projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove hlen variable
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
422e925b 7 Copyright (c) 2012 Code Aurora Forum. All rights reserved.
1da177e4
LT		 8
9 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License version 2 as
13 published by the Free Software Foundation;
14
15 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
16 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
18 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 19 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
20 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
21 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 22 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23
8e87d142
YH		 24 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
25 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 26 SOFTWARE IS DISCLAIMED.
27*/
28
bb58f747 29/* Bluetooth L2CAP core. */
1da177e4 30
1da177e4
LT		 31#include <linux/module.h>
32
33#include <linux/types.h>
4fc268d2 34#include <linux/capability.h>
1da177e4
LT		 35#include <linux/errno.h>
36#include <linux/kernel.h>
1da177e4
LT		 37#include <linux/sched.h>
38#include <linux/slab.h>
39#include <linux/poll.h>
40#include <linux/fcntl.h>
41#include <linux/init.h>
42#include <linux/interrupt.h>
43#include <linux/socket.h>
44#include <linux/skbuff.h>
1da177e4 45#include <linux/list.h>
be9d1227 46#include <linux/device.h>
aef7d97c
MH		 47#include <linux/debugfs.h>
48#include <linux/seq_file.h>
af05b30b 49#include <linux/uaccess.h>
fcc203c3 50#include <linux/crc16.h>
1da177e4
LT		 51#include <net/sock.h>
52
1da177e4
LT		 53#include <asm/unaligned.h>
54
55#include <net/bluetooth/bluetooth.h>
56#include <net/bluetooth/hci_core.h>
57#include <net/bluetooth/l2cap.h>
b501d6a1 58#include <net/bluetooth/smp.h>
1da177e4 59
eb939922 60bool disable_ertm;
f0709e03 61
47ec1dcd 62static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 63static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 64
b5ad8b7f
JB		 65static LIST_HEAD(chan_list);
66static DEFINE_RWLOCK(chan_list_lock);
1da177e4 67
1da177e4
LT		 68static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
69 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 70static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
71 void *data);
710f9b0a 72static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a
GP		 73static void l2cap_send_disconn_req(struct l2cap_conn *conn,
74 struct l2cap_chan *chan, int err);
1da177e4 75
0139418c 76/* ---- L2CAP channels ---- */
71ba0e56 77
baa7e1fa 78static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 79{
3df91ea2 80 struct l2cap_chan *c;
3d57dc68 81
3df91ea2
AE		 82 list_for_each_entry(c, &conn->chan_l, list) {
83 if (c->dcid == cid)
84 return c;
0139418c 85 }
3df91ea2 86 return NULL;
0139418c
MH		 87}
88
baa7e1fa 89static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 90{
3df91ea2 91 struct l2cap_chan *c;
3d57dc68 92
3df91ea2
AE		 93 list_for_each_entry(c, &conn->chan_l, list) {
94 if (c->scid == cid)
95 return c;
0139418c 96 }
3df91ea2 97 return NULL;
0139418c
MH		 98}
99
100/* Find channel with given SCID.
101 * Returns locked socket */
baa7e1fa 102static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 103{
48454079 104 struct l2cap_chan *c;
baa7e1fa 105
3df91ea2 106 mutex_lock(&conn->chan_lock);
baa7e1fa 107 c = __l2cap_get_chan_by_scid(conn, cid);
3df91ea2
AE		 108 mutex_unlock(&conn->chan_lock);
109
48454079 110 return c;
0139418c
MH		 111}
112
baa7e1fa 113static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 114{
3df91ea2 115 struct l2cap_chan *c;
3d57dc68 116
3df91ea2
AE		 117 list_for_each_entry(c, &conn->chan_l, list) {
118 if (c->ident == ident)
119 return c;
0139418c 120 }
3df91ea2 121 return NULL;
0139418c
MH		 122}
123
23691d75 124static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 125{
23691d75 126 struct l2cap_chan *c;
9e4425ff 127
23691d75
GP		 128 list_for_each_entry(c, &chan_list, global_l) {
129 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 130 return c;
9e4425ff 131 }
250938cb 132 return NULL;
9e4425ff
GP		 133}
134
135int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
136{
73b2ec18
GP		 137 int err;
138
333055f2 139 write_lock(&chan_list_lock);
9e4425ff 140
23691d75 141 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 142 err = -EADDRINUSE;
143 goto done;
9e4425ff
GP		 144 }
145
73b2ec18
GP		 146 if (psm) {
147 chan->psm = psm;
148 chan->sport = psm;
149 err = 0;
150 } else {
151 u16 p;
152
153 err = -EINVAL;
154 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 155 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 156 chan->psm = cpu_to_le16(p);
157 chan->sport = cpu_to_le16(p);
158 err = 0;
159 break;
160 }
161 }
9e4425ff 162
73b2ec18 163done:
333055f2 164 write_unlock(&chan_list_lock);
73b2ec18 165 return err;
9e4425ff
GP		 166}
167
168int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
169{
333055f2 170 write_lock(&chan_list_lock);
9e4425ff
GP		 171
172 chan->scid = scid;
173
333055f2 174 write_unlock(&chan_list_lock);
9e4425ff
GP		 175
176 return 0;
177}
178
baa7e1fa 179static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 180{
8db4dc46 181 u16 cid = L2CAP_CID_DYN_START;
0139418c 182
8db4dc46 183 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 184 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 185 return cid;
186 }
187
188 return 0;
189}
190
0e587be7 191static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 192{
42d2d87c 193 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 194 state_to_string(state));
195
89bc500e
GP		 196 chan->state = state;
197 chan->ops->state_change(chan->data, state);
198}
199
0e587be7
AE		 200static void l2cap_state_change(struct l2cap_chan *chan, int state)
201{
202 struct sock *sk = chan->sk;
203
204 lock_sock(sk);
205 __l2cap_state_change(chan, state);
206 release_sock(sk);
207}
208
2e0052e4
AE		 209static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
210{
211 struct sock *sk = chan->sk;
212
213 sk->sk_err = err;
214}
215
216static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
217{
218 struct sock *sk = chan->sk;
219
220 lock_sock(sk);
221 __l2cap_chan_set_err(chan, err);
222 release_sock(sk);
223}
224
3c588192
MM		 225/* ---- L2CAP sequence number lists ---- */
226
227/* For ERTM, ordered lists of sequence numbers must be tracked for
228 * SREJ requests that are received and for frames that are to be
229 * retransmitted. These seq_list functions implement a singly-linked
230 * list in an array, where membership in the list can also be checked
231 * in constant time. Items can also be added to the tail of the list
232 * and removed from the head in constant time, without further memory
233 * allocs or frees.
234 */
235
236static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
237{
238 size_t alloc_size, i;
239
240 /* Allocated size is a power of 2 to map sequence numbers
241 * (which may be up to 14 bits) in to a smaller array that is
242 * sized for the negotiated ERTM transmit windows.
243 */
244 alloc_size = roundup_pow_of_two(size);
245
246 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
247 if (!seq_list->list)
248 return -ENOMEM;
249
250 seq_list->mask = alloc_size - 1;
251 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
252 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
253 for (i = 0; i < alloc_size; i++)
254 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
255
256 return 0;
257}
258
259static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
260{
261 kfree(seq_list->list);
262}
263
264static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
265 u16 seq)
266{
267 /* Constant-time check for list membership */
268 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
269}
270
271static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
272{
273 u16 mask = seq_list->mask;
274
275 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
276 /* In case someone tries to pop the head of an empty list */
277 return L2CAP_SEQ_LIST_CLEAR;
278 } else if (seq_list->head == seq) {
279 /* Head can be removed in constant time */
280 seq_list->head = seq_list->list[seq & mask];
281 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
282
283 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
284 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
285 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
286 }
287 } else {
288 /* Walk the list to find the sequence number */
289 u16 prev = seq_list->head;
290 while (seq_list->list[prev & mask] != seq) {
291 prev = seq_list->list[prev & mask];
292 if (prev == L2CAP_SEQ_LIST_TAIL)
293 return L2CAP_SEQ_LIST_CLEAR;
294 }
295
296 /* Unlink the number from the list and clear it */
297 seq_list->list[prev & mask] = seq_list->list[seq & mask];
298 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
299 if (seq_list->tail == seq)
300 seq_list->tail = prev;
301 }
302 return seq;
303}
304
305static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
306{
307 /* Remove the head in constant time */
308 return l2cap_seq_list_remove(seq_list, seq_list->head);
309}
310
311static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
312{
313 if (seq_list->head != L2CAP_SEQ_LIST_CLEAR) {
314 u16 i;
315 for (i = 0; i <= seq_list->mask; i++)
316 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
317
318 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
319 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
320 }
321}
322
323static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
324{
325 u16 mask = seq_list->mask;
326
327 /* All appends happen in constant time */
328
329 if (seq_list->list[seq & mask] == L2CAP_SEQ_LIST_CLEAR) {
330 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
331 seq_list->head = seq;
332 else
333 seq_list->list[seq_list->tail & mask] = seq;
334
335 seq_list->tail = seq;
336 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
337 }
338}
339
721c4181 340static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 341{
721c4181
GP		 342 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
343 chan_timer.work);
3df91ea2 344 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 345 int reason;
346
e05dcc32 347 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 348
3df91ea2 349 mutex_lock(&conn->chan_lock);
6be36555 350 l2cap_chan_lock(chan);
ab07801d 351
89bc500e 352 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 353 reason = ECONNREFUSED;
89bc500e 354 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 355 chan->sec_level != BT_SECURITY_SDP)
356 reason = ECONNREFUSED;
357 else
358 reason = ETIMEDOUT;
359
0f852724 360 l2cap_chan_close(chan, reason);
ab07801d 361
6be36555 362 l2cap_chan_unlock(chan);
ab07801d 363
ba3bd0ee 364 chan->ops->close(chan->data);
3df91ea2
AE		 365 mutex_unlock(&conn->chan_lock);
366
371fd835 367 l2cap_chan_put(chan);
ab07801d
GP		 368}
369
eef1d9b6 370struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 371{
372 struct l2cap_chan *chan;
373
374 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
375 if (!chan)
376 return NULL;
377
c03b355e
AE		 378 mutex_init(&chan->lock);
379
333055f2 380 write_lock(&chan_list_lock);
23691d75 381 list_add(&chan->global_l, &chan_list);
333055f2 382 write_unlock(&chan_list_lock);
23691d75 383
721c4181 384 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 385
89bc500e
GP		 386 chan->state = BT_OPEN;
387
71ba0e56
GP		 388 atomic_set(&chan->refcnt, 1);
389
eef1d9b6 390 BT_DBG("chan %p", chan);
abc545b8 391
48454079
GP		 392 return chan;
393}
394
23691d75 395void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 396{
333055f2 397 write_lock(&chan_list_lock);
23691d75 398 list_del(&chan->global_l);
333055f2 399 write_unlock(&chan_list_lock);
23691d75 400
371fd835 401 l2cap_chan_put(chan);
6ff5abbf
GP		 402}
403
bd4b1653
AE		 404void l2cap_chan_set_defaults(struct l2cap_chan *chan)
405{
406 chan->fcs = L2CAP_FCS_CRC16;
407 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
408 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
409 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
410 chan->sec_level = BT_SECURITY_LOW;
411
412 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
413}
414
14a28491 415static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 416{
af05b30b 417 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 418 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 419
9f5a0d7b 420 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 421
8c1d787b 422 chan->conn = conn;
0139418c 423
5491120e
AE		 424 switch (chan->chan_type) {
425 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 426 if (conn->hcon->type == LE_LINK) {
427 /* LE connection */
0c1bc5c6 428 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 429 chan->scid = L2CAP_CID_LE_DATA;
430 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 431 } else {
432 /* Alloc CID for connection-oriented socket */
fe4128e0 433 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 434 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 435 }
5491120e
AE		 436 break;
437
438 case L2CAP_CHAN_CONN_LESS:
0139418c 439 /* Connectionless socket */
fe4128e0
GP		 440 chan->scid = L2CAP_CID_CONN_LESS;
441 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 442 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 443 break;
444
445 default:
0139418c 446 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 447 chan->scid = L2CAP_CID_SIGNALING;
448 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 449 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 450 }
451
8f7975b1
AE		 452 chan->local_id = L2CAP_BESTEFFORT_ID;
453 chan->local_stype = L2CAP_SERV_BESTEFFORT;
454 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
455 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
456 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
457 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
458
371fd835 459 l2cap_chan_hold(chan);
baa7e1fa 460
3df91ea2 461 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 462}
463
14a28491 464static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 465{
466 mutex_lock(&conn->chan_lock);
467 __l2cap_chan_add(conn, chan);
3df91ea2 468 mutex_unlock(&conn->chan_lock);
0139418c
MH		 469}
470
4519de9a 471static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 472{
48454079 473 struct sock *sk = chan->sk;
8c1d787b 474 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 475 struct sock *parent = bt_sk(sk)->parent;
476
c9b66675 477 __clear_chan_timer(chan);
0139418c 478
49208c9c 479 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 480
8e87d142 481 if (conn) {
baa7e1fa 482 /* Delete from channel list */
3df91ea2 483 list_del(&chan->list);
3d57dc68 484
371fd835 485 l2cap_chan_put(chan);
baa7e1fa 486
8c1d787b 487 chan->conn = NULL;
0139418c
MH		 488 hci_conn_put(conn->hcon);
489 }
490
6be36555
AE		 491 lock_sock(sk);
492
0e587be7 493 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 494 sock_set_flag(sk, SOCK_ZAPPED);
495
496 if (err)
2e0052e4 497 __l2cap_chan_set_err(chan, err);
0139418c
MH		 498
499 if (parent) {
500 bt_accept_unlink(sk);
501 parent->sk_data_ready(parent, 0);
502 } else
503 sk->sk_state_change(sk);
c13ffa62 504
6be36555
AE		 505 release_sock(sk);
506
c1360a1c
GP		 507 if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
508 test_bit(CONF_INPUT_DONE, &chan->conf_state)))
6ff5abbf 509 return;
2ead70b8 510
58d35f87 511 skb_queue_purge(&chan->tx_q);
c13ffa62 512
0c1bc5c6 513 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 514 struct srej_list *l, *tmp;
515
1a09bcb9
GP		 516 __clear_retrans_timer(chan);
517 __clear_monitor_timer(chan);
518 __clear_ack_timer(chan);
c13ffa62 519
f1c6775b 520 skb_queue_purge(&chan->srej_q);
c13ffa62 521
3c588192
MM		 522 l2cap_seq_list_free(&chan->srej_list);
523 l2cap_seq_list_free(&chan->retrans_list);
39d5a3ee 524 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 525 list_del(&l->list);
526 kfree(l);
527 }
528 }
0139418c
MH		 529}
530
4519de9a
GP		 531static void l2cap_chan_cleanup_listen(struct sock *parent)
532{
533 struct sock *sk;
534
535 BT_DBG("parent %p", parent);
536
537 /* Close not yet accepted channels */
0f852724 538 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 539 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 540
6be36555 541 l2cap_chan_lock(chan);
c9b66675 542 __clear_chan_timer(chan);
ba3bd0ee 543 l2cap_chan_close(chan, ECONNRESET);
6be36555 544 l2cap_chan_unlock(chan);
3df91ea2 545
ba3bd0ee 546 chan->ops->close(chan->data);
0f852724 547 }
4519de9a
GP		 548}
549
0f852724 550void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 551{
552 struct l2cap_conn *conn = chan->conn;
553 struct sock *sk = chan->sk;
554
e05dcc32
AE		 555 BT_DBG("chan %p state %s sk %p", chan,
556 state_to_string(chan->state), sk);
4519de9a 557
89bc500e 558 switch (chan->state) {
4519de9a 559 case BT_LISTEN:
6be36555 560 lock_sock(sk);
4519de9a 561 l2cap_chan_cleanup_listen(sk);
89bc500e 562
0e587be7 563 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 564 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 565 release_sock(sk);
4519de9a
GP		 566 break;
567
568 case BT_CONNECTED:
569 case BT_CONFIG:
715ec005 570 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 571 conn->hcon->type == ACL_LINK) {
c9b66675 572 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 573 l2cap_send_disconn_req(conn, chan, reason);
574 } else
575 l2cap_chan_del(chan, reason);
576 break;
577
578 case BT_CONNECT2:
715ec005 579 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 580 conn->hcon->type == ACL_LINK) {
581 struct l2cap_conn_rsp rsp;
582 __u16 result;
583
584 if (bt_sk(sk)->defer_setup)
585 result = L2CAP_CR_SEC_BLOCK;
586 else
587 result = L2CAP_CR_BAD_PSM;
89bc500e 588 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 589
590 rsp.scid = cpu_to_le16(chan->dcid);
591 rsp.dcid = cpu_to_le16(chan->scid);
592 rsp.result = cpu_to_le16(result);
593 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
594 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
595 sizeof(rsp), &rsp);
596 }
597
598 l2cap_chan_del(chan, reason);
599 break;
600
601 case BT_CONNECT:
602 case BT_DISCONN:
603 l2cap_chan_del(chan, reason);
604 break;
605
606 default:
6be36555 607 lock_sock(sk);
4519de9a 608 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 609 release_sock(sk);
4519de9a
GP		 610 break;
611 }
612}
613
4343478f 614static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 615{
715ec005 616 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 617 switch (chan->sec_level) {
8556edd3
JH		 618 case BT_SECURITY_HIGH:
619 return HCI_AT_DEDICATED_BONDING_MITM;
620 case BT_SECURITY_MEDIUM:
621 return HCI_AT_DEDICATED_BONDING;
622 default:
623 return HCI_AT_NO_BONDING;
624 }
fe4128e0 625 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 626 if (chan->sec_level == BT_SECURITY_LOW)
627 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 628
4343478f 629 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 630 return HCI_AT_NO_BONDING_MITM;
00ae4af9 631 else
8556edd3 632 return HCI_AT_NO_BONDING;
00ae4af9 633 } else {
4343478f 634 switch (chan->sec_level) {
00ae4af9 635 case BT_SECURITY_HIGH:
8556edd3 636 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 637 case BT_SECURITY_MEDIUM:
8556edd3 638 return HCI_AT_GENERAL_BONDING;
00ae4af9 639 default:
8556edd3 640 return HCI_AT_NO_BONDING;
00ae4af9 641 }
0684e5f9 642 }
8556edd3
JH		 643}
644
645/* Service level security */
d45fc423 646int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 647{
8c1d787b 648 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 649 __u8 auth_type;
650
4343478f 651 auth_type = l2cap_get_auth_type(chan);
79d554a6 652
4343478f 653 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 654}
655
b5ad8b7f 656static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 657{
658 u8 id;
659
660 /* Get next available identificator.
661 * 1 - 128 are used by kernel.
662 * 129 - 199 are reserved.
663 * 200 - 254 are used by utilities like l2ping, etc.
664 */
665
333055f2 666 spin_lock(&conn->lock);
4e8402a3
MH		 667
668 if (++conn->tx_ident > 128)
669 conn->tx_ident = 1;
670
671 id = conn->tx_ident;
672
333055f2 673 spin_unlock(&conn->lock);
4e8402a3
MH		 674
675 return id;
676}
677
4519de9a 678static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 679{
680 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 681 u8 flags;
4e8402a3
MH		 682
683 BT_DBG("code 0x%2.2x", code);
684
685 if (!skb)
9a9c6a34 686 return;
4e8402a3 687
e702112f
AE		 688 if (lmp_no_flush_capable(conn->hcon->hdev))
689 flags = ACL_START_NO_FLUSH;
690 else
691 flags = ACL_START;
692
14b12d0b 693 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 694 skb->priority = HCI_PRIO_MAX;
14b12d0b 695
73d80deb
LAD		 696 hci_send_acl(conn->hchan, skb, flags);
697}
698
699static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
700{
701 struct hci_conn *hcon = chan->conn->hcon;
702 u16 flags;
703
704 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
705 skb->priority);
706
707 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
708 lmp_no_flush_capable(hcon->hdev))
709 flags = ACL_START_NO_FLUSH;
710 else
711 flags = ACL_START;
14b12d0b 712
73d80deb
LAD		 713 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
714 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 715}
716
b76bbd66
MM		 717static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
718{
719 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
720 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
721
722 if (enh & L2CAP_CTRL_FRAME_TYPE) {
723 /* S-Frame */
724 control->sframe = 1;
725 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
726 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
727
728 control->sar = 0;
729 control->txseq = 0;
730 } else {
731 /* I-Frame */
732 control->sframe = 0;
733 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
734 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
735
736 control->poll = 0;
737 control->super = 0;
738 }
739}
740
b76bbd66
MM		 741static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
742{
743 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
744 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
745
746 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
747 /* S-Frame */
748 control->sframe = 1;
749 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
750 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
751
752 control->sar = 0;
753 control->txseq = 0;
754 } else {
755 /* I-Frame */
756 control->sframe = 0;
757 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
758 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
759
760 control->poll = 0;
761 control->super = 0;
762 }
763}
764
765static inline void __unpack_control(struct l2cap_chan *chan,
766 struct sk_buff *skb)
767{
768 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
769 __unpack_extended_control(get_unaligned_le32(skb->data),
770 &bt_cb(skb)->control);
771 } else {
772 __unpack_enhanced_control(get_unaligned_le16(skb->data),
773 &bt_cb(skb)->control);
774 }
775}
776
b5c6aaed
MM		 777static u32 __pack_extended_control(struct l2cap_ctrl *control)
778{
779 u32 packed;
780
781 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
782 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
783
784 if (control->sframe) {
785 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
786 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
787 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
788 } else {
789 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
790 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
791 }
792
793 return packed;
794}
795
796static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
797{
798 u16 packed;
799
800 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
801 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
802
803 if (control->sframe) {
804 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
805 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
806 packed |= L2CAP_CTRL_FRAME_TYPE;
807 } else {
808 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
809 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
810 }
811
812 return packed;
813}
814
b76bbd66
MM		 815static inline void __pack_control(struct l2cap_chan *chan,
816 struct l2cap_ctrl *control,
817 struct sk_buff *skb)
818{
819 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
820 put_unaligned_le32(__pack_extended_control(control),
821 skb->data + L2CAP_HDR_SIZE);
822 } else {
823 put_unaligned_le16(__pack_enhanced_control(control),
824 skb->data + L2CAP_HDR_SIZE);
825 }
826}
827
b5c6aaed
MM		 828static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
829{
830 struct sk_buff *skb;
831 struct l2cap_hdr *lh;
832 struct l2cap_conn *conn = chan->conn;
833 int count, hlen;
834
835 if (chan->state != BT_CONNECTED)
836 return;
837
838 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
839 hlen = L2CAP_EXT_HDR_SIZE;
840 else
841 hlen = L2CAP_ENH_HDR_SIZE;
842
843 if (chan->fcs == L2CAP_FCS_CRC16)
844 hlen += L2CAP_FCS_SIZE;
845
846 BT_DBG("chan %p, control 0x%8.8x", chan, control);
847
848 count = min_t(unsigned int, conn->mtu, hlen);
849
850 control |= __set_sframe(chan);
851
852 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
853 control |= __set_ctrl_final(chan);
854
855 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
856 control |= __set_ctrl_poll(chan);
857
858 skb = bt_skb_alloc(count, GFP_ATOMIC);
859 if (!skb)
860 return;
861
862 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
863 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
864 lh->cid = cpu_to_le16(chan->dcid);
865
866 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
867
868 if (chan->fcs == L2CAP_FCS_CRC16) {
869 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
870 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
871 }
872
873 skb->priority = HCI_PRIO_MAX;
874 l2cap_do_send(chan, skb);
875}
876
877static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
878{
879 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
880 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
881 set_bit(CONN_RNR_SENT, &chan->conn_state);
882 } else
883 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
884
885 control |= __set_reqseq(chan, chan->buffer_seq);
886
887 l2cap_send_sframe(chan, control);
888}
889
b4450035 890static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 891{
c1360a1c 892 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 893}
894
9b27f350
AE		 895static void l2cap_send_conn_req(struct l2cap_chan *chan)
896{
897 struct l2cap_conn *conn = chan->conn;
898 struct l2cap_conn_req req;
899
900 req.scid = cpu_to_le16(chan->scid);
901 req.psm = chan->psm;
902
903 chan->ident = l2cap_get_ident(conn);
904
905 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
906
907 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
908}
909
9f0caeb1
VCG		 910static void l2cap_chan_ready(struct l2cap_chan *chan)
911{
912 struct sock *sk = chan->sk;
913 struct sock *parent;
914
915 lock_sock(sk);
916
917 parent = bt_sk(sk)->parent;
918
919 BT_DBG("sk %p, parent %p", sk, parent);
920
921 chan->conf_state = 0;
922 __clear_chan_timer(chan);
923
924 __l2cap_state_change(chan, BT_CONNECTED);
925 sk->sk_state_change(sk);
926
927 if (parent)
928 parent->sk_data_ready(parent, 0);
929
930 release_sock(sk);
931}
932
fc7f8a7e 933static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 934{
8c1d787b 935 struct l2cap_conn *conn = chan->conn;
79d554a6 936
9f0caeb1
VCG		 937 if (conn->hcon->type == LE_LINK) {
938 l2cap_chan_ready(chan);
939 return;
940 }
941
79d554a6 942 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 943 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
944 return;
945
d45fc423 946 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 947 __l2cap_no_conn_pending(chan))
948 l2cap_send_conn_req(chan);
79d554a6
MH		 949 } else {
950 struct l2cap_info_req req;
951 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
952
953 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
954 conn->info_ident = l2cap_get_ident(conn);
955
ba13ccd9 956 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 957
958 l2cap_send_cmd(conn, conn->info_ident,
959 L2CAP_INFO_REQ, sizeof(req), &req);
960 }
961}
962
cf6c2c0b
GP		 963static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
964{
965 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 966 if (!disable_ertm)
cf6c2c0b
GP		 967 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
968
969 switch (mode) {
970 case L2CAP_MODE_ERTM:
971 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
972 case L2CAP_MODE_STREAMING:
973 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
974 default:
975 return 0x00;
976 }
977}
978
4519de9a 979static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 980{
6be36555 981 struct sock *sk = chan->sk;
22121fc9
GP		 982 struct l2cap_disconn_req req;
983
c13ffa62
GP		 984 if (!conn)
985 return;
986
0c1bc5c6 987 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 988 __clear_retrans_timer(chan);
989 __clear_monitor_timer(chan);
990 __clear_ack_timer(chan);
c13ffa62
GP		 991 }
992
fe4128e0
GP		 993 req.dcid = cpu_to_le16(chan->dcid);
994 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 995 l2cap_send_cmd(conn, l2cap_get_ident(conn),
996 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 997
6be36555 998 lock_sock(sk);
0e587be7 999 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 1000 __l2cap_chan_set_err(chan, err);
6be36555 1001 release_sock(sk);
22121fc9
GP		 1002}
1003
1da177e4 1004/* ---- L2CAP connections ---- */
4e8402a3
MH		 1005static void l2cap_conn_start(struct l2cap_conn *conn)
1006{
3df91ea2 1007 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 1008
1009 BT_DBG("conn %p", conn);
1010
3df91ea2 1011 mutex_lock(&conn->chan_lock);
4e8402a3 1012
3df91ea2 1013 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 1014 struct sock *sk = chan->sk;
baa7e1fa 1015
6be36555 1016 l2cap_chan_lock(chan);
4e8402a3 1017
715ec005 1018 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1019 l2cap_chan_unlock(chan);
79d554a6
MH		 1020 continue;
1021 }
1022
89bc500e 1023 if (chan->state == BT_CONNECT) {
d45fc423 1024 if (!l2cap_chan_check_security(chan) ||
b4450035 1025 !__l2cap_no_conn_pending(chan)) {
6be36555 1026 l2cap_chan_unlock(chan);
47731de7
GP		 1027 continue;
1028 }
79d554a6 1029
c1360a1c
GP		 1030 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1031 && test_bit(CONF_STATE2_DEVICE,
1032 &chan->conf_state)) {
89bc500e 1033 l2cap_chan_close(chan, ECONNRESET);
6be36555 1034 l2cap_chan_unlock(chan);
47731de7 1035 continue;
b1235d79 1036 }
47731de7 1037
9b27f350 1038 l2cap_send_conn_req(chan);
47731de7 1039
89bc500e 1040 } else if (chan->state == BT_CONNECT2) {
79d554a6 1041 struct l2cap_conn_rsp rsp;
e9aeb2dd 1042 char buf[128];
fe4128e0
GP		 1043 rsp.scid = cpu_to_le16(chan->dcid);
1044 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1045
d45fc423 1046 if (l2cap_chan_check_security(chan)) {
6be36555 1047 lock_sock(sk);
f66dc81f
MH		 1048 if (bt_sk(sk)->defer_setup) {
1049 struct sock *parent = bt_sk(sk)->parent;
1050 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1051 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 1052 if (parent)
1053 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 1054
1055 } else {
0e587be7 1056 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 1057 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1058 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1059 }
6be36555 1060 release_sock(sk);
79d554a6
MH		 1061 } else {
1062 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1063 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1064 }
1065
fc7f8a7e
GP		 1066 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1067 sizeof(rsp), &rsp);
e9aeb2dd 1068
c1360a1c 1069 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 1070 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1071 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1072 continue;
1073 }
1074
c1360a1c 1075 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1076 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 1077 l2cap_build_conf_req(chan, buf), buf);
1078 chan->num_conf_req++;
4e8402a3
MH		 1079 }
1080
6be36555 1081 l2cap_chan_unlock(chan);
4e8402a3
MH		 1082 }
1083
3df91ea2 1084 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1085}
1086
c2287681 1087/* Find socket with cid and source/destination bdaddr.
b62f328b
VT		 1088 * Returns closest match, locked.
1089 */
d9b88702 1090static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
c2287681
IY		 1091 bdaddr_t *src,
1092 bdaddr_t *dst)
b62f328b 1093{
23691d75 1094 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1095
23691d75 1096 read_lock(&chan_list_lock);
b62f328b 1097
23691d75
GP		 1098 list_for_each_entry(c, &chan_list, global_l) {
1099 struct sock *sk = c->sk;
fe4128e0 1100
89bc500e 1101 if (state && c->state != state)
b62f328b
VT		 1102 continue;
1103
23691d75 1104 if (c->scid == cid) {
c2287681
IY		 1105 int src_match, dst_match;
1106 int src_any, dst_any;
1107
b62f328b 1108 /* Exact match. */
c2287681
IY		 1109 src_match = !bacmp(&bt_sk(sk)->src, src);
1110 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1111 if (src_match && dst_match) {
23691d75
GP		 1112 read_unlock(&chan_list_lock);
1113 return c;
1114 }
b62f328b
VT		 1115
1116 /* Closest match */
c2287681
IY		 1117 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1118 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1119 if ((src_match && dst_any) || (src_any && dst_match) ||
1120 (src_any && dst_any))
23691d75 1121 c1 = c;
b62f328b
VT		 1122 }
1123 }
280f294f 1124
23691d75 1125 read_unlock(&chan_list_lock);
b62f328b 1126
23691d75 1127 return c1;
b62f328b
VT		 1128}
1129
1130static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1131{
c916fbe4 1132 struct sock *parent, *sk;
23691d75 1133 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1134
1135 BT_DBG("");
1136
1137 /* Check if we have socket listening on cid */
23691d75 1138 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
c2287681 1139 conn->src, conn->dst);
23691d75 1140 if (!pchan)
b62f328b
VT		 1141 return;
1142
23691d75
GP		 1143 parent = pchan->sk;
1144
aa2ac881 1145 lock_sock(parent);
62f3a2cf 1146
b62f328b
VT		 1147 /* Check for backlog size */
1148 if (sk_acceptq_is_full(parent)) {
1149 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1150 goto clean;
1151 }
1152
80808e43
GP		 1153 chan = pchan->ops->new_connection(pchan->data);
1154 if (!chan)
b62f328b
VT		 1155 goto clean;
1156
80808e43 1157 sk = chan->sk;
5d41ce1d 1158
b62f328b
VT		 1159 hci_conn_hold(conn->hcon);
1160
b62f328b
VT		 1161 bacpy(&bt_sk(sk)->src, conn->src);
1162 bacpy(&bt_sk(sk)->dst, conn->dst);
1163
d1010240
GP		 1164 bt_accept_enqueue(parent, sk);
1165
3d57dc68 1166 l2cap_chan_add(conn, chan);
48454079 1167
c9b66675 1168 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 1169
0e587be7 1170 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 1171 parent->sk_data_ready(parent, 0);
1172
b62f328b 1173clean:
aa2ac881 1174 release_sock(parent);
b62f328b
VT		 1175}
1176
4e8402a3
MH		 1177static void l2cap_conn_ready(struct l2cap_conn *conn)
1178{
48454079 1179 struct l2cap_chan *chan;
4e8402a3 1180
79d554a6 1181 BT_DBG("conn %p", conn);
4e8402a3 1182
b62f328b
VT		 1183 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
1184 l2cap_le_conn_ready(conn);
1185
160dc6ac
VCG		 1186 if (conn->hcon->out && conn->hcon->type == LE_LINK)
1187 smp_conn_security(conn, conn->hcon->pending_sec_level);
1188
3df91ea2 1189 mutex_lock(&conn->chan_lock);
4e8402a3 1190
3df91ea2 1191 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1192
6be36555 1193 l2cap_chan_lock(chan);
4e8402a3 1194
63128451 1195 if (conn->hcon->type == LE_LINK) {
b501d6a1 1196 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 1197 l2cap_chan_ready(chan);
acd7d370 1198
63128451 1199 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1200 struct sock *sk = chan->sk;
c9b66675 1201 __clear_chan_timer(chan);
6be36555 1202 lock_sock(sk);
0e587be7 1203 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1204 sk->sk_state_change(sk);
6be36555 1205 release_sock(sk);
b501d6a1 1206
89bc500e 1207 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1208 l2cap_do_start(chan);
4e8402a3 1209
6be36555 1210 l2cap_chan_unlock(chan);
4e8402a3 1211 }
79d554a6 1212
3df91ea2 1213 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1214}
1215
1216/* Notify sockets that we cannot guaranty reliability anymore */
1217static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1218{
48454079 1219 struct l2cap_chan *chan;
4e8402a3
MH		 1220
1221 BT_DBG("conn %p", conn);
1222
3df91ea2 1223 mutex_lock(&conn->chan_lock);
4e8402a3 1224
3df91ea2 1225 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1226 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 1227 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1228 }
1229
3df91ea2 1230 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1231}
1232
f878fcad 1233static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1234{
f878fcad 1235 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 1236 info_timer.work);
4e8402a3 1237
984947dc 1238 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1239 conn->info_ident = 0;
984947dc 1240
4e8402a3
MH		 1241 l2cap_conn_start(conn);
1242}
1243
5d3de7df
VCG		 1244static void l2cap_conn_del(struct hci_conn *hcon, int err)
1245{
1246 struct l2cap_conn *conn = hcon->l2cap_data;
1247 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1248
1249 if (!conn)
1250 return;
1251
1252 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1253
1254 kfree_skb(conn->rx_skb);
1255
3df91ea2
AE		 1256 mutex_lock(&conn->chan_lock);
1257
5d3de7df
VCG		 1258 /* Kill channels */
1259 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
61d6ef3e 1260 l2cap_chan_hold(chan);
6be36555
AE		 1261 l2cap_chan_lock(chan);
1262
5d3de7df 1263 l2cap_chan_del(chan, err);
6be36555
AE		 1264
1265 l2cap_chan_unlock(chan);
1266
5d3de7df 1267 chan->ops->close(chan->data);
61d6ef3e 1268 l2cap_chan_put(chan);
5d3de7df
VCG		 1269 }
1270
3df91ea2
AE		 1271 mutex_unlock(&conn->chan_lock);
1272
73d80deb
LAD		 1273 hci_chan_del(conn->hchan);
1274
5d3de7df 1275 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1276 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1277
51a8efd7 1278 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1279 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1280 smp_chan_destroy(conn);
d26a2345 1281 }
5d3de7df
VCG		 1282
1283 hcon->l2cap_data = NULL;
1284 kfree(conn);
1285}
1286
6c9d42a1 1287static void security_timeout(struct work_struct *work)
5d3de7df 1288{
6c9d42a1
GP		 1289 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1290 security_timer.work);
5d3de7df
VCG		 1291
1292 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1293}
1294
1da177e4
LT		 1295static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1296{
0139418c 1297 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1298 struct hci_chan *hchan;
1da177e4 1299
0139418c 1300 if (conn || status)
1da177e4
LT		 1301 return conn;
1302
73d80deb
LAD		 1303 hchan = hci_chan_create(hcon);
1304 if (!hchan)
1305 return NULL;
1306
0139418c 1307 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1308 if (!conn) {
1309 hci_chan_del(hchan);
1da177e4 1310 return NULL;
73d80deb 1311 }
1da177e4
LT		 1312
1313 hcon->l2cap_data = conn;
1314 conn->hcon = hcon;
73d80deb 1315 conn->hchan = hchan;
1da177e4 1316
73d80deb 1317 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1318
acd7d370
VT		 1319 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1320 conn->mtu = hcon->hdev->le_mtu;
1321 else
1322 conn->mtu = hcon->hdev->acl_mtu;
1323
1da177e4
LT		 1324 conn->src = &hcon->hdev->bdaddr;
1325 conn->dst = &hcon->dst;
1326
4e8402a3
MH		 1327 conn->feat_mask = 0;
1328
1da177e4 1329 spin_lock_init(&conn->lock);
3df91ea2 1330 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1331
1332 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1333
5d3de7df 1334 if (hcon->type == LE_LINK)
6c9d42a1 1335 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1336 else
030013d8 1337 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1338
9f5a0d7b 1339 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1340
1da177e4
LT		 1341 return conn;
1342}
1343
1da177e4 1344/* ---- Socket interface ---- */
1da177e4 1345
c2287681 1346/* Find socket with psm and source / destination bdaddr.
1da177e4
LT		 1347 * Returns closest match.
1348 */
c2287681
IY		 1349static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm,
1350 bdaddr_t *src,
1351 bdaddr_t *dst)
1da177e4 1352{
23691d75 1353 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1354
23691d75 1355 read_lock(&chan_list_lock);
e0f0cb56 1356
23691d75
GP		 1357 list_for_each_entry(c, &chan_list, global_l) {
1358 struct sock *sk = c->sk;
fe4128e0 1359
89bc500e 1360 if (state && c->state != state)
1da177e4
LT		 1361 continue;
1362
23691d75 1363 if (c->psm == psm) {
c2287681
IY		 1364 int src_match, dst_match;
1365 int src_any, dst_any;
1366
1da177e4 1367 /* Exact match. */
c2287681
IY		 1368 src_match = !bacmp(&bt_sk(sk)->src, src);
1369 dst_match = !bacmp(&bt_sk(sk)->dst, dst);
1370 if (src_match && dst_match) {
a7567b20 1371 read_unlock(&chan_list_lock);
23691d75
GP		 1372 return c;
1373 }
1da177e4
LT		 1374
1375 /* Closest match */
c2287681
IY		 1376 src_any = !bacmp(&bt_sk(sk)->src, BDADDR_ANY);
1377 dst_any = !bacmp(&bt_sk(sk)->dst, BDADDR_ANY);
1378 if ((src_match && dst_any) || (src_any && dst_match) ||
1379 (src_any && dst_any))
23691d75 1380 c1 = c;
1da177e4
LT		 1381 }
1382 }
1da177e4 1383
23691d75 1384 read_unlock(&chan_list_lock);
e0f0cb56 1385
23691d75 1386 return c1;
1da177e4
LT		 1387}
1388
8e9f9892
AG		 1389int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
1390 bdaddr_t *dst, u8 dst_type)
1da177e4 1391{
5d41ce1d 1392 struct sock *sk = chan->sk;
1da177e4 1393 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1394 struct l2cap_conn *conn;
1395 struct hci_conn *hcon;
1396 struct hci_dev *hdev;
09ab6f4c 1397 __u8 auth_type;
44d0e48e 1398 int err;
1da177e4 1399
8e9f9892
AG		 1400 BT_DBG("%s -> %s (type %u) psm 0x%2.2x", batostr(src), batostr(dst),
1401 dst_type, __le16_to_cpu(chan->psm));
1da177e4 1402
af05b30b
GP		 1403 hdev = hci_get_route(dst, src);
1404 if (!hdev)
1da177e4
LT		 1405 return -EHOSTUNREACH;
1406
09fd0de5 1407 hci_dev_lock(hdev);
1da177e4 1408
6be36555 1409 l2cap_chan_lock(chan);
03a00194
GP		 1410
1411 /* PSM must be odd and lsb of upper byte must be 0 */
1412 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1413 chan->chan_type != L2CAP_CHAN_RAW) {
1414 err = -EINVAL;
1415 goto done;
1416 }
1417
1418 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1419 err = -EINVAL;
1420 goto done;
1421 }
1422
1423 switch (chan->mode) {
1424 case L2CAP_MODE_BASIC:
1425 break;
1426 case L2CAP_MODE_ERTM:
1427 case L2CAP_MODE_STREAMING:
1428 if (!disable_ertm)
1429 break;
1430 /* fall through */
1431 default:
1432 err = -ENOTSUPP;
1433 goto done;
1434 }
1435
6be36555
AE		 1436 lock_sock(sk);
1437
03a00194
GP		 1438 switch (sk->sk_state) {
1439 case BT_CONNECT:
1440 case BT_CONNECT2:
1441 case BT_CONFIG:
1442 /* Already connecting */
1443 err = 0;
6be36555 1444 release_sock(sk);
03a00194
GP		 1445 goto done;
1446
1447 case BT_CONNECTED:
1448 /* Already connected */
1449 err = -EISCONN;
6be36555 1450 release_sock(sk);
03a00194
GP		 1451 goto done;
1452
1453 case BT_OPEN:
1454 case BT_BOUND:
1455 /* Can connect */
1456 break;
1457
1458 default:
1459 err = -EBADFD;
6be36555 1460 release_sock(sk);
03a00194
GP		 1461 goto done;
1462 }
1463
1464 /* Set destination address and psm */
9219b2a0 1465 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1466
1467 release_sock(sk);
1468
03a00194
GP		 1469 chan->psm = psm;
1470 chan->dcid = cid;
1da177e4 1471
4343478f 1472 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1473
fe4128e0 1474 if (chan->dcid == L2CAP_CID_LE_DATA)
8e9f9892 1475 hcon = hci_connect(hdev, LE_LINK, dst, dst_type,
b12f62cf 1476 chan->sec_level, auth_type);
acd7d370 1477 else
8e9f9892 1478 hcon = hci_connect(hdev, ACL_LINK, dst, dst_type,
b12f62cf 1479 chan->sec_level, auth_type);
acd7d370 1480
30e76272
VT		 1481 if (IS_ERR(hcon)) {
1482 err = PTR_ERR(hcon);
1da177e4 1483 goto done;
30e76272 1484 }
1da177e4
LT		 1485
1486 conn = l2cap_conn_add(hcon, 0);
1487 if (!conn) {
1488 hci_conn_put(hcon);
30e76272 1489 err = -ENOMEM;
1da177e4
LT		 1490 goto done;
1491 }
1492
9f0caeb1
VCG		 1493 if (hcon->type == LE_LINK) {
1494 err = 0;
1495
1496 if (!list_empty(&conn->chan_l)) {
1497 err = -EBUSY;
1498 hci_conn_put(hcon);
1499 }
1500
1501 if (err)
1502 goto done;
1503 }
1504
1da177e4
LT		 1505 /* Update source addr of the socket */
1506 bacpy(src, conn->src);
1507
6be36555 1508 l2cap_chan_unlock(chan);
48454079 1509 l2cap_chan_add(conn, chan);
6be36555 1510 l2cap_chan_lock(chan);
48454079 1511
6be36555 1512 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1513 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1514
1515 if (hcon->state == BT_CONNECTED) {
715ec005 1516 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1517 __clear_chan_timer(chan);
d45fc423 1518 if (l2cap_chan_check_security(chan))
6be36555 1519 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1520 } else
fc7f8a7e 1521 l2cap_do_start(chan);
1da177e4
LT		 1522 }
1523
30e76272
VT		 1524 err = 0;
1525
1da177e4 1526done:
6be36555 1527 l2cap_chan_unlock(chan);
09fd0de5 1528 hci_dev_unlock(hdev);
1da177e4
LT		 1529 hci_dev_put(hdev);
1530 return err;
1531}
1532
dcba0dba 1533int __l2cap_wait_ack(struct sock *sk)
6161c038 1534{
8c1d787b 1535 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1536 DECLARE_WAITQUEUE(wait, current);
1537 int err = 0;
1538 int timeo = HZ/5;
1539
2b0b05dd 1540 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1541 set_current_state(TASK_INTERRUPTIBLE);
1542 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1543 if (!timeo)
1544 timeo = HZ/5;
1545
1546 if (signal_pending(current)) {
1547 err = sock_intr_errno(timeo);
1548 break;
1549 }
1550
1551 release_sock(sk);
1552 timeo = schedule_timeout(timeo);
1553 lock_sock(sk);
a71a0cf4 1554 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1555
1556 err = sock_error(sk);
1557 if (err)
1558 break;
1559 }
1560 set_current_state(TASK_RUNNING);
2b0b05dd 1561 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1562 return err;
1563}
1564
721c4181 1565static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1566{
721c4181
GP		 1567 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1568 monitor_timer.work);
e90bac06 1569
525cd185 1570 BT_DBG("chan %p", chan);
0e98958d 1571
6be36555
AE		 1572 l2cap_chan_lock(chan);
1573
2c03a7a4 1574 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1575 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
6be36555 1576 l2cap_chan_unlock(chan);
8d7e1c7f 1577 l2cap_chan_put(chan);
e90bac06
GP		 1578 return;
1579 }
1580
6a026610 1581 chan->retry_count++;
1a09bcb9 1582 __set_monitor_timer(chan);
e90bac06 1583
525cd185 1584 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555 1585 l2cap_chan_unlock(chan);
8d7e1c7f 1586 l2cap_chan_put(chan);
e90bac06
GP		 1587}
1588
721c4181 1589static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1590{
721c4181
GP		 1591 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1592 retrans_timer.work);
e90bac06 1593
49208c9c 1594 BT_DBG("chan %p", chan);
0e98958d 1595
6be36555
AE		 1596 l2cap_chan_lock(chan);
1597
6a026610 1598 chan->retry_count = 1;
1a09bcb9 1599 __set_monitor_timer(chan);
e90bac06 1600
e2ab4353 1601 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1602
525cd185 1603 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555
AE		 1604
1605 l2cap_chan_unlock(chan);
8d7e1c7f 1606 l2cap_chan_put(chan);
e90bac06
GP		 1607}
1608
42e5c802 1609static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1610{
1c2acffb 1611 struct sk_buff *skb;
1da177e4 1612
58d35f87 1613 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1614 chan->unacked_frames) {
3ce3514f 1615 if (bt_cb(skb)->control.txseq == chan->expected_ack_seq)
1c2acffb 1616 break;
1da177e4 1617
58d35f87 1618 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1619 kfree_skb(skb);
1da177e4 1620
6a026610 1621 chan->unacked_frames--;
1c2acffb 1622 }
1da177e4 1623
6a026610 1624 if (!chan->unacked_frames)
1a09bcb9 1625 __clear_retrans_timer(chan);
1c2acffb 1626}
1da177e4 1627
67c9e840 1628static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1629{
ccbb84af 1630 struct sk_buff *skb;
88843ab0
AE		 1631 u32 control;
1632 u16 fcs;
6840ed07 1633
58d35f87 1634 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1635 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1636 control |= __set_txseq(chan, chan->next_tx_seq);
88843ab0 1637 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1638
47d1ec61 1639 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1640 fcs = crc16(0, (u8 *)skb->data,
1641 skb->len - L2CAP_FCS_SIZE);
1642 put_unaligned_le16(fcs,
1643 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1644 }
1645
4343478f 1646 l2cap_do_send(chan, skb);
6840ed07 1647
836be934 1648 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1649 }
6840ed07
GP		 1650}
1651
fb45de7d 1652static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1653{
8f17154f 1654 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1655 u16 fcs;
1656 u32 control;
8f17154f 1657
58d35f87 1658 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1659 if (!skb)
1660 return;
8f17154f 1661
3ce3514f 1662 while (bt_cb(skb)->control.txseq != tx_seq) {
58d35f87 1663 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1664 return;
8f17154f 1665
d1726b6d
SJ		 1666 skb = skb_queue_next(&chan->tx_q, skb);
1667 }
8f17154f 1668
3ce3514f
MM		 1669 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1670 chan->remote_max_tx) {
8c1d787b 1671 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1672 return;
1673 }
1674
1675 tx_skb = skb_clone(skb, GFP_ATOMIC);
3ce3514f 1676 bt_cb(skb)->control.retries++;
88843ab0
AE		 1677
1678 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1679 control &= __get_sar_mask(chan);
3cb123d1 1680
e2ab4353 1681 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1682 control |= __set_ctrl_final(chan);
95ffa978 1683
0b209fae 1684 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1685 control |= __set_txseq(chan, tx_seq);
3cb123d1 1686
88843ab0 1687 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1688
47d1ec61 1689 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1690 fcs = crc16(0, (u8 *)tx_skb->data,
1691 tx_skb->len - L2CAP_FCS_SIZE);
1692 put_unaligned_le16(fcs,
1693 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1694 }
1695
4343478f 1696 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1697}
1698
67c9e840 1699static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1700{
1701 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1702 u16 fcs;
1703 u32 control;
9a9c6a34 1704 int nsent = 0;
1c2acffb 1705
89bc500e 1706 if (chan->state != BT_CONNECTED)
c13ffa62 1707 return -ENOTCONN;
e90bac06 1708
58d35f87 1709 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1710
3ce3514f
MM		 1711 if (bt_cb(skb)->control.retries == chan->remote_max_tx &&
1712 chan->remote_max_tx) {
8c1d787b 1713 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1714 break;
1715 }
1716
e420aba3
AE		 1717 tx_skb = skb_clone(skb, GFP_ATOMIC);
1718
3ce3514f 1719 bt_cb(skb)->control.retries++;
e90bac06 1720
88843ab0 1721 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1722 control &= __get_sar_mask(chan);
95ffa978 1723
e2ab4353 1724 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1725 control |= __set_ctrl_final(chan);
e2ab4353 1726
0b209fae 1727 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1728 control |= __set_txseq(chan, chan->next_tx_seq);
1c2acffb 1729
88843ab0 1730 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1731
47d1ec61 1732 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1733 fcs = crc16(0, (u8 *)skb->data,
1734 tx_skb->len - L2CAP_FCS_SIZE);
1735 put_unaligned_le16(fcs, skb->data +
1736 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1737 }
1738
4343478f 1739 l2cap_do_send(chan, tx_skb);
9a9c6a34 1740
1a09bcb9 1741 __set_retrans_timer(chan);
1c2acffb 1742
3ce3514f 1743 bt_cb(skb)->control.txseq = chan->next_tx_seq;
836be934
AE		 1744
1745 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1746
3ce3514f 1747 if (bt_cb(skb)->control.retries == 1) {
6a026610 1748 chan->unacked_frames++;
930fa4ae
SJ		 1749
1750 if (!nsent++)
1751 __clear_ack_timer(chan);
8ed7a0ae 1752 }
23e9fde2 1753
6a026610 1754 chan->frames_sent++;
1c2acffb 1755
58d35f87
GP		 1756 if (skb_queue_is_last(&chan->tx_q, skb))
1757 chan->tx_send_head = NULL;
1c2acffb 1758 else
58d35f87 1759 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1c2acffb
GP		 1760 }
1761
9e917af1
GP		 1762 return nsent;
1763}
1764
525cd185 1765static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1766{
dfc909be
GP		 1767 int ret;
1768
58d35f87
GP		 1769 if (!skb_queue_empty(&chan->tx_q))
1770 chan->tx_send_head = chan->tx_q.next;
dfc909be 1771
42e5c802 1772 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1773 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1774 return ret;
1775}
1776
b17e73bb 1777static void __l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1778{
88843ab0 1779 u32 control = 0;
9e917af1 1780
0b209fae 1781 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1782
e2ab4353 1783 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1784 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1785 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1786 l2cap_send_sframe(chan, control);
9a9c6a34 1787 return;
9e917af1 1788 }
dfc909be 1789
525cd185 1790 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1791 return;
1792
ab784b73 1793 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1794 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1795}
1796
b17e73bb
SJ		 1797static void l2cap_send_ack(struct l2cap_chan *chan)
1798{
1799 __clear_ack_timer(chan);
1800 __l2cap_send_ack(chan);
1801}
1802
525cd185 1803static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1804{
1805 struct srej_list *tail;
88843ab0 1806 u32 control;
99b0d4b7 1807
ab784b73 1808 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1809 control |= __set_ctrl_final(chan);
99b0d4b7 1810
39d5a3ee 1811 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1812 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1813
525cd185 1814 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1815}
1816
04124681
GP		 1817static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1818 struct msghdr *msg, int len,
1819 int count, struct sk_buff *skb)
1c2acffb 1820{
0952a57a 1821 struct l2cap_conn *conn = chan->conn;
1c2acffb 1822 struct sk_buff **frag;
90338947 1823 int sent = 0;
1da177e4 1824
59203a21 1825 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1826 return -EFAULT;
1da177e4
LT		 1827
1828 sent += count;
1829 len -= count;
1830
1831 /* Continuation fragments (no L2CAP header) */
1832 frag = &skb_shinfo(skb)->frag_list;
1833 while (len) {
1834 count = min_t(unsigned int, conn->mtu, len);
1835
2f7719ce 1836 *frag = chan->ops->alloc_skb(chan, count,
90338947 1837 msg->msg_flags & MSG_DONTWAIT);
2f7719ce 1838
90338947
GP		 1839 if (IS_ERR(*frag))
1840 return PTR_ERR(*frag);
1c2acffb
GP		 1841 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1842 return -EFAULT;
1da177e4 1843
5e59b791
LAD		 1844 (*frag)->priority = skb->priority;
1845
1da177e4
LT		 1846 sent += count;
1847 len -= count;
1848
1849 frag = &(*frag)->next;
1850 }
1da177e4
LT		 1851
1852 return sent;
1c2acffb 1853}
1da177e4 1854
5e59b791
LAD		 1855static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1856 struct msghdr *msg, size_t len,
1857 u32 priority)
1c2acffb 1858{
8c1d787b 1859 struct l2cap_conn *conn = chan->conn;
1c2acffb 1860 struct sk_buff *skb;
03a51213 1861 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1862 struct l2cap_hdr *lh;
1863
6d5922b0 1864 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1865
1866 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1867
1868 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1869 msg->msg_flags & MSG_DONTWAIT);
1870 if (IS_ERR(skb))
1871 return skb;
1c2acffb 1872
5e59b791
LAD		 1873 skb->priority = priority;
1874
1c2acffb
GP		 1875 /* Create L2CAP header */
1876 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1877 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1878 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
097db76c 1879 put_unaligned(chan->psm, skb_put(skb, 2));
1c2acffb 1880
0952a57a 1881 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1882 if (unlikely(err < 0)) {
1883 kfree_skb(skb);
1884 return ERR_PTR(err);
1885 }
1886 return skb;
1887}
1888
5e59b791
LAD		 1889static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1890 struct msghdr *msg, size_t len,
1891 u32 priority)
1c2acffb 1892{
8c1d787b 1893 struct l2cap_conn *conn = chan->conn;
1c2acffb 1894 struct sk_buff *skb;
f2ba7fae 1895 int err, count;
1c2acffb
GP		 1896 struct l2cap_hdr *lh;
1897
6d5922b0 1898 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1899
f2ba7fae 1900 count = min_t(unsigned int, (conn->mtu - L2CAP_HDR_SIZE), len);
2f7719ce 1901
f2ba7fae 1902 skb = chan->ops->alloc_skb(chan, count + L2CAP_HDR_SIZE,
90338947
GP		 1903 msg->msg_flags & MSG_DONTWAIT);
1904 if (IS_ERR(skb))
1905 return skb;
1c2acffb 1906
5e59b791
LAD		 1907 skb->priority = priority;
1908
1c2acffb
GP		 1909 /* Create L2CAP header */
1910 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1911 lh->cid = cpu_to_le16(chan->dcid);
6ff9b5ef 1912 lh->len = cpu_to_le16(len);
1c2acffb 1913
0952a57a 1914 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1915 if (unlikely(err < 0)) {
1916 kfree_skb(skb);
1917 return ERR_PTR(err);
1918 }
1919 return skb;
1920}
1921
ab0ff76d
LAD		 1922static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1923 struct msghdr *msg, size_t len,
88843ab0 1924 u32 control, u16 sdulen)
1c2acffb 1925{
8c1d787b 1926 struct l2cap_conn *conn = chan->conn;
1c2acffb 1927 struct sk_buff *skb;
e4ca6d98 1928 int err, count, hlen;
1c2acffb
GP		 1929 struct l2cap_hdr *lh;
1930
6d5922b0 1931 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1932
0ee0d208
GP		 1933 if (!conn)
1934 return ERR_PTR(-ENOTCONN);
1935
e4ca6d98
AE		 1936 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1937 hlen = L2CAP_EXT_HDR_SIZE;
1938 else
1939 hlen = L2CAP_ENH_HDR_SIZE;
1940
c74e560c 1941 if (sdulen)
03a51213 1942 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1943
47d1ec61 1944 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1945 hlen += L2CAP_FCS_SIZE;
fcc203c3 1946
1c2acffb 1947 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1948
1949 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1950 msg->msg_flags & MSG_DONTWAIT);
1951 if (IS_ERR(skb))
1952 return skb;
1c2acffb
GP		 1953
1954 /* Create L2CAP header */
1955 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1956 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1957 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0
AE		 1958
1959 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1960
c74e560c 1961 if (sdulen)
03a51213 1962 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 1963
0952a57a 1964 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1965 if (unlikely(err < 0)) {
1966 kfree_skb(skb);
1967 return ERR_PTR(err);
1968 }
e90bac06 1969
47d1ec61 1970 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1971 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1972
3ce3514f 1973 bt_cb(skb)->control.retries = 0;
1c2acffb 1974 return skb;
1da177e4
LT		 1975}
1976
67c9e840 1977static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
c74e560c 1978{
c74e560c
GP		 1979 struct sk_buff *skb;
1980 struct sk_buff_head sar_queue;
88843ab0 1981 u32 control;
c74e560c
GP		 1982 size_t size = 0;
1983
ff12fd64 1984 skb_queue_head_init(&sar_queue);
7e0ef6ee 1985 control = __set_ctrl_sar(chan, L2CAP_SAR_START);
47d1ec61 1986 skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
c74e560c
GP		 1987 if (IS_ERR(skb))
1988 return PTR_ERR(skb);
1989
1990 __skb_queue_tail(&sar_queue, skb);
2c03a7a4
GP		 1991 len -= chan->remote_mps;
1992 size += chan->remote_mps;
c74e560c
GP		 1993
1994 while (len > 0) {
1995 size_t buflen;
1996
2c03a7a4 1997 if (len > chan->remote_mps) {
7e0ef6ee 1998 control = __set_ctrl_sar(chan, L2CAP_SAR_CONTINUE);
2c03a7a4 1999 buflen = chan->remote_mps;
c74e560c 2000 } else {
7e0ef6ee 2001 control = __set_ctrl_sar(chan, L2CAP_SAR_END);
c74e560c
GP		 2002 buflen = len;
2003 }
2004
47d1ec61 2005 skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
c74e560c
GP		 2006 if (IS_ERR(skb)) {
2007 skb_queue_purge(&sar_queue);
2008 return PTR_ERR(skb);
2009 }
2010
2011 __skb_queue_tail(&sar_queue, skb);
2012 len -= buflen;
2013 size += buflen;
c74e560c 2014 }
58d35f87
GP		 2015 skb_queue_splice_tail(&sar_queue, &chan->tx_q);
2016 if (chan->tx_send_head == NULL)
2017 chan->tx_send_head = sar_queue.next;
c74e560c
GP		 2018
2019 return size;
2020}
2021
5e59b791
LAD		 2022int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
2023 u32 priority)
9a91a04a 2024{
9a91a04a 2025 struct sk_buff *skb;
88843ab0 2026 u32 control;
9a91a04a
GP		 2027 int err;
2028
2029 /* Connectionless channel */
715ec005 2030 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2031 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2032 if (IS_ERR(skb))
2033 return PTR_ERR(skb);
2034
2035 l2cap_do_send(chan, skb);
2036 return len;
2037 }
2038
2039 switch (chan->mode) {
2040 case L2CAP_MODE_BASIC:
2041 /* Check outgoing MTU */
2042 if (len > chan->omtu)
2043 return -EMSGSIZE;
2044
2045 /* Create a basic PDU */
5e59b791 2046 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2047 if (IS_ERR(skb))
2048 return PTR_ERR(skb);
2049
2050 l2cap_do_send(chan, skb);
2051 err = len;
2052 break;
2053
2054 case L2CAP_MODE_ERTM:
2055 case L2CAP_MODE_STREAMING:
2056 /* Entire SDU fits into one PDU */
2057 if (len <= chan->remote_mps) {
7e0ef6ee 2058 control = __set_ctrl_sar(chan, L2CAP_SAR_UNSEGMENTED);
9a91a04a
GP		 2059 skb = l2cap_create_iframe_pdu(chan, msg, len, control,
2060 0);
2061 if (IS_ERR(skb))
2062 return PTR_ERR(skb);
2063
2064 __skb_queue_tail(&chan->tx_q, skb);
2065
2066 if (chan->tx_send_head == NULL)
2067 chan->tx_send_head = skb;
2068
2069 } else {
2070 /* Segment SDU into multiples PDUs */
2071 err = l2cap_sar_segment_sdu(chan, msg, len);
2072 if (err < 0)
2073 return err;
2074 }
2075
2076 if (chan->mode == L2CAP_MODE_STREAMING) {
2077 l2cap_streaming_send(chan);
2078 err = len;
2079 break;
2080 }
2081
e2ab4353
GP		 2082 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
2083 test_bit(CONN_WAIT_F, &chan->conn_state)) {
9a91a04a
GP		 2084 err = len;
2085 break;
2086 }
2087
2088 err = l2cap_ertm_send(chan);
2089 if (err >= 0)
2090 err = len;
2091
2092 break;
2093
2094 default:
2095 BT_DBG("bad state %1.1x", chan->mode);
2096 err = -EBADFD;
2097 }
2098
2099 return err;
2100}
2101
1da177e4
LT		 2102/* Copy frame to all raw sockets on that connection */
2103static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2104{
1da177e4 2105 struct sk_buff *nskb;
48454079 2106 struct l2cap_chan *chan;
1da177e4
LT		 2107
2108 BT_DBG("conn %p", conn);
2109
3df91ea2 2110 mutex_lock(&conn->chan_lock);
3d57dc68 2111
3df91ea2 2112 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2113 struct sock *sk = chan->sk;
715ec005 2114 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2115 continue;
2116
2117 /* Don't send frame to the socket it came from */
2118 if (skb->sk == sk)
2119 continue;
af05b30b
GP		 2120 nskb = skb_clone(skb, GFP_ATOMIC);
2121 if (!nskb)
1da177e4
LT		 2122 continue;
2123
23070494 2124 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 2125 kfree_skb(nskb);
2126 }
3d57dc68 2127
3df91ea2 2128 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2129}
2130
2131/* ---- L2CAP signalling commands ---- */
2132static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2133 u8 code, u8 ident, u16 dlen, void *data)
2134{
2135 struct sk_buff *skb, **frag;
2136 struct l2cap_cmd_hdr *cmd;
2137 struct l2cap_hdr *lh;
2138 int len, count;
2139
af05b30b
GP		 2140 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2141 conn, code, ident, dlen);
1da177e4
LT		 2142
2143 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2144 count = min_t(unsigned int, conn->mtu, len);
2145
2146 skb = bt_skb_alloc(count, GFP_ATOMIC);
2147 if (!skb)
2148 return NULL;
2149
2150 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2151 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2152
2153 if (conn->hcon->type == LE_LINK)
2154 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2155 else
2156 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2157
2158 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2159 cmd->code = code;
2160 cmd->ident = ident;
aca3192c 2161 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2162
2163 if (dlen) {
2164 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2165 memcpy(skb_put(skb, count), data, count);
2166 data += count;
2167 }
2168
2169 len -= skb->len;
2170
2171 /* Continuation fragments (no L2CAP header) */
2172 frag = &skb_shinfo(skb)->frag_list;
2173 while (len) {
2174 count = min_t(unsigned int, conn->mtu, len);
2175
2176 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2177 if (!*frag)
2178 goto fail;
2179
2180 memcpy(skb_put(*frag, count), data, count);
2181
2182 len -= count;
2183 data += count;
2184
2185 frag = &(*frag)->next;
2186 }
2187
2188 return skb;
2189
2190fail:
2191 kfree_skb(skb);
2192 return NULL;
2193}
2194
2195static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2196{
2197 struct l2cap_conf_opt *opt = *ptr;
2198 int len;
2199
2200 len = L2CAP_CONF_OPT_SIZE + opt->len;
2201 *ptr += len;
2202
2203 *type = opt->type;
2204 *olen = opt->len;
2205
2206 switch (opt->len) {
2207 case 1:
2208 *val = *((u8 *) opt->val);
2209 break;
2210
2211 case 2:
bfaaeb3e 2212 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2213 break;
2214
2215 case 4:
bfaaeb3e 2216 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2217 break;
2218
2219 default:
2220 *val = (unsigned long) opt->val;
2221 break;
2222 }
2223
2224 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2225 return len;
2226}
2227
1da177e4
LT		 2228static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2229{
2230 struct l2cap_conf_opt *opt = *ptr;
2231
2232 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2233
2234 opt->type = type;
2235 opt->len = len;
2236
2237 switch (len) {
2238 case 1:
2239 *((u8 *) opt->val) = val;
2240 break;
2241
2242 case 2:
4f8b691c 2243 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2244 break;
2245
2246 case 4:
4f8b691c 2247 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2248 break;
2249
2250 default:
2251 memcpy(opt->val, (void *) val, len);
2252 break;
2253 }
2254
2255 *ptr += L2CAP_CONF_OPT_SIZE + len;
2256}
2257
f89cef09
AE		 2258static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2259{
2260 struct l2cap_conf_efs efs;
2261
1ec918ce 2262 switch (chan->mode) {
f89cef09
AE		 2263 case L2CAP_MODE_ERTM:
2264 efs.id = chan->local_id;
2265 efs.stype = chan->local_stype;
2266 efs.msdu = cpu_to_le16(chan->local_msdu);
2267 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2268 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2269 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2270 break;
2271
2272 case L2CAP_MODE_STREAMING:
2273 efs.id = 1;
2274 efs.stype = L2CAP_SERV_BESTEFFORT;
2275 efs.msdu = cpu_to_le16(chan->local_msdu);
2276 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2277 efs.acc_lat = 0;
2278 efs.flush_to = 0;
2279 break;
2280
2281 default:
2282 return;
2283 }
2284
2285 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2286 (unsigned long) &efs);
2287}
2288
721c4181 2289static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2290{
721c4181
GP		 2291 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2292 ack_timer.work);
c1b4f43b 2293
2fb9b3d4
GP		 2294 BT_DBG("chan %p", chan);
2295
6be36555
AE		 2296 l2cap_chan_lock(chan);
2297
b17e73bb 2298 __l2cap_send_ack(chan);
6be36555
AE		 2299
2300 l2cap_chan_unlock(chan);
09bfb2ee
SJ		 2301
2302 l2cap_chan_put(chan);
c1b4f43b
GP		 2303}
2304
3c588192 2305static inline int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2306{
3c588192
MM		 2307 int err;
2308
105bdf9e
MM		 2309 chan->next_tx_seq = 0;
2310 chan->expected_tx_seq = 0;
42e5c802 2311 chan->expected_ack_seq = 0;
6a026610 2312 chan->unacked_frames = 0;
42e5c802 2313 chan->buffer_seq = 0;
6a026610
GP		 2314 chan->num_acked = 0;
2315 chan->frames_sent = 0;
105bdf9e
MM		 2316 chan->last_acked_seq = 0;
2317 chan->sdu = NULL;
2318 chan->sdu_last_frag = NULL;
2319 chan->sdu_len = 0;
2320
2321 if (chan->mode != L2CAP_MODE_ERTM)
2322 return 0;
2323
2324 chan->rx_state = L2CAP_RX_STATE_RECV;
2325 chan->tx_state = L2CAP_TX_STATE_XMIT;
0565c1c2 2326
721c4181
GP		 2327 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2328 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2329 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2330
f1c6775b 2331 skb_queue_head_init(&chan->srej_q);
105bdf9e 2332 skb_queue_head_init(&chan->tx_q);
1890d36b 2333
39d5a3ee 2334 INIT_LIST_HEAD(&chan->srej_l);
3c588192
MM		 2335 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2336 if (err < 0)
2337 return err;
2338
2339 return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
0565c1c2
GP		 2340}
2341
f2fcfcd6
GP		 2342static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2343{
2344 switch (mode) {
2345 case L2CAP_MODE_STREAMING:
2346 case L2CAP_MODE_ERTM:
2347 if (l2cap_mode_supported(mode, remote_feat_mask))
2348 return mode;
2349 /* fall through */
2350 default:
2351 return L2CAP_MODE_BASIC;
2352 }
2353}
2354
6327eb98
AE		 2355static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2356{
2357 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2358}
2359
f89cef09
AE		 2360static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2361{
2362 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2363}
2364
6327eb98
AE		 2365static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2366{
2367 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2368 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2369 /* use extended control field */
2370 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2371 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2372 } else {
6327eb98
AE		 2373 chan->tx_win = min_t(u16, chan->tx_win,
2374 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2375 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2376 }
6327eb98
AE		 2377}
2378
710f9b0a 2379static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2380{
1da177e4 2381 struct l2cap_conf_req *req = data;
0c1bc5c6 2382 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2383 void *ptr = req->data;
c8f79162 2384 u16 size;
1da177e4 2385
49208c9c 2386 BT_DBG("chan %p", chan);
1da177e4 2387
73ffa904 2388 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2389 goto done;
2390
0c1bc5c6 2391 switch (chan->mode) {
f2fcfcd6
GP		 2392 case L2CAP_MODE_STREAMING:
2393 case L2CAP_MODE_ERTM:
c1360a1c 2394 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2395 break;
85eb53c6 2396
f89cef09
AE		 2397 if (__l2cap_efs_supported(chan))
2398 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2399
2ba13ed6 2400 /* fall through */
f2fcfcd6 2401 default:
8c1d787b 2402 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2403 break;
2404 }
2405
2406done:
0c1bc5c6
GP		 2407 if (chan->imtu != L2CAP_DEFAULT_MTU)
2408 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2409
0c1bc5c6 2410 switch (chan->mode) {
65c7c491 2411 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2412 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2413 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2414 break;
2415
62547752
GP		 2416 rfc.mode = L2CAP_MODE_BASIC;
2417 rfc.txwin_size = 0;
2418 rfc.max_transmit = 0;
2419 rfc.retrans_timeout = 0;
2420 rfc.monitor_timeout = 0;
2421 rfc.max_pdu_size = 0;
2422
63406504
GP		 2423 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2424 (unsigned long) &rfc);
65c7c491
MH		 2425 break;
2426
2427 case L2CAP_MODE_ERTM:
2428 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2429 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2430 rfc.retrans_timeout = 0;
2431 rfc.monitor_timeout = 0;
c8f79162
AE		 2432
2433 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2434 L2CAP_EXT_HDR_SIZE -
2435 L2CAP_SDULEN_SIZE -
2436 L2CAP_FCS_SIZE);
2437 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2438
6327eb98
AE		 2439 l2cap_txwin_setup(chan);
2440
2441 rfc.txwin_size = min_t(u16, chan->tx_win,
2442 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2443
63406504
GP		 2444 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2445 (unsigned long) &rfc);
2446
f89cef09
AE		 2447 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2448 l2cap_add_opt_efs(&ptr, chan);
2449
8c1d787b 2450 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2451 break;
2452
47d1ec61 2453 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2454 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2455 chan->fcs = L2CAP_FCS_NONE;
2456 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2457 }
6327eb98
AE		 2458
2459 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2460 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2461 chan->tx_win);
f2fcfcd6
GP		 2462 break;
2463
2464 case L2CAP_MODE_STREAMING:
2465 rfc.mode = L2CAP_MODE_STREAMING;
2466 rfc.txwin_size = 0;
2467 rfc.max_transmit = 0;
2468 rfc.retrans_timeout = 0;
2469 rfc.monitor_timeout = 0;
c8f79162
AE		 2470
2471 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2472 L2CAP_EXT_HDR_SIZE -
2473 L2CAP_SDULEN_SIZE -
2474 L2CAP_FCS_SIZE);
2475 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2476
63406504
GP		 2477 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2478 (unsigned long) &rfc);
2479
f89cef09
AE		 2480 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2481 l2cap_add_opt_efs(&ptr, chan);
2482
8c1d787b 2483 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2484 break;
2485
47d1ec61 2486 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2487 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2488 chan->fcs = L2CAP_FCS_NONE;
2489 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2490 }
65c7c491
MH		 2491 break;
2492 }
1da177e4 2493
fe4128e0 2494 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2495 req->flags = cpu_to_le16(0);
1da177e4
LT		 2496
2497 return ptr - data;
2498}
2499
73ffa904 2500static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2501{
5dee9e7c
MH		 2502 struct l2cap_conf_rsp *rsp = data;
2503 void *ptr = rsp->data;
73ffa904
GP		 2504 void *req = chan->conf_req;
2505 int len = chan->conf_len;
5dee9e7c
MH		 2506 int type, hint, olen;
2507 unsigned long val;
6464f35f 2508 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2509 struct l2cap_conf_efs efs;
2510 u8 remote_efs = 0;
861d6882 2511 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2512 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2513 u16 size;
1da177e4 2514
73ffa904 2515 BT_DBG("chan %p", chan);
820ae1b8 2516
5dee9e7c
MH		 2517 while (len >= L2CAP_CONF_OPT_SIZE) {
2518 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2519
589d2746 2520 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2521 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2522
2523 switch (type) {
2524 case L2CAP_CONF_MTU:
861d6882 2525 mtu = val;
5dee9e7c
MH		 2526 break;
2527
2528 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2529 chan->flush_to = val;
5dee9e7c
MH		 2530 break;
2531
2532 case L2CAP_CONF_QOS:
2533 break;
2534
6464f35f
MH		 2535 case L2CAP_CONF_RFC:
2536 if (olen == sizeof(rfc))
2537 memcpy(&rfc, (void *) val, olen);
2538 break;
2539
fcc203c3
GP		 2540 case L2CAP_CONF_FCS:
2541 if (val == L2CAP_FCS_NONE)
c1360a1c 2542 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2543 break;
fcc203c3 2544
42dceae2
AE		 2545 case L2CAP_CONF_EFS:
2546 remote_efs = 1;
2547 if (olen == sizeof(efs))
2548 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2549 break;
2550
6327eb98
AE		 2551 case L2CAP_CONF_EWS:
2552 if (!enable_hs)
2553 return -ECONNREFUSED;
fcc203c3 2554
6327eb98
AE		 2555 set_bit(FLAG_EXT_CTRL, &chan->flags);
2556 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2557 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2558 chan->remote_tx_win = val;
fcc203c3
GP		 2559 break;
2560
5dee9e7c
MH		 2561 default:
2562 if (hint)
2563 break;
2564
2565 result = L2CAP_CONF_UNKNOWN;
2566 *((u8 *) ptr++) = type;
2567 break;
2568 }
2569 }
2570
73ffa904 2571 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2572 goto done;
2573
0c1bc5c6 2574 switch (chan->mode) {
f2fcfcd6
GP		 2575 case L2CAP_MODE_STREAMING:
2576 case L2CAP_MODE_ERTM:
c1360a1c 2577 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2578 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2579 chan->conn->feat_mask);
85eb53c6
GP		 2580 break;
2581 }
2582
42dceae2
AE		 2583 if (remote_efs) {
2584 if (__l2cap_efs_supported(chan))
2585 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2586 else
2587 return -ECONNREFUSED;
2588 }
2589
0c1bc5c6 2590 if (chan->mode != rfc.mode)
f2fcfcd6 2591 return -ECONNREFUSED;
742e519b 2592
f2fcfcd6 2593 break;
f2fcfcd6
GP		 2594 }
2595
2596done:
0c1bc5c6 2597 if (chan->mode != rfc.mode) {
f2fcfcd6 2598 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2599 rfc.mode = chan->mode;
f2fcfcd6 2600
73ffa904 2601 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2602 return -ECONNREFUSED;
2603
2604 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2605 sizeof(rfc), (unsigned long) &rfc);
2606 }
2607
5dee9e7c
MH		 2608 if (result == L2CAP_CONF_SUCCESS) {
2609 /* Configure output options and let the other side know
2610 * which ones we don't like. */
2611
f2fcfcd6
GP		 2612 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2613 result = L2CAP_CONF_UNACCEPT;
2614 else {
0c1bc5c6 2615 chan->omtu = mtu;
c1360a1c 2616 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2617 }
0c1bc5c6 2618 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2619
42dceae2
AE		 2620 if (remote_efs) {
2621 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2622 efs.stype != L2CAP_SERV_NOTRAFIC &&
2623 efs.stype != chan->local_stype) {
2624
2625 result = L2CAP_CONF_UNACCEPT;
2626
2627 if (chan->num_conf_req >= 1)
2628 return -ECONNREFUSED;
2629
2630 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2631 sizeof(efs),
42dceae2 2632 (unsigned long) &efs);
0e8b207e 2633 } else {
3e6b3b95 2634 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2635 result = L2CAP_CONF_PENDING;
2636 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2637 }
2638 }
2639
f2fcfcd6
GP		 2640 switch (rfc.mode) {
2641 case L2CAP_MODE_BASIC:
47d1ec61 2642 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2643 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2644 break;
2645
2646 case L2CAP_MODE_ERTM:
6327eb98
AE		 2647 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2648 chan->remote_tx_win = rfc.txwin_size;
2649 else
2650 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2651
2c03a7a4 2652 chan->remote_max_tx = rfc.max_transmit;
1c762159 2653
c8f79162
AE		 2654 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2655 chan->conn->mtu -
2656 L2CAP_EXT_HDR_SIZE -
2657 L2CAP_SDULEN_SIZE -
2658 L2CAP_FCS_SIZE);
2659 rfc.max_pdu_size = cpu_to_le16(size);
2660 chan->remote_mps = size;
f2fcfcd6 2661
10467e9e 2662 rfc.retrans_timeout =
4fd21a88 2663 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 2664 rfc.monitor_timeout =
4fd21a88 2665 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2666
c1360a1c 2667 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2668
2669 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2670 sizeof(rfc), (unsigned long) &rfc);
2671
42dceae2
AE		 2672 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2673 chan->remote_id = efs.id;
2674 chan->remote_stype = efs.stype;
2675 chan->remote_msdu = le16_to_cpu(efs.msdu);
2676 chan->remote_flush_to =
2677 le32_to_cpu(efs.flush_to);
2678 chan->remote_acc_lat =
2679 le32_to_cpu(efs.acc_lat);
2680 chan->remote_sdu_itime =
2681 le32_to_cpu(efs.sdu_itime);
2682 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2683 sizeof(efs), (unsigned long) &efs);
2684 }
f2fcfcd6
GP		 2685 break;
2686
2687 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2688 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2689 chan->conn->mtu -
2690 L2CAP_EXT_HDR_SIZE -
2691 L2CAP_SDULEN_SIZE -
2692 L2CAP_FCS_SIZE);
2693 rfc.max_pdu_size = cpu_to_le16(size);
2694 chan->remote_mps = size;
f2fcfcd6 2695
c1360a1c 2696 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2697
2698 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2699 sizeof(rfc), (unsigned long) &rfc);
2700
f2fcfcd6
GP		 2701 break;
2702
2703 default:
5dee9e7c 2704 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2705
6464f35f 2706 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2707 rfc.mode = chan->mode;
f2fcfcd6 2708 }
6464f35f 2709
f2fcfcd6 2710 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2711 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2712 }
fe4128e0 2713 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2714 rsp->result = cpu_to_le16(result);
2715 rsp->flags = cpu_to_le16(0x0000);
2716
2717 return ptr - data;
1da177e4
LT		 2718}
2719
b4450035 2720static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2721{
f2fcfcd6
GP		 2722 struct l2cap_conf_req *req = data;
2723 void *ptr = req->data;
2724 int type, olen;
2725 unsigned long val;
36e999a8 2726 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 2727 struct l2cap_conf_efs efs;
f2fcfcd6 2728
fe4128e0 2729 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2730
2731 while (len >= L2CAP_CONF_OPT_SIZE) {
2732 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2733
2734 switch (type) {
2735 case L2CAP_CONF_MTU:
2736 if (val < L2CAP_DEFAULT_MIN_MTU) {
2737 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2738 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2739 } else
0c1bc5c6
GP		 2740 chan->imtu = val;
2741 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2742 break;
2743
2744 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2745 chan->flush_to = val;
f2fcfcd6 2746 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2747 2, chan->flush_to);
f2fcfcd6
GP		 2748 break;
2749
2750 case L2CAP_CONF_RFC:
2751 if (olen == sizeof(rfc))
2752 memcpy(&rfc, (void *)val, olen);
2753
c1360a1c 2754 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2755 rfc.mode != chan->mode)
f2fcfcd6
GP		 2756 return -ECONNREFUSED;
2757
47d1ec61 2758 chan->fcs = 0;
f2fcfcd6
GP		 2759
2760 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2761 sizeof(rfc), (unsigned long) &rfc);
2762 break;
6327eb98
AE		 2763
2764 case L2CAP_CONF_EWS:
2765 chan->tx_win = min_t(u16, val,
2766 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2767 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2768 chan->tx_win);
6327eb98 2769 break;
66af7aaf
AE		 2770
2771 case L2CAP_CONF_EFS:
2772 if (olen == sizeof(efs))
2773 memcpy(&efs, (void *)val, olen);
2774
2775 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2776 efs.stype != L2CAP_SERV_NOTRAFIC &&
2777 efs.stype != chan->local_stype)
2778 return -ECONNREFUSED;
2779
2780 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2781 sizeof(efs), (unsigned long) &efs);
2782 break;
f2fcfcd6
GP		 2783 }
2784 }
2785
0c1bc5c6 2786 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2787 return -ECONNREFUSED;
2788
0c1bc5c6 2789 chan->mode = rfc.mode;
6c2ea7a8 2790
0e8b207e 2791 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2792 switch (rfc.mode) {
2793 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2794 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2795 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2796 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2797
2798 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2799 chan->local_msdu = le16_to_cpu(efs.msdu);
2800 chan->local_sdu_itime =
2801 le32_to_cpu(efs.sdu_itime);
2802 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2803 chan->local_flush_to =
2804 le32_to_cpu(efs.flush_to);
2805 }
f2fcfcd6 2806 break;
66af7aaf 2807
f2fcfcd6 2808 case L2CAP_MODE_STREAMING:
47d1ec61 2809 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2810 }
2811 }
2812
fe4128e0 2813 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2814 req->flags = cpu_to_le16(0x0000);
2815
2816 return ptr - data;
2817}
2818
fe4128e0 2819static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2820{
2821 struct l2cap_conf_rsp *rsp = data;
2822 void *ptr = rsp->data;
1da177e4 2823
fe4128e0 2824 BT_DBG("chan %p", chan);
1da177e4 2825
fe4128e0 2826 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2827 rsp->result = cpu_to_le16(result);
aca3192c 2828 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2829
2830 return ptr - data;
2831}
2832
8c1d787b 2833void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2834{
2835 struct l2cap_conn_rsp rsp;
8c1d787b 2836 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2837 u8 buf[128];
2838
fe4128e0
GP		 2839 rsp.scid = cpu_to_le16(chan->dcid);
2840 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2841 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2842 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2843 l2cap_send_cmd(conn, chan->ident,
2844 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2845
c1360a1c 2846 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2847 return;
2848
710f9b0a
GP		 2849 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2850 l2cap_build_conf_req(chan, buf), buf);
2851 chan->num_conf_req++;
2852}
2853
47d1ec61 2854static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2855{
7b1c0049
GP		 2856 int type, olen;
2857 unsigned long val;
2858 struct l2cap_conf_rfc rfc;
2859
47d1ec61 2860 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2861
0c1bc5c6 2862 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2863 return;
2864
2865 while (len >= L2CAP_CONF_OPT_SIZE) {
2866 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2867
2868 switch (type) {
2869 case L2CAP_CONF_RFC:
2870 if (olen == sizeof(rfc))
2871 memcpy(&rfc, (void *)val, olen);
2872 goto done;
2873 }
2874 }
2875
36e999a8
MM		 2876 /* Use sane default values in case a misbehaving remote device
2877 * did not send an RFC option.
2878 */
2879 rfc.mode = chan->mode;
2880 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2881 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2882 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2883
2884 BT_ERR("Expected RFC option was not found, using defaults");
2885
7b1c0049
GP		 2886done:
2887 switch (rfc.mode) {
2888 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2889 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2890 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2891 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2892 break;
2893 case L2CAP_MODE_STREAMING:
47d1ec61 2894 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2895 }
2896}
2897
4e8402a3
MH		 2898static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2899{
e2fd318e 2900 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2901
e2fd318e 2902 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2903 return 0;
2904
2905 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2906 cmd->ident == conn->info_ident) {
17cd3f37 2907 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 2908
2909 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2910 conn->info_ident = 0;
984947dc 2911
4e8402a3
MH		 2912 l2cap_conn_start(conn);
2913 }
2914
2915 return 0;
2916}
2917
1da177e4
LT		 2918static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2919{
1da177e4
LT		 2920 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2921 struct l2cap_conn_rsp rsp;
23691d75 2922 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2923 struct sock *parent, *sk = NULL;
e7c29cb1 2924 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2925
2926 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2927 __le16 psm = req->psm;
1da177e4 2928
097db76c 2929 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 2930
2931 /* Check if we have socket listening on psm */
c2287681 2932 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src, conn->dst);
23691d75 2933 if (!pchan) {
1da177e4
LT		 2934 result = L2CAP_CR_BAD_PSM;
2935 goto sendresp;
2936 }
2937
23691d75
GP		 2938 parent = pchan->sk;
2939
3df91ea2 2940 mutex_lock(&conn->chan_lock);
aa2ac881 2941 lock_sock(parent);
e0f0cb56 2942
e7c29cb1
MH		 2943 /* Check if the ACL is secure enough (if not SDP) */
2944 if (psm != cpu_to_le16(0x0001) &&
2945 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2946 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2947 result = L2CAP_CR_SEC_BLOCK;
2948 goto response;
2949 }
2950
1da177e4
LT		 2951 result = L2CAP_CR_NO_MEM;
2952
2953 /* Check for backlog size */
2954 if (sk_acceptq_is_full(parent)) {
8e87d142 2955 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2956 goto response;
2957 }
2958
80808e43
GP		 2959 chan = pchan->ops->new_connection(pchan->data);
2960 if (!chan)
1da177e4
LT		 2961 goto response;
2962
80808e43
GP		 2963 sk = chan->sk;
2964
1da177e4 2965 /* Check if we already have channel with that dcid */
baa7e1fa 2966 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 2967 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 2968 chan->ops->close(chan->data);
1da177e4
LT		 2969 goto response;
2970 }
2971
2972 hci_conn_hold(conn->hcon);
2973
1da177e4
LT		 2974 bacpy(&bt_sk(sk)->src, conn->src);
2975 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 2976 chan->psm = psm;
2977 chan->dcid = scid;
1da177e4 2978
d1010240
GP		 2979 bt_accept_enqueue(parent, sk);
2980
6be36555 2981 __l2cap_chan_add(conn, chan);
48454079 2982
fe4128e0 2983 dcid = chan->scid;
1da177e4 2984
c9b66675 2985 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 2986
fc7f8a7e 2987 chan->ident = cmd->ident;
1da177e4 2988
984947dc 2989 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 2990 if (l2cap_chan_check_security(chan)) {
f66dc81f 2991 if (bt_sk(sk)->defer_setup) {
0e587be7 2992 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 2993 result = L2CAP_CR_PEND;
2994 status = L2CAP_CS_AUTHOR_PEND;
2995 parent->sk_data_ready(parent, 0);
2996 } else {
0e587be7 2997 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 2998 result = L2CAP_CR_SUCCESS;
2999 status = L2CAP_CS_NO_INFO;
3000 }
79d554a6 3001 } else {
0e587be7 3002 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3003 result = L2CAP_CR_PEND;
3004 status = L2CAP_CS_AUTHEN_PEND;
3005 }
3006 } else {
0e587be7 3007 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 3008 result = L2CAP_CR_PEND;
3009 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 3010 }
3011
1da177e4 3012response:
aa2ac881 3013 release_sock(parent);
3df91ea2 3014 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 3015
3016sendresp:
aca3192c
YH		 3017 rsp.scid = cpu_to_le16(scid);
3018 rsp.dcid = cpu_to_le16(dcid);
3019 rsp.result = cpu_to_le16(result);
3020 rsp.status = cpu_to_le16(status);
1da177e4 3021 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 3022
3023 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
3024 struct l2cap_info_req info;
3025 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3026
3027 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
3028 conn->info_ident = l2cap_get_ident(conn);
3029
ba13ccd9 3030 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 3031
3032 l2cap_send_cmd(conn, conn->info_ident,
3033 L2CAP_INFO_REQ, sizeof(info), &info);
3034 }
3035
c1360a1c 3036 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 3037 result == L2CAP_CR_SUCCESS) {
3038 u8 buf[128];
c1360a1c 3039 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 3040 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3041 l2cap_build_conf_req(chan, buf), buf);
3042 chan->num_conf_req++;
e9aeb2dd
GP		 3043 }
3044
1da177e4
LT		 3045 return 0;
3046}
3047
3048static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3049{
3050 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3051 u16 scid, dcid, result, status;
48454079 3052 struct l2cap_chan *chan;
1da177e4 3053 u8 req[128];
3df91ea2 3054 int err;
1da177e4
LT		 3055
3056 scid = __le16_to_cpu(rsp->scid);
3057 dcid = __le16_to_cpu(rsp->dcid);
3058 result = __le16_to_cpu(rsp->result);
3059 status = __le16_to_cpu(rsp->status);
3060
1b009c98
AE		 3061 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3062 dcid, scid, result, status);
1da177e4 3063
3df91ea2
AE		 3064 mutex_lock(&conn->chan_lock);
3065
1da177e4 3066 if (scid) {
3df91ea2
AE		 3067 chan = __l2cap_get_chan_by_scid(conn, scid);
3068 if (!chan) {
3069 err = -EFAULT;
3070 goto unlock;
3071 }
1da177e4 3072 } else {
3df91ea2
AE		 3073 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3074 if (!chan) {
3075 err = -EFAULT;
3076 goto unlock;
3077 }
1da177e4
LT		 3078 }
3079
3df91ea2
AE		 3080 err = 0;
3081
6be36555 3082 l2cap_chan_lock(chan);
48454079 3083
1da177e4
LT		 3084 switch (result) {
3085 case L2CAP_CR_SUCCESS:
89bc500e 3086 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3087 chan->ident = 0;
fe4128e0 3088 chan->dcid = dcid;
c1360a1c 3089 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3090
c1360a1c 3091 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3092 break;
3093
1da177e4 3094 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3095 l2cap_build_conf_req(chan, req), req);
3096 chan->num_conf_req++;
1da177e4
LT		 3097 break;
3098
3099 case L2CAP_CR_PEND:
c1360a1c 3100 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3101 break;
3102
3103 default:
48454079 3104 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3105 break;
3106 }
3107
6be36555 3108 l2cap_chan_unlock(chan);
3df91ea2
AE		 3109
3110unlock:
3111 mutex_unlock(&conn->chan_lock);
3112
3113 return err;
1da177e4
LT		 3114}
3115
47d1ec61 3116static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3117{
3118 /* FCS is enabled only in ERTM or streaming mode, if one or both
3119 * sides request it.
3120 */
0c1bc5c6 3121 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3122 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3123 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3124 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3125}
3126
88219a0f 3127static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3128{
3129 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3130 u16 dcid, flags;
3131 u8 rsp[64];
48454079 3132 struct l2cap_chan *chan;
3c588192 3133 int len, err = 0;
1da177e4
LT		 3134
3135 dcid = __le16_to_cpu(req->dcid);
3136 flags = __le16_to_cpu(req->flags);
3137
3138 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3139
baa7e1fa 3140 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3141 if (!chan)
1da177e4
LT		 3142 return -ENOENT;
3143
6be36555 3144 l2cap_chan_lock(chan);
48454079 3145
033b1142 3146 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3147 struct l2cap_cmd_rej_cid rej;
3148
3149 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3150 rej.scid = cpu_to_le16(chan->scid);
3151 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3152
df6bd743
GP		 3153 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3154 sizeof(rej), &rej);
354f60a9 3155 goto unlock;
df6bd743 3156 }
354f60a9 3157
5dee9e7c 3158 /* Reject if config buffer is too small. */
88219a0f 3159 len = cmd_len - sizeof(*req);
7ac28817 3160 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3161 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3162 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 3163 L2CAP_CONF_REJECT, flags), rsp);
3164 goto unlock;
3165 }
3166
3167 /* Store config. */
73ffa904
GP		 3168 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3169 chan->conf_len += len;
1da177e4
LT		 3170
3171 if (flags & 0x0001) {
3172 /* Incomplete config. Send empty response. */
3173 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3174 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 3175 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 3176 goto unlock;
3177 }
3178
3179 /* Complete config. */
73ffa904 3180 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3181 if (len < 0) {
e92c8e70 3182 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3183 goto unlock;
f2fcfcd6 3184 }
1da177e4 3185
5dee9e7c 3186 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3187 chan->num_conf_rsp++;
5dee9e7c 3188
5dee9e7c 3189 /* Reset config buffer. */
73ffa904 3190 chan->conf_len = 0;
5dee9e7c 3191
c1360a1c 3192 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3193 goto unlock;
3194
c1360a1c 3195 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3196 set_default_fcs(chan);
fcc203c3 3197
89bc500e 3198 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 3199
105bdf9e
MM		 3200 if (chan->mode == L2CAP_MODE_ERTM ||
3201 chan->mode == L2CAP_MODE_STREAMING)
3c588192
MM		 3202 err = l2cap_ertm_init(chan);
3203
3204 if (err < 0)
3205 l2cap_send_disconn_req(chan->conn, chan, -err);
3206 else
3207 l2cap_chan_ready(chan);
0565c1c2 3208
876d9484
MH		 3209 goto unlock;
3210 }
3211
c1360a1c 3212 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3213 u8 buf[64];
1da177e4 3214 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3215 l2cap_build_conf_req(chan, buf), buf);
3216 chan->num_conf_req++;
1da177e4
LT		 3217 }
3218
0e8b207e
AE		 3219 /* Got Conf Rsp PENDING from remote side and asume we sent
3220 Conf Rsp PENDING in the code above */
3221 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3222 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3223
3224 /* check compatibility */
3225
3226 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3227 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3228
3229 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3230 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 3231 L2CAP_CONF_SUCCESS, 0x0000), rsp);
3232 }
3233
1da177e4 3234unlock:
6be36555 3235 l2cap_chan_unlock(chan);
3c588192 3236 return err;
1da177e4
LT		 3237}
3238
3239static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3240{
3241 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3242 u16 scid, flags, result;
48454079 3243 struct l2cap_chan *chan;
61386cba 3244 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3245 int err = 0;
1da177e4
LT		 3246
3247 scid = __le16_to_cpu(rsp->scid);
3248 flags = __le16_to_cpu(rsp->flags);
3249 result = __le16_to_cpu(rsp->result);
3250
61386cba
AE		 3251 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3252 result, len);
1da177e4 3253
baa7e1fa 3254 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3255 if (!chan)
1da177e4
LT		 3256 return 0;
3257
6be36555 3258 l2cap_chan_lock(chan);
48454079 3259
1da177e4
LT		 3260 switch (result) {
3261 case L2CAP_CONF_SUCCESS:
47d1ec61 3262 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3263 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3264 break;
3265
0e8b207e
AE		 3266 case L2CAP_CONF_PENDING:
3267 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3268
3269 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3270 char buf[64];
3271
3272 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3273 buf, &result);
3274 if (len < 0) {
3275 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3276 goto done;
3277 }
3278
3279 /* check compatibility */
3280
3281 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3282 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3283
3284 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3285 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 3286 L2CAP_CONF_SUCCESS, 0x0000), buf);
3287 }
3288 goto done;
3289
1da177e4 3290 case L2CAP_CONF_UNACCEPT:
73ffa904 3291 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3292 char req[64];
3293
c2c77ec8 3294 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3295 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3296 goto done;
3297 }
3298
f2fcfcd6
GP		 3299 /* throw out any old stored conf requests */
3300 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3301 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3302 req, &result);
f2fcfcd6 3303 if (len < 0) {
e92c8e70 3304 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3305 goto done;
3306 }
3307
3308 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3309 L2CAP_CONF_REQ, len, req);
73ffa904 3310 chan->num_conf_req++;
f2fcfcd6
GP		 3311 if (result != L2CAP_CONF_SUCCESS)
3312 goto done;
3313 break;
1da177e4
LT		 3314 }
3315
8e87d142 3316 default:
6be36555 3317 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3318
ba13ccd9 3319 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3320 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3321 goto done;
3322 }
3323
3324 if (flags & 0x01)
3325 goto done;
3326
c1360a1c 3327 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3328
c1360a1c 3329 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3330 set_default_fcs(chan);
fcc203c3 3331
89bc500e 3332 l2cap_state_change(chan, BT_CONNECTED);
105bdf9e
MM		 3333 if (chan->mode == L2CAP_MODE_ERTM ||
3334 chan->mode == L2CAP_MODE_STREAMING)
3c588192 3335 err = l2cap_ertm_init(chan);
0565c1c2 3336
3c588192
MM		 3337 if (err < 0)
3338 l2cap_send_disconn_req(chan->conn, chan, -err);
3339 else
3340 l2cap_chan_ready(chan);
1da177e4
LT		 3341 }
3342
3343done:
6be36555 3344 l2cap_chan_unlock(chan);
3c588192 3345 return err;
1da177e4
LT		 3346}
3347
3348static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3349{
3350 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3351 struct l2cap_disconn_rsp rsp;
3352 u16 dcid, scid;
48454079 3353 struct l2cap_chan *chan;
1da177e4
LT		 3354 struct sock *sk;
3355
3356 scid = __le16_to_cpu(req->scid);
3357 dcid = __le16_to_cpu(req->dcid);
3358
3359 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3360
3df91ea2
AE		 3361 mutex_lock(&conn->chan_lock);
3362
3363 chan = __l2cap_get_chan_by_scid(conn, dcid);
3364 if (!chan) {
3365 mutex_unlock(&conn->chan_lock);
1da177e4 3366 return 0;
3df91ea2 3367 }
1da177e4 3368
6be36555
AE		 3369 l2cap_chan_lock(chan);
3370
48454079
GP		 3371 sk = chan->sk;
3372
fe4128e0
GP		 3373 rsp.dcid = cpu_to_le16(chan->scid);
3374 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3375 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3376
6be36555 3377 lock_sock(sk);
1da177e4 3378 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3379 release_sock(sk);
1da177e4 3380
61d6ef3e 3381 l2cap_chan_hold(chan);
48454079 3382 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3383
3384 l2cap_chan_unlock(chan);
1da177e4 3385
ba3bd0ee 3386 chan->ops->close(chan->data);
61d6ef3e 3387 l2cap_chan_put(chan);
3df91ea2
AE		 3388
3389 mutex_unlock(&conn->chan_lock);
3390
1da177e4
LT		 3391 return 0;
3392}
3393
3394static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3395{
3396 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3397 u16 dcid, scid;
48454079 3398 struct l2cap_chan *chan;
1da177e4
LT		 3399
3400 scid = __le16_to_cpu(rsp->scid);
3401 dcid = __le16_to_cpu(rsp->dcid);
3402
3403 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3404
3df91ea2
AE		 3405 mutex_lock(&conn->chan_lock);
3406
3407 chan = __l2cap_get_chan_by_scid(conn, scid);
3408 if (!chan) {
3409 mutex_unlock(&conn->chan_lock);
1da177e4 3410 return 0;
3df91ea2 3411 }
1da177e4 3412
6be36555 3413 l2cap_chan_lock(chan);
48454079 3414
61d6ef3e 3415 l2cap_chan_hold(chan);
48454079 3416 l2cap_chan_del(chan, 0);
6be36555
AE		 3417
3418 l2cap_chan_unlock(chan);
1da177e4 3419
ba3bd0ee 3420 chan->ops->close(chan->data);
61d6ef3e 3421 l2cap_chan_put(chan);
3df91ea2
AE		 3422
3423 mutex_unlock(&conn->chan_lock);
3424
1da177e4
LT		 3425 return 0;
3426}
3427
3428static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3429{
3430 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3431 u16 type;
3432
3433 type = __le16_to_cpu(req->type);
3434
3435 BT_DBG("type 0x%4.4x", type);
3436
f0709e03
MH		 3437 if (type == L2CAP_IT_FEAT_MASK) {
3438 u8 buf[8];
44dd46de 3439 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3440 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3441 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3442 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3443 if (!disable_ertm)
fcc203c3
GP		 3444 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3445 | L2CAP_FEAT_FCS;
a5fd6f30 3446 if (enable_hs)
6327eb98
AE		 3447 feat_mask |= L2CAP_FEAT_EXT_FLOW
3448 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3449
1b7bf4ed 3450 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3451 l2cap_send_cmd(conn, cmd->ident,
3452 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3453 } else if (type == L2CAP_IT_FIXED_CHAN) {
3454 u8 buf[12];
3455 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3456
3457 if (enable_hs)
3458 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3459 else
3460 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3461
e1027a7c
MH		 3462 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3463 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3464 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3465 l2cap_send_cmd(conn, cmd->ident,
3466 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3467 } else {
3468 struct l2cap_info_rsp rsp;
3469 rsp.type = cpu_to_le16(type);
3470 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3471 l2cap_send_cmd(conn, cmd->ident,
3472 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3473 }
1da177e4
LT		 3474
3475 return 0;
3476}
3477
3478static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3479{
3480 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3481 u16 type, result;
3482
3483 type = __le16_to_cpu(rsp->type);
3484 result = __le16_to_cpu(rsp->result);
3485
3486 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3487
e90165be
AE		 3488 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3489 if (cmd->ident != conn->info_ident ||
3490 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3491 return 0;
3492
17cd3f37 3493 cancel_delayed_work(&conn->info_timer);
4e8402a3 3494
adb08ede
VT		 3495 if (result != L2CAP_IR_SUCCESS) {
3496 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3497 conn->info_ident = 0;
3498
3499 l2cap_conn_start(conn);
3500
3501 return 0;
3502 }
3503
978c93b9
AE		 3504 switch (type) {
3505 case L2CAP_IT_FEAT_MASK:
83985319 3506 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3507
47ec1dcd 3508 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3509 struct l2cap_info_req req;
3510 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3511
3512 conn->info_ident = l2cap_get_ident(conn);
3513
3514 l2cap_send_cmd(conn, conn->info_ident,
3515 L2CAP_INFO_REQ, sizeof(req), &req);
3516 } else {
3517 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3518 conn->info_ident = 0;
3519
3520 l2cap_conn_start(conn);
3521 }
978c93b9
AE		 3522 break;
3523
3524 case L2CAP_IT_FIXED_CHAN:
3525 conn->fixed_chan_mask = rsp->data[0];
984947dc 3526 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3527 conn->info_ident = 0;
984947dc
MH		 3528
3529 l2cap_conn_start(conn);
978c93b9 3530 break;
984947dc 3531 }
4e8402a3 3532
1da177e4
LT		 3533 return 0;
3534}
3535
f94ff6ff
MM		 3536static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3537 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3538 void *data)
3539{
3540 struct l2cap_create_chan_req *req = data;
3541 struct l2cap_create_chan_rsp rsp;
3542 u16 psm, scid;
3543
3544 if (cmd_len != sizeof(*req))
3545 return -EPROTO;
3546
3547 if (!enable_hs)
3548 return -EINVAL;
3549
3550 psm = le16_to_cpu(req->psm);
3551 scid = le16_to_cpu(req->scid);
3552
3553 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3554
3555 /* Placeholder: Always reject */
3556 rsp.dcid = 0;
3557 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 3558 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3559 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 3560
3561 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3562 sizeof(rsp), &rsp);
3563
3564 return 0;
3565}
3566
3567static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3568 struct l2cap_cmd_hdr *cmd, void *data)
3569{
3570 BT_DBG("conn %p", conn);
3571
3572 return l2cap_connect_rsp(conn, cmd, data);
3573}
3574
8d5a04a1
MM		 3575static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3576 u16 icid, u16 result)
3577{
3578 struct l2cap_move_chan_rsp rsp;
3579
3580 BT_DBG("icid %d, result %d", icid, result);
3581
3582 rsp.icid = cpu_to_le16(icid);
3583 rsp.result = cpu_to_le16(result);
3584
3585 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3586}
3587
3588static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3589 struct l2cap_chan *chan, u16 icid, u16 result)
3590{
3591 struct l2cap_move_chan_cfm cfm;
3592 u8 ident;
3593
3594 BT_DBG("icid %d, result %d", icid, result);
3595
3596 ident = l2cap_get_ident(conn);
3597 if (chan)
3598 chan->ident = ident;
3599
3600 cfm.icid = cpu_to_le16(icid);
3601 cfm.result = cpu_to_le16(result);
3602
3603 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3604}
3605
3606static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3607 u16 icid)
3608{
3609 struct l2cap_move_chan_cfm_rsp rsp;
3610
3611 BT_DBG("icid %d", icid);
3612
3613 rsp.icid = cpu_to_le16(icid);
3614 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3615}
3616
3617static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3618 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3619{
3620 struct l2cap_move_chan_req *req = data;
3621 u16 icid = 0;
3622 u16 result = L2CAP_MR_NOT_ALLOWED;
3623
3624 if (cmd_len != sizeof(*req))
3625 return -EPROTO;
3626
3627 icid = le16_to_cpu(req->icid);
3628
3629 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3630
3631 if (!enable_hs)
3632 return -EINVAL;
3633
3634 /* Placeholder: Always refuse */
3635 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3636
3637 return 0;
3638}
3639
3640static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3641 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3642{
3643 struct l2cap_move_chan_rsp *rsp = data;
3644 u16 icid, result;
3645
3646 if (cmd_len != sizeof(*rsp))
3647 return -EPROTO;
3648
3649 icid = le16_to_cpu(rsp->icid);
3650 result = le16_to_cpu(rsp->result);
3651
3652 BT_DBG("icid %d, result %d", icid, result);
3653
3654 /* Placeholder: Always unconfirmed */
3655 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3656
3657 return 0;
3658}
3659
3660static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3661 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3662{
3663 struct l2cap_move_chan_cfm *cfm = data;
3664 u16 icid, result;
3665
3666 if (cmd_len != sizeof(*cfm))
3667 return -EPROTO;
3668
3669 icid = le16_to_cpu(cfm->icid);
3670 result = le16_to_cpu(cfm->result);
3671
3672 BT_DBG("icid %d, result %d", icid, result);
3673
3674 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3675
3676 return 0;
3677}
3678
3679static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3680 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3681{
3682 struct l2cap_move_chan_cfm_rsp *rsp = data;
3683 u16 icid;
3684
3685 if (cmd_len != sizeof(*rsp))
3686 return -EPROTO;
3687
3688 icid = le16_to_cpu(rsp->icid);
3689
3690 BT_DBG("icid %d", icid);
3691
3692 return 0;
3693}
3694
e2174ca4 3695static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3696 u16 to_multiplier)
3697{
3698 u16 max_latency;
3699
3700 if (min > max || min < 6 || max > 3200)
3701 return -EINVAL;
3702
3703 if (to_multiplier < 10 || to_multiplier > 3200)
3704 return -EINVAL;
3705
3706 if (max >= to_multiplier * 8)
3707 return -EINVAL;
3708
3709 max_latency = (to_multiplier * 8 / max) - 1;
3710 if (latency > 499 || latency > max_latency)
3711 return -EINVAL;
3712
3713 return 0;
3714}
3715
3716static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3717 struct l2cap_cmd_hdr *cmd, u8 *data)
3718{
3719 struct hci_conn *hcon = conn->hcon;
3720 struct l2cap_conn_param_update_req *req;
3721 struct l2cap_conn_param_update_rsp rsp;
3722 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3723 int err;
de73115a
CT		 3724
3725 if (!(hcon->link_mode & HCI_LM_MASTER))
3726 return -EINVAL;
3727
3728 cmd_len = __le16_to_cpu(cmd->len);
3729 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3730 return -EPROTO;
3731
3732 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3733 min = __le16_to_cpu(req->min);
3734 max = __le16_to_cpu(req->max);
de73115a
CT		 3735 latency = __le16_to_cpu(req->latency);
3736 to_multiplier = __le16_to_cpu(req->to_multiplier);
3737
3738 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3739 min, max, latency, to_multiplier);
3740
3741 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3742
3743 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3744 if (err)
de73115a
CT		 3745 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3746 else
3747 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3748
3749 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3750 sizeof(rsp), &rsp);
3751
2ce603eb
CT		 3752 if (!err)
3753 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3754
de73115a
CT		 3755 return 0;
3756}
3757
3300d9a9
CT		 3758static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3759 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3760{
3761 int err = 0;
3762
3763 switch (cmd->code) {
3764 case L2CAP_COMMAND_REJ:
3765 l2cap_command_rej(conn, cmd, data);
3766 break;
3767
3768 case L2CAP_CONN_REQ:
3769 err = l2cap_connect_req(conn, cmd, data);
3770 break;
3771
3772 case L2CAP_CONN_RSP:
3773 err = l2cap_connect_rsp(conn, cmd, data);
3774 break;
3775
3776 case L2CAP_CONF_REQ:
3777 err = l2cap_config_req(conn, cmd, cmd_len, data);
3778 break;
3779
3780 case L2CAP_CONF_RSP:
3781 err = l2cap_config_rsp(conn, cmd, data);
3782 break;
3783
3784 case L2CAP_DISCONN_REQ:
3785 err = l2cap_disconnect_req(conn, cmd, data);
3786 break;
3787
3788 case L2CAP_DISCONN_RSP:
3789 err = l2cap_disconnect_rsp(conn, cmd, data);
3790 break;
3791
3792 case L2CAP_ECHO_REQ:
3793 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3794 break;
3795
3796 case L2CAP_ECHO_RSP:
3797 break;
3798
3799 case L2CAP_INFO_REQ:
3800 err = l2cap_information_req(conn, cmd, data);
3801 break;
3802
3803 case L2CAP_INFO_RSP:
3804 err = l2cap_information_rsp(conn, cmd, data);
3805 break;
3806
f94ff6ff
MM		 3807 case L2CAP_CREATE_CHAN_REQ:
3808 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3809 break;
3810
3811 case L2CAP_CREATE_CHAN_RSP:
3812 err = l2cap_create_channel_rsp(conn, cmd, data);
3813 break;
3814
8d5a04a1
MM		 3815 case L2CAP_MOVE_CHAN_REQ:
3816 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3817 break;
3818
3819 case L2CAP_MOVE_CHAN_RSP:
3820 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3821 break;
3822
3823 case L2CAP_MOVE_CHAN_CFM:
3824 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3825 break;
3826
3827 case L2CAP_MOVE_CHAN_CFM_RSP:
3828 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3829 break;
3830
3300d9a9
CT		 3831 default:
3832 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3833 err = -EINVAL;
3834 break;
3835 }
3836
3837 return err;
3838}
3839
3840static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3841 struct l2cap_cmd_hdr *cmd, u8 *data)
3842{
3843 switch (cmd->code) {
3844 case L2CAP_COMMAND_REJ:
3845 return 0;
3846
3847 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3848 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3849
3850 case L2CAP_CONN_PARAM_UPDATE_RSP:
3851 return 0;
3852
3853 default:
3854 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3855 return -EINVAL;
3856 }
3857}
3858
3859static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3860 struct sk_buff *skb)
1da177e4
LT		 3861{
3862 u8 *data = skb->data;
3863 int len = skb->len;
3864 struct l2cap_cmd_hdr cmd;
3300d9a9 3865 int err;
1da177e4
LT		 3866
3867 l2cap_raw_recv(conn, skb);
3868
3869 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3870 u16 cmd_len;
1da177e4
LT		 3871 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3872 data += L2CAP_CMD_HDR_SIZE;
3873 len -= L2CAP_CMD_HDR_SIZE;
3874
88219a0f 3875 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3876
88219a0f 3877 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3878
88219a0f 3879 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3880 BT_DBG("corrupted command");
3881 break;
3882 }
3883
3300d9a9
CT		 3884 if (conn->hcon->type == LE_LINK)
3885 err = l2cap_le_sig_cmd(conn, &cmd, data);
3886 else
3887 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3888
3889 if (err) {
e2fd318e 3890 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3891
3892 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3893
3894 /* FIXME: Map err to a valid reason */
e2fd318e 3895 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3896 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3897 }
3898
88219a0f
AV		 3899 data += cmd_len;
3900 len -= cmd_len;
1da177e4
LT		 3901 }
3902
3903 kfree_skb(skb);
3904}
3905
47d1ec61 3906static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3907{
3908 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3909 int hdr_size;
3910
3911 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3912 hdr_size = L2CAP_EXT_HDR_SIZE;
3913 else
3914 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3915
47d1ec61 3916 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3917 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3918 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3919 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3920
3921 if (our_fcs != rcv_fcs)
7a560e5c 3922 return -EBADMSG;
fcc203c3
GP		 3923 }
3924 return 0;
3925}
3926
525cd185 3927static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3928{
88843ab0 3929 u32 control = 0;
d5392c8f 3930
6a026610 3931 chan->frames_sent = 0;
d5392c8f 3932
0b209fae 3933 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3934
e2ab4353 3935 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3936 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3937 l2cap_send_sframe(chan, control);
e2ab4353 3938 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3939 }
3940
e2ab4353 3941 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3942 l2cap_retransmit_frames(chan);
d5392c8f 3943
525cd185 3944 l2cap_ertm_send(chan);
d5392c8f 3945
e2ab4353 3946 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3947 chan->frames_sent == 0) {
ab784b73 3948 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3949 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3950 }
3951}
3952
fb45de7d 3953static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 3954{
3955 struct sk_buff *next_skb;
bfbacc11 3956 int tx_seq_offset, next_tx_seq_offset;
8f17154f 3957
3ce3514f
MM		 3958 bt_cb(skb)->control.txseq = tx_seq;
3959 bt_cb(skb)->control.sar = sar;
8f17154f 3960
f1c6775b 3961 next_skb = skb_peek(&chan->srej_q);
8f17154f 3962
836be934 3963 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 3964
039d9572 3965 while (next_skb) {
3ce3514f 3966 if (bt_cb(next_skb)->control.txseq == tx_seq)
9b53350d
JPRV		 3967 return -EINVAL;
3968
836be934 3969 next_tx_seq_offset = __seq_offset(chan,
3ce3514f 3970 bt_cb(next_skb)->control.txseq, chan->buffer_seq);
bfbacc11
JPRV		 3971
3972 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 3973 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 3974 return 0;
8f17154f
GP		 3975 }
3976
f1c6775b 3977 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 3978 next_skb = NULL;
3979 else
3980 next_skb = skb_queue_next(&chan->srej_q, next_skb);
3981 }
8f17154f 3982
f1c6775b 3983 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 3984
3985 return 0;
8f17154f
GP		 3986}
3987
84084a31
MM		 3988static void append_skb_frag(struct sk_buff *skb,
3989 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 3990{
84084a31
MM		 3991 /* skb->len reflects data in skb as well as all fragments
3992 * skb->data_len reflects only data in fragments
3993 */
3994 if (!skb_has_frag_list(skb))
3995 skb_shinfo(skb)->frag_list = new_frag;
3996
3997 new_frag->next = NULL;
3998
3999 (*last_frag)->next = new_frag;
4000 *last_frag = new_frag;
4001
4002 skb->len += new_frag->len;
4003 skb->data_len += new_frag->len;
4004 skb->truesize += new_frag->truesize;
4005}
4006
88843ab0 4007static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 4008{
4009 int err = -EINVAL;
18778a63 4010
7e0ef6ee
AE		 4011 switch (__get_ctrl_sar(chan, control)) {
4012 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 4013 if (chan->sdu)
4014 break;
18778a63 4015
84084a31
MM		 4016 err = chan->ops->recv(chan->data, skb);
4017 break;
18778a63 4018
7e0ef6ee 4019 case L2CAP_SAR_START:
84084a31
MM		 4020 if (chan->sdu)
4021 break;
18778a63 4022
6f61fd47 4023 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 4024 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 4025
84084a31
MM		 4026 if (chan->sdu_len > chan->imtu) {
4027 err = -EMSGSIZE;
4028 break;
4029 }
1890d36b 4030
84084a31
MM		 4031 if (skb->len >= chan->sdu_len)
4032 break;
18778a63 4033
84084a31
MM		 4034 chan->sdu = skb;
4035 chan->sdu_last_frag = skb;
18778a63 4036
84084a31
MM		 4037 skb = NULL;
4038 err = 0;
18778a63
GP		 4039 break;
4040
7e0ef6ee 4041 case L2CAP_SAR_CONTINUE:
6f61fd47 4042 if (!chan->sdu)
84084a31 4043 break;
18778a63 4044
84084a31
MM		 4045 append_skb_frag(chan->sdu, skb,
4046 &chan->sdu_last_frag);
4047 skb = NULL;
18778a63 4048
84084a31
MM		 4049 if (chan->sdu->len >= chan->sdu_len)
4050 break;
4178ba46 4051
84084a31 4052 err = 0;
18778a63
GP		 4053 break;
4054
7e0ef6ee 4055 case L2CAP_SAR_END:
6f61fd47 4056 if (!chan->sdu)
84084a31 4057 break;
18778a63 4058
84084a31
MM		 4059 append_skb_frag(chan->sdu, skb,
4060 &chan->sdu_last_frag);
4061 skb = NULL;
4178ba46 4062
84084a31
MM		 4063 if (chan->sdu->len != chan->sdu_len)
4064 break;
18778a63 4065
84084a31 4066 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 4067
84084a31
MM		 4068 if (!err) {
4069 /* Reassembly complete */
4070 chan->sdu = NULL;
4071 chan->sdu_last_frag = NULL;
4072 chan->sdu_len = 0;
1890d36b 4073 }
18778a63
GP		 4074 break;
4075 }
4076
84084a31
MM		 4077 if (err) {
4078 kfree_skb(skb);
4079 kfree_skb(chan->sdu);
4080 chan->sdu = NULL;
4081 chan->sdu_last_frag = NULL;
4082 chan->sdu_len = 0;
4083 }
18778a63 4084
84084a31 4085 return err;
18778a63
GP		 4086}
4087
26f880d2 4088static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 4089{
26f880d2 4090 BT_DBG("chan %p, Enter local busy", chan);
712132eb 4091
26f880d2 4092 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3c588192 4093 l2cap_seq_list_clear(&chan->srej_list);
26f880d2 4094
77f918bc 4095 __set_ack_timer(chan);
26f880d2
MM		 4096}
4097
4098static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
4099{
88843ab0 4100 u32 control;
712132eb 4101
e2ab4353 4102 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 4103 goto done;
4104
0b209fae 4105 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 4106 control |= __set_ctrl_poll(chan);
ab784b73 4107 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 4108 l2cap_send_sframe(chan, control);
6a026610 4109 chan->retry_count = 1;
712132eb 4110
1a09bcb9
GP		 4111 __clear_retrans_timer(chan);
4112 __set_monitor_timer(chan);
712132eb 4113
e2ab4353 4114 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 4115
4116done:
e2ab4353
GP		 4117 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4118 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 4119
49208c9c 4120 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 4121}
4122
e328140f 4123void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 4124{
e328140f
MM		 4125 if (chan->mode == L2CAP_MODE_ERTM) {
4126 if (busy)
4127 l2cap_ertm_enter_local_busy(chan);
4128 else
4129 l2cap_ertm_exit_local_busy(chan);
1890d36b 4130 }
1890d36b
GP		 4131}
4132
fb45de7d 4133static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 4134{
4135 struct sk_buff *skb;
88843ab0 4136 u32 control;
8f17154f 4137
e328140f
MM		 4138 while ((skb = skb_peek(&chan->srej_q)) &&
4139 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4140 int err;
4141
3ce3514f 4142 if (bt_cb(skb)->control.txseq != tx_seq)
8f17154f
GP		 4143 break;
4144
f1c6775b 4145 skb = skb_dequeue(&chan->srej_q);
3ce3514f 4146 control = __set_ctrl_sar(chan, bt_cb(skb)->control.sar);
84084a31 4147 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 4148
4149 if (err < 0) {
4150 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4151 break;
4152 }
4153
836be934
AE		 4154 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
4155 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 4156 }
4157}
4158
fb45de7d 4159static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4160{
8f17154f 4161 struct srej_list *l, *tmp;
88843ab0 4162 u32 control;
8f17154f 4163
39d5a3ee 4164 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 4165 if (l->tx_seq == tx_seq) {
4166 list_del(&l->list);
4167 kfree(l);
4168 return;
4169 }
ab784b73 4170 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4171 control |= __set_reqseq(chan, l->tx_seq);
525cd185 4172 l2cap_send_sframe(chan, control);
8f17154f 4173 list_del(&l->list);
39d5a3ee 4174 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 4175 }
4176}
4177
aef89f21 4178static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4179{
8f17154f 4180 struct srej_list *new;
88843ab0 4181 u32 control;
8f17154f 4182
42e5c802 4183 while (tx_seq != chan->expected_tx_seq) {
ab784b73 4184 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4185 control |= __set_reqseq(chan, chan->expected_tx_seq);
3c588192 4186 l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
525cd185 4187 l2cap_send_sframe(chan, control);
8f17154f
GP		 4188
4189 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 4190 if (!new)
4191 return -ENOMEM;
4192
42e5c802 4193 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 4194
4195 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4196
39d5a3ee 4197 list_add_tail(&new->list, &chan->srej_l);
8f17154f 4198 }
836be934
AE		 4199
4200 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 4201
4202 return 0;
8f17154f
GP		 4203}
4204
88843ab0 4205static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 4206{
fb45de7d 4207 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 4208 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 4209 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 4210 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 4211 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 4212 int err = 0;
4213
88843ab0 4214 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 4215 tx_seq, rx_control);
1c2acffb 4216
03f6715d 4217 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4218 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4219 __clear_monitor_timer(chan);
6a026610 4220 if (chan->unacked_frames > 0)
1a09bcb9 4221 __set_retrans_timer(chan);
e2ab4353 4222 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 4223 }
4224
42e5c802
GP		 4225 chan->expected_ack_seq = req_seq;
4226 l2cap_drop_acked_frames(chan);
9f121a5a 4227
836be934 4228 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4229
4230 /* invalid tx_seq */
47d1ec61 4231 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 4232 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 4233 goto drop;
4234 }
4235
77f918bc
SJ		 4236 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4237 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4238 l2cap_send_ack(chan);
1890d36b 4239 goto drop;
77f918bc 4240 }
1890d36b 4241
02f1b641
MM		 4242 if (tx_seq == chan->expected_tx_seq)
4243 goto expected;
4244
e2ab4353 4245 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 4246 struct srej_list *first;
30afb5b2 4247
39d5a3ee 4248 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 4249 struct srej_list, list);
4250 if (tx_seq == first->tx_seq) {
42e5c802 4251 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 4252 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 4253
4254 list_del(&first->list);
4255 kfree(first);
4256
39d5a3ee 4257 if (list_empty(&chan->srej_l)) {
42e5c802 4258 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 4259 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 4260 l2cap_send_ack(chan);
49208c9c 4261 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 4262 }
4263 } else {
4264 struct srej_list *l;
9b53350d
JPRV		 4265
4266 /* duplicated tx_seq */
42e5c802 4267 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 4268 goto drop;
8f17154f 4269
39d5a3ee 4270 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 4271 if (l->tx_seq == tx_seq) {
525cd185 4272 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 4273 return 0;
4274 }
4275 }
aef89f21
SJ		 4276
4277 err = l2cap_send_srejframe(chan, tx_seq);
4278 if (err < 0) {
4279 l2cap_send_disconn_req(chan->conn, chan, -err);
4280 return err;
4281 }
30afb5b2
GP		 4282 }
4283 } else {
836be934
AE		 4284 expected_tx_seq_offset = __seq_offset(chan,
4285 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4286
4287 /* duplicated tx_seq */
4288 if (tx_seq_offset < expected_tx_seq_offset)
4289 goto drop;
4290
e2ab4353 4291 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 4292
49208c9c 4293 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 4294
39d5a3ee 4295 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 4296 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 4297
f1c6775b 4298 __skb_queue_head_init(&chan->srej_q);
42e5c802 4299 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 4300
0ef3ef0f
SJ		 4301 /* Set P-bit only if there are some I-frames to ack. */
4302 if (__clear_ack_timer(chan))
4303 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 4304
aef89f21
SJ		 4305 err = l2cap_send_srejframe(chan, tx_seq);
4306 if (err < 0) {
4307 l2cap_send_disconn_req(chan->conn, chan, -err);
4308 return err;
4309 }
1c2acffb 4310 }
30afb5b2
GP		 4311 return 0;
4312
8f17154f 4313expected:
836be934 4314 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 4315
e2ab4353 4316 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3ce3514f
MM		 4317 bt_cb(skb)->control.txseq = tx_seq;
4318 bt_cb(skb)->control.sar = sar;
f1c6775b 4319 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 4320 return 0;
4321 }
4322
84084a31 4323 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 4324 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4325
e328140f
MM		 4326 if (err < 0) {
4327 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4328 return err;
4329 }
2ece3684 4330
03f6715d 4331 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4332 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4333 l2cap_retransmit_frames(chan);
4ec10d97
GP		 4334 }
4335
c1b4f43b 4336
6a026610
GP		 4337 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4338 if (chan->num_acked == num_to_ack - 1)
525cd185 4339 l2cap_send_ack(chan);
4d611e4d
GP		 4340 else
4341 __set_ack_timer(chan);
9e917af1 4342
8f17154f 4343 return 0;
9b53350d
JPRV		 4344
4345drop:
4346 kfree_skb(skb);
4347 return 0;
1c2acffb
GP		 4348}
4349
88843ab0 4350static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 4351{
88843ab0 4352 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 4353 __get_reqseq(chan, rx_control), rx_control);
0e98958d 4354
0b209fae 4355 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 4356 l2cap_drop_acked_frames(chan);
1c2acffb 4357
e3781735 4358 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 4359 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4360 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4361 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4362 (chan->unacked_frames > 0))
1a09bcb9 4363 __set_retrans_timer(chan);
05fbd89d 4364
e2ab4353 4365 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 4366 l2cap_send_srejtail(chan);
05fbd89d 4367 } else {
525cd185 4368 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 4369 }
1d8f5d16 4370
03f6715d 4371 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4372 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4373
e2ab4353 4374 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4375 l2cap_retransmit_frames(chan);
2246b2f1 4376
e072745f 4377 } else {
e2ab4353 4378 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4379 (chan->unacked_frames > 0))
1a09bcb9 4380 __set_retrans_timer(chan);
1c2acffb 4381
e2ab4353
GP		 4382 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4383 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4384 l2cap_send_ack(chan);
894718a6 4385 else
525cd185 4386 l2cap_ertm_send(chan);
e072745f
GP		 4387 }
4388}
2246b2f1 4389
88843ab0 4390static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4391{
0b209fae 4392 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4393
88843ab0 4394 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4395
e2ab4353 4396 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4397
42e5c802
GP		 4398 chan->expected_ack_seq = tx_seq;
4399 l2cap_drop_acked_frames(chan);
e072745f 4400
03f6715d 4401 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4402 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4403 l2cap_retransmit_frames(chan);
e072745f 4404 } else {
525cd185 4405 l2cap_retransmit_frames(chan);
30afb5b2 4406
e2ab4353
GP		 4407 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4408 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4409 }
4410}
88843ab0 4411static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4412{
0b209fae 4413 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4414
88843ab0 4415 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4416
e2ab4353 4417 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4418
e3781735 4419 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4420 chan->expected_ack_seq = tx_seq;
4421 l2cap_drop_acked_frames(chan);
3cb123d1 4422
e2ab4353 4423 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4424 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4425
525cd185 4426 l2cap_ertm_send(chan);
dfc909be 4427
e2ab4353 4428 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4429 chan->srej_save_reqseq = tx_seq;
e2ab4353 4430 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4431 }
03f6715d 4432 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4433 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4434 chan->srej_save_reqseq == tx_seq)
e2ab4353 4435 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4436 else
525cd185 4437 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4438 } else {
525cd185 4439 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4440 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4441 chan->srej_save_reqseq = tx_seq;
e2ab4353 4442 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4443 }
e072745f
GP		 4444 }
4445}
4446
88843ab0 4447static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4448{
0b209fae 4449 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4450
88843ab0 4451 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4452
e2ab4353 4453 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4454 chan->expected_ack_seq = tx_seq;
4455 l2cap_drop_acked_frames(chan);
e072745f 4456
e3781735 4457 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4458 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4459
e2ab4353 4460 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4461 __clear_retrans_timer(chan);
e3781735 4462 if (__is_ctrl_poll(chan, rx_control))
525cd185 4463 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4464 return;
e072745f 4465 }
99b0d4b7 4466
e3781735 4467 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4468 l2cap_send_srejtail(chan);
ab784b73
AE		 4469 } else {
4470 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4471 l2cap_send_sframe(chan, rx_control);
4472 }
e072745f
GP		 4473}
4474
88843ab0 4475static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4476{
88843ab0 4477 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4478
03f6715d 4479 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4480 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4481 __clear_monitor_timer(chan);
6a026610 4482 if (chan->unacked_frames > 0)
1a09bcb9 4483 __set_retrans_timer(chan);
e2ab4353 4484 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4485 }
4486
ab784b73
AE		 4487 switch (__get_ctrl_super(chan, rx_control)) {
4488 case L2CAP_SUPER_RR:
525cd185 4489 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4490 break;
4491
ab784b73 4492 case L2CAP_SUPER_REJ:
525cd185 4493 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4494 break;
2246b2f1 4495
ab784b73 4496 case L2CAP_SUPER_SREJ:
525cd185 4497 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4498 break;
4499
ab784b73 4500 case L2CAP_SUPER_RNR:
525cd185 4501 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4502 break;
4503 }
4504
faaebd19 4505 kfree_skb(skb);
1c2acffb
GP		 4506 return 0;
4507}
4508
cad8f1d0 4509static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
218bb9df 4510{
88843ab0 4511 u32 control;
0b209fae 4512 u16 req_seq;
218bb9df
GP		 4513 int len, next_tx_seq_offset, req_seq_offset;
4514
b76bbd66
MM		 4515 __unpack_control(chan, skb);
4516
88843ab0
AE		 4517 control = __get_control(chan, skb->data);
4518 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4519 len = skb->len;
4520
4521 /*
4522 * We can just drop the corrupted I-frame here.
4523 * Receiver will miss it and start proper recovery
4524 * procedures and ask retransmission.
4525 */
47d1ec61 4526 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4527 goto drop;
4528
793c2f1c 4529 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4530 len -= L2CAP_SDULEN_SIZE;
218bb9df 4531
47d1ec61 4532 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4533 len -= L2CAP_FCS_SIZE;
218bb9df 4534
47d1ec61 4535 if (len > chan->mps) {
8c1d787b 4536 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4537 goto drop;
4538 }
4539
0b209fae 4540 req_seq = __get_reqseq(chan, control);
218bb9df 4541
836be934
AE		 4542 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4543
4544 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4545 chan->expected_ack_seq);
218bb9df
GP		 4546
4547 /* check for invalid req-seq */
4548 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4549 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4550 goto drop;
4551 }
4552
793c2f1c 4553 if (!__is_sframe(chan, control)) {
218bb9df 4554 if (len < 0) {
8c1d787b 4555 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4556 goto drop;
4557 }
4558
525cd185 4559 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4560 } else {
4561 if (len != 0) {
4562 BT_ERR("%d", len);
8c1d787b 4563 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4564 goto drop;
4565 }
4566
525cd185 4567 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4568 }
4569
4570 return 0;
4571
4572drop:
4573 kfree_skb(skb);
4574 return 0;
4575}
4576
1da177e4
LT		 4577static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4578{
48454079 4579 struct l2cap_chan *chan;
88843ab0 4580 u32 control;
fb45de7d 4581 u16 tx_seq;
218bb9df 4582 int len;
1da177e4 4583
baa7e1fa 4584 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4585 if (!chan) {
1da177e4 4586 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 4587 /* Drop packet and return */
3379013b 4588 kfree_skb(skb);
6be36555 4589 return 0;
1da177e4
LT		 4590 }
4591
6be36555 4592 l2cap_chan_lock(chan);
6840ed07 4593
49208c9c 4594 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4595
89bc500e 4596 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4597 goto drop;
4598
0c1bc5c6 4599 switch (chan->mode) {
1c2acffb
GP		 4600 case L2CAP_MODE_BASIC:
4601 /* If socket recv buffers overflows we drop data here
4602 * which is *bad* because L2CAP has to be reliable.
4603 * But we don't have any other choice. L2CAP doesn't
4604 * provide flow control mechanism. */
1da177e4 4605
0c1bc5c6 4606 if (chan->imtu < skb->len)
1c2acffb 4607 goto drop;
1da177e4 4608
23070494 4609 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4610 goto done;
4611 break;
4612
4613 case L2CAP_MODE_ERTM:
5ef8cb9e 4614 l2cap_ertm_data_rcv(chan, skb);
1c2acffb 4615
fcafde2e 4616 goto done;
1c2acffb 4617
6840ed07 4618 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4619 control = __get_control(chan, skb->data);
4620 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4621 len = skb->len;
4622
47d1ec61 4623 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4624 goto drop;
4625
7e0ef6ee 4626 if (__is_sar_start(chan, control))
03a51213 4627 len -= L2CAP_SDULEN_SIZE;
6840ed07 4628
47d1ec61 4629 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4630 len -= L2CAP_FCS_SIZE;
fcc203c3 4631
793c2f1c 4632 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4633 goto drop;
4634
fb45de7d 4635 tx_seq = __get_txseq(chan, control);
6840ed07 4636
84084a31
MM		 4637 if (chan->expected_tx_seq != tx_seq) {
4638 /* Frame(s) missing - must discard partial SDU */
4639 kfree_skb(chan->sdu);
4640 chan->sdu = NULL;
4641 chan->sdu_last_frag = NULL;
4642 chan->sdu_len = 0;
6840ed07 4643
84084a31
MM		 4644 /* TODO: Notify userland of missing data */
4645 }
4646
836be934 4647 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4648
4649 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4650 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4651
4652 goto done;
4653
1c2acffb 4654 default:
0c1bc5c6 4655 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4656 break;
4657 }
1da177e4
LT		 4658
4659drop:
4660 kfree_skb(skb);
4661
4662done:
6be36555 4663 l2cap_chan_unlock(chan);
0139418c 4664
1da177e4
LT		 4665 return 0;
4666}
4667
8e036fc3 4668static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4669{
23691d75 4670 struct l2cap_chan *chan;
1da177e4 4671
c2287681 4672 chan = l2cap_global_chan_by_psm(0, psm, conn->src, conn->dst);
23691d75 4673 if (!chan)
1da177e4
LT		 4674 goto drop;
4675
5b4cedaa 4676 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4677
89bc500e 4678 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4679 goto drop;
4680
e13e21dc 4681 if (chan->imtu < skb->len)
1da177e4
LT		 4682 goto drop;
4683
23070494 4684 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4685 return 0;
1da177e4
LT		 4686
4687drop:
4688 kfree_skb(skb);
4689
1da177e4
LT		 4690 return 0;
4691}
4692
d9b88702
AE		 4693static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4694 struct sk_buff *skb)
9f69bda6 4695{
23691d75 4696 struct l2cap_chan *chan;
9f69bda6 4697
c2287681 4698 chan = l2cap_global_chan_by_scid(0, cid, conn->src, conn->dst);
23691d75 4699 if (!chan)
9f69bda6
GP		 4700 goto drop;
4701
5b4cedaa 4702 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 4703
89bc500e 4704 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4705 goto drop;
4706
e13e21dc 4707 if (chan->imtu < skb->len)
9f69bda6
GP		 4708 goto drop;
4709
23070494 4710 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4711 return 0;
9f69bda6
GP		 4712
4713drop:
4714 kfree_skb(skb);
4715
9f69bda6
GP		 4716 return 0;
4717}
4718
1da177e4
LT		 4719static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4720{
4721 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4722 u16 cid, len;
4723 __le16 psm;
1da177e4
LT		 4724
4725 skb_pull(skb, L2CAP_HDR_SIZE);
4726 cid = __le16_to_cpu(lh->cid);
4727 len = __le16_to_cpu(lh->len);
4728
1c2acffb
GP		 4729 if (len != skb->len) {
4730 kfree_skb(skb);
4731 return;
4732 }
4733
1da177e4
LT		 4734 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4735
4736 switch (cid) {
3300d9a9 4737 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4738 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4739 l2cap_sig_channel(conn, skb);
4740 break;
4741
8db4dc46 4742 case L2CAP_CID_CONN_LESS:
097db76c 4743 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 4744 skb_pull(skb, 2);
4745 l2cap_conless_channel(conn, psm, skb);
4746 break;
4747
9f69bda6
GP		 4748 case L2CAP_CID_LE_DATA:
4749 l2cap_att_channel(conn, cid, skb);
4750 break;
4751
b501d6a1
AB		 4752 case L2CAP_CID_SMP:
4753 if (smp_sig_channel(conn, skb))
4754 l2cap_conn_del(conn->hcon, EACCES);
4755 break;
4756
1da177e4
LT		 4757 default:
4758 l2cap_data_channel(conn, cid, skb);
4759 break;
4760 }
4761}
4762
4763/* ---- L2CAP interface with lower layer (HCI) ---- */
4764
686ebf28 4765int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 4766{
4767 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4768 struct l2cap_chan *c;
1da177e4 4769
1da177e4
LT		 4770 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4771
4772 /* Find listening sockets and check their link_mode */
23691d75
GP		 4773 read_lock(&chan_list_lock);
4774 list_for_each_entry(c, &chan_list, global_l) {
4775 struct sock *sk = c->sk;
4343478f 4776
89bc500e 4777 if (c->state != BT_LISTEN)
1da177e4
LT		 4778 continue;
4779
4780 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4781 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4782 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4783 lm1 |= HCI_LM_MASTER;
1da177e4 4784 exact++;
2af6b9d5
MH		 4785 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4786 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4787 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4788 lm2 |= HCI_LM_MASTER;
4789 }
1da177e4 4790 }
23691d75 4791 read_unlock(&chan_list_lock);
1da177e4
LT		 4792
4793 return exact ? lm1 : lm2;
4794}
4795
686ebf28 4796int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 4797{
0139418c
MH		 4798 struct l2cap_conn *conn;
4799
1da177e4
LT		 4800 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4801
1da177e4 4802 if (!status) {
1da177e4
LT		 4803 conn = l2cap_conn_add(hcon, status);
4804 if (conn)
4805 l2cap_conn_ready(conn);
0139418c 4806 } else
e175072f 4807 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4808
4809 return 0;
4810}
4811
686ebf28 4812int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 4813{
4814 struct l2cap_conn *conn = hcon->l2cap_data;
4815
4816 BT_DBG("hcon %p", hcon);
4817
686ebf28 4818 if (!conn)
9f5a0d7b 4819 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4820 return conn->disc_reason;
4821}
4822
686ebf28 4823int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4824{
4825 BT_DBG("hcon %p reason %d", hcon, reason);
4826
e175072f 4827 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 4828 return 0;
4829}
4830
4343478f 4831static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4832{
715ec005 4833 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4834 return;
4835
f62e4323 4836 if (encrypt == 0x00) {
4343478f 4837 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 4838 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4839 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4840 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4841 } else {
4343478f 4842 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4843 __clear_chan_timer(chan);
f62e4323
MH		 4844 }
4845}
4846
686ebf28 4847int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4848{
0139418c 4849 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4850 struct l2cap_chan *chan;
1da177e4 4851
0139418c 4852 if (!conn)
1da177e4 4853 return 0;
0139418c 4854
1da177e4
LT		 4855 BT_DBG("conn %p", conn);
4856
160dc6ac 4857 if (hcon->type == LE_LINK) {
35d4adcc
HG		 4858 if (!status && encrypt)
4859 smp_distribute_keys(conn, 0);
17cd3f37 4860 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 4861 }
4862
3df91ea2 4863 mutex_lock(&conn->chan_lock);
1da177e4 4864
3df91ea2 4865 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 4866 l2cap_chan_lock(chan);
1da177e4 4867
f1cb9af5
VCG		 4868 BT_DBG("chan->scid %d", chan->scid);
4869
4870 if (chan->scid == L2CAP_CID_LE_DATA) {
4871 if (!status && encrypt) {
4872 chan->sec_level = hcon->sec_level;
cf4cd009 4873 l2cap_chan_ready(chan);
f1cb9af5
VCG		 4874 }
4875
6be36555 4876 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 4877 continue;
4878 }
4879
c1360a1c 4880 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 4881 l2cap_chan_unlock(chan);
6a8d3010
MH		 4882 continue;
4883 }
4884
89bc500e
GP		 4885 if (!status && (chan->state == BT_CONNECTED ||
4886 chan->state == BT_CONFIG)) {
4343478f 4887 l2cap_check_encryption(chan, encrypt);
6be36555 4888 l2cap_chan_unlock(chan);
9719f8af
MH		 4889 continue;
4890 }
4891
89bc500e 4892 if (chan->state == BT_CONNECT) {
b1235d79 4893 if (!status) {
9b27f350 4894 l2cap_send_conn_req(chan);
b1235d79 4895 } else {
ba13ccd9 4896 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4897 }
89bc500e 4898 } else if (chan->state == BT_CONNECT2) {
6be36555 4899 struct sock *sk = chan->sk;
b1235d79 4900 struct l2cap_conn_rsp rsp;
df3c3931 4901 __u16 res, stat;
1da177e4 4902
6be36555
AE		 4903 lock_sock(sk);
4904
b1235d79 4905 if (!status) {
df3c3931
JH		 4906 if (bt_sk(sk)->defer_setup) {
4907 struct sock *parent = bt_sk(sk)->parent;
4908 res = L2CAP_CR_PEND;
4909 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4910 if (parent)
4911 parent->sk_data_ready(parent, 0);
df3c3931 4912 } else {
0e587be7 4913 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4914 res = L2CAP_CR_SUCCESS;
4915 stat = L2CAP_CS_NO_INFO;
4916 }
b1235d79 4917 } else {
0e587be7 4918 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 4919 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4920 res = L2CAP_CR_SEC_BLOCK;
4921 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4922 }
4923
6be36555
AE		 4924 release_sock(sk);
4925
fe4128e0
GP		 4926 rsp.scid = cpu_to_le16(chan->dcid);
4927 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4928 rsp.result = cpu_to_le16(res);
4929 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4930 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4931 sizeof(rsp), &rsp);
b1235d79 4932 }
1da177e4 4933
6be36555 4934 l2cap_chan_unlock(chan);
1da177e4
LT		 4935 }
4936
3df91ea2 4937 mutex_unlock(&conn->chan_lock);
b1235d79 4938
1da177e4
LT		 4939 return 0;
4940}
4941
686ebf28 4942int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 4943{
4944 struct l2cap_conn *conn = hcon->l2cap_data;
4945
5a08ecce
AE		 4946 if (!conn)
4947 conn = l2cap_conn_add(hcon, 0);
4948
4949 if (!conn)
1da177e4
LT		 4950 goto drop;
4951
4952 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4953
e702112f 4954 if (!(flags & ACL_CONT)) {
1da177e4 4955 struct l2cap_hdr *hdr;
48454079 4956 struct l2cap_chan *chan;
89794813 4957 u16 cid;
1da177e4
LT		 4958 int len;
4959
4960 if (conn->rx_len) {
4961 BT_ERR("Unexpected start frame (len %d)", skb->len);
4962 kfree_skb(conn->rx_skb);
4963 conn->rx_skb = NULL;
4964 conn->rx_len = 0;
4965 l2cap_conn_unreliable(conn, ECOMM);
4966 }
4967
aae7fe22
AE		 4968 /* Start fragment always begin with Basic L2CAP header */
4969 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 4970 BT_ERR("Frame is too short (len %d)", skb->len);
4971 l2cap_conn_unreliable(conn, ECOMM);
4972 goto drop;
4973 }
4974
4975 hdr = (struct l2cap_hdr *) skb->data;
4976 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 4977 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 4978
4979 if (len == skb->len) {
4980 /* Complete frame received */
4981 l2cap_recv_frame(conn, skb);
4982 return 0;
4983 }
4984
4985 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
4986
4987 if (skb->len > len) {
4988 BT_ERR("Frame is too long (len %d, expected len %d)",
4989 skb->len, len);
4990 l2cap_conn_unreliable(conn, ECOMM);
4991 goto drop;
4992 }
4993
baa7e1fa 4994 chan = l2cap_get_chan_by_scid(conn, cid);
89794813 4995
48454079
GP		 4996 if (chan && chan->sk) {
4997 struct sock *sk = chan->sk;
3df91ea2 4998 lock_sock(sk);
89794813 4999
0c1bc5c6 5000 if (chan->imtu < len - L2CAP_HDR_SIZE) {
48454079
GP		 5001 BT_ERR("Frame exceeding recv MTU (len %d, "
5002 "MTU %d)", len,
0c1bc5c6 5003 chan->imtu);
aa2ac881 5004 release_sock(sk);
48454079
GP		 5005 l2cap_conn_unreliable(conn, ECOMM);
5006 goto drop;
5007 }
aa2ac881 5008 release_sock(sk);
48454079 5009 }
89794813 5010
1da177e4 5011 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 5012 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
5013 if (!conn->rx_skb)
1da177e4
LT		 5014 goto drop;
5015
d626f62b 5016 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5017 skb->len);
1da177e4
LT		 5018 conn->rx_len = len - skb->len;
5019 } else {
5020 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
5021
5022 if (!conn->rx_len) {
5023 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
5024 l2cap_conn_unreliable(conn, ECOMM);
5025 goto drop;
5026 }
5027
5028 if (skb->len > conn->rx_len) {
5029 BT_ERR("Fragment is too long (len %d, expected %d)",
5030 skb->len, conn->rx_len);
5031 kfree_skb(conn->rx_skb);
5032 conn->rx_skb = NULL;
5033 conn->rx_len = 0;
5034 l2cap_conn_unreliable(conn, ECOMM);
5035 goto drop;
5036 }
5037
d626f62b 5038 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 5039 skb->len);
1da177e4
LT		 5040 conn->rx_len -= skb->len;
5041
5042 if (!conn->rx_len) {
5043 /* Complete frame received */
5044 l2cap_recv_frame(conn, conn->rx_skb);
5045 conn->rx_skb = NULL;
5046 }
5047 }
5048
5049drop:
5050 kfree_skb(skb);
5051 return 0;
5052}
5053
aef7d97c 5054static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5055{
23691d75 5056 struct l2cap_chan *c;
1da177e4 5057
333055f2 5058 read_lock(&chan_list_lock);
1da177e4 5059
23691d75
GP		 5060 list_for_each_entry(c, &chan_list, global_l) {
5061 struct sock *sk = c->sk;
101545f6 5062
903d343e 5063 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 5064 batostr(&bt_sk(sk)->src),
5065 batostr(&bt_sk(sk)->dst),
89bc500e 5066 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 5067 c->scid, c->dcid, c->imtu, c->omtu,
5068 c->sec_level, c->mode);
61e1b4b7 5069 }
1da177e4 5070
333055f2 5071 read_unlock(&chan_list_lock);
1da177e4 5072
aef7d97c 5073 return 0;
1da177e4
LT		 5074}
5075
aef7d97c
MH		 5076static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5077{
5078 return single_open(file, l2cap_debugfs_show, inode->i_private);
5079}
5080
5081static const struct file_operations l2cap_debugfs_fops = {
5082 .open = l2cap_debugfs_open,
5083 .read = seq_read,
5084 .llseek = seq_lseek,
5085 .release = single_release,
5086};
5087
5088static struct dentry *l2cap_debugfs;
1da177e4 5089
64274518 5090int __init l2cap_init(void)
1da177e4
LT		 5091{
5092 int err;
be9d1227 5093
bb58f747 5094 err = l2cap_init_sockets();
1da177e4
LT		 5095 if (err < 0)
5096 return err;
5097
aef7d97c
MH		 5098 if (bt_debugfs) {
5099 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5100 bt_debugfs, NULL, &l2cap_debugfs_fops);
5101 if (!l2cap_debugfs)
5102 BT_ERR("Failed to create L2CAP debug file");
5103 }
1da177e4 5104
1da177e4 5105 return 0;
1da177e4
LT		 5106}
5107
64274518 5108void l2cap_exit(void)
1da177e4 5109{
aef7d97c 5110 debugfs_remove(l2cap_debugfs);
bb58f747 5111 l2cap_cleanup_sockets();
1da177e4
LT		 5112}
5113
d1c4a17d
GP		 5114module_param(disable_ertm, bool, 0644);
5115MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)