0;
2872 break;
2873
2874 default:
2875 return;
2876 }
2877
2878 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
8936fa6d 2879 (unsigned long) &efs);
f89cef09
AE		 2880}
2881
721c4181 2882static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2883{
721c4181 2884 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
0362520b
MM		 2885 ack_timer.work);
2886 u16 frames_to_ack;
c1b4f43b 2887
2fb9b3d4
GP		 2888 BT_DBG("chan %p", chan);
2889
6be36555
AE		 2890 l2cap_chan_lock(chan);
2891
0362520b
MM		 2892 frames_to_ack = __seq_offset(chan, chan->buffer_seq,
2893 chan->last_acked_seq);
6be36555 2894
0362520b
MM		 2895 if (frames_to_ack)
2896 l2cap_send_rr_or_rnr(chan, 0);
09bfb2ee 2897
0362520b 2898 l2cap_chan_unlock(chan);
09bfb2ee 2899 l2cap_chan_put(chan);
c1b4f43b
GP		 2900}
2901
466f8004 2902int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2903{
3c588192
MM		 2904 int err;
2905
105bdf9e
MM		 2906 chan->next_tx_seq = 0;
2907 chan->expected_tx_seq = 0;
42e5c802 2908 chan->expected_ack_seq = 0;
6a026610 2909 chan->unacked_frames = 0;
42e5c802 2910 chan->buffer_seq = 0;
6a026610 2911 chan->frames_sent = 0;
105bdf9e
MM		 2912 chan->last_acked_seq = 0;
2913 chan->sdu = NULL;
2914 chan->sdu_last_frag = NULL;
2915 chan->sdu_len = 0;
2916
d34c34fb
MM		 2917 skb_queue_head_init(&chan->tx_q);
2918
08333283
MM		 2919 chan->local_amp_id = 0;
2920 chan->move_id = 0;
2921 chan->move_state = L2CAP_MOVE_STABLE;
2922 chan->move_role = L2CAP_MOVE_ROLE_NONE;
2923
105bdf9e
MM		 2924 if (chan->mode != L2CAP_MODE_ERTM)
2925 return 0;
2926
2927 chan->rx_state = L2CAP_RX_STATE_RECV;
2928 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2929
721c4181
GP		 2930 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2931 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2932 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2933
f1c6775b 2934 skb_queue_head_init(&chan->srej_q);
1890d36b 2935
3c588192
MM		 2936 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2937 if (err < 0)
2938 return err;
2939
9dc9affc
MM		 2940 err = l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
2941 if (err < 0)
2942 l2cap_seq_list_free(&chan->srej_list);
2943
2944 return err;
0565c1c2
GP		 2945}
2946
f2fcfcd6
GP		 2947static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2948{
2949 switch (mode) {
2950 case L2CAP_MODE_STREAMING:
2951 case L2CAP_MODE_ERTM:
2952 if (l2cap_mode_supported(mode, remote_feat_mask))
2953 return mode;
2954 /* fall through */
2955 default:
2956 return L2CAP_MODE_BASIC;
2957 }
2958}
2959
6327eb98
AE		 2960static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2961{
2962 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2963}
2964
f89cef09
AE		 2965static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2966{
2967 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2968}
2969
6327eb98
AE		 2970static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2971{
2972 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
2d792818 2973 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2974 /* use extended control field */
2975 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2976 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2977 } else {
6327eb98 2978 chan->tx_win = min_t(u16, chan->tx_win,
2d792818 2979 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2980 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2981 }
c20f8e35 2982 chan->ack_win = chan->tx_win;
6327eb98
AE		 2983}
2984
710f9b0a 2985static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2986{
1da177e4 2987 struct l2cap_conf_req *req = data;
0c1bc5c6 2988 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2989 void *ptr = req->data;
c8f79162 2990 u16 size;
1da177e4 2991
49208c9c 2992 BT_DBG("chan %p", chan);
1da177e4 2993
73ffa904 2994 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2995 goto done;
2996
0c1bc5c6 2997 switch (chan->mode) {
f2fcfcd6
GP		 2998 case L2CAP_MODE_STREAMING:
2999 case L2CAP_MODE_ERTM:
c1360a1c 3000 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 3001 break;
85eb53c6 3002
f89cef09
AE		 3003 if (__l2cap_efs_supported(chan))
3004 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3005
2ba13ed6 3006 /* fall through */
f2fcfcd6 3007 default:
8c1d787b 3008 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 3009 break;
3010 }
3011
3012done:
0c1bc5c6
GP		 3013 if (chan->imtu != L2CAP_DEFAULT_MTU)
3014 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 3015
0c1bc5c6 3016 switch (chan->mode) {
65c7c491 3017 case L2CAP_MODE_BASIC:
8c1d787b 3018 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2d792818 3019 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 3020 break;
3021
62547752
GP		 3022 rfc.mode = L2CAP_MODE_BASIC;
3023 rfc.txwin_size = 0;
3024 rfc.max_transmit = 0;
3025 rfc.retrans_timeout = 0;
3026 rfc.monitor_timeout = 0;
3027 rfc.max_pdu_size = 0;
3028
63406504 3029 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3030 (unsigned long) &rfc);
65c7c491
MH		 3031 break;
3032
3033 case L2CAP_MODE_ERTM:
3034 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 3035 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 3036 rfc.retrans_timeout = 0;
3037 rfc.monitor_timeout = 0;
c8f79162
AE		 3038
3039 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3040 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3041 L2CAP_FCS_SIZE);
c8f79162 3042 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 3043
6327eb98
AE		 3044 l2cap_txwin_setup(chan);
3045
3046 rfc.txwin_size = min_t(u16, chan->tx_win,
2d792818 3047 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 3048
63406504 3049 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3050 (unsigned long) &rfc);
63406504 3051
f89cef09
AE		 3052 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3053 l2cap_add_opt_efs(&ptr, chan);
3054
8c1d787b 3055 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 3056 break;
3057
47d1ec61 3058 if (chan->fcs == L2CAP_FCS_NONE ||
2d792818 3059 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 3060 chan->fcs = L2CAP_FCS_NONE;
3061 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 3062 }
6327eb98
AE		 3063
3064 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3065 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2d792818 3066 chan->tx_win);
f2fcfcd6
GP		 3067 break;
3068
3069 case L2CAP_MODE_STREAMING:
273759e2 3070 l2cap_txwin_setup(chan);
f2fcfcd6
GP		 3071 rfc.mode = L2CAP_MODE_STREAMING;
3072 rfc.txwin_size = 0;
3073 rfc.max_transmit = 0;
3074 rfc.retrans_timeout = 0;
3075 rfc.monitor_timeout = 0;
c8f79162
AE		 3076
3077 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2d792818
GP		 3078 L2CAP_EXT_HDR_SIZE - L2CAP_SDULEN_SIZE -
3079 L2CAP_FCS_SIZE);
c8f79162 3080 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 3081
63406504 3082 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2d792818 3083 (unsigned long) &rfc);
63406504 3084
f89cef09
AE		 3085 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
3086 l2cap_add_opt_efs(&ptr, chan);
3087
8c1d787b 3088 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 3089 break;
3090
47d1ec61 3091 if (chan->fcs == L2CAP_FCS_NONE ||
2d792818 3092 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 3093 chan->fcs = L2CAP_FCS_NONE;
3094 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 3095 }
65c7c491
MH		 3096 break;
3097 }
1da177e4 3098
fe4128e0 3099 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 3100 req->flags = __constant_cpu_to_le16(0);
1da177e4
LT		 3101
3102 return ptr - data;
3103}
3104
73ffa904 3105static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 3106{
5dee9e7c
MH		 3107 struct l2cap_conf_rsp *rsp = data;
3108 void *ptr = rsp->data;
73ffa904
GP		 3109 void *req = chan->conf_req;
3110 int len = chan->conf_len;
5dee9e7c
MH		 3111 int type, hint, olen;
3112 unsigned long val;
6464f35f 3113 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 3114 struct l2cap_conf_efs efs;
3115 u8 remote_efs = 0;
861d6882 3116 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 3117 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 3118 u16 size;
1da177e4 3119
73ffa904 3120 BT_DBG("chan %p", chan);
820ae1b8 3121
5dee9e7c
MH		 3122 while (len >= L2CAP_CONF_OPT_SIZE) {
3123 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 3124
589d2746 3125 hint = type & L2CAP_CONF_HINT;
47ec1dcd 3126 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 3127
3128 switch (type) {
3129 case L2CAP_CONF_MTU:
861d6882 3130 mtu = val;
5dee9e7c
MH		 3131 break;
3132
3133 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3134 chan->flush_to = val;
5dee9e7c
MH		 3135 break;
3136
3137 case L2CAP_CONF_QOS:
3138 break;
3139
6464f35f
MH		 3140 case L2CAP_CONF_RFC:
3141 if (olen == sizeof(rfc))
3142 memcpy(&rfc, (void *) val, olen);
3143 break;
3144
fcc203c3
GP		 3145 case L2CAP_CONF_FCS:
3146 if (val == L2CAP_FCS_NONE)
c1360a1c 3147 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 3148 break;
fcc203c3 3149
42dceae2
AE		 3150 case L2CAP_CONF_EFS:
3151 remote_efs = 1;
3152 if (olen == sizeof(efs))
3153 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 3154 break;
3155
6327eb98
AE		 3156 case L2CAP_CONF_EWS:
3157 if (!enable_hs)
3158 return -ECONNREFUSED;
fcc203c3 3159
6327eb98
AE		 3160 set_bit(FLAG_EXT_CTRL, &chan->flags);
3161 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 3162 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 3163 chan->remote_tx_win = val;
fcc203c3
GP		 3164 break;
3165
5dee9e7c
MH		 3166 default:
3167 if (hint)
3168 break;
3169
3170 result = L2CAP_CONF_UNKNOWN;
3171 *((u8 *) ptr++) = type;
3172 break;
3173 }
3174 }
3175
73ffa904 3176 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 3177 goto done;
3178
0c1bc5c6 3179 switch (chan->mode) {
f2fcfcd6
GP		 3180 case L2CAP_MODE_STREAMING:
3181 case L2CAP_MODE_ERTM:
c1360a1c 3182 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 3183 chan->mode = l2cap_select_mode(rfc.mode,
2d792818 3184 chan->conn->feat_mask);
85eb53c6
GP		 3185 break;
3186 }
3187
42dceae2
AE		 3188 if (remote_efs) {
3189 if (__l2cap_efs_supported(chan))
3190 set_bit(FLAG_EFS_ENABLE, &chan->flags);
3191 else
3192 return -ECONNREFUSED;
3193 }
3194
0c1bc5c6 3195 if (chan->mode != rfc.mode)
f2fcfcd6 3196 return -ECONNREFUSED;
742e519b 3197
f2fcfcd6 3198 break;
f2fcfcd6
GP		 3199 }
3200
3201done:
0c1bc5c6 3202 if (chan->mode != rfc.mode) {
f2fcfcd6 3203 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3204 rfc.mode = chan->mode;
f2fcfcd6 3205
73ffa904 3206 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 3207 return -ECONNREFUSED;
3208
2d792818
GP		 3209 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3210 (unsigned long) &rfc);
f2fcfcd6
GP		 3211 }
3212
5dee9e7c
MH		 3213 if (result == L2CAP_CONF_SUCCESS) {
3214 /* Configure output options and let the other side know
3215 * which ones we don't like. */
3216
f2fcfcd6
GP		 3217 if (mtu < L2CAP_DEFAULT_MIN_MTU)
3218 result = L2CAP_CONF_UNACCEPT;
3219 else {
0c1bc5c6 3220 chan->omtu = mtu;
c1360a1c 3221 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 3222 }
0c1bc5c6 3223 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 3224
42dceae2
AE		 3225 if (remote_efs) {
3226 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3227 efs.stype != L2CAP_SERV_NOTRAFIC &&
3228 efs.stype != chan->local_stype) {
42dceae2
AE		 3229
3230 result = L2CAP_CONF_UNACCEPT;
3231
3232 if (chan->num_conf_req >= 1)
3233 return -ECONNREFUSED;
3234
3235 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3236 sizeof(efs),
3237 (unsigned long) &efs);
0e8b207e 3238 } else {
3e6b3b95 3239 /* Send PENDING Conf Rsp */
0e8b207e
AE		 3240 result = L2CAP_CONF_PENDING;
3241 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 3242 }
3243 }
3244
f2fcfcd6
GP		 3245 switch (rfc.mode) {
3246 case L2CAP_MODE_BASIC:
47d1ec61 3247 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3248 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 3249 break;
3250
3251 case L2CAP_MODE_ERTM:
6327eb98
AE		 3252 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
3253 chan->remote_tx_win = rfc.txwin_size;
3254 else
3255 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 3256
2c03a7a4 3257 chan->remote_max_tx = rfc.max_transmit;
1c762159 3258
c8f79162 3259 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3260 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3261 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3262 rfc.max_pdu_size = cpu_to_le16(size);
3263 chan->remote_mps = size;
f2fcfcd6 3264
10467e9e 3265 rfc.retrans_timeout =
4fd21a88 3266 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 3267 rfc.monitor_timeout =
4fd21a88 3268 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 3269
c1360a1c 3270 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 3271
3272 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3273 sizeof(rfc), (unsigned long) &rfc);
68ae6639 3274
42dceae2
AE		 3275 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3276 chan->remote_id = efs.id;
3277 chan->remote_stype = efs.stype;
3278 chan->remote_msdu = le16_to_cpu(efs.msdu);
3279 chan->remote_flush_to =
2d792818 3280 le32_to_cpu(efs.flush_to);
42dceae2 3281 chan->remote_acc_lat =
2d792818 3282 le32_to_cpu(efs.acc_lat);
42dceae2
AE		 3283 chan->remote_sdu_itime =
3284 le32_to_cpu(efs.sdu_itime);
3285 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2d792818
GP		 3286 sizeof(efs),
3287 (unsigned long) &efs);
42dceae2 3288 }
f2fcfcd6
GP		 3289 break;
3290
3291 case L2CAP_MODE_STREAMING:
c8f79162 3292 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2d792818
GP		 3293 chan->conn->mtu - L2CAP_EXT_HDR_SIZE -
3294 L2CAP_SDULEN_SIZE - L2CAP_FCS_SIZE);
c8f79162
AE		 3295 rfc.max_pdu_size = cpu_to_le16(size);
3296 chan->remote_mps = size;
f2fcfcd6 3297
c1360a1c 3298 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639 3299
2d792818
GP		 3300 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
3301 (unsigned long) &rfc);
68ae6639 3302
f2fcfcd6
GP		 3303 break;
3304
3305 default:
5dee9e7c 3306 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 3307
6464f35f 3308 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 3309 rfc.mode = chan->mode;
f2fcfcd6 3310 }
6464f35f 3311
f2fcfcd6 3312 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 3313 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 3314 }
fe4128e0 3315 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3316 rsp->result = cpu_to_le16(result);
59e54bd1 3317 rsp->flags = __constant_cpu_to_le16(0);
5dee9e7c
MH		 3318
3319 return ptr - data;
1da177e4
LT		 3320}
3321
2d792818
GP		 3322static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
3323 void *data, u16 *result)
f2fcfcd6 3324{
f2fcfcd6
GP		 3325 struct l2cap_conf_req *req = data;
3326 void *ptr = req->data;
3327 int type, olen;
3328 unsigned long val;
36e999a8 3329 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 3330 struct l2cap_conf_efs efs;
f2fcfcd6 3331
fe4128e0 3332 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 3333
3334 while (len >= L2CAP_CONF_OPT_SIZE) {
3335 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3336
3337 switch (type) {
3338 case L2CAP_CONF_MTU:
3339 if (val < L2CAP_DEFAULT_MIN_MTU) {
3340 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 3341 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 3342 } else
0c1bc5c6
GP		 3343 chan->imtu = val;
3344 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 3345 break;
3346
3347 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 3348 chan->flush_to = val;
f2fcfcd6 3349 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2d792818 3350 2, chan->flush_to);
f2fcfcd6
GP		 3351 break;
3352
3353 case L2CAP_CONF_RFC:
3354 if (olen == sizeof(rfc))
3355 memcpy(&rfc, (void *)val, olen);
3356
c1360a1c 3357 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
2d792818 3358 rfc.mode != chan->mode)
f2fcfcd6
GP		 3359 return -ECONNREFUSED;
3360
47d1ec61 3361 chan->fcs = 0;
f2fcfcd6
GP		 3362
3363 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2d792818 3364 sizeof(rfc), (unsigned long) &rfc);
f2fcfcd6 3365 break;
6327eb98
AE		 3366
3367 case L2CAP_CONF_EWS:
c20f8e35 3368 chan->ack_win = min_t(u16, val, chan->ack_win);
3e6b3b95 3369 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
c20f8e35 3370 chan->tx_win);
6327eb98 3371 break;
66af7aaf
AE		 3372
3373 case L2CAP_CONF_EFS:
3374 if (olen == sizeof(efs))
3375 memcpy(&efs, (void *)val, olen);
3376
3377 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2d792818
GP		 3378 efs.stype != L2CAP_SERV_NOTRAFIC &&
3379 efs.stype != chan->local_stype)
66af7aaf
AE		 3380 return -ECONNREFUSED;
3381
2d792818
GP		 3382 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
3383 (unsigned long) &efs);
66af7aaf 3384 break;
f2fcfcd6
GP		 3385 }
3386 }
3387
0c1bc5c6 3388 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 3389 return -ECONNREFUSED;
3390
0c1bc5c6 3391 chan->mode = rfc.mode;
6c2ea7a8 3392
0e8b207e 3393 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 3394 switch (rfc.mode) {
3395 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3396 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3397 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
3398 chan->mps = le16_to_cpu(rfc.max_pdu_size);
c20f8e35
MM		 3399 if (!test_bit(FLAG_EXT_CTRL, &chan->flags))
3400 chan->ack_win = min_t(u16, chan->ack_win,
3401 rfc.txwin_size);
66af7aaf
AE		 3402
3403 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
3404 chan->local_msdu = le16_to_cpu(efs.msdu);
3405 chan->local_sdu_itime =
2d792818 3406 le32_to_cpu(efs.sdu_itime);
66af7aaf
AE		 3407 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
3408 chan->local_flush_to =
2d792818 3409 le32_to_cpu(efs.flush_to);
66af7aaf 3410 }
f2fcfcd6 3411 break;
66af7aaf 3412
f2fcfcd6 3413 case L2CAP_MODE_STREAMING:
47d1ec61 3414 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 3415 }
3416 }
3417
fe4128e0 3418 req->dcid = cpu_to_le16(chan->dcid);
59e54bd1 3419 req->flags = __constant_cpu_to_le16(0);
f2fcfcd6
GP		 3420
3421 return ptr - data;
3422}
3423
2d792818
GP		 3424static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data,
3425 u16 result, u16 flags)
1da177e4
LT		 3426{
3427 struct l2cap_conf_rsp *rsp = data;
3428 void *ptr = rsp->data;
1da177e4 3429
fe4128e0 3430 BT_DBG("chan %p", chan);
1da177e4 3431
fe4128e0 3432 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 3433 rsp->result = cpu_to_le16(result);
aca3192c 3434 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 3435
3436 return ptr - data;
3437}
3438
8c1d787b 3439void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 3440{
3441 struct l2cap_conn_rsp rsp;
8c1d787b 3442 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 3443 u8 buf[128];
3444
fe4128e0
GP		 3445 rsp.scid = cpu_to_le16(chan->dcid);
3446 rsp.dcid = cpu_to_le16(chan->scid);
ac73498c
AE		 3447 rsp.result = __constant_cpu_to_le16(L2CAP_CR_SUCCESS);
3448 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
2d792818 3449 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
710f9b0a 3450
c1360a1c 3451 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 3452 return;
3453
710f9b0a 3454 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3455 l2cap_build_conf_req(chan, buf), buf);
710f9b0a
GP		 3456 chan->num_conf_req++;
3457}
3458
47d1ec61 3459static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 3460{
7b1c0049
GP		 3461 int type, olen;
3462 unsigned long val;
c20f8e35
MM		 3463 /* Use sane default values in case a misbehaving remote device
3464 * did not send an RFC or extended window size option.
3465 */
3466 u16 txwin_ext = chan->ack_win;
3467 struct l2cap_conf_rfc rfc = {
3468 .mode = chan->mode,
3469 .retrans_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO),
3470 .monitor_timeout = __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO),
3471 .max_pdu_size = cpu_to_le16(chan->imtu),
3472 .txwin_size = min_t(u16, chan->ack_win, L2CAP_DEFAULT_TX_WINDOW),
3473 };
7b1c0049 3474
47d1ec61 3475 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 3476
0c1bc5c6 3477 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 3478 return;
3479
3480 while (len >= L2CAP_CONF_OPT_SIZE) {
3481 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
3482
c20f8e35
MM		 3483 switch (type) {
3484 case L2CAP_CONF_RFC:
3485 if (olen == sizeof(rfc))
3486 memcpy(&rfc, (void *)val, olen);
8f321f85 3487 break;
c20f8e35
MM		 3488 case L2CAP_CONF_EWS:
3489 txwin_ext = val;
3490 break;
3491 }
7b1c0049
GP		 3492 }
3493
7b1c0049
GP		 3494 switch (rfc.mode) {
3495 case L2CAP_MODE_ERTM:
47d1ec61
GP		 3496 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
3497 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
c20f8e35
MM		 3498 chan->mps = le16_to_cpu(rfc.max_pdu_size);
3499 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3500 chan->ack_win = min_t(u16, chan->ack_win, txwin_ext);
3501 else
3502 chan->ack_win = min_t(u16, chan->ack_win,
3503 rfc.txwin_size);
7b1c0049
GP		 3504 break;
3505 case L2CAP_MODE_STREAMING:
47d1ec61 3506 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 3507 }
3508}
3509
2d792818
GP		 3510static inline int l2cap_command_rej(struct l2cap_conn *conn,
3511 struct l2cap_cmd_hdr *cmd, u8 *data)
4e8402a3 3512{
e2fd318e 3513 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 3514
e2fd318e 3515 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 3516 return 0;
3517
3518 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2d792818 3519 cmd->ident == conn->info_ident) {
17cd3f37 3520 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 3521
3522 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3523 conn->info_ident = 0;
984947dc 3524
4e8402a3
MH		 3525 l2cap_conn_start(conn);
3526 }
3527
3528 return 0;
3529}
3530
1700915f
MM		 3531static struct l2cap_chan *l2cap_connect(struct l2cap_conn *conn,
3532 struct l2cap_cmd_hdr *cmd,
3533 u8 *data, u8 rsp_code, u8 amp_id)
1da177e4 3534{
1da177e4
LT		 3535 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
3536 struct l2cap_conn_rsp rsp;
23691d75 3537 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 3538 struct sock *parent, *sk = NULL;
e7c29cb1 3539 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3540
3541 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 3542 __le16 psm = req->psm;
1da177e4 3543
097db76c 3544 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 3545
3546 /* Check if we have socket listening on psm */
c2287681 3547 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 3548 if (!pchan) {
1da177e4
LT		 3549 result = L2CAP_CR_BAD_PSM;
3550 goto sendresp;
3551 }
3552
23691d75
GP		 3553 parent = pchan->sk;
3554
3df91ea2 3555 mutex_lock(&conn->chan_lock);
aa2ac881 3556 lock_sock(parent);
e0f0cb56 3557
e7c29cb1 3558 /* Check if the ACL is secure enough (if not SDP) */
2983fd68 3559 if (psm != __constant_cpu_to_le16(L2CAP_PSM_SDP) &&
2d792818 3560 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 3561 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 3562 result = L2CAP_CR_SEC_BLOCK;
3563 goto response;
3564 }
3565
1da177e4
LT		 3566 result = L2CAP_CR_NO_MEM;
3567
2dfa1003
GP		 3568 /* Check if we already have channel with that dcid */
3569 if (__l2cap_get_chan_by_dcid(conn, scid))
3570 goto response;
3571
80b98027 3572 chan = pchan->ops->new_connection(pchan);
80808e43 3573 if (!chan)
1da177e4
LT		 3574 goto response;
3575
80808e43
GP		 3576 sk = chan->sk;
3577
1da177e4
LT		 3578 hci_conn_hold(conn->hcon);
3579
1da177e4
LT		 3580 bacpy(&bt_sk(sk)->src, conn->src);
3581 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 3582 chan->psm = psm;
3583 chan->dcid = scid;
1700915f 3584 chan->local_amp_id = amp_id;
1da177e4 3585
6be36555 3586 __l2cap_chan_add(conn, chan);
48454079 3587
fe4128e0 3588 dcid = chan->scid;
1da177e4 3589
c9b66675 3590 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 3591
fc7f8a7e 3592 chan->ident = cmd->ident;
1da177e4 3593
984947dc 3594 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 3595 if (l2cap_chan_check_security(chan)) {
c5daa683 3596 if (test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) {
0e587be7 3597 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 3598 result = L2CAP_CR_PEND;
3599 status = L2CAP_CS_AUTHOR_PEND;
2dc4e510 3600 chan->ops->defer(chan);
f66dc81f 3601 } else {
1700915f
MM		 3602 /* Force pending result for AMP controllers.
3603 * The connection will succeed after the
3604 * physical link is up.
3605 */
3606 if (amp_id) {
3607 __l2cap_state_change(chan, BT_CONNECT2);
3608 result = L2CAP_CR_PEND;
3609 } else {
3610 __l2cap_state_change(chan, BT_CONFIG);
3611 result = L2CAP_CR_SUCCESS;
3612 }
f66dc81f
MH		 3613 status = L2CAP_CS_NO_INFO;
3614 }
79d554a6 3615 } else {
0e587be7 3616 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3617 result = L2CAP_CR_PEND;
3618 status = L2CAP_CS_AUTHEN_PEND;
3619 }
3620 } else {
0e587be7 3621 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3622 result = L2CAP_CR_PEND;
3623 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3624 }
3625
1da177e4 3626response:
aa2ac881 3627 release_sock(parent);
3df91ea2 3628 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3629
3630sendresp:
aca3192c
YH		 3631 rsp.scid = cpu_to_le16(scid);
3632 rsp.dcid = cpu_to_le16(dcid);
3633 rsp.result = cpu_to_le16(result);
3634 rsp.status = cpu_to_le16(status);
4c89b6aa 3635 l2cap_send_cmd(conn, cmd->ident, rsp_code, sizeof(rsp), &rsp);
79d554a6
MH		 3636
3637 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3638 struct l2cap_info_req info;
ac73498c 3639 info.type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
79d554a6
MH		 3640
3641 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3642 conn->info_ident = l2cap_get_ident(conn);
3643
ba13ccd9 3644 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6 3645
2d792818
GP		 3646 l2cap_send_cmd(conn, conn->info_ident, L2CAP_INFO_REQ,
3647 sizeof(info), &info);
79d554a6
MH		 3648 }
3649
c1360a1c 3650 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
2d792818 3651 result == L2CAP_CR_SUCCESS) {
e9aeb2dd 3652 u8 buf[128];
c1360a1c 3653 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3654 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3655 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3656 chan->num_conf_req++;
e9aeb2dd 3657 }
1700915f
MM		 3658
3659 return chan;
4c89b6aa 3660}
e9aeb2dd 3661
4c89b6aa
MM		 3662static int l2cap_connect_req(struct l2cap_conn *conn,
3663 struct l2cap_cmd_hdr *cmd, u8 *data)
3664{
300229f9 3665 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
1da177e4
LT		 3666 return 0;
3667}
3668
5909cf30 3669static int l2cap_connect_create_rsp(struct l2cap_conn *conn,
2d792818 3670 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3671{
3672 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3673 u16 scid, dcid, result, status;
48454079 3674 struct l2cap_chan *chan;
1da177e4 3675 u8 req[128];
3df91ea2 3676 int err;
1da177e4
LT		 3677
3678 scid = __le16_to_cpu(rsp->scid);
3679 dcid = __le16_to_cpu(rsp->dcid);
3680 result = __le16_to_cpu(rsp->result);
3681 status = __le16_to_cpu(rsp->status);
3682
1b009c98 3683 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
2d792818 3684 dcid, scid, result, status);
1da177e4 3685
3df91ea2
AE		 3686 mutex_lock(&conn->chan_lock);
3687
1da177e4 3688 if (scid) {
3df91ea2
AE		 3689 chan = __l2cap_get_chan_by_scid(conn, scid);
3690 if (!chan) {
3691 err = -EFAULT;
3692 goto unlock;
3693 }
1da177e4 3694 } else {
3df91ea2
AE		 3695 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3696 if (!chan) {
3697 err = -EFAULT;
3698 goto unlock;
3699 }
1da177e4
LT		 3700 }
3701
3df91ea2
AE		 3702 err = 0;
3703
6be36555 3704 l2cap_chan_lock(chan);
48454079 3705
1da177e4
LT		 3706 switch (result) {
3707 case L2CAP_CR_SUCCESS:
89bc500e 3708 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3709 chan->ident = 0;
fe4128e0 3710 chan->dcid = dcid;
c1360a1c 3711 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3712
c1360a1c 3713 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3714 break;
3715
1da177e4 3716 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3717 l2cap_build_conf_req(chan, req), req);
73ffa904 3718 chan->num_conf_req++;
1da177e4
LT		 3719 break;
3720
3721 case L2CAP_CR_PEND:
c1360a1c 3722 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3723 break;
3724
3725 default:
48454079 3726 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3727 break;
3728 }
3729
6be36555 3730 l2cap_chan_unlock(chan);
3df91ea2
AE		 3731
3732unlock:
3733 mutex_unlock(&conn->chan_lock);
3734
3735 return err;
1da177e4
LT		 3736}
3737
47d1ec61 3738static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3739{
3740 /* FCS is enabled only in ERTM or streaming mode, if one or both
3741 * sides request it.
3742 */
0c1bc5c6 3743 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3744 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3745 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3746 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3747}
3748
29d8a590
AE		 3749static void l2cap_send_efs_conf_rsp(struct l2cap_chan *chan, void *data,
3750 u8 ident, u16 flags)
3751{
3752 struct l2cap_conn *conn = chan->conn;
3753
3754 BT_DBG("conn %p chan %p ident %d flags 0x%4.4x", conn, chan, ident,
3755 flags);
3756
3757 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3758 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3759
3760 l2cap_send_cmd(conn, ident, L2CAP_CONF_RSP,
3761 l2cap_build_conf_rsp(chan, data,
3762 L2CAP_CONF_SUCCESS, flags), data);
3763}
3764
2d792818
GP		 3765static inline int l2cap_config_req(struct l2cap_conn *conn,
3766 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3767 u8 *data)
1da177e4
LT		 3768{
3769 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3770 u16 dcid, flags;
3771 u8 rsp[64];
48454079 3772 struct l2cap_chan *chan;
3c588192 3773 int len, err = 0;
1da177e4
LT		 3774
3775 dcid = __le16_to_cpu(req->dcid);
3776 flags = __le16_to_cpu(req->flags);
3777
3778 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3779
baa7e1fa 3780 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3781 if (!chan)
1da177e4
LT		 3782 return -ENOENT;
3783
033b1142 3784 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3785 struct l2cap_cmd_rej_cid rej;
3786
ac73498c 3787 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_INVALID_CID);
e2fd318e
IK		 3788 rej.scid = cpu_to_le16(chan->scid);
3789 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3790
df6bd743 3791 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2d792818 3792 sizeof(rej), &rej);
354f60a9 3793 goto unlock;
df6bd743 3794 }
354f60a9 3795
5dee9e7c 3796 /* Reject if config buffer is too small. */
88219a0f 3797 len = cmd_len - sizeof(*req);
7ac28817 3798 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3799 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 3800 l2cap_build_conf_rsp(chan, rsp,
3801 L2CAP_CONF_REJECT, flags), rsp);
5dee9e7c
MH		 3802 goto unlock;
3803 }
3804
3805 /* Store config. */
73ffa904
GP		 3806 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3807 chan->conf_len += len;
1da177e4 3808
59e54bd1 3809 if (flags & L2CAP_CONF_FLAG_CONTINUATION) {
1da177e4
LT		 3810 /* Incomplete config. Send empty response. */
3811 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2d792818
GP		 3812 l2cap_build_conf_rsp(chan, rsp,
3813 L2CAP_CONF_SUCCESS, flags), rsp);
1da177e4
LT		 3814 goto unlock;
3815 }
3816
3817 /* Complete config. */
73ffa904 3818 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3819 if (len < 0) {
e92c8e70 3820 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3821 goto unlock;
f2fcfcd6 3822 }
1da177e4 3823
1500109b 3824 chan->ident = cmd->ident;
5dee9e7c 3825 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3826 chan->num_conf_rsp++;
5dee9e7c 3827
5dee9e7c 3828 /* Reset config buffer. */
73ffa904 3829 chan->conf_len = 0;
5dee9e7c 3830
c1360a1c 3831 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3832 goto unlock;
3833
c1360a1c 3834 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3835 set_default_fcs(chan);
fcc203c3 3836
105bdf9e
MM		 3837 if (chan->mode == L2CAP_MODE_ERTM ||
3838 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3839 err = l2cap_ertm_init(chan);
3840
3841 if (err < 0)
3842 l2cap_send_disconn_req(chan->conn, chan, -err);
3843 else
3844 l2cap_chan_ready(chan);
0565c1c2 3845
876d9484
MH		 3846 goto unlock;
3847 }
3848
c1360a1c 3849 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3850 u8 buf[64];
1da177e4 3851 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2d792818 3852 l2cap_build_conf_req(chan, buf), buf);
73ffa904 3853 chan->num_conf_req++;
1da177e4
LT		 3854 }
3855
0e8b207e
AE		 3856 /* Got Conf Rsp PENDING from remote side and asume we sent
3857 Conf Rsp PENDING in the code above */
3858 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
29d8a590 3859 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
0e8b207e
AE		 3860
3861 /* check compatibility */
3862
79de886d
AE		 3863 /* Send rsp for BR/EDR channel */
3864 if (!chan->ctrl_id)
3865 l2cap_send_efs_conf_rsp(chan, rsp, cmd->ident, flags);
3866 else
3867 chan->ident = cmd->ident;
0e8b207e
AE		 3868 }
3869
1da177e4 3870unlock:
6be36555 3871 l2cap_chan_unlock(chan);
3c588192 3872 return err;
1da177e4
LT		 3873}
3874
2d792818
GP		 3875static inline int l2cap_config_rsp(struct l2cap_conn *conn,
3876 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3877{
3878 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3879 u16 scid, flags, result;
48454079 3880 struct l2cap_chan *chan;
61386cba 3881 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3882 int err = 0;
1da177e4
LT		 3883
3884 scid = __le16_to_cpu(rsp->scid);
3885 flags = __le16_to_cpu(rsp->flags);
3886 result = __le16_to_cpu(rsp->result);
3887
61386cba
AE		 3888 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3889 result, len);
1da177e4 3890
baa7e1fa 3891 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3892 if (!chan)
1da177e4
LT		 3893 return 0;
3894
3895 switch (result) {
3896 case L2CAP_CONF_SUCCESS:
47d1ec61 3897 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3898 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3899 break;
3900
0e8b207e
AE		 3901 case L2CAP_CONF_PENDING:
3902 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3903
3904 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3905 char buf[64];
3906
3907 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 3908 buf, &result);
0e8b207e
AE		 3909 if (len < 0) {
3910 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3911 goto done;
3912 }
3913
3914 /* check compatibility */
3915
79de886d
AE		 3916 if (!chan->ctrl_id)
3917 l2cap_send_efs_conf_rsp(chan, buf, cmd->ident,
3918 0);
3919 else
3920 chan->ident = cmd->ident;
0e8b207e
AE		 3921 }
3922 goto done;
3923
1da177e4 3924 case L2CAP_CONF_UNACCEPT:
73ffa904 3925 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3926 char req[64];
3927
c2c77ec8 3928 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3929 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3930 goto done;
3931 }
3932
f2fcfcd6
GP		 3933 /* throw out any old stored conf requests */
3934 result = L2CAP_CONF_SUCCESS;
b4450035 3935 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2d792818 3936 req, &result);
f2fcfcd6 3937 if (len < 0) {
e92c8e70 3938 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3939 goto done;
3940 }
3941
3942 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2d792818 3943 L2CAP_CONF_REQ, len, req);
73ffa904 3944 chan->num_conf_req++;
f2fcfcd6
GP		 3945 if (result != L2CAP_CONF_SUCCESS)
3946 goto done;
3947 break;
1da177e4
LT		 3948 }
3949
8e87d142 3950 default:
6be36555 3951 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3952
ba13ccd9 3953 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3954 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3955 goto done;
3956 }
3957
59e54bd1 3958 if (flags & L2CAP_CONF_FLAG_CONTINUATION)
1da177e4
LT		 3959 goto done;
3960
c1360a1c 3961 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3962
c1360a1c 3963 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3964 set_default_fcs(chan);
fcc203c3 3965
105bdf9e
MM		 3966 if (chan->mode == L2CAP_MODE_ERTM ||
3967 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3968 err = l2cap_ertm_init(chan);
0565c1c2 3969
3c588192
MM		 3970 if (err < 0)
3971 l2cap_send_disconn_req(chan->conn, chan, -err);
3972 else
3973 l2cap_chan_ready(chan);
1da177e4
LT		 3974 }
3975
3976done:
6be36555 3977 l2cap_chan_unlock(chan);
3c588192 3978 return err;
1da177e4
LT		 3979}
3980
2d792818
GP		 3981static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
3982 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 3983{
3984 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3985 struct l2cap_disconn_rsp rsp;
3986 u16 dcid, scid;
48454079 3987 struct l2cap_chan *chan;
1da177e4
LT		 3988 struct sock *sk;
3989
3990 scid = __le16_to_cpu(req->scid);
3991 dcid = __le16_to_cpu(req->dcid);
3992
3993 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3994
3df91ea2
AE		 3995 mutex_lock(&conn->chan_lock);
3996
3997 chan = __l2cap_get_chan_by_scid(conn, dcid);
3998 if (!chan) {
3999 mutex_unlock(&conn->chan_lock);
1da177e4 4000 return 0;
3df91ea2 4001 }
1da177e4 4002
6be36555
AE		 4003 l2cap_chan_lock(chan);
4004
48454079
GP		 4005 sk = chan->sk;
4006
fe4128e0
GP		 4007 rsp.dcid = cpu_to_le16(chan->scid);
4008 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 4009 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
4010
6be36555 4011 lock_sock(sk);
1da177e4 4012 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 4013 release_sock(sk);
1da177e4 4014
61d6ef3e 4015 l2cap_chan_hold(chan);
48454079 4016 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 4017
4018 l2cap_chan_unlock(chan);
1da177e4 4019
80b98027 4020 chan->ops->close(chan);
61d6ef3e 4021 l2cap_chan_put(chan);
3df91ea2
AE		 4022
4023 mutex_unlock(&conn->chan_lock);
4024
1da177e4
LT		 4025 return 0;
4026}
4027
2d792818
GP		 4028static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
4029 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4030{
4031 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
4032 u16 dcid, scid;
48454079 4033 struct l2cap_chan *chan;
1da177e4
LT		 4034
4035 scid = __le16_to_cpu(rsp->scid);
4036 dcid = __le16_to_cpu(rsp->dcid);
4037
4038 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
4039
3df91ea2
AE		 4040 mutex_lock(&conn->chan_lock);
4041
4042 chan = __l2cap_get_chan_by_scid(conn, scid);
4043 if (!chan) {
4044 mutex_unlock(&conn->chan_lock);
1da177e4 4045 return 0;
3df91ea2 4046 }
1da177e4 4047
6be36555 4048 l2cap_chan_lock(chan);
48454079 4049
61d6ef3e 4050 l2cap_chan_hold(chan);
48454079 4051 l2cap_chan_del(chan, 0);
6be36555
AE		 4052
4053 l2cap_chan_unlock(chan);
1da177e4 4054
80b98027 4055 chan->ops->close(chan);
61d6ef3e 4056 l2cap_chan_put(chan);
3df91ea2
AE		 4057
4058 mutex_unlock(&conn->chan_lock);
4059
1da177e4
LT		 4060 return 0;
4061}
4062
2d792818
GP		 4063static inline int l2cap_information_req(struct l2cap_conn *conn,
4064 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4065{
4066 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 4067 u16 type;
4068
4069 type = __le16_to_cpu(req->type);
4070
4071 BT_DBG("type 0x%4.4x", type);
4072
f0709e03
MH		 4073 if (type == L2CAP_IT_FEAT_MASK) {
4074 u8 buf[8];
44dd46de 4075 u32 feat_mask = l2cap_feat_mask;
f0709e03 4076 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
ac73498c
AE		 4077 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FEAT_MASK);
4078 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 4079 if (!disable_ertm)
fcc203c3 4080 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
2d792818 4081 | L2CAP_FEAT_FCS;
a5fd6f30 4082 if (enable_hs)
6327eb98 4083 feat_mask |= L2CAP_FEAT_EXT_FLOW
2d792818 4084 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 4085
1b7bf4ed 4086 put_unaligned_le32(feat_mask, rsp->data);
2d792818
GP		 4087 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4088 buf);
e1027a7c
MH		 4089 } else if (type == L2CAP_IT_FIXED_CHAN) {
4090 u8 buf[12];
4091 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 4092
4093 if (enable_hs)
4094 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
4095 else
4096 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
4097
ac73498c
AE		 4098 rsp->type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
4099 rsp->result = __constant_cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 4100 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
2d792818
GP		 4101 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(buf),
4102 buf);
f0709e03
MH		 4103 } else {
4104 struct l2cap_info_rsp rsp;
4105 rsp.type = cpu_to_le16(type);
ac73498c 4106 rsp.result = __constant_cpu_to_le16(L2CAP_IR_NOTSUPP);
2d792818
GP		 4107 l2cap_send_cmd(conn, cmd->ident, L2CAP_INFO_RSP, sizeof(rsp),
4108 &rsp);
f0709e03 4109 }
1da177e4
LT		 4110
4111 return 0;
4112}
4113
2d792818
GP		 4114static inline int l2cap_information_rsp(struct l2cap_conn *conn,
4115 struct l2cap_cmd_hdr *cmd, u8 *data)
1da177e4
LT		 4116{
4117 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
4118 u16 type, result;
4119
4120 type = __le16_to_cpu(rsp->type);
4121 result = __le16_to_cpu(rsp->result);
4122
4123 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
4124
e90165be
AE		 4125 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
4126 if (cmd->ident != conn->info_ident ||
2d792818 4127 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
e90165be
AE		 4128 return 0;
4129
17cd3f37 4130 cancel_delayed_work(&conn->info_timer);
4e8402a3 4131
adb08ede
VT		 4132 if (result != L2CAP_IR_SUCCESS) {
4133 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4134 conn->info_ident = 0;
4135
4136 l2cap_conn_start(conn);
4137
4138 return 0;
4139 }
4140
978c93b9
AE		 4141 switch (type) {
4142 case L2CAP_IT_FEAT_MASK:
83985319 4143 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 4144
47ec1dcd 4145 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c 4146 struct l2cap_info_req req;
ac73498c 4147 req.type = __constant_cpu_to_le16(L2CAP_IT_FIXED_CHAN);
e1027a7c
MH		 4148
4149 conn->info_ident = l2cap_get_ident(conn);
4150
4151 l2cap_send_cmd(conn, conn->info_ident,
2d792818 4152 L2CAP_INFO_REQ, sizeof(req), &req);
e1027a7c
MH		 4153 } else {
4154 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
4155 conn->info_ident = 0;
4156
4157 l2cap_conn_start(conn);
4158 }
978c93b9
AE		 4159 break;
4160
4161 case L2CAP_IT_FIXED_CHAN:
4162 conn->fixed_chan_mask = rsp->data[0];
984947dc 4163 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 4164 conn->info_ident = 0;
984947dc
MH		 4165
4166 l2cap_conn_start(conn);
978c93b9 4167 break;
984947dc 4168 }
4e8402a3 4169
1da177e4
LT		 4170 return 0;
4171}
4172
1700915f
MM		 4173static int l2cap_create_channel_req(struct l2cap_conn *conn,
4174 struct l2cap_cmd_hdr *cmd,
4175 u16 cmd_len, void *data)
f94ff6ff
MM		 4176{
4177 struct l2cap_create_chan_req *req = data;
1700915f 4178 struct l2cap_chan *chan;
f94ff6ff
MM		 4179 u16 psm, scid;
4180
4181 if (cmd_len != sizeof(*req))
4182 return -EPROTO;
4183
4184 if (!enable_hs)
4185 return -EINVAL;
4186
4187 psm = le16_to_cpu(req->psm);
4188 scid = le16_to_cpu(req->scid);
4189
ad0ac6ca 4190 BT_DBG("psm 0x%2.2x, scid 0x%4.4x, amp_id %d", psm, scid, req->amp_id);
f94ff6ff 4191
1700915f
MM		 4192 if (req->amp_id) {
4193 struct hci_dev *hdev;
4194
4195 /* Validate AMP controller id */
4196 hdev = hci_dev_get(req->amp_id);
4197 if (!hdev || hdev->dev_type != HCI_AMP ||
4198 !test_bit(HCI_UP, &hdev->flags)) {
4199 struct l2cap_create_chan_rsp rsp;
4200
4201 rsp.dcid = 0;
4202 rsp.scid = cpu_to_le16(scid);
4203 rsp.result = __constant_cpu_to_le16(L2CAP_CR_BAD_AMP);
4204 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
4205
4206 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
4207 sizeof(rsp), &rsp);
4208
4209 if (hdev)
4210 hci_dev_put(hdev);
4211
4212 return 0;
4213 }
4214
4215 hci_dev_put(hdev);
4216 }
f94ff6ff 4217
1700915f
MM		 4218 chan = l2cap_connect(conn, cmd, data, L2CAP_CREATE_CHAN_RSP,
4219 req->amp_id);
f94ff6ff
MM		 4220
4221 return 0;
4222}
4223
8eb200bd
MM		 4224static void l2cap_send_move_chan_req(struct l2cap_chan *chan, u8 dest_amp_id)
4225{
4226 struct l2cap_move_chan_req req;
4227 u8 ident;
4228
4229 BT_DBG("chan %p, dest_amp_id %d", chan, dest_amp_id);
4230
4231 ident = l2cap_get_ident(chan->conn);
4232 chan->ident = ident;
4233
4234 req.icid = cpu_to_le16(chan->scid);
4235 req.dest_amp_id = dest_amp_id;
4236
4237 l2cap_send_cmd(chan->conn, ident, L2CAP_MOVE_CHAN_REQ, sizeof(req),
4238 &req);
4239
4240 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4241}
4242
1500109b 4243static void l2cap_send_move_chan_rsp(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4244{
4245 struct l2cap_move_chan_rsp rsp;
4246
1500109b 4247 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4248
1500109b 4249 rsp.icid = cpu_to_le16(chan->dcid);
8d5a04a1
MM		 4250 rsp.result = cpu_to_le16(result);
4251
1500109b
MM		 4252 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_RSP,
4253 sizeof(rsp), &rsp);
8d5a04a1
MM		 4254}
4255
5b155ef9 4256static void l2cap_send_move_chan_cfm(struct l2cap_chan *chan, u16 result)
8d5a04a1
MM		 4257{
4258 struct l2cap_move_chan_cfm cfm;
8d5a04a1 4259
5b155ef9 4260 BT_DBG("chan %p, result 0x%4.4x", chan, result);
8d5a04a1 4261
5b155ef9 4262 chan->ident = l2cap_get_ident(chan->conn);
8d5a04a1 4263
5b155ef9 4264 cfm.icid = cpu_to_le16(chan->scid);
8d5a04a1
MM		 4265 cfm.result = cpu_to_le16(result);
4266
5b155ef9
MM		 4267 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_MOVE_CHAN_CFM,
4268 sizeof(cfm), &cfm);
4269
4270 __set_chan_timer(chan, L2CAP_MOVE_TIMEOUT);
4271}
4272
4273static void l2cap_send_move_chan_cfm_icid(struct l2cap_conn *conn, u16 icid)
4274{
4275 struct l2cap_move_chan_cfm cfm;
4276
4277 BT_DBG("conn %p, icid 0x%4.4x", conn, icid);
4278
4279 cfm.icid = cpu_to_le16(icid);
4280 cfm.result = __constant_cpu_to_le16(L2CAP_MC_UNCONFIRMED);
4281
4282 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_MOVE_CHAN_CFM,
4283 sizeof(cfm), &cfm);
8d5a04a1
MM		 4284}
4285
4286static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
ad0ac6ca 4287 u16 icid)
8d5a04a1
MM		 4288{
4289 struct l2cap_move_chan_cfm_rsp rsp;
4290
ad0ac6ca 4291 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1
MM		 4292
4293 rsp.icid = cpu_to_le16(icid);
4294 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
4295}
4296
5f3847a4
MM		 4297static void __release_logical_link(struct l2cap_chan *chan)
4298{
4299 chan->hs_hchan = NULL;
4300 chan->hs_hcon = NULL;
4301
4302 /* Placeholder - release the logical link */
4303}
4304
1500109b
MM		 4305static void l2cap_logical_fail(struct l2cap_chan *chan)
4306{
4307 /* Logical link setup failed */
4308 if (chan->state != BT_CONNECTED) {
4309 /* Create channel failure, disconnect */
4310 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4311 return;
4312 }
4313
4314 switch (chan->move_role) {
4315 case L2CAP_MOVE_ROLE_RESPONDER:
4316 l2cap_move_done(chan);
4317 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_SUPP);
4318 break;
4319 case L2CAP_MOVE_ROLE_INITIATOR:
4320 if (chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_COMP ||
4321 chan->move_state == L2CAP_MOVE_WAIT_LOGICAL_CFM) {
4322 /* Remote has only sent pending or
4323 * success responses, clean up
4324 */
4325 l2cap_move_done(chan);
4326 }
4327
4328 /* Other amp move states imply that the move
4329 * has already aborted
4330 */
4331 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4332 break;
4333 }
4334}
4335
4336static void l2cap_logical_finish_create(struct l2cap_chan *chan,
4337 struct hci_chan *hchan)
4338{
4339 struct l2cap_conf_rsp rsp;
4340 u8 code;
4341
4342 chan->hs_hcon = hchan->conn;
4343 chan->hs_hcon->l2cap_data = chan->conn;
4344
4345 code = l2cap_build_conf_rsp(chan, &rsp,
4346 L2CAP_CONF_SUCCESS, 0);
4347 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CONF_RSP, code,
4348 &rsp);
4349 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
4350
4351 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
4352 int err = 0;
4353
4354 set_default_fcs(chan);
4355
4356 err = l2cap_ertm_init(chan);
4357 if (err < 0)
4358 l2cap_send_disconn_req(chan->conn, chan, -err);
4359 else
4360 l2cap_chan_ready(chan);
4361 }
4362}
4363
4364static void l2cap_logical_finish_move(struct l2cap_chan *chan,
4365 struct hci_chan *hchan)
4366{
4367 chan->hs_hcon = hchan->conn;
4368 chan->hs_hcon->l2cap_data = chan->conn;
4369
4370 BT_DBG("move_state %d", chan->move_state);
4371
4372 switch (chan->move_state) {
4373 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4374 /* Move confirm will be sent after a success
4375 * response is received
4376 */
4377 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4378 break;
4379 case L2CAP_MOVE_WAIT_LOGICAL_CFM:
4380 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4381 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4382 } else if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4383 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4384 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4385 } else if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4386 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4387 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4388 }
4389 break;
4390 default:
4391 /* Move was not in expected state, free the channel */
4392 __release_logical_link(chan);
4393
4394 chan->move_state = L2CAP_MOVE_STABLE;
4395 }
4396}
4397
4398/* Call with chan locked */
5b155ef9
MM		 4399static void l2cap_logical_cfm(struct l2cap_chan *chan, struct hci_chan *hchan,
4400 u8 status)
4401{
1500109b
MM		 4402 BT_DBG("chan %p, hchan %p, status %d", chan, hchan, status);
4403
4404 if (status) {
4405 l2cap_logical_fail(chan);
4406 __release_logical_link(chan);
4407 return;
4408 }
4409
4410 if (chan->state != BT_CONNECTED) {
4411 /* Ignore logical link if channel is on BR/EDR */
4412 if (chan->local_amp_id)
4413 l2cap_logical_finish_create(chan, hchan);
4414 } else {
4415 l2cap_logical_finish_move(chan, hchan);
4416 }
5b155ef9
MM		 4417}
4418
8eb200bd
MM		 4419static void l2cap_do_create(struct l2cap_chan *chan, int result,
4420 u8 local_amp_id, u8 remote_amp_id)
4421{
4422 if (!test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
4423 struct l2cap_conn_rsp rsp;
4424 char buf[128];
4425 rsp.scid = cpu_to_le16(chan->dcid);
4426 rsp.dcid = cpu_to_le16(chan->scid);
4427
4428 /* Incoming channel on AMP */
4429 if (result == L2CAP_CR_SUCCESS) {
4430 /* Send successful response */
4431 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
4432 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4433 } else {
4434 /* Send negative response */
4435 rsp.result = cpu_to_le16(L2CAP_CR_NO_MEM);
4436 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
4437 }
4438
4439 l2cap_send_cmd(chan->conn, chan->ident, L2CAP_CREATE_CHAN_RSP,
4440 sizeof(rsp), &rsp);
4441
4442 if (result == L2CAP_CR_SUCCESS) {
4443 __l2cap_state_change(chan, BT_CONFIG);
4444 set_bit(CONF_REQ_SENT, &chan->conf_state);
4445 l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn),
4446 L2CAP_CONF_REQ,
4447 l2cap_build_conf_req(chan, buf), buf);
4448 chan->num_conf_req++;
4449 }
4450 } else {
4451 /* Outgoing channel on AMP */
4452 if (result == L2CAP_CR_SUCCESS) {
4453 chan->local_amp_id = local_amp_id;
4454 l2cap_send_create_chan_req(chan, remote_amp_id);
4455 } else {
4456 /* Revert to BR/EDR connect */
4457 l2cap_send_conn_req(chan);
4458 }
4459 }
4460}
4461
4462static void l2cap_do_move_initiate(struct l2cap_chan *chan, u8 local_amp_id,
4463 u8 remote_amp_id)
4464{
4465 l2cap_move_setup(chan);
4466 chan->move_id = local_amp_id;
4467 chan->move_state = L2CAP_MOVE_WAIT_RSP;
4468
4469 l2cap_send_move_chan_req(chan, remote_amp_id);
4470}
4471
4472static void l2cap_do_move_respond(struct l2cap_chan *chan, int result)
4473{
4474 struct hci_chan *hchan = NULL;
4475
4476 /* Placeholder - get hci_chan for logical link */
4477
4478 if (hchan) {
4479 if (hchan->state == BT_CONNECTED) {
4480 /* Logical link is ready to go */
4481 chan->hs_hcon = hchan->conn;
4482 chan->hs_hcon->l2cap_data = chan->conn;
4483 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4484 l2cap_send_move_chan_rsp(chan, L2CAP_MR_SUCCESS);
4485
4486 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4487 } else {
4488 /* Wait for logical link to be ready */
4489 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4490 }
4491 } else {
4492 /* Logical link not available */
4493 l2cap_send_move_chan_rsp(chan, L2CAP_MR_NOT_ALLOWED);
4494 }
4495}
4496
4497static void l2cap_do_move_cancel(struct l2cap_chan *chan, int result)
4498{
4499 if (chan->move_role == L2CAP_MOVE_ROLE_RESPONDER) {
4500 u8 rsp_result;
4501 if (result == -EINVAL)
4502 rsp_result = L2CAP_MR_BAD_ID;
4503 else
4504 rsp_result = L2CAP_MR_NOT_ALLOWED;
4505
4506 l2cap_send_move_chan_rsp(chan, rsp_result);
4507 }
4508
4509 chan->move_role = L2CAP_MOVE_ROLE_NONE;
4510 chan->move_state = L2CAP_MOVE_STABLE;
4511
4512 /* Restart data transmission */
4513 l2cap_ertm_send(chan);
4514}
4515
4516void l2cap_physical_cfm(struct l2cap_chan *chan, int result, u8 local_amp_id,
4517 u8 remote_amp_id)
4518{
4519 BT_DBG("chan %p, result %d, local_amp_id %d, remote_amp_id %d",
4520 chan, result, local_amp_id, remote_amp_id);
4521
4522 l2cap_chan_lock(chan);
4523
4524 if (chan->state == BT_DISCONN || chan->state == BT_CLOSED) {
4525 l2cap_chan_unlock(chan);
4526 return;
4527 }
4528
4529 if (chan->state != BT_CONNECTED) {
4530 l2cap_do_create(chan, result, local_amp_id, remote_amp_id);
4531 } else if (result != L2CAP_MR_SUCCESS) {
4532 l2cap_do_move_cancel(chan, result);
4533 } else {
4534 switch (chan->move_role) {
4535 case L2CAP_MOVE_ROLE_INITIATOR:
4536 l2cap_do_move_initiate(chan, local_amp_id,
4537 remote_amp_id);
4538 break;
4539 case L2CAP_MOVE_ROLE_RESPONDER:
4540 l2cap_do_move_respond(chan, result);
4541 break;
4542 default:
4543 l2cap_do_move_cancel(chan, result);
4544 break;
4545 }
4546 }
4547
4548 l2cap_chan_unlock(chan);
4549}
4550
8d5a04a1 4551static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
ad0ac6ca
AE		 4552 struct l2cap_cmd_hdr *cmd,
4553 u16 cmd_len, void *data)
8d5a04a1
MM		 4554{
4555 struct l2cap_move_chan_req *req = data;
1500109b 4556 struct l2cap_move_chan_rsp rsp;
02b0fbb9 4557 struct l2cap_chan *chan;
8d5a04a1
MM		 4558 u16 icid = 0;
4559 u16 result = L2CAP_MR_NOT_ALLOWED;
4560
4561 if (cmd_len != sizeof(*req))
4562 return -EPROTO;
4563
4564 icid = le16_to_cpu(req->icid);
4565
ad0ac6ca 4566 BT_DBG("icid 0x%4.4x, dest_amp_id %d", icid, req->dest_amp_id);
8d5a04a1
MM		 4567
4568 if (!enable_hs)
4569 return -EINVAL;
4570
02b0fbb9
MM		 4571 chan = l2cap_get_chan_by_dcid(conn, icid);
4572 if (!chan) {
1500109b
MM		 4573 rsp.icid = cpu_to_le16(icid);
4574 rsp.result = __constant_cpu_to_le16(L2CAP_MR_NOT_ALLOWED);
4575 l2cap_send_cmd(conn, cmd->ident, L2CAP_MOVE_CHAN_RSP,
4576 sizeof(rsp), &rsp);
02b0fbb9
MM		 4577 return 0;
4578 }
4579
1500109b
MM		 4580 chan->ident = cmd->ident;
4581
02b0fbb9
MM		 4582 if (chan->scid < L2CAP_CID_DYN_START ||
4583 chan->chan_policy == BT_CHANNEL_POLICY_BREDR_ONLY ||
4584 (chan->mode != L2CAP_MODE_ERTM &&
4585 chan->mode != L2CAP_MODE_STREAMING)) {
4586 result = L2CAP_MR_NOT_ALLOWED;
4587 goto send_move_response;
4588 }
4589
4590 if (chan->local_amp_id == req->dest_amp_id) {
4591 result = L2CAP_MR_SAME_ID;
4592 goto send_move_response;
4593 }
4594
4595 if (req->dest_amp_id) {
4596 struct hci_dev *hdev;
4597 hdev = hci_dev_get(req->dest_amp_id);
4598 if (!hdev || hdev->dev_type != HCI_AMP ||
4599 !test_bit(HCI_UP, &hdev->flags)) {
4600 if (hdev)
4601 hci_dev_put(hdev);
4602
4603 result = L2CAP_MR_BAD_ID;
4604 goto send_move_response;
4605 }
4606 hci_dev_put(hdev);
4607 }
4608
4609 /* Detect a move collision. Only send a collision response
4610 * if this side has "lost", otherwise proceed with the move.
4611 * The winner has the larger bd_addr.
4612 */
4613 if ((__chan_is_moving(chan) ||
4614 chan->move_role != L2CAP_MOVE_ROLE_NONE) &&
4615 bacmp(conn->src, conn->dst) > 0) {
4616 result = L2CAP_MR_COLLISION;
4617 goto send_move_response;
4618 }
4619
02b0fbb9
MM		 4620 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4621 l2cap_move_setup(chan);
4622 chan->move_id = req->dest_amp_id;
4623 icid = chan->dcid;
4624
4625 if (!req->dest_amp_id) {
4626 /* Moving to BR/EDR */
4627 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4628 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4629 result = L2CAP_MR_PEND;
4630 } else {
4631 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM;
4632 result = L2CAP_MR_SUCCESS;
4633 }
4634 } else {
4635 chan->move_state = L2CAP_MOVE_WAIT_PREPARE;
4636 /* Placeholder - uncomment when amp functions are available */
4637 /*amp_accept_physical(chan, req->dest_amp_id);*/
4638 result = L2CAP_MR_PEND;
4639 }
4640
4641send_move_response:
1500109b 4642 l2cap_send_move_chan_rsp(chan, result);
8d5a04a1 4643
02b0fbb9
MM		 4644 l2cap_chan_unlock(chan);
4645
8d5a04a1
MM		 4646 return 0;
4647}
4648
5b155ef9
MM		 4649static void l2cap_move_continue(struct l2cap_conn *conn, u16 icid, u16 result)
4650{
4651 struct l2cap_chan *chan;
4652 struct hci_chan *hchan = NULL;
4653
4654 chan = l2cap_get_chan_by_scid(conn, icid);
4655 if (!chan) {
4656 l2cap_send_move_chan_cfm_icid(conn, icid);
4657 return;
4658 }
4659
4660 __clear_chan_timer(chan);
4661 if (result == L2CAP_MR_PEND)
4662 __set_chan_timer(chan, L2CAP_MOVE_ERTX_TIMEOUT);
4663
4664 switch (chan->move_state) {
4665 case L2CAP_MOVE_WAIT_LOGICAL_COMP:
4666 /* Move confirm will be sent when logical link
4667 * is complete.
4668 */
4669 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4670 break;
4671 case L2CAP_MOVE_WAIT_RSP_SUCCESS:
4672 if (result == L2CAP_MR_PEND) {
4673 break;
4674 } else if (test_bit(CONN_LOCAL_BUSY,
4675 &chan->conn_state)) {
4676 chan->move_state = L2CAP_MOVE_WAIT_LOCAL_BUSY;
4677 } else {
4678 /* Logical link is up or moving to BR/EDR,
4679 * proceed with move
4680 */
4681 chan->move_state = L2CAP_MOVE_WAIT_CONFIRM_RSP;
4682 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4683 }
4684 break;
4685 case L2CAP_MOVE_WAIT_RSP:
4686 /* Moving to AMP */
4687 if (result == L2CAP_MR_SUCCESS) {
4688 /* Remote is ready, send confirm immediately
4689 * after logical link is ready
4690 */
4691 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_CFM;
4692 } else {
4693 /* Both logical link and move success
4694 * are required to confirm
4695 */
4696 chan->move_state = L2CAP_MOVE_WAIT_LOGICAL_COMP;
4697 }
4698
4699 /* Placeholder - get hci_chan for logical link */
4700 if (!hchan) {
4701 /* Logical link not available */
4702 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4703 break;
4704 }
4705
4706 /* If the logical link is not yet connected, do not
4707 * send confirmation.
4708 */
4709 if (hchan->state != BT_CONNECTED)
4710 break;
4711
4712 /* Logical link is already ready to go */
4713
4714 chan->hs_hcon = hchan->conn;
4715 chan->hs_hcon->l2cap_data = chan->conn;
4716
4717 if (result == L2CAP_MR_SUCCESS) {
4718 /* Can confirm now */
4719 l2cap_send_move_chan_cfm(chan, L2CAP_MC_CONFIRMED);
4720 } else {
4721 /* Now only need move success
4722 * to confirm
4723 */
4724 chan->move_state = L2CAP_MOVE_WAIT_RSP_SUCCESS;
4725 }
4726
4727 l2cap_logical_cfm(chan, hchan, L2CAP_MR_SUCCESS);
4728 break;
4729 default:
4730 /* Any other amp move state means the move failed. */
4731 chan->move_id = chan->local_amp_id;
4732 l2cap_move_done(chan);
4733 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4734 }
4735
4736 l2cap_chan_unlock(chan);
4737}
4738
4739static void l2cap_move_fail(struct l2cap_conn *conn, u8 ident, u16 icid,
4740 u16 result)
4741{
4742 struct l2cap_chan *chan;
4743
4744 chan = l2cap_get_chan_by_ident(conn, ident);
4745 if (!chan) {
4746 /* Could not locate channel, icid is best guess */
4747 l2cap_send_move_chan_cfm_icid(conn, icid);
4748 return;
4749 }
4750
4751 __clear_chan_timer(chan);
4752
4753 if (chan->move_role == L2CAP_MOVE_ROLE_INITIATOR) {
4754 if (result == L2CAP_MR_COLLISION) {
4755 chan->move_role = L2CAP_MOVE_ROLE_RESPONDER;
4756 } else {
4757 /* Cleanup - cancel move */
4758 chan->move_id = chan->local_amp_id;
4759 l2cap_move_done(chan);
4760 }
4761 }
4762
4763 l2cap_send_move_chan_cfm(chan, L2CAP_MC_UNCONFIRMED);
4764
4765 l2cap_chan_unlock(chan);
4766}
4767
4768static int l2cap_move_channel_rsp(struct l2cap_conn *conn,
4769 struct l2cap_cmd_hdr *cmd,
4770 u16 cmd_len, void *data)
8d5a04a1
MM		 4771{
4772 struct l2cap_move_chan_rsp *rsp = data;
4773 u16 icid, result;
4774
4775 if (cmd_len != sizeof(*rsp))
4776 return -EPROTO;
4777
4778 icid = le16_to_cpu(rsp->icid);
4779 result = le16_to_cpu(rsp->result);
4780
ad0ac6ca 4781 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 4782
5b155ef9
MM		 4783 if (result == L2CAP_MR_SUCCESS || result == L2CAP_MR_PEND)
4784 l2cap_move_continue(conn, icid, result);
4785 else
4786 l2cap_move_fail(conn, cmd->ident, icid, result);
8d5a04a1
MM		 4787
4788 return 0;
4789}
4790
5f3847a4
MM		 4791static int l2cap_move_channel_confirm(struct l2cap_conn *conn,
4792 struct l2cap_cmd_hdr *cmd,
4793 u16 cmd_len, void *data)
8d5a04a1
MM		 4794{
4795 struct l2cap_move_chan_cfm *cfm = data;
5f3847a4 4796 struct l2cap_chan *chan;
8d5a04a1
MM		 4797 u16 icid, result;
4798
4799 if (cmd_len != sizeof(*cfm))
4800 return -EPROTO;
4801
4802 icid = le16_to_cpu(cfm->icid);
4803 result = le16_to_cpu(cfm->result);
4804
ad0ac6ca 4805 BT_DBG("icid 0x%4.4x, result 0x%4.4x", icid, result);
8d5a04a1 4806
5f3847a4
MM		 4807 chan = l2cap_get_chan_by_dcid(conn, icid);
4808 if (!chan) {
4809 /* Spec requires a response even if the icid was not found */
4810 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
4811 return 0;
4812 }
4813
4814 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM) {
4815 if (result == L2CAP_MC_CONFIRMED) {
4816 chan->local_amp_id = chan->move_id;
4817 if (!chan->local_amp_id)
4818 __release_logical_link(chan);
4819 } else {
4820 chan->move_id = chan->local_amp_id;
4821 }
4822
4823 l2cap_move_done(chan);
4824 }
4825
8d5a04a1
MM		 4826 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
4827
5f3847a4
MM		 4828 l2cap_chan_unlock(chan);
4829
8d5a04a1
MM		 4830 return 0;
4831}
4832
4833static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
ad0ac6ca
AE		 4834 struct l2cap_cmd_hdr *cmd,
4835 u16 cmd_len, void *data)
8d5a04a1
MM		 4836{
4837 struct l2cap_move_chan_cfm_rsp *rsp = data;
3fd71a0a 4838 struct l2cap_chan *chan;
8d5a04a1
MM		 4839 u16 icid;
4840
4841 if (cmd_len != sizeof(*rsp))
4842 return -EPROTO;
4843
4844 icid = le16_to_cpu(rsp->icid);
4845
ad0ac6ca 4846 BT_DBG("icid 0x%4.4x", icid);
8d5a04a1 4847
3fd71a0a
MM		 4848 chan = l2cap_get_chan_by_scid(conn, icid);
4849 if (!chan)
4850 return 0;
4851
4852 __clear_chan_timer(chan);
4853
4854 if (chan->move_state == L2CAP_MOVE_WAIT_CONFIRM_RSP) {
4855 chan->local_amp_id = chan->move_id;
4856
4857 if (!chan->local_amp_id && chan->hs_hchan)
4858 __release_logical_link(chan);
4859
4860 l2cap_move_done(chan);
4861 }
4862
4863 l2cap_chan_unlock(chan);
4864
8d5a04a1
MM		 4865 return 0;
4866}
4867
e2174ca4 4868static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
2d792818 4869 u16 to_multiplier)
de73115a
CT		 4870{
4871 u16 max_latency;
4872
4873 if (min > max || min < 6 || max > 3200)
4874 return -EINVAL;
4875
4876 if (to_multiplier < 10 || to_multiplier > 3200)
4877 return -EINVAL;
4878
4879 if (max >= to_multiplier * 8)
4880 return -EINVAL;
4881
4882 max_latency = (to_multiplier * 8 / max) - 1;
4883 if (latency > 499 || latency > max_latency)
4884 return -EINVAL;
4885
4886 return 0;
4887}
4888
4889static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
2d792818
GP		 4890 struct l2cap_cmd_hdr *cmd,
4891 u8 *data)
de73115a
CT		 4892{
4893 struct hci_conn *hcon = conn->hcon;
4894 struct l2cap_conn_param_update_req *req;
4895 struct l2cap_conn_param_update_rsp rsp;
4896 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 4897 int err;
de73115a
CT		 4898
4899 if (!(hcon->link_mode & HCI_LM_MASTER))
4900 return -EINVAL;
4901
4902 cmd_len = __le16_to_cpu(cmd->len);
4903 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
4904 return -EPROTO;
4905
4906 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 4907 min = __le16_to_cpu(req->min);
4908 max = __le16_to_cpu(req->max);
de73115a
CT		 4909 latency = __le16_to_cpu(req->latency);
4910 to_multiplier = __le16_to_cpu(req->to_multiplier);
4911
4912 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
2d792818 4913 min, max, latency, to_multiplier);
de73115a
CT		 4914
4915 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 4916
4917 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
4918 if (err)
ac73498c 4919 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
de73115a 4920 else
ac73498c 4921 rsp.result = __constant_cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
de73115a
CT		 4922
4923 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
2d792818 4924 sizeof(rsp), &rsp);
de73115a 4925
2ce603eb
CT		 4926 if (!err)
4927 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
4928
de73115a
CT		 4929 return 0;
4930}
4931
3300d9a9 4932static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
2d792818
GP		 4933 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
4934 u8 *data)
3300d9a9
CT		 4935{
4936 int err = 0;
4937
4938 switch (cmd->code) {
4939 case L2CAP_COMMAND_REJ:
4940 l2cap_command_rej(conn, cmd, data);
4941 break;
4942
4943 case L2CAP_CONN_REQ:
4944 err = l2cap_connect_req(conn, cmd, data);
4945 break;
4946
4947 case L2CAP_CONN_RSP:
f5a2598d 4948 case L2CAP_CREATE_CHAN_RSP:
5909cf30 4949 err = l2cap_connect_create_rsp(conn, cmd, data);
3300d9a9
CT		 4950 break;
4951
4952 case L2CAP_CONF_REQ:
4953 err = l2cap_config_req(conn, cmd, cmd_len, data);
4954 break;
4955
4956 case L2CAP_CONF_RSP:
4957 err = l2cap_config_rsp(conn, cmd, data);
4958 break;
4959
4960 case L2CAP_DISCONN_REQ:
4961 err = l2cap_disconnect_req(conn, cmd, data);
4962 break;
4963
4964 case L2CAP_DISCONN_RSP:
4965 err = l2cap_disconnect_rsp(conn, cmd, data);
4966 break;
4967
4968 case L2CAP_ECHO_REQ:
4969 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
4970 break;
4971
4972 case L2CAP_ECHO_RSP:
4973 break;
4974
4975 case L2CAP_INFO_REQ:
4976 err = l2cap_information_req(conn, cmd, data);
4977 break;
4978
4979 case L2CAP_INFO_RSP:
4980 err = l2cap_information_rsp(conn, cmd, data);
4981 break;
4982
f94ff6ff
MM		 4983 case L2CAP_CREATE_CHAN_REQ:
4984 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
4985 break;
4986
8d5a04a1
MM		 4987 case L2CAP_MOVE_CHAN_REQ:
4988 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
4989 break;
4990
4991 case L2CAP_MOVE_CHAN_RSP:
4992 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
4993 break;
4994
4995 case L2CAP_MOVE_CHAN_CFM:
4996 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
4997 break;
4998
4999 case L2CAP_MOVE_CHAN_CFM_RSP:
5000 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
5001 break;
5002
3300d9a9
CT		 5003 default:
5004 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
5005 err = -EINVAL;
5006 break;
5007 }
5008
5009 return err;
5010}
5011
5012static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
2d792818 5013 struct l2cap_cmd_hdr *cmd, u8 *data)
3300d9a9
CT		 5014{
5015 switch (cmd->code) {
5016 case L2CAP_COMMAND_REJ:
5017 return 0;
5018
5019 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 5020 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 5021
5022 case L2CAP_CONN_PARAM_UPDATE_RSP:
5023 return 0;
5024
5025 default:
5026 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
5027 return -EINVAL;
5028 }
5029}
5030
5031static inline void l2cap_sig_channel(struct l2cap_conn *conn,
2d792818 5032 struct sk_buff *skb)
1da177e4
LT		 5033{
5034 u8 *data = skb->data;
5035 int len = skb->len;
5036 struct l2cap_cmd_hdr cmd;
3300d9a9 5037 int err;
1da177e4
LT		 5038
5039 l2cap_raw_recv(conn, skb);
5040
5041 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 5042 u16 cmd_len;
1da177e4
LT		 5043 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
5044 data += L2CAP_CMD_HDR_SIZE;
5045 len -= L2CAP_CMD_HDR_SIZE;
5046
88219a0f 5047 cmd_len = le16_to_cpu(cmd.len);
1da177e4 5048
2d792818
GP		 5049 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len,
5050 cmd.ident);
1da177e4 5051
88219a0f 5052 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 5053 BT_DBG("corrupted command");
5054 break;
5055 }
5056
3300d9a9
CT		 5057 if (conn->hcon->type == LE_LINK)
5058 err = l2cap_le_sig_cmd(conn, &cmd, data);
5059 else
5060 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 5061
5062 if (err) {
e2fd318e 5063 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 5064
5065 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 5066
5067 /* FIXME: Map err to a valid reason */
ac73498c 5068 rej.reason = __constant_cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
2d792818
GP		 5069 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ,
5070 sizeof(rej), &rej);
1da177e4
LT		 5071 }
5072
88219a0f
AV		 5073 data += cmd_len;
5074 len -= cmd_len;
1da177e4
LT		 5075 }
5076
5077 kfree_skb(skb);
5078}
5079
47d1ec61 5080static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 5081{
5082 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 5083 int hdr_size;
5084
5085 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
5086 hdr_size = L2CAP_EXT_HDR_SIZE;
5087 else
5088 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 5089
47d1ec61 5090 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 5091 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 5092 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
5093 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
5094
5095 if (our_fcs != rcv_fcs)
7a560e5c 5096 return -EBADMSG;
fcc203c3
GP		 5097 }
5098 return 0;
5099}
5100
6ea00485 5101static void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 5102{
e31f7633 5103 struct l2cap_ctrl control;
d5392c8f 5104
e31f7633 5105 BT_DBG("chan %p", chan);
d5392c8f 5106
e31f7633
MM		 5107 memset(&control, 0, sizeof(control));
5108 control.sframe = 1;
5109 control.final = 1;
5110 control.reqseq = chan->buffer_seq;
5111 set_bit(CONN_SEND_FBIT, &chan->conn_state);
d5392c8f 5112
e2ab4353 5113 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
e31f7633
MM		 5114 control.super = L2CAP_SUPER_RNR;
5115 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5116 }
5117
e31f7633
MM		 5118 if (test_and_clear_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
5119 chan->unacked_frames > 0)
5120 __set_retrans_timer(chan);
d5392c8f 5121
e31f7633 5122 /* Send pending iframes */
525cd185 5123 l2cap_ertm_send(chan);
d5392c8f 5124
e2ab4353 5125 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
e31f7633
MM		 5126 test_bit(CONN_SEND_FBIT, &chan->conn_state)) {
5127 /* F-bit wasn't sent in an s-frame or i-frame yet, so
5128 * send it now.
5129 */
5130 control.super = L2CAP_SUPER_RR;
5131 l2cap_send_sframe(chan, &control);
d5392c8f
GP		 5132 }
5133}
5134
2d792818
GP		 5135static void append_skb_frag(struct sk_buff *skb, struct sk_buff *new_frag,
5136 struct sk_buff **last_frag)
18778a63 5137{
84084a31
MM		 5138 /* skb->len reflects data in skb as well as all fragments
5139 * skb->data_len reflects only data in fragments
5140 */
5141 if (!skb_has_frag_list(skb))
5142 skb_shinfo(skb)->frag_list = new_frag;
5143
5144 new_frag->next = NULL;
5145
5146 (*last_frag)->next = new_frag;
5147 *last_frag = new_frag;
5148
5149 skb->len += new_frag->len;
5150 skb->data_len += new_frag->len;
5151 skb->truesize += new_frag->truesize;
5152}
5153
4b51dae9
MM		 5154static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb,
5155 struct l2cap_ctrl *control)
84084a31
MM		 5156{
5157 int err = -EINVAL;
18778a63 5158
4b51dae9 5159 switch (control->sar) {
7e0ef6ee 5160 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 5161 if (chan->sdu)
5162 break;
18778a63 5163
80b98027 5164 err = chan->ops->recv(chan, skb);
84084a31 5165 break;
18778a63 5166
7e0ef6ee 5167 case L2CAP_SAR_START:
84084a31
MM		 5168 if (chan->sdu)
5169 break;
18778a63 5170
6f61fd47 5171 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 5172 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 5173
84084a31
MM		 5174 if (chan->sdu_len > chan->imtu) {
5175 err = -EMSGSIZE;
5176 break;
5177 }
1890d36b 5178
84084a31
MM		 5179 if (skb->len >= chan->sdu_len)
5180 break;
18778a63 5181
84084a31
MM		 5182 chan->sdu = skb;
5183 chan->sdu_last_frag = skb;
18778a63 5184
84084a31
MM		 5185 skb = NULL;
5186 err = 0;
18778a63
GP		 5187 break;
5188
7e0ef6ee 5189 case L2CAP_SAR_CONTINUE:
6f61fd47 5190 if (!chan->sdu)
84084a31 5191 break;
18778a63 5192
84084a31
MM		 5193 append_skb_frag(chan->sdu, skb,
5194 &chan->sdu_last_frag);
5195 skb = NULL;
18778a63 5196
84084a31
MM		 5197 if (chan->sdu->len >= chan->sdu_len)
5198 break;
4178ba46 5199
84084a31 5200 err = 0;
18778a63
GP		 5201 break;
5202
7e0ef6ee 5203 case L2CAP_SAR_END:
6f61fd47 5204 if (!chan->sdu)
84084a31 5205 break;
18778a63 5206
84084a31
MM		 5207 append_skb_frag(chan->sdu, skb,
5208 &chan->sdu_last_frag);
5209 skb = NULL;
4178ba46 5210
84084a31
MM		 5211 if (chan->sdu->len != chan->sdu_len)
5212 break;
18778a63 5213
80b98027 5214 err = chan->ops->recv(chan, chan->sdu);
1890d36b 5215
84084a31
MM		 5216 if (!err) {
5217 /* Reassembly complete */
5218 chan->sdu = NULL;
5219 chan->sdu_last_frag = NULL;
5220 chan->sdu_len = 0;
1890d36b 5221 }
18778a63
GP		 5222 break;
5223 }
5224
84084a31
MM		 5225 if (err) {
5226 kfree_skb(skb);
5227 kfree_skb(chan->sdu);
5228 chan->sdu = NULL;
5229 chan->sdu_last_frag = NULL;
5230 chan->sdu_len = 0;
5231 }
18778a63 5232
84084a31 5233 return err;
18778a63
GP		 5234}
5235
32b32735
MM		 5236static int l2cap_resegment(struct l2cap_chan *chan)
5237{
5238 /* Placeholder */
5239 return 0;
5240}
5241
61aa4f5b 5242void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
26f880d2 5243{
61aa4f5b 5244 u8 event;
712132eb 5245
61aa4f5b
MM		 5246 if (chan->mode != L2CAP_MODE_ERTM)
5247 return;
712132eb 5248
61aa4f5b 5249 event = busy ? L2CAP_EV_LOCAL_BUSY_DETECTED : L2CAP_EV_LOCAL_BUSY_CLEAR;
401bb1f7 5250 l2cap_tx(chan, NULL, NULL, event);
1890d36b
GP		 5251}
5252
d2a7ac5d
MM		 5253static int l2cap_rx_queued_iframes(struct l2cap_chan *chan)
5254{
63838725
MM		 5255 int err = 0;
5256 /* Pass sequential frames to l2cap_reassemble_sdu()
5257 * until a gap is encountered.
5258 */
5259
5260 BT_DBG("chan %p", chan);
5261
5262 while (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5263 struct sk_buff *skb;
5264 BT_DBG("Searching for skb with txseq %d (queue len %d)",
5265 chan->buffer_seq, skb_queue_len(&chan->srej_q));
5266
5267 skb = l2cap_ertm_seq_in_queue(&chan->srej_q, chan->buffer_seq);
5268
5269 if (!skb)
5270 break;
5271
5272 skb_unlink(skb, &chan->srej_q);
5273 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5274 err = l2cap_reassemble_sdu(chan, skb, &bt_cb(skb)->control);
5275 if (err)
5276 break;
5277 }
5278
5279 if (skb_queue_empty(&chan->srej_q)) {
5280 chan->rx_state = L2CAP_RX_STATE_RECV;
5281 l2cap_send_ack(chan);
5282 }
5283
5284 return err;
d2a7ac5d
MM		 5285}
5286
5287static void l2cap_handle_srej(struct l2cap_chan *chan,
5288 struct l2cap_ctrl *control)
5289{
f80842a8
MM		 5290 struct sk_buff *skb;
5291
5292 BT_DBG("chan %p, control %p", chan, control);
5293
5294 if (control->reqseq == chan->next_tx_seq) {
5295 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5296 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5297 return;
5298 }
5299
5300 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5301
5302 if (skb == NULL) {
5303 BT_DBG("Seq %d not available for retransmission",
5304 control->reqseq);
5305 return;
5306 }
5307
5308 if (chan->max_tx != 0 && bt_cb(skb)->control.retries >= chan->max_tx) {
5309 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5310 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5311 return;
5312 }
5313
5314 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5315
5316 if (control->poll) {
5317 l2cap_pass_to_tx(chan, control);
5318
5319 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5320 l2cap_retransmit(chan, control);
5321 l2cap_ertm_send(chan);
5322
5323 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5324 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5325 chan->srej_save_reqseq = control->reqseq;
5326 }
5327 } else {
5328 l2cap_pass_to_tx_fbit(chan, control);
5329
5330 if (control->final) {
5331 if (chan->srej_save_reqseq != control->reqseq ||
5332 !test_and_clear_bit(CONN_SREJ_ACT,
5333 &chan->conn_state))
5334 l2cap_retransmit(chan, control);
5335 } else {
5336 l2cap_retransmit(chan, control);
5337 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F) {
5338 set_bit(CONN_SREJ_ACT, &chan->conn_state);
5339 chan->srej_save_reqseq = control->reqseq;
5340 }
5341 }
5342 }
d2a7ac5d
MM		 5343}
5344
5345static void l2cap_handle_rej(struct l2cap_chan *chan,
5346 struct l2cap_ctrl *control)
5347{
fcd289df
MM		 5348 struct sk_buff *skb;
5349
5350 BT_DBG("chan %p, control %p", chan, control);
5351
5352 if (control->reqseq == chan->next_tx_seq) {
5353 BT_DBG("Invalid reqseq %d, disconnecting", control->reqseq);
5354 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5355 return;
5356 }
5357
5358 skb = l2cap_ertm_seq_in_queue(&chan->tx_q, control->reqseq);
5359
5360 if (chan->max_tx && skb &&
5361 bt_cb(skb)->control.retries >= chan->max_tx) {
5362 BT_DBG("Retry limit exceeded (%d)", chan->max_tx);
5363 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5364 return;
5365 }
5366
5367 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5368
5369 l2cap_pass_to_tx(chan, control);
5370
5371 if (control->final) {
5372 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
5373 l2cap_retransmit_all(chan, control);
5374 } else {
5375 l2cap_retransmit_all(chan, control);
5376 l2cap_ertm_send(chan);
5377 if (chan->tx_state == L2CAP_TX_STATE_WAIT_F)
5378 set_bit(CONN_REJ_ACT, &chan->conn_state);
5379 }
d2a7ac5d
MM		 5380}
5381
4b51dae9
MM		 5382static u8 l2cap_classify_txseq(struct l2cap_chan *chan, u16 txseq)
5383{
5384 BT_DBG("chan %p, txseq %d", chan, txseq);
5385
5386 BT_DBG("last_acked_seq %d, expected_tx_seq %d", chan->last_acked_seq,
5387 chan->expected_tx_seq);
5388
5389 if (chan->rx_state == L2CAP_RX_STATE_SREJ_SENT) {
5390 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
2d792818 5391 chan->tx_win) {
4b51dae9
MM		 5392 /* See notes below regarding "double poll" and
5393 * invalid packets.
5394 */
5395 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5396 BT_DBG("Invalid/Ignore - after SREJ");
5397 return L2CAP_TXSEQ_INVALID_IGNORE;
5398 } else {
5399 BT_DBG("Invalid - in window after SREJ sent");
5400 return L2CAP_TXSEQ_INVALID;
5401 }
5402 }
5403
5404 if (chan->srej_list.head == txseq) {
5405 BT_DBG("Expected SREJ");
5406 return L2CAP_TXSEQ_EXPECTED_SREJ;
5407 }
5408
5409 if (l2cap_ertm_seq_in_queue(&chan->srej_q, txseq)) {
5410 BT_DBG("Duplicate SREJ - txseq already stored");
5411 return L2CAP_TXSEQ_DUPLICATE_SREJ;
5412 }
5413
5414 if (l2cap_seq_list_contains(&chan->srej_list, txseq)) {
5415 BT_DBG("Unexpected SREJ - not requested");
5416 return L2CAP_TXSEQ_UNEXPECTED_SREJ;
5417 }
5418 }
5419
5420 if (chan->expected_tx_seq == txseq) {
5421 if (__seq_offset(chan, txseq, chan->last_acked_seq) >=
5422 chan->tx_win) {
5423 BT_DBG("Invalid - txseq outside tx window");
5424 return L2CAP_TXSEQ_INVALID;
5425 } else {
5426 BT_DBG("Expected");
5427 return L2CAP_TXSEQ_EXPECTED;
5428 }
5429 }
5430
5431 if (__seq_offset(chan, txseq, chan->last_acked_seq) <
2d792818 5432 __seq_offset(chan, chan->expected_tx_seq, chan->last_acked_seq)) {
4b51dae9
MM		 5433 BT_DBG("Duplicate - expected_tx_seq later than txseq");
5434 return L2CAP_TXSEQ_DUPLICATE;
5435 }
5436
5437 if (__seq_offset(chan, txseq, chan->last_acked_seq) >= chan->tx_win) {
5438 /* A source of invalid packets is a "double poll" condition,
5439 * where delays cause us to send multiple poll packets. If
5440 * the remote stack receives and processes both polls,
5441 * sequence numbers can wrap around in such a way that a
5442 * resent frame has a sequence number that looks like new data
5443 * with a sequence gap. This would trigger an erroneous SREJ
5444 * request.
5445 *
5446 * Fortunately, this is impossible with a tx window that's
5447 * less than half of the maximum sequence number, which allows
5448 * invalid frames to be safely ignored.
5449 *
5450 * With tx window sizes greater than half of the tx window
5451 * maximum, the frame is invalid and cannot be ignored. This
5452 * causes a disconnect.
5453 */
5454
5455 if (chan->tx_win <= ((chan->tx_win_max + 1) >> 1)) {
5456 BT_DBG("Invalid/Ignore - txseq outside tx window");
5457 return L2CAP_TXSEQ_INVALID_IGNORE;
5458 } else {
5459 BT_DBG("Invalid - txseq outside tx window");
5460 return L2CAP_TXSEQ_INVALID;
5461 }
5462 } else {
5463 BT_DBG("Unexpected - txseq indicates missing frames");
5464 return L2CAP_TXSEQ_UNEXPECTED;
5465 }
5466}
5467
d2a7ac5d
MM		 5468static int l2cap_rx_state_recv(struct l2cap_chan *chan,
5469 struct l2cap_ctrl *control,
5470 struct sk_buff *skb, u8 event)
5471{
5472 int err = 0;
5473 bool skb_in_use = 0;
5474
5475 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5476 event);
5477
5478 switch (event) {
5479 case L2CAP_EV_RECV_IFRAME:
5480 switch (l2cap_classify_txseq(chan, control->txseq)) {
5481 case L2CAP_TXSEQ_EXPECTED:
5482 l2cap_pass_to_tx(chan, control);
5483
5484 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5485 BT_DBG("Busy, discarding expected seq %d",
5486 control->txseq);
5487 break;
5488 }
5489
5490 chan->expected_tx_seq = __next_seq(chan,
5491 control->txseq);
5492
5493 chan->buffer_seq = chan->expected_tx_seq;
5494 skb_in_use = 1;
5495
5496 err = l2cap_reassemble_sdu(chan, skb, control);
5497 if (err)
5498 break;
5499
5500 if (control->final) {
5501 if (!test_and_clear_bit(CONN_REJ_ACT,
5502 &chan->conn_state)) {
5503 control->final = 0;
5504 l2cap_retransmit_all(chan, control);
5505 l2cap_ertm_send(chan);
5506 }
5507 }
5508
5509 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
5510 l2cap_send_ack(chan);
5511 break;
5512 case L2CAP_TXSEQ_UNEXPECTED:
5513 l2cap_pass_to_tx(chan, control);
5514
5515 /* Can't issue SREJ frames in the local busy state.
5516 * Drop this frame, it will be seen as missing
5517 * when local busy is exited.
5518 */
5519 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
5520 BT_DBG("Busy, discarding unexpected seq %d",
5521 control->txseq);
5522 break;
5523 }
5524
5525 /* There was a gap in the sequence, so an SREJ
5526 * must be sent for each missing frame. The
5527 * current frame is stored for later use.
5528 */
5529 skb_queue_tail(&chan->srej_q, skb);
5530 skb_in_use = 1;
5531 BT_DBG("Queued %p (queue len %d)", skb,
5532 skb_queue_len(&chan->srej_q));
5533
5534 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
5535 l2cap_seq_list_clear(&chan->srej_list);
5536 l2cap_send_srej(chan, control->txseq);
5537
5538 chan->rx_state = L2CAP_RX_STATE_SREJ_SENT;
5539 break;
5540 case L2CAP_TXSEQ_DUPLICATE:
5541 l2cap_pass_to_tx(chan, control);
5542 break;
5543 case L2CAP_TXSEQ_INVALID_IGNORE:
5544 break;
5545 case L2CAP_TXSEQ_INVALID:
5546 default:
5547 l2cap_send_disconn_req(chan->conn, chan,
5548 ECONNRESET);
5549 break;
5550 }
5551 break;
5552 case L2CAP_EV_RECV_RR:
5553 l2cap_pass_to_tx(chan, control);
5554 if (control->final) {
5555 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5556
5557 if (!test_and_clear_bit(CONN_REJ_ACT,
5558 &chan->conn_state)) {
5559 control->final = 0;
5560 l2cap_retransmit_all(chan, control);
5561 }
5562
5563 l2cap_ertm_send(chan);
5564 } else if (control->poll) {
5565 l2cap_send_i_or_rr_or_rnr(chan);
5566 } else {
5567 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5568 &chan->conn_state) &&
5569 chan->unacked_frames)
5570 __set_retrans_timer(chan);
5571
5572 l2cap_ertm_send(chan);
5573 }
5574 break;
5575 case L2CAP_EV_RECV_RNR:
5576 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5577 l2cap_pass_to_tx(chan, control);
5578 if (control && control->poll) {
5579 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5580 l2cap_send_rr_or_rnr(chan, 0);
5581 }
5582 __clear_retrans_timer(chan);
5583 l2cap_seq_list_clear(&chan->retrans_list);
5584 break;
5585 case L2CAP_EV_RECV_REJ:
5586 l2cap_handle_rej(chan, control);
5587 break;
5588 case L2CAP_EV_RECV_SREJ:
5589 l2cap_handle_srej(chan, control);
5590 break;
5591 default:
5592 break;
5593 }
5594
5595 if (skb && !skb_in_use) {
5596 BT_DBG("Freeing %p", skb);
5597 kfree_skb(skb);
5598 }
5599
5600 return err;
5601}
5602
5603static int l2cap_rx_state_srej_sent(struct l2cap_chan *chan,
5604 struct l2cap_ctrl *control,
5605 struct sk_buff *skb, u8 event)
5606{
5607 int err = 0;
5608 u16 txseq = control->txseq;
5609 bool skb_in_use = 0;
5610
5611 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5612 event);
5613
5614 switch (event) {
5615 case L2CAP_EV_RECV_IFRAME:
5616 switch (l2cap_classify_txseq(chan, txseq)) {
5617 case L2CAP_TXSEQ_EXPECTED:
5618 /* Keep frame for reassembly later */
5619 l2cap_pass_to_tx(chan, control);
5620 skb_queue_tail(&chan->srej_q, skb);
5621 skb_in_use = 1;
5622 BT_DBG("Queued %p (queue len %d)", skb,
5623 skb_queue_len(&chan->srej_q));
5624
5625 chan->expected_tx_seq = __next_seq(chan, txseq);
5626 break;
5627 case L2CAP_TXSEQ_EXPECTED_SREJ:
5628 l2cap_seq_list_pop(&chan->srej_list);
5629
5630 l2cap_pass_to_tx(chan, control);
5631 skb_queue_tail(&chan->srej_q, skb);
5632 skb_in_use = 1;
5633 BT_DBG("Queued %p (queue len %d)", skb,
5634 skb_queue_len(&chan->srej_q));
5635
5636 err = l2cap_rx_queued_iframes(chan);
5637 if (err)
5638 break;
5639
5640 break;
5641 case L2CAP_TXSEQ_UNEXPECTED:
5642 /* Got a frame that can't be reassembled yet.
5643 * Save it for later, and send SREJs to cover
5644 * the missing frames.
5645 */
5646 skb_queue_tail(&chan->srej_q, skb);
5647 skb_in_use = 1;
5648 BT_DBG("Queued %p (queue len %d)", skb,
5649 skb_queue_len(&chan->srej_q));
5650
5651 l2cap_pass_to_tx(chan, control);
5652 l2cap_send_srej(chan, control->txseq);
5653 break;
5654 case L2CAP_TXSEQ_UNEXPECTED_SREJ:
5655 /* This frame was requested with an SREJ, but
5656 * some expected retransmitted frames are
5657 * missing. Request retransmission of missing
5658 * SREJ'd frames.
5659 */
5660 skb_queue_tail(&chan->srej_q, skb);
5661 skb_in_use = 1;
5662 BT_DBG("Queued %p (queue len %d)", skb,
5663 skb_queue_len(&chan->srej_q));
5664
5665 l2cap_pass_to_tx(chan, control);
5666 l2cap_send_srej_list(chan, control->txseq);
5667 break;
5668 case L2CAP_TXSEQ_DUPLICATE_SREJ:
5669 /* We've already queued this frame. Drop this copy. */
5670 l2cap_pass_to_tx(chan, control);
5671 break;
5672 case L2CAP_TXSEQ_DUPLICATE:
5673 /* Expecting a later sequence number, so this frame
5674 * was already received. Ignore it completely.
5675 */
5676 break;
5677 case L2CAP_TXSEQ_INVALID_IGNORE:
5678 break;
5679 case L2CAP_TXSEQ_INVALID:
5680 default:
5681 l2cap_send_disconn_req(chan->conn, chan,
5682 ECONNRESET);
5683 break;
5684 }
5685 break;
5686 case L2CAP_EV_RECV_RR:
5687 l2cap_pass_to_tx(chan, control);
5688 if (control->final) {
5689 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5690
5691 if (!test_and_clear_bit(CONN_REJ_ACT,
5692 &chan->conn_state)) {
5693 control->final = 0;
5694 l2cap_retransmit_all(chan, control);
5695 }
5696
5697 l2cap_ertm_send(chan);
5698 } else if (control->poll) {
5699 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5700 &chan->conn_state) &&
5701 chan->unacked_frames) {
5702 __set_retrans_timer(chan);
5703 }
5704
5705 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5706 l2cap_send_srej_tail(chan);
5707 } else {
5708 if (test_and_clear_bit(CONN_REMOTE_BUSY,
5709 &chan->conn_state) &&
5710 chan->unacked_frames)
5711 __set_retrans_timer(chan);
5712
5713 l2cap_send_ack(chan);
5714 }
5715 break;
5716 case L2CAP_EV_RECV_RNR:
5717 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5718 l2cap_pass_to_tx(chan, control);
5719 if (control->poll) {
5720 l2cap_send_srej_tail(chan);
5721 } else {
5722 struct l2cap_ctrl rr_control;
5723 memset(&rr_control, 0, sizeof(rr_control));
5724 rr_control.sframe = 1;
5725 rr_control.super = L2CAP_SUPER_RR;
5726 rr_control.reqseq = chan->buffer_seq;
5727 l2cap_send_sframe(chan, &rr_control);
5728 }
5729
5730 break;
5731 case L2CAP_EV_RECV_REJ:
5732 l2cap_handle_rej(chan, control);
5733 break;
5734 case L2CAP_EV_RECV_SREJ:
5735 l2cap_handle_srej(chan, control);
5736 break;
5737 }
5738
5739 if (skb && !skb_in_use) {
5740 BT_DBG("Freeing %p", skb);
5741 kfree_skb(skb);
5742 }
5743
5744 return err;
5745}
5746
32b32735
MM		 5747static int l2cap_finish_move(struct l2cap_chan *chan)
5748{
5749 BT_DBG("chan %p", chan);
5750
5751 chan->rx_state = L2CAP_RX_STATE_RECV;
5752
5753 if (chan->hs_hcon)
5754 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
5755 else
5756 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
5757
5758 return l2cap_resegment(chan);
5759}
5760
5761static int l2cap_rx_state_wait_p(struct l2cap_chan *chan,
5762 struct l2cap_ctrl *control,
5763 struct sk_buff *skb, u8 event)
5764{
5765 int err;
5766
5767 BT_DBG("chan %p, control %p, skb %p, event %d", chan, control, skb,
5768 event);
5769
5770 if (!control->poll)
5771 return -EPROTO;
5772
5773 l2cap_process_reqseq(chan, control->reqseq);
5774
5775 if (!skb_queue_empty(&chan->tx_q))
5776 chan->tx_send_head = skb_peek(&chan->tx_q);
5777 else
5778 chan->tx_send_head = NULL;
5779
5780 /* Rewind next_tx_seq to the point expected
5781 * by the receiver.
5782 */
5783 chan->next_tx_seq = control->reqseq;
5784 chan->unacked_frames = 0;
5785
5786 err = l2cap_finish_move(chan);
5787 if (err)
5788 return err;
5789
5790 set_bit(CONN_SEND_FBIT, &chan->conn_state);
5791 l2cap_send_i_or_rr_or_rnr(chan);
5792
5793 if (event == L2CAP_EV_RECV_IFRAME)
5794 return -EPROTO;
5795
5796 return l2cap_rx_state_recv(chan, control, NULL, event);
5797}
5798
5799static int l2cap_rx_state_wait_f(struct l2cap_chan *chan,
5800 struct l2cap_ctrl *control,
5801 struct sk_buff *skb, u8 event)
5802{
5803 int err;
5804
5805 if (!control->final)
5806 return -EPROTO;
5807
5808 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
5809
5810 chan->rx_state = L2CAP_RX_STATE_RECV;
5811 l2cap_process_reqseq(chan, control->reqseq);
5812
5813 if (!skb_queue_empty(&chan->tx_q))
5814 chan->tx_send_head = skb_peek(&chan->tx_q);
5815 else
5816 chan->tx_send_head = NULL;
5817
5818 /* Rewind next_tx_seq to the point expected
5819 * by the receiver.
5820 */
5821 chan->next_tx_seq = control->reqseq;
5822 chan->unacked_frames = 0;
5823
5824 if (chan->hs_hcon)
5825 chan->conn->mtu = chan->hs_hcon->hdev->block_mtu;
5826 else
5827 chan->conn->mtu = chan->conn->hcon->hdev->acl_mtu;
5828
5829 err = l2cap_resegment(chan);
5830
5831 if (!err)
5832 err = l2cap_rx_state_recv(chan, control, skb, event);
5833
5834 return err;
5835}
5836
d2a7ac5d
MM		 5837static bool __valid_reqseq(struct l2cap_chan *chan, u16 reqseq)
5838{
5839 /* Make sure reqseq is for a packet that has been sent but not acked */
5840 u16 unacked;
5841
5842 unacked = __seq_offset(chan, chan->next_tx_seq, chan->expected_ack_seq);
5843 return __seq_offset(chan, chan->next_tx_seq, reqseq) <= unacked;
5844}
5845
cec8ab6e
MM		 5846static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5847 struct sk_buff *skb, u8 event)
218bb9df 5848{
d2a7ac5d
MM		 5849 int err = 0;
5850
5851 BT_DBG("chan %p, control %p, skb %p, event %d, state %d", chan,
5852 control, skb, event, chan->rx_state);
5853
5854 if (__valid_reqseq(chan, control->reqseq)) {
5855 switch (chan->rx_state) {
5856 case L2CAP_RX_STATE_RECV:
5857 err = l2cap_rx_state_recv(chan, control, skb, event);
5858 break;
5859 case L2CAP_RX_STATE_SREJ_SENT:
5860 err = l2cap_rx_state_srej_sent(chan, control, skb,
5861 event);
5862 break;
32b32735
MM		 5863 case L2CAP_RX_STATE_WAIT_P:
5864 err = l2cap_rx_state_wait_p(chan, control, skb, event);
5865 break;
5866 case L2CAP_RX_STATE_WAIT_F:
5867 err = l2cap_rx_state_wait_f(chan, control, skb, event);
5868 break;
d2a7ac5d
MM		 5869 default:
5870 /* shut it down */
5871 break;
5872 }
5873 } else {
5874 BT_DBG("Invalid reqseq %d (next_tx_seq %d, expected_ack_seq %d",
5875 control->reqseq, chan->next_tx_seq,
5876 chan->expected_ack_seq);
5877 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
5878 }
5879
5880 return err;
cec8ab6e
MM		 5881}
5882
5883static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control,
5884 struct sk_buff *skb)
5885{
4b51dae9
MM		 5886 int err = 0;
5887
5888 BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb,
5889 chan->rx_state);
5890
5891 if (l2cap_classify_txseq(chan, control->txseq) ==
5892 L2CAP_TXSEQ_EXPECTED) {
5893 l2cap_pass_to_tx(chan, control);
5894
5895 BT_DBG("buffer_seq %d->%d", chan->buffer_seq,
5896 __next_seq(chan, chan->buffer_seq));
5897
5898 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
5899
5900 l2cap_reassemble_sdu(chan, skb, control);
5901 } else {
5902 if (chan->sdu) {
5903 kfree_skb(chan->sdu);
5904 chan->sdu = NULL;
5905 }
5906 chan->sdu_last_frag = NULL;
5907 chan->sdu_len = 0;
5908
5909 if (skb) {
5910 BT_DBG("Freeing %p", skb);
5911 kfree_skb(skb);
5912 }
5913 }
5914
5915 chan->last_acked_seq = control->txseq;
5916 chan->expected_tx_seq = __next_seq(chan, control->txseq);
5917
5918 return err;
cec8ab6e
MM		 5919}
5920
5921static int l2cap_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
5922{
5923 struct l2cap_ctrl *control = &bt_cb(skb)->control;
5924 u16 len;
5925 u8 event;
218bb9df 5926
b76bbd66
MM		 5927 __unpack_control(chan, skb);
5928
218bb9df
GP		 5929 len = skb->len;
5930
5931 /*
5932 * We can just drop the corrupted I-frame here.
5933 * Receiver will miss it and start proper recovery
cec8ab6e 5934 * procedures and ask for retransmission.
218bb9df 5935 */
47d1ec61 5936 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 5937 goto drop;
5938
cec8ab6e 5939 if (!control->sframe && control->sar == L2CAP_SAR_START)
03a51213 5940 len -= L2CAP_SDULEN_SIZE;
218bb9df 5941
47d1ec61 5942 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 5943 len -= L2CAP_FCS_SIZE;
218bb9df 5944
47d1ec61 5945 if (len > chan->mps) {
8c1d787b 5946 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5947 goto drop;
5948 }
5949
cec8ab6e
MM		 5950 if (!control->sframe) {
5951 int err;
218bb9df 5952
cec8ab6e
MM		 5953 BT_DBG("iframe sar %d, reqseq %d, final %d, txseq %d",
5954 control->sar, control->reqseq, control->final,
5955 control->txseq);
218bb9df 5956
cec8ab6e
MM		 5957 /* Validate F-bit - F=0 always valid, F=1 only
5958 * valid in TX WAIT_F
5959 */
5960 if (control->final && chan->tx_state != L2CAP_TX_STATE_WAIT_F)
218bb9df 5961 goto drop;
cec8ab6e
MM		 5962
5963 if (chan->mode != L2CAP_MODE_STREAMING) {
5964 event = L2CAP_EV_RECV_IFRAME;
5965 err = l2cap_rx(chan, control, skb, event);
5966 } else {
5967 err = l2cap_stream_rx(chan, control, skb);
218bb9df
GP		 5968 }
5969
cec8ab6e
MM		 5970 if (err)
5971 l2cap_send_disconn_req(chan->conn, chan,
5972 ECONNRESET);
218bb9df 5973 } else {
cec8ab6e
MM		 5974 const u8 rx_func_to_event[4] = {
5975 L2CAP_EV_RECV_RR, L2CAP_EV_RECV_REJ,
5976 L2CAP_EV_RECV_RNR, L2CAP_EV_RECV_SREJ
5977 };
5978
5979 /* Only I-frames are expected in streaming mode */
5980 if (chan->mode == L2CAP_MODE_STREAMING)
5981 goto drop;
5982
5983 BT_DBG("sframe reqseq %d, final %d, poll %d, super %d",
5984 control->reqseq, control->final, control->poll,
5985 control->super);
5986
218bb9df
GP		 5987 if (len != 0) {
5988 BT_ERR("%d", len);
8c1d787b 5989 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 5990 goto drop;
5991 }
5992
cec8ab6e
MM		 5993 /* Validate F and P bits */
5994 if (control->final && (control->poll ||
5995 chan->tx_state != L2CAP_TX_STATE_WAIT_F))
5996 goto drop;
5997
5998 event = rx_func_to_event[control->super];
5999 if (l2cap_rx(chan, control, skb, event))
6000 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 6001 }
6002
6003 return 0;
6004
6005drop:
6006 kfree_skb(skb);
6007 return 0;
6008}
6009
13ca56e0
AE		 6010static void l2cap_data_channel(struct l2cap_conn *conn, u16 cid,
6011 struct sk_buff *skb)
1da177e4 6012{
48454079 6013 struct l2cap_chan *chan;
1da177e4 6014
baa7e1fa 6015 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 6016 if (!chan) {
97e8e89d
AE		 6017 if (cid == L2CAP_CID_A2MP) {
6018 chan = a2mp_channel_create(conn, skb);
6019 if (!chan) {
6020 kfree_skb(skb);
13ca56e0 6021 return;
97e8e89d
AE		 6022 }
6023
6024 l2cap_chan_lock(chan);
6025 } else {
6026 BT_DBG("unknown cid 0x%4.4x", cid);
6027 /* Drop packet and return */
6028 kfree_skb(skb);
13ca56e0 6029 return;
97e8e89d 6030 }
1da177e4
LT		 6031 }
6032
49208c9c 6033 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6034
89bc500e 6035 if (chan->state != BT_CONNECTED)
1da177e4
LT		 6036 goto drop;
6037
0c1bc5c6 6038 switch (chan->mode) {
1c2acffb
GP		 6039 case L2CAP_MODE_BASIC:
6040 /* If socket recv buffers overflows we drop data here
6041 * which is *bad* because L2CAP has to be reliable.
6042 * But we don't have any other choice. L2CAP doesn't
6043 * provide flow control mechanism. */
1da177e4 6044
0c1bc5c6 6045 if (chan->imtu < skb->len)
1c2acffb 6046 goto drop;
1da177e4 6047
80b98027 6048 if (!chan->ops->recv(chan, skb))
1c2acffb
GP		 6049 goto done;
6050 break;
6051
6052 case L2CAP_MODE_ERTM:
6840ed07 6053 case L2CAP_MODE_STREAMING:
cec8ab6e 6054 l2cap_data_rcv(chan, skb);
6840ed07
GP		 6055 goto done;
6056
1c2acffb 6057 default:
0c1bc5c6 6058 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 6059 break;
6060 }
1da177e4
LT		 6061
6062drop:
6063 kfree_skb(skb);
6064
6065done:
6be36555 6066 l2cap_chan_unlock(chan);
1da177e4
LT		 6067}
6068
84104b24
AE		 6069static void l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm,
6070 struct sk_buff *skb)
1da177e4 6071{
23691d75 6072 struct l2cap_chan *chan;
1da177e4 6073
c2287681 6074 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 6075 if (!chan)
1da177e4
LT		 6076 goto drop;
6077
5b4cedaa 6078 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 6079
89bc500e 6080 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 6081 goto drop;
6082
e13e21dc 6083 if (chan->imtu < skb->len)
1da177e4
LT		 6084 goto drop;
6085
80b98027 6086 if (!chan->ops->recv(chan, skb))
84104b24 6087 return;
1da177e4
LT		 6088
6089drop:
6090 kfree_skb(skb);
1da177e4
LT		 6091}
6092
6810fca7
AE		 6093static void l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
6094 struct sk_buff *skb)
9f69bda6 6095{
23691d75 6096 struct l2cap_chan *chan;
9f69bda6 6097
c2287681 6098 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 6099 if (!chan)
9f69bda6
GP		 6100 goto drop;
6101
5b4cedaa 6102 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 6103
89bc500e 6104 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 6105 goto drop;
6106
e13e21dc 6107 if (chan->imtu < skb->len)
9f69bda6
GP		 6108 goto drop;
6109
80b98027 6110 if (!chan->ops->recv(chan, skb))
6810fca7 6111 return;
9f69bda6
GP		 6112
6113drop:
6114 kfree_skb(skb);
9f69bda6
GP		 6115}
6116
1da177e4
LT		 6117static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
6118{
6119 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 6120 u16 cid, len;
6121 __le16 psm;
1da177e4
LT		 6122
6123 skb_pull(skb, L2CAP_HDR_SIZE);
6124 cid = __le16_to_cpu(lh->cid);
6125 len = __le16_to_cpu(lh->len);
6126
1c2acffb
GP		 6127 if (len != skb->len) {
6128 kfree_skb(skb);
6129 return;
6130 }
6131
1da177e4
LT		 6132 BT_DBG("len %d, cid 0x%4.4x", len, cid);
6133
6134 switch (cid) {
3300d9a9 6135 case L2CAP_CID_LE_SIGNALING:
8db4dc46 6136 case L2CAP_CID_SIGNALING:
1da177e4
LT		 6137 l2cap_sig_channel(conn, skb);
6138 break;
6139
8db4dc46 6140 case L2CAP_CID_CONN_LESS:
097db76c 6141 psm = get_unaligned((__le16 *) skb->data);
0181a70f 6142 skb_pull(skb, L2CAP_PSMLEN_SIZE);
1da177e4
LT		 6143 l2cap_conless_channel(conn, psm, skb);
6144 break;
6145
9f69bda6
GP		 6146 case L2CAP_CID_LE_DATA:
6147 l2cap_att_channel(conn, cid, skb);
6148 break;
6149
b501d6a1
AB		 6150 case L2CAP_CID_SMP:
6151 if (smp_sig_channel(conn, skb))
6152 l2cap_conn_del(conn->hcon, EACCES);
6153 break;
6154
1da177e4
LT		 6155 default:
6156 l2cap_data_channel(conn, cid, skb);
6157 break;
6158 }
6159}
6160
6161/* ---- L2CAP interface with lower layer (HCI) ---- */
6162
686ebf28 6163int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 6164{
6165 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 6166 struct l2cap_chan *c;
1da177e4 6167
6ed93dc6 6168 BT_DBG("hdev %s, bdaddr %pMR", hdev->name, bdaddr);
1da177e4
LT		 6169
6170 /* Find listening sockets and check their link_mode */
23691d75
GP		 6171 read_lock(&chan_list_lock);
6172 list_for_each_entry(c, &chan_list, global_l) {
6173 struct sock *sk = c->sk;
4343478f 6174
89bc500e 6175 if (c->state != BT_LISTEN)
1da177e4
LT		 6176 continue;
6177
6178 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 6179 lm1 |= HCI_LM_ACCEPT;
43bd0f32 6180 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 6181 lm1 |= HCI_LM_MASTER;
1da177e4 6182 exact++;
2af6b9d5
MH		 6183 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
6184 lm2 |= HCI_LM_ACCEPT;
43bd0f32 6185 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 6186 lm2 |= HCI_LM_MASTER;
6187 }
1da177e4 6188 }
23691d75 6189 read_unlock(&chan_list_lock);
1da177e4
LT		 6190
6191 return exact ? lm1 : lm2;
6192}
6193
9e664631 6194void l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 6195{
0139418c
MH		 6196 struct l2cap_conn *conn;
6197
6ed93dc6 6198 BT_DBG("hcon %p bdaddr %pMR status %d", hcon, &hcon->dst, status);
1da177e4 6199
1da177e4 6200 if (!status) {
1da177e4
LT		 6201 conn = l2cap_conn_add(hcon, status);
6202 if (conn)
6203 l2cap_conn_ready(conn);
0139418c 6204 } else
e175072f 6205 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4 6206
1da177e4
LT		 6207}
6208
686ebf28 6209int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 6210{
6211 struct l2cap_conn *conn = hcon->l2cap_data;
6212
6213 BT_DBG("hcon %p", hcon);
6214
686ebf28 6215 if (!conn)
9f5a0d7b 6216 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 6217 return conn->disc_reason;
6218}
6219
9e664631 6220void l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 6221{
6222 BT_DBG("hcon %p reason %d", hcon, reason);
6223
e175072f 6224 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 6225}
6226
4343478f 6227static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 6228{
715ec005 6229 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 6230 return;
6231
f62e4323 6232 if (encrypt == 0x00) {
4343478f 6233 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 6234 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 6235 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 6236 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 6237 } else {
4343478f 6238 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 6239 __clear_chan_timer(chan);
f62e4323
MH		 6240 }
6241}
6242
686ebf28 6243int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 6244{
0139418c 6245 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 6246 struct l2cap_chan *chan;
1da177e4 6247
0139418c 6248 if (!conn)
1da177e4 6249 return 0;
0139418c 6250
89d8b407 6251 BT_DBG("conn %p status 0x%2.2x encrypt %u", conn, status, encrypt);
1da177e4 6252
160dc6ac 6253 if (hcon->type == LE_LINK) {
35d4adcc
HG		 6254 if (!status && encrypt)
6255 smp_distribute_keys(conn, 0);
17cd3f37 6256 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 6257 }
6258
3df91ea2 6259 mutex_lock(&conn->chan_lock);
1da177e4 6260
3df91ea2 6261 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 6262 l2cap_chan_lock(chan);
1da177e4 6263
89d8b407
AE		 6264 BT_DBG("chan %p scid 0x%4.4x state %s", chan, chan->scid,
6265 state_to_string(chan->state));
f1cb9af5 6266
78eb2f98
AE		 6267 if (chan->chan_type == L2CAP_CHAN_CONN_FIX_A2MP) {
6268 l2cap_chan_unlock(chan);
6269 continue;
6270 }
6271
f1cb9af5
VCG		 6272 if (chan->scid == L2CAP_CID_LE_DATA) {
6273 if (!status && encrypt) {
6274 chan->sec_level = hcon->sec_level;
cf4cd009 6275 l2cap_chan_ready(chan);
f1cb9af5
VCG		 6276 }
6277
6be36555 6278 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 6279 continue;
6280 }
6281
c1360a1c 6282 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 6283 l2cap_chan_unlock(chan);
6a8d3010
MH		 6284 continue;
6285 }
6286
89bc500e 6287 if (!status && (chan->state == BT_CONNECTED ||
2d792818 6288 chan->state == BT_CONFIG)) {
a7d7723a
GP		 6289 struct sock *sk = chan->sk;
6290
c5daa683 6291 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
a7d7723a
GP		 6292 sk->sk_state_change(sk);
6293
4343478f 6294 l2cap_check_encryption(chan, encrypt);
6be36555 6295 l2cap_chan_unlock(chan);
9719f8af
MH		 6296 continue;
6297 }
6298
89bc500e 6299 if (chan->state == BT_CONNECT) {
b1235d79 6300 if (!status) {
93c3e8f5 6301 l2cap_start_connection(chan);
b1235d79 6302 } else {
ba13ccd9 6303 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 6304 }
89bc500e 6305 } else if (chan->state == BT_CONNECT2) {
6be36555 6306 struct sock *sk = chan->sk;
b1235d79 6307 struct l2cap_conn_rsp rsp;
df3c3931 6308 __u16 res, stat;
1da177e4 6309
6be36555
AE		 6310 lock_sock(sk);
6311
b1235d79 6312 if (!status) {
c5daa683
GP		 6313 if (test_bit(BT_SK_DEFER_SETUP,
6314 &bt_sk(sk)->flags)) {
df3c3931
JH		 6315 res = L2CAP_CR_PEND;
6316 stat = L2CAP_CS_AUTHOR_PEND;
2dc4e510 6317 chan->ops->defer(chan);
df3c3931 6318 } else {
0e587be7 6319 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 6320 res = L2CAP_CR_SUCCESS;
6321 stat = L2CAP_CS_NO_INFO;
6322 }
b1235d79 6323 } else {
0e587be7 6324 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 6325 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 6326 res = L2CAP_CR_SEC_BLOCK;
6327 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 6328 }
6329
6be36555
AE		 6330 release_sock(sk);
6331
fe4128e0
GP		 6332 rsp.scid = cpu_to_le16(chan->dcid);
6333 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 6334 rsp.result = cpu_to_le16(res);
6335 rsp.status = cpu_to_le16(stat);
fc7f8a7e 6336 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
2d792818 6337 sizeof(rsp), &rsp);
2d369359
MM		 6338
6339 if (!test_bit(CONF_REQ_SENT, &chan->conf_state) &&
6340 res == L2CAP_CR_SUCCESS) {
6341 char buf[128];
6342 set_bit(CONF_REQ_SENT, &chan->conf_state);
6343 l2cap_send_cmd(conn, l2cap_get_ident(conn),
6344 L2CAP_CONF_REQ,
6345 l2cap_build_conf_req(chan, buf),
6346 buf);
6347 chan->num_conf_req++;
6348 }
b1235d79 6349 }
1da177e4 6350
6be36555 6351 l2cap_chan_unlock(chan);
1da177e4
LT		 6352 }
6353
3df91ea2 6354 mutex_unlock(&conn->chan_lock);
b1235d79 6355
1da177e4
LT		 6356 return 0;
6357}
6358
686ebf28 6359int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 6360{
6361 struct l2cap_conn *conn = hcon->l2cap_data;
d73a0988
AE		 6362 struct l2cap_hdr *hdr;
6363 int len;
1da177e4 6364
1d13a254
AE		 6365 /* For AMP controller do not create l2cap conn */
6366 if (!conn && hcon->hdev->dev_type != HCI_BREDR)
6367 goto drop;
1da177e4 6368
5a08ecce
AE		 6369 if (!conn)
6370 conn = l2cap_conn_add(hcon, 0);
6371
6372 if (!conn)
1da177e4
LT		 6373 goto drop;
6374
6375 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
6376
d73a0988
AE		 6377 switch (flags) {
6378 case ACL_START:
6379 case ACL_START_NO_FLUSH:
6380 case ACL_COMPLETE:
1da177e4
LT		 6381 if (conn->rx_len) {
6382 BT_ERR("Unexpected start frame (len %d)", skb->len);
6383 kfree_skb(conn->rx_skb);
6384 conn->rx_skb = NULL;
6385 conn->rx_len = 0;
6386 l2cap_conn_unreliable(conn, ECOMM);
6387 }
6388
aae7fe22
AE		 6389 /* Start fragment always begin with Basic L2CAP header */
6390 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 6391 BT_ERR("Frame is too short (len %d)", skb->len);
6392 l2cap_conn_unreliable(conn, ECOMM);
6393 goto drop;
6394 }
6395
6396 hdr = (struct l2cap_hdr *) skb->data;
6397 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
6398
6399 if (len == skb->len) {
6400 /* Complete frame received */
6401 l2cap_recv_frame(conn, skb);
6402 return 0;
6403 }
6404
6405 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
6406
6407 if (skb->len > len) {
6408 BT_ERR("Frame is too long (len %d, expected len %d)",
2d792818 6409 skb->len, len);
1da177e4
LT		 6410 l2cap_conn_unreliable(conn, ECOMM);
6411 goto drop;
6412 }
6413
6414 /* Allocate skb for the complete frame (with header) */
8bcde1f2 6415 conn->rx_skb = bt_skb_alloc(len, GFP_KERNEL);
af05b30b 6416 if (!conn->rx_skb)
1da177e4
LT		 6417 goto drop;
6418
d626f62b 6419 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 6420 skb->len);
1da177e4 6421 conn->rx_len = len - skb->len;
d73a0988
AE		 6422 break;
6423
6424 case ACL_CONT:
1da177e4
LT		 6425 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
6426
6427 if (!conn->rx_len) {
6428 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
6429 l2cap_conn_unreliable(conn, ECOMM);
6430 goto drop;
6431 }
6432
6433 if (skb->len > conn->rx_len) {
6434 BT_ERR("Fragment is too long (len %d, expected %d)",
2d792818 6435 skb->len, conn->rx_len);
1da177e4
LT		 6436 kfree_skb(conn->rx_skb);
6437 conn->rx_skb = NULL;
6438 conn->rx_len = 0;
6439 l2cap_conn_unreliable(conn, ECOMM);
6440 goto drop;
6441 }
6442
d626f62b 6443 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2d792818 6444 skb->len);
1da177e4
LT		 6445 conn->rx_len -= skb->len;
6446
6447 if (!conn->rx_len) {
6448 /* Complete frame received */
6449 l2cap_recv_frame(conn, conn->rx_skb);
6450 conn->rx_skb = NULL;
6451 }
d73a0988 6452 break;
1da177e4
LT		 6453 }
6454
6455drop:
6456 kfree_skb(skb);
6457 return 0;
6458}
6459
aef7d97c 6460static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 6461{
23691d75 6462 struct l2cap_chan *c;
1da177e4 6463
333055f2 6464 read_lock(&chan_list_lock);
1da177e4 6465
23691d75
GP		 6466 list_for_each_entry(c, &chan_list, global_l) {
6467 struct sock *sk = c->sk;
101545f6 6468
fcb73338
AE		 6469 seq_printf(f, "%pMR %pMR %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
6470 &bt_sk(sk)->src, &bt_sk(sk)->dst,
6471 c->state, __le16_to_cpu(c->psm),
6472 c->scid, c->dcid, c->imtu, c->omtu,
6473 c->sec_level, c->mode);
61e1b4b7 6474 }
1da177e4 6475
333055f2 6476 read_unlock(&chan_list_lock);
1da177e4 6477
aef7d97c 6478 return 0;
1da177e4
LT		 6479}
6480
aef7d97c
MH		 6481static int l2cap_debugfs_open(struct inode *inode, struct file *file)
6482{
6483 return single_open(file, l2cap_debugfs_show, inode->i_private);
6484}
6485
6486static const struct file_operations l2cap_debugfs_fops = {
6487 .open = l2cap_debugfs_open,
6488 .read = seq_read,
6489 .llseek = seq_lseek,
6490 .release = single_release,
6491};
6492
6493static struct dentry *l2cap_debugfs;
1da177e4 6494
64274518 6495int __init l2cap_init(void)
1da177e4
LT		 6496{
6497 int err;
be9d1227 6498
bb58f747 6499 err = l2cap_init_sockets();
1da177e4
LT		 6500 if (err < 0)
6501 return err;
6502
aef7d97c 6503 if (bt_debugfs) {
2d792818
GP		 6504 l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
6505 NULL, &l2cap_debugfs_fops);
aef7d97c
MH		 6506 if (!l2cap_debugfs)
6507 BT_ERR("Failed to create L2CAP debug file");
6508 }
1da177e4 6509
1da177e4 6510 return 0;
1da177e4
LT		 6511}
6512
64274518 6513void l2cap_exit(void)
1da177e4 6514{
aef7d97c 6515 debugfs_remove(l2cap_debugfs);
bb58f747 6516 l2cap_cleanup_sockets();
1da177e4
LT		 6517}
6518
d1c4a17d
GP		 6519module_param(disable_ertm, bool, 0644);
6520MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)