projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: btusb: Dynamic alternate setting
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / l2cap_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
590051de 6 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 7
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
13
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22
8e87d142
YH		 23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 25 SOFTWARE IS DISCLAIMED.
26*/
27
bb58f747 28/* Bluetooth L2CAP core. */
1da177e4 29
1da177e4
LT		 30#include <linux/module.h>
31
32#include <linux/types.h>
4fc268d2 33#include <linux/capability.h>
1da177e4
LT		 34#include <linux/errno.h>
35#include <linux/kernel.h>
1da177e4
LT		 36#include <linux/sched.h>
37#include <linux/slab.h>
38#include <linux/poll.h>
39#include <linux/fcntl.h>
40#include <linux/init.h>
41#include <linux/interrupt.h>
42#include <linux/socket.h>
43#include <linux/skbuff.h>
1da177e4 44#include <linux/list.h>
be9d1227 45#include <linux/device.h>
aef7d97c
MH		 46#include <linux/debugfs.h>
47#include <linux/seq_file.h>
af05b30b 48#include <linux/uaccess.h>
fcc203c3 49#include <linux/crc16.h>
1da177e4
LT		 50#include <net/sock.h>
51
1da177e4
LT		 52#include <asm/unaligned.h>
53
54#include <net/bluetooth/bluetooth.h>
55#include <net/bluetooth/hci_core.h>
56#include <net/bluetooth/l2cap.h>
b501d6a1 57#include <net/bluetooth/smp.h>
1da177e4 58
eb939922 59bool disable_ertm;
f0709e03 60
47ec1dcd 61static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
50a147cd 62static u8 l2cap_fixed_chan[8] = { L2CAP_FC_L2CAP, };
1da177e4 63
b5ad8b7f
JB		 64static LIST_HEAD(chan_list);
65static DEFINE_RWLOCK(chan_list_lock);
1da177e4 66
1da177e4
LT		 67static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
68 u8 code, u8 ident, u16 dlen, void *data);
4519de9a
GP		 69static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len,
70 void *data);
710f9b0a 71static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data);
4519de9a
GP		 72static void l2cap_send_disconn_req(struct l2cap_conn *conn,
73 struct l2cap_chan *chan, int err);
1da177e4 74
0139418c 75/* ---- L2CAP channels ---- */
71ba0e56 76
baa7e1fa 77static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid)
0139418c 78{
3df91ea2 79 struct l2cap_chan *c;
3d57dc68 80
3df91ea2
AE		 81 list_for_each_entry(c, &conn->chan_l, list) {
82 if (c->dcid == cid)
83 return c;
0139418c 84 }
3df91ea2 85 return NULL;
0139418c
MH		 86}
87
baa7e1fa 88static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 89{
3df91ea2 90 struct l2cap_chan *c;
3d57dc68 91
3df91ea2
AE		 92 list_for_each_entry(c, &conn->chan_l, list) {
93 if (c->scid == cid)
94 return c;
0139418c 95 }
3df91ea2 96 return NULL;
0139418c
MH		 97}
98
99/* Find channel with given SCID.
100 * Returns locked socket */
baa7e1fa 101static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid)
0139418c 102{
48454079 103 struct l2cap_chan *c;
baa7e1fa 104
3df91ea2 105 mutex_lock(&conn->chan_lock);
baa7e1fa 106 c = __l2cap_get_chan_by_scid(conn, cid);
3df91ea2
AE		 107 mutex_unlock(&conn->chan_lock);
108
48454079 109 return c;
0139418c
MH		 110}
111
baa7e1fa 112static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 113{
3df91ea2 114 struct l2cap_chan *c;
3d57dc68 115
3df91ea2
AE		 116 list_for_each_entry(c, &conn->chan_l, list) {
117 if (c->ident == ident)
118 return c;
0139418c 119 }
3df91ea2 120 return NULL;
0139418c
MH		 121}
122
baa7e1fa 123static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident)
0139418c 124{
48454079 125 struct l2cap_chan *c;
baa7e1fa 126
3df91ea2 127 mutex_lock(&conn->chan_lock);
baa7e1fa 128 c = __l2cap_get_chan_by_ident(conn, ident);
3df91ea2
AE		 129 mutex_unlock(&conn->chan_lock);
130
48454079 131 return c;
0139418c
MH		 132}
133
23691d75 134static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src)
9e4425ff 135{
23691d75 136 struct l2cap_chan *c;
9e4425ff 137
23691d75
GP		 138 list_for_each_entry(c, &chan_list, global_l) {
139 if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src))
250938cb 140 return c;
9e4425ff 141 }
250938cb 142 return NULL;
9e4425ff
GP		 143}
144
145int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
146{
73b2ec18
GP		 147 int err;
148
333055f2 149 write_lock(&chan_list_lock);
9e4425ff 150
23691d75 151 if (psm && __l2cap_global_chan_by_addr(psm, src)) {
73b2ec18
GP		 152 err = -EADDRINUSE;
153 goto done;
9e4425ff
GP		 154 }
155
73b2ec18
GP		 156 if (psm) {
157 chan->psm = psm;
158 chan->sport = psm;
159 err = 0;
160 } else {
161 u16 p;
162
163 err = -EINVAL;
164 for (p = 0x1001; p < 0x1100; p += 2)
23691d75 165 if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
73b2ec18
GP		 166 chan->psm = cpu_to_le16(p);
167 chan->sport = cpu_to_le16(p);
168 err = 0;
169 break;
170 }
171 }
9e4425ff 172
73b2ec18 173done:
333055f2 174 write_unlock(&chan_list_lock);
73b2ec18 175 return err;
9e4425ff
GP		 176}
177
178int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid)
179{
333055f2 180 write_lock(&chan_list_lock);
9e4425ff
GP		 181
182 chan->scid = scid;
183
333055f2 184 write_unlock(&chan_list_lock);
9e4425ff
GP		 185
186 return 0;
187}
188
baa7e1fa 189static u16 l2cap_alloc_cid(struct l2cap_conn *conn)
0139418c 190{
8db4dc46 191 u16 cid = L2CAP_CID_DYN_START;
0139418c 192
8db4dc46 193 for (; cid < L2CAP_CID_DYN_END; cid++) {
baa7e1fa 194 if (!__l2cap_get_chan_by_scid(conn, cid))
0139418c
MH		 195 return cid;
196 }
197
198 return 0;
199}
200
0e587be7 201static void __l2cap_state_change(struct l2cap_chan *chan, int state)
89bc500e 202{
42d2d87c 203 BT_DBG("chan %p %s -> %s", chan, state_to_string(chan->state),
badaaa00
GP		 204 state_to_string(state));
205
89bc500e
GP		 206 chan->state = state;
207 chan->ops->state_change(chan->data, state);
208}
209
0e587be7
AE		 210static void l2cap_state_change(struct l2cap_chan *chan, int state)
211{
212 struct sock *sk = chan->sk;
213
214 lock_sock(sk);
215 __l2cap_state_change(chan, state);
216 release_sock(sk);
217}
218
2e0052e4
AE		 219static inline void __l2cap_chan_set_err(struct l2cap_chan *chan, int err)
220{
221 struct sock *sk = chan->sk;
222
223 sk->sk_err = err;
224}
225
226static inline void l2cap_chan_set_err(struct l2cap_chan *chan, int err)
227{
228 struct sock *sk = chan->sk;
229
230 lock_sock(sk);
231 __l2cap_chan_set_err(chan, err);
232 release_sock(sk);
233}
234
3c588192
MM		 235/* ---- L2CAP sequence number lists ---- */
236
237/* For ERTM, ordered lists of sequence numbers must be tracked for
238 * SREJ requests that are received and for frames that are to be
239 * retransmitted. These seq_list functions implement a singly-linked
240 * list in an array, where membership in the list can also be checked
241 * in constant time. Items can also be added to the tail of the list
242 * and removed from the head in constant time, without further memory
243 * allocs or frees.
244 */
245
246static int l2cap_seq_list_init(struct l2cap_seq_list *seq_list, u16 size)
247{
248 size_t alloc_size, i;
249
250 /* Allocated size is a power of 2 to map sequence numbers
251 * (which may be up to 14 bits) in to a smaller array that is
252 * sized for the negotiated ERTM transmit windows.
253 */
254 alloc_size = roundup_pow_of_two(size);
255
256 seq_list->list = kmalloc(sizeof(u16) * alloc_size, GFP_KERNEL);
257 if (!seq_list->list)
258 return -ENOMEM;
259
260 seq_list->mask = alloc_size - 1;
261 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
262 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
263 for (i = 0; i < alloc_size; i++)
264 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
265
266 return 0;
267}
268
269static inline void l2cap_seq_list_free(struct l2cap_seq_list *seq_list)
270{
271 kfree(seq_list->list);
272}
273
274static inline bool l2cap_seq_list_contains(struct l2cap_seq_list *seq_list,
275 u16 seq)
276{
277 /* Constant-time check for list membership */
278 return seq_list->list[seq & seq_list->mask] != L2CAP_SEQ_LIST_CLEAR;
279}
280
281static u16 l2cap_seq_list_remove(struct l2cap_seq_list *seq_list, u16 seq)
282{
283 u16 mask = seq_list->mask;
284
285 if (seq_list->head == L2CAP_SEQ_LIST_CLEAR) {
286 /* In case someone tries to pop the head of an empty list */
287 return L2CAP_SEQ_LIST_CLEAR;
288 } else if (seq_list->head == seq) {
289 /* Head can be removed in constant time */
290 seq_list->head = seq_list->list[seq & mask];
291 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
292
293 if (seq_list->head == L2CAP_SEQ_LIST_TAIL) {
294 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
295 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
296 }
297 } else {
298 /* Walk the list to find the sequence number */
299 u16 prev = seq_list->head;
300 while (seq_list->list[prev & mask] != seq) {
301 prev = seq_list->list[prev & mask];
302 if (prev == L2CAP_SEQ_LIST_TAIL)
303 return L2CAP_SEQ_LIST_CLEAR;
304 }
305
306 /* Unlink the number from the list and clear it */
307 seq_list->list[prev & mask] = seq_list->list[seq & mask];
308 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_CLEAR;
309 if (seq_list->tail == seq)
310 seq_list->tail = prev;
311 }
312 return seq;
313}
314
315static inline u16 l2cap_seq_list_pop(struct l2cap_seq_list *seq_list)
316{
317 /* Remove the head in constant time */
318 return l2cap_seq_list_remove(seq_list, seq_list->head);
319}
320
321static void l2cap_seq_list_clear(struct l2cap_seq_list *seq_list)
322{
323 if (seq_list->head != L2CAP_SEQ_LIST_CLEAR) {
324 u16 i;
325 for (i = 0; i <= seq_list->mask; i++)
326 seq_list->list[i] = L2CAP_SEQ_LIST_CLEAR;
327
328 seq_list->head = L2CAP_SEQ_LIST_CLEAR;
329 seq_list->tail = L2CAP_SEQ_LIST_CLEAR;
330 }
331}
332
333static void l2cap_seq_list_append(struct l2cap_seq_list *seq_list, u16 seq)
334{
335 u16 mask = seq_list->mask;
336
337 /* All appends happen in constant time */
338
339 if (seq_list->list[seq & mask] == L2CAP_SEQ_LIST_CLEAR) {
340 if (seq_list->tail == L2CAP_SEQ_LIST_CLEAR)
341 seq_list->head = seq;
342 else
343 seq_list->list[seq_list->tail & mask] = seq;
344
345 seq_list->tail = seq;
346 seq_list->list[seq & mask] = L2CAP_SEQ_LIST_TAIL;
347 }
348}
349
721c4181 350static void l2cap_chan_timeout(struct work_struct *work)
ab07801d 351{
721c4181
GP		 352 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
353 chan_timer.work);
3df91ea2 354 struct l2cap_conn *conn = chan->conn;
ab07801d
GP		 355 int reason;
356
e05dcc32 357 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
ab07801d 358
3df91ea2 359 mutex_lock(&conn->chan_lock);
6be36555 360 l2cap_chan_lock(chan);
ab07801d 361
89bc500e 362 if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
ab07801d 363 reason = ECONNREFUSED;
89bc500e 364 else if (chan->state == BT_CONNECT &&
ab07801d
GP		 365 chan->sec_level != BT_SECURITY_SDP)
366 reason = ECONNREFUSED;
367 else
368 reason = ETIMEDOUT;
369
0f852724 370 l2cap_chan_close(chan, reason);
ab07801d 371
6be36555 372 l2cap_chan_unlock(chan);
ab07801d 373
ba3bd0ee 374 chan->ops->close(chan->data);
3df91ea2
AE		 375 mutex_unlock(&conn->chan_lock);
376
371fd835 377 l2cap_chan_put(chan);
ab07801d
GP		 378}
379
eef1d9b6 380struct l2cap_chan *l2cap_chan_create(void)
48454079
GP		 381{
382 struct l2cap_chan *chan;
383
384 chan = kzalloc(sizeof(*chan), GFP_ATOMIC);
385 if (!chan)
386 return NULL;
387
c03b355e
AE		 388 mutex_init(&chan->lock);
389
333055f2 390 write_lock(&chan_list_lock);
23691d75 391 list_add(&chan->global_l, &chan_list);
333055f2 392 write_unlock(&chan_list_lock);
23691d75 393
721c4181 394 INIT_DELAYED_WORK(&chan->chan_timer, l2cap_chan_timeout);
ab07801d 395
89bc500e
GP		 396 chan->state = BT_OPEN;
397
71ba0e56
GP		 398 atomic_set(&chan->refcnt, 1);
399
eef1d9b6 400 BT_DBG("chan %p", chan);
abc545b8 401
48454079
GP		 402 return chan;
403}
404
23691d75 405void l2cap_chan_destroy(struct l2cap_chan *chan)
6ff5abbf 406{
333055f2 407 write_lock(&chan_list_lock);
23691d75 408 list_del(&chan->global_l);
333055f2 409 write_unlock(&chan_list_lock);
23691d75 410
371fd835 411 l2cap_chan_put(chan);
6ff5abbf
GP		 412}
413
bd4b1653
AE		 414void l2cap_chan_set_defaults(struct l2cap_chan *chan)
415{
416 chan->fcs = L2CAP_FCS_CRC16;
417 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
418 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
419 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
420 chan->sec_level = BT_SECURITY_LOW;
421
422 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
423}
424
14a28491 425static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
0139418c 426{
af05b30b 427 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
097db76c 428 __le16_to_cpu(chan->psm), chan->dcid);
0139418c 429
9f5a0d7b 430 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 431
8c1d787b 432 chan->conn = conn;
0139418c 433
5491120e
AE		 434 switch (chan->chan_type) {
435 case L2CAP_CHAN_CONN_ORIENTED:
b62f328b
VT		 436 if (conn->hcon->type == LE_LINK) {
437 /* LE connection */
0c1bc5c6 438 chan->omtu = L2CAP_LE_DEFAULT_MTU;
fe4128e0
GP		 439 chan->scid = L2CAP_CID_LE_DATA;
440 chan->dcid = L2CAP_CID_LE_DATA;
b62f328b
VT		 441 } else {
442 /* Alloc CID for connection-oriented socket */
fe4128e0 443 chan->scid = l2cap_alloc_cid(conn);
0c1bc5c6 444 chan->omtu = L2CAP_DEFAULT_MTU;
b62f328b 445 }
5491120e
AE		 446 break;
447
448 case L2CAP_CHAN_CONN_LESS:
0139418c 449 /* Connectionless socket */
fe4128e0
GP		 450 chan->scid = L2CAP_CID_CONN_LESS;
451 chan->dcid = L2CAP_CID_CONN_LESS;
0c1bc5c6 452 chan->omtu = L2CAP_DEFAULT_MTU;
5491120e
AE		 453 break;
454
455 default:
0139418c 456 /* Raw socket can send/recv signalling messages only */
fe4128e0
GP		 457 chan->scid = L2CAP_CID_SIGNALING;
458 chan->dcid = L2CAP_CID_SIGNALING;
0c1bc5c6 459 chan->omtu = L2CAP_DEFAULT_MTU;
0139418c
MH		 460 }
461
8f7975b1
AE		 462 chan->local_id = L2CAP_BESTEFFORT_ID;
463 chan->local_stype = L2CAP_SERV_BESTEFFORT;
464 chan->local_msdu = L2CAP_DEFAULT_MAX_SDU_SIZE;
465 chan->local_sdu_itime = L2CAP_DEFAULT_SDU_ITIME;
466 chan->local_acc_lat = L2CAP_DEFAULT_ACC_LAT;
467 chan->local_flush_to = L2CAP_DEFAULT_FLUSH_TO;
468
371fd835 469 l2cap_chan_hold(chan);
baa7e1fa 470
3df91ea2 471 list_add(&chan->list, &conn->chan_l);
643162a8
AE		 472}
473
14a28491 474static void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan)
643162a8
AE		 475{
476 mutex_lock(&conn->chan_lock);
477 __l2cap_chan_add(conn, chan);
3df91ea2 478 mutex_unlock(&conn->chan_lock);
0139418c
MH		 479}
480
4519de9a 481static void l2cap_chan_del(struct l2cap_chan *chan, int err)
0139418c 482{
48454079 483 struct sock *sk = chan->sk;
8c1d787b 484 struct l2cap_conn *conn = chan->conn;
0139418c
MH		 485 struct sock *parent = bt_sk(sk)->parent;
486
c9b66675 487 __clear_chan_timer(chan);
0139418c 488
49208c9c 489 BT_DBG("chan %p, conn %p, err %d", chan, conn, err);
0139418c 490
8e87d142 491 if (conn) {
baa7e1fa 492 /* Delete from channel list */
3df91ea2 493 list_del(&chan->list);
3d57dc68 494
371fd835 495 l2cap_chan_put(chan);
baa7e1fa 496
8c1d787b 497 chan->conn = NULL;
0139418c
MH		 498 hci_conn_put(conn->hcon);
499 }
500
6be36555
AE		 501 lock_sock(sk);
502
0e587be7 503 __l2cap_state_change(chan, BT_CLOSED);
0139418c
MH		 504 sock_set_flag(sk, SOCK_ZAPPED);
505
506 if (err)
2e0052e4 507 __l2cap_chan_set_err(chan, err);
0139418c
MH		 508
509 if (parent) {
510 bt_accept_unlink(sk);
511 parent->sk_data_ready(parent, 0);
512 } else
513 sk->sk_state_change(sk);
c13ffa62 514
6be36555
AE		 515 release_sock(sk);
516
c1360a1c
GP		 517 if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) &&
518 test_bit(CONF_INPUT_DONE, &chan->conf_state)))
6ff5abbf 519 return;
2ead70b8 520
58d35f87 521 skb_queue_purge(&chan->tx_q);
c13ffa62 522
0c1bc5c6 523 if (chan->mode == L2CAP_MODE_ERTM) {
c13ffa62
GP		 524 struct srej_list *l, *tmp;
525
1a09bcb9
GP		 526 __clear_retrans_timer(chan);
527 __clear_monitor_timer(chan);
528 __clear_ack_timer(chan);
c13ffa62 529
f1c6775b 530 skb_queue_purge(&chan->srej_q);
c13ffa62 531
3c588192
MM		 532 l2cap_seq_list_free(&chan->srej_list);
533 l2cap_seq_list_free(&chan->retrans_list);
39d5a3ee 534 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
c13ffa62
GP		 535 list_del(&l->list);
536 kfree(l);
537 }
538 }
0139418c
MH		 539}
540
4519de9a
GP		 541static void l2cap_chan_cleanup_listen(struct sock *parent)
542{
543 struct sock *sk;
544
545 BT_DBG("parent %p", parent);
546
547 /* Close not yet accepted channels */
0f852724 548 while ((sk = bt_accept_dequeue(parent, NULL))) {
ba3bd0ee 549 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
3df91ea2 550
6be36555 551 l2cap_chan_lock(chan);
c9b66675 552 __clear_chan_timer(chan);
ba3bd0ee 553 l2cap_chan_close(chan, ECONNRESET);
6be36555 554 l2cap_chan_unlock(chan);
3df91ea2 555
ba3bd0ee 556 chan->ops->close(chan->data);
0f852724 557 }
4519de9a
GP		 558}
559
0f852724 560void l2cap_chan_close(struct l2cap_chan *chan, int reason)
4519de9a
GP		 561{
562 struct l2cap_conn *conn = chan->conn;
563 struct sock *sk = chan->sk;
564
e05dcc32
AE		 565 BT_DBG("chan %p state %s sk %p", chan,
566 state_to_string(chan->state), sk);
4519de9a 567
89bc500e 568 switch (chan->state) {
4519de9a 569 case BT_LISTEN:
6be36555 570 lock_sock(sk);
4519de9a 571 l2cap_chan_cleanup_listen(sk);
89bc500e 572
0e587be7 573 __l2cap_state_change(chan, BT_CLOSED);
89bc500e 574 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 575 release_sock(sk);
4519de9a
GP		 576 break;
577
578 case BT_CONNECTED:
579 case BT_CONFIG:
715ec005 580 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a 581 conn->hcon->type == ACL_LINK) {
c9b66675 582 __set_chan_timer(chan, sk->sk_sndtimeo);
4519de9a
GP		 583 l2cap_send_disconn_req(conn, chan, reason);
584 } else
585 l2cap_chan_del(chan, reason);
586 break;
587
588 case BT_CONNECT2:
715ec005 589 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED &&
4519de9a
GP		 590 conn->hcon->type == ACL_LINK) {
591 struct l2cap_conn_rsp rsp;
592 __u16 result;
593
594 if (bt_sk(sk)->defer_setup)
595 result = L2CAP_CR_SEC_BLOCK;
596 else
597 result = L2CAP_CR_BAD_PSM;
89bc500e 598 l2cap_state_change(chan, BT_DISCONN);
4519de9a
GP		 599
600 rsp.scid = cpu_to_le16(chan->dcid);
601 rsp.dcid = cpu_to_le16(chan->scid);
602 rsp.result = cpu_to_le16(result);
603 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
604 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
605 sizeof(rsp), &rsp);
606 }
607
608 l2cap_chan_del(chan, reason);
609 break;
610
611 case BT_CONNECT:
612 case BT_DISCONN:
613 l2cap_chan_del(chan, reason);
614 break;
615
616 default:
6be36555 617 lock_sock(sk);
4519de9a 618 sock_set_flag(sk, SOCK_ZAPPED);
6be36555 619 release_sock(sk);
4519de9a
GP		 620 break;
621 }
622}
623
4343478f 624static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan)
79d554a6 625{
715ec005 626 if (chan->chan_type == L2CAP_CHAN_RAW) {
4343478f 627 switch (chan->sec_level) {
8556edd3
JH		 628 case BT_SECURITY_HIGH:
629 return HCI_AT_DEDICATED_BONDING_MITM;
630 case BT_SECURITY_MEDIUM:
631 return HCI_AT_DEDICATED_BONDING;
632 default:
633 return HCI_AT_NO_BONDING;
634 }
fe4128e0 635 } else if (chan->psm == cpu_to_le16(0x0001)) {
4343478f
GP		 636 if (chan->sec_level == BT_SECURITY_LOW)
637 chan->sec_level = BT_SECURITY_SDP;
0684e5f9 638
4343478f 639 if (chan->sec_level == BT_SECURITY_HIGH)
8556edd3 640 return HCI_AT_NO_BONDING_MITM;
00ae4af9 641 else
8556edd3 642 return HCI_AT_NO_BONDING;
00ae4af9 643 } else {
4343478f 644 switch (chan->sec_level) {
00ae4af9 645 case BT_SECURITY_HIGH:
8556edd3 646 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 647 case BT_SECURITY_MEDIUM:
8556edd3 648 return HCI_AT_GENERAL_BONDING;
00ae4af9 649 default:
8556edd3 650 return HCI_AT_NO_BONDING;
00ae4af9 651 }
0684e5f9 652 }
8556edd3
JH		 653}
654
655/* Service level security */
d45fc423 656int l2cap_chan_check_security(struct l2cap_chan *chan)
8556edd3 657{
8c1d787b 658 struct l2cap_conn *conn = chan->conn;
8556edd3
JH		 659 __u8 auth_type;
660
4343478f 661 auth_type = l2cap_get_auth_type(chan);
79d554a6 662
4343478f 663 return hci_conn_security(conn->hcon, chan->sec_level, auth_type);
79d554a6
MH		 664}
665
b5ad8b7f 666static u8 l2cap_get_ident(struct l2cap_conn *conn)
4e8402a3
MH		 667{
668 u8 id;
669
670 /* Get next available identificator.
671 * 1 - 128 are used by kernel.
672 * 129 - 199 are reserved.
673 * 200 - 254 are used by utilities like l2ping, etc.
674 */
675
333055f2 676 spin_lock(&conn->lock);
4e8402a3
MH		 677
678 if (++conn->tx_ident > 128)
679 conn->tx_ident = 1;
680
681 id = conn->tx_ident;
682
333055f2 683 spin_unlock(&conn->lock);
4e8402a3
MH		 684
685 return id;
686}
687
4519de9a 688static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 689{
690 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
e702112f 691 u8 flags;
4e8402a3
MH		 692
693 BT_DBG("code 0x%2.2x", code);
694
695 if (!skb)
9a9c6a34 696 return;
4e8402a3 697
e702112f
AE		 698 if (lmp_no_flush_capable(conn->hcon->hdev))
699 flags = ACL_START_NO_FLUSH;
700 else
701 flags = ACL_START;
702
14b12d0b 703 bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON;
5e59b791 704 skb->priority = HCI_PRIO_MAX;
14b12d0b 705
73d80deb
LAD		 706 hci_send_acl(conn->hchan, skb, flags);
707}
708
709static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb)
710{
711 struct hci_conn *hcon = chan->conn->hcon;
712 u16 flags;
713
714 BT_DBG("chan %p, skb %p len %d priority %u", chan, skb, skb->len,
715 skb->priority);
716
717 if (!test_bit(FLAG_FLUSHABLE, &chan->flags) &&
718 lmp_no_flush_capable(hcon->hdev))
719 flags = ACL_START_NO_FLUSH;
720 else
721 flags = ACL_START;
14b12d0b 722
73d80deb
LAD		 723 bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
724 hci_send_acl(chan->conn->hchan, skb, flags);
4e8402a3
MH		 725}
726
88843ab0 727static inline void l2cap_send_sframe(struct l2cap_chan *chan, u32 control)
1c2acffb
GP		 728{
729 struct sk_buff *skb;
730 struct l2cap_hdr *lh;
8c1d787b 731 struct l2cap_conn *conn = chan->conn;
e4ca6d98 732 int count, hlen;
fcc203c3 733
89bc500e 734 if (chan->state != BT_CONNECTED)
c13ffa62
GP		 735 return;
736
e4ca6d98
AE		 737 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
738 hlen = L2CAP_EXT_HDR_SIZE;
739 else
740 hlen = L2CAP_ENH_HDR_SIZE;
741
47d1ec61 742 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 743 hlen += L2CAP_FCS_SIZE;
1c2acffb 744
88843ab0 745 BT_DBG("chan %p, control 0x%8.8x", chan, control);
1c2acffb 746
fcc203c3 747 count = min_t(unsigned int, conn->mtu, hlen);
793c2f1c
AE		 748
749 control |= __set_sframe(chan);
1c2acffb 750
e2ab4353 751 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 752 control |= __set_ctrl_final(chan);
9e917af1 753
e2ab4353 754 if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state))
e3781735 755 control |= __set_ctrl_poll(chan);
f0946ccf 756
1c2acffb
GP		 757 skb = bt_skb_alloc(count, GFP_ATOMIC);
758 if (!skb)
9a9c6a34 759 return;
1c2acffb
GP		 760
761 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fcc203c3 762 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
fe4128e0 763 lh->cid = cpu_to_le16(chan->dcid);
88843ab0
AE		 764
765 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1c2acffb 766
47d1ec61 767 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 768 u16 fcs = crc16(0, (u8 *)lh, count - L2CAP_FCS_SIZE);
769 put_unaligned_le16(fcs, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3
GP		 770 }
771
73d80deb
LAD		 772 skb->priority = HCI_PRIO_MAX;
773 l2cap_do_send(chan, skb);
1c2acffb
GP		 774}
775
88843ab0 776static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u32 control)
7e743090 777{
e2ab4353 778 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 779 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 780 set_bit(CONN_RNR_SENT, &chan->conn_state);
1890d36b 781 } else
ab784b73 782 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
7e743090 783
0b209fae 784 control |= __set_reqseq(chan, chan->buffer_seq);
2ab25cdd 785
525cd185 786 l2cap_send_sframe(chan, control);
7e743090
GP		 787}
788
b76bbd66
MM		 789static u16 __pack_enhanced_control(struct l2cap_ctrl *control)
790{
791 u16 packed;
792
793 packed = control->reqseq << L2CAP_CTRL_REQSEQ_SHIFT;
794 packed |= control->final << L2CAP_CTRL_FINAL_SHIFT;
795
796 if (control->sframe) {
797 packed |= control->poll << L2CAP_CTRL_POLL_SHIFT;
798 packed |= control->super << L2CAP_CTRL_SUPER_SHIFT;
799 packed |= L2CAP_CTRL_FRAME_TYPE;
800 } else {
801 packed |= control->sar << L2CAP_CTRL_SAR_SHIFT;
802 packed |= control->txseq << L2CAP_CTRL_TXSEQ_SHIFT;
803 }
804
805 return packed;
806}
807
808static void __unpack_enhanced_control(u16 enh, struct l2cap_ctrl *control)
809{
810 control->reqseq = (enh & L2CAP_CTRL_REQSEQ) >> L2CAP_CTRL_REQSEQ_SHIFT;
811 control->final = (enh & L2CAP_CTRL_FINAL) >> L2CAP_CTRL_FINAL_SHIFT;
812
813 if (enh & L2CAP_CTRL_FRAME_TYPE) {
814 /* S-Frame */
815 control->sframe = 1;
816 control->poll = (enh & L2CAP_CTRL_POLL) >> L2CAP_CTRL_POLL_SHIFT;
817 control->super = (enh & L2CAP_CTRL_SUPERVISE) >> L2CAP_CTRL_SUPER_SHIFT;
818
819 control->sar = 0;
820 control->txseq = 0;
821 } else {
822 /* I-Frame */
823 control->sframe = 0;
824 control->sar = (enh & L2CAP_CTRL_SAR) >> L2CAP_CTRL_SAR_SHIFT;
825 control->txseq = (enh & L2CAP_CTRL_TXSEQ) >> L2CAP_CTRL_TXSEQ_SHIFT;
826
827 control->poll = 0;
828 control->super = 0;
829 }
830}
831
832static u32 __pack_extended_control(struct l2cap_ctrl *control)
833{
834 u32 packed;
835
836 packed = control->reqseq << L2CAP_EXT_CTRL_REQSEQ_SHIFT;
837 packed |= control->final << L2CAP_EXT_CTRL_FINAL_SHIFT;
838
839 if (control->sframe) {
840 packed |= control->poll << L2CAP_EXT_CTRL_POLL_SHIFT;
841 packed |= control->super << L2CAP_EXT_CTRL_SUPER_SHIFT;
842 packed |= L2CAP_EXT_CTRL_FRAME_TYPE;
843 } else {
844 packed |= control->sar << L2CAP_EXT_CTRL_SAR_SHIFT;
845 packed |= control->txseq << L2CAP_EXT_CTRL_TXSEQ_SHIFT;
846 }
847
848 return packed;
849}
850
851static void __unpack_extended_control(u32 ext, struct l2cap_ctrl *control)
852{
853 control->reqseq = (ext & L2CAP_EXT_CTRL_REQSEQ) >> L2CAP_EXT_CTRL_REQSEQ_SHIFT;
854 control->final = (ext & L2CAP_EXT_CTRL_FINAL) >> L2CAP_EXT_CTRL_FINAL_SHIFT;
855
856 if (ext & L2CAP_EXT_CTRL_FRAME_TYPE) {
857 /* S-Frame */
858 control->sframe = 1;
859 control->poll = (ext & L2CAP_EXT_CTRL_POLL) >> L2CAP_EXT_CTRL_POLL_SHIFT;
860 control->super = (ext & L2CAP_EXT_CTRL_SUPERVISE) >> L2CAP_EXT_CTRL_SUPER_SHIFT;
861
862 control->sar = 0;
863 control->txseq = 0;
864 } else {
865 /* I-Frame */
866 control->sframe = 0;
867 control->sar = (ext & L2CAP_EXT_CTRL_SAR) >> L2CAP_EXT_CTRL_SAR_SHIFT;
868 control->txseq = (ext & L2CAP_EXT_CTRL_TXSEQ) >> L2CAP_EXT_CTRL_TXSEQ_SHIFT;
869
870 control->poll = 0;
871 control->super = 0;
872 }
873}
874
875static inline void __unpack_control(struct l2cap_chan *chan,
876 struct sk_buff *skb)
877{
878 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
879 __unpack_extended_control(get_unaligned_le32(skb->data),
880 &bt_cb(skb)->control);
881 } else {
882 __unpack_enhanced_control(get_unaligned_le16(skb->data),
883 &bt_cb(skb)->control);
884 }
885}
886
887static inline void __pack_control(struct l2cap_chan *chan,
888 struct l2cap_ctrl *control,
889 struct sk_buff *skb)
890{
891 if (test_bit(FLAG_EXT_CTRL, &chan->flags)) {
892 put_unaligned_le32(__pack_extended_control(control),
893 skb->data + L2CAP_HDR_SIZE);
894 } else {
895 put_unaligned_le16(__pack_enhanced_control(control),
896 skb->data + L2CAP_HDR_SIZE);
897 }
898}
899
b4450035 900static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan)
e501d055 901{
c1360a1c 902 return !test_bit(CONF_CONNECT_PEND, &chan->conf_state);
e501d055
AE		 903}
904
9b27f350
AE		 905static void l2cap_send_conn_req(struct l2cap_chan *chan)
906{
907 struct l2cap_conn *conn = chan->conn;
908 struct l2cap_conn_req req;
909
910 req.scid = cpu_to_le16(chan->scid);
911 req.psm = chan->psm;
912
913 chan->ident = l2cap_get_ident(conn);
914
915 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
916
917 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, sizeof(req), &req);
918}
919
fc7f8a7e 920static void l2cap_do_start(struct l2cap_chan *chan)
79d554a6 921{
8c1d787b 922 struct l2cap_conn *conn = chan->conn;
79d554a6
MH		 923
924 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 925 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
926 return;
927
d45fc423 928 if (l2cap_chan_check_security(chan) &&
9b27f350
AE		 929 __l2cap_no_conn_pending(chan))
930 l2cap_send_conn_req(chan);
79d554a6
MH		 931 } else {
932 struct l2cap_info_req req;
933 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
934
935 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
936 conn->info_ident = l2cap_get_ident(conn);
937
ba13ccd9 938 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 939
940 l2cap_send_cmd(conn, conn->info_ident,
941 L2CAP_INFO_REQ, sizeof(req), &req);
942 }
943}
944
cf6c2c0b
GP		 945static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
946{
947 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 948 if (!disable_ertm)
cf6c2c0b
GP		 949 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
950
951 switch (mode) {
952 case L2CAP_MODE_ERTM:
953 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
954 case L2CAP_MODE_STREAMING:
955 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
956 default:
957 return 0x00;
958 }
959}
960
4519de9a 961static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err)
22121fc9 962{
6be36555 963 struct sock *sk = chan->sk;
22121fc9
GP		 964 struct l2cap_disconn_req req;
965
c13ffa62
GP		 966 if (!conn)
967 return;
968
0c1bc5c6 969 if (chan->mode == L2CAP_MODE_ERTM) {
1a09bcb9
GP		 970 __clear_retrans_timer(chan);
971 __clear_monitor_timer(chan);
972 __clear_ack_timer(chan);
c13ffa62
GP		 973 }
974
fe4128e0
GP		 975 req.dcid = cpu_to_le16(chan->dcid);
976 req.scid = cpu_to_le16(chan->scid);
22121fc9
GP		 977 l2cap_send_cmd(conn, l2cap_get_ident(conn),
978 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62 979
6be36555 980 lock_sock(sk);
0e587be7 981 __l2cap_state_change(chan, BT_DISCONN);
2e0052e4 982 __l2cap_chan_set_err(chan, err);
6be36555 983 release_sock(sk);
22121fc9
GP		 984}
985
1da177e4 986/* ---- L2CAP connections ---- */
4e8402a3
MH		 987static void l2cap_conn_start(struct l2cap_conn *conn)
988{
3df91ea2 989 struct l2cap_chan *chan, *tmp;
4e8402a3
MH		 990
991 BT_DBG("conn %p", conn);
992
3df91ea2 993 mutex_lock(&conn->chan_lock);
4e8402a3 994
3df91ea2 995 list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) {
48454079 996 struct sock *sk = chan->sk;
baa7e1fa 997
6be36555 998 l2cap_chan_lock(chan);
4e8402a3 999
715ec005 1000 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1001 l2cap_chan_unlock(chan);
79d554a6
MH		 1002 continue;
1003 }
1004
89bc500e 1005 if (chan->state == BT_CONNECT) {
d45fc423 1006 if (!l2cap_chan_check_security(chan) ||
b4450035 1007 !__l2cap_no_conn_pending(chan)) {
6be36555 1008 l2cap_chan_unlock(chan);
47731de7
GP		 1009 continue;
1010 }
79d554a6 1011
c1360a1c
GP		 1012 if (!l2cap_mode_supported(chan->mode, conn->feat_mask)
1013 && test_bit(CONF_STATE2_DEVICE,
1014 &chan->conf_state)) {
89bc500e 1015 l2cap_chan_close(chan, ECONNRESET);
6be36555 1016 l2cap_chan_unlock(chan);
47731de7 1017 continue;
b1235d79 1018 }
47731de7 1019
9b27f350 1020 l2cap_send_conn_req(chan);
47731de7 1021
89bc500e 1022 } else if (chan->state == BT_CONNECT2) {
79d554a6 1023 struct l2cap_conn_rsp rsp;
e9aeb2dd 1024 char buf[128];
fe4128e0
GP		 1025 rsp.scid = cpu_to_le16(chan->dcid);
1026 rsp.dcid = cpu_to_le16(chan->scid);
79d554a6 1027
d45fc423 1028 if (l2cap_chan_check_security(chan)) {
6be36555 1029 lock_sock(sk);
f66dc81f
MH		 1030 if (bt_sk(sk)->defer_setup) {
1031 struct sock *parent = bt_sk(sk)->parent;
1032 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1033 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
05e9a2f6
IK		 1034 if (parent)
1035 parent->sk_data_ready(parent, 0);
f66dc81f
MH		 1036
1037 } else {
0e587be7 1038 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 1039 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1040 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1041 }
6be36555 1042 release_sock(sk);
79d554a6
MH		 1043 } else {
1044 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
1045 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
1046 }
1047
fc7f8a7e
GP		 1048 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
1049 sizeof(rsp), &rsp);
e9aeb2dd 1050
c1360a1c 1051 if (test_bit(CONF_REQ_SENT, &chan->conf_state) ||
e9aeb2dd 1052 rsp.result != L2CAP_CR_SUCCESS) {
6be36555 1053 l2cap_chan_unlock(chan);
e9aeb2dd
GP		 1054 continue;
1055 }
1056
c1360a1c 1057 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 1058 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 1059 l2cap_build_conf_req(chan, buf), buf);
1060 chan->num_conf_req++;
4e8402a3
MH		 1061 }
1062
6be36555 1063 l2cap_chan_unlock(chan);
4e8402a3
MH		 1064 }
1065
3df91ea2 1066 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1067}
1068
b62f328b
VT		 1069/* Find socket with cid and source bdaddr.
1070 * Returns closest match, locked.
1071 */
d9b88702
AE		 1072static struct l2cap_chan *l2cap_global_chan_by_scid(int state, u16 cid,
1073 bdaddr_t *src)
b62f328b 1074{
23691d75 1075 struct l2cap_chan *c, *c1 = NULL;
b62f328b 1076
23691d75 1077 read_lock(&chan_list_lock);
b62f328b 1078
23691d75
GP		 1079 list_for_each_entry(c, &chan_list, global_l) {
1080 struct sock *sk = c->sk;
fe4128e0 1081
89bc500e 1082 if (state && c->state != state)
b62f328b
VT		 1083 continue;
1084
23691d75 1085 if (c->scid == cid) {
b62f328b 1086 /* Exact match. */
23691d75
GP		 1087 if (!bacmp(&bt_sk(sk)->src, src)) {
1088 read_unlock(&chan_list_lock);
1089 return c;
1090 }
b62f328b
VT		 1091
1092 /* Closest match */
1093 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
23691d75 1094 c1 = c;
b62f328b
VT		 1095 }
1096 }
280f294f 1097
23691d75 1098 read_unlock(&chan_list_lock);
b62f328b 1099
23691d75 1100 return c1;
b62f328b
VT		 1101}
1102
1103static void l2cap_le_conn_ready(struct l2cap_conn *conn)
1104{
c916fbe4 1105 struct sock *parent, *sk;
23691d75 1106 struct l2cap_chan *chan, *pchan;
b62f328b
VT		 1107
1108 BT_DBG("");
1109
1110 /* Check if we have socket listening on cid */
23691d75 1111 pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA,
b62f328b 1112 conn->src);
23691d75 1113 if (!pchan)
b62f328b
VT		 1114 return;
1115
23691d75
GP		 1116 parent = pchan->sk;
1117
aa2ac881 1118 lock_sock(parent);
62f3a2cf 1119
b62f328b
VT		 1120 /* Check for backlog size */
1121 if (sk_acceptq_is_full(parent)) {
1122 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1123 goto clean;
1124 }
1125
80808e43
GP		 1126 chan = pchan->ops->new_connection(pchan->data);
1127 if (!chan)
b62f328b
VT		 1128 goto clean;
1129
80808e43 1130 sk = chan->sk;
5d41ce1d 1131
b62f328b
VT		 1132 hci_conn_hold(conn->hcon);
1133
b62f328b
VT		 1134 bacpy(&bt_sk(sk)->src, conn->src);
1135 bacpy(&bt_sk(sk)->dst, conn->dst);
1136
d1010240
GP		 1137 bt_accept_enqueue(parent, sk);
1138
3d57dc68 1139 l2cap_chan_add(conn, chan);
48454079 1140
c9b66675 1141 __set_chan_timer(chan, sk->sk_sndtimeo);
b62f328b 1142
0e587be7 1143 __l2cap_state_change(chan, BT_CONNECTED);
b62f328b
VT		 1144 parent->sk_data_ready(parent, 0);
1145
b62f328b 1146clean:
aa2ac881 1147 release_sock(parent);
b62f328b
VT		 1148}
1149
cf4cd009 1150static void l2cap_chan_ready(struct l2cap_chan *chan)
f1cb9af5 1151{
cf4cd009 1152 struct sock *sk = chan->sk;
6be36555
AE		 1153 struct sock *parent;
1154
1155 lock_sock(sk);
1156
1157 parent = bt_sk(sk)->parent;
f1cb9af5
VCG		 1158
1159 BT_DBG("sk %p, parent %p", sk, parent);
1160
1161 chan->conf_state = 0;
1162 __clear_chan_timer(chan);
1163
0e587be7 1164 __l2cap_state_change(chan, BT_CONNECTED);
f1cb9af5
VCG		 1165 sk->sk_state_change(sk);
1166
1167 if (parent)
1168 parent->sk_data_ready(parent, 0);
6be36555
AE		 1169
1170 release_sock(sk);
f1cb9af5
VCG		 1171}
1172
4e8402a3
MH		 1173static void l2cap_conn_ready(struct l2cap_conn *conn)
1174{
48454079 1175 struct l2cap_chan *chan;
4e8402a3 1176
79d554a6 1177 BT_DBG("conn %p", conn);
4e8402a3 1178
b62f328b
VT		 1179 if (!conn->hcon->out && conn->hcon->type == LE_LINK)
1180 l2cap_le_conn_ready(conn);
1181
160dc6ac
VCG		 1182 if (conn->hcon->out && conn->hcon->type == LE_LINK)
1183 smp_conn_security(conn, conn->hcon->pending_sec_level);
1184
3df91ea2 1185 mutex_lock(&conn->chan_lock);
4e8402a3 1186
3df91ea2 1187 list_for_each_entry(chan, &conn->chan_l, list) {
baa7e1fa 1188
6be36555 1189 l2cap_chan_lock(chan);
4e8402a3 1190
63128451 1191 if (conn->hcon->type == LE_LINK) {
b501d6a1 1192 if (smp_conn_security(conn, chan->sec_level))
cf4cd009 1193 l2cap_chan_ready(chan);
acd7d370 1194
63128451 1195 } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
6be36555 1196 struct sock *sk = chan->sk;
c9b66675 1197 __clear_chan_timer(chan);
6be36555 1198 lock_sock(sk);
0e587be7 1199 __l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1200 sk->sk_state_change(sk);
6be36555 1201 release_sock(sk);
b501d6a1 1202
89bc500e 1203 } else if (chan->state == BT_CONNECT)
fc7f8a7e 1204 l2cap_do_start(chan);
4e8402a3 1205
6be36555 1206 l2cap_chan_unlock(chan);
4e8402a3 1207 }
79d554a6 1208
3df91ea2 1209 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1210}
1211
1212/* Notify sockets that we cannot guaranty reliability anymore */
1213static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
1214{
48454079 1215 struct l2cap_chan *chan;
4e8402a3
MH		 1216
1217 BT_DBG("conn %p", conn);
1218
3df91ea2 1219 mutex_lock(&conn->chan_lock);
4e8402a3 1220
3df91ea2 1221 list_for_each_entry(chan, &conn->chan_l, list) {
ecf61bdb 1222 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
2e0052e4 1223 __l2cap_chan_set_err(chan, err);
4e8402a3
MH		 1224 }
1225
3df91ea2 1226 mutex_unlock(&conn->chan_lock);
4e8402a3
MH		 1227}
1228
f878fcad 1229static void l2cap_info_timeout(struct work_struct *work)
4e8402a3 1230{
f878fcad 1231 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
030013d8 1232 info_timer.work);
4e8402a3 1233
984947dc 1234 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 1235 conn->info_ident = 0;
984947dc 1236
4e8402a3
MH		 1237 l2cap_conn_start(conn);
1238}
1239
5d3de7df
VCG		 1240static void l2cap_conn_del(struct hci_conn *hcon, int err)
1241{
1242 struct l2cap_conn *conn = hcon->l2cap_data;
1243 struct l2cap_chan *chan, *l;
5d3de7df
VCG		 1244
1245 if (!conn)
1246 return;
1247
1248 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
1249
1250 kfree_skb(conn->rx_skb);
1251
3df91ea2
AE		 1252 mutex_lock(&conn->chan_lock);
1253
5d3de7df
VCG		 1254 /* Kill channels */
1255 list_for_each_entry_safe(chan, l, &conn->chan_l, list) {
6be36555
AE		 1256 l2cap_chan_lock(chan);
1257
5d3de7df 1258 l2cap_chan_del(chan, err);
6be36555
AE		 1259
1260 l2cap_chan_unlock(chan);
1261
5d3de7df
VCG		 1262 chan->ops->close(chan->data);
1263 }
1264
3df91ea2
AE		 1265 mutex_unlock(&conn->chan_lock);
1266
73d80deb
LAD		 1267 hci_chan_del(conn->hchan);
1268
5d3de7df 1269 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
127074bf 1270 cancel_delayed_work_sync(&conn->info_timer);
5d3de7df 1271
51a8efd7 1272 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) {
127074bf 1273 cancel_delayed_work_sync(&conn->security_timer);
8aab4757 1274 smp_chan_destroy(conn);
d26a2345 1275 }
5d3de7df
VCG		 1276
1277 hcon->l2cap_data = NULL;
1278 kfree(conn);
1279}
1280
6c9d42a1 1281static void security_timeout(struct work_struct *work)
5d3de7df 1282{
6c9d42a1
GP		 1283 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1284 security_timer.work);
5d3de7df
VCG		 1285
1286 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1287}
1288
1da177e4
LT		 1289static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
1290{
0139418c 1291 struct l2cap_conn *conn = hcon->l2cap_data;
73d80deb 1292 struct hci_chan *hchan;
1da177e4 1293
0139418c 1294 if (conn || status)
1da177e4
LT		 1295 return conn;
1296
73d80deb
LAD		 1297 hchan = hci_chan_create(hcon);
1298 if (!hchan)
1299 return NULL;
1300
0139418c 1301 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
73d80deb
LAD		 1302 if (!conn) {
1303 hci_chan_del(hchan);
1da177e4 1304 return NULL;
73d80deb 1305 }
1da177e4
LT		 1306
1307 hcon->l2cap_data = conn;
1308 conn->hcon = hcon;
73d80deb 1309 conn->hchan = hchan;
1da177e4 1310
73d80deb 1311 BT_DBG("hcon %p conn %p hchan %p", hcon, conn, hchan);
0139418c 1312
acd7d370
VT		 1313 if (hcon->hdev->le_mtu && hcon->type == LE_LINK)
1314 conn->mtu = hcon->hdev->le_mtu;
1315 else
1316 conn->mtu = hcon->hdev->acl_mtu;
1317
1da177e4
LT		 1318 conn->src = &hcon->hdev->bdaddr;
1319 conn->dst = &hcon->dst;
1320
4e8402a3
MH		 1321 conn->feat_mask = 0;
1322
1da177e4 1323 spin_lock_init(&conn->lock);
3df91ea2 1324 mutex_init(&conn->chan_lock);
baa7e1fa
GP		 1325
1326 INIT_LIST_HEAD(&conn->chan_l);
1da177e4 1327
5d3de7df 1328 if (hcon->type == LE_LINK)
6c9d42a1 1329 INIT_DELAYED_WORK(&conn->security_timer, security_timeout);
5d3de7df 1330 else
030013d8 1331 INIT_DELAYED_WORK(&conn->info_timer, l2cap_info_timeout);
45054dc1 1332
9f5a0d7b 1333 conn->disc_reason = HCI_ERROR_REMOTE_USER_TERM;
2950f21a 1334
1da177e4
LT		 1335 return conn;
1336}
1337
1da177e4 1338/* ---- Socket interface ---- */
1da177e4
LT		 1339
1340/* Find socket with psm and source bdaddr.
1341 * Returns closest match.
1342 */
23691d75 1343static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4 1344{
23691d75 1345 struct l2cap_chan *c, *c1 = NULL;
1da177e4 1346
23691d75 1347 read_lock(&chan_list_lock);
e0f0cb56 1348
23691d75
GP		 1349 list_for_each_entry(c, &chan_list, global_l) {
1350 struct sock *sk = c->sk;
fe4128e0 1351
89bc500e 1352 if (state && c->state != state)
1da177e4
LT		 1353 continue;
1354
23691d75 1355 if (c->psm == psm) {
1da177e4 1356 /* Exact match. */
23691d75 1357 if (!bacmp(&bt_sk(sk)->src, src)) {
a7567b20 1358 read_unlock(&chan_list_lock);
23691d75
GP		 1359 return c;
1360 }
1da177e4
LT		 1361
1362 /* Closest match */
1363 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
23691d75 1364 c1 = c;
1da177e4
LT		 1365 }
1366 }
1da177e4 1367
23691d75 1368 read_unlock(&chan_list_lock);
e0f0cb56 1369
23691d75 1370 return c1;
1da177e4
LT		 1371}
1372
cbe8fed4 1373int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, bdaddr_t *dst)
1da177e4 1374{
5d41ce1d 1375 struct sock *sk = chan->sk;
1da177e4 1376 bdaddr_t *src = &bt_sk(sk)->src;
1da177e4
LT		 1377 struct l2cap_conn *conn;
1378 struct hci_conn *hcon;
1379 struct hci_dev *hdev;
09ab6f4c 1380 __u8 auth_type;
44d0e48e 1381 int err;
1da177e4 1382
f29972de 1383 BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
097db76c 1384 __le16_to_cpu(chan->psm));
1da177e4 1385
af05b30b
GP		 1386 hdev = hci_get_route(dst, src);
1387 if (!hdev)
1da177e4
LT		 1388 return -EHOSTUNREACH;
1389
09fd0de5 1390 hci_dev_lock(hdev);
1da177e4 1391
6be36555 1392 l2cap_chan_lock(chan);
03a00194
GP		 1393
1394 /* PSM must be odd and lsb of upper byte must be 0 */
1395 if ((__le16_to_cpu(psm) & 0x0101) != 0x0001 && !cid &&
1396 chan->chan_type != L2CAP_CHAN_RAW) {
1397 err = -EINVAL;
1398 goto done;
1399 }
1400
1401 if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && !(psm || cid)) {
1402 err = -EINVAL;
1403 goto done;
1404 }
1405
1406 switch (chan->mode) {
1407 case L2CAP_MODE_BASIC:
1408 break;
1409 case L2CAP_MODE_ERTM:
1410 case L2CAP_MODE_STREAMING:
1411 if (!disable_ertm)
1412 break;
1413 /* fall through */
1414 default:
1415 err = -ENOTSUPP;
1416 goto done;
1417 }
1418
6be36555
AE		 1419 lock_sock(sk);
1420
03a00194
GP		 1421 switch (sk->sk_state) {
1422 case BT_CONNECT:
1423 case BT_CONNECT2:
1424 case BT_CONFIG:
1425 /* Already connecting */
1426 err = 0;
6be36555 1427 release_sock(sk);
03a00194
GP		 1428 goto done;
1429
1430 case BT_CONNECTED:
1431 /* Already connected */
1432 err = -EISCONN;
6be36555 1433 release_sock(sk);
03a00194
GP		 1434 goto done;
1435
1436 case BT_OPEN:
1437 case BT_BOUND:
1438 /* Can connect */
1439 break;
1440
1441 default:
1442 err = -EBADFD;
6be36555 1443 release_sock(sk);
03a00194
GP		 1444 goto done;
1445 }
1446
1447 /* Set destination address and psm */
9219b2a0 1448 bacpy(&bt_sk(sk)->dst, dst);
6be36555
AE		 1449
1450 release_sock(sk);
1451
03a00194
GP		 1452 chan->psm = psm;
1453 chan->dcid = cid;
1da177e4 1454
4343478f 1455 auth_type = l2cap_get_auth_type(chan);
09ab6f4c 1456
fe4128e0 1457 if (chan->dcid == L2CAP_CID_LE_DATA)
acd7d370 1458 hcon = hci_connect(hdev, LE_LINK, dst,
4343478f 1459 chan->sec_level, auth_type);
acd7d370
VT		 1460 else
1461 hcon = hci_connect(hdev, ACL_LINK, dst,
4343478f 1462 chan->sec_level, auth_type);
acd7d370 1463
30e76272
VT		 1464 if (IS_ERR(hcon)) {
1465 err = PTR_ERR(hcon);
1da177e4 1466 goto done;
30e76272 1467 }
1da177e4
LT		 1468
1469 conn = l2cap_conn_add(hcon, 0);
1470 if (!conn) {
1471 hci_conn_put(hcon);
30e76272 1472 err = -ENOMEM;
1da177e4
LT		 1473 goto done;
1474 }
1475
1da177e4
LT		 1476 /* Update source addr of the socket */
1477 bacpy(src, conn->src);
1478
6be36555 1479 l2cap_chan_unlock(chan);
48454079 1480 l2cap_chan_add(conn, chan);
6be36555 1481 l2cap_chan_lock(chan);
48454079 1482
6be36555 1483 l2cap_state_change(chan, BT_CONNECT);
c9b66675 1484 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4
LT		 1485
1486 if (hcon->state == BT_CONNECTED) {
715ec005 1487 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) {
c9b66675 1488 __clear_chan_timer(chan);
d45fc423 1489 if (l2cap_chan_check_security(chan))
6be36555 1490 l2cap_state_change(chan, BT_CONNECTED);
79d554a6 1491 } else
fc7f8a7e 1492 l2cap_do_start(chan);
1da177e4
LT		 1493 }
1494
30e76272
VT		 1495 err = 0;
1496
1da177e4 1497done:
6be36555 1498 l2cap_chan_unlock(chan);
09fd0de5 1499 hci_dev_unlock(hdev);
1da177e4
LT		 1500 hci_dev_put(hdev);
1501 return err;
1502}
1503
dcba0dba 1504int __l2cap_wait_ack(struct sock *sk)
6161c038 1505{
8c1d787b 1506 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
6161c038
GP		 1507 DECLARE_WAITQUEUE(wait, current);
1508 int err = 0;
1509 int timeo = HZ/5;
1510
2b0b05dd 1511 add_wait_queue(sk_sleep(sk), &wait);
a71a0cf4
PH		 1512 set_current_state(TASK_INTERRUPTIBLE);
1513 while (chan->unacked_frames > 0 && chan->conn) {
6161c038
GP		 1514 if (!timeo)
1515 timeo = HZ/5;
1516
1517 if (signal_pending(current)) {
1518 err = sock_intr_errno(timeo);
1519 break;
1520 }
1521
1522 release_sock(sk);
1523 timeo = schedule_timeout(timeo);
1524 lock_sock(sk);
a71a0cf4 1525 set_current_state(TASK_INTERRUPTIBLE);
6161c038
GP		 1526
1527 err = sock_error(sk);
1528 if (err)
1529 break;
1530 }
1531 set_current_state(TASK_RUNNING);
2b0b05dd 1532 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1533 return err;
1534}
1535
721c4181 1536static void l2cap_monitor_timeout(struct work_struct *work)
e90bac06 1537{
721c4181
GP		 1538 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1539 monitor_timer.work);
e90bac06 1540
525cd185 1541 BT_DBG("chan %p", chan);
0e98958d 1542
6be36555
AE		 1543 l2cap_chan_lock(chan);
1544
2c03a7a4 1545 if (chan->retry_count >= chan->remote_max_tx) {
8c1d787b 1546 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
6be36555 1547 l2cap_chan_unlock(chan);
8d7e1c7f 1548 l2cap_chan_put(chan);
e90bac06
GP		 1549 return;
1550 }
1551
6a026610 1552 chan->retry_count++;
1a09bcb9 1553 __set_monitor_timer(chan);
e90bac06 1554
525cd185 1555 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555 1556 l2cap_chan_unlock(chan);
8d7e1c7f 1557 l2cap_chan_put(chan);
e90bac06
GP		 1558}
1559
721c4181 1560static void l2cap_retrans_timeout(struct work_struct *work)
e90bac06 1561{
721c4181
GP		 1562 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
1563 retrans_timer.work);
e90bac06 1564
49208c9c 1565 BT_DBG("chan %p", chan);
0e98958d 1566
6be36555
AE		 1567 l2cap_chan_lock(chan);
1568
6a026610 1569 chan->retry_count = 1;
1a09bcb9 1570 __set_monitor_timer(chan);
e90bac06 1571
e2ab4353 1572 set_bit(CONN_WAIT_F, &chan->conn_state);
e90bac06 1573
525cd185 1574 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
6be36555
AE		 1575
1576 l2cap_chan_unlock(chan);
8d7e1c7f 1577 l2cap_chan_put(chan);
e90bac06
GP		 1578}
1579
42e5c802 1580static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
1da177e4 1581{
1c2acffb 1582 struct sk_buff *skb;
1da177e4 1583
58d35f87 1584 while ((skb = skb_peek(&chan->tx_q)) &&
6a026610 1585 chan->unacked_frames) {
42e5c802 1586 if (bt_cb(skb)->tx_seq == chan->expected_ack_seq)
1c2acffb 1587 break;
1da177e4 1588
58d35f87 1589 skb = skb_dequeue(&chan->tx_q);
1c2acffb 1590 kfree_skb(skb);
1da177e4 1591
6a026610 1592 chan->unacked_frames--;
1c2acffb 1593 }
1da177e4 1594
6a026610 1595 if (!chan->unacked_frames)
1a09bcb9 1596 __clear_retrans_timer(chan);
1c2acffb 1597}
1da177e4 1598
67c9e840 1599static void l2cap_streaming_send(struct l2cap_chan *chan)
6840ed07 1600{
ccbb84af 1601 struct sk_buff *skb;
88843ab0
AE		 1602 u32 control;
1603 u16 fcs;
6840ed07 1604
58d35f87 1605 while ((skb = skb_dequeue(&chan->tx_q))) {
88843ab0 1606 control = __get_control(chan, skb->data + L2CAP_HDR_SIZE);
fb45de7d 1607 control |= __set_txseq(chan, chan->next_tx_seq);
88843ab0 1608 __put_control(chan, control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1609
47d1ec61 1610 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1611 fcs = crc16(0, (u8 *)skb->data,
1612 skb->len - L2CAP_FCS_SIZE);
1613 put_unaligned_le16(fcs,
1614 skb->data + skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1615 }
1616
4343478f 1617 l2cap_do_send(chan, skb);
6840ed07 1618
836be934 1619 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
6840ed07 1620 }
6840ed07
GP		 1621}
1622
fb45de7d 1623static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 1624{
8f17154f 1625 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1626 u16 fcs;
1627 u32 control;
8f17154f 1628
58d35f87 1629 skb = skb_peek(&chan->tx_q);
f11d676d
GP		 1630 if (!skb)
1631 return;
8f17154f 1632
d1726b6d 1633 while (bt_cb(skb)->tx_seq != tx_seq) {
58d35f87 1634 if (skb_queue_is_last(&chan->tx_q, skb))
f11d676d 1635 return;
8f17154f 1636
d1726b6d
SJ		 1637 skb = skb_queue_next(&chan->tx_q, skb);
1638 }
8f17154f 1639
2c03a7a4
GP		 1640 if (chan->remote_max_tx &&
1641 bt_cb(skb)->retries == chan->remote_max_tx) {
8c1d787b 1642 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
f11d676d
GP		 1643 return;
1644 }
1645
1646 tx_skb = skb_clone(skb, GFP_ATOMIC);
1647 bt_cb(skb)->retries++;
88843ab0
AE		 1648
1649 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1650 control &= __get_sar_mask(chan);
3cb123d1 1651
e2ab4353 1652 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1653 control |= __set_ctrl_final(chan);
95ffa978 1654
0b209fae 1655 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1656 control |= __set_txseq(chan, tx_seq);
3cb123d1 1657
88843ab0 1658 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
f11d676d 1659
47d1ec61 1660 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1661 fcs = crc16(0, (u8 *)tx_skb->data,
1662 tx_skb->len - L2CAP_FCS_SIZE);
1663 put_unaligned_le16(fcs,
1664 tx_skb->data + tx_skb->len - L2CAP_FCS_SIZE);
f11d676d
GP		 1665 }
1666
4343478f 1667 l2cap_do_send(chan, tx_skb);
8f17154f
GP		 1668}
1669
67c9e840 1670static int l2cap_ertm_send(struct l2cap_chan *chan)
1c2acffb
GP		 1671{
1672 struct sk_buff *skb, *tx_skb;
88843ab0
AE		 1673 u16 fcs;
1674 u32 control;
9a9c6a34 1675 int nsent = 0;
1c2acffb 1676
89bc500e 1677 if (chan->state != BT_CONNECTED)
c13ffa62 1678 return -ENOTCONN;
e90bac06 1679
58d35f87 1680 while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) {
1c2acffb 1681
2c03a7a4
GP		 1682 if (chan->remote_max_tx &&
1683 bt_cb(skb)->retries == chan->remote_max_tx) {
8c1d787b 1684 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
e90bac06
GP		 1685 break;
1686 }
1687
e420aba3
AE		 1688 tx_skb = skb_clone(skb, GFP_ATOMIC);
1689
e90bac06
GP		 1690 bt_cb(skb)->retries++;
1691
88843ab0 1692 control = __get_control(chan, tx_skb->data + L2CAP_HDR_SIZE);
7e0ef6ee 1693 control &= __get_sar_mask(chan);
95ffa978 1694
e2ab4353 1695 if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state))
03f6715d 1696 control |= __set_ctrl_final(chan);
e2ab4353 1697
0b209fae 1698 control |= __set_reqseq(chan, chan->buffer_seq);
fb45de7d 1699 control |= __set_txseq(chan, chan->next_tx_seq);
1c2acffb 1700
88843ab0 1701 __put_control(chan, control, tx_skb->data + L2CAP_HDR_SIZE);
e90bac06 1702
47d1ec61 1703 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213
AE		 1704 fcs = crc16(0, (u8 *)skb->data,
1705 tx_skb->len - L2CAP_FCS_SIZE);
1706 put_unaligned_le16(fcs, skb->data +
1707 tx_skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 1708 }
1709
4343478f 1710 l2cap_do_send(chan, tx_skb);
9a9c6a34 1711
1a09bcb9 1712 __set_retrans_timer(chan);
1c2acffb 1713
42e5c802 1714 bt_cb(skb)->tx_seq = chan->next_tx_seq;
836be934
AE		 1715
1716 chan->next_tx_seq = __next_seq(chan, chan->next_tx_seq);
1c2acffb 1717
8ed7a0ae 1718 if (bt_cb(skb)->retries == 1) {
6a026610 1719 chan->unacked_frames++;
930fa4ae
SJ		 1720
1721 if (!nsent++)
1722 __clear_ack_timer(chan);
8ed7a0ae 1723 }
23e9fde2 1724
6a026610 1725 chan->frames_sent++;
1c2acffb 1726
58d35f87
GP		 1727 if (skb_queue_is_last(&chan->tx_q, skb))
1728 chan->tx_send_head = NULL;
1c2acffb 1729 else
58d35f87 1730 chan->tx_send_head = skb_queue_next(&chan->tx_q, skb);
1c2acffb
GP		 1731 }
1732
9e917af1
GP		 1733 return nsent;
1734}
1735
525cd185 1736static int l2cap_retransmit_frames(struct l2cap_chan *chan)
dfc909be 1737{
dfc909be
GP		 1738 int ret;
1739
58d35f87
GP		 1740 if (!skb_queue_empty(&chan->tx_q))
1741 chan->tx_send_head = chan->tx_q.next;
dfc909be 1742
42e5c802 1743 chan->next_tx_seq = chan->expected_ack_seq;
525cd185 1744 ret = l2cap_ertm_send(chan);
dfc909be
GP		 1745 return ret;
1746}
1747
b17e73bb 1748static void __l2cap_send_ack(struct l2cap_chan *chan)
9e917af1 1749{
88843ab0 1750 u32 control = 0;
9e917af1 1751
0b209fae 1752 control |= __set_reqseq(chan, chan->buffer_seq);
9e917af1 1753
e2ab4353 1754 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 1755 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
e2ab4353 1756 set_bit(CONN_RNR_SENT, &chan->conn_state);
525cd185 1757 l2cap_send_sframe(chan, control);
9a9c6a34 1758 return;
9e917af1 1759 }
dfc909be 1760
525cd185 1761 if (l2cap_ertm_send(chan) > 0)
dfc909be
GP		 1762 return;
1763
ab784b73 1764 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 1765 l2cap_send_sframe(chan, control);
1c2acffb
GP		 1766}
1767
b17e73bb
SJ		 1768static void l2cap_send_ack(struct l2cap_chan *chan)
1769{
1770 __clear_ack_timer(chan);
1771 __l2cap_send_ack(chan);
1772}
1773
525cd185 1774static void l2cap_send_srejtail(struct l2cap_chan *chan)
99b0d4b7
GP		 1775{
1776 struct srej_list *tail;
88843ab0 1777 u32 control;
99b0d4b7 1778
ab784b73 1779 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
03f6715d 1780 control |= __set_ctrl_final(chan);
99b0d4b7 1781
39d5a3ee 1782 tail = list_entry((&chan->srej_l)->prev, struct srej_list, list);
0b209fae 1783 control |= __set_reqseq(chan, tail->tx_seq);
99b0d4b7 1784
525cd185 1785 l2cap_send_sframe(chan, control);
99b0d4b7
GP		 1786}
1787
04124681
GP		 1788static inline int l2cap_skbuff_fromiovec(struct l2cap_chan *chan,
1789 struct msghdr *msg, int len,
1790 int count, struct sk_buff *skb)
1c2acffb 1791{
0952a57a 1792 struct l2cap_conn *conn = chan->conn;
1c2acffb 1793 struct sk_buff **frag;
90338947 1794 int sent = 0;
1da177e4 1795
59203a21 1796 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1797 return -EFAULT;
1da177e4
LT		 1798
1799 sent += count;
1800 len -= count;
1801
1802 /* Continuation fragments (no L2CAP header) */
1803 frag = &skb_shinfo(skb)->frag_list;
1804 while (len) {
1805 count = min_t(unsigned int, conn->mtu, len);
1806
2f7719ce 1807 *frag = chan->ops->alloc_skb(chan, count,
90338947 1808 msg->msg_flags & MSG_DONTWAIT);
2f7719ce 1809
90338947
GP		 1810 if (IS_ERR(*frag))
1811 return PTR_ERR(*frag);
1c2acffb
GP		 1812 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1813 return -EFAULT;
1da177e4 1814
5e59b791
LAD		 1815 (*frag)->priority = skb->priority;
1816
1da177e4
LT		 1817 sent += count;
1818 len -= count;
1819
1820 frag = &(*frag)->next;
1821 }
1da177e4
LT		 1822
1823 return sent;
1c2acffb 1824}
1da177e4 1825
5e59b791
LAD		 1826static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan,
1827 struct msghdr *msg, size_t len,
1828 u32 priority)
1c2acffb 1829{
8c1d787b 1830 struct l2cap_conn *conn = chan->conn;
1c2acffb 1831 struct sk_buff *skb;
03a51213 1832 int err, count, hlen = L2CAP_HDR_SIZE + L2CAP_PSMLEN_SIZE;
1c2acffb
GP		 1833 struct l2cap_hdr *lh;
1834
6d5922b0 1835 BT_DBG("chan %p len %d priority %u", chan, (int)len, priority);
1c2acffb
GP		 1836
1837 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1838
1839 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1840 msg->msg_flags & MSG_DONTWAIT);
1841 if (IS_ERR(skb))
1842 return skb;
1c2acffb 1843
5e59b791
LAD		 1844 skb->priority = priority;
1845
1c2acffb
GP		 1846 /* Create L2CAP header */
1847 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1848 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1849 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
097db76c 1850 put_unaligned(chan->psm, skb_put(skb, 2));
1c2acffb 1851
0952a57a 1852 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1853 if (unlikely(err < 0)) {
1854 kfree_skb(skb);
1855 return ERR_PTR(err);
1856 }
1857 return skb;
1858}
1859
5e59b791
LAD		 1860static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan,
1861 struct msghdr *msg, size_t len,
1862 u32 priority)
1c2acffb 1863{
8c1d787b 1864 struct l2cap_conn *conn = chan->conn;
1c2acffb
GP		 1865 struct sk_buff *skb;
1866 int err, count, hlen = L2CAP_HDR_SIZE;
1867 struct l2cap_hdr *lh;
1868
6d5922b0 1869 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb
GP		 1870
1871 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1872
1873 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1874 msg->msg_flags & MSG_DONTWAIT);
1875 if (IS_ERR(skb))
1876 return skb;
1c2acffb 1877
5e59b791
LAD		 1878 skb->priority = priority;
1879
1c2acffb
GP		 1880 /* Create L2CAP header */
1881 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1882 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb
GP		 1883 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1884
0952a57a 1885 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1886 if (unlikely(err < 0)) {
1887 kfree_skb(skb);
1888 return ERR_PTR(err);
1889 }
1890 return skb;
1891}
1892
ab0ff76d
LAD		 1893static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan,
1894 struct msghdr *msg, size_t len,
88843ab0 1895 u32 control, u16 sdulen)
1c2acffb 1896{
8c1d787b 1897 struct l2cap_conn *conn = chan->conn;
1c2acffb 1898 struct sk_buff *skb;
e4ca6d98 1899 int err, count, hlen;
1c2acffb
GP		 1900 struct l2cap_hdr *lh;
1901
6d5922b0 1902 BT_DBG("chan %p len %d", chan, (int)len);
1c2acffb 1903
0ee0d208
GP		 1904 if (!conn)
1905 return ERR_PTR(-ENOTCONN);
1906
e4ca6d98
AE		 1907 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
1908 hlen = L2CAP_EXT_HDR_SIZE;
1909 else
1910 hlen = L2CAP_ENH_HDR_SIZE;
1911
c74e560c 1912 if (sdulen)
03a51213 1913 hlen += L2CAP_SDULEN_SIZE;
c74e560c 1914
47d1ec61 1915 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1916 hlen += L2CAP_FCS_SIZE;
fcc203c3 1917
1c2acffb 1918 count = min_t(unsigned int, (conn->mtu - hlen), len);
2f7719ce
AE		 1919
1920 skb = chan->ops->alloc_skb(chan, count + hlen,
90338947
GP		 1921 msg->msg_flags & MSG_DONTWAIT);
1922 if (IS_ERR(skb))
1923 return skb;
1c2acffb
GP		 1924
1925 /* Create L2CAP header */
1926 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fe4128e0 1927 lh->cid = cpu_to_le16(chan->dcid);
1c2acffb 1928 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
88843ab0
AE		 1929
1930 __put_control(chan, control, skb_put(skb, __ctrl_size(chan)));
1931
c74e560c 1932 if (sdulen)
03a51213 1933 put_unaligned_le16(sdulen, skb_put(skb, L2CAP_SDULEN_SIZE));
1c2acffb 1934
0952a57a 1935 err = l2cap_skbuff_fromiovec(chan, msg, len, count, skb);
1c2acffb
GP		 1936 if (unlikely(err < 0)) {
1937 kfree_skb(skb);
1938 return ERR_PTR(err);
1939 }
e90bac06 1940
47d1ec61 1941 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 1942 put_unaligned_le16(0, skb_put(skb, L2CAP_FCS_SIZE));
fcc203c3 1943
e90bac06 1944 bt_cb(skb)->retries = 0;
1c2acffb 1945 return skb;
1da177e4
LT		 1946}
1947
67c9e840 1948static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len)
c74e560c 1949{
c74e560c
GP		 1950 struct sk_buff *skb;
1951 struct sk_buff_head sar_queue;
88843ab0 1952 u32 control;
c74e560c
GP		 1953 size_t size = 0;
1954
ff12fd64 1955 skb_queue_head_init(&sar_queue);
7e0ef6ee 1956 control = __set_ctrl_sar(chan, L2CAP_SAR_START);
47d1ec61 1957 skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len);
c74e560c
GP		 1958 if (IS_ERR(skb))
1959 return PTR_ERR(skb);
1960
1961 __skb_queue_tail(&sar_queue, skb);
2c03a7a4
GP		 1962 len -= chan->remote_mps;
1963 size += chan->remote_mps;
c74e560c
GP		 1964
1965 while (len > 0) {
1966 size_t buflen;
1967
2c03a7a4 1968 if (len > chan->remote_mps) {
7e0ef6ee 1969 control = __set_ctrl_sar(chan, L2CAP_SAR_CONTINUE);
2c03a7a4 1970 buflen = chan->remote_mps;
c74e560c 1971 } else {
7e0ef6ee 1972 control = __set_ctrl_sar(chan, L2CAP_SAR_END);
c74e560c
GP		 1973 buflen = len;
1974 }
1975
47d1ec61 1976 skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0);
c74e560c
GP		 1977 if (IS_ERR(skb)) {
1978 skb_queue_purge(&sar_queue);
1979 return PTR_ERR(skb);
1980 }
1981
1982 __skb_queue_tail(&sar_queue, skb);
1983 len -= buflen;
1984 size += buflen;
c74e560c 1985 }
58d35f87
GP		 1986 skb_queue_splice_tail(&sar_queue, &chan->tx_q);
1987 if (chan->tx_send_head == NULL)
1988 chan->tx_send_head = sar_queue.next;
c74e560c
GP		 1989
1990 return size;
1991}
1992
5e59b791
LAD		 1993int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len,
1994 u32 priority)
9a91a04a 1995{
9a91a04a 1996 struct sk_buff *skb;
88843ab0 1997 u32 control;
9a91a04a
GP		 1998 int err;
1999
2000 /* Connectionless channel */
715ec005 2001 if (chan->chan_type == L2CAP_CHAN_CONN_LESS) {
5e59b791 2002 skb = l2cap_create_connless_pdu(chan, msg, len, priority);
9a91a04a
GP		 2003 if (IS_ERR(skb))
2004 return PTR_ERR(skb);
2005
2006 l2cap_do_send(chan, skb);
2007 return len;
2008 }
2009
2010 switch (chan->mode) {
2011 case L2CAP_MODE_BASIC:
2012 /* Check outgoing MTU */
2013 if (len > chan->omtu)
2014 return -EMSGSIZE;
2015
2016 /* Create a basic PDU */
5e59b791 2017 skb = l2cap_create_basic_pdu(chan, msg, len, priority);
9a91a04a
GP		 2018 if (IS_ERR(skb))
2019 return PTR_ERR(skb);
2020
2021 l2cap_do_send(chan, skb);
2022 err = len;
2023 break;
2024
2025 case L2CAP_MODE_ERTM:
2026 case L2CAP_MODE_STREAMING:
2027 /* Entire SDU fits into one PDU */
2028 if (len <= chan->remote_mps) {
7e0ef6ee 2029 control = __set_ctrl_sar(chan, L2CAP_SAR_UNSEGMENTED);
9a91a04a
GP		 2030 skb = l2cap_create_iframe_pdu(chan, msg, len, control,
2031 0);
2032 if (IS_ERR(skb))
2033 return PTR_ERR(skb);
2034
2035 __skb_queue_tail(&chan->tx_q, skb);
2036
2037 if (chan->tx_send_head == NULL)
2038 chan->tx_send_head = skb;
2039
2040 } else {
2041 /* Segment SDU into multiples PDUs */
2042 err = l2cap_sar_segment_sdu(chan, msg, len);
2043 if (err < 0)
2044 return err;
2045 }
2046
2047 if (chan->mode == L2CAP_MODE_STREAMING) {
2048 l2cap_streaming_send(chan);
2049 err = len;
2050 break;
2051 }
2052
e2ab4353
GP		 2053 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
2054 test_bit(CONN_WAIT_F, &chan->conn_state)) {
9a91a04a
GP		 2055 err = len;
2056 break;
2057 }
2058
2059 err = l2cap_ertm_send(chan);
2060 if (err >= 0)
2061 err = len;
2062
2063 break;
2064
2065 default:
2066 BT_DBG("bad state %1.1x", chan->mode);
2067 err = -EBADFD;
2068 }
2069
2070 return err;
2071}
2072
1da177e4
LT		 2073/* Copy frame to all raw sockets on that connection */
2074static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2075{
1da177e4 2076 struct sk_buff *nskb;
48454079 2077 struct l2cap_chan *chan;
1da177e4
LT		 2078
2079 BT_DBG("conn %p", conn);
2080
3df91ea2 2081 mutex_lock(&conn->chan_lock);
3d57dc68 2082
3df91ea2 2083 list_for_each_entry(chan, &conn->chan_l, list) {
48454079 2084 struct sock *sk = chan->sk;
715ec005 2085 if (chan->chan_type != L2CAP_CHAN_RAW)
1da177e4
LT		 2086 continue;
2087
2088 /* Don't send frame to the socket it came from */
2089 if (skb->sk == sk)
2090 continue;
af05b30b
GP		 2091 nskb = skb_clone(skb, GFP_ATOMIC);
2092 if (!nskb)
1da177e4
LT		 2093 continue;
2094
23070494 2095 if (chan->ops->recv(chan->data, nskb))
1da177e4
LT		 2096 kfree_skb(nskb);
2097 }
3d57dc68 2098
3df91ea2 2099 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2100}
2101
2102/* ---- L2CAP signalling commands ---- */
2103static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2104 u8 code, u8 ident, u16 dlen, void *data)
2105{
2106 struct sk_buff *skb, **frag;
2107 struct l2cap_cmd_hdr *cmd;
2108 struct l2cap_hdr *lh;
2109 int len, count;
2110
af05b30b
GP		 2111 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2112 conn, code, ident, dlen);
1da177e4
LT		 2113
2114 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2115 count = min_t(unsigned int, conn->mtu, len);
2116
2117 skb = bt_skb_alloc(count, GFP_ATOMIC);
2118 if (!skb)
2119 return NULL;
2120
2121 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2122 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
3300d9a9
CT		 2123
2124 if (conn->hcon->type == LE_LINK)
2125 lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING);
2126 else
2127 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2128
2129 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2130 cmd->code = code;
2131 cmd->ident = ident;
aca3192c 2132 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2133
2134 if (dlen) {
2135 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2136 memcpy(skb_put(skb, count), data, count);
2137 data += count;
2138 }
2139
2140 len -= skb->len;
2141
2142 /* Continuation fragments (no L2CAP header) */
2143 frag = &skb_shinfo(skb)->frag_list;
2144 while (len) {
2145 count = min_t(unsigned int, conn->mtu, len);
2146
2147 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2148 if (!*frag)
2149 goto fail;
2150
2151 memcpy(skb_put(*frag, count), data, count);
2152
2153 len -= count;
2154 data += count;
2155
2156 frag = &(*frag)->next;
2157 }
2158
2159 return skb;
2160
2161fail:
2162 kfree_skb(skb);
2163 return NULL;
2164}
2165
2166static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2167{
2168 struct l2cap_conf_opt *opt = *ptr;
2169 int len;
2170
2171 len = L2CAP_CONF_OPT_SIZE + opt->len;
2172 *ptr += len;
2173
2174 *type = opt->type;
2175 *olen = opt->len;
2176
2177 switch (opt->len) {
2178 case 1:
2179 *val = *((u8 *) opt->val);
2180 break;
2181
2182 case 2:
bfaaeb3e 2183 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2184 break;
2185
2186 case 4:
bfaaeb3e 2187 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2188 break;
2189
2190 default:
2191 *val = (unsigned long) opt->val;
2192 break;
2193 }
2194
2195 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2196 return len;
2197}
2198
1da177e4
LT		 2199static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2200{
2201 struct l2cap_conf_opt *opt = *ptr;
2202
2203 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2204
2205 opt->type = type;
2206 opt->len = len;
2207
2208 switch (len) {
2209 case 1:
2210 *((u8 *) opt->val) = val;
2211 break;
2212
2213 case 2:
4f8b691c 2214 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2215 break;
2216
2217 case 4:
4f8b691c 2218 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2219 break;
2220
2221 default:
2222 memcpy(opt->val, (void *) val, len);
2223 break;
2224 }
2225
2226 *ptr += L2CAP_CONF_OPT_SIZE + len;
2227}
2228
f89cef09
AE		 2229static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan)
2230{
2231 struct l2cap_conf_efs efs;
2232
1ec918ce 2233 switch (chan->mode) {
f89cef09
AE		 2234 case L2CAP_MODE_ERTM:
2235 efs.id = chan->local_id;
2236 efs.stype = chan->local_stype;
2237 efs.msdu = cpu_to_le16(chan->local_msdu);
2238 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2239 efs.acc_lat = cpu_to_le32(L2CAP_DEFAULT_ACC_LAT);
2240 efs.flush_to = cpu_to_le32(L2CAP_DEFAULT_FLUSH_TO);
2241 break;
2242
2243 case L2CAP_MODE_STREAMING:
2244 efs.id = 1;
2245 efs.stype = L2CAP_SERV_BESTEFFORT;
2246 efs.msdu = cpu_to_le16(chan->local_msdu);
2247 efs.sdu_itime = cpu_to_le32(chan->local_sdu_itime);
2248 efs.acc_lat = 0;
2249 efs.flush_to = 0;
2250 break;
2251
2252 default:
2253 return;
2254 }
2255
2256 l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs),
2257 (unsigned long) &efs);
2258}
2259
721c4181 2260static void l2cap_ack_timeout(struct work_struct *work)
c1b4f43b 2261{
721c4181
GP		 2262 struct l2cap_chan *chan = container_of(work, struct l2cap_chan,
2263 ack_timer.work);
c1b4f43b 2264
2fb9b3d4
GP		 2265 BT_DBG("chan %p", chan);
2266
6be36555
AE		 2267 l2cap_chan_lock(chan);
2268
b17e73bb 2269 __l2cap_send_ack(chan);
6be36555
AE		 2270
2271 l2cap_chan_unlock(chan);
09bfb2ee
SJ		 2272
2273 l2cap_chan_put(chan);
c1b4f43b
GP		 2274}
2275
3c588192 2276static inline int l2cap_ertm_init(struct l2cap_chan *chan)
0565c1c2 2277{
3c588192
MM		 2278 int err;
2279
42e5c802 2280 chan->expected_ack_seq = 0;
6a026610 2281 chan->unacked_frames = 0;
42e5c802 2282 chan->buffer_seq = 0;
6a026610
GP		 2283 chan->num_acked = 0;
2284 chan->frames_sent = 0;
0565c1c2 2285
721c4181
GP		 2286 INIT_DELAYED_WORK(&chan->retrans_timer, l2cap_retrans_timeout);
2287 INIT_DELAYED_WORK(&chan->monitor_timer, l2cap_monitor_timeout);
2288 INIT_DELAYED_WORK(&chan->ack_timer, l2cap_ack_timeout);
0565c1c2 2289
f1c6775b 2290 skb_queue_head_init(&chan->srej_q);
1890d36b 2291
39d5a3ee 2292 INIT_LIST_HEAD(&chan->srej_l);
3c588192
MM		 2293 err = l2cap_seq_list_init(&chan->srej_list, chan->tx_win);
2294 if (err < 0)
2295 return err;
2296
2297 return l2cap_seq_list_init(&chan->retrans_list, chan->remote_tx_win);
0565c1c2
GP		 2298}
2299
f2fcfcd6
GP		 2300static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2301{
2302 switch (mode) {
2303 case L2CAP_MODE_STREAMING:
2304 case L2CAP_MODE_ERTM:
2305 if (l2cap_mode_supported(mode, remote_feat_mask))
2306 return mode;
2307 /* fall through */
2308 default:
2309 return L2CAP_MODE_BASIC;
2310 }
2311}
2312
6327eb98
AE		 2313static inline bool __l2cap_ews_supported(struct l2cap_chan *chan)
2314{
2315 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW;
2316}
2317
f89cef09
AE		 2318static inline bool __l2cap_efs_supported(struct l2cap_chan *chan)
2319{
2320 return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_FLOW;
2321}
2322
6327eb98
AE		 2323static inline void l2cap_txwin_setup(struct l2cap_chan *chan)
2324{
2325 if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW &&
836be934 2326 __l2cap_ews_supported(chan)) {
6327eb98
AE		 2327 /* use extended control field */
2328 set_bit(FLAG_EXT_CTRL, &chan->flags);
836be934
AE		 2329 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
2330 } else {
6327eb98
AE		 2331 chan->tx_win = min_t(u16, chan->tx_win,
2332 L2CAP_DEFAULT_TX_WINDOW);
836be934
AE		 2333 chan->tx_win_max = L2CAP_DEFAULT_TX_WINDOW;
2334 }
6327eb98
AE		 2335}
2336
710f9b0a 2337static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2338{
1da177e4 2339 struct l2cap_conf_req *req = data;
0c1bc5c6 2340 struct l2cap_conf_rfc rfc = { .mode = chan->mode };
1da177e4 2341 void *ptr = req->data;
c8f79162 2342 u16 size;
1da177e4 2343
49208c9c 2344 BT_DBG("chan %p", chan);
1da177e4 2345
73ffa904 2346 if (chan->num_conf_req || chan->num_conf_rsp)
f2fcfcd6
GP		 2347 goto done;
2348
0c1bc5c6 2349 switch (chan->mode) {
f2fcfcd6
GP		 2350 case L2CAP_MODE_STREAMING:
2351 case L2CAP_MODE_ERTM:
c1360a1c 2352 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state))
85eb53c6 2353 break;
85eb53c6 2354
f89cef09
AE		 2355 if (__l2cap_efs_supported(chan))
2356 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2357
2ba13ed6 2358 /* fall through */
f2fcfcd6 2359 default:
8c1d787b 2360 chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask);
f2fcfcd6
GP		 2361 break;
2362 }
2363
2364done:
0c1bc5c6
GP		 2365 if (chan->imtu != L2CAP_DEFAULT_MTU)
2366 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
7990681c 2367
0c1bc5c6 2368 switch (chan->mode) {
65c7c491 2369 case L2CAP_MODE_BASIC:
8c1d787b
GP		 2370 if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2371 !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING))
63406504
GP		 2372 break;
2373
62547752
GP		 2374 rfc.mode = L2CAP_MODE_BASIC;
2375 rfc.txwin_size = 0;
2376 rfc.max_transmit = 0;
2377 rfc.retrans_timeout = 0;
2378 rfc.monitor_timeout = 0;
2379 rfc.max_pdu_size = 0;
2380
63406504
GP		 2381 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2382 (unsigned long) &rfc);
65c7c491
MH		 2383 break;
2384
2385 case L2CAP_MODE_ERTM:
2386 rfc.mode = L2CAP_MODE_ERTM;
47d1ec61 2387 rfc.max_transmit = chan->max_tx;
f2fcfcd6
GP		 2388 rfc.retrans_timeout = 0;
2389 rfc.monitor_timeout = 0;
c8f79162
AE		 2390
2391 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2392 L2CAP_EXT_HDR_SIZE -
2393 L2CAP_SDULEN_SIZE -
2394 L2CAP_FCS_SIZE);
2395 rfc.max_pdu_size = cpu_to_le16(size);
f2fcfcd6 2396
6327eb98
AE		 2397 l2cap_txwin_setup(chan);
2398
2399 rfc.txwin_size = min_t(u16, chan->tx_win,
2400 L2CAP_DEFAULT_TX_WINDOW);
f2fcfcd6 2401
63406504
GP		 2402 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2403 (unsigned long) &rfc);
2404
f89cef09
AE		 2405 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2406 l2cap_add_opt_efs(&ptr, chan);
2407
8c1d787b 2408 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2409 break;
2410
47d1ec61 2411 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2412 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2413 chan->fcs = L2CAP_FCS_NONE;
2414 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2415 }
6327eb98
AE		 2416
2417 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
2418 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2419 chan->tx_win);
f2fcfcd6
GP		 2420 break;
2421
2422 case L2CAP_MODE_STREAMING:
2423 rfc.mode = L2CAP_MODE_STREAMING;
2424 rfc.txwin_size = 0;
2425 rfc.max_transmit = 0;
2426 rfc.retrans_timeout = 0;
2427 rfc.monitor_timeout = 0;
c8f79162
AE		 2428
2429 size = min_t(u16, L2CAP_DEFAULT_MAX_PDU_SIZE, chan->conn->mtu -
2430 L2CAP_EXT_HDR_SIZE -
2431 L2CAP_SDULEN_SIZE -
2432 L2CAP_FCS_SIZE);
2433 rfc.max_pdu_size = cpu_to_le16(size);
65c7c491 2434
63406504
GP		 2435 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2436 (unsigned long) &rfc);
2437
f89cef09
AE		 2438 if (test_bit(FLAG_EFS_ENABLE, &chan->flags))
2439 l2cap_add_opt_efs(&ptr, chan);
2440
8c1d787b 2441 if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS))
fcc203c3
GP		 2442 break;
2443
47d1ec61 2444 if (chan->fcs == L2CAP_FCS_NONE ||
c1360a1c 2445 test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) {
47d1ec61
GP		 2446 chan->fcs = L2CAP_FCS_NONE;
2447 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs);
fcc203c3 2448 }
65c7c491
MH		 2449 break;
2450 }
1da177e4 2451
fe4128e0 2452 req->dcid = cpu_to_le16(chan->dcid);
aca3192c 2453 req->flags = cpu_to_le16(0);
1da177e4
LT		 2454
2455 return ptr - data;
2456}
2457
73ffa904 2458static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data)
1da177e4 2459{
5dee9e7c
MH		 2460 struct l2cap_conf_rsp *rsp = data;
2461 void *ptr = rsp->data;
73ffa904
GP		 2462 void *req = chan->conf_req;
2463 int len = chan->conf_len;
5dee9e7c
MH		 2464 int type, hint, olen;
2465 unsigned long val;
6464f35f 2466 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
42dceae2
AE		 2467 struct l2cap_conf_efs efs;
2468 u8 remote_efs = 0;
861d6882 2469 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2470 u16 result = L2CAP_CONF_SUCCESS;
c8f79162 2471 u16 size;
1da177e4 2472
73ffa904 2473 BT_DBG("chan %p", chan);
820ae1b8 2474
5dee9e7c
MH		 2475 while (len >= L2CAP_CONF_OPT_SIZE) {
2476 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2477
589d2746 2478 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2479 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2480
2481 switch (type) {
2482 case L2CAP_CONF_MTU:
861d6882 2483 mtu = val;
5dee9e7c
MH		 2484 break;
2485
2486 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2487 chan->flush_to = val;
5dee9e7c
MH		 2488 break;
2489
2490 case L2CAP_CONF_QOS:
2491 break;
2492
6464f35f
MH		 2493 case L2CAP_CONF_RFC:
2494 if (olen == sizeof(rfc))
2495 memcpy(&rfc, (void *) val, olen);
2496 break;
2497
fcc203c3
GP		 2498 case L2CAP_CONF_FCS:
2499 if (val == L2CAP_FCS_NONE)
c1360a1c 2500 set_bit(CONF_NO_FCS_RECV, &chan->conf_state);
42dceae2 2501 break;
fcc203c3 2502
42dceae2
AE		 2503 case L2CAP_CONF_EFS:
2504 remote_efs = 1;
2505 if (olen == sizeof(efs))
2506 memcpy(&efs, (void *) val, olen);
fcc203c3
GP		 2507 break;
2508
6327eb98
AE		 2509 case L2CAP_CONF_EWS:
2510 if (!enable_hs)
2511 return -ECONNREFUSED;
fcc203c3 2512
6327eb98
AE		 2513 set_bit(FLAG_EXT_CTRL, &chan->flags);
2514 set_bit(CONF_EWS_RECV, &chan->conf_state);
836be934 2515 chan->tx_win_max = L2CAP_DEFAULT_EXT_WINDOW;
6327eb98 2516 chan->remote_tx_win = val;
fcc203c3
GP		 2517 break;
2518
5dee9e7c
MH		 2519 default:
2520 if (hint)
2521 break;
2522
2523 result = L2CAP_CONF_UNKNOWN;
2524 *((u8 *) ptr++) = type;
2525 break;
2526 }
2527 }
2528
73ffa904 2529 if (chan->num_conf_rsp || chan->num_conf_req > 1)
f2fcfcd6
GP		 2530 goto done;
2531
0c1bc5c6 2532 switch (chan->mode) {
f2fcfcd6
GP		 2533 case L2CAP_MODE_STREAMING:
2534 case L2CAP_MODE_ERTM:
c1360a1c 2535 if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) {
0c1bc5c6 2536 chan->mode = l2cap_select_mode(rfc.mode,
8c1d787b 2537 chan->conn->feat_mask);
85eb53c6
GP		 2538 break;
2539 }
2540
42dceae2
AE		 2541 if (remote_efs) {
2542 if (__l2cap_efs_supported(chan))
2543 set_bit(FLAG_EFS_ENABLE, &chan->flags);
2544 else
2545 return -ECONNREFUSED;
2546 }
2547
0c1bc5c6 2548 if (chan->mode != rfc.mode)
f2fcfcd6 2549 return -ECONNREFUSED;
742e519b 2550
f2fcfcd6 2551 break;
f2fcfcd6
GP		 2552 }
2553
2554done:
0c1bc5c6 2555 if (chan->mode != rfc.mode) {
f2fcfcd6 2556 result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2557 rfc.mode = chan->mode;
f2fcfcd6 2558
73ffa904 2559 if (chan->num_conf_rsp == 1)
f2fcfcd6
GP		 2560 return -ECONNREFUSED;
2561
2562 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2563 sizeof(rfc), (unsigned long) &rfc);
2564 }
2565
5dee9e7c
MH		 2566 if (result == L2CAP_CONF_SUCCESS) {
2567 /* Configure output options and let the other side know
2568 * which ones we don't like. */
2569
f2fcfcd6
GP		 2570 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2571 result = L2CAP_CONF_UNACCEPT;
2572 else {
0c1bc5c6 2573 chan->omtu = mtu;
c1360a1c 2574 set_bit(CONF_MTU_DONE, &chan->conf_state);
f2fcfcd6 2575 }
0c1bc5c6 2576 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu);
6464f35f 2577
42dceae2
AE		 2578 if (remote_efs) {
2579 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2580 efs.stype != L2CAP_SERV_NOTRAFIC &&
2581 efs.stype != chan->local_stype) {
2582
2583 result = L2CAP_CONF_UNACCEPT;
2584
2585 if (chan->num_conf_req >= 1)
2586 return -ECONNREFUSED;
2587
2588 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
3e6b3b95 2589 sizeof(efs),
42dceae2 2590 (unsigned long) &efs);
0e8b207e 2591 } else {
3e6b3b95 2592 /* Send PENDING Conf Rsp */
0e8b207e
AE		 2593 result = L2CAP_CONF_PENDING;
2594 set_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
42dceae2
AE		 2595 }
2596 }
2597
f2fcfcd6
GP		 2598 switch (rfc.mode) {
2599 case L2CAP_MODE_BASIC:
47d1ec61 2600 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 2601 set_bit(CONF_MODE_DONE, &chan->conf_state);
f2fcfcd6
GP		 2602 break;
2603
2604 case L2CAP_MODE_ERTM:
6327eb98
AE		 2605 if (!test_bit(CONF_EWS_RECV, &chan->conf_state))
2606 chan->remote_tx_win = rfc.txwin_size;
2607 else
2608 rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW;
86b1b263 2609
2c03a7a4 2610 chan->remote_max_tx = rfc.max_transmit;
1c762159 2611
c8f79162
AE		 2612 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2613 chan->conn->mtu -
2614 L2CAP_EXT_HDR_SIZE -
2615 L2CAP_SDULEN_SIZE -
2616 L2CAP_FCS_SIZE);
2617 rfc.max_pdu_size = cpu_to_le16(size);
2618 chan->remote_mps = size;
f2fcfcd6 2619
10467e9e 2620 rfc.retrans_timeout =
4fd21a88 2621 __constant_cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
10467e9e 2622 rfc.monitor_timeout =
4fd21a88 2623 __constant_cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6 2624
c1360a1c 2625 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2626
2627 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2628 sizeof(rfc), (unsigned long) &rfc);
2629
42dceae2
AE		 2630 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2631 chan->remote_id = efs.id;
2632 chan->remote_stype = efs.stype;
2633 chan->remote_msdu = le16_to_cpu(efs.msdu);
2634 chan->remote_flush_to =
2635 le32_to_cpu(efs.flush_to);
2636 chan->remote_acc_lat =
2637 le32_to_cpu(efs.acc_lat);
2638 chan->remote_sdu_itime =
2639 le32_to_cpu(efs.sdu_itime);
2640 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2641 sizeof(efs), (unsigned long) &efs);
2642 }
f2fcfcd6
GP		 2643 break;
2644
2645 case L2CAP_MODE_STREAMING:
c8f79162
AE		 2646 size = min_t(u16, le16_to_cpu(rfc.max_pdu_size),
2647 chan->conn->mtu -
2648 L2CAP_EXT_HDR_SIZE -
2649 L2CAP_SDULEN_SIZE -
2650 L2CAP_FCS_SIZE);
2651 rfc.max_pdu_size = cpu_to_le16(size);
2652 chan->remote_mps = size;
f2fcfcd6 2653
c1360a1c 2654 set_bit(CONF_MODE_DONE, &chan->conf_state);
68ae6639
GP		 2655
2656 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2657 sizeof(rfc), (unsigned long) &rfc);
2658
f2fcfcd6
GP		 2659 break;
2660
2661 default:
5dee9e7c 2662 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2663
6464f35f 2664 memset(&rfc, 0, sizeof(rfc));
0c1bc5c6 2665 rfc.mode = chan->mode;
f2fcfcd6 2666 }
6464f35f 2667
f2fcfcd6 2668 if (result == L2CAP_CONF_SUCCESS)
c1360a1c 2669 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
f2fcfcd6 2670 }
fe4128e0 2671 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c
MH		 2672 rsp->result = cpu_to_le16(result);
2673 rsp->flags = cpu_to_le16(0x0000);
2674
2675 return ptr - data;
1da177e4
LT		 2676}
2677
b4450035 2678static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result)
f2fcfcd6 2679{
f2fcfcd6
GP		 2680 struct l2cap_conf_req *req = data;
2681 void *ptr = req->data;
2682 int type, olen;
2683 unsigned long val;
36e999a8 2684 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
66af7aaf 2685 struct l2cap_conf_efs efs;
f2fcfcd6 2686
fe4128e0 2687 BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data);
f2fcfcd6
GP		 2688
2689 while (len >= L2CAP_CONF_OPT_SIZE) {
2690 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2691
2692 switch (type) {
2693 case L2CAP_CONF_MTU:
2694 if (val < L2CAP_DEFAULT_MIN_MTU) {
2695 *result = L2CAP_CONF_UNACCEPT;
0c1bc5c6 2696 chan->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2697 } else
0c1bc5c6
GP		 2698 chan->imtu = val;
2699 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu);
f2fcfcd6
GP		 2700 break;
2701
2702 case L2CAP_CONF_FLUSH_TO:
0c1bc5c6 2703 chan->flush_to = val;
f2fcfcd6 2704 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
0c1bc5c6 2705 2, chan->flush_to);
f2fcfcd6
GP		 2706 break;
2707
2708 case L2CAP_CONF_RFC:
2709 if (olen == sizeof(rfc))
2710 memcpy(&rfc, (void *)val, olen);
2711
c1360a1c 2712 if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
0c1bc5c6 2713 rfc.mode != chan->mode)
f2fcfcd6
GP		 2714 return -ECONNREFUSED;
2715
47d1ec61 2716 chan->fcs = 0;
f2fcfcd6
GP		 2717
2718 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2719 sizeof(rfc), (unsigned long) &rfc);
2720 break;
6327eb98
AE		 2721
2722 case L2CAP_CONF_EWS:
2723 chan->tx_win = min_t(u16, val,
2724 L2CAP_DEFAULT_EXT_WINDOW);
3e6b3b95
GP		 2725 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2,
2726 chan->tx_win);
6327eb98 2727 break;
66af7aaf
AE		 2728
2729 case L2CAP_CONF_EFS:
2730 if (olen == sizeof(efs))
2731 memcpy(&efs, (void *)val, olen);
2732
2733 if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
2734 efs.stype != L2CAP_SERV_NOTRAFIC &&
2735 efs.stype != chan->local_stype)
2736 return -ECONNREFUSED;
2737
2738 l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS,
2739 sizeof(efs), (unsigned long) &efs);
2740 break;
f2fcfcd6
GP		 2741 }
2742 }
2743
0c1bc5c6 2744 if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode)
6c2ea7a8
GP		 2745 return -ECONNREFUSED;
2746
0c1bc5c6 2747 chan->mode = rfc.mode;
6c2ea7a8 2748
0e8b207e 2749 if (*result == L2CAP_CONF_SUCCESS || *result == L2CAP_CONF_PENDING) {
f2fcfcd6
GP		 2750 switch (rfc.mode) {
2751 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2752 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2753 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2754 chan->mps = le16_to_cpu(rfc.max_pdu_size);
66af7aaf
AE		 2755
2756 if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) {
2757 chan->local_msdu = le16_to_cpu(efs.msdu);
2758 chan->local_sdu_itime =
2759 le32_to_cpu(efs.sdu_itime);
2760 chan->local_acc_lat = le32_to_cpu(efs.acc_lat);
2761 chan->local_flush_to =
2762 le32_to_cpu(efs.flush_to);
2763 }
f2fcfcd6 2764 break;
66af7aaf 2765
f2fcfcd6 2766 case L2CAP_MODE_STREAMING:
47d1ec61 2767 chan->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2768 }
2769 }
2770
fe4128e0 2771 req->dcid = cpu_to_le16(chan->dcid);
f2fcfcd6
GP		 2772 req->flags = cpu_to_le16(0x0000);
2773
2774 return ptr - data;
2775}
2776
fe4128e0 2777static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags)
1da177e4
LT		 2778{
2779 struct l2cap_conf_rsp *rsp = data;
2780 void *ptr = rsp->data;
1da177e4 2781
fe4128e0 2782 BT_DBG("chan %p", chan);
1da177e4 2783
fe4128e0 2784 rsp->scid = cpu_to_le16(chan->dcid);
5dee9e7c 2785 rsp->result = cpu_to_le16(result);
aca3192c 2786 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2787
2788 return ptr - data;
2789}
2790
8c1d787b 2791void __l2cap_connect_rsp_defer(struct l2cap_chan *chan)
710f9b0a
GP		 2792{
2793 struct l2cap_conn_rsp rsp;
8c1d787b 2794 struct l2cap_conn *conn = chan->conn;
710f9b0a
GP		 2795 u8 buf[128];
2796
fe4128e0
GP		 2797 rsp.scid = cpu_to_le16(chan->dcid);
2798 rsp.dcid = cpu_to_le16(chan->scid);
710f9b0a
GP		 2799 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
2800 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2801 l2cap_send_cmd(conn, chan->ident,
2802 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2803
c1360a1c 2804 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
710f9b0a
GP		 2805 return;
2806
710f9b0a
GP		 2807 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2808 l2cap_build_conf_req(chan, buf), buf);
2809 chan->num_conf_req++;
2810}
2811
47d1ec61 2812static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
7b1c0049 2813{
7b1c0049
GP		 2814 int type, olen;
2815 unsigned long val;
2816 struct l2cap_conf_rfc rfc;
2817
47d1ec61 2818 BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len);
7b1c0049 2819
0c1bc5c6 2820 if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING))
7b1c0049
GP		 2821 return;
2822
2823 while (len >= L2CAP_CONF_OPT_SIZE) {
2824 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2825
2826 switch (type) {
2827 case L2CAP_CONF_RFC:
2828 if (olen == sizeof(rfc))
2829 memcpy(&rfc, (void *)val, olen);
2830 goto done;
2831 }
2832 }
2833
36e999a8
MM		 2834 /* Use sane default values in case a misbehaving remote device
2835 * did not send an RFC option.
2836 */
2837 rfc.mode = chan->mode;
2838 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
2839 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
2840 rfc.max_pdu_size = cpu_to_le16(chan->imtu);
2841
2842 BT_ERR("Expected RFC option was not found, using defaults");
2843
7b1c0049
GP		 2844done:
2845 switch (rfc.mode) {
2846 case L2CAP_MODE_ERTM:
47d1ec61
GP		 2847 chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2848 chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
2849 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2850 break;
2851 case L2CAP_MODE_STREAMING:
47d1ec61 2852 chan->mps = le16_to_cpu(rfc.max_pdu_size);
7b1c0049
GP		 2853 }
2854}
2855
4e8402a3
MH		 2856static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2857{
e2fd318e 2858 struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data;
4e8402a3 2859
e2fd318e 2860 if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD)
4e8402a3
MH		 2861 return 0;
2862
2863 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2864 cmd->ident == conn->info_ident) {
17cd3f37 2865 cancel_delayed_work(&conn->info_timer);
984947dc
MH		 2866
2867 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2868 conn->info_ident = 0;
984947dc 2869
4e8402a3
MH		 2870 l2cap_conn_start(conn);
2871 }
2872
2873 return 0;
2874}
2875
1da177e4
LT		 2876static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2877{
1da177e4
LT		 2878 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2879 struct l2cap_conn_rsp rsp;
23691d75 2880 struct l2cap_chan *chan = NULL, *pchan;
d793fe8c 2881 struct sock *parent, *sk = NULL;
e7c29cb1 2882 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2883
2884 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2885 __le16 psm = req->psm;
1da177e4 2886
097db76c 2887 BT_DBG("psm 0x%2.2x scid 0x%4.4x", __le16_to_cpu(psm), scid);
1da177e4
LT		 2888
2889 /* Check if we have socket listening on psm */
23691d75
GP		 2890 pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src);
2891 if (!pchan) {
1da177e4
LT		 2892 result = L2CAP_CR_BAD_PSM;
2893 goto sendresp;
2894 }
2895
23691d75
GP		 2896 parent = pchan->sk;
2897
3df91ea2 2898 mutex_lock(&conn->chan_lock);
aa2ac881 2899 lock_sock(parent);
e0f0cb56 2900
e7c29cb1
MH		 2901 /* Check if the ACL is secure enough (if not SDP) */
2902 if (psm != cpu_to_le16(0x0001) &&
2903 !hci_conn_check_link_mode(conn->hcon)) {
9f5a0d7b 2904 conn->disc_reason = HCI_ERROR_AUTH_FAILURE;
e7c29cb1
MH		 2905 result = L2CAP_CR_SEC_BLOCK;
2906 goto response;
2907 }
2908
1da177e4
LT		 2909 result = L2CAP_CR_NO_MEM;
2910
2911 /* Check for backlog size */
2912 if (sk_acceptq_is_full(parent)) {
8e87d142 2913 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2914 goto response;
2915 }
2916
80808e43
GP		 2917 chan = pchan->ops->new_connection(pchan->data);
2918 if (!chan)
1da177e4
LT		 2919 goto response;
2920
80808e43
GP		 2921 sk = chan->sk;
2922
1da177e4 2923 /* Check if we already have channel with that dcid */
baa7e1fa 2924 if (__l2cap_get_chan_by_dcid(conn, scid)) {
1da177e4 2925 sock_set_flag(sk, SOCK_ZAPPED);
ba3bd0ee 2926 chan->ops->close(chan->data);
1da177e4
LT		 2927 goto response;
2928 }
2929
2930 hci_conn_hold(conn->hcon);
2931
1da177e4
LT		 2932 bacpy(&bt_sk(sk)->src, conn->src);
2933 bacpy(&bt_sk(sk)->dst, conn->dst);
fe4128e0
GP		 2934 chan->psm = psm;
2935 chan->dcid = scid;
1da177e4 2936
d1010240
GP		 2937 bt_accept_enqueue(parent, sk);
2938
6be36555 2939 __l2cap_chan_add(conn, chan);
48454079 2940
fe4128e0 2941 dcid = chan->scid;
1da177e4 2942
c9b66675 2943 __set_chan_timer(chan, sk->sk_sndtimeo);
1da177e4 2944
fc7f8a7e 2945 chan->ident = cmd->ident;
1da177e4 2946
984947dc 2947 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
d45fc423 2948 if (l2cap_chan_check_security(chan)) {
f66dc81f 2949 if (bt_sk(sk)->defer_setup) {
0e587be7 2950 __l2cap_state_change(chan, BT_CONNECT2);
f66dc81f
MH		 2951 result = L2CAP_CR_PEND;
2952 status = L2CAP_CS_AUTHOR_PEND;
2953 parent->sk_data_ready(parent, 0);
2954 } else {
0e587be7 2955 __l2cap_state_change(chan, BT_CONFIG);
f66dc81f
MH		 2956 result = L2CAP_CR_SUCCESS;
2957 status = L2CAP_CS_NO_INFO;
2958 }
79d554a6 2959 } else {
0e587be7 2960 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 2961 result = L2CAP_CR_PEND;
2962 status = L2CAP_CS_AUTHEN_PEND;
2963 }
2964 } else {
0e587be7 2965 __l2cap_state_change(chan, BT_CONNECT2);
79d554a6
MH		 2966 result = L2CAP_CR_PEND;
2967 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2968 }
2969
1da177e4 2970response:
aa2ac881 2971 release_sock(parent);
3df91ea2 2972 mutex_unlock(&conn->chan_lock);
1da177e4
LT		 2973
2974sendresp:
aca3192c
YH		 2975 rsp.scid = cpu_to_le16(scid);
2976 rsp.dcid = cpu_to_le16(dcid);
2977 rsp.result = cpu_to_le16(result);
2978 rsp.status = cpu_to_le16(status);
1da177e4 2979 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 2980
2981 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
2982 struct l2cap_info_req info;
2983 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2984
2985 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
2986 conn->info_ident = l2cap_get_ident(conn);
2987
ba13ccd9 2988 schedule_delayed_work(&conn->info_timer, L2CAP_INFO_TIMEOUT);
79d554a6
MH		 2989
2990 l2cap_send_cmd(conn, conn->info_ident,
2991 L2CAP_INFO_REQ, sizeof(info), &info);
2992 }
2993
c1360a1c 2994 if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) &&
e9aeb2dd
GP		 2995 result == L2CAP_CR_SUCCESS) {
2996 u8 buf[128];
c1360a1c 2997 set_bit(CONF_REQ_SENT, &chan->conf_state);
e9aeb2dd 2998 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 2999 l2cap_build_conf_req(chan, buf), buf);
3000 chan->num_conf_req++;
e9aeb2dd
GP		 3001 }
3002
1da177e4
LT		 3003 return 0;
3004}
3005
3006static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3007{
3008 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3009 u16 scid, dcid, result, status;
48454079 3010 struct l2cap_chan *chan;
1da177e4 3011 u8 req[128];
3df91ea2 3012 int err;
1da177e4
LT		 3013
3014 scid = __le16_to_cpu(rsp->scid);
3015 dcid = __le16_to_cpu(rsp->dcid);
3016 result = __le16_to_cpu(rsp->result);
3017 status = __le16_to_cpu(rsp->status);
3018
1b009c98
AE		 3019 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x",
3020 dcid, scid, result, status);
1da177e4 3021
3df91ea2
AE		 3022 mutex_lock(&conn->chan_lock);
3023
1da177e4 3024 if (scid) {
3df91ea2
AE		 3025 chan = __l2cap_get_chan_by_scid(conn, scid);
3026 if (!chan) {
3027 err = -EFAULT;
3028 goto unlock;
3029 }
1da177e4 3030 } else {
3df91ea2
AE		 3031 chan = __l2cap_get_chan_by_ident(conn, cmd->ident);
3032 if (!chan) {
3033 err = -EFAULT;
3034 goto unlock;
3035 }
1da177e4
LT		 3036 }
3037
3df91ea2
AE		 3038 err = 0;
3039
6be36555 3040 l2cap_chan_lock(chan);
48454079 3041
1da177e4
LT		 3042 switch (result) {
3043 case L2CAP_CR_SUCCESS:
89bc500e 3044 l2cap_state_change(chan, BT_CONFIG);
fc7f8a7e 3045 chan->ident = 0;
fe4128e0 3046 chan->dcid = dcid;
c1360a1c 3047 clear_bit(CONF_CONNECT_PEND, &chan->conf_state);
6a8d3010 3048
c1360a1c 3049 if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state))
e9aeb2dd
GP		 3050 break;
3051
1da177e4 3052 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3053 l2cap_build_conf_req(chan, req), req);
3054 chan->num_conf_req++;
1da177e4
LT		 3055 break;
3056
3057 case L2CAP_CR_PEND:
c1360a1c 3058 set_bit(CONF_CONNECT_PEND, &chan->conf_state);
1da177e4
LT		 3059 break;
3060
3061 default:
48454079 3062 l2cap_chan_del(chan, ECONNREFUSED);
1da177e4
LT		 3063 break;
3064 }
3065
6be36555 3066 l2cap_chan_unlock(chan);
3df91ea2
AE		 3067
3068unlock:
3069 mutex_unlock(&conn->chan_lock);
3070
3071 return err;
1da177e4
LT		 3072}
3073
47d1ec61 3074static inline void set_default_fcs(struct l2cap_chan *chan)
8c462b60
MM		 3075{
3076 /* FCS is enabled only in ERTM or streaming mode, if one or both
3077 * sides request it.
3078 */
0c1bc5c6 3079 if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING)
47d1ec61 3080 chan->fcs = L2CAP_FCS_NONE;
c1360a1c 3081 else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state))
47d1ec61 3082 chan->fcs = L2CAP_FCS_CRC16;
8c462b60
MM		 3083}
3084
88219a0f 3085static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3086{
3087 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3088 u16 dcid, flags;
3089 u8 rsp[64];
48454079 3090 struct l2cap_chan *chan;
3c588192 3091 int len, err = 0;
1da177e4
LT		 3092
3093 dcid = __le16_to_cpu(req->dcid);
3094 flags = __le16_to_cpu(req->flags);
3095
3096 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3097
baa7e1fa 3098 chan = l2cap_get_chan_by_scid(conn, dcid);
48454079 3099 if (!chan)
1da177e4
LT		 3100 return -ENOENT;
3101
6be36555 3102 l2cap_chan_lock(chan);
48454079 3103
033b1142 3104 if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
e2fd318e
IK		 3105 struct l2cap_cmd_rej_cid rej;
3106
3107 rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID);
3108 rej.scid = cpu_to_le16(chan->scid);
3109 rej.dcid = cpu_to_le16(chan->dcid);
df6bd743 3110
df6bd743
GP		 3111 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3112 sizeof(rej), &rej);
354f60a9 3113 goto unlock;
df6bd743 3114 }
354f60a9 3115
5dee9e7c 3116 /* Reject if config buffer is too small. */
88219a0f 3117 len = cmd_len - sizeof(*req);
7ac28817 3118 if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) {
5dee9e7c 3119 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3120 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c
MH		 3121 L2CAP_CONF_REJECT, flags), rsp);
3122 goto unlock;
3123 }
3124
3125 /* Store config. */
73ffa904
GP		 3126 memcpy(chan->conf_req + chan->conf_len, req->data, len);
3127 chan->conf_len += len;
1da177e4
LT		 3128
3129 if (flags & 0x0001) {
3130 /* Incomplete config. Send empty response. */
3131 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
fe4128e0 3132 l2cap_build_conf_rsp(chan, rsp,
5dee9e7c 3133 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 3134 goto unlock;
3135 }
3136
3137 /* Complete config. */
73ffa904 3138 len = l2cap_parse_conf_req(chan, rsp);
f2fcfcd6 3139 if (len < 0) {
e92c8e70 3140 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4 3141 goto unlock;
f2fcfcd6 3142 }
1da177e4 3143
5dee9e7c 3144 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
73ffa904 3145 chan->num_conf_rsp++;
5dee9e7c 3146
5dee9e7c 3147 /* Reset config buffer. */
73ffa904 3148 chan->conf_len = 0;
5dee9e7c 3149
c1360a1c 3150 if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state))
876d9484
MH		 3151 goto unlock;
3152
c1360a1c 3153 if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) {
47d1ec61 3154 set_default_fcs(chan);
fcc203c3 3155
89bc500e 3156 l2cap_state_change(chan, BT_CONNECTED);
e90bac06 3157
42e5c802
GP		 3158 chan->next_tx_seq = 0;
3159 chan->expected_tx_seq = 0;
58d35f87 3160 skb_queue_head_init(&chan->tx_q);
0c1bc5c6 3161 if (chan->mode == L2CAP_MODE_ERTM)
3c588192
MM		 3162 err = l2cap_ertm_init(chan);
3163
3164 if (err < 0)
3165 l2cap_send_disconn_req(chan->conn, chan, -err);
3166 else
3167 l2cap_chan_ready(chan);
0565c1c2 3168
876d9484
MH		 3169 goto unlock;
3170 }
3171
c1360a1c 3172 if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) {
79d554a6 3173 u8 buf[64];
1da177e4 3174 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
73ffa904
GP		 3175 l2cap_build_conf_req(chan, buf), buf);
3176 chan->num_conf_req++;
1da177e4
LT		 3177 }
3178
0e8b207e
AE		 3179 /* Got Conf Rsp PENDING from remote side and asume we sent
3180 Conf Rsp PENDING in the code above */
3181 if (test_bit(CONF_REM_CONF_PEND, &chan->conf_state) &&
3182 test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3183
3184 /* check compatibility */
3185
3186 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3187 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3188
3189 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3190 l2cap_build_conf_rsp(chan, rsp,
0e8b207e
AE		 3191 L2CAP_CONF_SUCCESS, 0x0000), rsp);
3192 }
3193
1da177e4 3194unlock:
6be36555 3195 l2cap_chan_unlock(chan);
3c588192 3196 return err;
1da177e4
LT		 3197}
3198
3199static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3200{
3201 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3202 u16 scid, flags, result;
48454079 3203 struct l2cap_chan *chan;
61386cba 3204 int len = le16_to_cpu(cmd->len) - sizeof(*rsp);
3c588192 3205 int err = 0;
1da177e4
LT		 3206
3207 scid = __le16_to_cpu(rsp->scid);
3208 flags = __le16_to_cpu(rsp->flags);
3209 result = __le16_to_cpu(rsp->result);
3210
61386cba
AE		 3211 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x len %d", scid, flags,
3212 result, len);
1da177e4 3213
baa7e1fa 3214 chan = l2cap_get_chan_by_scid(conn, scid);
48454079 3215 if (!chan)
1da177e4
LT		 3216 return 0;
3217
6be36555 3218 l2cap_chan_lock(chan);
48454079 3219
1da177e4
LT		 3220 switch (result) {
3221 case L2CAP_CONF_SUCCESS:
47d1ec61 3222 l2cap_conf_rfc_get(chan, rsp->data, len);
0e8b207e 3223 clear_bit(CONF_REM_CONF_PEND, &chan->conf_state);
1da177e4
LT		 3224 break;
3225
0e8b207e
AE		 3226 case L2CAP_CONF_PENDING:
3227 set_bit(CONF_REM_CONF_PEND, &chan->conf_state);
3228
3229 if (test_bit(CONF_LOC_CONF_PEND, &chan->conf_state)) {
3230 char buf[64];
3231
3232 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3233 buf, &result);
3234 if (len < 0) {
3235 l2cap_send_disconn_req(conn, chan, ECONNRESET);
3236 goto done;
3237 }
3238
3239 /* check compatibility */
3240
3241 clear_bit(CONF_LOC_CONF_PEND, &chan->conf_state);
3242 set_bit(CONF_OUTPUT_DONE, &chan->conf_state);
3243
3244 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3e6b3b95 3245 l2cap_build_conf_rsp(chan, buf,
0e8b207e
AE		 3246 L2CAP_CONF_SUCCESS, 0x0000), buf);
3247 }
3248 goto done;
3249
1da177e4 3250 case L2CAP_CONF_UNACCEPT:
73ffa904 3251 if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3252 char req[64];
3253
c2c77ec8 3254 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
e92c8e70 3255 l2cap_send_disconn_req(conn, chan, ECONNRESET);
c2c77ec8
AE		 3256 goto done;
3257 }
3258
f2fcfcd6
GP		 3259 /* throw out any old stored conf requests */
3260 result = L2CAP_CONF_SUCCESS;
b4450035
GP		 3261 len = l2cap_parse_conf_rsp(chan, rsp->data, len,
3262 req, &result);
f2fcfcd6 3263 if (len < 0) {
e92c8e70 3264 l2cap_send_disconn_req(conn, chan, ECONNRESET);
f2fcfcd6
GP		 3265 goto done;
3266 }
3267
3268 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3269 L2CAP_CONF_REQ, len, req);
73ffa904 3270 chan->num_conf_req++;
f2fcfcd6
GP		 3271 if (result != L2CAP_CONF_SUCCESS)
3272 goto done;
3273 break;
1da177e4
LT		 3274 }
3275
8e87d142 3276 default:
6be36555 3277 l2cap_chan_set_err(chan, ECONNRESET);
2e0052e4 3278
ba13ccd9 3279 __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT);
e92c8e70 3280 l2cap_send_disconn_req(conn, chan, ECONNRESET);
1da177e4
LT		 3281 goto done;
3282 }
3283
3284 if (flags & 0x01)
3285 goto done;
3286
c1360a1c 3287 set_bit(CONF_INPUT_DONE, &chan->conf_state);
1da177e4 3288
c1360a1c 3289 if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) {
47d1ec61 3290 set_default_fcs(chan);
fcc203c3 3291
89bc500e 3292 l2cap_state_change(chan, BT_CONNECTED);
42e5c802
GP		 3293 chan->next_tx_seq = 0;
3294 chan->expected_tx_seq = 0;
58d35f87 3295 skb_queue_head_init(&chan->tx_q);
0c1bc5c6 3296 if (chan->mode == L2CAP_MODE_ERTM)
3c588192 3297 err = l2cap_ertm_init(chan);
0565c1c2 3298
3c588192
MM		 3299 if (err < 0)
3300 l2cap_send_disconn_req(chan->conn, chan, -err);
3301 else
3302 l2cap_chan_ready(chan);
1da177e4
LT		 3303 }
3304
3305done:
6be36555 3306 l2cap_chan_unlock(chan);
3c588192 3307 return err;
1da177e4
LT		 3308}
3309
3310static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3311{
3312 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3313 struct l2cap_disconn_rsp rsp;
3314 u16 dcid, scid;
48454079 3315 struct l2cap_chan *chan;
1da177e4
LT		 3316 struct sock *sk;
3317
3318 scid = __le16_to_cpu(req->scid);
3319 dcid = __le16_to_cpu(req->dcid);
3320
3321 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3322
3df91ea2
AE		 3323 mutex_lock(&conn->chan_lock);
3324
3325 chan = __l2cap_get_chan_by_scid(conn, dcid);
3326 if (!chan) {
3327 mutex_unlock(&conn->chan_lock);
1da177e4 3328 return 0;
3df91ea2 3329 }
1da177e4 3330
6be36555
AE		 3331 l2cap_chan_lock(chan);
3332
48454079
GP		 3333 sk = chan->sk;
3334
fe4128e0
GP		 3335 rsp.dcid = cpu_to_le16(chan->scid);
3336 rsp.scid = cpu_to_le16(chan->dcid);
1da177e4
LT		 3337 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3338
6be36555 3339 lock_sock(sk);
1da177e4 3340 sk->sk_shutdown = SHUTDOWN_MASK;
6be36555 3341 release_sock(sk);
1da177e4 3342
48454079 3343 l2cap_chan_del(chan, ECONNRESET);
6be36555
AE		 3344
3345 l2cap_chan_unlock(chan);
1da177e4 3346
ba3bd0ee 3347 chan->ops->close(chan->data);
3df91ea2
AE		 3348
3349 mutex_unlock(&conn->chan_lock);
3350
1da177e4
LT		 3351 return 0;
3352}
3353
3354static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3355{
3356 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3357 u16 dcid, scid;
48454079 3358 struct l2cap_chan *chan;
1da177e4
LT		 3359
3360 scid = __le16_to_cpu(rsp->scid);
3361 dcid = __le16_to_cpu(rsp->dcid);
3362
3363 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3364
3df91ea2
AE		 3365 mutex_lock(&conn->chan_lock);
3366
3367 chan = __l2cap_get_chan_by_scid(conn, scid);
3368 if (!chan) {
3369 mutex_unlock(&conn->chan_lock);
1da177e4 3370 return 0;
3df91ea2 3371 }
1da177e4 3372
6be36555 3373 l2cap_chan_lock(chan);
48454079 3374
48454079 3375 l2cap_chan_del(chan, 0);
6be36555
AE		 3376
3377 l2cap_chan_unlock(chan);
1da177e4 3378
ba3bd0ee 3379 chan->ops->close(chan->data);
3df91ea2
AE		 3380
3381 mutex_unlock(&conn->chan_lock);
3382
1da177e4
LT		 3383 return 0;
3384}
3385
3386static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3387{
3388 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3389 u16 type;
3390
3391 type = __le16_to_cpu(req->type);
3392
3393 BT_DBG("type 0x%4.4x", type);
3394
f0709e03
MH		 3395 if (type == L2CAP_IT_FEAT_MASK) {
3396 u8 buf[8];
44dd46de 3397 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3398 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3399 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3400 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3401 if (!disable_ertm)
fcc203c3
GP		 3402 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3403 | L2CAP_FEAT_FCS;
a5fd6f30 3404 if (enable_hs)
6327eb98
AE		 3405 feat_mask |= L2CAP_FEAT_EXT_FLOW
3406 | L2CAP_FEAT_EXT_WINDOW;
a5fd6f30 3407
1b7bf4ed 3408 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3409 l2cap_send_cmd(conn, cmd->ident,
3410 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3411 } else if (type == L2CAP_IT_FIXED_CHAN) {
3412 u8 buf[12];
3413 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
50a147cd
MM		 3414
3415 if (enable_hs)
3416 l2cap_fixed_chan[0] |= L2CAP_FC_A2MP;
3417 else
3418 l2cap_fixed_chan[0] &= ~L2CAP_FC_A2MP;
3419
e1027a7c
MH		 3420 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3421 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
c6337ea6 3422 memcpy(rsp->data, l2cap_fixed_chan, sizeof(l2cap_fixed_chan));
e1027a7c
MH		 3423 l2cap_send_cmd(conn, cmd->ident,
3424 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3425 } else {
3426 struct l2cap_info_rsp rsp;
3427 rsp.type = cpu_to_le16(type);
3428 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3429 l2cap_send_cmd(conn, cmd->ident,
3430 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3431 }
1da177e4
LT		 3432
3433 return 0;
3434}
3435
3436static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3437{
3438 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3439 u16 type, result;
3440
3441 type = __le16_to_cpu(rsp->type);
3442 result = __le16_to_cpu(rsp->result);
3443
3444 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3445
e90165be
AE		 3446 /* L2CAP Info req/rsp are unbound to channels, add extra checks */
3447 if (cmd->ident != conn->info_ident ||
3448 conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)
3449 return 0;
3450
17cd3f37 3451 cancel_delayed_work(&conn->info_timer);
4e8402a3 3452
adb08ede
VT		 3453 if (result != L2CAP_IR_SUCCESS) {
3454 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3455 conn->info_ident = 0;
3456
3457 l2cap_conn_start(conn);
3458
3459 return 0;
3460 }
3461
978c93b9
AE		 3462 switch (type) {
3463 case L2CAP_IT_FEAT_MASK:
83985319 3464 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3465
47ec1dcd 3466 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3467 struct l2cap_info_req req;
3468 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3469
3470 conn->info_ident = l2cap_get_ident(conn);
3471
3472 l2cap_send_cmd(conn, conn->info_ident,
3473 L2CAP_INFO_REQ, sizeof(req), &req);
3474 } else {
3475 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3476 conn->info_ident = 0;
3477
3478 l2cap_conn_start(conn);
3479 }
978c93b9
AE		 3480 break;
3481
3482 case L2CAP_IT_FIXED_CHAN:
3483 conn->fixed_chan_mask = rsp->data[0];
984947dc 3484 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3485 conn->info_ident = 0;
984947dc
MH		 3486
3487 l2cap_conn_start(conn);
978c93b9 3488 break;
984947dc 3489 }
4e8402a3 3490
1da177e4
LT		 3491 return 0;
3492}
3493
f94ff6ff
MM		 3494static inline int l2cap_create_channel_req(struct l2cap_conn *conn,
3495 struct l2cap_cmd_hdr *cmd, u16 cmd_len,
3496 void *data)
3497{
3498 struct l2cap_create_chan_req *req = data;
3499 struct l2cap_create_chan_rsp rsp;
3500 u16 psm, scid;
3501
3502 if (cmd_len != sizeof(*req))
3503 return -EPROTO;
3504
3505 if (!enable_hs)
3506 return -EINVAL;
3507
3508 psm = le16_to_cpu(req->psm);
3509 scid = le16_to_cpu(req->scid);
3510
3511 BT_DBG("psm %d, scid %d, amp_id %d", psm, scid, req->amp_id);
3512
3513 /* Placeholder: Always reject */
3514 rsp.dcid = 0;
3515 rsp.scid = cpu_to_le16(scid);
8ce0c498
AE		 3516 rsp.result = __constant_cpu_to_le16(L2CAP_CR_NO_MEM);
3517 rsp.status = __constant_cpu_to_le16(L2CAP_CS_NO_INFO);
f94ff6ff
MM		 3518
3519 l2cap_send_cmd(conn, cmd->ident, L2CAP_CREATE_CHAN_RSP,
3520 sizeof(rsp), &rsp);
3521
3522 return 0;
3523}
3524
3525static inline int l2cap_create_channel_rsp(struct l2cap_conn *conn,
3526 struct l2cap_cmd_hdr *cmd, void *data)
3527{
3528 BT_DBG("conn %p", conn);
3529
3530 return l2cap_connect_rsp(conn, cmd, data);
3531}
3532
8d5a04a1
MM		 3533static void l2cap_send_move_chan_rsp(struct l2cap_conn *conn, u8 ident,
3534 u16 icid, u16 result)
3535{
3536 struct l2cap_move_chan_rsp rsp;
3537
3538 BT_DBG("icid %d, result %d", icid, result);
3539
3540 rsp.icid = cpu_to_le16(icid);
3541 rsp.result = cpu_to_le16(result);
3542
3543 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_RSP, sizeof(rsp), &rsp);
3544}
3545
3546static void l2cap_send_move_chan_cfm(struct l2cap_conn *conn,
3547 struct l2cap_chan *chan, u16 icid, u16 result)
3548{
3549 struct l2cap_move_chan_cfm cfm;
3550 u8 ident;
3551
3552 BT_DBG("icid %d, result %d", icid, result);
3553
3554 ident = l2cap_get_ident(conn);
3555 if (chan)
3556 chan->ident = ident;
3557
3558 cfm.icid = cpu_to_le16(icid);
3559 cfm.result = cpu_to_le16(result);
3560
3561 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM, sizeof(cfm), &cfm);
3562}
3563
3564static void l2cap_send_move_chan_cfm_rsp(struct l2cap_conn *conn, u8 ident,
3565 u16 icid)
3566{
3567 struct l2cap_move_chan_cfm_rsp rsp;
3568
3569 BT_DBG("icid %d", icid);
3570
3571 rsp.icid = cpu_to_le16(icid);
3572 l2cap_send_cmd(conn, ident, L2CAP_MOVE_CHAN_CFM_RSP, sizeof(rsp), &rsp);
3573}
3574
3575static inline int l2cap_move_channel_req(struct l2cap_conn *conn,
3576 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3577{
3578 struct l2cap_move_chan_req *req = data;
3579 u16 icid = 0;
3580 u16 result = L2CAP_MR_NOT_ALLOWED;
3581
3582 if (cmd_len != sizeof(*req))
3583 return -EPROTO;
3584
3585 icid = le16_to_cpu(req->icid);
3586
3587 BT_DBG("icid %d, dest_amp_id %d", icid, req->dest_amp_id);
3588
3589 if (!enable_hs)
3590 return -EINVAL;
3591
3592 /* Placeholder: Always refuse */
3593 l2cap_send_move_chan_rsp(conn, cmd->ident, icid, result);
3594
3595 return 0;
3596}
3597
3598static inline int l2cap_move_channel_rsp(struct l2cap_conn *conn,
3599 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3600{
3601 struct l2cap_move_chan_rsp *rsp = data;
3602 u16 icid, result;
3603
3604 if (cmd_len != sizeof(*rsp))
3605 return -EPROTO;
3606
3607 icid = le16_to_cpu(rsp->icid);
3608 result = le16_to_cpu(rsp->result);
3609
3610 BT_DBG("icid %d, result %d", icid, result);
3611
3612 /* Placeholder: Always unconfirmed */
3613 l2cap_send_move_chan_cfm(conn, NULL, icid, L2CAP_MC_UNCONFIRMED);
3614
3615 return 0;
3616}
3617
3618static inline int l2cap_move_channel_confirm(struct l2cap_conn *conn,
3619 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3620{
3621 struct l2cap_move_chan_cfm *cfm = data;
3622 u16 icid, result;
3623
3624 if (cmd_len != sizeof(*cfm))
3625 return -EPROTO;
3626
3627 icid = le16_to_cpu(cfm->icid);
3628 result = le16_to_cpu(cfm->result);
3629
3630 BT_DBG("icid %d, result %d", icid, result);
3631
3632 l2cap_send_move_chan_cfm_rsp(conn, cmd->ident, icid);
3633
3634 return 0;
3635}
3636
3637static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
3638 struct l2cap_cmd_hdr *cmd, u16 cmd_len, void *data)
3639{
3640 struct l2cap_move_chan_cfm_rsp *rsp = data;
3641 u16 icid;
3642
3643 if (cmd_len != sizeof(*rsp))
3644 return -EPROTO;
3645
3646 icid = le16_to_cpu(rsp->icid);
3647
3648 BT_DBG("icid %d", icid);
3649
3650 return 0;
3651}
3652
e2174ca4 3653static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency,
de73115a
CT		 3654 u16 to_multiplier)
3655{
3656 u16 max_latency;
3657
3658 if (min > max || min < 6 || max > 3200)
3659 return -EINVAL;
3660
3661 if (to_multiplier < 10 || to_multiplier > 3200)
3662 return -EINVAL;
3663
3664 if (max >= to_multiplier * 8)
3665 return -EINVAL;
3666
3667 max_latency = (to_multiplier * 8 / max) - 1;
3668 if (latency > 499 || latency > max_latency)
3669 return -EINVAL;
3670
3671 return 0;
3672}
3673
3674static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn,
3675 struct l2cap_cmd_hdr *cmd, u8 *data)
3676{
3677 struct hci_conn *hcon = conn->hcon;
3678 struct l2cap_conn_param_update_req *req;
3679 struct l2cap_conn_param_update_rsp rsp;
3680 u16 min, max, latency, to_multiplier, cmd_len;
2ce603eb 3681 int err;
de73115a
CT		 3682
3683 if (!(hcon->link_mode & HCI_LM_MASTER))
3684 return -EINVAL;
3685
3686 cmd_len = __le16_to_cpu(cmd->len);
3687 if (cmd_len != sizeof(struct l2cap_conn_param_update_req))
3688 return -EPROTO;
3689
3690 req = (struct l2cap_conn_param_update_req *) data;
e2174ca4
GP		 3691 min = __le16_to_cpu(req->min);
3692 max = __le16_to_cpu(req->max);
de73115a
CT		 3693 latency = __le16_to_cpu(req->latency);
3694 to_multiplier = __le16_to_cpu(req->to_multiplier);
3695
3696 BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x",
3697 min, max, latency, to_multiplier);
3698
3699 memset(&rsp, 0, sizeof(rsp));
2ce603eb
CT		 3700
3701 err = l2cap_check_conn_param(min, max, latency, to_multiplier);
3702 if (err)
de73115a
CT		 3703 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED);
3704 else
3705 rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED);
3706
3707 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP,
3708 sizeof(rsp), &rsp);
3709
2ce603eb
CT		 3710 if (!err)
3711 hci_le_conn_update(hcon, min, max, latency, to_multiplier);
3712
de73115a
CT		 3713 return 0;
3714}
3715
3300d9a9
CT		 3716static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn,
3717 struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
3718{
3719 int err = 0;
3720
3721 switch (cmd->code) {
3722 case L2CAP_COMMAND_REJ:
3723 l2cap_command_rej(conn, cmd, data);
3724 break;
3725
3726 case L2CAP_CONN_REQ:
3727 err = l2cap_connect_req(conn, cmd, data);
3728 break;
3729
3730 case L2CAP_CONN_RSP:
3731 err = l2cap_connect_rsp(conn, cmd, data);
3732 break;
3733
3734 case L2CAP_CONF_REQ:
3735 err = l2cap_config_req(conn, cmd, cmd_len, data);
3736 break;
3737
3738 case L2CAP_CONF_RSP:
3739 err = l2cap_config_rsp(conn, cmd, data);
3740 break;
3741
3742 case L2CAP_DISCONN_REQ:
3743 err = l2cap_disconnect_req(conn, cmd, data);
3744 break;
3745
3746 case L2CAP_DISCONN_RSP:
3747 err = l2cap_disconnect_rsp(conn, cmd, data);
3748 break;
3749
3750 case L2CAP_ECHO_REQ:
3751 l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data);
3752 break;
3753
3754 case L2CAP_ECHO_RSP:
3755 break;
3756
3757 case L2CAP_INFO_REQ:
3758 err = l2cap_information_req(conn, cmd, data);
3759 break;
3760
3761 case L2CAP_INFO_RSP:
3762 err = l2cap_information_rsp(conn, cmd, data);
3763 break;
3764
f94ff6ff
MM		 3765 case L2CAP_CREATE_CHAN_REQ:
3766 err = l2cap_create_channel_req(conn, cmd, cmd_len, data);
3767 break;
3768
3769 case L2CAP_CREATE_CHAN_RSP:
3770 err = l2cap_create_channel_rsp(conn, cmd, data);
3771 break;
3772
8d5a04a1
MM		 3773 case L2CAP_MOVE_CHAN_REQ:
3774 err = l2cap_move_channel_req(conn, cmd, cmd_len, data);
3775 break;
3776
3777 case L2CAP_MOVE_CHAN_RSP:
3778 err = l2cap_move_channel_rsp(conn, cmd, cmd_len, data);
3779 break;
3780
3781 case L2CAP_MOVE_CHAN_CFM:
3782 err = l2cap_move_channel_confirm(conn, cmd, cmd_len, data);
3783 break;
3784
3785 case L2CAP_MOVE_CHAN_CFM_RSP:
3786 err = l2cap_move_channel_confirm_rsp(conn, cmd, cmd_len, data);
3787 break;
3788
3300d9a9
CT		 3789 default:
3790 BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code);
3791 err = -EINVAL;
3792 break;
3793 }
3794
3795 return err;
3796}
3797
3798static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn,
3799 struct l2cap_cmd_hdr *cmd, u8 *data)
3800{
3801 switch (cmd->code) {
3802 case L2CAP_COMMAND_REJ:
3803 return 0;
3804
3805 case L2CAP_CONN_PARAM_UPDATE_REQ:
de73115a 3806 return l2cap_conn_param_update_req(conn, cmd, data);
3300d9a9
CT		 3807
3808 case L2CAP_CONN_PARAM_UPDATE_RSP:
3809 return 0;
3810
3811 default:
3812 BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code);
3813 return -EINVAL;
3814 }
3815}
3816
3817static inline void l2cap_sig_channel(struct l2cap_conn *conn,
3818 struct sk_buff *skb)
1da177e4
LT		 3819{
3820 u8 *data = skb->data;
3821 int len = skb->len;
3822 struct l2cap_cmd_hdr cmd;
3300d9a9 3823 int err;
1da177e4
LT		 3824
3825 l2cap_raw_recv(conn, skb);
3826
3827 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3828 u16 cmd_len;
1da177e4
LT		 3829 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3830 data += L2CAP_CMD_HDR_SIZE;
3831 len -= L2CAP_CMD_HDR_SIZE;
3832
88219a0f 3833 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3834
88219a0f 3835 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3836
88219a0f 3837 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3838 BT_DBG("corrupted command");
3839 break;
3840 }
3841
3300d9a9
CT		 3842 if (conn->hcon->type == LE_LINK)
3843 err = l2cap_le_sig_cmd(conn, &cmd, data);
3844 else
3845 err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data);
1da177e4
LT		 3846
3847 if (err) {
e2fd318e 3848 struct l2cap_cmd_rej_unk rej;
2c6d1a2e
GP		 3849
3850 BT_ERR("Wrong link type (%d)", err);
1da177e4
LT		 3851
3852 /* FIXME: Map err to a valid reason */
e2fd318e 3853 rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
1da177e4
LT		 3854 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3855 }
3856
88219a0f
AV		 3857 data += cmd_len;
3858 len -= cmd_len;
1da177e4
LT		 3859 }
3860
3861 kfree_skb(skb);
3862}
3863
47d1ec61 3864static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb)
fcc203c3
GP		 3865{
3866 u16 our_fcs, rcv_fcs;
e4ca6d98
AE		 3867 int hdr_size;
3868
3869 if (test_bit(FLAG_EXT_CTRL, &chan->flags))
3870 hdr_size = L2CAP_EXT_HDR_SIZE;
3871 else
3872 hdr_size = L2CAP_ENH_HDR_SIZE;
fcc203c3 3873
47d1ec61 3874 if (chan->fcs == L2CAP_FCS_CRC16) {
03a51213 3875 skb_trim(skb, skb->len - L2CAP_FCS_SIZE);
fcc203c3
GP		 3876 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3877 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3878
3879 if (our_fcs != rcv_fcs)
7a560e5c 3880 return -EBADMSG;
fcc203c3
GP		 3881 }
3882 return 0;
3883}
3884
525cd185 3885static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan)
d5392c8f 3886{
88843ab0 3887 u32 control = 0;
d5392c8f 3888
6a026610 3889 chan->frames_sent = 0;
d5392c8f 3890
0b209fae 3891 control |= __set_reqseq(chan, chan->buffer_seq);
d5392c8f 3892
e2ab4353 3893 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
ab784b73 3894 control |= __set_ctrl_super(chan, L2CAP_SUPER_RNR);
525cd185 3895 l2cap_send_sframe(chan, control);
e2ab4353 3896 set_bit(CONN_RNR_SENT, &chan->conn_state);
d5392c8f
GP		 3897 }
3898
e2ab4353 3899 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state))
525cd185 3900 l2cap_retransmit_frames(chan);
d5392c8f 3901
525cd185 3902 l2cap_ertm_send(chan);
d5392c8f 3903
e2ab4353 3904 if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) &&
6a026610 3905 chan->frames_sent == 0) {
ab784b73 3906 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 3907 l2cap_send_sframe(chan, control);
d5392c8f
GP		 3908 }
3909}
3910
fb45de7d 3911static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u16 tx_seq, u8 sar)
8f17154f
GP		 3912{
3913 struct sk_buff *next_skb;
bfbacc11 3914 int tx_seq_offset, next_tx_seq_offset;
8f17154f
GP		 3915
3916 bt_cb(skb)->tx_seq = tx_seq;
3917 bt_cb(skb)->sar = sar;
3918
f1c6775b 3919 next_skb = skb_peek(&chan->srej_q);
8f17154f 3920
836be934 3921 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
bfbacc11 3922
039d9572 3923 while (next_skb) {
9b53350d
JPRV		 3924 if (bt_cb(next_skb)->tx_seq == tx_seq)
3925 return -EINVAL;
3926
836be934
AE		 3927 next_tx_seq_offset = __seq_offset(chan,
3928 bt_cb(next_skb)->tx_seq, chan->buffer_seq);
bfbacc11
JPRV		 3929
3930 if (next_tx_seq_offset > tx_seq_offset) {
f1c6775b 3931 __skb_queue_before(&chan->srej_q, next_skb, skb);
9b53350d 3932 return 0;
8f17154f
GP		 3933 }
3934
f1c6775b 3935 if (skb_queue_is_last(&chan->srej_q, next_skb))
039d9572
SJ		 3936 next_skb = NULL;
3937 else
3938 next_skb = skb_queue_next(&chan->srej_q, next_skb);
3939 }
8f17154f 3940
f1c6775b 3941 __skb_queue_tail(&chan->srej_q, skb);
9b53350d
JPRV		 3942
3943 return 0;
8f17154f
GP		 3944}
3945
84084a31
MM		 3946static void append_skb_frag(struct sk_buff *skb,
3947 struct sk_buff *new_frag, struct sk_buff **last_frag)
18778a63 3948{
84084a31
MM		 3949 /* skb->len reflects data in skb as well as all fragments
3950 * skb->data_len reflects only data in fragments
3951 */
3952 if (!skb_has_frag_list(skb))
3953 skb_shinfo(skb)->frag_list = new_frag;
3954
3955 new_frag->next = NULL;
3956
3957 (*last_frag)->next = new_frag;
3958 *last_frag = new_frag;
3959
3960 skb->len += new_frag->len;
3961 skb->data_len += new_frag->len;
3962 skb->truesize += new_frag->truesize;
3963}
3964
88843ab0 3965static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u32 control)
84084a31
MM		 3966{
3967 int err = -EINVAL;
18778a63 3968
7e0ef6ee
AE		 3969 switch (__get_ctrl_sar(chan, control)) {
3970 case L2CAP_SAR_UNSEGMENTED:
84084a31
MM		 3971 if (chan->sdu)
3972 break;
18778a63 3973
84084a31
MM		 3974 err = chan->ops->recv(chan->data, skb);
3975 break;
18778a63 3976
7e0ef6ee 3977 case L2CAP_SAR_START:
84084a31
MM		 3978 if (chan->sdu)
3979 break;
18778a63 3980
6f61fd47 3981 chan->sdu_len = get_unaligned_le16(skb->data);
03a51213 3982 skb_pull(skb, L2CAP_SDULEN_SIZE);
18778a63 3983
84084a31
MM		 3984 if (chan->sdu_len > chan->imtu) {
3985 err = -EMSGSIZE;
3986 break;
3987 }
1890d36b 3988
84084a31
MM		 3989 if (skb->len >= chan->sdu_len)
3990 break;
18778a63 3991
84084a31
MM		 3992 chan->sdu = skb;
3993 chan->sdu_last_frag = skb;
18778a63 3994
84084a31
MM		 3995 skb = NULL;
3996 err = 0;
18778a63
GP		 3997 break;
3998
7e0ef6ee 3999 case L2CAP_SAR_CONTINUE:
6f61fd47 4000 if (!chan->sdu)
84084a31 4001 break;
18778a63 4002
84084a31
MM		 4003 append_skb_frag(chan->sdu, skb,
4004 &chan->sdu_last_frag);
4005 skb = NULL;
18778a63 4006
84084a31
MM		 4007 if (chan->sdu->len >= chan->sdu_len)
4008 break;
4178ba46 4009
84084a31 4010 err = 0;
18778a63
GP		 4011 break;
4012
7e0ef6ee 4013 case L2CAP_SAR_END:
6f61fd47 4014 if (!chan->sdu)
84084a31 4015 break;
18778a63 4016
84084a31
MM		 4017 append_skb_frag(chan->sdu, skb,
4018 &chan->sdu_last_frag);
4019 skb = NULL;
4178ba46 4020
84084a31
MM		 4021 if (chan->sdu->len != chan->sdu_len)
4022 break;
18778a63 4023
84084a31 4024 err = chan->ops->recv(chan->data, chan->sdu);
1890d36b 4025
84084a31
MM		 4026 if (!err) {
4027 /* Reassembly complete */
4028 chan->sdu = NULL;
4029 chan->sdu_last_frag = NULL;
4030 chan->sdu_len = 0;
1890d36b 4031 }
18778a63
GP		 4032 break;
4033 }
4034
84084a31
MM		 4035 if (err) {
4036 kfree_skb(skb);
4037 kfree_skb(chan->sdu);
4038 chan->sdu = NULL;
4039 chan->sdu_last_frag = NULL;
4040 chan->sdu_len = 0;
4041 }
18778a63 4042
84084a31 4043 return err;
18778a63
GP		 4044}
4045
26f880d2 4046static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan)
712132eb 4047{
26f880d2 4048 BT_DBG("chan %p, Enter local busy", chan);
712132eb 4049
26f880d2 4050 set_bit(CONN_LOCAL_BUSY, &chan->conn_state);
3c588192 4051 l2cap_seq_list_clear(&chan->srej_list);
26f880d2 4052
77f918bc 4053 __set_ack_timer(chan);
26f880d2
MM		 4054}
4055
4056static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan)
4057{
88843ab0 4058 u32 control;
712132eb 4059
e2ab4353 4060 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
712132eb
GP		 4061 goto done;
4062
0b209fae 4063 control = __set_reqseq(chan, chan->buffer_seq);
e3781735 4064 control |= __set_ctrl_poll(chan);
ab784b73 4065 control |= __set_ctrl_super(chan, L2CAP_SUPER_RR);
525cd185 4066 l2cap_send_sframe(chan, control);
6a026610 4067 chan->retry_count = 1;
712132eb 4068
1a09bcb9
GP		 4069 __clear_retrans_timer(chan);
4070 __set_monitor_timer(chan);
712132eb 4071
e2ab4353 4072 set_bit(CONN_WAIT_F, &chan->conn_state);
712132eb
GP		 4073
4074done:
e2ab4353
GP		 4075 clear_bit(CONN_LOCAL_BUSY, &chan->conn_state);
4076 clear_bit(CONN_RNR_SENT, &chan->conn_state);
712132eb 4077
49208c9c 4078 BT_DBG("chan %p, Exit local busy", chan);
712132eb
GP		 4079}
4080
e328140f 4081void l2cap_chan_busy(struct l2cap_chan *chan, int busy)
1890d36b 4082{
e328140f
MM		 4083 if (chan->mode == L2CAP_MODE_ERTM) {
4084 if (busy)
4085 l2cap_ertm_enter_local_busy(chan);
4086 else
4087 l2cap_ertm_exit_local_busy(chan);
1890d36b 4088 }
1890d36b
GP		 4089}
4090
fb45de7d 4091static void l2cap_check_srej_gap(struct l2cap_chan *chan, u16 tx_seq)
8f17154f
GP		 4092{
4093 struct sk_buff *skb;
88843ab0 4094 u32 control;
8f17154f 4095
e328140f
MM		 4096 while ((skb = skb_peek(&chan->srej_q)) &&
4097 !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4098 int err;
4099
8f17154f
GP		 4100 if (bt_cb(skb)->tx_seq != tx_seq)
4101 break;
4102
f1c6775b 4103 skb = skb_dequeue(&chan->srej_q);
7e0ef6ee 4104 control = __set_ctrl_sar(chan, bt_cb(skb)->sar);
84084a31 4105 err = l2cap_reassemble_sdu(chan, skb, control);
e328140f
MM		 4106
4107 if (err < 0) {
4108 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4109 break;
4110 }
4111
836be934
AE		 4112 chan->buffer_seq_srej = __next_seq(chan, chan->buffer_seq_srej);
4113 tx_seq = __next_seq(chan, tx_seq);
8f17154f
GP		 4114 }
4115}
4116
fb45de7d 4117static void l2cap_resend_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4118{
8f17154f 4119 struct srej_list *l, *tmp;
88843ab0 4120 u32 control;
8f17154f 4121
39d5a3ee 4122 list_for_each_entry_safe(l, tmp, &chan->srej_l, list) {
8f17154f
GP		 4123 if (l->tx_seq == tx_seq) {
4124 list_del(&l->list);
4125 kfree(l);
4126 return;
4127 }
ab784b73 4128 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4129 control |= __set_reqseq(chan, l->tx_seq);
525cd185 4130 l2cap_send_sframe(chan, control);
8f17154f 4131 list_del(&l->list);
39d5a3ee 4132 list_add_tail(&l->list, &chan->srej_l);
8f17154f
GP		 4133 }
4134}
4135
aef89f21 4136static int l2cap_send_srejframe(struct l2cap_chan *chan, u16 tx_seq)
8f17154f 4137{
8f17154f 4138 struct srej_list *new;
88843ab0 4139 u32 control;
8f17154f 4140
42e5c802 4141 while (tx_seq != chan->expected_tx_seq) {
ab784b73 4142 control = __set_ctrl_super(chan, L2CAP_SUPER_SREJ);
0b209fae 4143 control |= __set_reqseq(chan, chan->expected_tx_seq);
3c588192 4144 l2cap_seq_list_append(&chan->srej_list, chan->expected_tx_seq);
525cd185 4145 l2cap_send_sframe(chan, control);
8f17154f
GP		 4146
4147 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
aef89f21
SJ		 4148 if (!new)
4149 return -ENOMEM;
4150
42e5c802 4151 new->tx_seq = chan->expected_tx_seq;
836be934
AE		 4152
4153 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
4154
39d5a3ee 4155 list_add_tail(&new->list, &chan->srej_l);
8f17154f 4156 }
836be934
AE		 4157
4158 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
aef89f21
SJ		 4159
4160 return 0;
8f17154f
GP		 4161}
4162
88843ab0 4163static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
1c2acffb 4164{
fb45de7d 4165 u16 tx_seq = __get_txseq(chan, rx_control);
0b209fae 4166 u16 req_seq = __get_reqseq(chan, rx_control);
7e0ef6ee 4167 u8 sar = __get_ctrl_sar(chan, rx_control);
f6337c77 4168 int tx_seq_offset, expected_tx_seq_offset;
47d1ec61 4169 int num_to_ack = (chan->tx_win/6) + 1;
1c2acffb
GP		 4170 int err = 0;
4171
88843ab0 4172 BT_DBG("chan %p len %d tx_seq %d rx_control 0x%8.8x", chan, skb->len,
525cd185 4173 tx_seq, rx_control);
1c2acffb 4174
03f6715d 4175 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4176 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4177 __clear_monitor_timer(chan);
6a026610 4178 if (chan->unacked_frames > 0)
1a09bcb9 4179 __set_retrans_timer(chan);
e2ab4353 4180 clear_bit(CONN_WAIT_F, &chan->conn_state);
1d8f5d16
GP		 4181 }
4182
42e5c802
GP		 4183 chan->expected_ack_seq = req_seq;
4184 l2cap_drop_acked_frames(chan);
9f121a5a 4185
836be934 4186 tx_seq_offset = __seq_offset(chan, tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4187
4188 /* invalid tx_seq */
47d1ec61 4189 if (tx_seq_offset >= chan->tx_win) {
8c1d787b 4190 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
9b53350d
JPRV		 4191 goto drop;
4192 }
4193
77f918bc
SJ		 4194 if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) {
4195 if (!test_bit(CONN_RNR_SENT, &chan->conn_state))
4196 l2cap_send_ack(chan);
1890d36b 4197 goto drop;
77f918bc 4198 }
1890d36b 4199
02f1b641
MM		 4200 if (tx_seq == chan->expected_tx_seq)
4201 goto expected;
4202
e2ab4353 4203 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
8f17154f 4204 struct srej_list *first;
30afb5b2 4205
39d5a3ee 4206 first = list_first_entry(&chan->srej_l,
8f17154f
GP		 4207 struct srej_list, list);
4208 if (tx_seq == first->tx_seq) {
42e5c802 4209 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
525cd185 4210 l2cap_check_srej_gap(chan, tx_seq);
8f17154f
GP		 4211
4212 list_del(&first->list);
4213 kfree(first);
4214
39d5a3ee 4215 if (list_empty(&chan->srej_l)) {
42e5c802 4216 chan->buffer_seq = chan->buffer_seq_srej;
e2ab4353 4217 clear_bit(CONN_SREJ_SENT, &chan->conn_state);
525cd185 4218 l2cap_send_ack(chan);
49208c9c 4219 BT_DBG("chan %p, Exit SREJ_SENT", chan);
8f17154f
GP		 4220 }
4221 } else {
4222 struct srej_list *l;
9b53350d
JPRV		 4223
4224 /* duplicated tx_seq */
42e5c802 4225 if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0)
9b53350d 4226 goto drop;
8f17154f 4227
39d5a3ee 4228 list_for_each_entry(l, &chan->srej_l, list) {
8f17154f 4229 if (l->tx_seq == tx_seq) {
525cd185 4230 l2cap_resend_srejframe(chan, tx_seq);
8f17154f
GP		 4231 return 0;
4232 }
4233 }
aef89f21
SJ		 4234
4235 err = l2cap_send_srejframe(chan, tx_seq);
4236 if (err < 0) {
4237 l2cap_send_disconn_req(chan->conn, chan, -err);
4238 return err;
4239 }
30afb5b2
GP		 4240 }
4241 } else {
836be934
AE		 4242 expected_tx_seq_offset = __seq_offset(chan,
4243 chan->expected_tx_seq, chan->buffer_seq);
9b53350d
JPRV		 4244
4245 /* duplicated tx_seq */
4246 if (tx_seq_offset < expected_tx_seq_offset)
4247 goto drop;
4248
e2ab4353 4249 set_bit(CONN_SREJ_SENT, &chan->conn_state);
1c2acffb 4250
49208c9c 4251 BT_DBG("chan %p, Enter SREJ", chan);
0e98958d 4252
39d5a3ee 4253 INIT_LIST_HEAD(&chan->srej_l);
42e5c802 4254 chan->buffer_seq_srej = chan->buffer_seq;
8f17154f 4255
f1c6775b 4256 __skb_queue_head_init(&chan->srej_q);
42e5c802 4257 l2cap_add_to_srej_queue(chan, skb, tx_seq, sar);
8f17154f 4258
0ef3ef0f
SJ		 4259 /* Set P-bit only if there are some I-frames to ack. */
4260 if (__clear_ack_timer(chan))
4261 set_bit(CONN_SEND_PBIT, &chan->conn_state);
ef54fd93 4262
aef89f21
SJ		 4263 err = l2cap_send_srejframe(chan, tx_seq);
4264 if (err < 0) {
4265 l2cap_send_disconn_req(chan->conn, chan, -err);
4266 return err;
4267 }
1c2acffb 4268 }
30afb5b2
GP		 4269 return 0;
4270
8f17154f 4271expected:
836be934 4272 chan->expected_tx_seq = __next_seq(chan, chan->expected_tx_seq);
8f17154f 4273
e2ab4353 4274 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
3b1a9f3f
GP		 4275 bt_cb(skb)->tx_seq = tx_seq;
4276 bt_cb(skb)->sar = sar;
f1c6775b 4277 __skb_queue_tail(&chan->srej_q, skb);
8f17154f
GP		 4278 return 0;
4279 }
4280
84084a31 4281 err = l2cap_reassemble_sdu(chan, skb, rx_control);
836be934
AE		 4282 chan->buffer_seq = __next_seq(chan, chan->buffer_seq);
4283
e328140f
MM		 4284 if (err < 0) {
4285 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
4286 return err;
4287 }
2ece3684 4288
03f6715d 4289 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4290 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4291 l2cap_retransmit_frames(chan);
4ec10d97
GP		 4292 }
4293
c1b4f43b 4294
6a026610
GP		 4295 chan->num_acked = (chan->num_acked + 1) % num_to_ack;
4296 if (chan->num_acked == num_to_ack - 1)
525cd185 4297 l2cap_send_ack(chan);
4d611e4d
GP		 4298 else
4299 __set_ack_timer(chan);
9e917af1 4300
8f17154f 4301 return 0;
9b53350d
JPRV		 4302
4303drop:
4304 kfree_skb(skb);
4305 return 0;
1c2acffb
GP		 4306}
4307
88843ab0 4308static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u32 rx_control)
1c2acffb 4309{
88843ab0 4310 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan,
0b209fae 4311 __get_reqseq(chan, rx_control), rx_control);
0e98958d 4312
0b209fae 4313 chan->expected_ack_seq = __get_reqseq(chan, rx_control);
42e5c802 4314 l2cap_drop_acked_frames(chan);
1c2acffb 4315
e3781735 4316 if (__is_ctrl_poll(chan, rx_control)) {
e2ab4353
GP		 4317 set_bit(CONN_SEND_FBIT, &chan->conn_state);
4318 if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
4319 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4320 (chan->unacked_frames > 0))
1a09bcb9 4321 __set_retrans_timer(chan);
05fbd89d 4322
e2ab4353 4323 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
525cd185 4324 l2cap_send_srejtail(chan);
05fbd89d 4325 } else {
525cd185 4326 l2cap_send_i_or_rr_or_rnr(chan);
05fbd89d 4327 }
1d8f5d16 4328
03f6715d 4329 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4330 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4ec10d97 4331
e2ab4353 4332 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4333 l2cap_retransmit_frames(chan);
2246b2f1 4334
e072745f 4335 } else {
e2ab4353 4336 if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) &&
6a026610 4337 (chan->unacked_frames > 0))
1a09bcb9 4338 __set_retrans_timer(chan);
1c2acffb 4339
e2ab4353
GP		 4340 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
4341 if (test_bit(CONN_SREJ_SENT, &chan->conn_state))
525cd185 4342 l2cap_send_ack(chan);
894718a6 4343 else
525cd185 4344 l2cap_ertm_send(chan);
e072745f
GP		 4345 }
4346}
2246b2f1 4347
88843ab0 4348static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4349{
0b209fae 4350 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4351
88843ab0 4352 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4353
e2ab4353 4354 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
e072745f 4355
42e5c802
GP		 4356 chan->expected_ack_seq = tx_seq;
4357 l2cap_drop_acked_frames(chan);
e072745f 4358
03f6715d 4359 if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4360 if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state))
525cd185 4361 l2cap_retransmit_frames(chan);
e072745f 4362 } else {
525cd185 4363 l2cap_retransmit_frames(chan);
30afb5b2 4364
e2ab4353
GP		 4365 if (test_bit(CONN_WAIT_F, &chan->conn_state))
4366 set_bit(CONN_REJ_ACT, &chan->conn_state);
e072745f
GP		 4367 }
4368}
88843ab0 4369static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4370{
0b209fae 4371 u16 tx_seq = __get_reqseq(chan, rx_control);
30afb5b2 4372
88843ab0 4373 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4374
e2ab4353 4375 clear_bit(CONN_REMOTE_BUSY, &chan->conn_state);
2246b2f1 4376
e3781735 4377 if (__is_ctrl_poll(chan, rx_control)) {
42e5c802
GP		 4378 chan->expected_ack_seq = tx_seq;
4379 l2cap_drop_acked_frames(chan);
3cb123d1 4380
e2ab4353 4381 set_bit(CONN_SEND_FBIT, &chan->conn_state);
525cd185 4382 l2cap_retransmit_one_frame(chan, tx_seq);
dfc909be 4383
525cd185 4384 l2cap_ertm_send(chan);
dfc909be 4385
e2ab4353 4386 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4387 chan->srej_save_reqseq = tx_seq;
e2ab4353 4388 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4389 }
03f6715d 4390 } else if (__is_ctrl_final(chan, rx_control)) {
e2ab4353 4391 if (test_bit(CONN_SREJ_ACT, &chan->conn_state) &&
6a026610 4392 chan->srej_save_reqseq == tx_seq)
e2ab4353 4393 clear_bit(CONN_SREJ_ACT, &chan->conn_state);
e072745f 4394 else
525cd185 4395 l2cap_retransmit_one_frame(chan, tx_seq);
e072745f 4396 } else {
525cd185 4397 l2cap_retransmit_one_frame(chan, tx_seq);
e2ab4353 4398 if (test_bit(CONN_WAIT_F, &chan->conn_state)) {
6a026610 4399 chan->srej_save_reqseq = tx_seq;
e2ab4353 4400 set_bit(CONN_SREJ_ACT, &chan->conn_state);
ef54fd93 4401 }
e072745f
GP		 4402 }
4403}
4404
88843ab0 4405static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u32 rx_control)
e072745f 4406{
0b209fae 4407 u16 tx_seq = __get_reqseq(chan, rx_control);
e072745f 4408
88843ab0 4409 BT_DBG("chan %p, req_seq %d ctrl 0x%8.8x", chan, tx_seq, rx_control);
0e98958d 4410
e2ab4353 4411 set_bit(CONN_REMOTE_BUSY, &chan->conn_state);
42e5c802
GP		 4412 chan->expected_ack_seq = tx_seq;
4413 l2cap_drop_acked_frames(chan);
e072745f 4414
e3781735 4415 if (__is_ctrl_poll(chan, rx_control))
e2ab4353 4416 set_bit(CONN_SEND_FBIT, &chan->conn_state);
3cb123d1 4417
e2ab4353 4418 if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) {
1a09bcb9 4419 __clear_retrans_timer(chan);
e3781735 4420 if (__is_ctrl_poll(chan, rx_control))
525cd185 4421 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL);
99b0d4b7 4422 return;
e072745f 4423 }
99b0d4b7 4424
e3781735 4425 if (__is_ctrl_poll(chan, rx_control)) {
525cd185 4426 l2cap_send_srejtail(chan);
ab784b73
AE		 4427 } else {
4428 rx_control = __set_ctrl_super(chan, L2CAP_SUPER_RR);
4429 l2cap_send_sframe(chan, rx_control);
4430 }
e072745f
GP		 4431}
4432
88843ab0 4433static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u32 rx_control, struct sk_buff *skb)
e072745f 4434{
88843ab0 4435 BT_DBG("chan %p rx_control 0x%8.8x len %d", chan, rx_control, skb->len);
e072745f 4436
03f6715d 4437 if (__is_ctrl_final(chan, rx_control) &&
e2ab4353 4438 test_bit(CONN_WAIT_F, &chan->conn_state)) {
1a09bcb9 4439 __clear_monitor_timer(chan);
6a026610 4440 if (chan->unacked_frames > 0)
1a09bcb9 4441 __set_retrans_timer(chan);
e2ab4353 4442 clear_bit(CONN_WAIT_F, &chan->conn_state);
e072745f
GP		 4443 }
4444
ab784b73
AE		 4445 switch (__get_ctrl_super(chan, rx_control)) {
4446 case L2CAP_SUPER_RR:
525cd185 4447 l2cap_data_channel_rrframe(chan, rx_control);
8f17154f
GP		 4448 break;
4449
ab784b73 4450 case L2CAP_SUPER_REJ:
525cd185 4451 l2cap_data_channel_rejframe(chan, rx_control);
e072745f 4452 break;
2246b2f1 4453
ab784b73 4454 case L2CAP_SUPER_SREJ:
525cd185 4455 l2cap_data_channel_srejframe(chan, rx_control);
e072745f
GP		 4456 break;
4457
ab784b73 4458 case L2CAP_SUPER_RNR:
525cd185 4459 l2cap_data_channel_rnrframe(chan, rx_control);
1c2acffb
GP		 4460 break;
4461 }
4462
faaebd19 4463 kfree_skb(skb);
1c2acffb
GP		 4464 return 0;
4465}
4466
cad8f1d0 4467static int l2cap_ertm_data_rcv(struct l2cap_chan *chan, struct sk_buff *skb)
218bb9df 4468{
88843ab0 4469 u32 control;
0b209fae 4470 u16 req_seq;
218bb9df
GP		 4471 int len, next_tx_seq_offset, req_seq_offset;
4472
b76bbd66
MM		 4473 __unpack_control(chan, skb);
4474
88843ab0
AE		 4475 control = __get_control(chan, skb->data);
4476 skb_pull(skb, __ctrl_size(chan));
218bb9df
GP		 4477 len = skb->len;
4478
4479 /*
4480 * We can just drop the corrupted I-frame here.
4481 * Receiver will miss it and start proper recovery
4482 * procedures and ask retransmission.
4483 */
47d1ec61 4484 if (l2cap_check_fcs(chan, skb))
218bb9df
GP		 4485 goto drop;
4486
793c2f1c 4487 if (__is_sar_start(chan, control) && !__is_sframe(chan, control))
03a51213 4488 len -= L2CAP_SDULEN_SIZE;
218bb9df 4489
47d1ec61 4490 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4491 len -= L2CAP_FCS_SIZE;
218bb9df 4492
47d1ec61 4493 if (len > chan->mps) {
8c1d787b 4494 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4495 goto drop;
4496 }
4497
0b209fae 4498 req_seq = __get_reqseq(chan, control);
218bb9df 4499
836be934
AE		 4500 req_seq_offset = __seq_offset(chan, req_seq, chan->expected_ack_seq);
4501
4502 next_tx_seq_offset = __seq_offset(chan, chan->next_tx_seq,
4503 chan->expected_ack_seq);
218bb9df
GP		 4504
4505 /* check for invalid req-seq */
4506 if (req_seq_offset > next_tx_seq_offset) {
8c1d787b 4507 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4508 goto drop;
4509 }
4510
793c2f1c 4511 if (!__is_sframe(chan, control)) {
218bb9df 4512 if (len < 0) {
8c1d787b 4513 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4514 goto drop;
4515 }
4516
525cd185 4517 l2cap_data_channel_iframe(chan, control, skb);
218bb9df
GP		 4518 } else {
4519 if (len != 0) {
4520 BT_ERR("%d", len);
8c1d787b 4521 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
218bb9df
GP		 4522 goto drop;
4523 }
4524
525cd185 4525 l2cap_data_channel_sframe(chan, control, skb);
218bb9df
GP		 4526 }
4527
4528 return 0;
4529
4530drop:
4531 kfree_skb(skb);
4532 return 0;
4533}
4534
1da177e4
LT		 4535static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4536{
48454079 4537 struct l2cap_chan *chan;
88843ab0 4538 u32 control;
fb45de7d 4539 u16 tx_seq;
218bb9df 4540 int len;
1da177e4 4541
baa7e1fa 4542 chan = l2cap_get_chan_by_scid(conn, cid);
48454079 4543 if (!chan) {
1da177e4 4544 BT_DBG("unknown cid 0x%4.4x", cid);
6be36555 4545 /* Drop packet and return */
3379013b 4546 kfree_skb(skb);
6be36555 4547 return 0;
1da177e4
LT		 4548 }
4549
6be36555 4550 l2cap_chan_lock(chan);
6840ed07 4551
49208c9c 4552 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4553
89bc500e 4554 if (chan->state != BT_CONNECTED)
1da177e4
LT		 4555 goto drop;
4556
0c1bc5c6 4557 switch (chan->mode) {
1c2acffb
GP		 4558 case L2CAP_MODE_BASIC:
4559 /* If socket recv buffers overflows we drop data here
4560 * which is *bad* because L2CAP has to be reliable.
4561 * But we don't have any other choice. L2CAP doesn't
4562 * provide flow control mechanism. */
1da177e4 4563
0c1bc5c6 4564 if (chan->imtu < skb->len)
1c2acffb 4565 goto drop;
1da177e4 4566
23070494 4567 if (!chan->ops->recv(chan->data, skb))
1c2acffb
GP		 4568 goto done;
4569 break;
4570
4571 case L2CAP_MODE_ERTM:
5ef8cb9e 4572 l2cap_ertm_data_rcv(chan, skb);
1c2acffb 4573
fcafde2e 4574 goto done;
1c2acffb 4575
6840ed07 4576 case L2CAP_MODE_STREAMING:
88843ab0
AE		 4577 control = __get_control(chan, skb->data);
4578 skb_pull(skb, __ctrl_size(chan));
6840ed07
GP		 4579 len = skb->len;
4580
47d1ec61 4581 if (l2cap_check_fcs(chan, skb))
26000089
GP		 4582 goto drop;
4583
7e0ef6ee 4584 if (__is_sar_start(chan, control))
03a51213 4585 len -= L2CAP_SDULEN_SIZE;
6840ed07 4586
47d1ec61 4587 if (chan->fcs == L2CAP_FCS_CRC16)
03a51213 4588 len -= L2CAP_FCS_SIZE;
fcc203c3 4589
793c2f1c 4590 if (len > chan->mps || len < 0 || __is_sframe(chan, control))
6840ed07
GP		 4591 goto drop;
4592
fb45de7d 4593 tx_seq = __get_txseq(chan, control);
6840ed07 4594
84084a31
MM		 4595 if (chan->expected_tx_seq != tx_seq) {
4596 /* Frame(s) missing - must discard partial SDU */
4597 kfree_skb(chan->sdu);
4598 chan->sdu = NULL;
4599 chan->sdu_last_frag = NULL;
4600 chan->sdu_len = 0;
6840ed07 4601
84084a31
MM		 4602 /* TODO: Notify userland of missing data */
4603 }
4604
836be934 4605 chan->expected_tx_seq = __next_seq(chan, tx_seq);
84084a31
MM		 4606
4607 if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE)
4608 l2cap_send_disconn_req(chan->conn, chan, ECONNRESET);
6840ed07
GP		 4609
4610 goto done;
4611
1c2acffb 4612 default:
0c1bc5c6 4613 BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode);
1c2acffb
GP		 4614 break;
4615 }
1da177e4
LT		 4616
4617drop:
4618 kfree_skb(skb);
4619
4620done:
6be36555 4621 l2cap_chan_unlock(chan);
0139418c 4622
1da177e4
LT		 4623 return 0;
4624}
4625
8e036fc3 4626static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4 4627{
23691d75 4628 struct l2cap_chan *chan;
1da177e4 4629
23691d75
GP		 4630 chan = l2cap_global_chan_by_psm(0, psm, conn->src);
4631 if (!chan)
1da177e4
LT		 4632 goto drop;
4633
5b4cedaa 4634 BT_DBG("chan %p, len %d", chan, skb->len);
1da177e4 4635
89bc500e 4636 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
1da177e4
LT		 4637 goto drop;
4638
e13e21dc 4639 if (chan->imtu < skb->len)
1da177e4
LT		 4640 goto drop;
4641
23070494 4642 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4643 return 0;
1da177e4
LT		 4644
4645drop:
4646 kfree_skb(skb);
4647
1da177e4
LT		 4648 return 0;
4649}
4650
d9b88702
AE		 4651static inline int l2cap_att_channel(struct l2cap_conn *conn, u16 cid,
4652 struct sk_buff *skb)
9f69bda6 4653{
23691d75 4654 struct l2cap_chan *chan;
9f69bda6 4655
23691d75
GP		 4656 chan = l2cap_global_chan_by_scid(0, cid, conn->src);
4657 if (!chan)
9f69bda6
GP		 4658 goto drop;
4659
5b4cedaa 4660 BT_DBG("chan %p, len %d", chan, skb->len);
9f69bda6 4661
89bc500e 4662 if (chan->state != BT_BOUND && chan->state != BT_CONNECTED)
9f69bda6
GP		 4663 goto drop;
4664
e13e21dc 4665 if (chan->imtu < skb->len)
9f69bda6
GP		 4666 goto drop;
4667
23070494 4668 if (!chan->ops->recv(chan->data, skb))
5b4cedaa 4669 return 0;
9f69bda6
GP		 4670
4671drop:
4672 kfree_skb(skb);
4673
9f69bda6
GP		 4674 return 0;
4675}
4676
1da177e4
LT		 4677static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4678{
4679 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4680 u16 cid, len;
4681 __le16 psm;
1da177e4
LT		 4682
4683 skb_pull(skb, L2CAP_HDR_SIZE);
4684 cid = __le16_to_cpu(lh->cid);
4685 len = __le16_to_cpu(lh->len);
4686
1c2acffb
GP		 4687 if (len != skb->len) {
4688 kfree_skb(skb);
4689 return;
4690 }
4691
1da177e4
LT		 4692 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4693
4694 switch (cid) {
3300d9a9 4695 case L2CAP_CID_LE_SIGNALING:
8db4dc46 4696 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4697 l2cap_sig_channel(conn, skb);
4698 break;
4699
8db4dc46 4700 case L2CAP_CID_CONN_LESS:
097db76c 4701 psm = get_unaligned((__le16 *) skb->data);
1da177e4
LT		 4702 skb_pull(skb, 2);
4703 l2cap_conless_channel(conn, psm, skb);
4704 break;
4705
9f69bda6
GP		 4706 case L2CAP_CID_LE_DATA:
4707 l2cap_att_channel(conn, cid, skb);
4708 break;
4709
b501d6a1
AB		 4710 case L2CAP_CID_SMP:
4711 if (smp_sig_channel(conn, skb))
4712 l2cap_conn_del(conn->hcon, EACCES);
4713 break;
4714
1da177e4
LT		 4715 default:
4716 l2cap_data_channel(conn, cid, skb);
4717 break;
4718 }
4719}
4720
4721/* ---- L2CAP interface with lower layer (HCI) ---- */
4722
686ebf28 4723int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr)
1da177e4
LT		 4724{
4725 int exact = 0, lm1 = 0, lm2 = 0;
23691d75 4726 struct l2cap_chan *c;
1da177e4 4727
1da177e4
LT		 4728 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4729
4730 /* Find listening sockets and check their link_mode */
23691d75
GP		 4731 read_lock(&chan_list_lock);
4732 list_for_each_entry(c, &chan_list, global_l) {
4733 struct sock *sk = c->sk;
4343478f 4734
89bc500e 4735 if (c->state != BT_LISTEN)
1da177e4
LT		 4736 continue;
4737
4738 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5 4739 lm1 |= HCI_LM_ACCEPT;
43bd0f32 4740 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5 4741 lm1 |= HCI_LM_MASTER;
1da177e4 4742 exact++;
2af6b9d5
MH		 4743 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4744 lm2 |= HCI_LM_ACCEPT;
43bd0f32 4745 if (test_bit(FLAG_ROLE_SWITCH, &c->flags))
2af6b9d5
MH		 4746 lm2 |= HCI_LM_MASTER;
4747 }
1da177e4 4748 }
23691d75 4749 read_unlock(&chan_list_lock);
1da177e4
LT		 4750
4751 return exact ? lm1 : lm2;
4752}
4753
686ebf28 4754int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
1da177e4 4755{
0139418c
MH		 4756 struct l2cap_conn *conn;
4757
1da177e4
LT		 4758 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4759
1da177e4 4760 if (!status) {
1da177e4
LT		 4761 conn = l2cap_conn_add(hcon, status);
4762 if (conn)
4763 l2cap_conn_ready(conn);
0139418c 4764 } else
e175072f 4765 l2cap_conn_del(hcon, bt_to_errno(status));
1da177e4
LT		 4766
4767 return 0;
4768}
4769
686ebf28 4770int l2cap_disconn_ind(struct hci_conn *hcon)
2950f21a
MH		 4771{
4772 struct l2cap_conn *conn = hcon->l2cap_data;
4773
4774 BT_DBG("hcon %p", hcon);
4775
686ebf28 4776 if (!conn)
9f5a0d7b 4777 return HCI_ERROR_REMOTE_USER_TERM;
2950f21a
MH		 4778 return conn->disc_reason;
4779}
4780
686ebf28 4781int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4782{
4783 BT_DBG("hcon %p reason %d", hcon, reason);
4784
e175072f 4785 l2cap_conn_del(hcon, bt_to_errno(reason));
1da177e4
LT		 4786 return 0;
4787}
4788
4343478f 4789static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt)
f62e4323 4790{
715ec005 4791 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED)
255c7601
MH		 4792 return;
4793
f62e4323 4794 if (encrypt == 0x00) {
4343478f 4795 if (chan->sec_level == BT_SECURITY_MEDIUM) {
ba13ccd9 4796 __set_chan_timer(chan, L2CAP_ENC_TIMEOUT);
4343478f 4797 } else if (chan->sec_level == BT_SECURITY_HIGH)
0f852724 4798 l2cap_chan_close(chan, ECONNREFUSED);
f62e4323 4799 } else {
4343478f 4800 if (chan->sec_level == BT_SECURITY_MEDIUM)
c9b66675 4801 __clear_chan_timer(chan);
f62e4323
MH		 4802 }
4803}
4804
686ebf28 4805int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4 4806{
0139418c 4807 struct l2cap_conn *conn = hcon->l2cap_data;
48454079 4808 struct l2cap_chan *chan;
1da177e4 4809
0139418c 4810 if (!conn)
1da177e4 4811 return 0;
0139418c 4812
1da177e4
LT		 4813 BT_DBG("conn %p", conn);
4814
160dc6ac
VCG		 4815 if (hcon->type == LE_LINK) {
4816 smp_distribute_keys(conn, 0);
17cd3f37 4817 cancel_delayed_work(&conn->security_timer);
160dc6ac
VCG		 4818 }
4819
3df91ea2 4820 mutex_lock(&conn->chan_lock);
1da177e4 4821
3df91ea2 4822 list_for_each_entry(chan, &conn->chan_l, list) {
6be36555 4823 l2cap_chan_lock(chan);
1da177e4 4824
f1cb9af5
VCG		 4825 BT_DBG("chan->scid %d", chan->scid);
4826
4827 if (chan->scid == L2CAP_CID_LE_DATA) {
4828 if (!status && encrypt) {
4829 chan->sec_level = hcon->sec_level;
cf4cd009 4830 l2cap_chan_ready(chan);
f1cb9af5
VCG		 4831 }
4832
6be36555 4833 l2cap_chan_unlock(chan);
f1cb9af5
VCG		 4834 continue;
4835 }
4836
c1360a1c 4837 if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) {
6be36555 4838 l2cap_chan_unlock(chan);
6a8d3010
MH		 4839 continue;
4840 }
4841
89bc500e
GP		 4842 if (!status && (chan->state == BT_CONNECTED ||
4843 chan->state == BT_CONFIG)) {
4343478f 4844 l2cap_check_encryption(chan, encrypt);
6be36555 4845 l2cap_chan_unlock(chan);
9719f8af
MH		 4846 continue;
4847 }
4848
89bc500e 4849 if (chan->state == BT_CONNECT) {
b1235d79 4850 if (!status) {
9b27f350 4851 l2cap_send_conn_req(chan);
b1235d79 4852 } else {
ba13ccd9 4853 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
b1235d79 4854 }
89bc500e 4855 } else if (chan->state == BT_CONNECT2) {
6be36555 4856 struct sock *sk = chan->sk;
b1235d79 4857 struct l2cap_conn_rsp rsp;
df3c3931 4858 __u16 res, stat;
1da177e4 4859
6be36555
AE		 4860 lock_sock(sk);
4861
b1235d79 4862 if (!status) {
df3c3931
JH		 4863 if (bt_sk(sk)->defer_setup) {
4864 struct sock *parent = bt_sk(sk)->parent;
4865 res = L2CAP_CR_PEND;
4866 stat = L2CAP_CS_AUTHOR_PEND;
05e9a2f6
IK		 4867 if (parent)
4868 parent->sk_data_ready(parent, 0);
df3c3931 4869 } else {
0e587be7 4870 __l2cap_state_change(chan, BT_CONFIG);
df3c3931
JH		 4871 res = L2CAP_CR_SUCCESS;
4872 stat = L2CAP_CS_NO_INFO;
4873 }
b1235d79 4874 } else {
0e587be7 4875 __l2cap_state_change(chan, BT_DISCONN);
ba13ccd9 4876 __set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
df3c3931
JH		 4877 res = L2CAP_CR_SEC_BLOCK;
4878 stat = L2CAP_CS_NO_INFO;
b1235d79
MH		 4879 }
4880
6be36555
AE		 4881 release_sock(sk);
4882
fe4128e0
GP		 4883 rsp.scid = cpu_to_le16(chan->dcid);
4884 rsp.dcid = cpu_to_le16(chan->scid);
df3c3931
JH		 4885 rsp.result = cpu_to_le16(res);
4886 rsp.status = cpu_to_le16(stat);
fc7f8a7e
GP		 4887 l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP,
4888 sizeof(rsp), &rsp);
b1235d79 4889 }
1da177e4 4890
6be36555 4891 l2cap_chan_unlock(chan);
1da177e4
LT		 4892 }
4893
3df91ea2 4894 mutex_unlock(&conn->chan_lock);
b1235d79 4895
1da177e4
LT		 4896 return 0;
4897}
4898
686ebf28 4899int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
1da177e4
LT		 4900{
4901 struct l2cap_conn *conn = hcon->l2cap_data;
4902
5a08ecce
AE		 4903 if (!conn)
4904 conn = l2cap_conn_add(hcon, 0);
4905
4906 if (!conn)
1da177e4
LT		 4907 goto drop;
4908
4909 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4910
e702112f 4911 if (!(flags & ACL_CONT)) {
1da177e4 4912 struct l2cap_hdr *hdr;
48454079 4913 struct l2cap_chan *chan;
89794813 4914 u16 cid;
1da177e4
LT		 4915 int len;
4916
4917 if (conn->rx_len) {
4918 BT_ERR("Unexpected start frame (len %d)", skb->len);
4919 kfree_skb(conn->rx_skb);
4920 conn->rx_skb = NULL;
4921 conn->rx_len = 0;
4922 l2cap_conn_unreliable(conn, ECOMM);
4923 }
4924
aae7fe22
AE		 4925 /* Start fragment always begin with Basic L2CAP header */
4926 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 4927 BT_ERR("Frame is too short (len %d)", skb->len);
4928 l2cap_conn_unreliable(conn, ECOMM);
4929 goto drop;
4930 }
4931
4932 hdr = (struct l2cap_hdr *) skb->data;
4933 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 4934 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 4935
4936 if (len == skb->len) {
4937 /* Complete frame received */
4938 l2cap_recv_frame(conn, skb);
4939 return 0;
4940 }
4941
4942 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
4943
4944 if (skb->len > len) {
4945 BT_ERR("Frame is too long (len %d, expected len %d)",
4946 skb->len, len);
4947 l2cap_conn_unreliable(conn, ECOMM);
4948 goto drop;
4949 }
4950
baa7e1fa 4951 chan = l2cap_get_chan_by_scid(conn, cid);
89794813 4952
48454079
GP		 4953 if (chan && chan->sk) {
4954 struct sock *sk = chan->sk;
3df91ea2 4955 lock_sock(sk);
89794813 4956
0c1bc5c6 4957 if (chan->imtu < len - L2CAP_HDR_SIZE) {
48454079
GP		 4958 BT_ERR("Frame exceeding recv MTU (len %d, "
4959 "MTU %d)", len,
0c1bc5c6 4960 chan->imtu);
aa2ac881 4961 release_sock(sk);
48454079
GP		 4962 l2cap_conn_unreliable(conn, ECOMM);
4963 goto drop;
4964 }
aa2ac881 4965 release_sock(sk);
48454079 4966 }
89794813 4967
1da177e4 4968 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 4969 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
4970 if (!conn->rx_skb)
1da177e4
LT		 4971 goto drop;
4972
d626f62b 4973 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4974 skb->len);
1da177e4
LT		 4975 conn->rx_len = len - skb->len;
4976 } else {
4977 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
4978
4979 if (!conn->rx_len) {
4980 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
4981 l2cap_conn_unreliable(conn, ECOMM);
4982 goto drop;
4983 }
4984
4985 if (skb->len > conn->rx_len) {
4986 BT_ERR("Fragment is too long (len %d, expected %d)",
4987 skb->len, conn->rx_len);
4988 kfree_skb(conn->rx_skb);
4989 conn->rx_skb = NULL;
4990 conn->rx_len = 0;
4991 l2cap_conn_unreliable(conn, ECOMM);
4992 goto drop;
4993 }
4994
d626f62b 4995 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4996 skb->len);
1da177e4
LT		 4997 conn->rx_len -= skb->len;
4998
4999 if (!conn->rx_len) {
5000 /* Complete frame received */
5001 l2cap_recv_frame(conn, conn->rx_skb);
5002 conn->rx_skb = NULL;
5003 }
5004 }
5005
5006drop:
5007 kfree_skb(skb);
5008 return 0;
5009}
5010
aef7d97c 5011static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4 5012{
23691d75 5013 struct l2cap_chan *c;
1da177e4 5014
333055f2 5015 read_lock(&chan_list_lock);
1da177e4 5016
23691d75
GP		 5017 list_for_each_entry(c, &chan_list, global_l) {
5018 struct sock *sk = c->sk;
101545f6 5019
903d343e 5020 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n",
aef7d97c
MH		 5021 batostr(&bt_sk(sk)->src),
5022 batostr(&bt_sk(sk)->dst),
89bc500e 5023 c->state, __le16_to_cpu(c->psm),
23691d75
GP		 5024 c->scid, c->dcid, c->imtu, c->omtu,
5025 c->sec_level, c->mode);
61e1b4b7 5026 }
1da177e4 5027
333055f2 5028 read_unlock(&chan_list_lock);
1da177e4 5029
aef7d97c 5030 return 0;
1da177e4
LT		 5031}
5032
aef7d97c
MH		 5033static int l2cap_debugfs_open(struct inode *inode, struct file *file)
5034{
5035 return single_open(file, l2cap_debugfs_show, inode->i_private);
5036}
5037
5038static const struct file_operations l2cap_debugfs_fops = {
5039 .open = l2cap_debugfs_open,
5040 .read = seq_read,
5041 .llseek = seq_lseek,
5042 .release = single_release,
5043};
5044
5045static struct dentry *l2cap_debugfs;
1da177e4 5046
64274518 5047int __init l2cap_init(void)
1da177e4
LT		 5048{
5049 int err;
be9d1227 5050
bb58f747 5051 err = l2cap_init_sockets();
1da177e4
LT		 5052 if (err < 0)
5053 return err;
5054
aef7d97c
MH		 5055 if (bt_debugfs) {
5056 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
5057 bt_debugfs, NULL, &l2cap_debugfs_fops);
5058 if (!l2cap_debugfs)
5059 BT_ERR("Failed to create L2CAP debug file");
5060 }
1da177e4 5061
1da177e4 5062 return 0;
1da177e4
LT		 5063}
5064
64274518 5065void l2cap_exit(void)
1da177e4 5066{
aef7d97c 5067 debugfs_remove(l2cap_debugfs);
bb58f747 5068 l2cap_cleanup_sockets();
1da177e4
LT		 5069}
5070
d1c4a17d
GP		 5071module_param(disable_ertm, bool, 0644);
5072MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
kernel source for telekom puls (alcatel/mediatek)