projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: hci_conn_auto_accept() doesn't need locking
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
1da177e4
LT		 6
7 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License version 2 as
11 published by the Free Software Foundation;
12
13 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
14 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
16 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 17 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
18 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 20 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21
8e87d142
YH		 22 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
23 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 24 SOFTWARE IS DISCLAIMED.
25*/
26
bb58f747 27/* Bluetooth L2CAP core. */
1da177e4 28
1da177e4
LT		 29#include <linux/module.h>
30
31#include <linux/types.h>
4fc268d2 32#include <linux/capability.h>
1da177e4
LT		 33#include <linux/errno.h>
34#include <linux/kernel.h>
1da177e4
LT		 35#include <linux/sched.h>
36#include <linux/slab.h>
37#include <linux/poll.h>
38#include <linux/fcntl.h>
39#include <linux/init.h>
40#include <linux/interrupt.h>
41#include <linux/socket.h>
42#include <linux/skbuff.h>
1da177e4 43#include <linux/list.h>
be9d1227 44#include <linux/device.h>
aef7d97c
MH		 45#include <linux/debugfs.h>
46#include <linux/seq_file.h>
af05b30b 47#include <linux/uaccess.h>
fcc203c3 48#include <linux/crc16.h>
1da177e4
LT		 49#include <net/sock.h>
50
51#include <asm/system.h>
1da177e4
LT		 52#include <asm/unaligned.h>
53
54#include <net/bluetooth/bluetooth.h>
55#include <net/bluetooth/hci_core.h>
56#include <net/bluetooth/l2cap.h>
b501d6a1 57#include <net/bluetooth/smp.h>
1da177e4 58
bb58f747 59int disable_ertm;
f0709e03 60
47ec1dcd 61static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 62static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 63
b5ad8b7f
JB		 64static LIST_HEAD(chan_list);
65static DEFINE_RWLOCK(chan_list_lock);
1da177e4 66
1da177e4
LT		 67static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
68 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 69static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
70 void *data);
710f9b0a 71static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a
GP		 72static void l2cap_send_disconn_req(struct l2cap_conn *conn,
73 struct l2cap_chan *chan, int err);
1da177e4 74
218bb9df
GP		 75static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
76
0139418c 77/* ---- L2CAP channels ---- */
71ba0e56
GP		 78
79static inline void chan_hold(struct l2cap_chan *c)
80{
81 atomic_inc(&c->refcnt);
82}
83
84static inline void chan_put(struct l2cap_chan *c)
85{
86 if (atomic_dec_and_test(&c->refcnt))
87 kfree(c);
88}
89
baa7e1fa 90static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 91{
48454079 92 struct l2cap_chan *c;
baa7e1fa
GP		 93
94 list_for_each_entry(c, &conn->chan_l, list) {
fe4128e0 95 if (c->dcid == cid)
baa7e1fa 96 return c;
0139418c 97 }
baa7e1fa 98 return NULL;
0139418c
MH		 99}
100
baa7e1fa 101static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 102{
48454079 103 struct l2cap_chan *c;
baa7e1fa
GP		 104
105 list_for_each_entry(c, &conn->chan_l, list) {
fe4128e0 106 if (c->scid == cid)
baa7e1fa 107 return c;
0139418c 108 }
baa7e1fa 109 return NULL;
0139418c
MH		 110}
111
112/* Find channel with given SCID.
113 * Returns locked socket */
baa7e1fa 114static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 115{
48454079 116 struct l2cap_chan *c;
baa7e1fa
GP		 117
118 read_lock(&conn->chan_lock);
119 c = __l2cap_get_chan_by_scid(conn, cid);
48454079
GP		 120 if (c)
121 bh_lock_sock(c->sk);
baa7e1fa 122 read_unlock(&conn->chan_lock);
48454079 123 return c;
0139418c
MH		 124}
125
baa7e1fa 126static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 127{
48454079 128 struct l2cap_chan *c;
baa7e1fa
GP		 129
130 list_for_each_entry(c, &conn->chan_l, list) {
fc7f8a7e 131 if (c->ident == ident)
baa7e1fa 132 return c;
0139418c 133 }
baa7e1fa 134 return NULL;
0139418c
MH		 135}
136
baa7e1fa 137static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 138{
48454079 139 struct l2cap_chan *c;
baa7e1fa
GP		 140
141 read_lock(&conn->chan_lock);
142 c = __l2cap_get_chan_by_ident(conn, ident);
48454079
GP		 143 if (c)
144 bh_lock_sock(c->sk);
baa7e1fa 145 read_unlock(&conn->chan_lock);
48454079 146 return c;
0139418c
MH		 147}
148
23691d75 149static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 150{
23691d75 151 struct l2cap_chan *c;
9e4425ff 152
23691d75
GP		 153 list_for_each_entry(c, &chan_list, global_l) {
154 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 155 return c;
9e4425ff 156 }
250938cb 157 return NULL;
9e4425ff
GP		 158}
159
160int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
161{
73b2ec18
GP		 162 int err;
163
23691d75 164 write_lock_bh(&chan_list_lock);
9e4425ff 165
23691d75 166 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 167 err = -EADDRINUSE;
168 goto done;
9e4425ff
GP		 169 }
170
73b2ec18
GP		 171 if (psm) {
172 chan->psm = psm;
173 chan->sport = psm;
174 err = 0;
175 } else {
176 u16 p;
177
178 err = -EINVAL;
179 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 180 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 181 chan->psm = cpu_to_le16(p);
182 chan->sport = cpu_to_le16(p);
183 err = 0;
184 break;
185 }
186 }
9e4425ff 187
73b2ec18 188done:
23691d75 189 write_unlock_bh(&chan_list_lock);
73b2ec18 190 return err;
9e4425ff
GP		 191}
192
193int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
194{
23691d75 195 write_lock_bh(&chan_list_lock);
9e4425ff
GP		 196
197 chan->scid = scid;
198
23691d75 199 write_unlock_bh(&chan_list_lock);
9e4425ff
GP		 200
201 return 0;
202}
203
baa7e1fa 204static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 205{
8db4dc46 206 u16 cid = L2CAP_CID_DYN_START;
0139418c 207
8db4dc46 208 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 209 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 210 return cid;
211 }
212
213 return 0;
214}
215
c9b66675 216static void l2cap_set_timer(struct l2cap_chan *chan, struct timer_list *timer, long timeout)
ab07801d 217{
457f4850 218 BT_DBG("chan %p state %d timeout %ld", chan, chan->state, timeout);
89bc500e 219
942ecc9c 220 if (!mod_timer(timer, jiffies + msecs_to_jiffies(timeout)))
774e5651 221 chan_hold(chan);
ab07801d
GP		 222}
223
c9b66675 224static void l2cap_clear_timer(struct l2cap_chan *chan, struct timer_list *timer)
ab07801d 225{
774e5651 226 BT_DBG("chan %p state %d", chan, chan->state);
ab07801d 227
774e5651
MM		 228 if (timer_pending(timer) && del_timer(timer))
229 chan_put(chan);
ab07801d
GP		 230}
231
badaaa00
GP		 232static char *state_to_string(int state)
233{
234 switch(state) {
235 case BT_CONNECTED:
236 return "BT_CONNECTED";
237 case BT_OPEN:
238 return "BT_OPEN";
239 case BT_BOUND:
240 return "BT_BOUND";
241 case BT_LISTEN:
242 return "BT_LISTEN";
243 case BT_CONNECT:
244 return "BT_CONNECT";
245 case BT_CONNECT2:
246 return "BT_CONNECT2";
247 case BT_CONFIG:
248 return "BT_CONFIG";
249 case BT_DISCONN:
250 return "BT_DISCONN";
251 case BT_CLOSED:
252 return "BT_CLOSED";
253 }
254
255 return "invalid state";
256}
257
89bc500e
GP		 258static void l2cap_state_change(struct l2cap_chan *chan, int state)
259{
badaaa00
GP		 260 BT_DBG("%p %s -> %s", chan, state_to_string(chan->state),
261 state_to_string(state));
262
89bc500e
GP		 263 chan->state = state;
264 chan->ops->state_change(chan->data, state);
265}
266
ab07801d
GP		 267static void l2cap_chan_timeout(unsigned long arg)
268{
269 struct l2cap_chan *chan = (struct l2cap_chan *) arg;
270 struct sock *sk = chan->sk;
271 int reason;
272
89bc500e 273 BT_DBG("chan %p state %d", chan, chan->state);
ab07801d
GP		 274
275 bh_lock_sock(sk);
276
277 if (sock_owned_by_user(sk)) {
278 /* sk is owned by user. Try again later */
f3f668b0 279 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
ab07801d 280 bh_unlock_sock(sk);
71ba0e56 281 chan_put(chan);
ab07801d
GP		 282 return;
283 }
284
89bc500e 285 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 286 reason = ECONNREFUSED;
89bc500e 287 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 288 chan->sec_level != BT_SECURITY_SDP)
289 reason = ECONNREFUSED;
290 else
291 reason = ETIMEDOUT;
292
0f852724 293 l2cap_chan_close(chan, reason);
ab07801d
GP		 294
295 bh_unlock_sock(sk);
296
ba3bd0ee 297 chan->ops->close(chan->data);
71ba0e56 298 chan_put(chan);
ab07801d
GP		 299}
300
23691d75 301struct l2cap_chan *l2cap_chan_create(struct sock *sk)
48454079
GP		 302{
303 struct l2cap_chan *chan;
304
305 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
306 if (!chan)
307 return NULL;
308
309 chan->sk = sk;
310
23691d75
GP		 311 write_lock_bh(&chan_list_lock);
312 list_add(&chan->global_l, &chan_list);
313 write_unlock_bh(&chan_list_lock);
314
ab07801d
GP		 315 setup_timer(&chan->chan_timer, l2cap_chan_timeout, (unsigned long) chan);
316
89bc500e
GP		 317 chan->state = BT_OPEN;
318
71ba0e56
GP		 319 atomic_set(&chan->refcnt, 1);
320
abc545b8
SJ		 321 BT_DBG("sk %p chan %p", sk, chan);
322
48454079
GP		 323 return chan;
324}
325
23691d75 326void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 327{
23691d75
GP		 328 write_lock_bh(&chan_list_lock);
329 list_del(&chan->global_l);
330 write_unlock_bh(&chan_list_lock);
331
71ba0e56 332 chan_put(chan);
6ff5abbf
GP		 333}
334
48454079 335static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 336{
af05b30b 337 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
fe4128e0 338 chan->psm, chan->dcid);
0139418c 339
9f5a0d7b 340 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 341
8c1d787b 342 chan->conn = conn;
0139418c 343
715ec005 344 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) {
b62f328b
VT		 345 if (conn->hcon->type == LE_LINK) {
346 /* LE connection */
0c1bc5c6 347 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 348 chan->scid = L2CAP_CID_LE_DATA;
349 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 350 } else {
351 /* Alloc CID for connection-oriented socket */
fe4128e0 352 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 353 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 354 }
715ec005 355 } else if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
0139418c 356 /* Connectionless socket */
fe4128e0
GP		 357 chan->scid = L2CAP_CID_CONN_LESS;
358 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 359 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 360 } else {
361 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 362 chan->scid = L2CAP_CID_SIGNALING;
363 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 364 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 365 }
366
8f7975b1
AE		 367 chan->local_id = L2CAP_BESTEFFORT_ID;
368 chan->local_stype = L2CAP_SERV_BESTEFFORT;
369 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
370 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
371 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
372 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
373
71ba0e56 374 chan_hold(chan);
baa7e1fa
GP		 375
376 list_add(&chan->list, &conn->chan_l);
0139418c
MH		 377}
378
8e87d142 379/* Delete channel.
0139418c 380 * Must be called on the locked socket. */
4519de9a 381static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 382{
48454079 383 struct sock *sk = chan->sk;
8c1d787b 384 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 385 struct sock *parent = bt_sk(sk)->parent;
386
c9b66675 387 __clear_chan_timer(chan);
0139418c 388
49208c9c 389 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 390
8e87d142 391 if (conn) {
baa7e1fa
GP		 392 /* Delete from channel list */
393 write_lock_bh(&conn->chan_lock);
394 list_del(&chan->list);
395 write_unlock_bh(&conn->chan_lock);
71ba0e56 396 chan_put(chan);
baa7e1fa 397
8c1d787b 398 chan->conn = NULL;
0139418c
MH		 399 hci_conn_put(conn->hcon);
400 }
401
89bc500e 402 l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 403 sock_set_flag(sk, SOCK_ZAPPED);
404
405 if (err)
406 sk->sk_err = err;
407
408 if (parent) {
409 bt_accept_unlink(sk);
410 parent->sk_data_ready(parent, 0);
411 } else
412 sk->sk_state_change(sk);
c13ffa62 413
c1360a1c
GP		 414 if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
415 test_bit(CONF_INPUT_DONE, &chan->conf_state)))
6ff5abbf 416 return;
2ead70b8 417
58d35f87 418 skb_queue_purge(&chan->tx_q);
c13ffa62 419
0c1bc5c6 420 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 421 struct srej_list *l, *tmp;
422
1a09bcb9
GP		 423 __clear_retrans_timer(chan);
424 __clear_monitor_timer(chan);
425 __clear_ack_timer(chan);
c13ffa62 426
f1c6775b 427 skb_queue_purge(&chan->srej_q);
c13ffa62 428
39d5a3ee 429 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 430 list_del(&l->list);
431 kfree(l);
432 }
433 }
0139418c
MH		 434}
435
4519de9a
GP		 436static void l2cap_chan_cleanup_listen(struct sock *parent)
437{
438 struct sock *sk;
439
440 BT_DBG("parent %p", parent);
441
442 /* Close not yet accepted channels */
0f852724 443 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 444 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
c9b66675 445 __clear_chan_timer(chan);
0f852724 446 lock_sock(sk);
ba3bd0ee 447 l2cap_chan_close(chan, ECONNRESET);
0f852724 448 release_sock(sk);
ba3bd0ee 449 chan->ops->close(chan->data);
0f852724 450 }
4519de9a
GP		 451}
452
0f852724 453void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 454{
455 struct l2cap_conn *conn = chan->conn;
456 struct sock *sk = chan->sk;
457
89bc500e 458 BT_DBG("chan %p state %d socket %p", chan, chan->state, sk->sk_socket);
4519de9a 459
89bc500e 460 switch (chan->state) {
4519de9a
GP		 461 case BT_LISTEN:
462 l2cap_chan_cleanup_listen(sk);
89bc500e
GP		 463
464 l2cap_state_change(chan, BT_CLOSED);
465 sock_set_flag(sk, SOCK_ZAPPED);
4519de9a
GP		 466 break;
467
468 case BT_CONNECTED:
469 case BT_CONFIG:
715ec005 470 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 471 conn->hcon->type == ACL_LINK) {
c9b66675
GP		 472 __clear_chan_timer(chan);
473 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 474 l2cap_send_disconn_req(conn, chan, reason);
475 } else
476 l2cap_chan_del(chan, reason);
477 break;
478
479 case BT_CONNECT2:
715ec005 480 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 481 conn->hcon->type == ACL_LINK) {
482 struct l2cap_conn_rsp rsp;
483 __u16 result;
484
485 if (bt_sk(sk)->defer_setup)
486 result = L2CAP_CR_SEC_BLOCK;
487 else
488 result = L2CAP_CR_BAD_PSM;
89bc500e 489 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 490
491 rsp.scid = cpu_to_le16(chan->dcid);
492 rsp.dcid = cpu_to_le16(chan->scid);
493 rsp.result = cpu_to_le16(result);
494 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
495 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
496 sizeof(rsp), &rsp);
497 }
498
499 l2cap_chan_del(chan, reason);
500 break;
501
502 case BT_CONNECT:
503 case BT_DISCONN:
504 l2cap_chan_del(chan, reason);
505 break;
506
507 default:
508 sock_set_flag(sk, SOCK_ZAPPED);
509 break;
510 }
511}
512
4343478f 513static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 514{
715ec005 515 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 516 switch (chan->sec_level) {
8556edd3
JH		 517 case BT_SECURITY_HIGH:
518 return HCI_AT_DEDICATED_BONDING_MITM;
519 case BT_SECURITY_MEDIUM:
520 return HCI_AT_DEDICATED_BONDING;
521 default:
522 return HCI_AT_NO_BONDING;
523 }
fe4128e0 524 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 525 if (chan->sec_level == BT_SECURITY_LOW)
526 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 527
4343478f 528 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 529 return HCI_AT_NO_BONDING_MITM;
00ae4af9 530 else
8556edd3 531 return HCI_AT_NO_BONDING;
00ae4af9 532 } else {
4343478f 533 switch (chan->sec_level) {
00ae4af9 534 case BT_SECURITY_HIGH:
8556edd3 535 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 536 case BT_SECURITY_MEDIUM:
8556edd3 537 return HCI_AT_GENERAL_BONDING;
00ae4af9 538 default:
8556edd3 539 return HCI_AT_NO_BONDING;
00ae4af9 540 }
0684e5f9 541 }
8556edd3
JH		 542}
543
544/* Service level security */
d45fc423 545int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 546{
8c1d787b 547 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 548 __u8 auth_type;
549
4343478f 550 auth_type = l2cap_get_auth_type(chan);
79d554a6 551
4343478f 552 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 553}
554
b5ad8b7f 555static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 556{
557 u8 id;
558
559 /* Get next available identificator.
560 * 1 - 128 are used by kernel.
561 * 129 - 199 are reserved.
562 * 200 - 254 are used by utilities like l2ping, etc.
563 */
564
565 spin_lock_bh(&conn->lock);
566
567 if (++conn->tx_ident > 128)
568 conn->tx_ident = 1;
569
570 id = conn->tx_ident;
571
572 spin_unlock_bh(&conn->lock);
573
574 return id;
575}
576
4519de9a 577static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 578{
579 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 580 u8 flags;
4e8402a3
MH		 581
582 BT_DBG("code 0x%2.2x", code);
583
584 if (!skb)
9a9c6a34 585 return;
4e8402a3 586
e702112f
AE		 587 if (lmp_no_flush_capable(conn->hcon->hdev))
588 flags = ACL_START_NO_FLUSH;
589 else
590 flags = ACL_START;
591
14b12d0b 592 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 593 skb->priority = HCI_PRIO_MAX;
14b12d0b 594
73d80deb
LAD		 595 hci_send_acl(conn->hchan, skb, flags);
596}
597
598static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
599{
600 struct hci_conn *hcon = chan->conn->hcon;
601 u16 flags;
602
603 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
604 skb->priority);
605
606 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
607 lmp_no_flush_capable(hcon->hdev))
608 flags = ACL_START_NO_FLUSH;
609 else
610 flags = ACL_START;
14b12d0b 611
73d80deb
LAD		 612 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
613 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 614}
615
88843ab0 616static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
1c2acffb
GP		 617{
618 struct sk_buff *skb;
619 struct l2cap_hdr *lh;
8c1d787b 620 struct l2cap_conn *conn = chan->conn;
e4ca6d98 621 int count, hlen;
fcc203c3 622
89bc500e 623 if (chan->state != BT_CONNECTED)
c13ffa62
GP		 624 return;
625
e4ca6d98
AE		 626 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
627 hlen = L2CAP_EXT_HDR_SIZE;
628 else
629 hlen = L2CAP_ENH_HDR_SIZE;
630
47d1ec61 631 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 632 hlen += L2CAP_FCS_SIZE;
1c2acffb 633
88843ab0 634 BT_DBG("chan %p, control 0x%8.8x", chan, control);
1c2acffb 635
fcc203c3 636 count = min_t(unsigned int, conn->mtu, hlen);
793c2f1c
AE		 637
638 control |= __set_sframe(chan);
1c2acffb 639
e2ab4353 640 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 641 control |= __set_ctrl_final(chan);
9e917af1 642
e2ab4353 643 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
e3781735 644 control |= __set_ctrl_poll(chan);
f0946ccf 645
1c2acffb
GP		 646 skb = bt_skb_alloc(count, GFP_ATOMIC);
647 if (!skb)
9a9c6a34 648 return;
1c2acffb
GP		 649
650 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fcc203c3 651 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
fe4128e0 652 lh->cid = cpu_to_le16(chan->dcid);
88843ab0
AE		 653
654 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1c2acffb 655
47d1ec61 656 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 657 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
658 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 659 }
660
73d80deb
LAD		 661 skb->priority = HCI_PRIO_MAX;
662 l2cap_do_send(chan, skb);
1c2acffb
GP		 663}
664
88843ab0 665static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
7e743090 666{
e2ab4353 667 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 668 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 669 set_bit(CONN_RNR_SENT, &chan->conn_state);
1890d36b 670 } else
ab784b73 671 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
7e743090 672
0b209fae 673 control |= __set_reqseq(chan, chan->buffer_seq);
2ab25cdd 674
525cd185 675 l2cap_send_sframe(chan, control);
7e743090
GP		 676}
677
b4450035 678static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 679{
c1360a1c 680 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 681}
682
fc7f8a7e 683static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 684{
8c1d787b 685 struct l2cap_conn *conn = chan->conn;
79d554a6
MH		 686
687 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 688 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
689 return;
690
d45fc423 691 if (l2cap_chan_check_security(chan) &&
4343478f 692 __l2cap_no_conn_pending(chan)) {
b1235d79 693 struct l2cap_conn_req req;
fe4128e0
GP		 694 req.scid = cpu_to_le16(chan->scid);
695 req.psm = chan->psm;
79d554a6 696
fc7f8a7e 697 chan->ident = l2cap_get_ident(conn);
c1360a1c 698 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
79d554a6 699
fc7f8a7e
GP		 700 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
701 sizeof(req), &req);
b1235d79 702 }
79d554a6
MH		 703 } else {
704 struct l2cap_info_req req;
705 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
706
707 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
708 conn->info_ident = l2cap_get_ident(conn);
709
710 mod_timer(&conn->info_timer, jiffies +
711 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
712
713 l2cap_send_cmd(conn, conn->info_ident,
714 L2CAP_INFO_REQ, sizeof(req), &req);
715 }
716}
717
cf6c2c0b
GP		 718static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
719{
720 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 721 if (!disable_ertm)
cf6c2c0b
GP		 722 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
723
724 switch (mode) {
725 case L2CAP_MODE_ERTM:
726 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
727 case L2CAP_MODE_STREAMING:
728 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
729 default:
730 return 0x00;
731 }
732}
733
4519de9a 734static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 735{
e92c8e70 736 struct sock *sk;
22121fc9
GP		 737 struct l2cap_disconn_req req;
738
c13ffa62
GP		 739 if (!conn)
740 return;
741
e92c8e70
GP		 742 sk = chan->sk;
743
0c1bc5c6 744 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 745 __clear_retrans_timer(chan);
746 __clear_monitor_timer(chan);
747 __clear_ack_timer(chan);
c13ffa62
GP		 748 }
749
fe4128e0
GP		 750 req.dcid = cpu_to_le16(chan->dcid);
751 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 752 l2cap_send_cmd(conn, l2cap_get_ident(conn),
753 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 754
89bc500e 755 l2cap_state_change(chan, BT_DISCONN);
9b108fc0 756 sk->sk_err = err;
22121fc9
GP		 757}
758
1da177e4 759/* ---- L2CAP connections ---- */
4e8402a3
MH		 760static void l2cap_conn_start(struct l2cap_conn *conn)
761{
820ffdb3 762 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 763
764 BT_DBG("conn %p", conn);
765
baa7e1fa 766 read_lock(&conn->chan_lock);
4e8402a3 767
820ffdb3 768 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 769 struct sock *sk = chan->sk;
baa7e1fa 770
4e8402a3
MH		 771 bh_lock_sock(sk);
772
715ec005 773 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
79d554a6
MH		 774 bh_unlock_sock(sk);
775 continue;
776 }
777
89bc500e 778 if (chan->state == BT_CONNECT) {
47731de7 779 struct l2cap_conn_req req;
79d554a6 780
d45fc423 781 if (!l2cap_chan_check_security(chan) ||
b4450035 782 !__l2cap_no_conn_pending(chan)) {
47731de7
GP		 783 bh_unlock_sock(sk);
784 continue;
785 }
79d554a6 786
c1360a1c
GP		 787 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
788 && test_bit(CONF_STATE2_DEVICE,
789 &chan->conf_state)) {
0f852724 790 /* l2cap_chan_close() calls list_del(chan)
820ffdb3 791 * so release the lock */
2461daac 792 read_unlock(&conn->chan_lock);
89bc500e 793 l2cap_chan_close(chan, ECONNRESET);
2461daac 794 read_lock(&conn->chan_lock);
47731de7
GP		 795 bh_unlock_sock(sk);
796 continue;
b1235d79 797 }
47731de7 798
fe4128e0
GP		 799 req.scid = cpu_to_le16(chan->scid);
800 req.psm = chan->psm;
47731de7 801
fc7f8a7e 802 chan->ident = l2cap_get_ident(conn);
c1360a1c 803 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
47731de7 804
fc7f8a7e
GP		 805 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ,
806 sizeof(req), &req);
47731de7 807
89bc500e 808 } else if (chan->state == BT_CONNECT2) {
79d554a6 809 struct l2cap_conn_rsp rsp;
e9aeb2dd 810 char buf[128];
fe4128e0
GP		 811 rsp.scid = cpu_to_le16(chan->dcid);
812 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 813
d45fc423 814 if (l2cap_chan_check_security(chan)) {
f66dc81f
MH		 815 if (bt_sk(sk)->defer_setup) {
816 struct sock *parent = bt_sk(sk)->parent;
817 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
818 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 819 if (parent)
820 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 821
822 } else {
89bc500e 823 l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 824 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
825 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
826 }
79d554a6
MH		 827 } else {
828 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
829 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
830 }
831
fc7f8a7e
GP		 832 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
833 sizeof(rsp), &rsp);
e9aeb2dd 834
c1360a1c 835 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd
GP		 836 rsp.result != L2CAP_CR_SUCCESS) {
837 bh_unlock_sock(sk);
838 continue;
839 }
840
c1360a1c 841 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 842 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 843 l2cap_build_conf_req(chan, buf), buf);
844 chan->num_conf_req++;
4e8402a3
MH		 845 }
846
847 bh_unlock_sock(sk);
848 }
849
baa7e1fa 850 read_unlock(&conn->chan_lock);
4e8402a3
MH		 851}
852
b62f328b
VT		 853/* Find socket with cid and source bdaddr.
854 * Returns closest match, locked.
855 */
23691d75 856static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdaddr_t *src)
b62f328b 857{
23691d75 858 struct l2cap_chan *c, *c1 = NULL;
b62f328b 859
23691d75 860 read_lock(&chan_list_lock);
b62f328b 861
23691d75
GP		 862 list_for_each_entry(c, &chan_list, global_l) {
863 struct sock *sk = c->sk;
fe4128e0 864
89bc500e 865 if (state && c->state != state)
b62f328b
VT		 866 continue;
867
23691d75 868 if (c->scid == cid) {
b62f328b 869 /* Exact match. */
23691d75
GP		 870 if (!bacmp(&bt_sk(sk)->src, src)) {
871 read_unlock(&chan_list_lock);
872 return c;
873 }
b62f328b
VT		 874
875 /* Closest match */
876 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
23691d75 877 c1 = c;
b62f328b
VT		 878 }
879 }
280f294f 880
23691d75 881 read_unlock(&chan_list_lock);
b62f328b 882
23691d75 883 return c1;
b62f328b
VT		 884}
885
886static void l2cap_le_conn_ready(struct l2cap_conn *conn)
887{
c916fbe4 888 struct sock *parent, *sk;
23691d75 889 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 890
891 BT_DBG("");
892
893 /* Check if we have socket listening on cid */
23691d75 894 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
b62f328b 895 conn->src);
23691d75 896 if (!pchan)
b62f328b
VT		 897 return;
898
23691d75
GP		 899 parent = pchan->sk;
900
62f3a2cf
GP		 901 bh_lock_sock(parent);
902
b62f328b
VT		 903 /* Check for backlog size */
904 if (sk_acceptq_is_full(parent)) {
905 BT_DBG("backlog full %d", parent->sk_ack_backlog);
906 goto clean;
907 }
908
80808e43
GP		 909 chan = pchan->ops->new_connection(pchan->data);
910 if (!chan)
b62f328b
VT		 911 goto clean;
912
80808e43 913 sk = chan->sk;
5d41ce1d 914
baa7e1fa 915 write_lock_bh(&conn->chan_lock);
b62f328b
VT		 916
917 hci_conn_hold(conn->hcon);
918
b62f328b
VT		 919 bacpy(&bt_sk(sk)->src, conn->src);
920 bacpy(&bt_sk(sk)->dst, conn->dst);
921
d1010240
GP		 922 bt_accept_enqueue(parent, sk);
923
48454079
GP		 924 __l2cap_chan_add(conn, chan);
925
c9b66675 926 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 927
89bc500e 928 l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 929 parent->sk_data_ready(parent, 0);
930
baa7e1fa 931 write_unlock_bh(&conn->chan_lock);
b62f328b
VT		 932
933clean:
934 bh_unlock_sock(parent);
935}
936
f1cb9af5
VCG		 937static void l2cap_chan_ready(struct sock *sk)
938{
939 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
940 struct sock *parent = bt_sk(sk)->parent;
941
942 BT_DBG("sk %p, parent %p", sk, parent);
943
944 chan->conf_state = 0;
945 __clear_chan_timer(chan);
946
43f3dc41 947 l2cap_state_change(chan, BT_CONNECTED);
f1cb9af5
VCG		 948 sk->sk_state_change(sk);
949
950 if (parent)
951 parent->sk_data_ready(parent, 0);
952}
953
4e8402a3
MH		 954static void l2cap_conn_ready(struct l2cap_conn *conn)
955{
48454079 956 struct l2cap_chan *chan;
4e8402a3 957
79d554a6 958 BT_DBG("conn %p", conn);
4e8402a3 959
b62f328b
VT		 960 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
961 l2cap_le_conn_ready(conn);
962
160dc6ac
VCG		 963 if (conn->hcon->out && conn->hcon->type == LE_LINK)
964 smp_conn_security(conn, conn->hcon->pending_sec_level);
965
baa7e1fa 966 read_lock(&conn->chan_lock);
4e8402a3 967
baa7e1fa 968 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 969 struct sock *sk = chan->sk;
baa7e1fa 970
79d554a6 971 bh_lock_sock(sk);
4e8402a3 972
63128451 973 if (conn->hcon->type == LE_LINK) {
b501d6a1 974 if (smp_conn_security(conn, chan->sec_level))
f1cb9af5 975 l2cap_chan_ready(sk);
acd7d370 976
63128451 977 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 978 __clear_chan_timer(chan);
89bc500e 979 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 980 sk->sk_state_change(sk);
b501d6a1 981
89bc500e 982 } else if (chan->state == BT_CONNECT)
fc7f8a7e 983 l2cap_do_start(chan);
4e8402a3 984
79d554a6 985 bh_unlock_sock(sk);
4e8402a3 986 }
79d554a6 987
baa7e1fa 988 read_unlock(&conn->chan_lock);
4e8402a3
MH		 989}
990
991/* Notify sockets that we cannot guaranty reliability anymore */
992static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
993{
48454079 994 struct l2cap_chan *chan;
4e8402a3
MH		 995
996 BT_DBG("conn %p", conn);
997
baa7e1fa 998 read_lock(&conn->chan_lock);
4e8402a3 999
baa7e1fa 1000 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 1001 struct sock *sk = chan->sk;
baa7e1fa 1002
ecf61bdb 1003 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
4e8402a3
MH		 1004 sk->sk_err = err;
1005 }
1006
baa7e1fa 1007 read_unlock(&conn->chan_lock);
4e8402a3
MH		 1008}
1009
1010static void l2cap_info_timeout(unsigned long arg)
1011{
1012 struct l2cap_conn *conn = (void *) arg;
1013
984947dc 1014 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1015 conn->info_ident = 0;
984947dc 1016
4e8402a3
MH		 1017 l2cap_conn_start(conn);
1018}
1019
5d3de7df
VCG		 1020static void l2cap_conn_del(struct hci_conn *hcon, int err)
1021{
1022 struct l2cap_conn *conn = hcon->l2cap_data;
1023 struct l2cap_chan *chan, *l;
1024 struct sock *sk;
1025
1026 if (!conn)
1027 return;
1028
1029 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1030
1031 kfree_skb(conn->rx_skb);
1032
1033 /* Kill channels */
1034 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
1035 sk = chan->sk;
1036 bh_lock_sock(sk);
1037 l2cap_chan_del(chan, err);
1038 bh_unlock_sock(sk);
1039 chan->ops->close(chan->data);
1040 }
1041
73d80deb
LAD		 1042 hci_chan_del(conn->hchan);
1043
5d3de7df
VCG		 1044 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
1045 del_timer_sync(&conn->info_timer);
1046
d26a2345 1047 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) {
5d3de7df 1048 del_timer(&conn->security_timer);
8aab4757 1049 smp_chan_destroy(conn);
d26a2345 1050 }
5d3de7df
VCG		 1051
1052 hcon->l2cap_data = NULL;
1053 kfree(conn);
1054}
1055
1056static void security_timeout(unsigned long arg)
1057{
1058 struct l2cap_conn *conn = (void *) arg;
1059
1060 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1061}
1062
1da177e4
LT		 1063static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1064{
0139418c 1065 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1066 struct hci_chan *hchan;
1da177e4 1067
0139418c 1068 if (conn || status)
1da177e4
LT		 1069 return conn;
1070
73d80deb
LAD		 1071 hchan = hci_chan_create(hcon);
1072 if (!hchan)
1073 return NULL;
1074
0139418c 1075 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1076 if (!conn) {
1077 hci_chan_del(hchan);
1da177e4 1078 return NULL;
73d80deb 1079 }
1da177e4
LT		 1080
1081 hcon->l2cap_data = conn;
1082 conn->hcon = hcon;
73d80deb 1083 conn->hchan = hchan;
1da177e4 1084
73d80deb 1085 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1086
acd7d370
VT		 1087 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1088 conn->mtu = hcon->hdev->le_mtu;
1089 else
1090 conn->mtu = hcon->hdev->acl_mtu;
1091
1da177e4
LT		 1092 conn->src = &hcon->hdev->bdaddr;
1093 conn->dst = &hcon->dst;
1094
4e8402a3
MH		 1095 conn->feat_mask = 0;
1096
1da177e4 1097 spin_lock_init(&conn->lock);
baa7e1fa
GP		 1098 rwlock_init(&conn->chan_lock);
1099
1100 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1101
5d3de7df
VCG		 1102 if (hcon->type == LE_LINK)
1103 setup_timer(&conn->security_timer, security_timeout,
1104 (unsigned long) conn);
1105 else
b62f328b 1106 setup_timer(&conn->info_timer, l2cap_info_timeout,
45054dc1
DY		 1107 (unsigned long) conn);
1108
9f5a0d7b 1109 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1110
1da177e4
LT		 1111 return conn;
1112}
1113
48454079 1114static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
1da177e4 1115{
baa7e1fa 1116 write_lock_bh(&conn->chan_lock);
48454079 1117 __l2cap_chan_add(conn, chan);
baa7e1fa 1118 write_unlock_bh(&conn->chan_lock);
1da177e4
LT		 1119}
1120
1da177e4 1121/* ---- Socket interface ---- */
1da177e4
LT		 1122
1123/* Find socket with psm and source bdaddr.
1124 * Returns closest match.
1125 */
23691d75 1126static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4 1127{
23691d75 1128 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1129
23691d75 1130 read_lock(&chan_list_lock);
e0f0cb56 1131
23691d75
GP		 1132 list_for_each_entry(c, &chan_list, global_l) {
1133 struct sock *sk = c->sk;
fe4128e0 1134
89bc500e 1135 if (state && c->state != state)
1da177e4
LT		 1136 continue;
1137
23691d75 1138 if (c->psm == psm) {
1da177e4 1139 /* Exact match. */
23691d75 1140 if (!bacmp(&bt_sk(sk)->src, src)) {
a7567b20 1141 read_unlock(&chan_list_lock);
23691d75
GP		 1142 return c;
1143 }
1da177e4
LT		 1144
1145 /* Closest match */
1146 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
23691d75 1147 c1 = c;
1da177e4
LT		 1148 }
1149 }
1da177e4 1150
23691d75 1151 read_unlock(&chan_list_lock);
e0f0cb56 1152
23691d75 1153 return c1;
1da177e4
LT		 1154}
1155
77a74c7e 1156int l2cap_chan_connect(struct l2cap_chan *chan)
1da177e4 1157{
5d41ce1d 1158 struct sock *sk = chan->sk;
1da177e4
LT		 1159 bdaddr_t *src = &bt_sk(sk)->src;
1160 bdaddr_t *dst = &bt_sk(sk)->dst;
1161 struct l2cap_conn *conn;
1162 struct hci_conn *hcon;
1163 struct hci_dev *hdev;
09ab6f4c 1164 __u8 auth_type;
44d0e48e 1165 int err;
1da177e4 1166
f29972de 1167 BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
fe4128e0 1168 chan->psm);
1da177e4 1169
af05b30b
GP		 1170 hdev = hci_get_route(dst, src);
1171 if (!hdev)
1da177e4
LT		 1172 return -EHOSTUNREACH;
1173
09fd0de5 1174 hci_dev_lock(hdev);
1da177e4 1175
4343478f 1176 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1177
fe4128e0 1178 if (chan->dcid == L2CAP_CID_LE_DATA)
acd7d370 1179 hcon = hci_connect(hdev, LE_LINK, dst,
4343478f 1180 chan->sec_level, auth_type);
acd7d370
VT		 1181 else
1182 hcon = hci_connect(hdev, ACL_LINK, dst,
4343478f 1183 chan->sec_level, auth_type);
acd7d370 1184
30e76272
VT		 1185 if (IS_ERR(hcon)) {
1186 err = PTR_ERR(hcon);
1da177e4 1187 goto done;
30e76272 1188 }
1da177e4
LT		 1189
1190 conn = l2cap_conn_add(hcon, 0);
1191 if (!conn) {
1192 hci_conn_put(hcon);
30e76272 1193 err = -ENOMEM;
1da177e4
LT		 1194 goto done;
1195 }
1196
1da177e4
LT		 1197 /* Update source addr of the socket */
1198 bacpy(src, conn->src);
1199
48454079
GP		 1200 l2cap_chan_add(conn, chan);
1201
89bc500e 1202 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1203 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1204
1205 if (hcon->state == BT_CONNECTED) {
715ec005 1206 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1207 __clear_chan_timer(chan);
d45fc423 1208 if (l2cap_chan_check_security(chan))
89bc500e 1209 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1210 } else
fc7f8a7e 1211 l2cap_do_start(chan);
1da177e4
LT		 1212 }
1213
30e76272
VT		 1214 err = 0;
1215
1da177e4 1216done:
09fd0de5 1217 hci_dev_unlock(hdev);
1da177e4
LT		 1218 hci_dev_put(hdev);
1219 return err;
1220}
1221
dcba0dba 1222int __l2cap_wait_ack(struct sock *sk)
6161c038 1223{
8c1d787b 1224 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1225 DECLARE_WAITQUEUE(wait, current);
1226 int err = 0;
1227 int timeo = HZ/5;
1228
2b0b05dd 1229 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1230 set_current_state(TASK_INTERRUPTIBLE);
1231 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1232 if (!timeo)
1233 timeo = HZ/5;
1234
1235 if (signal_pending(current)) {
1236 err = sock_intr_errno(timeo);
1237 break;
1238 }
1239
1240 release_sock(sk);
1241 timeo = schedule_timeout(timeo);
1242 lock_sock(sk);
a71a0cf4 1243 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1244
1245 err = sock_error(sk);
1246 if (err)
1247 break;
1248 }
1249 set_current_state(TASK_RUNNING);
2b0b05dd 1250 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1251 return err;
1252}
1253
e90bac06
GP		 1254static void l2cap_monitor_timeout(unsigned long arg)
1255{
525cd185
GP		 1256 struct l2cap_chan *chan = (void *) arg;
1257 struct sock *sk = chan->sk;
e90bac06 1258
525cd185 1259 BT_DBG("chan %p", chan);
0e98958d 1260
e686219a 1261 bh_lock_sock(sk);
2c03a7a4 1262 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1263 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
b13f5860 1264 bh_unlock_sock(sk);
e90bac06
GP		 1265 return;
1266 }
1267
6a026610 1268 chan->retry_count++;
1a09bcb9 1269 __set_monitor_timer(chan);
e90bac06 1270
525cd185 1271 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
e686219a 1272 bh_unlock_sock(sk);
e90bac06
GP		 1273}
1274
1275static void l2cap_retrans_timeout(unsigned long arg)
1276{
525cd185
GP		 1277 struct l2cap_chan *chan = (void *) arg;
1278 struct sock *sk = chan->sk;
e90bac06 1279
49208c9c 1280 BT_DBG("chan %p", chan);
0e98958d 1281
e686219a 1282 bh_lock_sock(sk);
6a026610 1283 chan->retry_count = 1;
1a09bcb9 1284 __set_monitor_timer(chan);
e90bac06 1285
e2ab4353 1286 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1287
525cd185 1288 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
e686219a 1289 bh_unlock_sock(sk);
e90bac06
GP		 1290}
1291
42e5c802 1292static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1293{
1c2acffb 1294 struct sk_buff *skb;
1da177e4 1295
58d35f87 1296 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1297 chan->unacked_frames) {
42e5c802 1298 if (bt_cb(skb)->tx_seq == chan->expected_ack_seq)
1c2acffb 1299 break;
1da177e4 1300
58d35f87 1301 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1302 kfree_skb(skb);
1da177e4 1303
6a026610 1304 chan->unacked_frames--;
1c2acffb 1305 }
1da177e4 1306
6a026610 1307 if (!chan->unacked_frames)
1a09bcb9 1308 __clear_retrans_timer(chan);
1c2acffb 1309}
1da177e4 1310
67c9e840 1311static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1312{
ccbb84af 1313 struct sk_buff *skb;
88843ab0
AE		 1314 u32 control;
1315 u16 fcs;
6840ed07 1316
58d35f87 1317 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1318 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1319 control |= __set_txseq(chan, chan->next_tx_seq);
88843ab0 1320 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1321
47d1ec61 1322 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1323 fcs = crc16(0, (u8 *)skb->data,
1324 skb->len - L2CAP_FCS_SIZE);
1325 put_unaligned_le16(fcs,
1326 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1327 }
1328
4343478f 1329 l2cap_do_send(chan, skb);
6840ed07 1330
836be934 1331 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1332 }
6840ed07
GP		 1333}
1334
fb45de7d 1335static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1336{
8f17154f 1337 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1338 u16 fcs;
1339 u32 control;
8f17154f 1340
58d35f87 1341 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1342 if (!skb)
1343 return;
8f17154f 1344
d1726b6d 1345 while (bt_cb(skb)->tx_seq != tx_seq) {
58d35f87 1346 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1347 return;
8f17154f 1348
d1726b6d
SJ		 1349 skb = skb_queue_next(&chan->tx_q, skb);
1350 }
8f17154f 1351
2c03a7a4
GP		 1352 if (chan->remote_max_tx &&
1353 bt_cb(skb)->retries == chan->remote_max_tx) {
8c1d787b 1354 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1355 return;
1356 }
1357
1358 tx_skb = skb_clone(skb, GFP_ATOMIC);
1359 bt_cb(skb)->retries++;
88843ab0
AE		 1360
1361 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1362 control &= __get_sar_mask(chan);
3cb123d1 1363
e2ab4353 1364 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1365 control |= __set_ctrl_final(chan);
95ffa978 1366
0b209fae 1367 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1368 control |= __set_txseq(chan, tx_seq);
3cb123d1 1369
88843ab0 1370 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1371
47d1ec61 1372 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1373 fcs = crc16(0, (u8 *)tx_skb->data,
1374 tx_skb->len - L2CAP_FCS_SIZE);
1375 put_unaligned_le16(fcs,
1376 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1377 }
1378
4343478f 1379 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1380}
1381
67c9e840 1382static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1383{
1384 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1385 u16 fcs;
1386 u32 control;
9a9c6a34 1387 int nsent = 0;
1c2acffb 1388
89bc500e 1389 if (chan->state != BT_CONNECTED)
c13ffa62 1390 return -ENOTCONN;
e90bac06 1391
58d35f87 1392 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1393
2c03a7a4
GP		 1394 if (chan->remote_max_tx &&
1395 bt_cb(skb)->retries == chan->remote_max_tx) {
8c1d787b 1396 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1397 break;
1398 }
1399
e420aba3
AE		 1400 tx_skb = skb_clone(skb, GFP_ATOMIC);
1401
e90bac06
GP		 1402 bt_cb(skb)->retries++;
1403
88843ab0 1404 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1405 control &= __get_sar_mask(chan);
95ffa978 1406
e2ab4353 1407 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1408 control |= __set_ctrl_final(chan);
e2ab4353 1409
0b209fae 1410 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1411 control |= __set_txseq(chan, chan->next_tx_seq);
1c2acffb 1412
88843ab0 1413 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1414
47d1ec61 1415 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1416 fcs = crc16(0, (u8 *)skb->data,
1417 tx_skb->len - L2CAP_FCS_SIZE);
1418 put_unaligned_le16(fcs, skb->data +
1419 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1420 }
1421
4343478f 1422 l2cap_do_send(chan, tx_skb);
9a9c6a34 1423
1a09bcb9 1424 __set_retrans_timer(chan);
1c2acffb 1425
42e5c802 1426 bt_cb(skb)->tx_seq = chan->next_tx_seq;
836be934
AE		 1427
1428 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1429
23e9fde2 1430 if (bt_cb(skb)->retries == 1)
6a026610 1431 chan->unacked_frames++;
23e9fde2 1432
6a026610 1433 chan->frames_sent++;
1c2acffb 1434
58d35f87
GP		 1435 if (skb_queue_is_last(&chan->tx_q, skb))
1436 chan->tx_send_head = NULL;
1c2acffb 1437 else
58d35f87 1438 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
9e917af1
GP		 1439
1440 nsent++;
1c2acffb
GP		 1441 }
1442
9e917af1
GP		 1443 return nsent;
1444}
1445
525cd185 1446static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1447{
dfc909be
GP		 1448 int ret;
1449
58d35f87
GP		 1450 if (!skb_queue_empty(&chan->tx_q))
1451 chan->tx_send_head = chan->tx_q.next;
dfc909be 1452
42e5c802 1453 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1454 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1455 return ret;
1456}
1457
525cd185 1458static void l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1459{
88843ab0 1460 u32 control = 0;
9e917af1 1461
0b209fae 1462 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1463
e2ab4353 1464 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1465 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1466 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1467 l2cap_send_sframe(chan, control);
9a9c6a34 1468 return;
9e917af1 1469 }
dfc909be 1470
525cd185 1471 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1472 return;
1473
ab784b73 1474 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1475 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1476}
1477
525cd185 1478static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1479{
1480 struct srej_list *tail;
88843ab0 1481 u32 control;
99b0d4b7 1482
ab784b73 1483 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1484 control |= __set_ctrl_final(chan);
99b0d4b7 1485
39d5a3ee 1486 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1487 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1488
525cd185 1489 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1490}
1491
1c2acffb
GP		 1492static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
1493{
8c1d787b 1494 struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
1c2acffb
GP		 1495 struct sk_buff **frag;
1496 int err, sent = 0;
1da177e4 1497
59203a21 1498 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1499 return -EFAULT;
1da177e4
LT		 1500
1501 sent += count;
1502 len -= count;
1503
1504 /* Continuation fragments (no L2CAP header) */
1505 frag = &skb_shinfo(skb)->frag_list;
1506 while (len) {
1507 count = min_t(unsigned int, conn->mtu, len);
1508
1509 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1510 if (!*frag)
0175d629 1511 return err;
1c2acffb
GP		 1512 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1513 return -EFAULT;
1da177e4 1514
5e59b791
LAD		 1515 (*frag)->priority = skb->priority;
1516
1da177e4
LT		 1517 sent += count;
1518 len -= count;
1519
1520 frag = &(*frag)->next;
1521 }
1da177e4
LT		 1522
1523 return sent;
1c2acffb 1524}
1da177e4 1525
5e59b791
LAD		 1526static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1527 struct msghdr *msg, size_t len,
1528 u32 priority)
1c2acffb 1529{
fe4128e0 1530 struct sock *sk = chan->sk;
8c1d787b 1531 struct l2cap_conn *conn = chan->conn;
1c2acffb 1532 struct sk_buff *skb;
03a51213 1533 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1534 struct l2cap_hdr *lh;
1535
5e59b791 1536 BT_DBG("sk %p len %d priority %u", sk, (int)len, priority);
1c2acffb
GP		 1537
1538 count = min_t(unsigned int, (conn->mtu - hlen), len);
1539 skb = bt_skb_send_alloc(sk, count + hlen,
1540 msg->msg_flags & MSG_DONTWAIT, &err);
1541 if (!skb)
0175d629 1542 return ERR_PTR(err);
1c2acffb 1543
5e59b791
LAD		 1544 skb->priority = priority;
1545
1c2acffb
GP		 1546 /* Create L2CAP header */
1547 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1548 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1549 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
fe4128e0 1550 put_unaligned_le16(chan->psm, skb_put(skb, 2));
1c2acffb
GP		 1551
1552 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1553 if (unlikely(err < 0)) {
1554 kfree_skb(skb);
1555 return ERR_PTR(err);
1556 }
1557 return skb;
1558}
1559
5e59b791
LAD		 1560static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1561 struct msghdr *msg, size_t len,
1562 u32 priority)
1c2acffb 1563{
fe4128e0 1564 struct sock *sk = chan->sk;
8c1d787b 1565 struct l2cap_conn *conn = chan->conn;
1c2acffb
GP		 1566 struct sk_buff *skb;
1567 int err, count, hlen = L2CAP_HDR_SIZE;
1568 struct l2cap_hdr *lh;
1569
1570 BT_DBG("sk %p len %d", sk, (int)len);
1571
1572 count = min_t(unsigned int, (conn->mtu - hlen), len);
1573 skb = bt_skb_send_alloc(sk, count + hlen,
1574 msg->msg_flags & MSG_DONTWAIT, &err);
1575 if (!skb)
0175d629 1576 return ERR_PTR(err);
1c2acffb 1577
5e59b791
LAD		 1578 skb->priority = priority;
1579
1c2acffb
GP		 1580 /* Create L2CAP header */
1581 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1582 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb
GP		 1583 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1584
1585 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1586 if (unlikely(err < 0)) {
1587 kfree_skb(skb);
1588 return ERR_PTR(err);
1589 }
1590 return skb;
1591}
1592
ab0ff76d
LAD		 1593static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1594 struct msghdr *msg, size_t len,
88843ab0 1595 u32 control, u16 sdulen)
1c2acffb 1596{
47d1ec61 1597 struct sock *sk = chan->sk;
8c1d787b 1598 struct l2cap_conn *conn = chan->conn;
1c2acffb 1599 struct sk_buff *skb;
e4ca6d98 1600 int err, count, hlen;
1c2acffb
GP		 1601 struct l2cap_hdr *lh;
1602
1603 BT_DBG("sk %p len %d", sk, (int)len);
1604
0ee0d208
GP		 1605 if (!conn)
1606 return ERR_PTR(-ENOTCONN);
1607
e4ca6d98
AE		 1608 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1609 hlen = L2CAP_EXT_HDR_SIZE;
1610 else
1611 hlen = L2CAP_ENH_HDR_SIZE;
1612
c74e560c 1613 if (sdulen)
03a51213 1614 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1615
47d1ec61 1616 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1617 hlen += L2CAP_FCS_SIZE;
fcc203c3 1618
1c2acffb
GP		 1619 count = min_t(unsigned int, (conn->mtu - hlen), len);
1620 skb = bt_skb_send_alloc(sk, count + hlen,
1621 msg->msg_flags & MSG_DONTWAIT, &err);
1622 if (!skb)
0175d629 1623 return ERR_PTR(err);
1c2acffb
GP		 1624
1625 /* Create L2CAP header */
1626 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1627 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1628 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0
AE		 1629
1630 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1631
c74e560c 1632 if (sdulen)
03a51213 1633 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb
GP		 1634
1635 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1636 if (unlikely(err < 0)) {
1637 kfree_skb(skb);
1638 return ERR_PTR(err);
1639 }
e90bac06 1640
47d1ec61 1641 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1642 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1643
e90bac06 1644 bt_cb(skb)->retries = 0;
1c2acffb 1645 return skb;
1da177e4
LT		 1646}
1647
67c9e840 1648static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
c74e560c 1649{
c74e560c
GP		 1650 struct sk_buff *skb;
1651 struct sk_buff_head sar_queue;
88843ab0 1652 u32 control;
c74e560c
GP		 1653 size_t size = 0;
1654
ff12fd64 1655 skb_queue_head_init(&sar_queue);
7e0ef6ee 1656 control = __set_ctrl_sar(chan, L2CAP_SAR_START);
47d1ec61 1657 skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
c74e560c
GP		 1658 if (IS_ERR(skb))
1659 return PTR_ERR(skb);
1660
1661 __skb_queue_tail(&sar_queue, skb);
2c03a7a4
GP		 1662 len -= chan->remote_mps;
1663 size += chan->remote_mps;
c74e560c
GP		 1664
1665 while (len > 0) {
1666 size_t buflen;
1667
2c03a7a4 1668 if (len > chan->remote_mps) {
7e0ef6ee 1669 control = __set_ctrl_sar(chan, L2CAP_SAR_CONTINUE);
2c03a7a4 1670 buflen = chan->remote_mps;
c74e560c 1671 } else {
7e0ef6ee 1672 control = __set_ctrl_sar(chan, L2CAP_SAR_END);
c74e560c
GP		 1673 buflen = len;
1674 }
1675
47d1ec61 1676 skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
c74e560c
GP		 1677 if (IS_ERR(skb)) {
1678 skb_queue_purge(&sar_queue);
1679 return PTR_ERR(skb);
1680 }
1681
1682 __skb_queue_tail(&sar_queue, skb);
1683 len -= buflen;
1684 size += buflen;
c74e560c 1685 }
58d35f87
GP		 1686 skb_queue_splice_tail(&sar_queue, &chan->tx_q);
1687 if (chan->tx_send_head == NULL)
1688 chan->tx_send_head = sar_queue.next;
c74e560c
GP		 1689
1690 return size;
1691}
1692
5e59b791
LAD		 1693int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
1694 u32 priority)
9a91a04a 1695{
9a91a04a 1696 struct sk_buff *skb;
88843ab0 1697 u32 control;
9a91a04a
GP		 1698 int err;
1699
1700 /* Connectionless channel */
715ec005 1701 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 1702 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 1703 if (IS_ERR(skb))
1704 return PTR_ERR(skb);
1705
1706 l2cap_do_send(chan, skb);
1707 return len;
1708 }
1709
1710 switch (chan->mode) {
1711 case L2CAP_MODE_BASIC:
1712 /* Check outgoing MTU */
1713 if (len > chan->omtu)
1714 return -EMSGSIZE;
1715
1716 /* Create a basic PDU */
5e59b791 1717 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 1718 if (IS_ERR(skb))
1719 return PTR_ERR(skb);
1720
1721 l2cap_do_send(chan, skb);
1722 err = len;
1723 break;
1724
1725 case L2CAP_MODE_ERTM:
1726 case L2CAP_MODE_STREAMING:
1727 /* Entire SDU fits into one PDU */
1728 if (len <= chan->remote_mps) {
7e0ef6ee 1729 control = __set_ctrl_sar(chan, L2CAP_SAR_UNSEGMENTED);
9a91a04a
GP		 1730 skb = l2cap_create_iframe_pdu(chan, msg, len, control,
1731 0);
1732 if (IS_ERR(skb))
1733 return PTR_ERR(skb);
1734
1735 __skb_queue_tail(&chan->tx_q, skb);
1736
1737 if (chan->tx_send_head == NULL)
1738 chan->tx_send_head = skb;
1739
1740 } else {
1741 /* Segment SDU into multiples PDUs */
1742 err = l2cap_sar_segment_sdu(chan, msg, len);
1743 if (err < 0)
1744 return err;
1745 }
1746
1747 if (chan->mode == L2CAP_MODE_STREAMING) {
1748 l2cap_streaming_send(chan);
1749 err = len;
1750 break;
1751 }
1752
e2ab4353
GP		 1753 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
1754 test_bit(CONN_WAIT_F, &chan->conn_state)) {
9a91a04a
GP		 1755 err = len;
1756 break;
1757 }
1758
1759 err = l2cap_ertm_send(chan);
1760 if (err >= 0)
1761 err = len;
1762
1763 break;
1764
1765 default:
1766 BT_DBG("bad state %1.1x", chan->mode);
1767 err = -EBADFD;
1768 }
1769
1770 return err;
1771}
1772
1da177e4
LT		 1773/* Copy frame to all raw sockets on that connection */
1774static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1775{
1da177e4 1776 struct sk_buff *nskb;
48454079 1777 struct l2cap_chan *chan;
1da177e4
LT		 1778
1779 BT_DBG("conn %p", conn);
1780
baa7e1fa
GP		 1781 read_lock(&conn->chan_lock);
1782 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 1783 struct sock *sk = chan->sk;
715ec005 1784 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 1785 continue;
1786
1787 /* Don't send frame to the socket it came from */
1788 if (skb->sk == sk)
1789 continue;
af05b30b
GP		 1790 nskb = skb_clone(skb, GFP_ATOMIC);
1791 if (!nskb)
1da177e4
LT		 1792 continue;
1793
23070494 1794 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 1795 kfree_skb(nskb);
1796 }
baa7e1fa 1797 read_unlock(&conn->chan_lock);
1da177e4
LT		 1798}
1799
1800/* ---- L2CAP signalling commands ---- */
1801static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1802 u8 code, u8 ident, u16 dlen, void *data)
1803{
1804 struct sk_buff *skb, **frag;
1805 struct l2cap_cmd_hdr *cmd;
1806 struct l2cap_hdr *lh;
1807 int len, count;
1808
af05b30b
GP		 1809 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
1810 conn, code, ident, dlen);
1da177e4
LT		 1811
1812 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1813 count = min_t(unsigned int, conn->mtu, len);
1814
1815 skb = bt_skb_alloc(count, GFP_ATOMIC);
1816 if (!skb)
1817 return NULL;
1818
1819 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 1820 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 1821
1822 if (conn->hcon->type == LE_LINK)
1823 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
1824 else
1825 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 1826
1827 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1828 cmd->code = code;
1829 cmd->ident = ident;
aca3192c 1830 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 1831
1832 if (dlen) {
1833 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1834 memcpy(skb_put(skb, count), data, count);
1835 data += count;
1836 }
1837
1838 len -= skb->len;
1839
1840 /* Continuation fragments (no L2CAP header) */
1841 frag = &skb_shinfo(skb)->frag_list;
1842 while (len) {
1843 count = min_t(unsigned int, conn->mtu, len);
1844
1845 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1846 if (!*frag)
1847 goto fail;
1848
1849 memcpy(skb_put(*frag, count), data, count);
1850
1851 len -= count;
1852 data += count;
1853
1854 frag = &(*frag)->next;
1855 }
1856
1857 return skb;
1858
1859fail:
1860 kfree_skb(skb);
1861 return NULL;
1862}
1863
1864static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1865{
1866 struct l2cap_conf_opt *opt = *ptr;
1867 int len;
1868
1869 len = L2CAP_CONF_OPT_SIZE + opt->len;
1870 *ptr += len;
1871
1872 *type = opt->type;
1873 *olen = opt->len;
1874
1875 switch (opt->len) {
1876 case 1:
1877 *val = *((u8 *) opt->val);
1878 break;
1879
1880 case 2:
bfaaeb3e 1881 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 1882 break;
1883
1884 case 4:
bfaaeb3e 1885 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 1886 break;
1887
1888 default:
1889 *val = (unsigned long) opt->val;
1890 break;
1891 }
1892
1893 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1894 return len;
1895}
1896
1da177e4
LT		 1897static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1898{
1899 struct l2cap_conf_opt *opt = *ptr;
1900
1901 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1902
1903 opt->type = type;
1904 opt->len = len;
1905
1906 switch (len) {
1907 case 1:
1908 *((u8 *) opt->val) = val;
1909 break;
1910
1911 case 2:
4f8b691c 1912 put_unaligned_le16(val, opt->val);
1da177e4
LT		 1913 break;
1914
1915 case 4:
4f8b691c 1916 put_unaligned_le32(val, opt->val);
1da177e4
LT		 1917 break;
1918
1919 default:
1920 memcpy(opt->val, (void *) val, len);
1921 break;
1922 }
1923
1924 *ptr += L2CAP_CONF_OPT_SIZE + len;
1925}
1926
f89cef09
AE		 1927static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
1928{
1929 struct l2cap_conf_efs efs;
1930
1ec918ce 1931 switch (chan->mode) {
f89cef09
AE		 1932 case L2CAP_MODE_ERTM:
1933 efs.id = chan->local_id;
1934 efs.stype = chan->local_stype;
1935 efs.msdu = cpu_to_le16(chan->local_msdu);
1936 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
1937 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
1938 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
1939 break;
1940
1941 case L2CAP_MODE_STREAMING:
1942 efs.id = 1;
1943 efs.stype = L2CAP_SERV_BESTEFFORT;
1944 efs.msdu = cpu_to_le16(chan->local_msdu);
1945 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
1946 efs.acc_lat = 0;
1947 efs.flush_to = 0;
1948 break;
1949
1950 default:
1951 return;
1952 }
1953
1954 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
1955 (unsigned long) &efs);
1956}
1957
c1b4f43b
GP		 1958static void l2cap_ack_timeout(unsigned long arg)
1959{
525cd185 1960 struct l2cap_chan *chan = (void *) arg;
c1b4f43b 1961
525cd185
GP		 1962 bh_lock_sock(chan->sk);
1963 l2cap_send_ack(chan);
1964 bh_unlock_sock(chan->sk);
c1b4f43b
GP		 1965}
1966
525cd185 1967static inline void l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 1968{
525cd185
GP		 1969 struct sock *sk = chan->sk;
1970
42e5c802 1971 chan->expected_ack_seq = 0;
6a026610 1972 chan->unacked_frames = 0;
42e5c802 1973 chan->buffer_seq = 0;
6a026610
GP		 1974 chan->num_acked = 0;
1975 chan->frames_sent = 0;
0565c1c2 1976
e92c8e70
GP		 1977 setup_timer(&chan->retrans_timer, l2cap_retrans_timeout,
1978 (unsigned long) chan);
1979 setup_timer(&chan->monitor_timer, l2cap_monitor_timeout,
1980 (unsigned long) chan);
1981 setup_timer(&chan->ack_timer, l2cap_ack_timeout, (unsigned long) chan);
0565c1c2 1982
f1c6775b 1983 skb_queue_head_init(&chan->srej_q);
1890d36b 1984
39d5a3ee
GP		 1985 INIT_LIST_HEAD(&chan->srej_l);
1986
218bb9df
GP		 1987
1988 sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
0565c1c2
GP		 1989}
1990
f2fcfcd6
GP		 1991static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
1992{
1993 switch (mode) {
1994 case L2CAP_MODE_STREAMING:
1995 case L2CAP_MODE_ERTM:
1996 if (l2cap_mode_supported(mode, remote_feat_mask))
1997 return mode;
1998 /* fall through */
1999 default:
2000 return L2CAP_MODE_BASIC;
2001 }
2002}
2003
6327eb98
AE		 2004static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2005{
2006 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2007}
2008
f89cef09
AE		 2009static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2010{
2011 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2012}
2013
6327eb98
AE		 2014static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2015{
2016 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2017 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2018 /* use extended control field */
2019 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2020 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2021 } else {
6327eb98
AE		 2022 chan->tx_win = min_t(u16, chan->tx_win,
2023 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2024 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2025 }
6327eb98
AE		 2026}
2027
710f9b0a 2028static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2029{
1da177e4 2030 struct l2cap_conf_req *req = data;
0c1bc5c6 2031 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2032 void *ptr = req->data;
c8f79162 2033 u16 size;
1da177e4 2034
49208c9c 2035 BT_DBG("chan %p", chan);
1da177e4 2036
73ffa904 2037 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2038 goto done;
2039
0c1bc5c6 2040 switch (chan->mode) {
f2fcfcd6
GP		 2041 case L2CAP_MODE_STREAMING:
2042 case L2CAP_MODE_ERTM:
c1360a1c 2043 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2044 break;
85eb53c6 2045
f89cef09
AE		 2046 if (__l2cap_efs_supported(chan))
2047 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2048
2ba13ed6 2049 /* fall through */
f2fcfcd6 2050 default:
8c1d787b 2051 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2052 break;
2053 }
2054
2055done:
0c1bc5c6
GP		 2056 if (chan->imtu != L2CAP_DEFAULT_MTU)
2057 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2058
0c1bc5c6 2059 switch (chan->mode) {
65c7c491 2060 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2061 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2062 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2063 break;
2064
62547752
GP		 2065 rfc.mode = L2CAP_MODE_BASIC;
2066 rfc.txwin_size = 0;
2067 rfc.max_transmit = 0;
2068 rfc.retrans_timeout = 0;
2069 rfc.monitor_timeout = 0;
2070 rfc.max_pdu_size = 0;
2071
63406504
GP		 2072 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2073 (unsigned long) &rfc);
65c7c491
MH		 2074 break;
2075
2076 case L2CAP_MODE_ERTM:
2077 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2078 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2079 rfc.retrans_timeout = 0;
2080 rfc.monitor_timeout = 0;
c8f79162
AE		 2081
2082 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2083 L2CAP_EXT_HDR_SIZE -
2084 L2CAP_SDULEN_SIZE -
2085 L2CAP_FCS_SIZE);
2086 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2087
6327eb98
AE		 2088 l2cap_txwin_setup(chan);
2089
2090 rfc.txwin_size = min_t(u16, chan->tx_win,
2091 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2092
63406504
GP		 2093 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2094 (unsigned long) &rfc);
2095
f89cef09
AE		 2096 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2097 l2cap_add_opt_efs(&ptr, chan);
2098
8c1d787b 2099 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2100 break;
2101
47d1ec61 2102 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2103 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2104 chan->fcs = L2CAP_FCS_NONE;
2105 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2106 }
6327eb98
AE		 2107
2108 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2109 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2110 chan->tx_win);
f2fcfcd6
GP		 2111 break;
2112
2113 case L2CAP_MODE_STREAMING:
2114 rfc.mode = L2CAP_MODE_STREAMING;
2115 rfc.txwin_size = 0;
2116 rfc.max_transmit = 0;
2117 rfc.retrans_timeout = 0;
2118 rfc.monitor_timeout = 0;
c8f79162
AE		 2119
2120 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2121 L2CAP_EXT_HDR_SIZE -
2122 L2CAP_SDULEN_SIZE -
2123 L2CAP_FCS_SIZE);
2124 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2125
63406504
GP		 2126 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2127 (unsigned long) &rfc);
2128
f89cef09
AE		 2129 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2130 l2cap_add_opt_efs(&ptr, chan);
2131
8c1d787b 2132 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2133 break;
2134
47d1ec61 2135 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2136 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2137 chan->fcs = L2CAP_FCS_NONE;
2138 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2139 }
65c7c491
MH		 2140 break;
2141 }
1da177e4 2142
fe4128e0 2143 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2144 req->flags = cpu_to_le16(0);
1da177e4
LT		 2145
2146 return ptr - data;
2147}
2148
73ffa904 2149static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2150{
5dee9e7c
MH		 2151 struct l2cap_conf_rsp *rsp = data;
2152 void *ptr = rsp->data;
73ffa904
GP		 2153 void *req = chan->conf_req;
2154 int len = chan->conf_len;
5dee9e7c
MH		 2155 int type, hint, olen;
2156 unsigned long val;
6464f35f 2157 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2158 struct l2cap_conf_efs efs;
2159 u8 remote_efs = 0;
861d6882 2160 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2161 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2162 u16 size;
1da177e4 2163
73ffa904 2164 BT_DBG("chan %p", chan);
820ae1b8 2165
5dee9e7c
MH		 2166 while (len >= L2CAP_CONF_OPT_SIZE) {
2167 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2168
589d2746 2169 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2170 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2171
2172 switch (type) {
2173 case L2CAP_CONF_MTU:
861d6882 2174 mtu = val;
5dee9e7c
MH		 2175 break;
2176
2177 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2178 chan->flush_to = val;
5dee9e7c
MH		 2179 break;
2180
2181 case L2CAP_CONF_QOS:
2182 break;
2183
6464f35f
MH		 2184 case L2CAP_CONF_RFC:
2185 if (olen == sizeof(rfc))
2186 memcpy(&rfc, (void *) val, olen);
2187 break;
2188
fcc203c3
GP		 2189 case L2CAP_CONF_FCS:
2190 if (val == L2CAP_FCS_NONE)
c1360a1c 2191 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2192 break;
fcc203c3 2193
42dceae2
AE		 2194 case L2CAP_CONF_EFS:
2195 remote_efs = 1;
2196 if (olen == sizeof(efs))
2197 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2198 break;
2199
6327eb98
AE		 2200 case L2CAP_CONF_EWS:
2201 if (!enable_hs)
2202 return -ECONNREFUSED;
fcc203c3 2203
6327eb98
AE		 2204 set_bit(FLAG_EXT_CTRL, &chan->flags);
2205 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2206 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2207 chan->remote_tx_win = val;
fcc203c3
GP		 2208 break;
2209
5dee9e7c
MH		 2210 default:
2211 if (hint)
2212 break;
2213
2214 result = L2CAP_CONF_UNKNOWN;
2215 *((u8 *) ptr++) = type;
2216 break;
2217 }
2218 }
2219
73ffa904 2220 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2221 goto done;
2222
0c1bc5c6 2223 switch (chan->mode) {
f2fcfcd6
GP		 2224 case L2CAP_MODE_STREAMING:
2225 case L2CAP_MODE_ERTM:
c1360a1c 2226 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2227 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2228 chan->conn->feat_mask);
85eb53c6
GP		 2229 break;
2230 }
2231
42dceae2
AE		 2232 if (remote_efs) {
2233 if (__l2cap_efs_supported(chan))
2234 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2235 else
2236 return -ECONNREFUSED;
2237 }
2238
0c1bc5c6 2239 if (chan->mode != rfc.mode)
f2fcfcd6 2240 return -ECONNREFUSED;
742e519b 2241
f2fcfcd6 2242 break;
f2fcfcd6
GP		 2243 }
2244
2245done:
0c1bc5c6 2246 if (chan->mode != rfc.mode) {
f2fcfcd6 2247 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2248 rfc.mode = chan->mode;
f2fcfcd6 2249
73ffa904 2250 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2251 return -ECONNREFUSED;
2252
2253 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2254 sizeof(rfc), (unsigned long) &rfc);
2255 }
2256
5dee9e7c
MH		 2257 if (result == L2CAP_CONF_SUCCESS) {
2258 /* Configure output options and let the other side know
2259 * which ones we don't like. */
2260
f2fcfcd6
GP		 2261 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2262 result = L2CAP_CONF_UNACCEPT;
2263 else {
0c1bc5c6 2264 chan->omtu = mtu;
c1360a1c 2265 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2266 }
0c1bc5c6 2267 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2268
42dceae2
AE		 2269 if (remote_efs) {
2270 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2271 efs.stype != L2CAP_SERV_NOTRAFIC &&
2272 efs.stype != chan->local_stype) {
2273
2274 result = L2CAP_CONF_UNACCEPT;
2275
2276 if (chan->num_conf_req >= 1)
2277 return -ECONNREFUSED;
2278
2279 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2280 sizeof(efs),
42dceae2 2281 (unsigned long) &efs);
0e8b207e 2282 } else {
3e6b3b95 2283 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2284 result = L2CAP_CONF_PENDING;
2285 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2286 }
2287 }
2288
f2fcfcd6
GP		 2289 switch (rfc.mode) {
2290 case L2CAP_MODE_BASIC:
47d1ec61 2291 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2292 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2293 break;
2294
2295 case L2CAP_MODE_ERTM:
6327eb98
AE		 2296 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2297 chan->remote_tx_win = rfc.txwin_size;
2298 else
2299 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2300
2c03a7a4 2301 chan->remote_max_tx = rfc.max_transmit;
1c762159 2302
c8f79162
AE		 2303 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2304 chan->conn->mtu -
2305 L2CAP_EXT_HDR_SIZE -
2306 L2CAP_SDULEN_SIZE -
2307 L2CAP_FCS_SIZE);
2308 rfc.max_pdu_size = cpu_to_le16(size);
2309 chan->remote_mps = size;
f2fcfcd6 2310
10467e9e
GP		 2311 rfc.retrans_timeout =
2312 le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
2313 rfc.monitor_timeout =
2314 le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2315
c1360a1c 2316 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2317
2318 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2319 sizeof(rfc), (unsigned long) &rfc);
2320
42dceae2
AE		 2321 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2322 chan->remote_id = efs.id;
2323 chan->remote_stype = efs.stype;
2324 chan->remote_msdu = le16_to_cpu(efs.msdu);
2325 chan->remote_flush_to =
2326 le32_to_cpu(efs.flush_to);
2327 chan->remote_acc_lat =
2328 le32_to_cpu(efs.acc_lat);
2329 chan->remote_sdu_itime =
2330 le32_to_cpu(efs.sdu_itime);
2331 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2332 sizeof(efs), (unsigned long) &efs);
2333 }
f2fcfcd6
GP		 2334 break;
2335
2336 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2337 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2338 chan->conn->mtu -
2339 L2CAP_EXT_HDR_SIZE -
2340 L2CAP_SDULEN_SIZE -
2341 L2CAP_FCS_SIZE);
2342 rfc.max_pdu_size = cpu_to_le16(size);
2343 chan->remote_mps = size;
f2fcfcd6 2344
c1360a1c 2345 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2346
2347 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2348 sizeof(rfc), (unsigned long) &rfc);
2349
f2fcfcd6
GP		 2350 break;
2351
2352 default:
5dee9e7c 2353 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2354
6464f35f 2355 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2356 rfc.mode = chan->mode;
f2fcfcd6 2357 }
6464f35f 2358
f2fcfcd6 2359 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2360 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2361 }
fe4128e0 2362 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2363 rsp->result = cpu_to_le16(result);
2364 rsp->flags = cpu_to_le16(0x0000);
2365
2366 return ptr - data;
1da177e4
LT		 2367}
2368
b4450035 2369static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2370{
f2fcfcd6
GP		 2371 struct l2cap_conf_req *req = data;
2372 void *ptr = req->data;
2373 int type, olen;
2374 unsigned long val;
2375 struct l2cap_conf_rfc rfc;
66af7aaf 2376 struct l2cap_conf_efs efs;
f2fcfcd6 2377
fe4128e0 2378 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2379
2380 while (len >= L2CAP_CONF_OPT_SIZE) {
2381 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2382
2383 switch (type) {
2384 case L2CAP_CONF_MTU:
2385 if (val < L2CAP_DEFAULT_MIN_MTU) {
2386 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2387 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2388 } else
0c1bc5c6
GP		 2389 chan->imtu = val;
2390 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2391 break;
2392
2393 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2394 chan->flush_to = val;
f2fcfcd6 2395 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2396 2, chan->flush_to);
f2fcfcd6
GP		 2397 break;
2398
2399 case L2CAP_CONF_RFC:
2400 if (olen == sizeof(rfc))
2401 memcpy(&rfc, (void *)val, olen);
2402
c1360a1c 2403 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2404 rfc.mode != chan->mode)
f2fcfcd6
GP		 2405 return -ECONNREFUSED;
2406
47d1ec61 2407 chan->fcs = 0;
f2fcfcd6
GP		 2408
2409 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2410 sizeof(rfc), (unsigned long) &rfc);
2411 break;
6327eb98
AE		 2412
2413 case L2CAP_CONF_EWS:
2414 chan->tx_win = min_t(u16, val,
2415 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2416 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2417 chan->tx_win);
6327eb98 2418 break;
66af7aaf
AE		 2419
2420 case L2CAP_CONF_EFS:
2421 if (olen == sizeof(efs))
2422 memcpy(&efs, (void *)val, olen);
2423
2424 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2425 efs.stype != L2CAP_SERV_NOTRAFIC &&
2426 efs.stype != chan->local_stype)
2427 return -ECONNREFUSED;
2428
2429 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2430 sizeof(efs), (unsigned long) &efs);
2431 break;
f2fcfcd6
GP		 2432 }
2433 }
2434
0c1bc5c6 2435 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2436 return -ECONNREFUSED;
2437
0c1bc5c6 2438 chan->mode = rfc.mode;
6c2ea7a8 2439
0e8b207e 2440 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2441 switch (rfc.mode) {
2442 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2443 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2444 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2445 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2446
2447 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2448 chan->local_msdu = le16_to_cpu(efs.msdu);
2449 chan->local_sdu_itime =
2450 le32_to_cpu(efs.sdu_itime);
2451 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2452 chan->local_flush_to =
2453 le32_to_cpu(efs.flush_to);
2454 }
f2fcfcd6 2455 break;
66af7aaf 2456
f2fcfcd6 2457 case L2CAP_MODE_STREAMING:
47d1ec61 2458 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2459 }
2460 }
2461
fe4128e0 2462 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2463 req->flags = cpu_to_le16(0x0000);
2464
2465 return ptr - data;
2466}
2467
fe4128e0 2468static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2469{
2470 struct l2cap_conf_rsp *rsp = data;
2471 void *ptr = rsp->data;
1da177e4 2472
fe4128e0 2473 BT_DBG("chan %p", chan);
1da177e4 2474
fe4128e0 2475 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2476 rsp->result = cpu_to_le16(result);
aca3192c 2477 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2478
2479 return ptr - data;
2480}
2481
8c1d787b 2482void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2483{
2484 struct l2cap_conn_rsp rsp;
8c1d787b 2485 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2486 u8 buf[128];
2487
fe4128e0
GP		 2488 rsp.scid = cpu_to_le16(chan->dcid);
2489 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2490 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2491 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2492 l2cap_send_cmd(conn, chan->ident,
2493 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2494
c1360a1c 2495 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2496 return;
2497
710f9b0a
GP		 2498 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2499 l2cap_build_conf_req(chan, buf), buf);
2500 chan->num_conf_req++;
2501}
2502
47d1ec61 2503static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2504{
7b1c0049
GP		 2505 int type, olen;
2506 unsigned long val;
2507 struct l2cap_conf_rfc rfc;
2508
47d1ec61 2509 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2510
0c1bc5c6 2511 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2512 return;
2513
2514 while (len >= L2CAP_CONF_OPT_SIZE) {
2515 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2516
2517 switch (type) {
2518 case L2CAP_CONF_RFC:
2519 if (olen == sizeof(rfc))
2520 memcpy(&rfc, (void *)val, olen);
2521 goto done;
2522 }
2523 }
2524
2525done:
2526 switch (rfc.mode) {
2527 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2528 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2529 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2530 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2531 break;
2532 case L2CAP_MODE_STREAMING:
47d1ec61 2533 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2534 }
2535}
2536
4e8402a3
MH		 2537static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2538{
e2fd318e 2539 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2540
e2fd318e 2541 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2542 return 0;
2543
2544 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2545 cmd->ident == conn->info_ident) {
4e8402a3 2546 del_timer(&conn->info_timer);
984947dc
MH		 2547
2548 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2549 conn->info_ident = 0;
984947dc 2550
4e8402a3
MH		 2551 l2cap_conn_start(conn);
2552 }
2553
2554 return 0;
2555}
2556
1da177e4
LT		 2557static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2558{
1da177e4
LT		 2559 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2560 struct l2cap_conn_rsp rsp;
23691d75 2561 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2562 struct sock *parent, *sk = NULL;
e7c29cb1 2563 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2564
2565 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2566 __le16 psm = req->psm;
1da177e4
LT		 2567
2568 BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
2569
2570 /* Check if we have socket listening on psm */
23691d75
GP		 2571 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src);
2572 if (!pchan) {
1da177e4
LT		 2573 result = L2CAP_CR_BAD_PSM;
2574 goto sendresp;
2575 }
2576
23691d75
GP		 2577 parent = pchan->sk;
2578
e0f0cb56
GP		 2579 bh_lock_sock(parent);
2580
e7c29cb1
MH		 2581 /* Check if the ACL is secure enough (if not SDP) */
2582 if (psm != cpu_to_le16(0x0001) &&
2583 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2584 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2585 result = L2CAP_CR_SEC_BLOCK;
2586 goto response;
2587 }
2588
1da177e4
LT		 2589 result = L2CAP_CR_NO_MEM;
2590
2591 /* Check for backlog size */
2592 if (sk_acceptq_is_full(parent)) {
8e87d142 2593 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2594 goto response;
2595 }
2596
80808e43
GP		 2597 chan = pchan->ops->new_connection(pchan->data);
2598 if (!chan)
1da177e4
LT		 2599 goto response;
2600
80808e43
GP		 2601 sk = chan->sk;
2602
baa7e1fa 2603 write_lock_bh(&conn->chan_lock);
1da177e4
LT		 2604
2605 /* Check if we already have channel with that dcid */
baa7e1fa
GP		 2606 if (__l2cap_get_chan_by_dcid(conn, scid)) {
2607 write_unlock_bh(&conn->chan_lock);
1da177e4 2608 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 2609 chan->ops->close(chan->data);
1da177e4
LT		 2610 goto response;
2611 }
2612
2613 hci_conn_hold(conn->hcon);
2614
1da177e4
LT		 2615 bacpy(&bt_sk(sk)->src, conn->src);
2616 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 2617 chan->psm = psm;
2618 chan->dcid = scid;
1da177e4 2619
d1010240
GP		 2620 bt_accept_enqueue(parent, sk);
2621
48454079
GP		 2622 __l2cap_chan_add(conn, chan);
2623
fe4128e0 2624 dcid = chan->scid;
1da177e4 2625
c9b66675 2626 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 2627
fc7f8a7e 2628 chan->ident = cmd->ident;
1da177e4 2629
984947dc 2630 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 2631 if (l2cap_chan_check_security(chan)) {
f66dc81f 2632 if (bt_sk(sk)->defer_setup) {
89bc500e 2633 l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 2634 result = L2CAP_CR_PEND;
2635 status = L2CAP_CS_AUTHOR_PEND;
2636 parent->sk_data_ready(parent, 0);
2637 } else {
89bc500e 2638 l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 2639 result = L2CAP_CR_SUCCESS;
2640 status = L2CAP_CS_NO_INFO;
2641 }
79d554a6 2642 } else {
89bc500e 2643 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 2644 result = L2CAP_CR_PEND;
2645 status = L2CAP_CS_AUTHEN_PEND;
2646 }
2647 } else {
89bc500e 2648 l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 2649 result = L2CAP_CR_PEND;
2650 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2651 }
2652
baa7e1fa 2653 write_unlock_bh(&conn->chan_lock);
1da177e4
LT		 2654
2655response:
2656 bh_unlock_sock(parent);
2657
2658sendresp:
aca3192c
YH		 2659 rsp.scid = cpu_to_le16(scid);
2660 rsp.dcid = cpu_to_le16(dcid);
2661 rsp.result = cpu_to_le16(result);
2662 rsp.status = cpu_to_le16(status);
1da177e4 2663 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 2664
2665 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
2666 struct l2cap_info_req info;
2667 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2668
2669 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
2670 conn->info_ident = l2cap_get_ident(conn);
2671
2672 mod_timer(&conn->info_timer, jiffies +
2673 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
2674
2675 l2cap_send_cmd(conn, conn->info_ident,
2676 L2CAP_INFO_REQ, sizeof(info), &info);
2677 }
2678
c1360a1c 2679 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 2680 result == L2CAP_CR_SUCCESS) {
2681 u8 buf[128];
c1360a1c 2682 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 2683 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2684 l2cap_build_conf_req(chan, buf), buf);
2685 chan->num_conf_req++;
e9aeb2dd
GP		 2686 }
2687
1da177e4
LT		 2688 return 0;
2689}
2690
2691static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2692{
2693 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
2694 u16 scid, dcid, result, status;
48454079 2695 struct l2cap_chan *chan;
1da177e4
LT		 2696 struct sock *sk;
2697 u8 req[128];
2698
2699 scid = __le16_to_cpu(rsp->scid);
2700 dcid = __le16_to_cpu(rsp->dcid);
2701 result = __le16_to_cpu(rsp->result);
2702 status = __le16_to_cpu(rsp->status);
2703
2704 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
2705
2706 if (scid) {
baa7e1fa 2707 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 2708 if (!chan)
57d3b22b 2709 return -EFAULT;
1da177e4 2710 } else {
baa7e1fa 2711 chan = l2cap_get_chan_by_ident(conn, cmd->ident);
48454079 2712 if (!chan)
57d3b22b 2713 return -EFAULT;
1da177e4
LT		 2714 }
2715
48454079
GP		 2716 sk = chan->sk;
2717
1da177e4
LT		 2718 switch (result) {
2719 case L2CAP_CR_SUCCESS:
89bc500e 2720 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 2721 chan->ident = 0;
fe4128e0 2722 chan->dcid = dcid;
c1360a1c 2723 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 2724
c1360a1c 2725 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 2726 break;
2727
1da177e4 2728 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2729 l2cap_build_conf_req(chan, req), req);
2730 chan->num_conf_req++;
1da177e4
LT		 2731 break;
2732
2733 case L2CAP_CR_PEND:
c1360a1c 2734 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 2735 break;
2736
2737 default:
a49184c2
AE		 2738 /* don't delete l2cap channel if sk is owned by user */
2739 if (sock_owned_by_user(sk)) {
89bc500e 2740 l2cap_state_change(chan, BT_DISCONN);
c9b66675 2741 __clear_chan_timer(chan);
f3f668b0 2742 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
a49184c2
AE		 2743 break;
2744 }
2745
48454079 2746 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 2747 break;
2748 }
2749
2750 bh_unlock_sock(sk);
2751 return 0;
2752}
2753
47d1ec61 2754static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 2755{
2756 /* FCS is enabled only in ERTM or streaming mode, if one or both
2757 * sides request it.
2758 */
0c1bc5c6 2759 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 2760 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2761 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 2762 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 2763}
2764
88219a0f 2765static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 2766{
2767 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2768 u16 dcid, flags;
2769 u8 rsp[64];
48454079 2770 struct l2cap_chan *chan;
1da177e4 2771 struct sock *sk;
5dee9e7c 2772 int len;
1da177e4
LT		 2773
2774 dcid = __le16_to_cpu(req->dcid);
2775 flags = __le16_to_cpu(req->flags);
2776
2777 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2778
baa7e1fa 2779 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 2780 if (!chan)
1da177e4
LT		 2781 return -ENOENT;
2782
48454079
GP		 2783 sk = chan->sk;
2784
033b1142 2785 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 2786 struct l2cap_cmd_rej_cid rej;
2787
2788 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
2789 rej.scid = cpu_to_le16(chan->scid);
2790 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 2791
df6bd743
GP		 2792 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
2793 sizeof(rej), &rej);
354f60a9 2794 goto unlock;
df6bd743 2795 }
354f60a9 2796
5dee9e7c 2797 /* Reject if config buffer is too small. */
88219a0f 2798 len = cmd_len - sizeof(*req);
7ac28817 2799 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 2800 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 2801 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 2802 L2CAP_CONF_REJECT, flags), rsp);
2803 goto unlock;
2804 }
2805
2806 /* Store config. */
73ffa904
GP		 2807 memcpy(chan->conf_req + chan->conf_len, req->data, len);
2808 chan->conf_len += len;
1da177e4
LT		 2809
2810 if (flags & 0x0001) {
2811 /* Incomplete config. Send empty response. */
2812 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 2813 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 2814 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 2815 goto unlock;
2816 }
2817
2818 /* Complete config. */
73ffa904 2819 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 2820 if (len < 0) {
e92c8e70 2821 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 2822 goto unlock;
f2fcfcd6 2823 }
1da177e4 2824
5dee9e7c 2825 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 2826 chan->num_conf_rsp++;
5dee9e7c 2827
5dee9e7c 2828 /* Reset config buffer. */
73ffa904 2829 chan->conf_len = 0;
5dee9e7c 2830
c1360a1c 2831 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 2832 goto unlock;
2833
c1360a1c 2834 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 2835 set_default_fcs(chan);
fcc203c3 2836
89bc500e 2837 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 2838
42e5c802
GP		 2839 chan->next_tx_seq = 0;
2840 chan->expected_tx_seq = 0;
58d35f87 2841 skb_queue_head_init(&chan->tx_q);
0c1bc5c6 2842 if (chan->mode == L2CAP_MODE_ERTM)
525cd185 2843 l2cap_ertm_init(chan);
0565c1c2 2844
1da177e4 2845 l2cap_chan_ready(sk);
876d9484
MH		 2846 goto unlock;
2847 }
2848
c1360a1c 2849 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 2850 u8 buf[64];
1da177e4 2851 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2852 l2cap_build_conf_req(chan, buf), buf);
2853 chan->num_conf_req++;
1da177e4
LT		 2854 }
2855
0e8b207e
AE		 2856 /* Got Conf Rsp PENDING from remote side and asume we sent
2857 Conf Rsp PENDING in the code above */
2858 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
2859 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
2860
2861 /* check compatibility */
2862
2863 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
2864 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
2865
2866 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 2867 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 2868 L2CAP_CONF_SUCCESS, 0x0000), rsp);
2869 }
2870
1da177e4
LT		 2871unlock:
2872 bh_unlock_sock(sk);
2873 return 0;
2874}
2875
2876static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2877{
2878 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2879 u16 scid, flags, result;
48454079 2880 struct l2cap_chan *chan;
1da177e4 2881 struct sock *sk;
7b1c0049 2882 int len = cmd->len - sizeof(*rsp);
1da177e4
LT		 2883
2884 scid = __le16_to_cpu(rsp->scid);
2885 flags = __le16_to_cpu(rsp->flags);
2886 result = __le16_to_cpu(rsp->result);
2887
af05b30b
GP		 2888 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
2889 scid, flags, result);
1da177e4 2890
baa7e1fa 2891 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 2892 if (!chan)
1da177e4
LT		 2893 return 0;
2894
48454079
GP		 2895 sk = chan->sk;
2896
1da177e4
LT		 2897 switch (result) {
2898 case L2CAP_CONF_SUCCESS:
47d1ec61 2899 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 2900 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 2901 break;
2902
0e8b207e
AE		 2903 case L2CAP_CONF_PENDING:
2904 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
2905
2906 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
2907 char buf[64];
2908
2909 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2910 buf, &result);
2911 if (len < 0) {
2912 l2cap_send_disconn_req(conn, chan, ECONNRESET);
2913 goto done;
2914 }
2915
2916 /* check compatibility */
2917
2918 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
2919 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
2920
2921 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 2922 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 2923 L2CAP_CONF_SUCCESS, 0x0000), buf);
2924 }
2925 goto done;
2926
1da177e4 2927 case L2CAP_CONF_UNACCEPT:
73ffa904 2928 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 2929 char req[64];
2930
c2c77ec8 2931 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 2932 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 2933 goto done;
2934 }
2935
f2fcfcd6
GP		 2936 /* throw out any old stored conf requests */
2937 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 2938 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
2939 req, &result);
f2fcfcd6 2940 if (len < 0) {
e92c8e70 2941 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 2942 goto done;
2943 }
2944
2945 l2cap_send_cmd(conn, l2cap_get_ident(conn),
2946 L2CAP_CONF_REQ, len, req);
73ffa904 2947 chan->num_conf_req++;
f2fcfcd6
GP		 2948 if (result != L2CAP_CONF_SUCCESS)
2949 goto done;
2950 break;
1da177e4
LT		 2951 }
2952
8e87d142 2953 default:
b1235d79 2954 sk->sk_err = ECONNRESET;
f3f668b0 2955 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 2956 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 2957 goto done;
2958 }
2959
2960 if (flags & 0x01)
2961 goto done;
2962
c1360a1c 2963 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 2964
c1360a1c 2965 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 2966 set_default_fcs(chan);
fcc203c3 2967
89bc500e 2968 l2cap_state_change(chan, BT_CONNECTED);
42e5c802
GP		 2969 chan->next_tx_seq = 0;
2970 chan->expected_tx_seq = 0;
58d35f87 2971 skb_queue_head_init(&chan->tx_q);
0c1bc5c6 2972 if (chan->mode == L2CAP_MODE_ERTM)
525cd185 2973 l2cap_ertm_init(chan);
0565c1c2 2974
1da177e4
LT		 2975 l2cap_chan_ready(sk);
2976 }
2977
2978done:
2979 bh_unlock_sock(sk);
2980 return 0;
2981}
2982
2983static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2984{
2985 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2986 struct l2cap_disconn_rsp rsp;
2987 u16 dcid, scid;
48454079 2988 struct l2cap_chan *chan;
1da177e4
LT		 2989 struct sock *sk;
2990
2991 scid = __le16_to_cpu(req->scid);
2992 dcid = __le16_to_cpu(req->dcid);
2993
2994 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2995
baa7e1fa 2996 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 2997 if (!chan)
1da177e4
LT		 2998 return 0;
2999
48454079
GP		 3000 sk = chan->sk;
3001
fe4128e0
GP		 3002 rsp.dcid = cpu_to_le16(chan->scid);
3003 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3004 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3005
3006 sk->sk_shutdown = SHUTDOWN_MASK;
3007
a49184c2
AE		 3008 /* don't delete l2cap channel if sk is owned by user */
3009 if (sock_owned_by_user(sk)) {
89bc500e 3010 l2cap_state_change(chan, BT_DISCONN);
c9b66675 3011 __clear_chan_timer(chan);
f3f668b0 3012 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
a49184c2
AE		 3013 bh_unlock_sock(sk);
3014 return 0;
3015 }
3016
48454079 3017 l2cap_chan_del(chan, ECONNRESET);
1da177e4
LT		 3018 bh_unlock_sock(sk);
3019
ba3bd0ee 3020 chan->ops->close(chan->data);
1da177e4
LT		 3021 return 0;
3022}
3023
3024static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3025{
3026 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3027 u16 dcid, scid;
48454079 3028 struct l2cap_chan *chan;
1da177e4
LT		 3029 struct sock *sk;
3030
3031 scid = __le16_to_cpu(rsp->scid);
3032 dcid = __le16_to_cpu(rsp->dcid);
3033
3034 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3035
baa7e1fa 3036 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3037 if (!chan)
1da177e4
LT		 3038 return 0;
3039
48454079
GP		 3040 sk = chan->sk;
3041
a49184c2
AE		 3042 /* don't delete l2cap channel if sk is owned by user */
3043 if (sock_owned_by_user(sk)) {
1ec918ce 3044 l2cap_state_change(chan, BT_DISCONN);
c9b66675 3045 __clear_chan_timer(chan);
f3f668b0 3046 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
a49184c2
AE		 3047 bh_unlock_sock(sk);
3048 return 0;
3049 }
3050
48454079 3051 l2cap_chan_del(chan, 0);
1da177e4
LT		 3052 bh_unlock_sock(sk);
3053
ba3bd0ee 3054 chan->ops->close(chan->data);
1da177e4
LT		 3055 return 0;
3056}
3057
3058static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3059{
3060 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3061 u16 type;
3062
3063 type = __le16_to_cpu(req->type);
3064
3065 BT_DBG("type 0x%4.4x", type);
3066
f0709e03
MH		 3067 if (type == L2CAP_IT_FEAT_MASK) {
3068 u8 buf[8];
44dd46de 3069 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3070 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3071 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3072 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3073 if (!disable_ertm)
fcc203c3
GP		 3074 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3075 | L2CAP_FEAT_FCS;
a5fd6f30 3076 if (enable_hs)
6327eb98
AE		 3077 feat_mask |= L2CAP_FEAT_EXT_FLOW
3078 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3079
1b7bf4ed 3080 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3081 l2cap_send_cmd(conn, cmd->ident,
3082 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3083 } else if (type == L2CAP_IT_FIXED_CHAN) {
3084 u8 buf[12];
3085 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3086
3087 if (enable_hs)
3088 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3089 else
3090 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3091
e1027a7c
MH		 3092 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3093 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3094 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3095 l2cap_send_cmd(conn, cmd->ident,
3096 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3097 } else {
3098 struct l2cap_info_rsp rsp;
3099 rsp.type = cpu_to_le16(type);
3100 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3101 l2cap_send_cmd(conn, cmd->ident,
3102 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3103 }
1da177e4
LT		 3104
3105 return 0;
3106}
3107
3108static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3109{
3110 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3111 u16 type, result;
3112
3113 type = __le16_to_cpu(rsp->type);
3114 result = __le16_to_cpu(rsp->result);
3115
3116 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3117
e90165be
AE		 3118 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3119 if (cmd->ident != conn->info_ident ||
3120 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3121 return 0;
3122
4e8402a3
MH		 3123 del_timer(&conn->info_timer);
3124
adb08ede
VT		 3125 if (result != L2CAP_IR_SUCCESS) {
3126 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3127 conn->info_ident = 0;
3128
3129 l2cap_conn_start(conn);
3130
3131 return 0;
3132 }
3133
984947dc 3134 if (type == L2CAP_IT_FEAT_MASK) {
83985319 3135 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3136
47ec1dcd 3137 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3138 struct l2cap_info_req req;
3139 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3140
3141 conn->info_ident = l2cap_get_ident(conn);
3142
3143 l2cap_send_cmd(conn, conn->info_ident,
3144 L2CAP_INFO_REQ, sizeof(req), &req);
3145 } else {
3146 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3147 conn->info_ident = 0;
3148
3149 l2cap_conn_start(conn);
3150 }
3151 } else if (type == L2CAP_IT_FIXED_CHAN) {
984947dc 3152 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3153 conn->info_ident = 0;
984947dc
MH		 3154
3155 l2cap_conn_start(conn);
3156 }
4e8402a3 3157
1da177e4
LT		 3158 return 0;
3159}
3160
f94ff6ff
MM		 3161static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3162 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3163 void *data)
3164{
3165 struct l2cap_create_chan_req *req = data;
3166 struct l2cap_create_chan_rsp rsp;
3167 u16 psm, scid;
3168
3169 if (cmd_len != sizeof(*req))
3170 return -EPROTO;
3171
3172 if (!enable_hs)
3173 return -EINVAL;
3174
3175 psm = le16_to_cpu(req->psm);
3176 scid = le16_to_cpu(req->scid);
3177
3178 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3179
3180 /* Placeholder: Always reject */
3181 rsp.dcid = 0;
3182 rsp.scid = cpu_to_le16(scid);
3183 rsp.result = L2CAP_CR_NO_MEM;
3184 rsp.status = L2CAP_CS_NO_INFO;
3185
3186 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3187 sizeof(rsp), &rsp);
3188
3189 return 0;
3190}
3191
3192static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3193 struct l2cap_cmd_hdr *cmd, void *data)
3194{
3195 BT_DBG("conn %p", conn);
3196
3197 return l2cap_connect_rsp(conn, cmd, data);
3198}
3199
8d5a04a1
MM		 3200static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3201 u16 icid, u16 result)
3202{
3203 struct l2cap_move_chan_rsp rsp;
3204
3205 BT_DBG("icid %d, result %d", icid, result);
3206
3207 rsp.icid = cpu_to_le16(icid);
3208 rsp.result = cpu_to_le16(result);
3209
3210 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3211}
3212
3213static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3214 struct l2cap_chan *chan, u16 icid, u16 result)
3215{
3216 struct l2cap_move_chan_cfm cfm;
3217 u8 ident;
3218
3219 BT_DBG("icid %d, result %d", icid, result);
3220
3221 ident = l2cap_get_ident(conn);
3222 if (chan)
3223 chan->ident = ident;
3224
3225 cfm.icid = cpu_to_le16(icid);
3226 cfm.result = cpu_to_le16(result);
3227
3228 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3229}
3230
3231static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3232 u16 icid)
3233{
3234 struct l2cap_move_chan_cfm_rsp rsp;
3235
3236 BT_DBG("icid %d", icid);
3237
3238 rsp.icid = cpu_to_le16(icid);
3239 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3240}
3241
3242static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3243 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3244{
3245 struct l2cap_move_chan_req *req = data;
3246 u16 icid = 0;
3247 u16 result = L2CAP_MR_NOT_ALLOWED;
3248
3249 if (cmd_len != sizeof(*req))
3250 return -EPROTO;
3251
3252 icid = le16_to_cpu(req->icid);
3253
3254 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3255
3256 if (!enable_hs)
3257 return -EINVAL;
3258
3259 /* Placeholder: Always refuse */
3260 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3261
3262 return 0;
3263}
3264
3265static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3266 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3267{
3268 struct l2cap_move_chan_rsp *rsp = data;
3269 u16 icid, result;
3270
3271 if (cmd_len != sizeof(*rsp))
3272 return -EPROTO;
3273
3274 icid = le16_to_cpu(rsp->icid);
3275 result = le16_to_cpu(rsp->result);
3276
3277 BT_DBG("icid %d, result %d", icid, result);
3278
3279 /* Placeholder: Always unconfirmed */
3280 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3281
3282 return 0;
3283}
3284
3285static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3286 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3287{
3288 struct l2cap_move_chan_cfm *cfm = data;
3289 u16 icid, result;
3290
3291 if (cmd_len != sizeof(*cfm))
3292 return -EPROTO;
3293
3294 icid = le16_to_cpu(cfm->icid);
3295 result = le16_to_cpu(cfm->result);
3296
3297 BT_DBG("icid %d, result %d", icid, result);
3298
3299 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3300
3301 return 0;
3302}
3303
3304static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3305 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3306{
3307 struct l2cap_move_chan_cfm_rsp *rsp = data;
3308 u16 icid;
3309
3310 if (cmd_len != sizeof(*rsp))
3311 return -EPROTO;
3312
3313 icid = le16_to_cpu(rsp->icid);
3314
3315 BT_DBG("icid %d", icid);
3316
3317 return 0;
3318}
3319
e2174ca4 3320static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3321 u16 to_multiplier)
3322{
3323 u16 max_latency;
3324
3325 if (min > max || min < 6 || max > 3200)
3326 return -EINVAL;
3327
3328 if (to_multiplier < 10 || to_multiplier > 3200)
3329 return -EINVAL;
3330
3331 if (max >= to_multiplier * 8)
3332 return -EINVAL;
3333
3334 max_latency = (to_multiplier * 8 / max) - 1;
3335 if (latency > 499 || latency > max_latency)
3336 return -EINVAL;
3337
3338 return 0;
3339}
3340
3341static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3342 struct l2cap_cmd_hdr *cmd, u8 *data)
3343{
3344 struct hci_conn *hcon = conn->hcon;
3345 struct l2cap_conn_param_update_req *req;
3346 struct l2cap_conn_param_update_rsp rsp;
3347 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3348 int err;
de73115a
CT		 3349
3350 if (!(hcon->link_mode & HCI_LM_MASTER))
3351 return -EINVAL;
3352
3353 cmd_len = __le16_to_cpu(cmd->len);
3354 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3355 return -EPROTO;
3356
3357 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3358 min = __le16_to_cpu(req->min);
3359 max = __le16_to_cpu(req->max);
de73115a
CT		 3360 latency = __le16_to_cpu(req->latency);
3361 to_multiplier = __le16_to_cpu(req->to_multiplier);
3362
3363 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3364 min, max, latency, to_multiplier);
3365
3366 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3367
3368 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3369 if (err)
de73115a
CT		 3370 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3371 else
3372 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3373
3374 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3375 sizeof(rsp), &rsp);
3376
2ce603eb
CT		 3377 if (!err)
3378 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3379
de73115a
CT		 3380 return 0;
3381}
3382
3300d9a9
CT		 3383static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3384 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3385{
3386 int err = 0;
3387
3388 switch (cmd->code) {
3389 case L2CAP_COMMAND_REJ:
3390 l2cap_command_rej(conn, cmd, data);
3391 break;
3392
3393 case L2CAP_CONN_REQ:
3394 err = l2cap_connect_req(conn, cmd, data);
3395 break;
3396
3397 case L2CAP_CONN_RSP:
3398 err = l2cap_connect_rsp(conn, cmd, data);
3399 break;
3400
3401 case L2CAP_CONF_REQ:
3402 err = l2cap_config_req(conn, cmd, cmd_len, data);
3403 break;
3404
3405 case L2CAP_CONF_RSP:
3406 err = l2cap_config_rsp(conn, cmd, data);
3407 break;
3408
3409 case L2CAP_DISCONN_REQ:
3410 err = l2cap_disconnect_req(conn, cmd, data);
3411 break;
3412
3413 case L2CAP_DISCONN_RSP:
3414 err = l2cap_disconnect_rsp(conn, cmd, data);
3415 break;
3416
3417 case L2CAP_ECHO_REQ:
3418 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3419 break;
3420
3421 case L2CAP_ECHO_RSP:
3422 break;
3423
3424 case L2CAP_INFO_REQ:
3425 err = l2cap_information_req(conn, cmd, data);
3426 break;
3427
3428 case L2CAP_INFO_RSP:
3429 err = l2cap_information_rsp(conn, cmd, data);
3430 break;
3431
f94ff6ff
MM		 3432 case L2CAP_CREATE_CHAN_REQ:
3433 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3434 break;
3435
3436 case L2CAP_CREATE_CHAN_RSP:
3437 err = l2cap_create_channel_rsp(conn, cmd, data);
3438 break;
3439
8d5a04a1
MM		 3440 case L2CAP_MOVE_CHAN_REQ:
3441 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3442 break;
3443
3444 case L2CAP_MOVE_CHAN_RSP:
3445 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3446 break;
3447
3448 case L2CAP_MOVE_CHAN_CFM:
3449 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3450 break;
3451
3452 case L2CAP_MOVE_CHAN_CFM_RSP:
3453 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3454 break;
3455
3300d9a9
CT		 3456 default:
3457 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3458 err = -EINVAL;
3459 break;
3460 }
3461
3462 return err;
3463}
3464
3465static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3466 struct l2cap_cmd_hdr *cmd, u8 *data)
3467{
3468 switch (cmd->code) {
3469 case L2CAP_COMMAND_REJ:
3470 return 0;
3471
3472 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3473 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3474
3475 case L2CAP_CONN_PARAM_UPDATE_RSP:
3476 return 0;
3477
3478 default:
3479 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3480 return -EINVAL;
3481 }
3482}
3483
3484static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3485 struct sk_buff *skb)
1da177e4
LT		 3486{
3487 u8 *data = skb->data;
3488 int len = skb->len;
3489 struct l2cap_cmd_hdr cmd;
3300d9a9 3490 int err;
1da177e4
LT		 3491
3492 l2cap_raw_recv(conn, skb);
3493
3494 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3495 u16 cmd_len;
1da177e4
LT		 3496 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3497 data += L2CAP_CMD_HDR_SIZE;
3498 len -= L2CAP_CMD_HDR_SIZE;
3499
88219a0f 3500 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3501
88219a0f 3502 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3503
88219a0f 3504 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3505 BT_DBG("corrupted command");
3506 break;
3507 }
3508
3300d9a9
CT		 3509 if (conn->hcon->type == LE_LINK)
3510 err = l2cap_le_sig_cmd(conn, &cmd, data);
3511 else
3512 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3513
3514 if (err) {
e2fd318e 3515 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3516
3517 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3518
3519 /* FIXME: Map err to a valid reason */
e2fd318e 3520 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3521 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3522 }
3523
88219a0f
AV		 3524 data += cmd_len;
3525 len -= cmd_len;
1da177e4
LT		 3526 }
3527
3528 kfree_skb(skb);
3529}
3530
47d1ec61 3531static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3532{
3533 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3534 int hdr_size;
3535
3536 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3537 hdr_size = L2CAP_EXT_HDR_SIZE;
3538 else
3539 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3540
47d1ec61 3541 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3542 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3543 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3544 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3545
3546 if (our_fcs != rcv_fcs)
7a560e5c 3547 return -EBADMSG;
fcc203c3
GP		 3548 }
3549 return 0;
3550}
3551
525cd185 3552static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3553{
88843ab0 3554 u32 control = 0;
d5392c8f 3555
6a026610 3556 chan->frames_sent = 0;
d5392c8f 3557
0b209fae 3558 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3559
e2ab4353 3560 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3561 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3562 l2cap_send_sframe(chan, control);
e2ab4353 3563 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3564 }
3565
e2ab4353 3566 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3567 l2cap_retransmit_frames(chan);
d5392c8f 3568
525cd185 3569 l2cap_ertm_send(chan);
d5392c8f 3570
e2ab4353 3571 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3572 chan->frames_sent == 0) {
ab784b73 3573 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3574 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3575 }
3576}
3577
fb45de7d 3578static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 3579{
3580 struct sk_buff *next_skb;
bfbacc11 3581 int tx_seq_offset, next_tx_seq_offset;
8f17154f
GP		 3582
3583 bt_cb(skb)->tx_seq = tx_seq;
3584 bt_cb(skb)->sar = sar;
3585
f1c6775b 3586 next_skb = skb_peek(&chan->srej_q);
8f17154f 3587
836be934 3588 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 3589
039d9572 3590 while (next_skb) {
9b53350d
JPRV		 3591 if (bt_cb(next_skb)->tx_seq == tx_seq)
3592 return -EINVAL;
3593
836be934
AE		 3594 next_tx_seq_offset = __seq_offset(chan,
3595 bt_cb(next_skb)->tx_seq, chan->buffer_seq);
bfbacc11
JPRV		 3596
3597 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 3598 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 3599 return 0;
8f17154f
GP		 3600 }
3601
f1c6775b 3602 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 3603 next_skb = NULL;
3604 else
3605 next_skb = skb_queue_next(&chan->srej_q, next_skb);
3606 }
8f17154f 3607
f1c6775b 3608 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 3609
3610 return 0;
8f17154f
GP		 3611}
3612
84084a31
MM		 3613static void append_skb_frag(struct sk_buff *skb,
3614 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 3615{
84084a31
MM		 3616 /* skb->len reflects data in skb as well as all fragments
3617 * skb->data_len reflects only data in fragments
3618 */
3619 if (!skb_has_frag_list(skb))
3620 skb_shinfo(skb)->frag_list = new_frag;
3621
3622 new_frag->next = NULL;
3623
3624 (*last_frag)->next = new_frag;
3625 *last_frag = new_frag;
3626
3627 skb->len += new_frag->len;
3628 skb->data_len += new_frag->len;
3629 skb->truesize += new_frag->truesize;
3630}
3631
88843ab0 3632static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 3633{
3634 int err = -EINVAL;
18778a63 3635
7e0ef6ee
AE		 3636 switch (__get_ctrl_sar(chan, control)) {
3637 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 3638 if (chan->sdu)
3639 break;
18778a63 3640
84084a31
MM		 3641 err = chan->ops->recv(chan->data, skb);
3642 break;
18778a63 3643
7e0ef6ee 3644 case L2CAP_SAR_START:
84084a31
MM		 3645 if (chan->sdu)
3646 break;
18778a63 3647
6f61fd47 3648 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 3649 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 3650
84084a31
MM		 3651 if (chan->sdu_len > chan->imtu) {
3652 err = -EMSGSIZE;
3653 break;
3654 }
1890d36b 3655
84084a31
MM		 3656 if (skb->len >= chan->sdu_len)
3657 break;
18778a63 3658
84084a31
MM		 3659 chan->sdu = skb;
3660 chan->sdu_last_frag = skb;
18778a63 3661
84084a31
MM		 3662 skb = NULL;
3663 err = 0;
18778a63
GP		 3664 break;
3665
7e0ef6ee 3666 case L2CAP_SAR_CONTINUE:
6f61fd47 3667 if (!chan->sdu)
84084a31 3668 break;
18778a63 3669
84084a31
MM		 3670 append_skb_frag(chan->sdu, skb,
3671 &chan->sdu_last_frag);
3672 skb = NULL;
18778a63 3673
84084a31
MM		 3674 if (chan->sdu->len >= chan->sdu_len)
3675 break;
4178ba46 3676
84084a31 3677 err = 0;
18778a63
GP		 3678 break;
3679
7e0ef6ee 3680 case L2CAP_SAR_END:
6f61fd47 3681 if (!chan->sdu)
84084a31 3682 break;
18778a63 3683
84084a31
MM		 3684 append_skb_frag(chan->sdu, skb,
3685 &chan->sdu_last_frag);
3686 skb = NULL;
4178ba46 3687
84084a31
MM		 3688 if (chan->sdu->len != chan->sdu_len)
3689 break;
18778a63 3690
84084a31 3691 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 3692
84084a31
MM		 3693 if (!err) {
3694 /* Reassembly complete */
3695 chan->sdu = NULL;
3696 chan->sdu_last_frag = NULL;
3697 chan->sdu_len = 0;
1890d36b 3698 }
18778a63
GP		 3699 break;
3700 }
3701
84084a31
MM		 3702 if (err) {
3703 kfree_skb(skb);
3704 kfree_skb(chan->sdu);
3705 chan->sdu = NULL;
3706 chan->sdu_last_frag = NULL;
3707 chan->sdu_len = 0;
3708 }
18778a63 3709
84084a31 3710 return err;
18778a63
GP		 3711}
3712
26f880d2 3713static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 3714{
88843ab0 3715 u32 control;
712132eb 3716
26f880d2 3717 BT_DBG("chan %p, Enter local busy", chan);
712132eb 3718
26f880d2
MM		 3719 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3720
0b209fae 3721 control = __set_reqseq(chan, chan->buffer_seq);
ab784b73 3722 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
26f880d2
MM		 3723 l2cap_send_sframe(chan, control);
3724
3725 set_bit(CONN_RNR_SENT, &chan->conn_state);
3726
3727 __clear_ack_timer(chan);
3728}
3729
3730static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
3731{
88843ab0 3732 u32 control;
712132eb 3733
e2ab4353 3734 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 3735 goto done;
3736
0b209fae 3737 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 3738 control |= __set_ctrl_poll(chan);
ab784b73 3739 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3740 l2cap_send_sframe(chan, control);
6a026610 3741 chan->retry_count = 1;
712132eb 3742
1a09bcb9
GP		 3743 __clear_retrans_timer(chan);
3744 __set_monitor_timer(chan);
712132eb 3745
e2ab4353 3746 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 3747
3748done:
e2ab4353
GP		 3749 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3750 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 3751
49208c9c 3752 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 3753}
3754
e328140f 3755void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 3756{
e328140f
MM		 3757 if (chan->mode == L2CAP_MODE_ERTM) {
3758 if (busy)
3759 l2cap_ertm_enter_local_busy(chan);
3760 else
3761 l2cap_ertm_exit_local_busy(chan);
1890d36b 3762 }
1890d36b
GP		 3763}
3764
fb45de7d 3765static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 3766{
3767 struct sk_buff *skb;
88843ab0 3768 u32 control;
8f17154f 3769
e328140f
MM		 3770 while ((skb = skb_peek(&chan->srej_q)) &&
3771 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
3772 int err;
3773
8f17154f
GP		 3774 if (bt_cb(skb)->tx_seq != tx_seq)
3775 break;
3776
f1c6775b 3777 skb = skb_dequeue(&chan->srej_q);
7e0ef6ee 3778 control = __set_ctrl_sar(chan, bt_cb(skb)->sar);
84084a31 3779 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 3780
3781 if (err < 0) {
3782 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
3783 break;
3784 }
3785
836be934
AE		 3786 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
3787 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 3788 }
3789}
3790
fb45de7d 3791static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 3792{
8f17154f 3793 struct srej_list *l, *tmp;
88843ab0 3794 u32 control;
8f17154f 3795
39d5a3ee 3796 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 3797 if (l->tx_seq == tx_seq) {
3798 list_del(&l->list);
3799 kfree(l);
3800 return;
3801 }
ab784b73 3802 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 3803 control |= __set_reqseq(chan, l->tx_seq);
525cd185 3804 l2cap_send_sframe(chan, control);
8f17154f 3805 list_del(&l->list);
39d5a3ee 3806 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 3807 }
3808}
3809
aef89f21 3810static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 3811{
8f17154f 3812 struct srej_list *new;
88843ab0 3813 u32 control;
8f17154f 3814
42e5c802 3815 while (tx_seq != chan->expected_tx_seq) {
ab784b73 3816 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 3817 control |= __set_reqseq(chan, chan->expected_tx_seq);
525cd185 3818 l2cap_send_sframe(chan, control);
8f17154f
GP		 3819
3820 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 3821 if (!new)
3822 return -ENOMEM;
3823
42e5c802 3824 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 3825
3826 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
3827
39d5a3ee 3828 list_add_tail(&new->list, &chan->srej_l);
8f17154f 3829 }
836be934
AE		 3830
3831 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 3832
3833 return 0;
8f17154f
GP		 3834}
3835
88843ab0 3836static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 3837{
fb45de7d 3838 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 3839 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 3840 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 3841 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 3842 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 3843 int err = 0;
3844
88843ab0 3845 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 3846 tx_seq, rx_control);
1c2acffb 3847
03f6715d 3848 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 3849 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 3850 __clear_monitor_timer(chan);
6a026610 3851 if (chan->unacked_frames > 0)
1a09bcb9 3852 __set_retrans_timer(chan);
e2ab4353 3853 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 3854 }
3855
42e5c802
GP		 3856 chan->expected_ack_seq = req_seq;
3857 l2cap_drop_acked_frames(chan);
9f121a5a 3858
836be934 3859 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 3860
3861 /* invalid tx_seq */
47d1ec61 3862 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 3863 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 3864 goto drop;
3865 }
3866
e2ab4353 3867 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state))
1890d36b
GP		 3868 goto drop;
3869
02f1b641
MM		 3870 if (tx_seq == chan->expected_tx_seq)
3871 goto expected;
3872
e2ab4353 3873 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 3874 struct srej_list *first;
30afb5b2 3875
39d5a3ee 3876 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 3877 struct srej_list, list);
3878 if (tx_seq == first->tx_seq) {
42e5c802 3879 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 3880 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 3881
3882 list_del(&first->list);
3883 kfree(first);
3884
39d5a3ee 3885 if (list_empty(&chan->srej_l)) {
42e5c802 3886 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 3887 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 3888 l2cap_send_ack(chan);
49208c9c 3889 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 3890 }
3891 } else {
3892 struct srej_list *l;
9b53350d
JPRV		 3893
3894 /* duplicated tx_seq */
42e5c802 3895 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 3896 goto drop;
8f17154f 3897
39d5a3ee 3898 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 3899 if (l->tx_seq == tx_seq) {
525cd185 3900 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 3901 return 0;
3902 }
3903 }
aef89f21
SJ		 3904
3905 err = l2cap_send_srejframe(chan, tx_seq);
3906 if (err < 0) {
3907 l2cap_send_disconn_req(chan->conn, chan, -err);
3908 return err;
3909 }
30afb5b2
GP		 3910 }
3911 } else {
836be934
AE		 3912 expected_tx_seq_offset = __seq_offset(chan,
3913 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 3914
3915 /* duplicated tx_seq */
3916 if (tx_seq_offset < expected_tx_seq_offset)
3917 goto drop;
3918
e2ab4353 3919 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 3920
49208c9c 3921 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 3922
39d5a3ee 3923 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 3924 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 3925
f1c6775b 3926 __skb_queue_head_init(&chan->srej_q);
42e5c802 3927 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 3928
e2ab4353 3929 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 3930
aef89f21
SJ		 3931 err = l2cap_send_srejframe(chan, tx_seq);
3932 if (err < 0) {
3933 l2cap_send_disconn_req(chan->conn, chan, -err);
3934 return err;
3935 }
7fe9b298 3936
1a09bcb9 3937 __clear_ack_timer(chan);
1c2acffb 3938 }
30afb5b2
GP		 3939 return 0;
3940
8f17154f 3941expected:
836be934 3942 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 3943
e2ab4353 3944 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3b1a9f3f
GP		 3945 bt_cb(skb)->tx_seq = tx_seq;
3946 bt_cb(skb)->sar = sar;
f1c6775b 3947 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 3948 return 0;
3949 }
3950
84084a31 3951 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 3952 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
3953
e328140f
MM		 3954 if (err < 0) {
3955 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
3956 return err;
3957 }
2ece3684 3958
03f6715d 3959 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 3960 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 3961 l2cap_retransmit_frames(chan);
4ec10d97
GP		 3962 }
3963
c1b4f43b 3964
6a026610
GP		 3965 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
3966 if (chan->num_acked == num_to_ack - 1)
525cd185 3967 l2cap_send_ack(chan);
4d611e4d
GP		 3968 else
3969 __set_ack_timer(chan);
9e917af1 3970
8f17154f 3971 return 0;
9b53350d
JPRV		 3972
3973drop:
3974 kfree_skb(skb);
3975 return 0;
1c2acffb
GP		 3976}
3977
88843ab0 3978static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 3979{
88843ab0 3980 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 3981 __get_reqseq(chan, rx_control), rx_control);
0e98958d 3982
0b209fae 3983 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 3984 l2cap_drop_acked_frames(chan);
1c2acffb 3985
e3781735 3986 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 3987 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3988 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3989 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 3990 (chan->unacked_frames > 0))
1a09bcb9 3991 __set_retrans_timer(chan);
05fbd89d 3992
e2ab4353 3993 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 3994 l2cap_send_srejtail(chan);
05fbd89d 3995 } else {
525cd185 3996 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 3997 }
1d8f5d16 3998
03f6715d 3999 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4000 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4001
e2ab4353 4002 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4003 l2cap_retransmit_frames(chan);
2246b2f1 4004
e072745f 4005 } else {
e2ab4353 4006 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4007 (chan->unacked_frames > 0))
1a09bcb9 4008 __set_retrans_timer(chan);
1c2acffb 4009
e2ab4353
GP		 4010 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4011 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4012 l2cap_send_ack(chan);
894718a6 4013 else
525cd185 4014 l2cap_ertm_send(chan);
e072745f
GP		 4015 }
4016}
2246b2f1 4017
88843ab0 4018static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4019{
0b209fae 4020 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4021
88843ab0 4022 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4023
e2ab4353 4024 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4025
42e5c802
GP		 4026 chan->expected_ack_seq = tx_seq;
4027 l2cap_drop_acked_frames(chan);
e072745f 4028
03f6715d 4029 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4030 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4031 l2cap_retransmit_frames(chan);
e072745f 4032 } else {
525cd185 4033 l2cap_retransmit_frames(chan);
30afb5b2 4034
e2ab4353
GP		 4035 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4036 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4037 }
4038}
88843ab0 4039static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4040{
0b209fae 4041 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4042
88843ab0 4043 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4044
e2ab4353 4045 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4046
e3781735 4047 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4048 chan->expected_ack_seq = tx_seq;
4049 l2cap_drop_acked_frames(chan);
3cb123d1 4050
e2ab4353 4051 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4052 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4053
525cd185 4054 l2cap_ertm_send(chan);
dfc909be 4055
e2ab4353 4056 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4057 chan->srej_save_reqseq = tx_seq;
e2ab4353 4058 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4059 }
03f6715d 4060 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4061 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4062 chan->srej_save_reqseq == tx_seq)
e2ab4353 4063 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4064 else
525cd185 4065 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4066 } else {
525cd185 4067 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4068 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4069 chan->srej_save_reqseq = tx_seq;
e2ab4353 4070 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4071 }
e072745f
GP		 4072 }
4073}
4074
88843ab0 4075static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4076{
0b209fae 4077 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4078
88843ab0 4079 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4080
e2ab4353 4081 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4082 chan->expected_ack_seq = tx_seq;
4083 l2cap_drop_acked_frames(chan);
e072745f 4084
e3781735 4085 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4086 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4087
e2ab4353 4088 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4089 __clear_retrans_timer(chan);
e3781735 4090 if (__is_ctrl_poll(chan, rx_control))
525cd185 4091 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4092 return;
e072745f 4093 }
99b0d4b7 4094
e3781735 4095 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4096 l2cap_send_srejtail(chan);
ab784b73
AE		 4097 } else {
4098 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4099 l2cap_send_sframe(chan, rx_control);
4100 }
e072745f
GP		 4101}
4102
88843ab0 4103static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4104{
88843ab0 4105 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4106
03f6715d 4107 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4108 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4109 __clear_monitor_timer(chan);
6a026610 4110 if (chan->unacked_frames > 0)
1a09bcb9 4111 __set_retrans_timer(chan);
e2ab4353 4112 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4113 }
4114
ab784b73
AE		 4115 switch (__get_ctrl_super(chan, rx_control)) {
4116 case L2CAP_SUPER_RR:
525cd185 4117 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4118 break;
4119
ab784b73 4120 case L2CAP_SUPER_REJ:
525cd185 4121 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4122 break;
2246b2f1 4123
ab784b73 4124 case L2CAP_SUPER_SREJ:
525cd185 4125 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4126 break;
4127
ab784b73 4128 case L2CAP_SUPER_RNR:
525cd185 4129 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4130 break;
4131 }
4132
faaebd19 4133 kfree_skb(skb);
1c2acffb
GP		 4134 return 0;
4135}
4136
218bb9df
GP		 4137static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
4138{
525cd185 4139 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
88843ab0 4140 u32 control;
0b209fae 4141 u16 req_seq;
218bb9df
GP		 4142 int len, next_tx_seq_offset, req_seq_offset;
4143
88843ab0
AE		 4144 control = __get_control(chan, skb->data);
4145 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4146 len = skb->len;
4147
4148 /*
4149 * We can just drop the corrupted I-frame here.
4150 * Receiver will miss it and start proper recovery
4151 * procedures and ask retransmission.
4152 */
47d1ec61 4153 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4154 goto drop;
4155
793c2f1c 4156 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4157 len -= L2CAP_SDULEN_SIZE;
218bb9df 4158
47d1ec61 4159 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4160 len -= L2CAP_FCS_SIZE;
218bb9df 4161
47d1ec61 4162 if (len > chan->mps) {
8c1d787b 4163 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4164 goto drop;
4165 }
4166
0b209fae 4167 req_seq = __get_reqseq(chan, control);
218bb9df 4168
836be934
AE		 4169 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4170
4171 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4172 chan->expected_ack_seq);
218bb9df
GP		 4173
4174 /* check for invalid req-seq */
4175 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4176 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4177 goto drop;
4178 }
4179
793c2f1c 4180 if (!__is_sframe(chan, control)) {
218bb9df 4181 if (len < 0) {
8c1d787b 4182 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4183 goto drop;
4184 }
4185
525cd185 4186 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4187 } else {
4188 if (len != 0) {
4189 BT_ERR("%d", len);
8c1d787b 4190 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4191 goto drop;
4192 }
4193
525cd185 4194 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4195 }
4196
4197 return 0;
4198
4199drop:
4200 kfree_skb(skb);
4201 return 0;
4202}
4203
1da177e4
LT		 4204static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4205{
48454079 4206 struct l2cap_chan *chan;
bf734843 4207 struct sock *sk = NULL;
88843ab0 4208 u32 control;
fb45de7d 4209 u16 tx_seq;
218bb9df 4210 int len;
1da177e4 4211
baa7e1fa 4212 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4213 if (!chan) {
1da177e4
LT		 4214 BT_DBG("unknown cid 0x%4.4x", cid);
4215 goto drop;
4216 }
4217
48454079 4218 sk = chan->sk;
6840ed07 4219
49208c9c 4220 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4221
89bc500e 4222 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4223 goto drop;
4224
0c1bc5c6 4225 switch (chan->mode) {
1c2acffb
GP		 4226 case L2CAP_MODE_BASIC:
4227 /* If socket recv buffers overflows we drop data here
4228 * which is *bad* because L2CAP has to be reliable.
4229 * But we don't have any other choice. L2CAP doesn't
4230 * provide flow control mechanism. */
1da177e4 4231
0c1bc5c6 4232 if (chan->imtu < skb->len)
1c2acffb 4233 goto drop;
1da177e4 4234
23070494 4235 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4236 goto done;
4237 break;
4238
4239 case L2CAP_MODE_ERTM:
218bb9df
GP		 4240 if (!sock_owned_by_user(sk)) {
4241 l2cap_ertm_data_rcv(sk, skb);
277ffbe3 4242 } else {
218bb9df 4243 if (sk_add_backlog(sk, skb))
277ffbe3 4244 goto drop;
277ffbe3 4245 }
1c2acffb 4246
fcafde2e 4247 goto done;
1c2acffb 4248
6840ed07 4249 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4250 control = __get_control(chan, skb->data);
4251 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4252 len = skb->len;
4253
47d1ec61 4254 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4255 goto drop;
4256
7e0ef6ee 4257 if (__is_sar_start(chan, control))
03a51213 4258 len -= L2CAP_SDULEN_SIZE;
6840ed07 4259
47d1ec61 4260 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4261 len -= L2CAP_FCS_SIZE;
fcc203c3 4262
793c2f1c 4263 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4264 goto drop;
4265
fb45de7d 4266 tx_seq = __get_txseq(chan, control);
6840ed07 4267
84084a31
MM		 4268 if (chan->expected_tx_seq != tx_seq) {
4269 /* Frame(s) missing - must discard partial SDU */
4270 kfree_skb(chan->sdu);
4271 chan->sdu = NULL;
4272 chan->sdu_last_frag = NULL;
4273 chan->sdu_len = 0;
6840ed07 4274
84084a31
MM		 4275 /* TODO: Notify userland of missing data */
4276 }
4277
836be934 4278 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4279
4280 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4281 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4282
4283 goto done;
4284
1c2acffb 4285 default:
0c1bc5c6 4286 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4287 break;
4288 }
1da177e4
LT		 4289
4290drop:
4291 kfree_skb(skb);
4292
4293done:
0139418c
MH		 4294 if (sk)
4295 bh_unlock_sock(sk);
4296
1da177e4
LT		 4297 return 0;
4298}
4299
8e036fc3 4300static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4301{
6dcae1ea 4302 struct sock *sk = NULL;
23691d75 4303 struct l2cap_chan *chan;
1da177e4 4304
23691d75
GP		 4305 chan = l2cap_global_chan_by_psm(0, psm, conn->src);
4306 if (!chan)
1da177e4
LT		 4307 goto drop;
4308
23691d75
GP		 4309 sk = chan->sk;
4310
e0f0cb56
GP		 4311 bh_lock_sock(sk);
4312
1da177e4
LT		 4313 BT_DBG("sk %p, len %d", sk, skb->len);
4314
89bc500e 4315 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4316 goto drop;
4317
e13e21dc 4318 if (chan->imtu < skb->len)
1da177e4
LT		 4319 goto drop;
4320
23070494 4321 if (!chan->ops->recv(chan->data, skb))
1da177e4
LT		 4322 goto done;
4323
4324drop:
4325 kfree_skb(skb);
4326
4327done:
af05b30b
GP		 4328 if (sk)
4329 bh_unlock_sock(sk);
1da177e4
LT		 4330 return 0;
4331}
4332
9f69bda6
GP		 4333static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb)
4334{
6dcae1ea 4335 struct sock *sk = NULL;
23691d75 4336 struct l2cap_chan *chan;
9f69bda6 4337
23691d75
GP		 4338 chan = l2cap_global_chan_by_scid(0, cid, conn->src);
4339 if (!chan)
9f69bda6
GP		 4340 goto drop;
4341
23691d75
GP		 4342 sk = chan->sk;
4343
9f69bda6
GP		 4344 bh_lock_sock(sk);
4345
4346 BT_DBG("sk %p, len %d", sk, skb->len);
4347
89bc500e 4348 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4349 goto drop;
4350
e13e21dc 4351 if (chan->imtu < skb->len)
9f69bda6
GP		 4352 goto drop;
4353
23070494 4354 if (!chan->ops->recv(chan->data, skb))
9f69bda6
GP		 4355 goto done;
4356
4357drop:
4358 kfree_skb(skb);
4359
4360done:
4361 if (sk)
4362 bh_unlock_sock(sk);
4363 return 0;
4364}
4365
1da177e4
LT		 4366static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4367{
4368 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4369 u16 cid, len;
4370 __le16 psm;
1da177e4
LT		 4371
4372 skb_pull(skb, L2CAP_HDR_SIZE);
4373 cid = __le16_to_cpu(lh->cid);
4374 len = __le16_to_cpu(lh->len);
4375
1c2acffb
GP		 4376 if (len != skb->len) {
4377 kfree_skb(skb);
4378 return;
4379 }
4380
1da177e4
LT		 4381 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4382
4383 switch (cid) {
3300d9a9 4384 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4385 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4386 l2cap_sig_channel(conn, skb);
4387 break;
4388
8db4dc46 4389 case L2CAP_CID_CONN_LESS:
1b7bf4ed 4390 psm = get_unaligned_le16(skb->data);
1da177e4
LT		 4391 skb_pull(skb, 2);
4392 l2cap_conless_channel(conn, psm, skb);
4393 break;
4394
9f69bda6
GP		 4395 case L2CAP_CID_LE_DATA:
4396 l2cap_att_channel(conn, cid, skb);
4397 break;
4398
b501d6a1
AB		 4399 case L2CAP_CID_SMP:
4400 if (smp_sig_channel(conn, skb))
4401 l2cap_conn_del(conn->hcon, EACCES);
4402 break;
4403
1da177e4
LT		 4404 default:
4405 l2cap_data_channel(conn, cid, skb);
4406 break;
4407 }
4408}
4409
4410/* ---- L2CAP interface with lower layer (HCI) ---- */
4411
4412static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4413{
4414 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4415 struct l2cap_chan *c;
1da177e4
LT		 4416
4417 if (type != ACL_LINK)
963cf687 4418 return -EINVAL;
1da177e4
LT		 4419
4420 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4421
4422 /* Find listening sockets and check their link_mode */
23691d75
GP		 4423 read_lock(&chan_list_lock);
4424 list_for_each_entry(c, &chan_list, global_l) {
4425 struct sock *sk = c->sk;
4343478f 4426
89bc500e 4427 if (c->state != BT_LISTEN)
1da177e4
LT		 4428 continue;
4429
4430 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4431 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4432 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4433 lm1 |= HCI_LM_MASTER;
1da177e4 4434 exact++;
2af6b9d5
MH		 4435 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4436 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4437 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4438 lm2 |= HCI_LM_MASTER;
4439 }
1da177e4 4440 }
23691d75 4441 read_unlock(&chan_list_lock);
1da177e4
LT		 4442
4443 return exact ? lm1 : lm2;
4444}
4445
4446static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
4447{
0139418c
MH		 4448 struct l2cap_conn *conn;
4449
1da177e4
LT		 4450 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4451
acd7d370 4452 if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
963cf687 4453 return -EINVAL;
1da177e4
LT		 4454
4455 if (!status) {
1da177e4
LT		 4456 conn = l2cap_conn_add(hcon, status);
4457 if (conn)
4458 l2cap_conn_ready(conn);
0139418c 4459 } else
e175072f 4460 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4461
4462 return 0;
4463}
4464
2950f21a
MH		 4465static int l2cap_disconn_ind(struct hci_conn *hcon)
4466{
4467 struct l2cap_conn *conn = hcon->l2cap_data;
4468
4469 BT_DBG("hcon %p", hcon);
4470
b5694506 4471 if ((hcon->type != ACL_LINK && hcon->type != LE_LINK) || !conn)
9f5a0d7b 4472 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4473
4474 return conn->disc_reason;
4475}
4476
4477static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4478{
4479 BT_DBG("hcon %p reason %d", hcon, reason);
4480
acd7d370 4481 if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK))
963cf687 4482 return -EINVAL;
1da177e4 4483
e175072f 4484 l2cap_conn_del(hcon, bt_to_errno(reason));
0139418c 4485
1da177e4
LT		 4486 return 0;
4487}
4488
4343478f 4489static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4490{
715ec005 4491 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4492 return;
4493
f62e4323 4494 if (encrypt == 0x00) {
4343478f 4495 if (chan->sec_level == BT_SECURITY_MEDIUM) {
c9b66675 4496 __clear_chan_timer(chan);
f3f668b0 4497 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4498 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4499 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4500 } else {
4343478f 4501 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4502 __clear_chan_timer(chan);
f62e4323
MH		 4503 }
4504}
4505
8c1b2355 4506static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4507{
0139418c 4508 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4509 struct l2cap_chan *chan;
1da177e4 4510
0139418c 4511 if (!conn)
1da177e4 4512 return 0;
0139418c 4513
1da177e4
LT		 4514 BT_DBG("conn %p", conn);
4515
160dc6ac
VCG		 4516 if (hcon->type == LE_LINK) {
4517 smp_distribute_keys(conn, 0);
4518 del_timer(&conn->security_timer);
4519 }
4520
baa7e1fa 4521 read_lock(&conn->chan_lock);
1da177e4 4522
baa7e1fa 4523 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 4524 struct sock *sk = chan->sk;
baa7e1fa 4525
1da177e4
LT		 4526 bh_lock_sock(sk);
4527
f1cb9af5
VCG		 4528 BT_DBG("chan->scid %d", chan->scid);
4529
4530 if (chan->scid == L2CAP_CID_LE_DATA) {
4531 if (!status && encrypt) {
4532 chan->sec_level = hcon->sec_level;
4533 l2cap_chan_ready(sk);
4534 }
4535
4536 bh_unlock_sock(sk);
4537 continue;
4538 }
4539
c1360a1c 4540 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6a8d3010
MH		 4541 bh_unlock_sock(sk);
4542 continue;
4543 }
4544
89bc500e
GP		 4545 if (!status && (chan->state == BT_CONNECTED ||
4546 chan->state == BT_CONFIG)) {
4343478f 4547 l2cap_check_encryption(chan, encrypt);
9719f8af
MH		 4548 bh_unlock_sock(sk);
4549 continue;
4550 }
4551
89bc500e 4552 if (chan->state == BT_CONNECT) {
b1235d79
MH		 4553 if (!status) {
4554 struct l2cap_conn_req req;
fe4128e0
GP		 4555 req.scid = cpu_to_le16(chan->scid);
4556 req.psm = chan->psm;
1da177e4 4557
fc7f8a7e 4558 chan->ident = l2cap_get_ident(conn);
c1360a1c 4559 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4 4560
fc7f8a7e 4561 l2cap_send_cmd(conn, chan->ident,
b1235d79
MH		 4562 L2CAP_CONN_REQ, sizeof(req), &req);
4563 } else {
c9b66675 4564 __clear_chan_timer(chan);
f3f668b0 4565 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4566 }
89bc500e 4567 } else if (chan->state == BT_CONNECT2) {
b1235d79 4568 struct l2cap_conn_rsp rsp;
df3c3931 4569 __u16 res, stat;
1da177e4 4570
b1235d79 4571 if (!status) {
df3c3931
JH		 4572 if (bt_sk(sk)->defer_setup) {
4573 struct sock *parent = bt_sk(sk)->parent;
4574 res = L2CAP_CR_PEND;
4575 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4576 if (parent)
4577 parent->sk_data_ready(parent, 0);
df3c3931 4578 } else {
05558911 4579 l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4580 res = L2CAP_CR_SUCCESS;
4581 stat = L2CAP_CS_NO_INFO;
4582 }
b1235d79 4583 } else {
89bc500e 4584 l2cap_state_change(chan, BT_DISCONN);
f3f668b0 4585 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4586 res = L2CAP_CR_SEC_BLOCK;
4587 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4588 }
4589
fe4128e0
GP		 4590 rsp.scid = cpu_to_le16(chan->dcid);
4591 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4592 rsp.result = cpu_to_le16(res);
4593 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4594 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4595 sizeof(rsp), &rsp);
b1235d79 4596 }
1da177e4
LT		 4597
4598 bh_unlock_sock(sk);
4599 }
4600
baa7e1fa 4601 read_unlock(&conn->chan_lock);
b1235d79 4602
1da177e4
LT		 4603 return 0;
4604}
4605
4606static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
4607{
4608 struct l2cap_conn *conn = hcon->l2cap_data;
4609
5a08ecce
AE		 4610 if (!conn)
4611 conn = l2cap_conn_add(hcon, 0);
4612
4613 if (!conn)
1da177e4
LT		 4614 goto drop;
4615
4616 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4617
e702112f 4618 if (!(flags & ACL_CONT)) {
1da177e4 4619 struct l2cap_hdr *hdr;
48454079 4620 struct l2cap_chan *chan;
89794813 4621 u16 cid;
1da177e4
LT		 4622 int len;
4623
4624 if (conn->rx_len) {
4625 BT_ERR("Unexpected start frame (len %d)", skb->len);
4626 kfree_skb(conn->rx_skb);
4627 conn->rx_skb = NULL;
4628 conn->rx_len = 0;
4629 l2cap_conn_unreliable(conn, ECOMM);
4630 }
4631
aae7fe22
AE		 4632 /* Start fragment always begin with Basic L2CAP header */
4633 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 4634 BT_ERR("Frame is too short (len %d)", skb->len);
4635 l2cap_conn_unreliable(conn, ECOMM);
4636 goto drop;
4637 }
4638
4639 hdr = (struct l2cap_hdr *) skb->data;
4640 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 4641 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 4642
4643 if (len == skb->len) {
4644 /* Complete frame received */
4645 l2cap_recv_frame(conn, skb);
4646 return 0;
4647 }
4648
4649 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
4650
4651 if (skb->len > len) {
4652 BT_ERR("Frame is too long (len %d, expected len %d)",
4653 skb->len, len);
4654 l2cap_conn_unreliable(conn, ECOMM);
4655 goto drop;
4656 }
4657
baa7e1fa 4658 chan = l2cap_get_chan_by_scid(conn, cid);
89794813 4659
48454079
GP		 4660 if (chan && chan->sk) {
4661 struct sock *sk = chan->sk;
89794813 4662
0c1bc5c6 4663 if (chan->imtu < len - L2CAP_HDR_SIZE) {
48454079
GP		 4664 BT_ERR("Frame exceeding recv MTU (len %d, "
4665 "MTU %d)", len,
0c1bc5c6 4666 chan->imtu);
48454079
GP		 4667 bh_unlock_sock(sk);
4668 l2cap_conn_unreliable(conn, ECOMM);
4669 goto drop;
4670 }
89794813 4671 bh_unlock_sock(sk);
48454079 4672 }
89794813 4673
1da177e4 4674 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 4675 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
4676 if (!conn->rx_skb)
1da177e4
LT		 4677 goto drop;
4678
d626f62b 4679 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4680 skb->len);
1da177e4
LT		 4681 conn->rx_len = len - skb->len;
4682 } else {
4683 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
4684
4685 if (!conn->rx_len) {
4686 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
4687 l2cap_conn_unreliable(conn, ECOMM);
4688 goto drop;
4689 }
4690
4691 if (skb->len > conn->rx_len) {
4692 BT_ERR("Fragment is too long (len %d, expected %d)",
4693 skb->len, conn->rx_len);
4694 kfree_skb(conn->rx_skb);
4695 conn->rx_skb = NULL;
4696 conn->rx_len = 0;
4697 l2cap_conn_unreliable(conn, ECOMM);
4698 goto drop;
4699 }
4700
d626f62b 4701 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4702 skb->len);
1da177e4
LT		 4703 conn->rx_len -= skb->len;
4704
4705 if (!conn->rx_len) {
4706 /* Complete frame received */
4707 l2cap_recv_frame(conn, conn->rx_skb);
4708 conn->rx_skb = NULL;
4709 }
4710 }
4711
4712drop:
4713 kfree_skb(skb);
4714 return 0;
4715}
4716
aef7d97c 4717static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 4718{
23691d75 4719 struct l2cap_chan *c;
1da177e4 4720
23691d75 4721 read_lock_bh(&chan_list_lock);
1da177e4 4722
23691d75
GP		 4723 list_for_each_entry(c, &chan_list, global_l) {
4724 struct sock *sk = c->sk;
101545f6 4725
903d343e 4726 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 4727 batostr(&bt_sk(sk)->src),
4728 batostr(&bt_sk(sk)->dst),
89bc500e 4729 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 4730 c->scid, c->dcid, c->imtu, c->omtu,
4731 c->sec_level, c->mode);
05558911 4732}
1da177e4 4733
23691d75 4734 read_unlock_bh(&chan_list_lock);
1da177e4 4735
aef7d97c 4736 return 0;
1da177e4
LT		 4737}
4738
aef7d97c
MH		 4739static int l2cap_debugfs_open(struct inode *inode, struct file *file)
4740{
4741 return single_open(file, l2cap_debugfs_show, inode->i_private);
4742}
4743
4744static const struct file_operations l2cap_debugfs_fops = {
4745 .open = l2cap_debugfs_open,
4746 .read = seq_read,
4747 .llseek = seq_lseek,
4748 .release = single_release,
4749};
4750
4751static struct dentry *l2cap_debugfs;
1da177e4 4752
1da177e4
LT		 4753static struct hci_proto l2cap_hci_proto = {
4754 .name = "L2CAP",
4755 .id = HCI_PROTO_L2CAP,
4756 .connect_ind = l2cap_connect_ind,
4757 .connect_cfm = l2cap_connect_cfm,
4758 .disconn_ind = l2cap_disconn_ind,
2950f21a 4759 .disconn_cfm = l2cap_disconn_cfm,
8c1b2355 4760 .security_cfm = l2cap_security_cfm,
1da177e4
LT		 4761 .recv_acldata = l2cap_recv_acldata
4762};
4763
64274518 4764int __init l2cap_init(void)
1da177e4
LT		 4765{
4766 int err;
be9d1227 4767
bb58f747 4768 err = l2cap_init_sockets();
1da177e4
LT		 4769 if (err < 0)
4770 return err;
4771
1da177e4
LT		 4772 err = hci_register_proto(&l2cap_hci_proto);
4773 if (err < 0) {
4774 BT_ERR("L2CAP protocol registration failed");
4775 bt_sock_unregister(BTPROTO_L2CAP);
4776 goto error;
4777 }
4778
aef7d97c
MH		 4779 if (bt_debugfs) {
4780 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
4781 bt_debugfs, NULL, &l2cap_debugfs_fops);
4782 if (!l2cap_debugfs)
4783 BT_ERR("Failed to create L2CAP debug file");
4784 }
1da177e4 4785
1da177e4
LT		 4786 return 0;
4787
4788error:
bb58f747 4789 l2cap_cleanup_sockets();
1da177e4
LT		 4790 return err;
4791}
4792
64274518 4793void l2cap_exit(void)
1da177e4 4794{
aef7d97c 4795 debugfs_remove(l2cap_debugfs);
1da177e4 4796
1da177e4
LT		 4797 if (hci_unregister_proto(&l2cap_hci_proto) < 0)
4798 BT_ERR("L2CAP protocol unregistration failed");
4799
bb58f747 4800 l2cap_cleanup_sockets();
1da177e4
LT		 4801}
4802
d1c4a17d
GP		 4803module_param(disable_ertm, bool, 0644);
4804MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)