10a708f8fSGustavo F. Padovan /* 20a708f8fSGustavo F. Padovan BlueZ - Bluetooth protocol stack for Linux 30a708f8fSGustavo F. Padovan Copyright (C) 2000-2001 Qualcomm Incorporated 40a708f8fSGustavo F. Padovan Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 50a708f8fSGustavo F. Padovan Copyright (C) 2010 Google Inc. 60a708f8fSGustavo F. Padovan 70a708f8fSGustavo F. Padovan Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 80a708f8fSGustavo F. Padovan 90a708f8fSGustavo F. Padovan This program is free software; you can redistribute it and/or modify 100a708f8fSGustavo F. Padovan it under the terms of the GNU General Public License version 2 as 110a708f8fSGustavo F. Padovan published by the Free Software Foundation; 120a708f8fSGustavo F. Padovan 130a708f8fSGustavo F. Padovan THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 140a708f8fSGustavo F. Padovan OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 150a708f8fSGustavo F. Padovan FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 160a708f8fSGustavo F. Padovan IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 170a708f8fSGustavo F. Padovan CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 180a708f8fSGustavo F. Padovan WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 190a708f8fSGustavo F. Padovan ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 200a708f8fSGustavo F. Padovan OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 210a708f8fSGustavo F. Padovan 220a708f8fSGustavo F. Padovan ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 230a708f8fSGustavo F. Padovan COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 240a708f8fSGustavo F. Padovan SOFTWARE IS DISCLAIMED. 250a708f8fSGustavo F. Padovan */ 260a708f8fSGustavo F. Padovan 27bb58f747SGustavo F. Padovan /* Bluetooth L2CAP core. */ 280a708f8fSGustavo F. Padovan 290a708f8fSGustavo F. Padovan #include <linux/module.h> 300a708f8fSGustavo F. Padovan 310a708f8fSGustavo F. Padovan #include <linux/types.h> 320a708f8fSGustavo F. Padovan #include <linux/capability.h> 330a708f8fSGustavo F. Padovan #include <linux/errno.h> 340a708f8fSGustavo F. Padovan #include <linux/kernel.h> 350a708f8fSGustavo F. Padovan #include <linux/sched.h> 360a708f8fSGustavo F. Padovan #include <linux/slab.h> 370a708f8fSGustavo F. Padovan #include <linux/poll.h> 380a708f8fSGustavo F. Padovan #include <linux/fcntl.h> 390a708f8fSGustavo F. Padovan #include <linux/init.h> 400a708f8fSGustavo F. Padovan #include <linux/interrupt.h> 410a708f8fSGustavo F. Padovan #include <linux/socket.h> 420a708f8fSGustavo F. Padovan #include <linux/skbuff.h> 430a708f8fSGustavo F. Padovan #include <linux/list.h> 440a708f8fSGustavo F. Padovan #include <linux/device.h> 450a708f8fSGustavo F. Padovan #include <linux/debugfs.h> 460a708f8fSGustavo F. Padovan #include <linux/seq_file.h> 470a708f8fSGustavo F. Padovan #include <linux/uaccess.h> 480a708f8fSGustavo F. Padovan #include <linux/crc16.h> 490a708f8fSGustavo F. Padovan #include <net/sock.h> 500a708f8fSGustavo F. Padovan 510a708f8fSGustavo F. Padovan #include <asm/system.h> 520a708f8fSGustavo F. Padovan #include <asm/unaligned.h> 530a708f8fSGustavo F. Padovan 540a708f8fSGustavo F. Padovan #include <net/bluetooth/bluetooth.h> 550a708f8fSGustavo F. Padovan #include <net/bluetooth/hci_core.h> 560a708f8fSGustavo F. Padovan #include <net/bluetooth/l2cap.h> 57b501d6a1SAnderson Briglia #include <net/bluetooth/smp.h> 580a708f8fSGustavo F. Padovan 59bb58f747SGustavo F. Padovan int disable_ertm; 600a708f8fSGustavo F. Padovan 610a708f8fSGustavo F. Padovan static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN; 620a708f8fSGustavo F. Padovan static u8 l2cap_fixed_chan[8] = { 0x02, }; 630a708f8fSGustavo F. Padovan 64b5ad8b7fSJohannes Berg static LIST_HEAD(chan_list); 65b5ad8b7fSJohannes Berg static DEFINE_RWLOCK(chan_list_lock); 660a708f8fSGustavo F. Padovan 670a708f8fSGustavo F. Padovan static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 680a708f8fSGustavo F. Padovan u8 code, u8 ident, u16 dlen, void *data); 694519de9aSGustavo F. Padovan static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 704519de9aSGustavo F. Padovan void *data); 71710f9b0aSGustavo F. Padovan static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); 724519de9aSGustavo F. Padovan static void l2cap_send_disconn_req(struct l2cap_conn *conn, 734519de9aSGustavo F. Padovan struct l2cap_chan *chan, int err); 740a708f8fSGustavo F. Padovan 750a708f8fSGustavo F. Padovan static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb); 760a708f8fSGustavo F. Padovan 770a708f8fSGustavo F. Padovan /* ---- L2CAP channels ---- */ 7871ba0e56SGustavo F. Padovan 7971ba0e56SGustavo F. Padovan static inline void chan_hold(struct l2cap_chan *c) 8071ba0e56SGustavo F. Padovan { 8171ba0e56SGustavo F. Padovan atomic_inc(&c->refcnt); 8271ba0e56SGustavo F. Padovan } 8371ba0e56SGustavo F. Padovan 8471ba0e56SGustavo F. Padovan static inline void chan_put(struct l2cap_chan *c) 8571ba0e56SGustavo F. Padovan { 8671ba0e56SGustavo F. Padovan if (atomic_dec_and_test(&c->refcnt)) 8771ba0e56SGustavo F. Padovan kfree(c); 8871ba0e56SGustavo F. Padovan } 8971ba0e56SGustavo F. Padovan 90baa7e1faSGustavo F. Padovan static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid) 910a708f8fSGustavo F. Padovan { 9248454079SGustavo F. Padovan struct l2cap_chan *c; 93baa7e1faSGustavo F. Padovan 94baa7e1faSGustavo F. Padovan list_for_each_entry(c, &conn->chan_l, list) { 95fe4128e0SGustavo F. Padovan if (c->dcid == cid) 9648454079SGustavo F. Padovan return c; 970a708f8fSGustavo F. Padovan } 98baa7e1faSGustavo F. Padovan return NULL; 99baa7e1faSGustavo F. Padovan 100baa7e1faSGustavo F. Padovan } 1010a708f8fSGustavo F. Padovan 102baa7e1faSGustavo F. Padovan static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) 1030a708f8fSGustavo F. Padovan { 10448454079SGustavo F. Padovan struct l2cap_chan *c; 105baa7e1faSGustavo F. Padovan 106baa7e1faSGustavo F. Padovan list_for_each_entry(c, &conn->chan_l, list) { 107fe4128e0SGustavo F. Padovan if (c->scid == cid) 10848454079SGustavo F. Padovan return c; 1090a708f8fSGustavo F. Padovan } 110baa7e1faSGustavo F. Padovan return NULL; 111baa7e1faSGustavo F. Padovan } 1120a708f8fSGustavo F. Padovan 1130a708f8fSGustavo F. Padovan /* Find channel with given SCID. 1140a708f8fSGustavo F. Padovan * Returns locked socket */ 115baa7e1faSGustavo F. Padovan static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) 1160a708f8fSGustavo F. Padovan { 11748454079SGustavo F. Padovan struct l2cap_chan *c; 118baa7e1faSGustavo F. Padovan 119baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 120baa7e1faSGustavo F. Padovan c = __l2cap_get_chan_by_scid(conn, cid); 12148454079SGustavo F. Padovan if (c) 12248454079SGustavo F. Padovan bh_lock_sock(c->sk); 123baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 12448454079SGustavo F. Padovan return c; 1250a708f8fSGustavo F. Padovan } 1260a708f8fSGustavo F. Padovan 127baa7e1faSGustavo F. Padovan static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident) 1280a708f8fSGustavo F. Padovan { 12948454079SGustavo F. Padovan struct l2cap_chan *c; 130baa7e1faSGustavo F. Padovan 131baa7e1faSGustavo F. Padovan list_for_each_entry(c, &conn->chan_l, list) { 132fc7f8a7eSGustavo F. Padovan if (c->ident == ident) 13348454079SGustavo F. Padovan return c; 1340a708f8fSGustavo F. Padovan } 135baa7e1faSGustavo F. Padovan return NULL; 136baa7e1faSGustavo F. Padovan } 1370a708f8fSGustavo F. Padovan 138baa7e1faSGustavo F. Padovan static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident) 1390a708f8fSGustavo F. Padovan { 14048454079SGustavo F. Padovan struct l2cap_chan *c; 141baa7e1faSGustavo F. Padovan 142baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 143baa7e1faSGustavo F. Padovan c = __l2cap_get_chan_by_ident(conn, ident); 14448454079SGustavo F. Padovan if (c) 14548454079SGustavo F. Padovan bh_lock_sock(c->sk); 146baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 14748454079SGustavo F. Padovan return c; 1480a708f8fSGustavo F. Padovan } 1490a708f8fSGustavo F. Padovan 15023691d75SGustavo F. Padovan static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src) 1519e4425ffSGustavo F. Padovan { 15223691d75SGustavo F. Padovan struct l2cap_chan *c; 1539e4425ffSGustavo F. Padovan 15423691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 15523691d75SGustavo F. Padovan if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src)) 1569e4425ffSGustavo F. Padovan goto found; 1579e4425ffSGustavo F. Padovan } 1589e4425ffSGustavo F. Padovan 15923691d75SGustavo F. Padovan c = NULL; 1609e4425ffSGustavo F. Padovan found: 16123691d75SGustavo F. Padovan return c; 1629e4425ffSGustavo F. Padovan } 1639e4425ffSGustavo F. Padovan 1649e4425ffSGustavo F. Padovan int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 1659e4425ffSGustavo F. Padovan { 16673b2ec18SGustavo F. Padovan int err; 16773b2ec18SGustavo F. Padovan 16823691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 1699e4425ffSGustavo F. Padovan 17023691d75SGustavo F. Padovan if (psm && __l2cap_global_chan_by_addr(psm, src)) { 17173b2ec18SGustavo F. Padovan err = -EADDRINUSE; 17273b2ec18SGustavo F. Padovan goto done; 1739e4425ffSGustavo F. Padovan } 1749e4425ffSGustavo F. Padovan 17573b2ec18SGustavo F. Padovan if (psm) { 1769e4425ffSGustavo F. Padovan chan->psm = psm; 1779e4425ffSGustavo F. Padovan chan->sport = psm; 17873b2ec18SGustavo F. Padovan err = 0; 17973b2ec18SGustavo F. Padovan } else { 18073b2ec18SGustavo F. Padovan u16 p; 1819e4425ffSGustavo F. Padovan 18273b2ec18SGustavo F. Padovan err = -EINVAL; 18373b2ec18SGustavo F. Padovan for (p = 0x1001; p < 0x1100; p += 2) 18423691d75SGustavo F. Padovan if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) { 18573b2ec18SGustavo F. Padovan chan->psm = cpu_to_le16(p); 18673b2ec18SGustavo F. Padovan chan->sport = cpu_to_le16(p); 18773b2ec18SGustavo F. Padovan err = 0; 18873b2ec18SGustavo F. Padovan break; 18973b2ec18SGustavo F. Padovan } 19073b2ec18SGustavo F. Padovan } 19173b2ec18SGustavo F. Padovan 19273b2ec18SGustavo F. Padovan done: 19323691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 19473b2ec18SGustavo F. Padovan return err; 1959e4425ffSGustavo F. Padovan } 1969e4425ffSGustavo F. Padovan 1979e4425ffSGustavo F. Padovan int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 1989e4425ffSGustavo F. Padovan { 19923691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 2009e4425ffSGustavo F. Padovan 2019e4425ffSGustavo F. Padovan chan->scid = scid; 2029e4425ffSGustavo F. Padovan 20323691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 2049e4425ffSGustavo F. Padovan 2059e4425ffSGustavo F. Padovan return 0; 2069e4425ffSGustavo F. Padovan } 2079e4425ffSGustavo F. Padovan 208baa7e1faSGustavo F. Padovan static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 2090a708f8fSGustavo F. Padovan { 2100a708f8fSGustavo F. Padovan u16 cid = L2CAP_CID_DYN_START; 2110a708f8fSGustavo F. Padovan 2120a708f8fSGustavo F. Padovan for (; cid < L2CAP_CID_DYN_END; cid++) { 213baa7e1faSGustavo F. Padovan if (!__l2cap_get_chan_by_scid(conn, cid)) 2140a708f8fSGustavo F. Padovan return cid; 2150a708f8fSGustavo F. Padovan } 2160a708f8fSGustavo F. Padovan 2170a708f8fSGustavo F. Padovan return 0; 2180a708f8fSGustavo F. Padovan } 2190a708f8fSGustavo F. Padovan 220c9b66675SGustavo F. Padovan static void l2cap_set_timer(struct l2cap_chan *chan, struct timer_list *timer, long timeout) 221ab07801dSGustavo F. Padovan { 22289bc500eSGustavo F. Padovan BT_DBG("chan %p state %d timeout %ld", chan->sk, chan->state, timeout); 22389bc500eSGustavo F. Padovan 224942ecc9cSMat Martineau if (!mod_timer(timer, jiffies + msecs_to_jiffies(timeout))) 22571ba0e56SGustavo F. Padovan chan_hold(chan); 226ab07801dSGustavo F. Padovan } 227ab07801dSGustavo F. Padovan 228c9b66675SGustavo F. Padovan static void l2cap_clear_timer(struct l2cap_chan *chan, struct timer_list *timer) 229ab07801dSGustavo F. Padovan { 23089bc500eSGustavo F. Padovan BT_DBG("chan %p state %d", chan, chan->state); 231ab07801dSGustavo F. Padovan 232c9b66675SGustavo F. Padovan if (timer_pending(timer) && del_timer(timer)) 23371ba0e56SGustavo F. Padovan chan_put(chan); 234ab07801dSGustavo F. Padovan } 235ab07801dSGustavo F. Padovan 23689bc500eSGustavo F. Padovan static void l2cap_state_change(struct l2cap_chan *chan, int state) 23789bc500eSGustavo F. Padovan { 23889bc500eSGustavo F. Padovan chan->state = state; 23989bc500eSGustavo F. Padovan chan->ops->state_change(chan->data, state); 24089bc500eSGustavo F. Padovan } 24189bc500eSGustavo F. Padovan 242ab07801dSGustavo F. Padovan static void l2cap_chan_timeout(unsigned long arg) 243ab07801dSGustavo F. Padovan { 244ab07801dSGustavo F. Padovan struct l2cap_chan *chan = (struct l2cap_chan *) arg; 245ab07801dSGustavo F. Padovan struct sock *sk = chan->sk; 246ab07801dSGustavo F. Padovan int reason; 247ab07801dSGustavo F. Padovan 24889bc500eSGustavo F. Padovan BT_DBG("chan %p state %d", chan, chan->state); 249ab07801dSGustavo F. Padovan 250ab07801dSGustavo F. Padovan bh_lock_sock(sk); 251ab07801dSGustavo F. Padovan 252ab07801dSGustavo F. Padovan if (sock_owned_by_user(sk)) { 253ab07801dSGustavo F. Padovan /* sk is owned by user. Try again later */ 254f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 255ab07801dSGustavo F. Padovan bh_unlock_sock(sk); 25671ba0e56SGustavo F. Padovan chan_put(chan); 257ab07801dSGustavo F. Padovan return; 258ab07801dSGustavo F. Padovan } 259ab07801dSGustavo F. Padovan 26089bc500eSGustavo F. Padovan if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 261ab07801dSGustavo F. Padovan reason = ECONNREFUSED; 26289bc500eSGustavo F. Padovan else if (chan->state == BT_CONNECT && 263ab07801dSGustavo F. Padovan chan->sec_level != BT_SECURITY_SDP) 264ab07801dSGustavo F. Padovan reason = ECONNREFUSED; 265ab07801dSGustavo F. Padovan else 266ab07801dSGustavo F. Padovan reason = ETIMEDOUT; 267ab07801dSGustavo F. Padovan 2680f852724SGustavo F. Padovan l2cap_chan_close(chan, reason); 269ab07801dSGustavo F. Padovan 270ab07801dSGustavo F. Padovan bh_unlock_sock(sk); 271ab07801dSGustavo F. Padovan 272ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 27371ba0e56SGustavo F. Padovan chan_put(chan); 274ab07801dSGustavo F. Padovan } 275ab07801dSGustavo F. Padovan 27623691d75SGustavo F. Padovan struct l2cap_chan *l2cap_chan_create(struct sock *sk) 2770a708f8fSGustavo F. Padovan { 27848454079SGustavo F. Padovan struct l2cap_chan *chan; 2790a708f8fSGustavo F. Padovan 28048454079SGustavo F. Padovan chan = kzalloc(sizeof(*chan), GFP_ATOMIC); 28148454079SGustavo F. Padovan if (!chan) 28248454079SGustavo F. Padovan return NULL; 2830a708f8fSGustavo F. Padovan 28448454079SGustavo F. Padovan chan->sk = sk; 28548454079SGustavo F. Padovan 28623691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 28723691d75SGustavo F. Padovan list_add(&chan->global_l, &chan_list); 28823691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 28923691d75SGustavo F. Padovan 290ab07801dSGustavo F. Padovan setup_timer(&chan->chan_timer, l2cap_chan_timeout, (unsigned long) chan); 291ab07801dSGustavo F. Padovan 29289bc500eSGustavo F. Padovan chan->state = BT_OPEN; 29389bc500eSGustavo F. Padovan 29471ba0e56SGustavo F. Padovan atomic_set(&chan->refcnt, 1); 29571ba0e56SGustavo F. Padovan 29648454079SGustavo F. Padovan return chan; 2970a708f8fSGustavo F. Padovan } 2980a708f8fSGustavo F. Padovan 29923691d75SGustavo F. Padovan void l2cap_chan_destroy(struct l2cap_chan *chan) 3006ff5abbfSGustavo F. Padovan { 30123691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 30223691d75SGustavo F. Padovan list_del(&chan->global_l); 30323691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 30423691d75SGustavo F. Padovan 30571ba0e56SGustavo F. Padovan chan_put(chan); 3066ff5abbfSGustavo F. Padovan } 3076ff5abbfSGustavo F. Padovan 30848454079SGustavo F. Padovan static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 3090a708f8fSGustavo F. Padovan { 3100a708f8fSGustavo F. Padovan BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 311fe4128e0SGustavo F. Padovan chan->psm, chan->dcid); 3120a708f8fSGustavo F. Padovan 3130a708f8fSGustavo F. Padovan conn->disc_reason = 0x13; 3140a708f8fSGustavo F. Padovan 3158c1d787bSGustavo F. Padovan chan->conn = conn; 3160a708f8fSGustavo F. Padovan 317715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 318b62f328bSVille Tervo if (conn->hcon->type == LE_LINK) { 319b62f328bSVille Tervo /* LE connection */ 3200c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_LE_DEFAULT_MTU; 321fe4128e0SGustavo F. Padovan chan->scid = L2CAP_CID_LE_DATA; 322fe4128e0SGustavo F. Padovan chan->dcid = L2CAP_CID_LE_DATA; 323b62f328bSVille Tervo } else { 3240a708f8fSGustavo F. Padovan /* Alloc CID for connection-oriented socket */ 325fe4128e0SGustavo F. Padovan chan->scid = l2cap_alloc_cid(conn); 3260c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_DEFAULT_MTU; 327b62f328bSVille Tervo } 328715ec005SGustavo F. Padovan } else if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 3290a708f8fSGustavo F. Padovan /* Connectionless socket */ 330fe4128e0SGustavo F. Padovan chan->scid = L2CAP_CID_CONN_LESS; 331fe4128e0SGustavo F. Padovan chan->dcid = L2CAP_CID_CONN_LESS; 3320c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_DEFAULT_MTU; 3330a708f8fSGustavo F. Padovan } else { 3340a708f8fSGustavo F. Padovan /* Raw socket can send/recv signalling messages only */ 335fe4128e0SGustavo F. Padovan chan->scid = L2CAP_CID_SIGNALING; 336fe4128e0SGustavo F. Padovan chan->dcid = L2CAP_CID_SIGNALING; 3370c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_DEFAULT_MTU; 3380a708f8fSGustavo F. Padovan } 3390a708f8fSGustavo F. Padovan 34071ba0e56SGustavo F. Padovan chan_hold(chan); 341baa7e1faSGustavo F. Padovan 342baa7e1faSGustavo F. Padovan list_add(&chan->list, &conn->chan_l); 3430a708f8fSGustavo F. Padovan } 3440a708f8fSGustavo F. Padovan 3450a708f8fSGustavo F. Padovan /* Delete channel. 3460a708f8fSGustavo F. Padovan * Must be called on the locked socket. */ 3474519de9aSGustavo F. Padovan static void l2cap_chan_del(struct l2cap_chan *chan, int err) 3480a708f8fSGustavo F. Padovan { 34948454079SGustavo F. Padovan struct sock *sk = chan->sk; 3508c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 3510a708f8fSGustavo F. Padovan struct sock *parent = bt_sk(sk)->parent; 3520a708f8fSGustavo F. Padovan 353c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 3540a708f8fSGustavo F. Padovan 35549208c9cSGustavo F. Padovan BT_DBG("chan %p, conn %p, err %d", chan, conn, err); 3560a708f8fSGustavo F. Padovan 3570a708f8fSGustavo F. Padovan if (conn) { 358baa7e1faSGustavo F. Padovan /* Delete from channel list */ 359baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 360baa7e1faSGustavo F. Padovan list_del(&chan->list); 361baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 36271ba0e56SGustavo F. Padovan chan_put(chan); 363baa7e1faSGustavo F. Padovan 3648c1d787bSGustavo F. Padovan chan->conn = NULL; 3650a708f8fSGustavo F. Padovan hci_conn_put(conn->hcon); 3660a708f8fSGustavo F. Padovan } 3670a708f8fSGustavo F. Padovan 36889bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CLOSED); 3690a708f8fSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 3700a708f8fSGustavo F. Padovan 3710a708f8fSGustavo F. Padovan if (err) 3720a708f8fSGustavo F. Padovan sk->sk_err = err; 3730a708f8fSGustavo F. Padovan 3740a708f8fSGustavo F. Padovan if (parent) { 3750a708f8fSGustavo F. Padovan bt_accept_unlink(sk); 3760a708f8fSGustavo F. Padovan parent->sk_data_ready(parent, 0); 3770a708f8fSGustavo F. Padovan } else 3780a708f8fSGustavo F. Padovan sk->sk_state_change(sk); 3790a708f8fSGustavo F. Padovan 380c1360a1cSGustavo F. Padovan if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) && 381c1360a1cSGustavo F. Padovan test_bit(CONF_INPUT_DONE, &chan->conf_state))) 3826ff5abbfSGustavo F. Padovan return; 3832ead70b8SGustavo F. Padovan 38458d35f87SGustavo F. Padovan skb_queue_purge(&chan->tx_q); 3850a708f8fSGustavo F. Padovan 3860c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) { 3870a708f8fSGustavo F. Padovan struct srej_list *l, *tmp; 3880a708f8fSGustavo F. Padovan 3891a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 3901a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 3911a09bcb9SGustavo F. Padovan __clear_ack_timer(chan); 3920a708f8fSGustavo F. Padovan 393f1c6775bSGustavo F. Padovan skb_queue_purge(&chan->srej_q); 3940a708f8fSGustavo F. Padovan 39539d5a3eeSGustavo F. Padovan list_for_each_entry_safe(l, tmp, &chan->srej_l, list) { 3960a708f8fSGustavo F. Padovan list_del(&l->list); 3970a708f8fSGustavo F. Padovan kfree(l); 3980a708f8fSGustavo F. Padovan } 3990a708f8fSGustavo F. Padovan } 4000a708f8fSGustavo F. Padovan } 4010a708f8fSGustavo F. Padovan 4024519de9aSGustavo F. Padovan static void l2cap_chan_cleanup_listen(struct sock *parent) 4034519de9aSGustavo F. Padovan { 4044519de9aSGustavo F. Padovan struct sock *sk; 4054519de9aSGustavo F. Padovan 4064519de9aSGustavo F. Padovan BT_DBG("parent %p", parent); 4074519de9aSGustavo F. Padovan 4084519de9aSGustavo F. Padovan /* Close not yet accepted channels */ 4090f852724SGustavo F. Padovan while ((sk = bt_accept_dequeue(parent, NULL))) { 410ba3bd0eeSGustavo F. Padovan struct l2cap_chan *chan = l2cap_pi(sk)->chan; 411c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 4120f852724SGustavo F. Padovan lock_sock(sk); 413ba3bd0eeSGustavo F. Padovan l2cap_chan_close(chan, ECONNRESET); 4140f852724SGustavo F. Padovan release_sock(sk); 415ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 4160f852724SGustavo F. Padovan } 4174519de9aSGustavo F. Padovan } 4184519de9aSGustavo F. Padovan 4190f852724SGustavo F. Padovan void l2cap_chan_close(struct l2cap_chan *chan, int reason) 4204519de9aSGustavo F. Padovan { 4214519de9aSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 4224519de9aSGustavo F. Padovan struct sock *sk = chan->sk; 4234519de9aSGustavo F. Padovan 42489bc500eSGustavo F. Padovan BT_DBG("chan %p state %d socket %p", chan, chan->state, sk->sk_socket); 4254519de9aSGustavo F. Padovan 42689bc500eSGustavo F. Padovan switch (chan->state) { 4274519de9aSGustavo F. Padovan case BT_LISTEN: 4284519de9aSGustavo F. Padovan l2cap_chan_cleanup_listen(sk); 42989bc500eSGustavo F. Padovan 43089bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CLOSED); 43189bc500eSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 4324519de9aSGustavo F. Padovan break; 4334519de9aSGustavo F. Padovan 4344519de9aSGustavo F. Padovan case BT_CONNECTED: 4354519de9aSGustavo F. Padovan case BT_CONFIG: 436715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && 4374519de9aSGustavo F. Padovan conn->hcon->type == ACL_LINK) { 438c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 439c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 4404519de9aSGustavo F. Padovan l2cap_send_disconn_req(conn, chan, reason); 4414519de9aSGustavo F. Padovan } else 4424519de9aSGustavo F. Padovan l2cap_chan_del(chan, reason); 4434519de9aSGustavo F. Padovan break; 4444519de9aSGustavo F. Padovan 4454519de9aSGustavo F. Padovan case BT_CONNECT2: 446715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && 4474519de9aSGustavo F. Padovan conn->hcon->type == ACL_LINK) { 4484519de9aSGustavo F. Padovan struct l2cap_conn_rsp rsp; 4494519de9aSGustavo F. Padovan __u16 result; 4504519de9aSGustavo F. Padovan 4514519de9aSGustavo F. Padovan if (bt_sk(sk)->defer_setup) 4524519de9aSGustavo F. Padovan result = L2CAP_CR_SEC_BLOCK; 4534519de9aSGustavo F. Padovan else 4544519de9aSGustavo F. Padovan result = L2CAP_CR_BAD_PSM; 45589bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 4564519de9aSGustavo F. Padovan 4574519de9aSGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 4584519de9aSGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 4594519de9aSGustavo F. Padovan rsp.result = cpu_to_le16(result); 4604519de9aSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 4614519de9aSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 4624519de9aSGustavo F. Padovan sizeof(rsp), &rsp); 4634519de9aSGustavo F. Padovan } 4644519de9aSGustavo F. Padovan 4654519de9aSGustavo F. Padovan l2cap_chan_del(chan, reason); 4664519de9aSGustavo F. Padovan break; 4674519de9aSGustavo F. Padovan 4684519de9aSGustavo F. Padovan case BT_CONNECT: 4694519de9aSGustavo F. Padovan case BT_DISCONN: 4704519de9aSGustavo F. Padovan l2cap_chan_del(chan, reason); 4714519de9aSGustavo F. Padovan break; 4724519de9aSGustavo F. Padovan 4734519de9aSGustavo F. Padovan default: 4744519de9aSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 4754519de9aSGustavo F. Padovan break; 4764519de9aSGustavo F. Padovan } 4774519de9aSGustavo F. Padovan } 4784519de9aSGustavo F. Padovan 4794343478fSGustavo F. Padovan static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 4800a708f8fSGustavo F. Padovan { 481715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_RAW) { 4824343478fSGustavo F. Padovan switch (chan->sec_level) { 4830a708f8fSGustavo F. Padovan case BT_SECURITY_HIGH: 4840a708f8fSGustavo F. Padovan return HCI_AT_DEDICATED_BONDING_MITM; 4850a708f8fSGustavo F. Padovan case BT_SECURITY_MEDIUM: 4860a708f8fSGustavo F. Padovan return HCI_AT_DEDICATED_BONDING; 4870a708f8fSGustavo F. Padovan default: 4880a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING; 4890a708f8fSGustavo F. Padovan } 490fe4128e0SGustavo F. Padovan } else if (chan->psm == cpu_to_le16(0x0001)) { 4914343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_LOW) 4924343478fSGustavo F. Padovan chan->sec_level = BT_SECURITY_SDP; 4930a708f8fSGustavo F. Padovan 4944343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_HIGH) 4950a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING_MITM; 4960a708f8fSGustavo F. Padovan else 4970a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING; 4980a708f8fSGustavo F. Padovan } else { 4994343478fSGustavo F. Padovan switch (chan->sec_level) { 5000a708f8fSGustavo F. Padovan case BT_SECURITY_HIGH: 5010a708f8fSGustavo F. Padovan return HCI_AT_GENERAL_BONDING_MITM; 5020a708f8fSGustavo F. Padovan case BT_SECURITY_MEDIUM: 5030a708f8fSGustavo F. Padovan return HCI_AT_GENERAL_BONDING; 5040a708f8fSGustavo F. Padovan default: 5050a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING; 5060a708f8fSGustavo F. Padovan } 5070a708f8fSGustavo F. Padovan } 5080a708f8fSGustavo F. Padovan } 5090a708f8fSGustavo F. Padovan 5100a708f8fSGustavo F. Padovan /* Service level security */ 5114343478fSGustavo F. Padovan static inline int l2cap_check_security(struct l2cap_chan *chan) 5120a708f8fSGustavo F. Padovan { 5138c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 5140a708f8fSGustavo F. Padovan __u8 auth_type; 5150a708f8fSGustavo F. Padovan 5164343478fSGustavo F. Padovan auth_type = l2cap_get_auth_type(chan); 5170a708f8fSGustavo F. Padovan 5184343478fSGustavo F. Padovan return hci_conn_security(conn->hcon, chan->sec_level, auth_type); 5190a708f8fSGustavo F. Padovan } 5200a708f8fSGustavo F. Padovan 521b5ad8b7fSJohannes Berg static u8 l2cap_get_ident(struct l2cap_conn *conn) 5220a708f8fSGustavo F. Padovan { 5230a708f8fSGustavo F. Padovan u8 id; 5240a708f8fSGustavo F. Padovan 5250a708f8fSGustavo F. Padovan /* Get next available identificator. 5260a708f8fSGustavo F. Padovan * 1 - 128 are used by kernel. 5270a708f8fSGustavo F. Padovan * 129 - 199 are reserved. 5280a708f8fSGustavo F. Padovan * 200 - 254 are used by utilities like l2ping, etc. 5290a708f8fSGustavo F. Padovan */ 5300a708f8fSGustavo F. Padovan 5310a708f8fSGustavo F. Padovan spin_lock_bh(&conn->lock); 5320a708f8fSGustavo F. Padovan 5330a708f8fSGustavo F. Padovan if (++conn->tx_ident > 128) 5340a708f8fSGustavo F. Padovan conn->tx_ident = 1; 5350a708f8fSGustavo F. Padovan 5360a708f8fSGustavo F. Padovan id = conn->tx_ident; 5370a708f8fSGustavo F. Padovan 5380a708f8fSGustavo F. Padovan spin_unlock_bh(&conn->lock); 5390a708f8fSGustavo F. Padovan 5400a708f8fSGustavo F. Padovan return id; 5410a708f8fSGustavo F. Padovan } 5420a708f8fSGustavo F. Padovan 5434519de9aSGustavo F. Padovan static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data) 5440a708f8fSGustavo F. Padovan { 5450a708f8fSGustavo F. Padovan struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 5460a708f8fSGustavo F. Padovan u8 flags; 5470a708f8fSGustavo F. Padovan 5480a708f8fSGustavo F. Padovan BT_DBG("code 0x%2.2x", code); 5490a708f8fSGustavo F. Padovan 5500a708f8fSGustavo F. Padovan if (!skb) 5510a708f8fSGustavo F. Padovan return; 5520a708f8fSGustavo F. Padovan 5530a708f8fSGustavo F. Padovan if (lmp_no_flush_capable(conn->hcon->hdev)) 5540a708f8fSGustavo F. Padovan flags = ACL_START_NO_FLUSH; 5550a708f8fSGustavo F. Padovan else 5560a708f8fSGustavo F. Padovan flags = ACL_START; 5570a708f8fSGustavo F. Padovan 55814b12d0bSJaikumar Ganesh bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 55914b12d0bSJaikumar Ganesh 5600a708f8fSGustavo F. Padovan hci_send_acl(conn->hcon, skb, flags); 5610a708f8fSGustavo F. Padovan } 5620a708f8fSGustavo F. Padovan 563525cd185SGustavo F. Padovan static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control) 5640a708f8fSGustavo F. Padovan { 5650a708f8fSGustavo F. Padovan struct sk_buff *skb; 5660a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 5678c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 5680a708f8fSGustavo F. Padovan int count, hlen = L2CAP_HDR_SIZE + 2; 5690a708f8fSGustavo F. Padovan u8 flags; 5700a708f8fSGustavo F. Padovan 57189bc500eSGustavo F. Padovan if (chan->state != BT_CONNECTED) 5720a708f8fSGustavo F. Padovan return; 5730a708f8fSGustavo F. Padovan 57447d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 5750a708f8fSGustavo F. Padovan hlen += 2; 5760a708f8fSGustavo F. Padovan 57749208c9cSGustavo F. Padovan BT_DBG("chan %p, control 0x%2.2x", chan, control); 5780a708f8fSGustavo F. Padovan 5790a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, hlen); 5800a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FRAME_TYPE; 5810a708f8fSGustavo F. Padovan 582e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 5830a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 5840a708f8fSGustavo F. Padovan 585e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state)) 5860a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_POLL; 5870a708f8fSGustavo F. Padovan 5880a708f8fSGustavo F. Padovan skb = bt_skb_alloc(count, GFP_ATOMIC); 5890a708f8fSGustavo F. Padovan if (!skb) 5900a708f8fSGustavo F. Padovan return; 5910a708f8fSGustavo F. Padovan 5920a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 5930a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 594fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 5950a708f8fSGustavo F. Padovan put_unaligned_le16(control, skb_put(skb, 2)); 5960a708f8fSGustavo F. Padovan 59747d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 5980a708f8fSGustavo F. Padovan u16 fcs = crc16(0, (u8 *)lh, count - 2); 5990a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, skb_put(skb, 2)); 6000a708f8fSGustavo F. Padovan } 6010a708f8fSGustavo F. Padovan 6020a708f8fSGustavo F. Padovan if (lmp_no_flush_capable(conn->hcon->hdev)) 6030a708f8fSGustavo F. Padovan flags = ACL_START_NO_FLUSH; 6040a708f8fSGustavo F. Padovan else 6050a708f8fSGustavo F. Padovan flags = ACL_START; 6060a708f8fSGustavo F. Padovan 60714b12d0bSJaikumar Ganesh bt_cb(skb)->force_active = chan->force_active; 60814b12d0bSJaikumar Ganesh 6098c1d787bSGustavo F. Padovan hci_send_acl(chan->conn->hcon, skb, flags); 6100a708f8fSGustavo F. Padovan } 6110a708f8fSGustavo F. Padovan 612525cd185SGustavo F. Padovan static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u16 control) 6130a708f8fSGustavo F. Padovan { 614e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6150a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_NOT_READY; 616e2ab4353SGustavo F. Padovan set_bit(CONN_RNR_SENT, &chan->conn_state); 6170a708f8fSGustavo F. Padovan } else 6180a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY; 6190a708f8fSGustavo F. Padovan 62042e5c802SGustavo F. Padovan control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 6210a708f8fSGustavo F. Padovan 622525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 6230a708f8fSGustavo F. Padovan } 6240a708f8fSGustavo F. Padovan 625b4450035SGustavo F. Padovan static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 6260a708f8fSGustavo F. Padovan { 627c1360a1cSGustavo F. Padovan return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 6280a708f8fSGustavo F. Padovan } 6290a708f8fSGustavo F. Padovan 630fc7f8a7eSGustavo F. Padovan static void l2cap_do_start(struct l2cap_chan *chan) 6310a708f8fSGustavo F. Padovan { 6328c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 6330a708f8fSGustavo F. Padovan 6340a708f8fSGustavo F. Padovan if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) { 6350a708f8fSGustavo F. Padovan if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 6360a708f8fSGustavo F. Padovan return; 6370a708f8fSGustavo F. Padovan 6384343478fSGustavo F. Padovan if (l2cap_check_security(chan) && 6394343478fSGustavo F. Padovan __l2cap_no_conn_pending(chan)) { 6400a708f8fSGustavo F. Padovan struct l2cap_conn_req req; 641fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 642fe4128e0SGustavo F. Padovan req.psm = chan->psm; 6430a708f8fSGustavo F. Padovan 644fc7f8a7eSGustavo F. Padovan chan->ident = l2cap_get_ident(conn); 645c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 6460a708f8fSGustavo F. Padovan 647fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, 648fc7f8a7eSGustavo F. Padovan sizeof(req), &req); 6490a708f8fSGustavo F. Padovan } 6500a708f8fSGustavo F. Padovan } else { 6510a708f8fSGustavo F. Padovan struct l2cap_info_req req; 6520a708f8fSGustavo F. Padovan req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 6530a708f8fSGustavo F. Padovan 6540a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 6550a708f8fSGustavo F. Padovan conn->info_ident = l2cap_get_ident(conn); 6560a708f8fSGustavo F. Padovan 6570a708f8fSGustavo F. Padovan mod_timer(&conn->info_timer, jiffies + 6580a708f8fSGustavo F. Padovan msecs_to_jiffies(L2CAP_INFO_TIMEOUT)); 6590a708f8fSGustavo F. Padovan 6600a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, conn->info_ident, 6610a708f8fSGustavo F. Padovan L2CAP_INFO_REQ, sizeof(req), &req); 6620a708f8fSGustavo F. Padovan } 6630a708f8fSGustavo F. Padovan } 6640a708f8fSGustavo F. Padovan 6650a708f8fSGustavo F. Padovan static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 6660a708f8fSGustavo F. Padovan { 6670a708f8fSGustavo F. Padovan u32 local_feat_mask = l2cap_feat_mask; 6680a708f8fSGustavo F. Padovan if (!disable_ertm) 6690a708f8fSGustavo F. Padovan local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 6700a708f8fSGustavo F. Padovan 6710a708f8fSGustavo F. Padovan switch (mode) { 6720a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 6730a708f8fSGustavo F. Padovan return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 6740a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 6750a708f8fSGustavo F. Padovan return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 6760a708f8fSGustavo F. Padovan default: 6770a708f8fSGustavo F. Padovan return 0x00; 6780a708f8fSGustavo F. Padovan } 6790a708f8fSGustavo F. Padovan } 6800a708f8fSGustavo F. Padovan 6814519de9aSGustavo F. Padovan static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err) 6820a708f8fSGustavo F. Padovan { 683e92c8e70SGustavo F. Padovan struct sock *sk; 6840a708f8fSGustavo F. Padovan struct l2cap_disconn_req req; 6850a708f8fSGustavo F. Padovan 6860a708f8fSGustavo F. Padovan if (!conn) 6870a708f8fSGustavo F. Padovan return; 6880a708f8fSGustavo F. Padovan 689e92c8e70SGustavo F. Padovan sk = chan->sk; 690e92c8e70SGustavo F. Padovan 6910c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) { 6921a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 6931a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 6941a09bcb9SGustavo F. Padovan __clear_ack_timer(chan); 6950a708f8fSGustavo F. Padovan } 6960a708f8fSGustavo F. Padovan 697fe4128e0SGustavo F. Padovan req.dcid = cpu_to_le16(chan->dcid); 698fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 6990a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), 7000a708f8fSGustavo F. Padovan L2CAP_DISCONN_REQ, sizeof(req), &req); 7010a708f8fSGustavo F. Padovan 70289bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 7030a708f8fSGustavo F. Padovan sk->sk_err = err; 7040a708f8fSGustavo F. Padovan } 7050a708f8fSGustavo F. Padovan 7060a708f8fSGustavo F. Padovan /* ---- L2CAP connections ---- */ 7070a708f8fSGustavo F. Padovan static void l2cap_conn_start(struct l2cap_conn *conn) 7080a708f8fSGustavo F. Padovan { 709820ffdb3SGustavo F. Padovan struct l2cap_chan *chan, *tmp; 7100a708f8fSGustavo F. Padovan 7110a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 7120a708f8fSGustavo F. Padovan 713baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 7140a708f8fSGustavo F. Padovan 715820ffdb3SGustavo F. Padovan list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 71648454079SGustavo F. Padovan struct sock *sk = chan->sk; 717baa7e1faSGustavo F. Padovan 7180a708f8fSGustavo F. Padovan bh_lock_sock(sk); 7190a708f8fSGustavo F. Padovan 720715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 7210a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7220a708f8fSGustavo F. Padovan continue; 7230a708f8fSGustavo F. Padovan } 7240a708f8fSGustavo F. Padovan 72589bc500eSGustavo F. Padovan if (chan->state == BT_CONNECT) { 7260a708f8fSGustavo F. Padovan struct l2cap_conn_req req; 7270a708f8fSGustavo F. Padovan 7284343478fSGustavo F. Padovan if (!l2cap_check_security(chan) || 729b4450035SGustavo F. Padovan !__l2cap_no_conn_pending(chan)) { 7300a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7310a708f8fSGustavo F. Padovan continue; 7320a708f8fSGustavo F. Padovan } 7330a708f8fSGustavo F. Padovan 734c1360a1cSGustavo F. Padovan if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 735c1360a1cSGustavo F. Padovan && test_bit(CONF_STATE2_DEVICE, 736c1360a1cSGustavo F. Padovan &chan->conf_state)) { 7370f852724SGustavo F. Padovan /* l2cap_chan_close() calls list_del(chan) 738820ffdb3SGustavo F. Padovan * so release the lock */ 7392461daacSGustavo F. Padovan read_unlock(&conn->chan_lock); 7400f852724SGustavo F. Padovan l2cap_chan_close(chan, ECONNRESET); 7412461daacSGustavo F. Padovan read_lock(&conn->chan_lock); 7420a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7430a708f8fSGustavo F. Padovan continue; 7440a708f8fSGustavo F. Padovan } 7450a708f8fSGustavo F. Padovan 746fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 747fe4128e0SGustavo F. Padovan req.psm = chan->psm; 7480a708f8fSGustavo F. Padovan 749fc7f8a7eSGustavo F. Padovan chan->ident = l2cap_get_ident(conn); 750c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 7510a708f8fSGustavo F. Padovan 752fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, 753fc7f8a7eSGustavo F. Padovan sizeof(req), &req); 7540a708f8fSGustavo F. Padovan 75589bc500eSGustavo F. Padovan } else if (chan->state == BT_CONNECT2) { 7560a708f8fSGustavo F. Padovan struct l2cap_conn_rsp rsp; 7570a708f8fSGustavo F. Padovan char buf[128]; 758fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 759fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 7600a708f8fSGustavo F. Padovan 7614343478fSGustavo F. Padovan if (l2cap_check_security(chan)) { 7620a708f8fSGustavo F. Padovan if (bt_sk(sk)->defer_setup) { 7630a708f8fSGustavo F. Padovan struct sock *parent = bt_sk(sk)->parent; 7640a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_PEND); 7650a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 76605e9a2f6SIlia Kolomisnky if (parent) 7670a708f8fSGustavo F. Padovan parent->sk_data_ready(parent, 0); 7680a708f8fSGustavo F. Padovan 7690a708f8fSGustavo F. Padovan } else { 77089bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 7710a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 7720a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 7730a708f8fSGustavo F. Padovan } 7740a708f8fSGustavo F. Padovan } else { 7750a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_PEND); 7760a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 7770a708f8fSGustavo F. Padovan } 7780a708f8fSGustavo F. Padovan 779fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 780fc7f8a7eSGustavo F. Padovan sizeof(rsp), &rsp); 7810a708f8fSGustavo F. Padovan 782c1360a1cSGustavo F. Padovan if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 7830a708f8fSGustavo F. Padovan rsp.result != L2CAP_CR_SUCCESS) { 7840a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7850a708f8fSGustavo F. Padovan continue; 7860a708f8fSGustavo F. Padovan } 7870a708f8fSGustavo F. Padovan 788c1360a1cSGustavo F. Padovan set_bit(CONF_REQ_SENT, &chan->conf_state); 7890a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 79073ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 79173ffa904SGustavo F. Padovan chan->num_conf_req++; 7920a708f8fSGustavo F. Padovan } 7930a708f8fSGustavo F. Padovan 7940a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7950a708f8fSGustavo F. Padovan } 7960a708f8fSGustavo F. Padovan 797baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 7980a708f8fSGustavo F. Padovan } 7990a708f8fSGustavo F. Padovan 800b62f328bSVille Tervo /* Find socket with cid and source bdaddr. 801b62f328bSVille Tervo * Returns closest match, locked. 802b62f328bSVille Tervo */ 80323691d75SGustavo F. Padovan static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdaddr_t *src) 804b62f328bSVille Tervo { 80523691d75SGustavo F. Padovan struct l2cap_chan *c, *c1 = NULL; 806b62f328bSVille Tervo 80723691d75SGustavo F. Padovan read_lock(&chan_list_lock); 808b62f328bSVille Tervo 80923691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 81023691d75SGustavo F. Padovan struct sock *sk = c->sk; 811fe4128e0SGustavo F. Padovan 81289bc500eSGustavo F. Padovan if (state && c->state != state) 813b62f328bSVille Tervo continue; 814b62f328bSVille Tervo 81523691d75SGustavo F. Padovan if (c->scid == cid) { 816b62f328bSVille Tervo /* Exact match. */ 81723691d75SGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, src)) { 81823691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 81923691d75SGustavo F. Padovan return c; 82023691d75SGustavo F. Padovan } 821b62f328bSVille Tervo 822b62f328bSVille Tervo /* Closest match */ 823b62f328bSVille Tervo if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) 82423691d75SGustavo F. Padovan c1 = c; 825b62f328bSVille Tervo } 826b62f328bSVille Tervo } 827280f294fSGustavo F. Padovan 82823691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 829b62f328bSVille Tervo 83023691d75SGustavo F. Padovan return c1; 831b62f328bSVille Tervo } 832b62f328bSVille Tervo 833b62f328bSVille Tervo static void l2cap_le_conn_ready(struct l2cap_conn *conn) 834b62f328bSVille Tervo { 835c916fbe4SGustavo F. Padovan struct sock *parent, *sk; 83623691d75SGustavo F. Padovan struct l2cap_chan *chan, *pchan; 837b62f328bSVille Tervo 838b62f328bSVille Tervo BT_DBG(""); 839b62f328bSVille Tervo 840b62f328bSVille Tervo /* Check if we have socket listening on cid */ 84123691d75SGustavo F. Padovan pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA, 842b62f328bSVille Tervo conn->src); 84323691d75SGustavo F. Padovan if (!pchan) 844b62f328bSVille Tervo return; 845b62f328bSVille Tervo 84623691d75SGustavo F. Padovan parent = pchan->sk; 84723691d75SGustavo F. Padovan 84862f3a2cfSGustavo F. Padovan bh_lock_sock(parent); 84962f3a2cfSGustavo F. Padovan 850b62f328bSVille Tervo /* Check for backlog size */ 851b62f328bSVille Tervo if (sk_acceptq_is_full(parent)) { 852b62f328bSVille Tervo BT_DBG("backlog full %d", parent->sk_ack_backlog); 853b62f328bSVille Tervo goto clean; 854b62f328bSVille Tervo } 855b62f328bSVille Tervo 85680808e43SGustavo F. Padovan chan = pchan->ops->new_connection(pchan->data); 85780808e43SGustavo F. Padovan if (!chan) 858b62f328bSVille Tervo goto clean; 859b62f328bSVille Tervo 86080808e43SGustavo F. Padovan sk = chan->sk; 8615d41ce1dSGustavo F. Padovan 862baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 863b62f328bSVille Tervo 864b62f328bSVille Tervo hci_conn_hold(conn->hcon); 865b62f328bSVille Tervo 866b62f328bSVille Tervo bacpy(&bt_sk(sk)->src, conn->src); 867b62f328bSVille Tervo bacpy(&bt_sk(sk)->dst, conn->dst); 868b62f328bSVille Tervo 869d1010240SGustavo F. Padovan bt_accept_enqueue(parent, sk); 870d1010240SGustavo F. Padovan 87148454079SGustavo F. Padovan __l2cap_chan_add(conn, chan); 87248454079SGustavo F. Padovan 873c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 874b62f328bSVille Tervo 87589bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 876b62f328bSVille Tervo parent->sk_data_ready(parent, 0); 877b62f328bSVille Tervo 878baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 879b62f328bSVille Tervo 880b62f328bSVille Tervo clean: 881b62f328bSVille Tervo bh_unlock_sock(parent); 882b62f328bSVille Tervo } 883b62f328bSVille Tervo 884f1cb9af5SVinicius Costa Gomes static void l2cap_chan_ready(struct sock *sk) 885f1cb9af5SVinicius Costa Gomes { 886f1cb9af5SVinicius Costa Gomes struct l2cap_chan *chan = l2cap_pi(sk)->chan; 887f1cb9af5SVinicius Costa Gomes struct sock *parent = bt_sk(sk)->parent; 888f1cb9af5SVinicius Costa Gomes 889f1cb9af5SVinicius Costa Gomes BT_DBG("sk %p, parent %p", sk, parent); 890f1cb9af5SVinicius Costa Gomes 891f1cb9af5SVinicius Costa Gomes chan->conf_state = 0; 892f1cb9af5SVinicius Costa Gomes __clear_chan_timer(chan); 893f1cb9af5SVinicius Costa Gomes 89443f3dc41SVinicius Costa Gomes l2cap_state_change(chan, BT_CONNECTED); 895f1cb9af5SVinicius Costa Gomes sk->sk_state_change(sk); 896f1cb9af5SVinicius Costa Gomes 897f1cb9af5SVinicius Costa Gomes if (parent) 898f1cb9af5SVinicius Costa Gomes parent->sk_data_ready(parent, 0); 899f1cb9af5SVinicius Costa Gomes } 900f1cb9af5SVinicius Costa Gomes 9010a708f8fSGustavo F. Padovan static void l2cap_conn_ready(struct l2cap_conn *conn) 9020a708f8fSGustavo F. Padovan { 90348454079SGustavo F. Padovan struct l2cap_chan *chan; 9040a708f8fSGustavo F. Padovan 9050a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 9060a708f8fSGustavo F. Padovan 907b62f328bSVille Tervo if (!conn->hcon->out && conn->hcon->type == LE_LINK) 908b62f328bSVille Tervo l2cap_le_conn_ready(conn); 909b62f328bSVille Tervo 910160dc6acSVinicius Costa Gomes if (conn->hcon->out && conn->hcon->type == LE_LINK) 911160dc6acSVinicius Costa Gomes smp_conn_security(conn, conn->hcon->pending_sec_level); 912160dc6acSVinicius Costa Gomes 913baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 9140a708f8fSGustavo F. Padovan 915baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 91648454079SGustavo F. Padovan struct sock *sk = chan->sk; 917baa7e1faSGustavo F. Padovan 9180a708f8fSGustavo F. Padovan bh_lock_sock(sk); 9190a708f8fSGustavo F. Padovan 92063128451SVinicius Costa Gomes if (conn->hcon->type == LE_LINK) { 921b501d6a1SAnderson Briglia if (smp_conn_security(conn, chan->sec_level)) 922f1cb9af5SVinicius Costa Gomes l2cap_chan_ready(sk); 923acd7d370SVille Tervo 92463128451SVinicius Costa Gomes } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 925c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 92689bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 9270a708f8fSGustavo F. Padovan sk->sk_state_change(sk); 928b501d6a1SAnderson Briglia 92989bc500eSGustavo F. Padovan } else if (chan->state == BT_CONNECT) 930fc7f8a7eSGustavo F. Padovan l2cap_do_start(chan); 9310a708f8fSGustavo F. Padovan 9320a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 9330a708f8fSGustavo F. Padovan } 9340a708f8fSGustavo F. Padovan 935baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 9360a708f8fSGustavo F. Padovan } 9370a708f8fSGustavo F. Padovan 9380a708f8fSGustavo F. Padovan /* Notify sockets that we cannot guaranty reliability anymore */ 9390a708f8fSGustavo F. Padovan static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 9400a708f8fSGustavo F. Padovan { 94148454079SGustavo F. Padovan struct l2cap_chan *chan; 9420a708f8fSGustavo F. Padovan 9430a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 9440a708f8fSGustavo F. Padovan 945baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 9460a708f8fSGustavo F. Padovan 947baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 94848454079SGustavo F. Padovan struct sock *sk = chan->sk; 949baa7e1faSGustavo F. Padovan 9504343478fSGustavo F. Padovan if (chan->force_reliable) 9510a708f8fSGustavo F. Padovan sk->sk_err = err; 9520a708f8fSGustavo F. Padovan } 9530a708f8fSGustavo F. Padovan 954baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 9550a708f8fSGustavo F. Padovan } 9560a708f8fSGustavo F. Padovan 9570a708f8fSGustavo F. Padovan static void l2cap_info_timeout(unsigned long arg) 9580a708f8fSGustavo F. Padovan { 9590a708f8fSGustavo F. Padovan struct l2cap_conn *conn = (void *) arg; 9600a708f8fSGustavo F. Padovan 9610a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 9620a708f8fSGustavo F. Padovan conn->info_ident = 0; 9630a708f8fSGustavo F. Padovan 9640a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 9650a708f8fSGustavo F. Padovan } 9660a708f8fSGustavo F. Padovan 9675d3de7dfSVinicius Costa Gomes static void l2cap_conn_del(struct hci_conn *hcon, int err) 9685d3de7dfSVinicius Costa Gomes { 9695d3de7dfSVinicius Costa Gomes struct l2cap_conn *conn = hcon->l2cap_data; 9705d3de7dfSVinicius Costa Gomes struct l2cap_chan *chan, *l; 9715d3de7dfSVinicius Costa Gomes struct sock *sk; 9725d3de7dfSVinicius Costa Gomes 9735d3de7dfSVinicius Costa Gomes if (!conn) 9745d3de7dfSVinicius Costa Gomes return; 9755d3de7dfSVinicius Costa Gomes 9765d3de7dfSVinicius Costa Gomes BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 9775d3de7dfSVinicius Costa Gomes 9785d3de7dfSVinicius Costa Gomes kfree_skb(conn->rx_skb); 9795d3de7dfSVinicius Costa Gomes 9805d3de7dfSVinicius Costa Gomes /* Kill channels */ 9815d3de7dfSVinicius Costa Gomes list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 9825d3de7dfSVinicius Costa Gomes sk = chan->sk; 9835d3de7dfSVinicius Costa Gomes bh_lock_sock(sk); 9845d3de7dfSVinicius Costa Gomes l2cap_chan_del(chan, err); 9855d3de7dfSVinicius Costa Gomes bh_unlock_sock(sk); 9865d3de7dfSVinicius Costa Gomes chan->ops->close(chan->data); 9875d3de7dfSVinicius Costa Gomes } 9885d3de7dfSVinicius Costa Gomes 9895d3de7dfSVinicius Costa Gomes if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 9905d3de7dfSVinicius Costa Gomes del_timer_sync(&conn->info_timer); 9915d3de7dfSVinicius Costa Gomes 992d26a2345SVinicius Costa Gomes if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) { 9935d3de7dfSVinicius Costa Gomes del_timer(&conn->security_timer); 9948aab4757SVinicius Costa Gomes smp_chan_destroy(conn); 995d26a2345SVinicius Costa Gomes } 9965d3de7dfSVinicius Costa Gomes 9975d3de7dfSVinicius Costa Gomes hcon->l2cap_data = NULL; 9985d3de7dfSVinicius Costa Gomes kfree(conn); 9995d3de7dfSVinicius Costa Gomes } 10005d3de7dfSVinicius Costa Gomes 10015d3de7dfSVinicius Costa Gomes static void security_timeout(unsigned long arg) 10025d3de7dfSVinicius Costa Gomes { 10035d3de7dfSVinicius Costa Gomes struct l2cap_conn *conn = (void *) arg; 10045d3de7dfSVinicius Costa Gomes 10055d3de7dfSVinicius Costa Gomes l2cap_conn_del(conn->hcon, ETIMEDOUT); 10065d3de7dfSVinicius Costa Gomes } 10075d3de7dfSVinicius Costa Gomes 10080a708f8fSGustavo F. Padovan static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status) 10090a708f8fSGustavo F. Padovan { 10100a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 10110a708f8fSGustavo F. Padovan 10120a708f8fSGustavo F. Padovan if (conn || status) 10130a708f8fSGustavo F. Padovan return conn; 10140a708f8fSGustavo F. Padovan 10150a708f8fSGustavo F. Padovan conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC); 10160a708f8fSGustavo F. Padovan if (!conn) 10170a708f8fSGustavo F. Padovan return NULL; 10180a708f8fSGustavo F. Padovan 10190a708f8fSGustavo F. Padovan hcon->l2cap_data = conn; 10200a708f8fSGustavo F. Padovan conn->hcon = hcon; 10210a708f8fSGustavo F. Padovan 10220a708f8fSGustavo F. Padovan BT_DBG("hcon %p conn %p", hcon, conn); 10230a708f8fSGustavo F. Padovan 1024acd7d370SVille Tervo if (hcon->hdev->le_mtu && hcon->type == LE_LINK) 1025acd7d370SVille Tervo conn->mtu = hcon->hdev->le_mtu; 1026acd7d370SVille Tervo else 10270a708f8fSGustavo F. Padovan conn->mtu = hcon->hdev->acl_mtu; 1028acd7d370SVille Tervo 10290a708f8fSGustavo F. Padovan conn->src = &hcon->hdev->bdaddr; 10300a708f8fSGustavo F. Padovan conn->dst = &hcon->dst; 10310a708f8fSGustavo F. Padovan 10320a708f8fSGustavo F. Padovan conn->feat_mask = 0; 10330a708f8fSGustavo F. Padovan 10340a708f8fSGustavo F. Padovan spin_lock_init(&conn->lock); 1035baa7e1faSGustavo F. Padovan rwlock_init(&conn->chan_lock); 1036baa7e1faSGustavo F. Padovan 1037baa7e1faSGustavo F. Padovan INIT_LIST_HEAD(&conn->chan_l); 10380a708f8fSGustavo F. Padovan 10395d3de7dfSVinicius Costa Gomes if (hcon->type == LE_LINK) 10405d3de7dfSVinicius Costa Gomes setup_timer(&conn->security_timer, security_timeout, 10415d3de7dfSVinicius Costa Gomes (unsigned long) conn); 10425d3de7dfSVinicius Costa Gomes else 10430a708f8fSGustavo F. Padovan setup_timer(&conn->info_timer, l2cap_info_timeout, 10440a708f8fSGustavo F. Padovan (unsigned long) conn); 10450a708f8fSGustavo F. Padovan 10460a708f8fSGustavo F. Padovan conn->disc_reason = 0x13; 10470a708f8fSGustavo F. Padovan 10480a708f8fSGustavo F. Padovan return conn; 10490a708f8fSGustavo F. Padovan } 10500a708f8fSGustavo F. Padovan 105148454079SGustavo F. Padovan static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 10520a708f8fSGustavo F. Padovan { 1053baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 105448454079SGustavo F. Padovan __l2cap_chan_add(conn, chan); 1055baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 10560a708f8fSGustavo F. Padovan } 10570a708f8fSGustavo F. Padovan 10580a708f8fSGustavo F. Padovan /* ---- Socket interface ---- */ 10590a708f8fSGustavo F. Padovan 10600a708f8fSGustavo F. Padovan /* Find socket with psm and source bdaddr. 10610a708f8fSGustavo F. Padovan * Returns closest match. 10620a708f8fSGustavo F. Padovan */ 106323691d75SGustavo F. Padovan static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src) 10640a708f8fSGustavo F. Padovan { 106523691d75SGustavo F. Padovan struct l2cap_chan *c, *c1 = NULL; 10660a708f8fSGustavo F. Padovan 106723691d75SGustavo F. Padovan read_lock(&chan_list_lock); 10680a708f8fSGustavo F. Padovan 106923691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 107023691d75SGustavo F. Padovan struct sock *sk = c->sk; 1071fe4128e0SGustavo F. Padovan 107289bc500eSGustavo F. Padovan if (state && c->state != state) 10730a708f8fSGustavo F. Padovan continue; 10740a708f8fSGustavo F. Padovan 107523691d75SGustavo F. Padovan if (c->psm == psm) { 10760a708f8fSGustavo F. Padovan /* Exact match. */ 107723691d75SGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, src)) { 1078a7567b20SJohannes Berg read_unlock(&chan_list_lock); 107923691d75SGustavo F. Padovan return c; 108023691d75SGustavo F. Padovan } 10810a708f8fSGustavo F. Padovan 10820a708f8fSGustavo F. Padovan /* Closest match */ 10830a708f8fSGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) 108423691d75SGustavo F. Padovan c1 = c; 10850a708f8fSGustavo F. Padovan } 10860a708f8fSGustavo F. Padovan } 10870a708f8fSGustavo F. Padovan 108823691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 10890a708f8fSGustavo F. Padovan 109023691d75SGustavo F. Padovan return c1; 10910a708f8fSGustavo F. Padovan } 10920a708f8fSGustavo F. Padovan 109377a74c7eSGustavo F. Padovan int l2cap_chan_connect(struct l2cap_chan *chan) 10940a708f8fSGustavo F. Padovan { 10955d41ce1dSGustavo F. Padovan struct sock *sk = chan->sk; 10960a708f8fSGustavo F. Padovan bdaddr_t *src = &bt_sk(sk)->src; 10970a708f8fSGustavo F. Padovan bdaddr_t *dst = &bt_sk(sk)->dst; 10980a708f8fSGustavo F. Padovan struct l2cap_conn *conn; 10990a708f8fSGustavo F. Padovan struct hci_conn *hcon; 11000a708f8fSGustavo F. Padovan struct hci_dev *hdev; 11010a708f8fSGustavo F. Padovan __u8 auth_type; 11020a708f8fSGustavo F. Padovan int err; 11030a708f8fSGustavo F. Padovan 11040a708f8fSGustavo F. Padovan BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), 1105fe4128e0SGustavo F. Padovan chan->psm); 11060a708f8fSGustavo F. Padovan 11070a708f8fSGustavo F. Padovan hdev = hci_get_route(dst, src); 11080a708f8fSGustavo F. Padovan if (!hdev) 11090a708f8fSGustavo F. Padovan return -EHOSTUNREACH; 11100a708f8fSGustavo F. Padovan 11110a708f8fSGustavo F. Padovan hci_dev_lock_bh(hdev); 11120a708f8fSGustavo F. Padovan 11134343478fSGustavo F. Padovan auth_type = l2cap_get_auth_type(chan); 11140a708f8fSGustavo F. Padovan 1115fe4128e0SGustavo F. Padovan if (chan->dcid == L2CAP_CID_LE_DATA) 1116acd7d370SVille Tervo hcon = hci_connect(hdev, LE_LINK, dst, 11174343478fSGustavo F. Padovan chan->sec_level, auth_type); 1118acd7d370SVille Tervo else 11190a708f8fSGustavo F. Padovan hcon = hci_connect(hdev, ACL_LINK, dst, 11204343478fSGustavo F. Padovan chan->sec_level, auth_type); 1121acd7d370SVille Tervo 112230e76272SVille Tervo if (IS_ERR(hcon)) { 112330e76272SVille Tervo err = PTR_ERR(hcon); 11240a708f8fSGustavo F. Padovan goto done; 112530e76272SVille Tervo } 11260a708f8fSGustavo F. Padovan 11270a708f8fSGustavo F. Padovan conn = l2cap_conn_add(hcon, 0); 11280a708f8fSGustavo F. Padovan if (!conn) { 11290a708f8fSGustavo F. Padovan hci_conn_put(hcon); 113030e76272SVille Tervo err = -ENOMEM; 11310a708f8fSGustavo F. Padovan goto done; 11320a708f8fSGustavo F. Padovan } 11330a708f8fSGustavo F. Padovan 11340a708f8fSGustavo F. Padovan /* Update source addr of the socket */ 11350a708f8fSGustavo F. Padovan bacpy(src, conn->src); 11360a708f8fSGustavo F. Padovan 113748454079SGustavo F. Padovan l2cap_chan_add(conn, chan); 113848454079SGustavo F. Padovan 113989bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT); 1140c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 11410a708f8fSGustavo F. Padovan 11420a708f8fSGustavo F. Padovan if (hcon->state == BT_CONNECTED) { 1143715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1144c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 11454343478fSGustavo F. Padovan if (l2cap_check_security(chan)) 114689bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 11470a708f8fSGustavo F. Padovan } else 1148fc7f8a7eSGustavo F. Padovan l2cap_do_start(chan); 11490a708f8fSGustavo F. Padovan } 11500a708f8fSGustavo F. Padovan 115130e76272SVille Tervo err = 0; 115230e76272SVille Tervo 11530a708f8fSGustavo F. Padovan done: 11540a708f8fSGustavo F. Padovan hci_dev_unlock_bh(hdev); 11550a708f8fSGustavo F. Padovan hci_dev_put(hdev); 11560a708f8fSGustavo F. Padovan return err; 11570a708f8fSGustavo F. Padovan } 11580a708f8fSGustavo F. Padovan 1159dcba0dbaSGustavo F. Padovan int __l2cap_wait_ack(struct sock *sk) 11600a708f8fSGustavo F. Padovan { 11618c1d787bSGustavo F. Padovan struct l2cap_chan *chan = l2cap_pi(sk)->chan; 11620a708f8fSGustavo F. Padovan DECLARE_WAITQUEUE(wait, current); 11630a708f8fSGustavo F. Padovan int err = 0; 11640a708f8fSGustavo F. Padovan int timeo = HZ/5; 11650a708f8fSGustavo F. Padovan 11660a708f8fSGustavo F. Padovan add_wait_queue(sk_sleep(sk), &wait); 11670a708f8fSGustavo F. Padovan set_current_state(TASK_INTERRUPTIBLE); 1168a71a0cf4SPeter Hurley while (chan->unacked_frames > 0 && chan->conn) { 11690a708f8fSGustavo F. Padovan if (!timeo) 11700a708f8fSGustavo F. Padovan timeo = HZ/5; 11710a708f8fSGustavo F. Padovan 11720a708f8fSGustavo F. Padovan if (signal_pending(current)) { 11730a708f8fSGustavo F. Padovan err = sock_intr_errno(timeo); 11740a708f8fSGustavo F. Padovan break; 11750a708f8fSGustavo F. Padovan } 11760a708f8fSGustavo F. Padovan 11770a708f8fSGustavo F. Padovan release_sock(sk); 11780a708f8fSGustavo F. Padovan timeo = schedule_timeout(timeo); 11790a708f8fSGustavo F. Padovan lock_sock(sk); 1180a71a0cf4SPeter Hurley set_current_state(TASK_INTERRUPTIBLE); 11810a708f8fSGustavo F. Padovan 11820a708f8fSGustavo F. Padovan err = sock_error(sk); 11830a708f8fSGustavo F. Padovan if (err) 11840a708f8fSGustavo F. Padovan break; 11850a708f8fSGustavo F. Padovan } 11860a708f8fSGustavo F. Padovan set_current_state(TASK_RUNNING); 11870a708f8fSGustavo F. Padovan remove_wait_queue(sk_sleep(sk), &wait); 11880a708f8fSGustavo F. Padovan return err; 11890a708f8fSGustavo F. Padovan } 11900a708f8fSGustavo F. Padovan 11910a708f8fSGustavo F. Padovan static void l2cap_monitor_timeout(unsigned long arg) 11920a708f8fSGustavo F. Padovan { 1193525cd185SGustavo F. Padovan struct l2cap_chan *chan = (void *) arg; 1194525cd185SGustavo F. Padovan struct sock *sk = chan->sk; 11950a708f8fSGustavo F. Padovan 1196525cd185SGustavo F. Padovan BT_DBG("chan %p", chan); 11970a708f8fSGustavo F. Padovan 11980a708f8fSGustavo F. Padovan bh_lock_sock(sk); 11992c03a7a4SGustavo F. Padovan if (chan->retry_count >= chan->remote_max_tx) { 12008c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 12010a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 12020a708f8fSGustavo F. Padovan return; 12030a708f8fSGustavo F. Padovan } 12040a708f8fSGustavo F. Padovan 12056a026610SGustavo F. Padovan chan->retry_count++; 12061a09bcb9SGustavo F. Padovan __set_monitor_timer(chan); 12070a708f8fSGustavo F. Padovan 1208525cd185SGustavo F. Padovan l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL); 12090a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 12100a708f8fSGustavo F. Padovan } 12110a708f8fSGustavo F. Padovan 12120a708f8fSGustavo F. Padovan static void l2cap_retrans_timeout(unsigned long arg) 12130a708f8fSGustavo F. Padovan { 1214525cd185SGustavo F. Padovan struct l2cap_chan *chan = (void *) arg; 1215525cd185SGustavo F. Padovan struct sock *sk = chan->sk; 12160a708f8fSGustavo F. Padovan 121749208c9cSGustavo F. Padovan BT_DBG("chan %p", chan); 12180a708f8fSGustavo F. Padovan 12190a708f8fSGustavo F. Padovan bh_lock_sock(sk); 12206a026610SGustavo F. Padovan chan->retry_count = 1; 12211a09bcb9SGustavo F. Padovan __set_monitor_timer(chan); 12220a708f8fSGustavo F. Padovan 1223e2ab4353SGustavo F. Padovan set_bit(CONN_WAIT_F, &chan->conn_state); 12240a708f8fSGustavo F. Padovan 1225525cd185SGustavo F. Padovan l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL); 12260a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 12270a708f8fSGustavo F. Padovan } 12280a708f8fSGustavo F. Padovan 122942e5c802SGustavo F. Padovan static void l2cap_drop_acked_frames(struct l2cap_chan *chan) 12300a708f8fSGustavo F. Padovan { 12310a708f8fSGustavo F. Padovan struct sk_buff *skb; 12320a708f8fSGustavo F. Padovan 123358d35f87SGustavo F. Padovan while ((skb = skb_peek(&chan->tx_q)) && 12346a026610SGustavo F. Padovan chan->unacked_frames) { 123542e5c802SGustavo F. Padovan if (bt_cb(skb)->tx_seq == chan->expected_ack_seq) 12360a708f8fSGustavo F. Padovan break; 12370a708f8fSGustavo F. Padovan 123858d35f87SGustavo F. Padovan skb = skb_dequeue(&chan->tx_q); 12390a708f8fSGustavo F. Padovan kfree_skb(skb); 12400a708f8fSGustavo F. Padovan 12416a026610SGustavo F. Padovan chan->unacked_frames--; 12420a708f8fSGustavo F. Padovan } 12430a708f8fSGustavo F. Padovan 12446a026610SGustavo F. Padovan if (!chan->unacked_frames) 12451a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 12460a708f8fSGustavo F. Padovan } 12470a708f8fSGustavo F. Padovan 124867c9e840SSzymon Janc static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 12490a708f8fSGustavo F. Padovan { 12508c1d787bSGustavo F. Padovan struct hci_conn *hcon = chan->conn->hcon; 12510a708f8fSGustavo F. Padovan u16 flags; 12520a708f8fSGustavo F. Padovan 12534343478fSGustavo F. Padovan BT_DBG("chan %p, skb %p len %d", chan, skb, skb->len); 12540a708f8fSGustavo F. Padovan 12554343478fSGustavo F. Padovan if (!chan->flushable && lmp_no_flush_capable(hcon->hdev)) 12560a708f8fSGustavo F. Padovan flags = ACL_START_NO_FLUSH; 12570a708f8fSGustavo F. Padovan else 12580a708f8fSGustavo F. Padovan flags = ACL_START; 12590a708f8fSGustavo F. Padovan 126014b12d0bSJaikumar Ganesh bt_cb(skb)->force_active = chan->force_active; 12610a708f8fSGustavo F. Padovan hci_send_acl(hcon, skb, flags); 12620a708f8fSGustavo F. Padovan } 12630a708f8fSGustavo F. Padovan 126467c9e840SSzymon Janc static void l2cap_streaming_send(struct l2cap_chan *chan) 12650a708f8fSGustavo F. Padovan { 12660a708f8fSGustavo F. Padovan struct sk_buff *skb; 12670a708f8fSGustavo F. Padovan u16 control, fcs; 12680a708f8fSGustavo F. Padovan 126958d35f87SGustavo F. Padovan while ((skb = skb_dequeue(&chan->tx_q))) { 12700a708f8fSGustavo F. Padovan control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE); 127142e5c802SGustavo F. Padovan control |= chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT; 12720a708f8fSGustavo F. Padovan put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE); 12730a708f8fSGustavo F. Padovan 127447d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 12750a708f8fSGustavo F. Padovan fcs = crc16(0, (u8 *)skb->data, skb->len - 2); 12760a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, skb->data + skb->len - 2); 12770a708f8fSGustavo F. Padovan } 12780a708f8fSGustavo F. Padovan 12794343478fSGustavo F. Padovan l2cap_do_send(chan, skb); 12800a708f8fSGustavo F. Padovan 128142e5c802SGustavo F. Padovan chan->next_tx_seq = (chan->next_tx_seq + 1) % 64; 12820a708f8fSGustavo F. Padovan } 12830a708f8fSGustavo F. Padovan } 12840a708f8fSGustavo F. Padovan 1285525cd185SGustavo F. Padovan static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq) 12860a708f8fSGustavo F. Padovan { 12870a708f8fSGustavo F. Padovan struct sk_buff *skb, *tx_skb; 12880a708f8fSGustavo F. Padovan u16 control, fcs; 12890a708f8fSGustavo F. Padovan 129058d35f87SGustavo F. Padovan skb = skb_peek(&chan->tx_q); 12910a708f8fSGustavo F. Padovan if (!skb) 12920a708f8fSGustavo F. Padovan return; 12930a708f8fSGustavo F. Padovan 12940a708f8fSGustavo F. Padovan do { 12950a708f8fSGustavo F. Padovan if (bt_cb(skb)->tx_seq == tx_seq) 12960a708f8fSGustavo F. Padovan break; 12970a708f8fSGustavo F. Padovan 129858d35f87SGustavo F. Padovan if (skb_queue_is_last(&chan->tx_q, skb)) 12990a708f8fSGustavo F. Padovan return; 13000a708f8fSGustavo F. Padovan 130158d35f87SGustavo F. Padovan } while ((skb = skb_queue_next(&chan->tx_q, skb))); 13020a708f8fSGustavo F. Padovan 13032c03a7a4SGustavo F. Padovan if (chan->remote_max_tx && 13042c03a7a4SGustavo F. Padovan bt_cb(skb)->retries == chan->remote_max_tx) { 13058c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 13060a708f8fSGustavo F. Padovan return; 13070a708f8fSGustavo F. Padovan } 13080a708f8fSGustavo F. Padovan 13090a708f8fSGustavo F. Padovan tx_skb = skb_clone(skb, GFP_ATOMIC); 13100a708f8fSGustavo F. Padovan bt_cb(skb)->retries++; 13110a708f8fSGustavo F. Padovan control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE); 1312a429b519SRuiyi Zhang control &= L2CAP_CTRL_SAR; 13130a708f8fSGustavo F. Padovan 1314e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 13150a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 13160a708f8fSGustavo F. Padovan 131742e5c802SGustavo F. Padovan control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT) 13180a708f8fSGustavo F. Padovan | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT); 13190a708f8fSGustavo F. Padovan 13200a708f8fSGustavo F. Padovan put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE); 13210a708f8fSGustavo F. Padovan 132247d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 13230a708f8fSGustavo F. Padovan fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2); 13240a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2); 13250a708f8fSGustavo F. Padovan } 13260a708f8fSGustavo F. Padovan 13274343478fSGustavo F. Padovan l2cap_do_send(chan, tx_skb); 13280a708f8fSGustavo F. Padovan } 13290a708f8fSGustavo F. Padovan 133067c9e840SSzymon Janc static int l2cap_ertm_send(struct l2cap_chan *chan) 13310a708f8fSGustavo F. Padovan { 13320a708f8fSGustavo F. Padovan struct sk_buff *skb, *tx_skb; 13330a708f8fSGustavo F. Padovan u16 control, fcs; 13340a708f8fSGustavo F. Padovan int nsent = 0; 13350a708f8fSGustavo F. Padovan 133689bc500eSGustavo F. Padovan if (chan->state != BT_CONNECTED) 13370a708f8fSGustavo F. Padovan return -ENOTCONN; 13380a708f8fSGustavo F. Padovan 133958d35f87SGustavo F. Padovan while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) { 13400a708f8fSGustavo F. Padovan 13412c03a7a4SGustavo F. Padovan if (chan->remote_max_tx && 13422c03a7a4SGustavo F. Padovan bt_cb(skb)->retries == chan->remote_max_tx) { 13438c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 13440a708f8fSGustavo F. Padovan break; 13450a708f8fSGustavo F. Padovan } 13460a708f8fSGustavo F. Padovan 13470a708f8fSGustavo F. Padovan tx_skb = skb_clone(skb, GFP_ATOMIC); 13480a708f8fSGustavo F. Padovan 13490a708f8fSGustavo F. Padovan bt_cb(skb)->retries++; 13500a708f8fSGustavo F. Padovan 13510a708f8fSGustavo F. Padovan control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE); 13520a708f8fSGustavo F. Padovan control &= L2CAP_CTRL_SAR; 13530a708f8fSGustavo F. Padovan 1354e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 13550a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 1356e2ab4353SGustavo F. Padovan 135742e5c802SGustavo F. Padovan control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT) 135842e5c802SGustavo F. Padovan | (chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT); 13590a708f8fSGustavo F. Padovan put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE); 13600a708f8fSGustavo F. Padovan 13610a708f8fSGustavo F. Padovan 136247d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 13630a708f8fSGustavo F. Padovan fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2); 13640a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, skb->data + tx_skb->len - 2); 13650a708f8fSGustavo F. Padovan } 13660a708f8fSGustavo F. Padovan 13674343478fSGustavo F. Padovan l2cap_do_send(chan, tx_skb); 13680a708f8fSGustavo F. Padovan 13691a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 13700a708f8fSGustavo F. Padovan 137142e5c802SGustavo F. Padovan bt_cb(skb)->tx_seq = chan->next_tx_seq; 137242e5c802SGustavo F. Padovan chan->next_tx_seq = (chan->next_tx_seq + 1) % 64; 13730a708f8fSGustavo F. Padovan 137423e9fde2SSuraj Sumangala if (bt_cb(skb)->retries == 1) 13756a026610SGustavo F. Padovan chan->unacked_frames++; 137623e9fde2SSuraj Sumangala 13776a026610SGustavo F. Padovan chan->frames_sent++; 13780a708f8fSGustavo F. Padovan 137958d35f87SGustavo F. Padovan if (skb_queue_is_last(&chan->tx_q, skb)) 138058d35f87SGustavo F. Padovan chan->tx_send_head = NULL; 13810a708f8fSGustavo F. Padovan else 138258d35f87SGustavo F. Padovan chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 13830a708f8fSGustavo F. Padovan 13840a708f8fSGustavo F. Padovan nsent++; 13850a708f8fSGustavo F. Padovan } 13860a708f8fSGustavo F. Padovan 13870a708f8fSGustavo F. Padovan return nsent; 13880a708f8fSGustavo F. Padovan } 13890a708f8fSGustavo F. Padovan 1390525cd185SGustavo F. Padovan static int l2cap_retransmit_frames(struct l2cap_chan *chan) 13910a708f8fSGustavo F. Padovan { 13920a708f8fSGustavo F. Padovan int ret; 13930a708f8fSGustavo F. Padovan 139458d35f87SGustavo F. Padovan if (!skb_queue_empty(&chan->tx_q)) 139558d35f87SGustavo F. Padovan chan->tx_send_head = chan->tx_q.next; 13960a708f8fSGustavo F. Padovan 139742e5c802SGustavo F. Padovan chan->next_tx_seq = chan->expected_ack_seq; 1398525cd185SGustavo F. Padovan ret = l2cap_ertm_send(chan); 13990a708f8fSGustavo F. Padovan return ret; 14000a708f8fSGustavo F. Padovan } 14010a708f8fSGustavo F. Padovan 1402525cd185SGustavo F. Padovan static void l2cap_send_ack(struct l2cap_chan *chan) 14030a708f8fSGustavo F. Padovan { 14040a708f8fSGustavo F. Padovan u16 control = 0; 14050a708f8fSGustavo F. Padovan 140642e5c802SGustavo F. Padovan control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 14070a708f8fSGustavo F. Padovan 1408e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 14090a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_NOT_READY; 1410e2ab4353SGustavo F. Padovan set_bit(CONN_RNR_SENT, &chan->conn_state); 1411525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 14120a708f8fSGustavo F. Padovan return; 14130a708f8fSGustavo F. Padovan } 14140a708f8fSGustavo F. Padovan 1415525cd185SGustavo F. Padovan if (l2cap_ertm_send(chan) > 0) 14160a708f8fSGustavo F. Padovan return; 14170a708f8fSGustavo F. Padovan 14180a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY; 1419525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 14200a708f8fSGustavo F. Padovan } 14210a708f8fSGustavo F. Padovan 1422525cd185SGustavo F. Padovan static void l2cap_send_srejtail(struct l2cap_chan *chan) 14230a708f8fSGustavo F. Padovan { 14240a708f8fSGustavo F. Padovan struct srej_list *tail; 14250a708f8fSGustavo F. Padovan u16 control; 14260a708f8fSGustavo F. Padovan 14270a708f8fSGustavo F. Padovan control = L2CAP_SUPER_SELECT_REJECT; 14280a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 14290a708f8fSGustavo F. Padovan 143039d5a3eeSGustavo F. Padovan tail = list_entry((&chan->srej_l)->prev, struct srej_list, list); 14310a708f8fSGustavo F. Padovan control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT; 14320a708f8fSGustavo F. Padovan 1433525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 14340a708f8fSGustavo F. Padovan } 14350a708f8fSGustavo F. Padovan 14360a708f8fSGustavo F. Padovan static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb) 14370a708f8fSGustavo F. Padovan { 14388c1d787bSGustavo F. Padovan struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 14390a708f8fSGustavo F. Padovan struct sk_buff **frag; 14400a708f8fSGustavo F. Padovan int err, sent = 0; 14410a708f8fSGustavo F. Padovan 14420a708f8fSGustavo F. Padovan if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) 14430a708f8fSGustavo F. Padovan return -EFAULT; 14440a708f8fSGustavo F. Padovan 14450a708f8fSGustavo F. Padovan sent += count; 14460a708f8fSGustavo F. Padovan len -= count; 14470a708f8fSGustavo F. Padovan 14480a708f8fSGustavo F. Padovan /* Continuation fragments (no L2CAP header) */ 14490a708f8fSGustavo F. Padovan frag = &skb_shinfo(skb)->frag_list; 14500a708f8fSGustavo F. Padovan while (len) { 14510a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, len); 14520a708f8fSGustavo F. Padovan 14530a708f8fSGustavo F. Padovan *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err); 14540a708f8fSGustavo F. Padovan if (!*frag) 14550a708f8fSGustavo F. Padovan return err; 14560a708f8fSGustavo F. Padovan if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) 14570a708f8fSGustavo F. Padovan return -EFAULT; 14580a708f8fSGustavo F. Padovan 14590a708f8fSGustavo F. Padovan sent += count; 14600a708f8fSGustavo F. Padovan len -= count; 14610a708f8fSGustavo F. Padovan 14620a708f8fSGustavo F. Padovan frag = &(*frag)->next; 14630a708f8fSGustavo F. Padovan } 14640a708f8fSGustavo F. Padovan 14650a708f8fSGustavo F. Padovan return sent; 14660a708f8fSGustavo F. Padovan } 14670a708f8fSGustavo F. Padovan 146867c9e840SSzymon Janc static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 14690a708f8fSGustavo F. Padovan { 1470fe4128e0SGustavo F. Padovan struct sock *sk = chan->sk; 14718c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 14720a708f8fSGustavo F. Padovan struct sk_buff *skb; 14730a708f8fSGustavo F. Padovan int err, count, hlen = L2CAP_HDR_SIZE + 2; 14740a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 14750a708f8fSGustavo F. Padovan 14760a708f8fSGustavo F. Padovan BT_DBG("sk %p len %d", sk, (int)len); 14770a708f8fSGustavo F. Padovan 14780a708f8fSGustavo F. Padovan count = min_t(unsigned int, (conn->mtu - hlen), len); 14790a708f8fSGustavo F. Padovan skb = bt_skb_send_alloc(sk, count + hlen, 14800a708f8fSGustavo F. Padovan msg->msg_flags & MSG_DONTWAIT, &err); 14810a708f8fSGustavo F. Padovan if (!skb) 14820a708f8fSGustavo F. Padovan return ERR_PTR(err); 14830a708f8fSGustavo F. Padovan 14840a708f8fSGustavo F. Padovan /* Create L2CAP header */ 14850a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 1486fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 14870a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 1488fe4128e0SGustavo F. Padovan put_unaligned_le16(chan->psm, skb_put(skb, 2)); 14890a708f8fSGustavo F. Padovan 14900a708f8fSGustavo F. Padovan err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb); 14910a708f8fSGustavo F. Padovan if (unlikely(err < 0)) { 14920a708f8fSGustavo F. Padovan kfree_skb(skb); 14930a708f8fSGustavo F. Padovan return ERR_PTR(err); 14940a708f8fSGustavo F. Padovan } 14950a708f8fSGustavo F. Padovan return skb; 14960a708f8fSGustavo F. Padovan } 14970a708f8fSGustavo F. Padovan 149867c9e840SSzymon Janc static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 14990a708f8fSGustavo F. Padovan { 1500fe4128e0SGustavo F. Padovan struct sock *sk = chan->sk; 15018c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 15020a708f8fSGustavo F. Padovan struct sk_buff *skb; 15030a708f8fSGustavo F. Padovan int err, count, hlen = L2CAP_HDR_SIZE; 15040a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 15050a708f8fSGustavo F. Padovan 15060a708f8fSGustavo F. Padovan BT_DBG("sk %p len %d", sk, (int)len); 15070a708f8fSGustavo F. Padovan 15080a708f8fSGustavo F. Padovan count = min_t(unsigned int, (conn->mtu - hlen), len); 15090a708f8fSGustavo F. Padovan skb = bt_skb_send_alloc(sk, count + hlen, 15100a708f8fSGustavo F. Padovan msg->msg_flags & MSG_DONTWAIT, &err); 15110a708f8fSGustavo F. Padovan if (!skb) 15120a708f8fSGustavo F. Padovan return ERR_PTR(err); 15130a708f8fSGustavo F. Padovan 15140a708f8fSGustavo F. Padovan /* Create L2CAP header */ 15150a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 1516fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 15170a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 15180a708f8fSGustavo F. Padovan 15190a708f8fSGustavo F. Padovan err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb); 15200a708f8fSGustavo F. Padovan if (unlikely(err < 0)) { 15210a708f8fSGustavo F. Padovan kfree_skb(skb); 15220a708f8fSGustavo F. Padovan return ERR_PTR(err); 15230a708f8fSGustavo F. Padovan } 15240a708f8fSGustavo F. Padovan return skb; 15250a708f8fSGustavo F. Padovan } 15260a708f8fSGustavo F. Padovan 1527ab0ff76dSLuiz Augusto von Dentz static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 1528ab0ff76dSLuiz Augusto von Dentz struct msghdr *msg, size_t len, 1529ab0ff76dSLuiz Augusto von Dentz u16 control, u16 sdulen) 15300a708f8fSGustavo F. Padovan { 153147d1ec61SGustavo F. Padovan struct sock *sk = chan->sk; 15328c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 15330a708f8fSGustavo F. Padovan struct sk_buff *skb; 15340a708f8fSGustavo F. Padovan int err, count, hlen = L2CAP_HDR_SIZE + 2; 15350a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 15360a708f8fSGustavo F. Padovan 15370a708f8fSGustavo F. Padovan BT_DBG("sk %p len %d", sk, (int)len); 15380a708f8fSGustavo F. Padovan 15390a708f8fSGustavo F. Padovan if (!conn) 15400a708f8fSGustavo F. Padovan return ERR_PTR(-ENOTCONN); 15410a708f8fSGustavo F. Padovan 15420a708f8fSGustavo F. Padovan if (sdulen) 15430a708f8fSGustavo F. Padovan hlen += 2; 15440a708f8fSGustavo F. Padovan 154547d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 15460a708f8fSGustavo F. Padovan hlen += 2; 15470a708f8fSGustavo F. Padovan 15480a708f8fSGustavo F. Padovan count = min_t(unsigned int, (conn->mtu - hlen), len); 15490a708f8fSGustavo F. Padovan skb = bt_skb_send_alloc(sk, count + hlen, 15500a708f8fSGustavo F. Padovan msg->msg_flags & MSG_DONTWAIT, &err); 15510a708f8fSGustavo F. Padovan if (!skb) 15520a708f8fSGustavo F. Padovan return ERR_PTR(err); 15530a708f8fSGustavo F. Padovan 15540a708f8fSGustavo F. Padovan /* Create L2CAP header */ 15550a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 1556fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 15570a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 15580a708f8fSGustavo F. Padovan put_unaligned_le16(control, skb_put(skb, 2)); 15590a708f8fSGustavo F. Padovan if (sdulen) 15600a708f8fSGustavo F. Padovan put_unaligned_le16(sdulen, skb_put(skb, 2)); 15610a708f8fSGustavo F. Padovan 15620a708f8fSGustavo F. Padovan err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb); 15630a708f8fSGustavo F. Padovan if (unlikely(err < 0)) { 15640a708f8fSGustavo F. Padovan kfree_skb(skb); 15650a708f8fSGustavo F. Padovan return ERR_PTR(err); 15660a708f8fSGustavo F. Padovan } 15670a708f8fSGustavo F. Padovan 156847d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 15690a708f8fSGustavo F. Padovan put_unaligned_le16(0, skb_put(skb, 2)); 15700a708f8fSGustavo F. Padovan 15710a708f8fSGustavo F. Padovan bt_cb(skb)->retries = 0; 15720a708f8fSGustavo F. Padovan return skb; 15730a708f8fSGustavo F. Padovan } 15740a708f8fSGustavo F. Padovan 157567c9e840SSzymon Janc static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 15760a708f8fSGustavo F. Padovan { 15770a708f8fSGustavo F. Padovan struct sk_buff *skb; 15780a708f8fSGustavo F. Padovan struct sk_buff_head sar_queue; 15790a708f8fSGustavo F. Padovan u16 control; 15800a708f8fSGustavo F. Padovan size_t size = 0; 15810a708f8fSGustavo F. Padovan 15820a708f8fSGustavo F. Padovan skb_queue_head_init(&sar_queue); 15830a708f8fSGustavo F. Padovan control = L2CAP_SDU_START; 158447d1ec61SGustavo F. Padovan skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len); 15850a708f8fSGustavo F. Padovan if (IS_ERR(skb)) 15860a708f8fSGustavo F. Padovan return PTR_ERR(skb); 15870a708f8fSGustavo F. Padovan 15880a708f8fSGustavo F. Padovan __skb_queue_tail(&sar_queue, skb); 15892c03a7a4SGustavo F. Padovan len -= chan->remote_mps; 15902c03a7a4SGustavo F. Padovan size += chan->remote_mps; 15910a708f8fSGustavo F. Padovan 15920a708f8fSGustavo F. Padovan while (len > 0) { 15930a708f8fSGustavo F. Padovan size_t buflen; 15940a708f8fSGustavo F. Padovan 15952c03a7a4SGustavo F. Padovan if (len > chan->remote_mps) { 15960a708f8fSGustavo F. Padovan control = L2CAP_SDU_CONTINUE; 15972c03a7a4SGustavo F. Padovan buflen = chan->remote_mps; 15980a708f8fSGustavo F. Padovan } else { 15990a708f8fSGustavo F. Padovan control = L2CAP_SDU_END; 16000a708f8fSGustavo F. Padovan buflen = len; 16010a708f8fSGustavo F. Padovan } 16020a708f8fSGustavo F. Padovan 160347d1ec61SGustavo F. Padovan skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0); 16040a708f8fSGustavo F. Padovan if (IS_ERR(skb)) { 16050a708f8fSGustavo F. Padovan skb_queue_purge(&sar_queue); 16060a708f8fSGustavo F. Padovan return PTR_ERR(skb); 16070a708f8fSGustavo F. Padovan } 16080a708f8fSGustavo F. Padovan 16090a708f8fSGustavo F. Padovan __skb_queue_tail(&sar_queue, skb); 16100a708f8fSGustavo F. Padovan len -= buflen; 16110a708f8fSGustavo F. Padovan size += buflen; 16120a708f8fSGustavo F. Padovan } 161358d35f87SGustavo F. Padovan skb_queue_splice_tail(&sar_queue, &chan->tx_q); 161458d35f87SGustavo F. Padovan if (chan->tx_send_head == NULL) 161558d35f87SGustavo F. Padovan chan->tx_send_head = sar_queue.next; 16160a708f8fSGustavo F. Padovan 16170a708f8fSGustavo F. Padovan return size; 16180a708f8fSGustavo F. Padovan } 16190a708f8fSGustavo F. Padovan 16209a91a04aSGustavo F. Padovan int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 16219a91a04aSGustavo F. Padovan { 16229a91a04aSGustavo F. Padovan struct sk_buff *skb; 16239a91a04aSGustavo F. Padovan u16 control; 16249a91a04aSGustavo F. Padovan int err; 16259a91a04aSGustavo F. Padovan 16269a91a04aSGustavo F. Padovan /* Connectionless channel */ 1627715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 16289a91a04aSGustavo F. Padovan skb = l2cap_create_connless_pdu(chan, msg, len); 16299a91a04aSGustavo F. Padovan if (IS_ERR(skb)) 16309a91a04aSGustavo F. Padovan return PTR_ERR(skb); 16319a91a04aSGustavo F. Padovan 16329a91a04aSGustavo F. Padovan l2cap_do_send(chan, skb); 16339a91a04aSGustavo F. Padovan return len; 16349a91a04aSGustavo F. Padovan } 16359a91a04aSGustavo F. Padovan 16369a91a04aSGustavo F. Padovan switch (chan->mode) { 16379a91a04aSGustavo F. Padovan case L2CAP_MODE_BASIC: 16389a91a04aSGustavo F. Padovan /* Check outgoing MTU */ 16399a91a04aSGustavo F. Padovan if (len > chan->omtu) 16409a91a04aSGustavo F. Padovan return -EMSGSIZE; 16419a91a04aSGustavo F. Padovan 16429a91a04aSGustavo F. Padovan /* Create a basic PDU */ 16439a91a04aSGustavo F. Padovan skb = l2cap_create_basic_pdu(chan, msg, len); 16449a91a04aSGustavo F. Padovan if (IS_ERR(skb)) 16459a91a04aSGustavo F. Padovan return PTR_ERR(skb); 16469a91a04aSGustavo F. Padovan 16479a91a04aSGustavo F. Padovan l2cap_do_send(chan, skb); 16489a91a04aSGustavo F. Padovan err = len; 16499a91a04aSGustavo F. Padovan break; 16509a91a04aSGustavo F. Padovan 16519a91a04aSGustavo F. Padovan case L2CAP_MODE_ERTM: 16529a91a04aSGustavo F. Padovan case L2CAP_MODE_STREAMING: 16539a91a04aSGustavo F. Padovan /* Entire SDU fits into one PDU */ 16549a91a04aSGustavo F. Padovan if (len <= chan->remote_mps) { 16559a91a04aSGustavo F. Padovan control = L2CAP_SDU_UNSEGMENTED; 16569a91a04aSGustavo F. Padovan skb = l2cap_create_iframe_pdu(chan, msg, len, control, 16579a91a04aSGustavo F. Padovan 0); 16589a91a04aSGustavo F. Padovan if (IS_ERR(skb)) 16599a91a04aSGustavo F. Padovan return PTR_ERR(skb); 16609a91a04aSGustavo F. Padovan 16619a91a04aSGustavo F. Padovan __skb_queue_tail(&chan->tx_q, skb); 16629a91a04aSGustavo F. Padovan 16639a91a04aSGustavo F. Padovan if (chan->tx_send_head == NULL) 16649a91a04aSGustavo F. Padovan chan->tx_send_head = skb; 16659a91a04aSGustavo F. Padovan 16669a91a04aSGustavo F. Padovan } else { 16679a91a04aSGustavo F. Padovan /* Segment SDU into multiples PDUs */ 16689a91a04aSGustavo F. Padovan err = l2cap_sar_segment_sdu(chan, msg, len); 16699a91a04aSGustavo F. Padovan if (err < 0) 16709a91a04aSGustavo F. Padovan return err; 16719a91a04aSGustavo F. Padovan } 16729a91a04aSGustavo F. Padovan 16739a91a04aSGustavo F. Padovan if (chan->mode == L2CAP_MODE_STREAMING) { 16749a91a04aSGustavo F. Padovan l2cap_streaming_send(chan); 16759a91a04aSGustavo F. Padovan err = len; 16769a91a04aSGustavo F. Padovan break; 16779a91a04aSGustavo F. Padovan } 16789a91a04aSGustavo F. Padovan 1679e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 1680e2ab4353SGustavo F. Padovan test_bit(CONN_WAIT_F, &chan->conn_state)) { 16819a91a04aSGustavo F. Padovan err = len; 16829a91a04aSGustavo F. Padovan break; 16839a91a04aSGustavo F. Padovan } 16849a91a04aSGustavo F. Padovan 16859a91a04aSGustavo F. Padovan err = l2cap_ertm_send(chan); 16869a91a04aSGustavo F. Padovan if (err >= 0) 16879a91a04aSGustavo F. Padovan err = len; 16889a91a04aSGustavo F. Padovan 16899a91a04aSGustavo F. Padovan break; 16909a91a04aSGustavo F. Padovan 16919a91a04aSGustavo F. Padovan default: 16929a91a04aSGustavo F. Padovan BT_DBG("bad state %1.1x", chan->mode); 16939a91a04aSGustavo F. Padovan err = -EBADFD; 16949a91a04aSGustavo F. Padovan } 16959a91a04aSGustavo F. Padovan 16969a91a04aSGustavo F. Padovan return err; 16979a91a04aSGustavo F. Padovan } 16989a91a04aSGustavo F. Padovan 16990a708f8fSGustavo F. Padovan /* Copy frame to all raw sockets on that connection */ 17000a708f8fSGustavo F. Padovan static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 17010a708f8fSGustavo F. Padovan { 17020a708f8fSGustavo F. Padovan struct sk_buff *nskb; 170348454079SGustavo F. Padovan struct l2cap_chan *chan; 17040a708f8fSGustavo F. Padovan 17050a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 17060a708f8fSGustavo F. Padovan 1707baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 1708baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 170948454079SGustavo F. Padovan struct sock *sk = chan->sk; 1710715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_RAW) 17110a708f8fSGustavo F. Padovan continue; 17120a708f8fSGustavo F. Padovan 17130a708f8fSGustavo F. Padovan /* Don't send frame to the socket it came from */ 17140a708f8fSGustavo F. Padovan if (skb->sk == sk) 17150a708f8fSGustavo F. Padovan continue; 17160a708f8fSGustavo F. Padovan nskb = skb_clone(skb, GFP_ATOMIC); 17170a708f8fSGustavo F. Padovan if (!nskb) 17180a708f8fSGustavo F. Padovan continue; 17190a708f8fSGustavo F. Padovan 172023070494SGustavo F. Padovan if (chan->ops->recv(chan->data, nskb)) 17210a708f8fSGustavo F. Padovan kfree_skb(nskb); 17220a708f8fSGustavo F. Padovan } 1723baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 17240a708f8fSGustavo F. Padovan } 17250a708f8fSGustavo F. Padovan 17260a708f8fSGustavo F. Padovan /* ---- L2CAP signalling commands ---- */ 17270a708f8fSGustavo F. Padovan static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 17280a708f8fSGustavo F. Padovan u8 code, u8 ident, u16 dlen, void *data) 17290a708f8fSGustavo F. Padovan { 17300a708f8fSGustavo F. Padovan struct sk_buff *skb, **frag; 17310a708f8fSGustavo F. Padovan struct l2cap_cmd_hdr *cmd; 17320a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 17330a708f8fSGustavo F. Padovan int len, count; 17340a708f8fSGustavo F. Padovan 17350a708f8fSGustavo F. Padovan BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", 17360a708f8fSGustavo F. Padovan conn, code, ident, dlen); 17370a708f8fSGustavo F. Padovan 17380a708f8fSGustavo F. Padovan len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 17390a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, len); 17400a708f8fSGustavo F. Padovan 17410a708f8fSGustavo F. Padovan skb = bt_skb_alloc(count, GFP_ATOMIC); 17420a708f8fSGustavo F. Padovan if (!skb) 17430a708f8fSGustavo F. Padovan return NULL; 17440a708f8fSGustavo F. Padovan 17450a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 17460a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 17473300d9a9SClaudio Takahasi 17483300d9a9SClaudio Takahasi if (conn->hcon->type == LE_LINK) 17493300d9a9SClaudio Takahasi lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 17503300d9a9SClaudio Takahasi else 17510a708f8fSGustavo F. Padovan lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 17520a708f8fSGustavo F. Padovan 17530a708f8fSGustavo F. Padovan cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE); 17540a708f8fSGustavo F. Padovan cmd->code = code; 17550a708f8fSGustavo F. Padovan cmd->ident = ident; 17560a708f8fSGustavo F. Padovan cmd->len = cpu_to_le16(dlen); 17570a708f8fSGustavo F. Padovan 17580a708f8fSGustavo F. Padovan if (dlen) { 17590a708f8fSGustavo F. Padovan count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 17600a708f8fSGustavo F. Padovan memcpy(skb_put(skb, count), data, count); 17610a708f8fSGustavo F. Padovan data += count; 17620a708f8fSGustavo F. Padovan } 17630a708f8fSGustavo F. Padovan 17640a708f8fSGustavo F. Padovan len -= skb->len; 17650a708f8fSGustavo F. Padovan 17660a708f8fSGustavo F. Padovan /* Continuation fragments (no L2CAP header) */ 17670a708f8fSGustavo F. Padovan frag = &skb_shinfo(skb)->frag_list; 17680a708f8fSGustavo F. Padovan while (len) { 17690a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, len); 17700a708f8fSGustavo F. Padovan 17710a708f8fSGustavo F. Padovan *frag = bt_skb_alloc(count, GFP_ATOMIC); 17720a708f8fSGustavo F. Padovan if (!*frag) 17730a708f8fSGustavo F. Padovan goto fail; 17740a708f8fSGustavo F. Padovan 17750a708f8fSGustavo F. Padovan memcpy(skb_put(*frag, count), data, count); 17760a708f8fSGustavo F. Padovan 17770a708f8fSGustavo F. Padovan len -= count; 17780a708f8fSGustavo F. Padovan data += count; 17790a708f8fSGustavo F. Padovan 17800a708f8fSGustavo F. Padovan frag = &(*frag)->next; 17810a708f8fSGustavo F. Padovan } 17820a708f8fSGustavo F. Padovan 17830a708f8fSGustavo F. Padovan return skb; 17840a708f8fSGustavo F. Padovan 17850a708f8fSGustavo F. Padovan fail: 17860a708f8fSGustavo F. Padovan kfree_skb(skb); 17870a708f8fSGustavo F. Padovan return NULL; 17880a708f8fSGustavo F. Padovan } 17890a708f8fSGustavo F. Padovan 17900a708f8fSGustavo F. Padovan static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val) 17910a708f8fSGustavo F. Padovan { 17920a708f8fSGustavo F. Padovan struct l2cap_conf_opt *opt = *ptr; 17930a708f8fSGustavo F. Padovan int len; 17940a708f8fSGustavo F. Padovan 17950a708f8fSGustavo F. Padovan len = L2CAP_CONF_OPT_SIZE + opt->len; 17960a708f8fSGustavo F. Padovan *ptr += len; 17970a708f8fSGustavo F. Padovan 17980a708f8fSGustavo F. Padovan *type = opt->type; 17990a708f8fSGustavo F. Padovan *olen = opt->len; 18000a708f8fSGustavo F. Padovan 18010a708f8fSGustavo F. Padovan switch (opt->len) { 18020a708f8fSGustavo F. Padovan case 1: 18030a708f8fSGustavo F. Padovan *val = *((u8 *) opt->val); 18040a708f8fSGustavo F. Padovan break; 18050a708f8fSGustavo F. Padovan 18060a708f8fSGustavo F. Padovan case 2: 18070a708f8fSGustavo F. Padovan *val = get_unaligned_le16(opt->val); 18080a708f8fSGustavo F. Padovan break; 18090a708f8fSGustavo F. Padovan 18100a708f8fSGustavo F. Padovan case 4: 18110a708f8fSGustavo F. Padovan *val = get_unaligned_le32(opt->val); 18120a708f8fSGustavo F. Padovan break; 18130a708f8fSGustavo F. Padovan 18140a708f8fSGustavo F. Padovan default: 18150a708f8fSGustavo F. Padovan *val = (unsigned long) opt->val; 18160a708f8fSGustavo F. Padovan break; 18170a708f8fSGustavo F. Padovan } 18180a708f8fSGustavo F. Padovan 18190a708f8fSGustavo F. Padovan BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val); 18200a708f8fSGustavo F. Padovan return len; 18210a708f8fSGustavo F. Padovan } 18220a708f8fSGustavo F. Padovan 18230a708f8fSGustavo F. Padovan static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) 18240a708f8fSGustavo F. Padovan { 18250a708f8fSGustavo F. Padovan struct l2cap_conf_opt *opt = *ptr; 18260a708f8fSGustavo F. Padovan 18270a708f8fSGustavo F. Padovan BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val); 18280a708f8fSGustavo F. Padovan 18290a708f8fSGustavo F. Padovan opt->type = type; 18300a708f8fSGustavo F. Padovan opt->len = len; 18310a708f8fSGustavo F. Padovan 18320a708f8fSGustavo F. Padovan switch (len) { 18330a708f8fSGustavo F. Padovan case 1: 18340a708f8fSGustavo F. Padovan *((u8 *) opt->val) = val; 18350a708f8fSGustavo F. Padovan break; 18360a708f8fSGustavo F. Padovan 18370a708f8fSGustavo F. Padovan case 2: 18380a708f8fSGustavo F. Padovan put_unaligned_le16(val, opt->val); 18390a708f8fSGustavo F. Padovan break; 18400a708f8fSGustavo F. Padovan 18410a708f8fSGustavo F. Padovan case 4: 18420a708f8fSGustavo F. Padovan put_unaligned_le32(val, opt->val); 18430a708f8fSGustavo F. Padovan break; 18440a708f8fSGustavo F. Padovan 18450a708f8fSGustavo F. Padovan default: 18460a708f8fSGustavo F. Padovan memcpy(opt->val, (void *) val, len); 18470a708f8fSGustavo F. Padovan break; 18480a708f8fSGustavo F. Padovan } 18490a708f8fSGustavo F. Padovan 18500a708f8fSGustavo F. Padovan *ptr += L2CAP_CONF_OPT_SIZE + len; 18510a708f8fSGustavo F. Padovan } 18520a708f8fSGustavo F. Padovan 18530a708f8fSGustavo F. Padovan static void l2cap_ack_timeout(unsigned long arg) 18540a708f8fSGustavo F. Padovan { 1855525cd185SGustavo F. Padovan struct l2cap_chan *chan = (void *) arg; 18560a708f8fSGustavo F. Padovan 1857525cd185SGustavo F. Padovan bh_lock_sock(chan->sk); 1858525cd185SGustavo F. Padovan l2cap_send_ack(chan); 1859525cd185SGustavo F. Padovan bh_unlock_sock(chan->sk); 18600a708f8fSGustavo F. Padovan } 18610a708f8fSGustavo F. Padovan 1862525cd185SGustavo F. Padovan static inline void l2cap_ertm_init(struct l2cap_chan *chan) 18630a708f8fSGustavo F. Padovan { 1864525cd185SGustavo F. Padovan struct sock *sk = chan->sk; 1865525cd185SGustavo F. Padovan 186642e5c802SGustavo F. Padovan chan->expected_ack_seq = 0; 18676a026610SGustavo F. Padovan chan->unacked_frames = 0; 186842e5c802SGustavo F. Padovan chan->buffer_seq = 0; 18696a026610SGustavo F. Padovan chan->num_acked = 0; 18706a026610SGustavo F. Padovan chan->frames_sent = 0; 18710a708f8fSGustavo F. Padovan 1872e92c8e70SGustavo F. Padovan setup_timer(&chan->retrans_timer, l2cap_retrans_timeout, 1873e92c8e70SGustavo F. Padovan (unsigned long) chan); 1874e92c8e70SGustavo F. Padovan setup_timer(&chan->monitor_timer, l2cap_monitor_timeout, 1875e92c8e70SGustavo F. Padovan (unsigned long) chan); 1876e92c8e70SGustavo F. Padovan setup_timer(&chan->ack_timer, l2cap_ack_timeout, (unsigned long) chan); 18770a708f8fSGustavo F. Padovan 1878f1c6775bSGustavo F. Padovan skb_queue_head_init(&chan->srej_q); 18790a708f8fSGustavo F. Padovan 188039d5a3eeSGustavo F. Padovan INIT_LIST_HEAD(&chan->srej_l); 188139d5a3eeSGustavo F. Padovan 18820a708f8fSGustavo F. Padovan 18830a708f8fSGustavo F. Padovan sk->sk_backlog_rcv = l2cap_ertm_data_rcv; 18840a708f8fSGustavo F. Padovan } 18850a708f8fSGustavo F. Padovan 18860a708f8fSGustavo F. Padovan static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 18870a708f8fSGustavo F. Padovan { 18880a708f8fSGustavo F. Padovan switch (mode) { 18890a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 18900a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 18910a708f8fSGustavo F. Padovan if (l2cap_mode_supported(mode, remote_feat_mask)) 18920a708f8fSGustavo F. Padovan return mode; 18930a708f8fSGustavo F. Padovan /* fall through */ 18940a708f8fSGustavo F. Padovan default: 18950a708f8fSGustavo F. Padovan return L2CAP_MODE_BASIC; 18960a708f8fSGustavo F. Padovan } 18970a708f8fSGustavo F. Padovan } 18980a708f8fSGustavo F. Padovan 1899710f9b0aSGustavo F. Padovan static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) 19000a708f8fSGustavo F. Padovan { 19010a708f8fSGustavo F. Padovan struct l2cap_conf_req *req = data; 19020c1bc5c6SGustavo F. Padovan struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 19030a708f8fSGustavo F. Padovan void *ptr = req->data; 19040a708f8fSGustavo F. Padovan 190549208c9cSGustavo F. Padovan BT_DBG("chan %p", chan); 19060a708f8fSGustavo F. Padovan 190773ffa904SGustavo F. Padovan if (chan->num_conf_req || chan->num_conf_rsp) 19080a708f8fSGustavo F. Padovan goto done; 19090a708f8fSGustavo F. Padovan 19100c1bc5c6SGustavo F. Padovan switch (chan->mode) { 19110a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 19120a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 1913c1360a1cSGustavo F. Padovan if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 19140a708f8fSGustavo F. Padovan break; 19150a708f8fSGustavo F. Padovan 19160a708f8fSGustavo F. Padovan /* fall through */ 19170a708f8fSGustavo F. Padovan default: 19188c1d787bSGustavo F. Padovan chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 19190a708f8fSGustavo F. Padovan break; 19200a708f8fSGustavo F. Padovan } 19210a708f8fSGustavo F. Padovan 19220a708f8fSGustavo F. Padovan done: 19230c1bc5c6SGustavo F. Padovan if (chan->imtu != L2CAP_DEFAULT_MTU) 19240c1bc5c6SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); 19250a708f8fSGustavo F. Padovan 19260c1bc5c6SGustavo F. Padovan switch (chan->mode) { 19270a708f8fSGustavo F. Padovan case L2CAP_MODE_BASIC: 19288c1d787bSGustavo F. Padovan if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 19298c1d787bSGustavo F. Padovan !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 19300a708f8fSGustavo F. Padovan break; 19310a708f8fSGustavo F. Padovan 19320a708f8fSGustavo F. Padovan rfc.mode = L2CAP_MODE_BASIC; 19330a708f8fSGustavo F. Padovan rfc.txwin_size = 0; 19340a708f8fSGustavo F. Padovan rfc.max_transmit = 0; 19350a708f8fSGustavo F. Padovan rfc.retrans_timeout = 0; 19360a708f8fSGustavo F. Padovan rfc.monitor_timeout = 0; 19370a708f8fSGustavo F. Padovan rfc.max_pdu_size = 0; 19380a708f8fSGustavo F. Padovan 19390a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 19400a708f8fSGustavo F. Padovan (unsigned long) &rfc); 19410a708f8fSGustavo F. Padovan break; 19420a708f8fSGustavo F. Padovan 19430a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 19440a708f8fSGustavo F. Padovan rfc.mode = L2CAP_MODE_ERTM; 194547d1ec61SGustavo F. Padovan rfc.txwin_size = chan->tx_win; 194647d1ec61SGustavo F. Padovan rfc.max_transmit = chan->max_tx; 19470a708f8fSGustavo F. Padovan rfc.retrans_timeout = 0; 19480a708f8fSGustavo F. Padovan rfc.monitor_timeout = 0; 19490a708f8fSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE); 19508c1d787bSGustavo F. Padovan if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10) 19518c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 19520a708f8fSGustavo F. Padovan 19530a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 19540a708f8fSGustavo F. Padovan (unsigned long) &rfc); 19550a708f8fSGustavo F. Padovan 19568c1d787bSGustavo F. Padovan if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS)) 19570a708f8fSGustavo F. Padovan break; 19580a708f8fSGustavo F. Padovan 195947d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_NONE || 1960c1360a1cSGustavo F. Padovan test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) { 196147d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 196247d1ec61SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs); 19630a708f8fSGustavo F. Padovan } 19640a708f8fSGustavo F. Padovan break; 19650a708f8fSGustavo F. Padovan 19660a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 19670a708f8fSGustavo F. Padovan rfc.mode = L2CAP_MODE_STREAMING; 19680a708f8fSGustavo F. Padovan rfc.txwin_size = 0; 19690a708f8fSGustavo F. Padovan rfc.max_transmit = 0; 19700a708f8fSGustavo F. Padovan rfc.retrans_timeout = 0; 19710a708f8fSGustavo F. Padovan rfc.monitor_timeout = 0; 19720a708f8fSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE); 19738c1d787bSGustavo F. Padovan if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10) 19748c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 19750a708f8fSGustavo F. Padovan 19760a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 19770a708f8fSGustavo F. Padovan (unsigned long) &rfc); 19780a708f8fSGustavo F. Padovan 19798c1d787bSGustavo F. Padovan if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS)) 19800a708f8fSGustavo F. Padovan break; 19810a708f8fSGustavo F. Padovan 198247d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_NONE || 1983c1360a1cSGustavo F. Padovan test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) { 198447d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 198547d1ec61SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs); 19860a708f8fSGustavo F. Padovan } 19870a708f8fSGustavo F. Padovan break; 19880a708f8fSGustavo F. Padovan } 19890a708f8fSGustavo F. Padovan 1990fe4128e0SGustavo F. Padovan req->dcid = cpu_to_le16(chan->dcid); 19910a708f8fSGustavo F. Padovan req->flags = cpu_to_le16(0); 19920a708f8fSGustavo F. Padovan 19930a708f8fSGustavo F. Padovan return ptr - data; 19940a708f8fSGustavo F. Padovan } 19950a708f8fSGustavo F. Padovan 199673ffa904SGustavo F. Padovan static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data) 19970a708f8fSGustavo F. Padovan { 19980a708f8fSGustavo F. Padovan struct l2cap_conf_rsp *rsp = data; 19990a708f8fSGustavo F. Padovan void *ptr = rsp->data; 200073ffa904SGustavo F. Padovan void *req = chan->conf_req; 200173ffa904SGustavo F. Padovan int len = chan->conf_len; 20020a708f8fSGustavo F. Padovan int type, hint, olen; 20030a708f8fSGustavo F. Padovan unsigned long val; 20040a708f8fSGustavo F. Padovan struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 20050a708f8fSGustavo F. Padovan u16 mtu = L2CAP_DEFAULT_MTU; 20060a708f8fSGustavo F. Padovan u16 result = L2CAP_CONF_SUCCESS; 20070a708f8fSGustavo F. Padovan 200873ffa904SGustavo F. Padovan BT_DBG("chan %p", chan); 20090a708f8fSGustavo F. Padovan 20100a708f8fSGustavo F. Padovan while (len >= L2CAP_CONF_OPT_SIZE) { 20110a708f8fSGustavo F. Padovan len -= l2cap_get_conf_opt(&req, &type, &olen, &val); 20120a708f8fSGustavo F. Padovan 20130a708f8fSGustavo F. Padovan hint = type & L2CAP_CONF_HINT; 20140a708f8fSGustavo F. Padovan type &= L2CAP_CONF_MASK; 20150a708f8fSGustavo F. Padovan 20160a708f8fSGustavo F. Padovan switch (type) { 20170a708f8fSGustavo F. Padovan case L2CAP_CONF_MTU: 20180a708f8fSGustavo F. Padovan mtu = val; 20190a708f8fSGustavo F. Padovan break; 20200a708f8fSGustavo F. Padovan 20210a708f8fSGustavo F. Padovan case L2CAP_CONF_FLUSH_TO: 20220c1bc5c6SGustavo F. Padovan chan->flush_to = val; 20230a708f8fSGustavo F. Padovan break; 20240a708f8fSGustavo F. Padovan 20250a708f8fSGustavo F. Padovan case L2CAP_CONF_QOS: 20260a708f8fSGustavo F. Padovan break; 20270a708f8fSGustavo F. Padovan 20280a708f8fSGustavo F. Padovan case L2CAP_CONF_RFC: 20290a708f8fSGustavo F. Padovan if (olen == sizeof(rfc)) 20300a708f8fSGustavo F. Padovan memcpy(&rfc, (void *) val, olen); 20310a708f8fSGustavo F. Padovan break; 20320a708f8fSGustavo F. Padovan 20330a708f8fSGustavo F. Padovan case L2CAP_CONF_FCS: 20340a708f8fSGustavo F. Padovan if (val == L2CAP_FCS_NONE) 2035c1360a1cSGustavo F. Padovan set_bit(CONF_NO_FCS_RECV, &chan->conf_state); 20360a708f8fSGustavo F. Padovan 20370a708f8fSGustavo F. Padovan break; 20380a708f8fSGustavo F. Padovan 20390a708f8fSGustavo F. Padovan default: 20400a708f8fSGustavo F. Padovan if (hint) 20410a708f8fSGustavo F. Padovan break; 20420a708f8fSGustavo F. Padovan 20430a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNKNOWN; 20440a708f8fSGustavo F. Padovan *((u8 *) ptr++) = type; 20450a708f8fSGustavo F. Padovan break; 20460a708f8fSGustavo F. Padovan } 20470a708f8fSGustavo F. Padovan } 20480a708f8fSGustavo F. Padovan 204973ffa904SGustavo F. Padovan if (chan->num_conf_rsp || chan->num_conf_req > 1) 20500a708f8fSGustavo F. Padovan goto done; 20510a708f8fSGustavo F. Padovan 20520c1bc5c6SGustavo F. Padovan switch (chan->mode) { 20530a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 20540a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 2055c1360a1cSGustavo F. Padovan if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 20560c1bc5c6SGustavo F. Padovan chan->mode = l2cap_select_mode(rfc.mode, 20578c1d787bSGustavo F. Padovan chan->conn->feat_mask); 20580a708f8fSGustavo F. Padovan break; 20590a708f8fSGustavo F. Padovan } 20600a708f8fSGustavo F. Padovan 20610c1bc5c6SGustavo F. Padovan if (chan->mode != rfc.mode) 20620a708f8fSGustavo F. Padovan return -ECONNREFUSED; 20630a708f8fSGustavo F. Padovan 20640a708f8fSGustavo F. Padovan break; 20650a708f8fSGustavo F. Padovan } 20660a708f8fSGustavo F. Padovan 20670a708f8fSGustavo F. Padovan done: 20680c1bc5c6SGustavo F. Padovan if (chan->mode != rfc.mode) { 20690a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNACCEPT; 20700c1bc5c6SGustavo F. Padovan rfc.mode = chan->mode; 20710a708f8fSGustavo F. Padovan 207273ffa904SGustavo F. Padovan if (chan->num_conf_rsp == 1) 20730a708f8fSGustavo F. Padovan return -ECONNREFUSED; 20740a708f8fSGustavo F. Padovan 20750a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 20760a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 20770a708f8fSGustavo F. Padovan } 20780a708f8fSGustavo F. Padovan 20790a708f8fSGustavo F. Padovan 20800a708f8fSGustavo F. Padovan if (result == L2CAP_CONF_SUCCESS) { 20810a708f8fSGustavo F. Padovan /* Configure output options and let the other side know 20820a708f8fSGustavo F. Padovan * which ones we don't like. */ 20830a708f8fSGustavo F. Padovan 20840a708f8fSGustavo F. Padovan if (mtu < L2CAP_DEFAULT_MIN_MTU) 20850a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNACCEPT; 20860a708f8fSGustavo F. Padovan else { 20870c1bc5c6SGustavo F. Padovan chan->omtu = mtu; 2088c1360a1cSGustavo F. Padovan set_bit(CONF_MTU_DONE, &chan->conf_state); 20890a708f8fSGustavo F. Padovan } 20900c1bc5c6SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu); 20910a708f8fSGustavo F. Padovan 20920a708f8fSGustavo F. Padovan switch (rfc.mode) { 20930a708f8fSGustavo F. Padovan case L2CAP_MODE_BASIC: 209447d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 2095c1360a1cSGustavo F. Padovan set_bit(CONF_MODE_DONE, &chan->conf_state); 20960a708f8fSGustavo F. Padovan break; 20970a708f8fSGustavo F. Padovan 20980a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 20992c03a7a4SGustavo F. Padovan chan->remote_tx_win = rfc.txwin_size; 21002c03a7a4SGustavo F. Padovan chan->remote_max_tx = rfc.max_transmit; 21010a708f8fSGustavo F. Padovan 21028c1d787bSGustavo F. Padovan if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10) 21038c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 21040a708f8fSGustavo F. Padovan 21052c03a7a4SGustavo F. Padovan chan->remote_mps = le16_to_cpu(rfc.max_pdu_size); 21060a708f8fSGustavo F. Padovan 21070a708f8fSGustavo F. Padovan rfc.retrans_timeout = 21080a708f8fSGustavo F. Padovan le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO); 21090a708f8fSGustavo F. Padovan rfc.monitor_timeout = 21100a708f8fSGustavo F. Padovan le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO); 21110a708f8fSGustavo F. Padovan 2112c1360a1cSGustavo F. Padovan set_bit(CONF_MODE_DONE, &chan->conf_state); 21130a708f8fSGustavo F. Padovan 21140a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 21150a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 21160a708f8fSGustavo F. Padovan 21170a708f8fSGustavo F. Padovan break; 21180a708f8fSGustavo F. Padovan 21190a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 21208c1d787bSGustavo F. Padovan if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10) 21218c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 21220a708f8fSGustavo F. Padovan 21232c03a7a4SGustavo F. Padovan chan->remote_mps = le16_to_cpu(rfc.max_pdu_size); 21240a708f8fSGustavo F. Padovan 2125c1360a1cSGustavo F. Padovan set_bit(CONF_MODE_DONE, &chan->conf_state); 21260a708f8fSGustavo F. Padovan 21270a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 21280a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 21290a708f8fSGustavo F. Padovan 21300a708f8fSGustavo F. Padovan break; 21310a708f8fSGustavo F. Padovan 21320a708f8fSGustavo F. Padovan default: 21330a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNACCEPT; 21340a708f8fSGustavo F. Padovan 21350a708f8fSGustavo F. Padovan memset(&rfc, 0, sizeof(rfc)); 21360c1bc5c6SGustavo F. Padovan rfc.mode = chan->mode; 21370a708f8fSGustavo F. Padovan } 21380a708f8fSGustavo F. Padovan 21390a708f8fSGustavo F. Padovan if (result == L2CAP_CONF_SUCCESS) 2140c1360a1cSGustavo F. Padovan set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 21410a708f8fSGustavo F. Padovan } 2142fe4128e0SGustavo F. Padovan rsp->scid = cpu_to_le16(chan->dcid); 21430a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(result); 21440a708f8fSGustavo F. Padovan rsp->flags = cpu_to_le16(0x0000); 21450a708f8fSGustavo F. Padovan 21460a708f8fSGustavo F. Padovan return ptr - data; 21470a708f8fSGustavo F. Padovan } 21480a708f8fSGustavo F. Padovan 2149b4450035SGustavo F. Padovan static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result) 21500a708f8fSGustavo F. Padovan { 21510a708f8fSGustavo F. Padovan struct l2cap_conf_req *req = data; 21520a708f8fSGustavo F. Padovan void *ptr = req->data; 21530a708f8fSGustavo F. Padovan int type, olen; 21540a708f8fSGustavo F. Padovan unsigned long val; 215536e999a8SMat Martineau struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 21560a708f8fSGustavo F. Padovan 2157fe4128e0SGustavo F. Padovan BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 21580a708f8fSGustavo F. Padovan 21590a708f8fSGustavo F. Padovan while (len >= L2CAP_CONF_OPT_SIZE) { 21600a708f8fSGustavo F. Padovan len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 21610a708f8fSGustavo F. Padovan 21620a708f8fSGustavo F. Padovan switch (type) { 21630a708f8fSGustavo F. Padovan case L2CAP_CONF_MTU: 21640a708f8fSGustavo F. Padovan if (val < L2CAP_DEFAULT_MIN_MTU) { 21650a708f8fSGustavo F. Padovan *result = L2CAP_CONF_UNACCEPT; 21660c1bc5c6SGustavo F. Padovan chan->imtu = L2CAP_DEFAULT_MIN_MTU; 21670a708f8fSGustavo F. Padovan } else 21680c1bc5c6SGustavo F. Padovan chan->imtu = val; 21690c1bc5c6SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); 21700a708f8fSGustavo F. Padovan break; 21710a708f8fSGustavo F. Padovan 21720a708f8fSGustavo F. Padovan case L2CAP_CONF_FLUSH_TO: 21730c1bc5c6SGustavo F. Padovan chan->flush_to = val; 21740a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 21750c1bc5c6SGustavo F. Padovan 2, chan->flush_to); 21760a708f8fSGustavo F. Padovan break; 21770a708f8fSGustavo F. Padovan 21780a708f8fSGustavo F. Padovan case L2CAP_CONF_RFC: 21790a708f8fSGustavo F. Padovan if (olen == sizeof(rfc)) 21800a708f8fSGustavo F. Padovan memcpy(&rfc, (void *)val, olen); 21810a708f8fSGustavo F. Padovan 2182c1360a1cSGustavo F. Padovan if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 21830c1bc5c6SGustavo F. Padovan rfc.mode != chan->mode) 21840a708f8fSGustavo F. Padovan return -ECONNREFUSED; 21850a708f8fSGustavo F. Padovan 218647d1ec61SGustavo F. Padovan chan->fcs = 0; 21870a708f8fSGustavo F. Padovan 21880a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 21890a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 21900a708f8fSGustavo F. Padovan break; 21910a708f8fSGustavo F. Padovan } 21920a708f8fSGustavo F. Padovan } 21930a708f8fSGustavo F. Padovan 21940c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) 21950a708f8fSGustavo F. Padovan return -ECONNREFUSED; 21960a708f8fSGustavo F. Padovan 21970c1bc5c6SGustavo F. Padovan chan->mode = rfc.mode; 21980a708f8fSGustavo F. Padovan 21990a708f8fSGustavo F. Padovan if (*result == L2CAP_CONF_SUCCESS) { 22000a708f8fSGustavo F. Padovan switch (rfc.mode) { 22010a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 220247d1ec61SGustavo F. Padovan chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 220347d1ec61SGustavo F. Padovan chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 220447d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 22050a708f8fSGustavo F. Padovan break; 22060a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 220747d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 22080a708f8fSGustavo F. Padovan } 22090a708f8fSGustavo F. Padovan } 22100a708f8fSGustavo F. Padovan 2211fe4128e0SGustavo F. Padovan req->dcid = cpu_to_le16(chan->dcid); 22120a708f8fSGustavo F. Padovan req->flags = cpu_to_le16(0x0000); 22130a708f8fSGustavo F. Padovan 22140a708f8fSGustavo F. Padovan return ptr - data; 22150a708f8fSGustavo F. Padovan } 22160a708f8fSGustavo F. Padovan 2217fe4128e0SGustavo F. Padovan static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags) 22180a708f8fSGustavo F. Padovan { 22190a708f8fSGustavo F. Padovan struct l2cap_conf_rsp *rsp = data; 22200a708f8fSGustavo F. Padovan void *ptr = rsp->data; 22210a708f8fSGustavo F. Padovan 2222fe4128e0SGustavo F. Padovan BT_DBG("chan %p", chan); 22230a708f8fSGustavo F. Padovan 2224fe4128e0SGustavo F. Padovan rsp->scid = cpu_to_le16(chan->dcid); 22250a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(result); 22260a708f8fSGustavo F. Padovan rsp->flags = cpu_to_le16(flags); 22270a708f8fSGustavo F. Padovan 22280a708f8fSGustavo F. Padovan return ptr - data; 22290a708f8fSGustavo F. Padovan } 22300a708f8fSGustavo F. Padovan 22318c1d787bSGustavo F. Padovan void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 2232710f9b0aSGustavo F. Padovan { 2233710f9b0aSGustavo F. Padovan struct l2cap_conn_rsp rsp; 22348c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 2235710f9b0aSGustavo F. Padovan u8 buf[128]; 2236710f9b0aSGustavo F. Padovan 2237fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 2238fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 2239710f9b0aSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 2240710f9b0aSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 2241710f9b0aSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, 2242710f9b0aSGustavo F. Padovan L2CAP_CONN_RSP, sizeof(rsp), &rsp); 2243710f9b0aSGustavo F. Padovan 2244c1360a1cSGustavo F. Padovan if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 2245710f9b0aSGustavo F. Padovan return; 2246710f9b0aSGustavo F. Padovan 2247710f9b0aSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 2248710f9b0aSGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 2249710f9b0aSGustavo F. Padovan chan->num_conf_req++; 2250710f9b0aSGustavo F. Padovan } 2251710f9b0aSGustavo F. Padovan 225247d1ec61SGustavo F. Padovan static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 22530a708f8fSGustavo F. Padovan { 22540a708f8fSGustavo F. Padovan int type, olen; 22550a708f8fSGustavo F. Padovan unsigned long val; 22560a708f8fSGustavo F. Padovan struct l2cap_conf_rfc rfc; 22570a708f8fSGustavo F. Padovan 225847d1ec61SGustavo F. Padovan BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 22590a708f8fSGustavo F. Padovan 22600c1bc5c6SGustavo F. Padovan if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 22610a708f8fSGustavo F. Padovan return; 22620a708f8fSGustavo F. Padovan 22630a708f8fSGustavo F. Padovan while (len >= L2CAP_CONF_OPT_SIZE) { 22640a708f8fSGustavo F. Padovan len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 22650a708f8fSGustavo F. Padovan 22660a708f8fSGustavo F. Padovan switch (type) { 22670a708f8fSGustavo F. Padovan case L2CAP_CONF_RFC: 22680a708f8fSGustavo F. Padovan if (olen == sizeof(rfc)) 22690a708f8fSGustavo F. Padovan memcpy(&rfc, (void *)val, olen); 22700a708f8fSGustavo F. Padovan goto done; 22710a708f8fSGustavo F. Padovan } 22720a708f8fSGustavo F. Padovan } 22730a708f8fSGustavo F. Padovan 227436e999a8SMat Martineau /* Use sane default values in case a misbehaving remote device 227536e999a8SMat Martineau * did not send an RFC option. 227636e999a8SMat Martineau */ 227736e999a8SMat Martineau rfc.mode = chan->mode; 227836e999a8SMat Martineau rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO); 227936e999a8SMat Martineau rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO); 228036e999a8SMat Martineau rfc.max_pdu_size = cpu_to_le16(chan->imtu); 228136e999a8SMat Martineau 228236e999a8SMat Martineau BT_ERR("Expected RFC option was not found, using defaults"); 228336e999a8SMat Martineau 22840a708f8fSGustavo F. Padovan done: 22850a708f8fSGustavo F. Padovan switch (rfc.mode) { 22860a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 228747d1ec61SGustavo F. Padovan chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 228847d1ec61SGustavo F. Padovan chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 228947d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 22900a708f8fSGustavo F. Padovan break; 22910a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 229247d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 22930a708f8fSGustavo F. Padovan } 22940a708f8fSGustavo F. Padovan } 22950a708f8fSGustavo F. Padovan 22960a708f8fSGustavo F. Padovan static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 22970a708f8fSGustavo F. Padovan { 2298e2fd318eSIlia Kolomisnky struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 22990a708f8fSGustavo F. Padovan 2300e2fd318eSIlia Kolomisnky if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 23010a708f8fSGustavo F. Padovan return 0; 23020a708f8fSGustavo F. Padovan 23030a708f8fSGustavo F. Padovan if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 23040a708f8fSGustavo F. Padovan cmd->ident == conn->info_ident) { 23050a708f8fSGustavo F. Padovan del_timer(&conn->info_timer); 23060a708f8fSGustavo F. Padovan 23070a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 23080a708f8fSGustavo F. Padovan conn->info_ident = 0; 23090a708f8fSGustavo F. Padovan 23100a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 23110a708f8fSGustavo F. Padovan } 23120a708f8fSGustavo F. Padovan 23130a708f8fSGustavo F. Padovan return 0; 23140a708f8fSGustavo F. Padovan } 23150a708f8fSGustavo F. Padovan 23160a708f8fSGustavo F. Padovan static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 23170a708f8fSGustavo F. Padovan { 23180a708f8fSGustavo F. Padovan struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 23190a708f8fSGustavo F. Padovan struct l2cap_conn_rsp rsp; 232023691d75SGustavo F. Padovan struct l2cap_chan *chan = NULL, *pchan; 23210a708f8fSGustavo F. Padovan struct sock *parent, *sk = NULL; 23220a708f8fSGustavo F. Padovan int result, status = L2CAP_CS_NO_INFO; 23230a708f8fSGustavo F. Padovan 23240a708f8fSGustavo F. Padovan u16 dcid = 0, scid = __le16_to_cpu(req->scid); 23250a708f8fSGustavo F. Padovan __le16 psm = req->psm; 23260a708f8fSGustavo F. Padovan 23270a708f8fSGustavo F. Padovan BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid); 23280a708f8fSGustavo F. Padovan 23290a708f8fSGustavo F. Padovan /* Check if we have socket listening on psm */ 233023691d75SGustavo F. Padovan pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src); 233123691d75SGustavo F. Padovan if (!pchan) { 23320a708f8fSGustavo F. Padovan result = L2CAP_CR_BAD_PSM; 23330a708f8fSGustavo F. Padovan goto sendresp; 23340a708f8fSGustavo F. Padovan } 23350a708f8fSGustavo F. Padovan 233623691d75SGustavo F. Padovan parent = pchan->sk; 233723691d75SGustavo F. Padovan 23380a708f8fSGustavo F. Padovan bh_lock_sock(parent); 23390a708f8fSGustavo F. Padovan 23400a708f8fSGustavo F. Padovan /* Check if the ACL is secure enough (if not SDP) */ 23410a708f8fSGustavo F. Padovan if (psm != cpu_to_le16(0x0001) && 23420a708f8fSGustavo F. Padovan !hci_conn_check_link_mode(conn->hcon)) { 23430a708f8fSGustavo F. Padovan conn->disc_reason = 0x05; 23440a708f8fSGustavo F. Padovan result = L2CAP_CR_SEC_BLOCK; 23450a708f8fSGustavo F. Padovan goto response; 23460a708f8fSGustavo F. Padovan } 23470a708f8fSGustavo F. Padovan 23480a708f8fSGustavo F. Padovan result = L2CAP_CR_NO_MEM; 23490a708f8fSGustavo F. Padovan 23500a708f8fSGustavo F. Padovan /* Check for backlog size */ 23510a708f8fSGustavo F. Padovan if (sk_acceptq_is_full(parent)) { 23520a708f8fSGustavo F. Padovan BT_DBG("backlog full %d", parent->sk_ack_backlog); 23530a708f8fSGustavo F. Padovan goto response; 23540a708f8fSGustavo F. Padovan } 23550a708f8fSGustavo F. Padovan 235680808e43SGustavo F. Padovan chan = pchan->ops->new_connection(pchan->data); 235780808e43SGustavo F. Padovan if (!chan) 23580a708f8fSGustavo F. Padovan goto response; 23590a708f8fSGustavo F. Padovan 236080808e43SGustavo F. Padovan sk = chan->sk; 236180808e43SGustavo F. Padovan 2362baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 23630a708f8fSGustavo F. Padovan 23640a708f8fSGustavo F. Padovan /* Check if we already have channel with that dcid */ 2365baa7e1faSGustavo F. Padovan if (__l2cap_get_chan_by_dcid(conn, scid)) { 2366baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 23670a708f8fSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 2368ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 23690a708f8fSGustavo F. Padovan goto response; 23700a708f8fSGustavo F. Padovan } 23710a708f8fSGustavo F. Padovan 23720a708f8fSGustavo F. Padovan hci_conn_hold(conn->hcon); 23730a708f8fSGustavo F. Padovan 23740a708f8fSGustavo F. Padovan bacpy(&bt_sk(sk)->src, conn->src); 23750a708f8fSGustavo F. Padovan bacpy(&bt_sk(sk)->dst, conn->dst); 2376fe4128e0SGustavo F. Padovan chan->psm = psm; 2377fe4128e0SGustavo F. Padovan chan->dcid = scid; 23780a708f8fSGustavo F. Padovan 2379d1010240SGustavo F. Padovan bt_accept_enqueue(parent, sk); 2380d1010240SGustavo F. Padovan 238148454079SGustavo F. Padovan __l2cap_chan_add(conn, chan); 238248454079SGustavo F. Padovan 2383fe4128e0SGustavo F. Padovan dcid = chan->scid; 23840a708f8fSGustavo F. Padovan 2385c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 23860a708f8fSGustavo F. Padovan 2387fc7f8a7eSGustavo F. Padovan chan->ident = cmd->ident; 23880a708f8fSGustavo F. Padovan 23890a708f8fSGustavo F. Padovan if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 23904343478fSGustavo F. Padovan if (l2cap_check_security(chan)) { 23910a708f8fSGustavo F. Padovan if (bt_sk(sk)->defer_setup) { 239289bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT2); 23930a708f8fSGustavo F. Padovan result = L2CAP_CR_PEND; 23940a708f8fSGustavo F. Padovan status = L2CAP_CS_AUTHOR_PEND; 23950a708f8fSGustavo F. Padovan parent->sk_data_ready(parent, 0); 23960a708f8fSGustavo F. Padovan } else { 239789bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 23980a708f8fSGustavo F. Padovan result = L2CAP_CR_SUCCESS; 23990a708f8fSGustavo F. Padovan status = L2CAP_CS_NO_INFO; 24000a708f8fSGustavo F. Padovan } 24010a708f8fSGustavo F. Padovan } else { 240289bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT2); 24030a708f8fSGustavo F. Padovan result = L2CAP_CR_PEND; 24040a708f8fSGustavo F. Padovan status = L2CAP_CS_AUTHEN_PEND; 24050a708f8fSGustavo F. Padovan } 24060a708f8fSGustavo F. Padovan } else { 240789bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT2); 24080a708f8fSGustavo F. Padovan result = L2CAP_CR_PEND; 24090a708f8fSGustavo F. Padovan status = L2CAP_CS_NO_INFO; 24100a708f8fSGustavo F. Padovan } 24110a708f8fSGustavo F. Padovan 2412baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 24130a708f8fSGustavo F. Padovan 24140a708f8fSGustavo F. Padovan response: 24150a708f8fSGustavo F. Padovan bh_unlock_sock(parent); 24160a708f8fSGustavo F. Padovan 24170a708f8fSGustavo F. Padovan sendresp: 24180a708f8fSGustavo F. Padovan rsp.scid = cpu_to_le16(scid); 24190a708f8fSGustavo F. Padovan rsp.dcid = cpu_to_le16(dcid); 24200a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(result); 24210a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(status); 24220a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 24230a708f8fSGustavo F. Padovan 24240a708f8fSGustavo F. Padovan if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 24250a708f8fSGustavo F. Padovan struct l2cap_info_req info; 24260a708f8fSGustavo F. Padovan info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 24270a708f8fSGustavo F. Padovan 24280a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 24290a708f8fSGustavo F. Padovan conn->info_ident = l2cap_get_ident(conn); 24300a708f8fSGustavo F. Padovan 24310a708f8fSGustavo F. Padovan mod_timer(&conn->info_timer, jiffies + 24320a708f8fSGustavo F. Padovan msecs_to_jiffies(L2CAP_INFO_TIMEOUT)); 24330a708f8fSGustavo F. Padovan 24340a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, conn->info_ident, 24350a708f8fSGustavo F. Padovan L2CAP_INFO_REQ, sizeof(info), &info); 24360a708f8fSGustavo F. Padovan } 24370a708f8fSGustavo F. Padovan 2438c1360a1cSGustavo F. Padovan if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 24390a708f8fSGustavo F. Padovan result == L2CAP_CR_SUCCESS) { 24400a708f8fSGustavo F. Padovan u8 buf[128]; 2441c1360a1cSGustavo F. Padovan set_bit(CONF_REQ_SENT, &chan->conf_state); 24420a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 244373ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 244473ffa904SGustavo F. Padovan chan->num_conf_req++; 24450a708f8fSGustavo F. Padovan } 24460a708f8fSGustavo F. Padovan 24470a708f8fSGustavo F. Padovan return 0; 24480a708f8fSGustavo F. Padovan } 24490a708f8fSGustavo F. Padovan 24500a708f8fSGustavo F. Padovan static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 24510a708f8fSGustavo F. Padovan { 24520a708f8fSGustavo F. Padovan struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 24530a708f8fSGustavo F. Padovan u16 scid, dcid, result, status; 245448454079SGustavo F. Padovan struct l2cap_chan *chan; 24550a708f8fSGustavo F. Padovan struct sock *sk; 24560a708f8fSGustavo F. Padovan u8 req[128]; 24570a708f8fSGustavo F. Padovan 24580a708f8fSGustavo F. Padovan scid = __le16_to_cpu(rsp->scid); 24590a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(rsp->dcid); 24600a708f8fSGustavo F. Padovan result = __le16_to_cpu(rsp->result); 24610a708f8fSGustavo F. Padovan status = __le16_to_cpu(rsp->status); 24620a708f8fSGustavo F. Padovan 24630a708f8fSGustavo F. Padovan BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status); 24640a708f8fSGustavo F. Padovan 24650a708f8fSGustavo F. Padovan if (scid) { 2466baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, scid); 246748454079SGustavo F. Padovan if (!chan) 24680a708f8fSGustavo F. Padovan return -EFAULT; 24690a708f8fSGustavo F. Padovan } else { 2470baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_ident(conn, cmd->ident); 247148454079SGustavo F. Padovan if (!chan) 24720a708f8fSGustavo F. Padovan return -EFAULT; 24730a708f8fSGustavo F. Padovan } 24740a708f8fSGustavo F. Padovan 247548454079SGustavo F. Padovan sk = chan->sk; 247648454079SGustavo F. Padovan 24770a708f8fSGustavo F. Padovan switch (result) { 24780a708f8fSGustavo F. Padovan case L2CAP_CR_SUCCESS: 247989bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 2480fc7f8a7eSGustavo F. Padovan chan->ident = 0; 2481fe4128e0SGustavo F. Padovan chan->dcid = dcid; 2482c1360a1cSGustavo F. Padovan clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 24830a708f8fSGustavo F. Padovan 2484c1360a1cSGustavo F. Padovan if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 24850a708f8fSGustavo F. Padovan break; 24860a708f8fSGustavo F. Padovan 24870a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 248873ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, req), req); 248973ffa904SGustavo F. Padovan chan->num_conf_req++; 24900a708f8fSGustavo F. Padovan break; 24910a708f8fSGustavo F. Padovan 24920a708f8fSGustavo F. Padovan case L2CAP_CR_PEND: 2493c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 24940a708f8fSGustavo F. Padovan break; 24950a708f8fSGustavo F. Padovan 24960a708f8fSGustavo F. Padovan default: 24970a708f8fSGustavo F. Padovan /* don't delete l2cap channel if sk is owned by user */ 24980a708f8fSGustavo F. Padovan if (sock_owned_by_user(sk)) { 249989bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 2500c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 2501f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 25020a708f8fSGustavo F. Padovan break; 25030a708f8fSGustavo F. Padovan } 25040a708f8fSGustavo F. Padovan 250548454079SGustavo F. Padovan l2cap_chan_del(chan, ECONNREFUSED); 25060a708f8fSGustavo F. Padovan break; 25070a708f8fSGustavo F. Padovan } 25080a708f8fSGustavo F. Padovan 25090a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 25100a708f8fSGustavo F. Padovan return 0; 25110a708f8fSGustavo F. Padovan } 25120a708f8fSGustavo F. Padovan 251347d1ec61SGustavo F. Padovan static inline void set_default_fcs(struct l2cap_chan *chan) 25140a708f8fSGustavo F. Padovan { 25150a708f8fSGustavo F. Padovan /* FCS is enabled only in ERTM or streaming mode, if one or both 25160a708f8fSGustavo F. Padovan * sides request it. 25170a708f8fSGustavo F. Padovan */ 25180c1bc5c6SGustavo F. Padovan if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 251947d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 2520c1360a1cSGustavo F. Padovan else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) 252147d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_CRC16; 25220a708f8fSGustavo F. Padovan } 25230a708f8fSGustavo F. Padovan 25240a708f8fSGustavo F. Padovan static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 25250a708f8fSGustavo F. Padovan { 25260a708f8fSGustavo F. Padovan struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 25270a708f8fSGustavo F. Padovan u16 dcid, flags; 25280a708f8fSGustavo F. Padovan u8 rsp[64]; 252948454079SGustavo F. Padovan struct l2cap_chan *chan; 25300a708f8fSGustavo F. Padovan struct sock *sk; 25310a708f8fSGustavo F. Padovan int len; 25320a708f8fSGustavo F. Padovan 25330a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(req->dcid); 25340a708f8fSGustavo F. Padovan flags = __le16_to_cpu(req->flags); 25350a708f8fSGustavo F. Padovan 25360a708f8fSGustavo F. Padovan BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 25370a708f8fSGustavo F. Padovan 2538baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, dcid); 253948454079SGustavo F. Padovan if (!chan) 25400a708f8fSGustavo F. Padovan return -ENOENT; 25410a708f8fSGustavo F. Padovan 254248454079SGustavo F. Padovan sk = chan->sk; 254348454079SGustavo F. Padovan 2544033b1142SDavid S. Miller if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) { 2545e2fd318eSIlia Kolomisnky struct l2cap_cmd_rej_cid rej; 25460a708f8fSGustavo F. Padovan 2547e2fd318eSIlia Kolomisnky rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 2548e2fd318eSIlia Kolomisnky rej.scid = cpu_to_le16(chan->scid); 2549e2fd318eSIlia Kolomisnky rej.dcid = cpu_to_le16(chan->dcid); 2550e2fd318eSIlia Kolomisnky 25510a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 25520a708f8fSGustavo F. Padovan sizeof(rej), &rej); 25530a708f8fSGustavo F. Padovan goto unlock; 25540a708f8fSGustavo F. Padovan } 25550a708f8fSGustavo F. Padovan 25560a708f8fSGustavo F. Padovan /* Reject if config buffer is too small. */ 25570a708f8fSGustavo F. Padovan len = cmd_len - sizeof(*req); 25587ac28817SDan Rosenberg if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) { 25590a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 2560fe4128e0SGustavo F. Padovan l2cap_build_conf_rsp(chan, rsp, 25610a708f8fSGustavo F. Padovan L2CAP_CONF_REJECT, flags), rsp); 25620a708f8fSGustavo F. Padovan goto unlock; 25630a708f8fSGustavo F. Padovan } 25640a708f8fSGustavo F. Padovan 25650a708f8fSGustavo F. Padovan /* Store config. */ 256673ffa904SGustavo F. Padovan memcpy(chan->conf_req + chan->conf_len, req->data, len); 256773ffa904SGustavo F. Padovan chan->conf_len += len; 25680a708f8fSGustavo F. Padovan 25690a708f8fSGustavo F. Padovan if (flags & 0x0001) { 25700a708f8fSGustavo F. Padovan /* Incomplete config. Send empty response. */ 25710a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 2572fe4128e0SGustavo F. Padovan l2cap_build_conf_rsp(chan, rsp, 25730a708f8fSGustavo F. Padovan L2CAP_CONF_SUCCESS, 0x0001), rsp); 25740a708f8fSGustavo F. Padovan goto unlock; 25750a708f8fSGustavo F. Padovan } 25760a708f8fSGustavo F. Padovan 25770a708f8fSGustavo F. Padovan /* Complete config. */ 257873ffa904SGustavo F. Padovan len = l2cap_parse_conf_req(chan, rsp); 25790a708f8fSGustavo F. Padovan if (len < 0) { 2580e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 25810a708f8fSGustavo F. Padovan goto unlock; 25820a708f8fSGustavo F. Padovan } 25830a708f8fSGustavo F. Padovan 25840a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 258573ffa904SGustavo F. Padovan chan->num_conf_rsp++; 25860a708f8fSGustavo F. Padovan 25870a708f8fSGustavo F. Padovan /* Reset config buffer. */ 258873ffa904SGustavo F. Padovan chan->conf_len = 0; 25890a708f8fSGustavo F. Padovan 2590c1360a1cSGustavo F. Padovan if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 25910a708f8fSGustavo F. Padovan goto unlock; 25920a708f8fSGustavo F. Padovan 2593c1360a1cSGustavo F. Padovan if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 259447d1ec61SGustavo F. Padovan set_default_fcs(chan); 25950a708f8fSGustavo F. Padovan 259689bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 25970a708f8fSGustavo F. Padovan 259842e5c802SGustavo F. Padovan chan->next_tx_seq = 0; 259942e5c802SGustavo F. Padovan chan->expected_tx_seq = 0; 260058d35f87SGustavo F. Padovan skb_queue_head_init(&chan->tx_q); 26010c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) 2602525cd185SGustavo F. Padovan l2cap_ertm_init(chan); 26030a708f8fSGustavo F. Padovan 26040a708f8fSGustavo F. Padovan l2cap_chan_ready(sk); 26050a708f8fSGustavo F. Padovan goto unlock; 26060a708f8fSGustavo F. Padovan } 26070a708f8fSGustavo F. Padovan 2608c1360a1cSGustavo F. Padovan if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 26090a708f8fSGustavo F. Padovan u8 buf[64]; 26100a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 261173ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 261273ffa904SGustavo F. Padovan chan->num_conf_req++; 26130a708f8fSGustavo F. Padovan } 26140a708f8fSGustavo F. Padovan 26150a708f8fSGustavo F. Padovan unlock: 26160a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 26170a708f8fSGustavo F. Padovan return 0; 26180a708f8fSGustavo F. Padovan } 26190a708f8fSGustavo F. Padovan 26200a708f8fSGustavo F. Padovan static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 26210a708f8fSGustavo F. Padovan { 26220a708f8fSGustavo F. Padovan struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 26230a708f8fSGustavo F. Padovan u16 scid, flags, result; 262448454079SGustavo F. Padovan struct l2cap_chan *chan; 26250a708f8fSGustavo F. Padovan struct sock *sk; 26260a708f8fSGustavo F. Padovan int len = cmd->len - sizeof(*rsp); 26270a708f8fSGustavo F. Padovan 26280a708f8fSGustavo F. Padovan scid = __le16_to_cpu(rsp->scid); 26290a708f8fSGustavo F. Padovan flags = __le16_to_cpu(rsp->flags); 26300a708f8fSGustavo F. Padovan result = __le16_to_cpu(rsp->result); 26310a708f8fSGustavo F. Padovan 26320a708f8fSGustavo F. Padovan BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", 26330a708f8fSGustavo F. Padovan scid, flags, result); 26340a708f8fSGustavo F. Padovan 2635baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, scid); 263648454079SGustavo F. Padovan if (!chan) 26370a708f8fSGustavo F. Padovan return 0; 26380a708f8fSGustavo F. Padovan 263948454079SGustavo F. Padovan sk = chan->sk; 264048454079SGustavo F. Padovan 26410a708f8fSGustavo F. Padovan switch (result) { 26420a708f8fSGustavo F. Padovan case L2CAP_CONF_SUCCESS: 264347d1ec61SGustavo F. Padovan l2cap_conf_rfc_get(chan, rsp->data, len); 26440a708f8fSGustavo F. Padovan break; 26450a708f8fSGustavo F. Padovan 26460a708f8fSGustavo F. Padovan case L2CAP_CONF_UNACCEPT: 264773ffa904SGustavo F. Padovan if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 26480a708f8fSGustavo F. Padovan char req[64]; 26490a708f8fSGustavo F. Padovan 26500a708f8fSGustavo F. Padovan if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 2651e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 26520a708f8fSGustavo F. Padovan goto done; 26530a708f8fSGustavo F. Padovan } 26540a708f8fSGustavo F. Padovan 26550a708f8fSGustavo F. Padovan /* throw out any old stored conf requests */ 26560a708f8fSGustavo F. Padovan result = L2CAP_CONF_SUCCESS; 2657b4450035SGustavo F. Padovan len = l2cap_parse_conf_rsp(chan, rsp->data, len, 2658b4450035SGustavo F. Padovan req, &result); 26590a708f8fSGustavo F. Padovan if (len < 0) { 2660e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 26610a708f8fSGustavo F. Padovan goto done; 26620a708f8fSGustavo F. Padovan } 26630a708f8fSGustavo F. Padovan 26640a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), 26650a708f8fSGustavo F. Padovan L2CAP_CONF_REQ, len, req); 266673ffa904SGustavo F. Padovan chan->num_conf_req++; 26670a708f8fSGustavo F. Padovan if (result != L2CAP_CONF_SUCCESS) 26680a708f8fSGustavo F. Padovan goto done; 26690a708f8fSGustavo F. Padovan break; 26700a708f8fSGustavo F. Padovan } 26710a708f8fSGustavo F. Padovan 26720a708f8fSGustavo F. Padovan default: 26730a708f8fSGustavo F. Padovan sk->sk_err = ECONNRESET; 2674f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_REJ_TIMEOUT); 2675e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 26760a708f8fSGustavo F. Padovan goto done; 26770a708f8fSGustavo F. Padovan } 26780a708f8fSGustavo F. Padovan 26790a708f8fSGustavo F. Padovan if (flags & 0x01) 26800a708f8fSGustavo F. Padovan goto done; 26810a708f8fSGustavo F. Padovan 2682c1360a1cSGustavo F. Padovan set_bit(CONF_INPUT_DONE, &chan->conf_state); 26830a708f8fSGustavo F. Padovan 2684c1360a1cSGustavo F. Padovan if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 268547d1ec61SGustavo F. Padovan set_default_fcs(chan); 26860a708f8fSGustavo F. Padovan 268789bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 268842e5c802SGustavo F. Padovan chan->next_tx_seq = 0; 268942e5c802SGustavo F. Padovan chan->expected_tx_seq = 0; 269058d35f87SGustavo F. Padovan skb_queue_head_init(&chan->tx_q); 26910c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) 2692525cd185SGustavo F. Padovan l2cap_ertm_init(chan); 26930a708f8fSGustavo F. Padovan 26940a708f8fSGustavo F. Padovan l2cap_chan_ready(sk); 26950a708f8fSGustavo F. Padovan } 26960a708f8fSGustavo F. Padovan 26970a708f8fSGustavo F. Padovan done: 26980a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 26990a708f8fSGustavo F. Padovan return 0; 27000a708f8fSGustavo F. Padovan } 27010a708f8fSGustavo F. Padovan 27020a708f8fSGustavo F. Padovan static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 27030a708f8fSGustavo F. Padovan { 27040a708f8fSGustavo F. Padovan struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 27050a708f8fSGustavo F. Padovan struct l2cap_disconn_rsp rsp; 27060a708f8fSGustavo F. Padovan u16 dcid, scid; 270748454079SGustavo F. Padovan struct l2cap_chan *chan; 27080a708f8fSGustavo F. Padovan struct sock *sk; 27090a708f8fSGustavo F. Padovan 27100a708f8fSGustavo F. Padovan scid = __le16_to_cpu(req->scid); 27110a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(req->dcid); 27120a708f8fSGustavo F. Padovan 27130a708f8fSGustavo F. Padovan BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 27140a708f8fSGustavo F. Padovan 2715baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, dcid); 271648454079SGustavo F. Padovan if (!chan) 27170a708f8fSGustavo F. Padovan return 0; 27180a708f8fSGustavo F. Padovan 271948454079SGustavo F. Padovan sk = chan->sk; 272048454079SGustavo F. Padovan 2721fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 2722fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 27230a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 27240a708f8fSGustavo F. Padovan 27250a708f8fSGustavo F. Padovan sk->sk_shutdown = SHUTDOWN_MASK; 27260a708f8fSGustavo F. Padovan 27270a708f8fSGustavo F. Padovan /* don't delete l2cap channel if sk is owned by user */ 27280a708f8fSGustavo F. Padovan if (sock_owned_by_user(sk)) { 272989bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 2730c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 2731f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 27320a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27330a708f8fSGustavo F. Padovan return 0; 27340a708f8fSGustavo F. Padovan } 27350a708f8fSGustavo F. Padovan 273648454079SGustavo F. Padovan l2cap_chan_del(chan, ECONNRESET); 27370a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27380a708f8fSGustavo F. Padovan 2739ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 27400a708f8fSGustavo F. Padovan return 0; 27410a708f8fSGustavo F. Padovan } 27420a708f8fSGustavo F. Padovan 27430a708f8fSGustavo F. Padovan static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 27440a708f8fSGustavo F. Padovan { 27450a708f8fSGustavo F. Padovan struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 27460a708f8fSGustavo F. Padovan u16 dcid, scid; 274748454079SGustavo F. Padovan struct l2cap_chan *chan; 27480a708f8fSGustavo F. Padovan struct sock *sk; 27490a708f8fSGustavo F. Padovan 27500a708f8fSGustavo F. Padovan scid = __le16_to_cpu(rsp->scid); 27510a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(rsp->dcid); 27520a708f8fSGustavo F. Padovan 27530a708f8fSGustavo F. Padovan BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 27540a708f8fSGustavo F. Padovan 2755baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, scid); 275648454079SGustavo F. Padovan if (!chan) 27570a708f8fSGustavo F. Padovan return 0; 27580a708f8fSGustavo F. Padovan 275948454079SGustavo F. Padovan sk = chan->sk; 276048454079SGustavo F. Padovan 27610a708f8fSGustavo F. Padovan /* don't delete l2cap channel if sk is owned by user */ 27620a708f8fSGustavo F. Padovan if (sock_owned_by_user(sk)) { 276389bc500eSGustavo F. Padovan l2cap_state_change(chan,BT_DISCONN); 2764c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 2765f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 27660a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27670a708f8fSGustavo F. Padovan return 0; 27680a708f8fSGustavo F. Padovan } 27690a708f8fSGustavo F. Padovan 277048454079SGustavo F. Padovan l2cap_chan_del(chan, 0); 27710a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27720a708f8fSGustavo F. Padovan 2773ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 27740a708f8fSGustavo F. Padovan return 0; 27750a708f8fSGustavo F. Padovan } 27760a708f8fSGustavo F. Padovan 27770a708f8fSGustavo F. Padovan static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 27780a708f8fSGustavo F. Padovan { 27790a708f8fSGustavo F. Padovan struct l2cap_info_req *req = (struct l2cap_info_req *) data; 27800a708f8fSGustavo F. Padovan u16 type; 27810a708f8fSGustavo F. Padovan 27820a708f8fSGustavo F. Padovan type = __le16_to_cpu(req->type); 27830a708f8fSGustavo F. Padovan 27840a708f8fSGustavo F. Padovan BT_DBG("type 0x%4.4x", type); 27850a708f8fSGustavo F. Padovan 27860a708f8fSGustavo F. Padovan if (type == L2CAP_IT_FEAT_MASK) { 27870a708f8fSGustavo F. Padovan u8 buf[8]; 27880a708f8fSGustavo F. Padovan u32 feat_mask = l2cap_feat_mask; 27890a708f8fSGustavo F. Padovan struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 27900a708f8fSGustavo F. Padovan rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 27910a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 27920a708f8fSGustavo F. Padovan if (!disable_ertm) 27930a708f8fSGustavo F. Padovan feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 27940a708f8fSGustavo F. Padovan | L2CAP_FEAT_FCS; 27950a708f8fSGustavo F. Padovan put_unaligned_le32(feat_mask, rsp->data); 27960a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, 27970a708f8fSGustavo F. Padovan L2CAP_INFO_RSP, sizeof(buf), buf); 27980a708f8fSGustavo F. Padovan } else if (type == L2CAP_IT_FIXED_CHAN) { 27990a708f8fSGustavo F. Padovan u8 buf[12]; 28000a708f8fSGustavo F. Padovan struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 28010a708f8fSGustavo F. Padovan rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 28020a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 28030a708f8fSGustavo F. Padovan memcpy(buf + 4, l2cap_fixed_chan, 8); 28040a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, 28050a708f8fSGustavo F. Padovan L2CAP_INFO_RSP, sizeof(buf), buf); 28060a708f8fSGustavo F. Padovan } else { 28070a708f8fSGustavo F. Padovan struct l2cap_info_rsp rsp; 28080a708f8fSGustavo F. Padovan rsp.type = cpu_to_le16(type); 28090a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 28100a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, 28110a708f8fSGustavo F. Padovan L2CAP_INFO_RSP, sizeof(rsp), &rsp); 28120a708f8fSGustavo F. Padovan } 28130a708f8fSGustavo F. Padovan 28140a708f8fSGustavo F. Padovan return 0; 28150a708f8fSGustavo F. Padovan } 28160a708f8fSGustavo F. Padovan 28170a708f8fSGustavo F. Padovan static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 28180a708f8fSGustavo F. Padovan { 28190a708f8fSGustavo F. Padovan struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 28200a708f8fSGustavo F. Padovan u16 type, result; 28210a708f8fSGustavo F. Padovan 28220a708f8fSGustavo F. Padovan type = __le16_to_cpu(rsp->type); 28230a708f8fSGustavo F. Padovan result = __le16_to_cpu(rsp->result); 28240a708f8fSGustavo F. Padovan 28250a708f8fSGustavo F. Padovan BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 28260a708f8fSGustavo F. Padovan 2827e90165beSAndrei Emeltchenko /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 2828e90165beSAndrei Emeltchenko if (cmd->ident != conn->info_ident || 2829e90165beSAndrei Emeltchenko conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 2830e90165beSAndrei Emeltchenko return 0; 2831e90165beSAndrei Emeltchenko 28320a708f8fSGustavo F. Padovan del_timer(&conn->info_timer); 28330a708f8fSGustavo F. Padovan 28340a708f8fSGustavo F. Padovan if (result != L2CAP_IR_SUCCESS) { 28350a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 28360a708f8fSGustavo F. Padovan conn->info_ident = 0; 28370a708f8fSGustavo F. Padovan 28380a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 28390a708f8fSGustavo F. Padovan 28400a708f8fSGustavo F. Padovan return 0; 28410a708f8fSGustavo F. Padovan } 28420a708f8fSGustavo F. Padovan 28430a708f8fSGustavo F. Padovan if (type == L2CAP_IT_FEAT_MASK) { 28440a708f8fSGustavo F. Padovan conn->feat_mask = get_unaligned_le32(rsp->data); 28450a708f8fSGustavo F. Padovan 28460a708f8fSGustavo F. Padovan if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 28470a708f8fSGustavo F. Padovan struct l2cap_info_req req; 28480a708f8fSGustavo F. Padovan req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 28490a708f8fSGustavo F. Padovan 28500a708f8fSGustavo F. Padovan conn->info_ident = l2cap_get_ident(conn); 28510a708f8fSGustavo F. Padovan 28520a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, conn->info_ident, 28530a708f8fSGustavo F. Padovan L2CAP_INFO_REQ, sizeof(req), &req); 28540a708f8fSGustavo F. Padovan } else { 28550a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 28560a708f8fSGustavo F. Padovan conn->info_ident = 0; 28570a708f8fSGustavo F. Padovan 28580a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 28590a708f8fSGustavo F. Padovan } 28600a708f8fSGustavo F. Padovan } else if (type == L2CAP_IT_FIXED_CHAN) { 28610a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 28620a708f8fSGustavo F. Padovan conn->info_ident = 0; 28630a708f8fSGustavo F. Padovan 28640a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 28650a708f8fSGustavo F. Padovan } 28660a708f8fSGustavo F. Padovan 28670a708f8fSGustavo F. Padovan return 0; 28680a708f8fSGustavo F. Padovan } 28690a708f8fSGustavo F. Padovan 2870e2174ca4SGustavo F. Padovan static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency, 2871de73115aSClaudio Takahasi u16 to_multiplier) 2872de73115aSClaudio Takahasi { 2873de73115aSClaudio Takahasi u16 max_latency; 2874de73115aSClaudio Takahasi 2875de73115aSClaudio Takahasi if (min > max || min < 6 || max > 3200) 2876de73115aSClaudio Takahasi return -EINVAL; 2877de73115aSClaudio Takahasi 2878de73115aSClaudio Takahasi if (to_multiplier < 10 || to_multiplier > 3200) 2879de73115aSClaudio Takahasi return -EINVAL; 2880de73115aSClaudio Takahasi 2881de73115aSClaudio Takahasi if (max >= to_multiplier * 8) 2882de73115aSClaudio Takahasi return -EINVAL; 2883de73115aSClaudio Takahasi 2884de73115aSClaudio Takahasi max_latency = (to_multiplier * 8 / max) - 1; 2885de73115aSClaudio Takahasi if (latency > 499 || latency > max_latency) 2886de73115aSClaudio Takahasi return -EINVAL; 2887de73115aSClaudio Takahasi 2888de73115aSClaudio Takahasi return 0; 2889de73115aSClaudio Takahasi } 2890de73115aSClaudio Takahasi 2891de73115aSClaudio Takahasi static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 2892de73115aSClaudio Takahasi struct l2cap_cmd_hdr *cmd, u8 *data) 2893de73115aSClaudio Takahasi { 2894de73115aSClaudio Takahasi struct hci_conn *hcon = conn->hcon; 2895de73115aSClaudio Takahasi struct l2cap_conn_param_update_req *req; 2896de73115aSClaudio Takahasi struct l2cap_conn_param_update_rsp rsp; 2897de73115aSClaudio Takahasi u16 min, max, latency, to_multiplier, cmd_len; 28982ce603ebSClaudio Takahasi int err; 2899de73115aSClaudio Takahasi 2900de73115aSClaudio Takahasi if (!(hcon->link_mode & HCI_LM_MASTER)) 2901de73115aSClaudio Takahasi return -EINVAL; 2902de73115aSClaudio Takahasi 2903de73115aSClaudio Takahasi cmd_len = __le16_to_cpu(cmd->len); 2904de73115aSClaudio Takahasi if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 2905de73115aSClaudio Takahasi return -EPROTO; 2906de73115aSClaudio Takahasi 2907de73115aSClaudio Takahasi req = (struct l2cap_conn_param_update_req *) data; 2908de73115aSClaudio Takahasi min = __le16_to_cpu(req->min); 2909de73115aSClaudio Takahasi max = __le16_to_cpu(req->max); 2910de73115aSClaudio Takahasi latency = __le16_to_cpu(req->latency); 2911de73115aSClaudio Takahasi to_multiplier = __le16_to_cpu(req->to_multiplier); 2912de73115aSClaudio Takahasi 2913de73115aSClaudio Takahasi BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 2914de73115aSClaudio Takahasi min, max, latency, to_multiplier); 2915de73115aSClaudio Takahasi 2916de73115aSClaudio Takahasi memset(&rsp, 0, sizeof(rsp)); 29172ce603ebSClaudio Takahasi 29182ce603ebSClaudio Takahasi err = l2cap_check_conn_param(min, max, latency, to_multiplier); 29192ce603ebSClaudio Takahasi if (err) 2920de73115aSClaudio Takahasi rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 2921de73115aSClaudio Takahasi else 2922de73115aSClaudio Takahasi rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 2923de73115aSClaudio Takahasi 2924de73115aSClaudio Takahasi l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 2925de73115aSClaudio Takahasi sizeof(rsp), &rsp); 2926de73115aSClaudio Takahasi 29272ce603ebSClaudio Takahasi if (!err) 29282ce603ebSClaudio Takahasi hci_le_conn_update(hcon, min, max, latency, to_multiplier); 29292ce603ebSClaudio Takahasi 2930de73115aSClaudio Takahasi return 0; 2931de73115aSClaudio Takahasi } 2932de73115aSClaudio Takahasi 29333300d9a9SClaudio Takahasi static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 29343300d9a9SClaudio Takahasi struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 29353300d9a9SClaudio Takahasi { 29363300d9a9SClaudio Takahasi int err = 0; 29373300d9a9SClaudio Takahasi 29383300d9a9SClaudio Takahasi switch (cmd->code) { 29393300d9a9SClaudio Takahasi case L2CAP_COMMAND_REJ: 29403300d9a9SClaudio Takahasi l2cap_command_rej(conn, cmd, data); 29413300d9a9SClaudio Takahasi break; 29423300d9a9SClaudio Takahasi 29433300d9a9SClaudio Takahasi case L2CAP_CONN_REQ: 29443300d9a9SClaudio Takahasi err = l2cap_connect_req(conn, cmd, data); 29453300d9a9SClaudio Takahasi break; 29463300d9a9SClaudio Takahasi 29473300d9a9SClaudio Takahasi case L2CAP_CONN_RSP: 29483300d9a9SClaudio Takahasi err = l2cap_connect_rsp(conn, cmd, data); 29493300d9a9SClaudio Takahasi break; 29503300d9a9SClaudio Takahasi 29513300d9a9SClaudio Takahasi case L2CAP_CONF_REQ: 29523300d9a9SClaudio Takahasi err = l2cap_config_req(conn, cmd, cmd_len, data); 29533300d9a9SClaudio Takahasi break; 29543300d9a9SClaudio Takahasi 29553300d9a9SClaudio Takahasi case L2CAP_CONF_RSP: 29563300d9a9SClaudio Takahasi err = l2cap_config_rsp(conn, cmd, data); 29573300d9a9SClaudio Takahasi break; 29583300d9a9SClaudio Takahasi 29593300d9a9SClaudio Takahasi case L2CAP_DISCONN_REQ: 29603300d9a9SClaudio Takahasi err = l2cap_disconnect_req(conn, cmd, data); 29613300d9a9SClaudio Takahasi break; 29623300d9a9SClaudio Takahasi 29633300d9a9SClaudio Takahasi case L2CAP_DISCONN_RSP: 29643300d9a9SClaudio Takahasi err = l2cap_disconnect_rsp(conn, cmd, data); 29653300d9a9SClaudio Takahasi break; 29663300d9a9SClaudio Takahasi 29673300d9a9SClaudio Takahasi case L2CAP_ECHO_REQ: 29683300d9a9SClaudio Takahasi l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 29693300d9a9SClaudio Takahasi break; 29703300d9a9SClaudio Takahasi 29713300d9a9SClaudio Takahasi case L2CAP_ECHO_RSP: 29723300d9a9SClaudio Takahasi break; 29733300d9a9SClaudio Takahasi 29743300d9a9SClaudio Takahasi case L2CAP_INFO_REQ: 29753300d9a9SClaudio Takahasi err = l2cap_information_req(conn, cmd, data); 29763300d9a9SClaudio Takahasi break; 29773300d9a9SClaudio Takahasi 29783300d9a9SClaudio Takahasi case L2CAP_INFO_RSP: 29793300d9a9SClaudio Takahasi err = l2cap_information_rsp(conn, cmd, data); 29803300d9a9SClaudio Takahasi break; 29813300d9a9SClaudio Takahasi 29823300d9a9SClaudio Takahasi default: 29833300d9a9SClaudio Takahasi BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 29843300d9a9SClaudio Takahasi err = -EINVAL; 29853300d9a9SClaudio Takahasi break; 29863300d9a9SClaudio Takahasi } 29873300d9a9SClaudio Takahasi 29883300d9a9SClaudio Takahasi return err; 29893300d9a9SClaudio Takahasi } 29903300d9a9SClaudio Takahasi 29913300d9a9SClaudio Takahasi static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 29923300d9a9SClaudio Takahasi struct l2cap_cmd_hdr *cmd, u8 *data) 29933300d9a9SClaudio Takahasi { 29943300d9a9SClaudio Takahasi switch (cmd->code) { 29953300d9a9SClaudio Takahasi case L2CAP_COMMAND_REJ: 29963300d9a9SClaudio Takahasi return 0; 29973300d9a9SClaudio Takahasi 29983300d9a9SClaudio Takahasi case L2CAP_CONN_PARAM_UPDATE_REQ: 2999de73115aSClaudio Takahasi return l2cap_conn_param_update_req(conn, cmd, data); 30003300d9a9SClaudio Takahasi 30013300d9a9SClaudio Takahasi case L2CAP_CONN_PARAM_UPDATE_RSP: 30023300d9a9SClaudio Takahasi return 0; 30033300d9a9SClaudio Takahasi 30043300d9a9SClaudio Takahasi default: 30053300d9a9SClaudio Takahasi BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 30063300d9a9SClaudio Takahasi return -EINVAL; 30073300d9a9SClaudio Takahasi } 30083300d9a9SClaudio Takahasi } 30093300d9a9SClaudio Takahasi 30103300d9a9SClaudio Takahasi static inline void l2cap_sig_channel(struct l2cap_conn *conn, 30113300d9a9SClaudio Takahasi struct sk_buff *skb) 30120a708f8fSGustavo F. Padovan { 30130a708f8fSGustavo F. Padovan u8 *data = skb->data; 30140a708f8fSGustavo F. Padovan int len = skb->len; 30150a708f8fSGustavo F. Padovan struct l2cap_cmd_hdr cmd; 30163300d9a9SClaudio Takahasi int err; 30170a708f8fSGustavo F. Padovan 30180a708f8fSGustavo F. Padovan l2cap_raw_recv(conn, skb); 30190a708f8fSGustavo F. Padovan 30200a708f8fSGustavo F. Padovan while (len >= L2CAP_CMD_HDR_SIZE) { 30210a708f8fSGustavo F. Padovan u16 cmd_len; 30220a708f8fSGustavo F. Padovan memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE); 30230a708f8fSGustavo F. Padovan data += L2CAP_CMD_HDR_SIZE; 30240a708f8fSGustavo F. Padovan len -= L2CAP_CMD_HDR_SIZE; 30250a708f8fSGustavo F. Padovan 30260a708f8fSGustavo F. Padovan cmd_len = le16_to_cpu(cmd.len); 30270a708f8fSGustavo F. Padovan 30280a708f8fSGustavo F. Padovan BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident); 30290a708f8fSGustavo F. Padovan 30300a708f8fSGustavo F. Padovan if (cmd_len > len || !cmd.ident) { 30310a708f8fSGustavo F. Padovan BT_DBG("corrupted command"); 30320a708f8fSGustavo F. Padovan break; 30330a708f8fSGustavo F. Padovan } 30340a708f8fSGustavo F. Padovan 30353300d9a9SClaudio Takahasi if (conn->hcon->type == LE_LINK) 30363300d9a9SClaudio Takahasi err = l2cap_le_sig_cmd(conn, &cmd, data); 30373300d9a9SClaudio Takahasi else 30383300d9a9SClaudio Takahasi err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data); 30390a708f8fSGustavo F. Padovan 30400a708f8fSGustavo F. Padovan if (err) { 3041e2fd318eSIlia Kolomisnky struct l2cap_cmd_rej_unk rej; 30422c6d1a2eSGustavo F. Padovan 30432c6d1a2eSGustavo F. Padovan BT_ERR("Wrong link type (%d)", err); 30440a708f8fSGustavo F. Padovan 30450a708f8fSGustavo F. Padovan /* FIXME: Map err to a valid reason */ 3046e2fd318eSIlia Kolomisnky rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 30470a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 30480a708f8fSGustavo F. Padovan } 30490a708f8fSGustavo F. Padovan 30500a708f8fSGustavo F. Padovan data += cmd_len; 30510a708f8fSGustavo F. Padovan len -= cmd_len; 30520a708f8fSGustavo F. Padovan } 30530a708f8fSGustavo F. Padovan 30540a708f8fSGustavo F. Padovan kfree_skb(skb); 30550a708f8fSGustavo F. Padovan } 30560a708f8fSGustavo F. Padovan 305747d1ec61SGustavo F. Padovan static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 30580a708f8fSGustavo F. Padovan { 30590a708f8fSGustavo F. Padovan u16 our_fcs, rcv_fcs; 30600a708f8fSGustavo F. Padovan int hdr_size = L2CAP_HDR_SIZE + 2; 30610a708f8fSGustavo F. Padovan 306247d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 30630a708f8fSGustavo F. Padovan skb_trim(skb, skb->len - 2); 30640a708f8fSGustavo F. Padovan rcv_fcs = get_unaligned_le16(skb->data + skb->len); 30650a708f8fSGustavo F. Padovan our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 30660a708f8fSGustavo F. Padovan 30670a708f8fSGustavo F. Padovan if (our_fcs != rcv_fcs) 30680a708f8fSGustavo F. Padovan return -EBADMSG; 30690a708f8fSGustavo F. Padovan } 30700a708f8fSGustavo F. Padovan return 0; 30710a708f8fSGustavo F. Padovan } 30720a708f8fSGustavo F. Padovan 3073525cd185SGustavo F. Padovan static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 30740a708f8fSGustavo F. Padovan { 30750a708f8fSGustavo F. Padovan u16 control = 0; 30760a708f8fSGustavo F. Padovan 30776a026610SGustavo F. Padovan chan->frames_sent = 0; 30780a708f8fSGustavo F. Padovan 307942e5c802SGustavo F. Padovan control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 30800a708f8fSGustavo F. Padovan 3081e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 30820a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_NOT_READY; 3083525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 3084e2ab4353SGustavo F. Padovan set_bit(CONN_RNR_SENT, &chan->conn_state); 30850a708f8fSGustavo F. Padovan } 30860a708f8fSGustavo F. Padovan 3087e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 3088525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 30890a708f8fSGustavo F. Padovan 3090525cd185SGustavo F. Padovan l2cap_ertm_send(chan); 30910a708f8fSGustavo F. Padovan 3092e2ab4353SGustavo F. Padovan if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 30936a026610SGustavo F. Padovan chan->frames_sent == 0) { 30940a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY; 3095525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 30960a708f8fSGustavo F. Padovan } 30970a708f8fSGustavo F. Padovan } 30980a708f8fSGustavo F. Padovan 309942e5c802SGustavo F. Padovan static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u8 tx_seq, u8 sar) 31000a708f8fSGustavo F. Padovan { 31010a708f8fSGustavo F. Padovan struct sk_buff *next_skb; 31020a708f8fSGustavo F. Padovan int tx_seq_offset, next_tx_seq_offset; 31030a708f8fSGustavo F. Padovan 31040a708f8fSGustavo F. Padovan bt_cb(skb)->tx_seq = tx_seq; 31050a708f8fSGustavo F. Padovan bt_cb(skb)->sar = sar; 31060a708f8fSGustavo F. Padovan 3107f1c6775bSGustavo F. Padovan next_skb = skb_peek(&chan->srej_q); 31080a708f8fSGustavo F. Padovan if (!next_skb) { 3109f1c6775bSGustavo F. Padovan __skb_queue_tail(&chan->srej_q, skb); 31100a708f8fSGustavo F. Padovan return 0; 31110a708f8fSGustavo F. Padovan } 31120a708f8fSGustavo F. Padovan 311342e5c802SGustavo F. Padovan tx_seq_offset = (tx_seq - chan->buffer_seq) % 64; 31140a708f8fSGustavo F. Padovan if (tx_seq_offset < 0) 31150a708f8fSGustavo F. Padovan tx_seq_offset += 64; 31160a708f8fSGustavo F. Padovan 31170a708f8fSGustavo F. Padovan do { 31180a708f8fSGustavo F. Padovan if (bt_cb(next_skb)->tx_seq == tx_seq) 31190a708f8fSGustavo F. Padovan return -EINVAL; 31200a708f8fSGustavo F. Padovan 31210a708f8fSGustavo F. Padovan next_tx_seq_offset = (bt_cb(next_skb)->tx_seq - 312242e5c802SGustavo F. Padovan chan->buffer_seq) % 64; 31230a708f8fSGustavo F. Padovan if (next_tx_seq_offset < 0) 31240a708f8fSGustavo F. Padovan next_tx_seq_offset += 64; 31250a708f8fSGustavo F. Padovan 31260a708f8fSGustavo F. Padovan if (next_tx_seq_offset > tx_seq_offset) { 3127f1c6775bSGustavo F. Padovan __skb_queue_before(&chan->srej_q, next_skb, skb); 31280a708f8fSGustavo F. Padovan return 0; 31290a708f8fSGustavo F. Padovan } 31300a708f8fSGustavo F. Padovan 3131f1c6775bSGustavo F. Padovan if (skb_queue_is_last(&chan->srej_q, next_skb)) 31320a708f8fSGustavo F. Padovan break; 31330a708f8fSGustavo F. Padovan 3134f1c6775bSGustavo F. Padovan } while ((next_skb = skb_queue_next(&chan->srej_q, next_skb))); 31350a708f8fSGustavo F. Padovan 3136f1c6775bSGustavo F. Padovan __skb_queue_tail(&chan->srej_q, skb); 31370a708f8fSGustavo F. Padovan 31380a708f8fSGustavo F. Padovan return 0; 31390a708f8fSGustavo F. Padovan } 31400a708f8fSGustavo F. Padovan 314184084a31SMat Martineau static void append_skb_frag(struct sk_buff *skb, 314284084a31SMat Martineau struct sk_buff *new_frag, struct sk_buff **last_frag) 31430a708f8fSGustavo F. Padovan { 314484084a31SMat Martineau /* skb->len reflects data in skb as well as all fragments 314584084a31SMat Martineau * skb->data_len reflects only data in fragments 314684084a31SMat Martineau */ 314784084a31SMat Martineau if (!skb_has_frag_list(skb)) 314884084a31SMat Martineau skb_shinfo(skb)->frag_list = new_frag; 314984084a31SMat Martineau 315084084a31SMat Martineau new_frag->next = NULL; 315184084a31SMat Martineau 315284084a31SMat Martineau (*last_frag)->next = new_frag; 315384084a31SMat Martineau *last_frag = new_frag; 315484084a31SMat Martineau 315584084a31SMat Martineau skb->len += new_frag->len; 315684084a31SMat Martineau skb->data_len += new_frag->len; 315784084a31SMat Martineau skb->truesize += new_frag->truesize; 315884084a31SMat Martineau } 315984084a31SMat Martineau 316084084a31SMat Martineau static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control) 316184084a31SMat Martineau { 316284084a31SMat Martineau int err = -EINVAL; 31630a708f8fSGustavo F. Padovan 31640a708f8fSGustavo F. Padovan switch (control & L2CAP_CTRL_SAR) { 31650a708f8fSGustavo F. Padovan case L2CAP_SDU_UNSEGMENTED: 316684084a31SMat Martineau if (chan->sdu) 316784084a31SMat Martineau break; 31680a708f8fSGustavo F. Padovan 316984084a31SMat Martineau err = chan->ops->recv(chan->data, skb); 317084084a31SMat Martineau break; 31710a708f8fSGustavo F. Padovan 31720a708f8fSGustavo F. Padovan case L2CAP_SDU_START: 317384084a31SMat Martineau if (chan->sdu) 317484084a31SMat Martineau break; 31750a708f8fSGustavo F. Padovan 31766f61fd47SGustavo F. Padovan chan->sdu_len = get_unaligned_le16(skb->data); 31770a708f8fSGustavo F. Padovan skb_pull(skb, 2); 31780a708f8fSGustavo F. Padovan 317984084a31SMat Martineau if (chan->sdu_len > chan->imtu) { 318084084a31SMat Martineau err = -EMSGSIZE; 318184084a31SMat Martineau break; 318284084a31SMat Martineau } 31830a708f8fSGustavo F. Padovan 318484084a31SMat Martineau if (skb->len >= chan->sdu_len) 318584084a31SMat Martineau break; 318684084a31SMat Martineau 318784084a31SMat Martineau chan->sdu = skb; 318884084a31SMat Martineau chan->sdu_last_frag = skb; 318984084a31SMat Martineau 319084084a31SMat Martineau skb = NULL; 319184084a31SMat Martineau err = 0; 31920a708f8fSGustavo F. Padovan break; 31930a708f8fSGustavo F. Padovan 31940a708f8fSGustavo F. Padovan case L2CAP_SDU_CONTINUE: 31956f61fd47SGustavo F. Padovan if (!chan->sdu) 319684084a31SMat Martineau break; 31970a708f8fSGustavo F. Padovan 319884084a31SMat Martineau append_skb_frag(chan->sdu, skb, 319984084a31SMat Martineau &chan->sdu_last_frag); 320084084a31SMat Martineau skb = NULL; 32010a708f8fSGustavo F. Padovan 320284084a31SMat Martineau if (chan->sdu->len >= chan->sdu_len) 320384084a31SMat Martineau break; 32040a708f8fSGustavo F. Padovan 320584084a31SMat Martineau err = 0; 32060a708f8fSGustavo F. Padovan break; 32070a708f8fSGustavo F. Padovan 32080a708f8fSGustavo F. Padovan case L2CAP_SDU_END: 32096f61fd47SGustavo F. Padovan if (!chan->sdu) 321084084a31SMat Martineau break; 32110a708f8fSGustavo F. Padovan 321284084a31SMat Martineau append_skb_frag(chan->sdu, skb, 321384084a31SMat Martineau &chan->sdu_last_frag); 321484084a31SMat Martineau skb = NULL; 32150a708f8fSGustavo F. Padovan 321684084a31SMat Martineau if (chan->sdu->len != chan->sdu_len) 321784084a31SMat Martineau break; 32180a708f8fSGustavo F. Padovan 321984084a31SMat Martineau err = chan->ops->recv(chan->data, chan->sdu); 32200a708f8fSGustavo F. Padovan 322184084a31SMat Martineau if (!err) { 322284084a31SMat Martineau /* Reassembly complete */ 322384084a31SMat Martineau chan->sdu = NULL; 322484084a31SMat Martineau chan->sdu_last_frag = NULL; 322584084a31SMat Martineau chan->sdu_len = 0; 32260a708f8fSGustavo F. Padovan } 32270a708f8fSGustavo F. Padovan break; 32280a708f8fSGustavo F. Padovan } 32290a708f8fSGustavo F. Padovan 323084084a31SMat Martineau if (err) { 32310a708f8fSGustavo F. Padovan kfree_skb(skb); 32326f61fd47SGustavo F. Padovan kfree_skb(chan->sdu); 32336f61fd47SGustavo F. Padovan chan->sdu = NULL; 323484084a31SMat Martineau chan->sdu_last_frag = NULL; 323584084a31SMat Martineau chan->sdu_len = 0; 323684084a31SMat Martineau } 32370a708f8fSGustavo F. Padovan 323884084a31SMat Martineau return err; 32390a708f8fSGustavo F. Padovan } 32400a708f8fSGustavo F. Padovan 324126f880d2SMat Martineau static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan) 32420a708f8fSGustavo F. Padovan { 32430a708f8fSGustavo F. Padovan u16 control; 32440a708f8fSGustavo F. Padovan 324526f880d2SMat Martineau BT_DBG("chan %p, Enter local busy", chan); 324626f880d2SMat Martineau 324726f880d2SMat Martineau set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 324826f880d2SMat Martineau 324926f880d2SMat Martineau control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 325026f880d2SMat Martineau control |= L2CAP_SUPER_RCV_NOT_READY; 325126f880d2SMat Martineau l2cap_send_sframe(chan, control); 325226f880d2SMat Martineau 325326f880d2SMat Martineau set_bit(CONN_RNR_SENT, &chan->conn_state); 325426f880d2SMat Martineau 325526f880d2SMat Martineau __clear_ack_timer(chan); 32560a708f8fSGustavo F. Padovan } 32570a708f8fSGustavo F. Padovan 325826f880d2SMat Martineau static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan) 325926f880d2SMat Martineau { 326026f880d2SMat Martineau u16 control; 32610a708f8fSGustavo F. Padovan 3262e2ab4353SGustavo F. Padovan if (!test_bit(CONN_RNR_SENT, &chan->conn_state)) 32630a708f8fSGustavo F. Padovan goto done; 32640a708f8fSGustavo F. Padovan 326542e5c802SGustavo F. Padovan control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 32660a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL; 3267525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 32686a026610SGustavo F. Padovan chan->retry_count = 1; 32690a708f8fSGustavo F. Padovan 32701a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 32711a09bcb9SGustavo F. Padovan __set_monitor_timer(chan); 32720a708f8fSGustavo F. Padovan 3273e2ab4353SGustavo F. Padovan set_bit(CONN_WAIT_F, &chan->conn_state); 32740a708f8fSGustavo F. Padovan 32750a708f8fSGustavo F. Padovan done: 3276e2ab4353SGustavo F. Padovan clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 3277e2ab4353SGustavo F. Padovan clear_bit(CONN_RNR_SENT, &chan->conn_state); 32780a708f8fSGustavo F. Padovan 327949208c9cSGustavo F. Padovan BT_DBG("chan %p, Exit local busy", chan); 32800a708f8fSGustavo F. Padovan } 32810a708f8fSGustavo F. Padovan 3282e328140fSMat Martineau void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 32830a708f8fSGustavo F. Padovan { 3284e328140fSMat Martineau if (chan->mode == L2CAP_MODE_ERTM) { 3285e328140fSMat Martineau if (busy) 328626f880d2SMat Martineau l2cap_ertm_enter_local_busy(chan); 3287e328140fSMat Martineau else 3288e328140fSMat Martineau l2cap_ertm_exit_local_busy(chan); 32890a708f8fSGustavo F. Padovan } 32900a708f8fSGustavo F. Padovan } 32910a708f8fSGustavo F. Padovan 3292525cd185SGustavo F. Padovan static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq) 32930a708f8fSGustavo F. Padovan { 32940a708f8fSGustavo F. Padovan struct sk_buff *skb; 32950a708f8fSGustavo F. Padovan u16 control; 32960a708f8fSGustavo F. Padovan 3297e328140fSMat Martineau while ((skb = skb_peek(&chan->srej_q)) && 3298e328140fSMat Martineau !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 3299e328140fSMat Martineau int err; 3300e328140fSMat Martineau 33010a708f8fSGustavo F. Padovan if (bt_cb(skb)->tx_seq != tx_seq) 33020a708f8fSGustavo F. Padovan break; 33030a708f8fSGustavo F. Padovan 3304f1c6775bSGustavo F. Padovan skb = skb_dequeue(&chan->srej_q); 33050a708f8fSGustavo F. Padovan control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT; 330684084a31SMat Martineau err = l2cap_reassemble_sdu(chan, skb, control); 3307e328140fSMat Martineau 3308e328140fSMat Martineau if (err < 0) { 3309e328140fSMat Martineau l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 3310e328140fSMat Martineau break; 3311e328140fSMat Martineau } 3312e328140fSMat Martineau 331342e5c802SGustavo F. Padovan chan->buffer_seq_srej = 331442e5c802SGustavo F. Padovan (chan->buffer_seq_srej + 1) % 64; 33150a708f8fSGustavo F. Padovan tx_seq = (tx_seq + 1) % 64; 33160a708f8fSGustavo F. Padovan } 33170a708f8fSGustavo F. Padovan } 33180a708f8fSGustavo F. Padovan 3319525cd185SGustavo F. Padovan static void l2cap_resend_srejframe(struct l2cap_chan *chan, u8 tx_seq) 33200a708f8fSGustavo F. Padovan { 33210a708f8fSGustavo F. Padovan struct srej_list *l, *tmp; 33220a708f8fSGustavo F. Padovan u16 control; 33230a708f8fSGustavo F. Padovan 332439d5a3eeSGustavo F. Padovan list_for_each_entry_safe(l, tmp, &chan->srej_l, list) { 33250a708f8fSGustavo F. Padovan if (l->tx_seq == tx_seq) { 33260a708f8fSGustavo F. Padovan list_del(&l->list); 33270a708f8fSGustavo F. Padovan kfree(l); 33280a708f8fSGustavo F. Padovan return; 33290a708f8fSGustavo F. Padovan } 33300a708f8fSGustavo F. Padovan control = L2CAP_SUPER_SELECT_REJECT; 33310a708f8fSGustavo F. Padovan control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT; 3332525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 33330a708f8fSGustavo F. Padovan list_del(&l->list); 333439d5a3eeSGustavo F. Padovan list_add_tail(&l->list, &chan->srej_l); 33350a708f8fSGustavo F. Padovan } 33360a708f8fSGustavo F. Padovan } 33370a708f8fSGustavo F. Padovan 3338525cd185SGustavo F. Padovan static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq) 33390a708f8fSGustavo F. Padovan { 33400a708f8fSGustavo F. Padovan struct srej_list *new; 33410a708f8fSGustavo F. Padovan u16 control; 33420a708f8fSGustavo F. Padovan 334342e5c802SGustavo F. Padovan while (tx_seq != chan->expected_tx_seq) { 33440a708f8fSGustavo F. Padovan control = L2CAP_SUPER_SELECT_REJECT; 334542e5c802SGustavo F. Padovan control |= chan->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT; 3346525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 33470a708f8fSGustavo F. Padovan 33480a708f8fSGustavo F. Padovan new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC); 334942e5c802SGustavo F. Padovan new->tx_seq = chan->expected_tx_seq; 335042e5c802SGustavo F. Padovan chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64; 335139d5a3eeSGustavo F. Padovan list_add_tail(&new->list, &chan->srej_l); 33520a708f8fSGustavo F. Padovan } 335342e5c802SGustavo F. Padovan chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64; 33540a708f8fSGustavo F. Padovan } 33550a708f8fSGustavo F. Padovan 3356525cd185SGustavo F. Padovan static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb) 33570a708f8fSGustavo F. Padovan { 33580a708f8fSGustavo F. Padovan u8 tx_seq = __get_txseq(rx_control); 33590a708f8fSGustavo F. Padovan u8 req_seq = __get_reqseq(rx_control); 33600a708f8fSGustavo F. Padovan u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT; 33610a708f8fSGustavo F. Padovan int tx_seq_offset, expected_tx_seq_offset; 336247d1ec61SGustavo F. Padovan int num_to_ack = (chan->tx_win/6) + 1; 33630a708f8fSGustavo F. Padovan int err = 0; 33640a708f8fSGustavo F. Padovan 3365525cd185SGustavo F. Padovan BT_DBG("chan %p len %d tx_seq %d rx_control 0x%4.4x", chan, skb->len, 3366525cd185SGustavo F. Padovan tx_seq, rx_control); 33670a708f8fSGustavo F. Padovan 33680a708f8fSGustavo F. Padovan if (L2CAP_CTRL_FINAL & rx_control && 3369e2ab4353SGustavo F. Padovan test_bit(CONN_WAIT_F, &chan->conn_state)) { 33701a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 33716a026610SGustavo F. Padovan if (chan->unacked_frames > 0) 33721a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 3373e2ab4353SGustavo F. Padovan clear_bit(CONN_WAIT_F, &chan->conn_state); 33740a708f8fSGustavo F. Padovan } 33750a708f8fSGustavo F. Padovan 337642e5c802SGustavo F. Padovan chan->expected_ack_seq = req_seq; 337742e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 33780a708f8fSGustavo F. Padovan 337942e5c802SGustavo F. Padovan tx_seq_offset = (tx_seq - chan->buffer_seq) % 64; 33800a708f8fSGustavo F. Padovan if (tx_seq_offset < 0) 33810a708f8fSGustavo F. Padovan tx_seq_offset += 64; 33820a708f8fSGustavo F. Padovan 33830a708f8fSGustavo F. Padovan /* invalid tx_seq */ 338447d1ec61SGustavo F. Padovan if (tx_seq_offset >= chan->tx_win) { 33858c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 33860a708f8fSGustavo F. Padovan goto drop; 33870a708f8fSGustavo F. Padovan } 33880a708f8fSGustavo F. Padovan 3389e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 33900a708f8fSGustavo F. Padovan goto drop; 33910a708f8fSGustavo F. Padovan 339202f1b641SMat Martineau if (tx_seq == chan->expected_tx_seq) 339302f1b641SMat Martineau goto expected; 339402f1b641SMat Martineau 3395e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 33960a708f8fSGustavo F. Padovan struct srej_list *first; 33970a708f8fSGustavo F. Padovan 339839d5a3eeSGustavo F. Padovan first = list_first_entry(&chan->srej_l, 33990a708f8fSGustavo F. Padovan struct srej_list, list); 34000a708f8fSGustavo F. Padovan if (tx_seq == first->tx_seq) { 340142e5c802SGustavo F. Padovan l2cap_add_to_srej_queue(chan, skb, tx_seq, sar); 3402525cd185SGustavo F. Padovan l2cap_check_srej_gap(chan, tx_seq); 34030a708f8fSGustavo F. Padovan 34040a708f8fSGustavo F. Padovan list_del(&first->list); 34050a708f8fSGustavo F. Padovan kfree(first); 34060a708f8fSGustavo F. Padovan 340739d5a3eeSGustavo F. Padovan if (list_empty(&chan->srej_l)) { 340842e5c802SGustavo F. Padovan chan->buffer_seq = chan->buffer_seq_srej; 3409e2ab4353SGustavo F. Padovan clear_bit(CONN_SREJ_SENT, &chan->conn_state); 3410525cd185SGustavo F. Padovan l2cap_send_ack(chan); 341149208c9cSGustavo F. Padovan BT_DBG("chan %p, Exit SREJ_SENT", chan); 34120a708f8fSGustavo F. Padovan } 34130a708f8fSGustavo F. Padovan } else { 34140a708f8fSGustavo F. Padovan struct srej_list *l; 34150a708f8fSGustavo F. Padovan 34160a708f8fSGustavo F. Padovan /* duplicated tx_seq */ 341742e5c802SGustavo F. Padovan if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0) 34180a708f8fSGustavo F. Padovan goto drop; 34190a708f8fSGustavo F. Padovan 342039d5a3eeSGustavo F. Padovan list_for_each_entry(l, &chan->srej_l, list) { 34210a708f8fSGustavo F. Padovan if (l->tx_seq == tx_seq) { 3422525cd185SGustavo F. Padovan l2cap_resend_srejframe(chan, tx_seq); 34230a708f8fSGustavo F. Padovan return 0; 34240a708f8fSGustavo F. Padovan } 34250a708f8fSGustavo F. Padovan } 3426525cd185SGustavo F. Padovan l2cap_send_srejframe(chan, tx_seq); 34270a708f8fSGustavo F. Padovan } 34280a708f8fSGustavo F. Padovan } else { 34290a708f8fSGustavo F. Padovan expected_tx_seq_offset = 343042e5c802SGustavo F. Padovan (chan->expected_tx_seq - chan->buffer_seq) % 64; 34310a708f8fSGustavo F. Padovan if (expected_tx_seq_offset < 0) 34320a708f8fSGustavo F. Padovan expected_tx_seq_offset += 64; 34330a708f8fSGustavo F. Padovan 34340a708f8fSGustavo F. Padovan /* duplicated tx_seq */ 34350a708f8fSGustavo F. Padovan if (tx_seq_offset < expected_tx_seq_offset) 34360a708f8fSGustavo F. Padovan goto drop; 34370a708f8fSGustavo F. Padovan 3438e2ab4353SGustavo F. Padovan set_bit(CONN_SREJ_SENT, &chan->conn_state); 34390a708f8fSGustavo F. Padovan 344049208c9cSGustavo F. Padovan BT_DBG("chan %p, Enter SREJ", chan); 34410a708f8fSGustavo F. Padovan 344239d5a3eeSGustavo F. Padovan INIT_LIST_HEAD(&chan->srej_l); 344342e5c802SGustavo F. Padovan chan->buffer_seq_srej = chan->buffer_seq; 34440a708f8fSGustavo F. Padovan 3445f1c6775bSGustavo F. Padovan __skb_queue_head_init(&chan->srej_q); 344642e5c802SGustavo F. Padovan l2cap_add_to_srej_queue(chan, skb, tx_seq, sar); 34470a708f8fSGustavo F. Padovan 3448e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_PBIT, &chan->conn_state); 34490a708f8fSGustavo F. Padovan 3450525cd185SGustavo F. Padovan l2cap_send_srejframe(chan, tx_seq); 34510a708f8fSGustavo F. Padovan 34521a09bcb9SGustavo F. Padovan __clear_ack_timer(chan); 34530a708f8fSGustavo F. Padovan } 34540a708f8fSGustavo F. Padovan return 0; 34550a708f8fSGustavo F. Padovan 34560a708f8fSGustavo F. Padovan expected: 345742e5c802SGustavo F. Padovan chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64; 34580a708f8fSGustavo F. Padovan 3459e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 34600a708f8fSGustavo F. Padovan bt_cb(skb)->tx_seq = tx_seq; 34610a708f8fSGustavo F. Padovan bt_cb(skb)->sar = sar; 3462f1c6775bSGustavo F. Padovan __skb_queue_tail(&chan->srej_q, skb); 34630a708f8fSGustavo F. Padovan return 0; 34640a708f8fSGustavo F. Padovan } 34650a708f8fSGustavo F. Padovan 346684084a31SMat Martineau err = l2cap_reassemble_sdu(chan, skb, rx_control); 3467fadd192eSMat Martineau chan->buffer_seq = (chan->buffer_seq + 1) % 64; 3468e328140fSMat Martineau if (err < 0) { 3469e328140fSMat Martineau l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 3470e328140fSMat Martineau return err; 3471e328140fSMat Martineau } 34720a708f8fSGustavo F. Padovan 34730a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_FINAL) { 3474e2ab4353SGustavo F. Padovan if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 3475525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 34760a708f8fSGustavo F. Padovan } 34770a708f8fSGustavo F. Padovan 34781a09bcb9SGustavo F. Padovan __set_ack_timer(chan); 34790a708f8fSGustavo F. Padovan 34806a026610SGustavo F. Padovan chan->num_acked = (chan->num_acked + 1) % num_to_ack; 34816a026610SGustavo F. Padovan if (chan->num_acked == num_to_ack - 1) 3482525cd185SGustavo F. Padovan l2cap_send_ack(chan); 34830a708f8fSGustavo F. Padovan 34840a708f8fSGustavo F. Padovan return 0; 34850a708f8fSGustavo F. Padovan 34860a708f8fSGustavo F. Padovan drop: 34870a708f8fSGustavo F. Padovan kfree_skb(skb); 34880a708f8fSGustavo F. Padovan return 0; 34890a708f8fSGustavo F. Padovan } 34900a708f8fSGustavo F. Padovan 3491525cd185SGustavo F. Padovan static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u16 rx_control) 34920a708f8fSGustavo F. Padovan { 349349208c9cSGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, __get_reqseq(rx_control), 34940a708f8fSGustavo F. Padovan rx_control); 34950a708f8fSGustavo F. Padovan 349642e5c802SGustavo F. Padovan chan->expected_ack_seq = __get_reqseq(rx_control); 349742e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 34980a708f8fSGustavo F. Padovan 34990a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) { 3500e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_FBIT, &chan->conn_state); 3501e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 3502e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 35036a026610SGustavo F. Padovan (chan->unacked_frames > 0)) 35041a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 35050a708f8fSGustavo F. Padovan 3506e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 3507525cd185SGustavo F. Padovan l2cap_send_srejtail(chan); 35080a708f8fSGustavo F. Padovan } else { 3509525cd185SGustavo F. Padovan l2cap_send_i_or_rr_or_rnr(chan); 35100a708f8fSGustavo F. Padovan } 35110a708f8fSGustavo F. Padovan 35120a708f8fSGustavo F. Padovan } else if (rx_control & L2CAP_CTRL_FINAL) { 3513e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 35140a708f8fSGustavo F. Padovan 3515e2ab4353SGustavo F. Padovan if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 3516525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35170a708f8fSGustavo F. Padovan 35180a708f8fSGustavo F. Padovan } else { 3519e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 35206a026610SGustavo F. Padovan (chan->unacked_frames > 0)) 35211a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 35220a708f8fSGustavo F. Padovan 3523e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 3524e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) 3525525cd185SGustavo F. Padovan l2cap_send_ack(chan); 35260a708f8fSGustavo F. Padovan else 3527525cd185SGustavo F. Padovan l2cap_ertm_send(chan); 35280a708f8fSGustavo F. Padovan } 35290a708f8fSGustavo F. Padovan } 35300a708f8fSGustavo F. Padovan 3531525cd185SGustavo F. Padovan static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u16 rx_control) 35320a708f8fSGustavo F. Padovan { 35330a708f8fSGustavo F. Padovan u8 tx_seq = __get_reqseq(rx_control); 35340a708f8fSGustavo F. Padovan 3535525cd185SGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control); 35360a708f8fSGustavo F. Padovan 3537e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 35380a708f8fSGustavo F. Padovan 353942e5c802SGustavo F. Padovan chan->expected_ack_seq = tx_seq; 354042e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 35410a708f8fSGustavo F. Padovan 35420a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_FINAL) { 3543e2ab4353SGustavo F. Padovan if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 3544525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35450a708f8fSGustavo F. Padovan } else { 3546525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35470a708f8fSGustavo F. Padovan 3548e2ab4353SGustavo F. Padovan if (test_bit(CONN_WAIT_F, &chan->conn_state)) 3549e2ab4353SGustavo F. Padovan set_bit(CONN_REJ_ACT, &chan->conn_state); 35500a708f8fSGustavo F. Padovan } 35510a708f8fSGustavo F. Padovan } 3552525cd185SGustavo F. Padovan static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u16 rx_control) 35530a708f8fSGustavo F. Padovan { 35540a708f8fSGustavo F. Padovan u8 tx_seq = __get_reqseq(rx_control); 35550a708f8fSGustavo F. Padovan 3556525cd185SGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control); 35570a708f8fSGustavo F. Padovan 3558e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 35590a708f8fSGustavo F. Padovan 35600a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) { 356142e5c802SGustavo F. Padovan chan->expected_ack_seq = tx_seq; 356242e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 35630a708f8fSGustavo F. Padovan 3564e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_FBIT, &chan->conn_state); 3565525cd185SGustavo F. Padovan l2cap_retransmit_one_frame(chan, tx_seq); 35660a708f8fSGustavo F. Padovan 3567525cd185SGustavo F. Padovan l2cap_ertm_send(chan); 35680a708f8fSGustavo F. Padovan 3569e2ab4353SGustavo F. Padovan if (test_bit(CONN_WAIT_F, &chan->conn_state)) { 35706a026610SGustavo F. Padovan chan->srej_save_reqseq = tx_seq; 3571e2ab4353SGustavo F. Padovan set_bit(CONN_SREJ_ACT, &chan->conn_state); 35720a708f8fSGustavo F. Padovan } 35730a708f8fSGustavo F. Padovan } else if (rx_control & L2CAP_CTRL_FINAL) { 3574e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_ACT, &chan->conn_state) && 35756a026610SGustavo F. Padovan chan->srej_save_reqseq == tx_seq) 3576e2ab4353SGustavo F. Padovan clear_bit(CONN_SREJ_ACT, &chan->conn_state); 35770a708f8fSGustavo F. Padovan else 3578525cd185SGustavo F. Padovan l2cap_retransmit_one_frame(chan, tx_seq); 35790a708f8fSGustavo F. Padovan } else { 3580525cd185SGustavo F. Padovan l2cap_retransmit_one_frame(chan, tx_seq); 3581e2ab4353SGustavo F. Padovan if (test_bit(CONN_WAIT_F, &chan->conn_state)) { 35826a026610SGustavo F. Padovan chan->srej_save_reqseq = tx_seq; 3583e2ab4353SGustavo F. Padovan set_bit(CONN_SREJ_ACT, &chan->conn_state); 35840a708f8fSGustavo F. Padovan } 35850a708f8fSGustavo F. Padovan } 35860a708f8fSGustavo F. Padovan } 35870a708f8fSGustavo F. Padovan 3588525cd185SGustavo F. Padovan static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u16 rx_control) 35890a708f8fSGustavo F. Padovan { 35900a708f8fSGustavo F. Padovan u8 tx_seq = __get_reqseq(rx_control); 35910a708f8fSGustavo F. Padovan 3592525cd185SGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control); 35930a708f8fSGustavo F. Padovan 3594e2ab4353SGustavo F. Padovan set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 359542e5c802SGustavo F. Padovan chan->expected_ack_seq = tx_seq; 359642e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 35970a708f8fSGustavo F. Padovan 35980a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) 3599e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_FBIT, &chan->conn_state); 36000a708f8fSGustavo F. Padovan 3601e2ab4353SGustavo F. Padovan if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 36021a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 36030a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) 3604525cd185SGustavo F. Padovan l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL); 36050a708f8fSGustavo F. Padovan return; 36060a708f8fSGustavo F. Padovan } 36070a708f8fSGustavo F. Padovan 36080a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) 3609525cd185SGustavo F. Padovan l2cap_send_srejtail(chan); 36100a708f8fSGustavo F. Padovan else 3611525cd185SGustavo F. Padovan l2cap_send_sframe(chan, L2CAP_SUPER_RCV_READY); 36120a708f8fSGustavo F. Padovan } 36130a708f8fSGustavo F. Padovan 3614525cd185SGustavo F. Padovan static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb) 36150a708f8fSGustavo F. Padovan { 3616525cd185SGustavo F. Padovan BT_DBG("chan %p rx_control 0x%4.4x len %d", chan, rx_control, skb->len); 36170a708f8fSGustavo F. Padovan 36180a708f8fSGustavo F. Padovan if (L2CAP_CTRL_FINAL & rx_control && 3619e2ab4353SGustavo F. Padovan test_bit(CONN_WAIT_F, &chan->conn_state)) { 36201a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 36216a026610SGustavo F. Padovan if (chan->unacked_frames > 0) 36221a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 3623e2ab4353SGustavo F. Padovan clear_bit(CONN_WAIT_F, &chan->conn_state); 36240a708f8fSGustavo F. Padovan } 36250a708f8fSGustavo F. Padovan 36260a708f8fSGustavo F. Padovan switch (rx_control & L2CAP_CTRL_SUPERVISE) { 36270a708f8fSGustavo F. Padovan case L2CAP_SUPER_RCV_READY: 3628525cd185SGustavo F. Padovan l2cap_data_channel_rrframe(chan, rx_control); 36290a708f8fSGustavo F. Padovan break; 36300a708f8fSGustavo F. Padovan 36310a708f8fSGustavo F. Padovan case L2CAP_SUPER_REJECT: 3632525cd185SGustavo F. Padovan l2cap_data_channel_rejframe(chan, rx_control); 36330a708f8fSGustavo F. Padovan break; 36340a708f8fSGustavo F. Padovan 36350a708f8fSGustavo F. Padovan case L2CAP_SUPER_SELECT_REJECT: 3636525cd185SGustavo F. Padovan l2cap_data_channel_srejframe(chan, rx_control); 36370a708f8fSGustavo F. Padovan break; 36380a708f8fSGustavo F. Padovan 36390a708f8fSGustavo F. Padovan case L2CAP_SUPER_RCV_NOT_READY: 3640525cd185SGustavo F. Padovan l2cap_data_channel_rnrframe(chan, rx_control); 36410a708f8fSGustavo F. Padovan break; 36420a708f8fSGustavo F. Padovan } 36430a708f8fSGustavo F. Padovan 36440a708f8fSGustavo F. Padovan kfree_skb(skb); 36450a708f8fSGustavo F. Padovan return 0; 36460a708f8fSGustavo F. Padovan } 36470a708f8fSGustavo F. Padovan 36480a708f8fSGustavo F. Padovan static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb) 36490a708f8fSGustavo F. Padovan { 3650525cd185SGustavo F. Padovan struct l2cap_chan *chan = l2cap_pi(sk)->chan; 36510a708f8fSGustavo F. Padovan u16 control; 36520a708f8fSGustavo F. Padovan u8 req_seq; 36530a708f8fSGustavo F. Padovan int len, next_tx_seq_offset, req_seq_offset; 36540a708f8fSGustavo F. Padovan 36550a708f8fSGustavo F. Padovan control = get_unaligned_le16(skb->data); 36560a708f8fSGustavo F. Padovan skb_pull(skb, 2); 36570a708f8fSGustavo F. Padovan len = skb->len; 36580a708f8fSGustavo F. Padovan 36590a708f8fSGustavo F. Padovan /* 36600a708f8fSGustavo F. Padovan * We can just drop the corrupted I-frame here. 36610a708f8fSGustavo F. Padovan * Receiver will miss it and start proper recovery 36620a708f8fSGustavo F. Padovan * procedures and ask retransmission. 36630a708f8fSGustavo F. Padovan */ 366447d1ec61SGustavo F. Padovan if (l2cap_check_fcs(chan, skb)) 36650a708f8fSGustavo F. Padovan goto drop; 36660a708f8fSGustavo F. Padovan 36670a708f8fSGustavo F. Padovan if (__is_sar_start(control) && __is_iframe(control)) 36680a708f8fSGustavo F. Padovan len -= 2; 36690a708f8fSGustavo F. Padovan 367047d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 36710a708f8fSGustavo F. Padovan len -= 2; 36720a708f8fSGustavo F. Padovan 367347d1ec61SGustavo F. Padovan if (len > chan->mps) { 36748c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 36750a708f8fSGustavo F. Padovan goto drop; 36760a708f8fSGustavo F. Padovan } 36770a708f8fSGustavo F. Padovan 36780a708f8fSGustavo F. Padovan req_seq = __get_reqseq(control); 367942e5c802SGustavo F. Padovan req_seq_offset = (req_seq - chan->expected_ack_seq) % 64; 36800a708f8fSGustavo F. Padovan if (req_seq_offset < 0) 36810a708f8fSGustavo F. Padovan req_seq_offset += 64; 36820a708f8fSGustavo F. Padovan 36830a708f8fSGustavo F. Padovan next_tx_seq_offset = 368442e5c802SGustavo F. Padovan (chan->next_tx_seq - chan->expected_ack_seq) % 64; 36850a708f8fSGustavo F. Padovan if (next_tx_seq_offset < 0) 36860a708f8fSGustavo F. Padovan next_tx_seq_offset += 64; 36870a708f8fSGustavo F. Padovan 36880a708f8fSGustavo F. Padovan /* check for invalid req-seq */ 36890a708f8fSGustavo F. Padovan if (req_seq_offset > next_tx_seq_offset) { 36908c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 36910a708f8fSGustavo F. Padovan goto drop; 36920a708f8fSGustavo F. Padovan } 36930a708f8fSGustavo F. Padovan 36940a708f8fSGustavo F. Padovan if (__is_iframe(control)) { 36950a708f8fSGustavo F. Padovan if (len < 0) { 36968c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 36970a708f8fSGustavo F. Padovan goto drop; 36980a708f8fSGustavo F. Padovan } 36990a708f8fSGustavo F. Padovan 3700525cd185SGustavo F. Padovan l2cap_data_channel_iframe(chan, control, skb); 37010a708f8fSGustavo F. Padovan } else { 37020a708f8fSGustavo F. Padovan if (len != 0) { 37030a708f8fSGustavo F. Padovan BT_ERR("%d", len); 37048c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 37050a708f8fSGustavo F. Padovan goto drop; 37060a708f8fSGustavo F. Padovan } 37070a708f8fSGustavo F. Padovan 3708525cd185SGustavo F. Padovan l2cap_data_channel_sframe(chan, control, skb); 37090a708f8fSGustavo F. Padovan } 37100a708f8fSGustavo F. Padovan 37110a708f8fSGustavo F. Padovan return 0; 37120a708f8fSGustavo F. Padovan 37130a708f8fSGustavo F. Padovan drop: 37140a708f8fSGustavo F. Padovan kfree_skb(skb); 37150a708f8fSGustavo F. Padovan return 0; 37160a708f8fSGustavo F. Padovan } 37170a708f8fSGustavo F. Padovan 37180a708f8fSGustavo F. Padovan static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb) 37190a708f8fSGustavo F. Padovan { 372048454079SGustavo F. Padovan struct l2cap_chan *chan; 3721bf734843SDavid S. Miller struct sock *sk = NULL; 37220a708f8fSGustavo F. Padovan u16 control; 37230a708f8fSGustavo F. Padovan u8 tx_seq; 37240a708f8fSGustavo F. Padovan int len; 37250a708f8fSGustavo F. Padovan 3726baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, cid); 372748454079SGustavo F. Padovan if (!chan) { 37280a708f8fSGustavo F. Padovan BT_DBG("unknown cid 0x%4.4x", cid); 37290a708f8fSGustavo F. Padovan goto drop; 37300a708f8fSGustavo F. Padovan } 37310a708f8fSGustavo F. Padovan 373248454079SGustavo F. Padovan sk = chan->sk; 37330a708f8fSGustavo F. Padovan 373449208c9cSGustavo F. Padovan BT_DBG("chan %p, len %d", chan, skb->len); 37350a708f8fSGustavo F. Padovan 373689bc500eSGustavo F. Padovan if (chan->state != BT_CONNECTED) 37370a708f8fSGustavo F. Padovan goto drop; 37380a708f8fSGustavo F. Padovan 37390c1bc5c6SGustavo F. Padovan switch (chan->mode) { 37400a708f8fSGustavo F. Padovan case L2CAP_MODE_BASIC: 37410a708f8fSGustavo F. Padovan /* If socket recv buffers overflows we drop data here 37420a708f8fSGustavo F. Padovan * which is *bad* because L2CAP has to be reliable. 37430a708f8fSGustavo F. Padovan * But we don't have any other choice. L2CAP doesn't 37440a708f8fSGustavo F. Padovan * provide flow control mechanism. */ 37450a708f8fSGustavo F. Padovan 37460c1bc5c6SGustavo F. Padovan if (chan->imtu < skb->len) 37470a708f8fSGustavo F. Padovan goto drop; 37480a708f8fSGustavo F. Padovan 374923070494SGustavo F. Padovan if (!chan->ops->recv(chan->data, skb)) 37500a708f8fSGustavo F. Padovan goto done; 37510a708f8fSGustavo F. Padovan break; 37520a708f8fSGustavo F. Padovan 37530a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 37540a708f8fSGustavo F. Padovan if (!sock_owned_by_user(sk)) { 37550a708f8fSGustavo F. Padovan l2cap_ertm_data_rcv(sk, skb); 37560a708f8fSGustavo F. Padovan } else { 37570a708f8fSGustavo F. Padovan if (sk_add_backlog(sk, skb)) 37580a708f8fSGustavo F. Padovan goto drop; 37590a708f8fSGustavo F. Padovan } 37600a708f8fSGustavo F. Padovan 37610a708f8fSGustavo F. Padovan goto done; 37620a708f8fSGustavo F. Padovan 37630a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 37640a708f8fSGustavo F. Padovan control = get_unaligned_le16(skb->data); 37650a708f8fSGustavo F. Padovan skb_pull(skb, 2); 37660a708f8fSGustavo F. Padovan len = skb->len; 37670a708f8fSGustavo F. Padovan 376847d1ec61SGustavo F. Padovan if (l2cap_check_fcs(chan, skb)) 37690a708f8fSGustavo F. Padovan goto drop; 37700a708f8fSGustavo F. Padovan 37710a708f8fSGustavo F. Padovan if (__is_sar_start(control)) 37720a708f8fSGustavo F. Padovan len -= 2; 37730a708f8fSGustavo F. Padovan 377447d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 37750a708f8fSGustavo F. Padovan len -= 2; 37760a708f8fSGustavo F. Padovan 377747d1ec61SGustavo F. Padovan if (len > chan->mps || len < 0 || __is_sframe(control)) 37780a708f8fSGustavo F. Padovan goto drop; 37790a708f8fSGustavo F. Padovan 37800a708f8fSGustavo F. Padovan tx_seq = __get_txseq(control); 37810a708f8fSGustavo F. Padovan 378284084a31SMat Martineau if (chan->expected_tx_seq != tx_seq) { 378384084a31SMat Martineau /* Frame(s) missing - must discard partial SDU */ 378484084a31SMat Martineau kfree_skb(chan->sdu); 378584084a31SMat Martineau chan->sdu = NULL; 378684084a31SMat Martineau chan->sdu_last_frag = NULL; 378784084a31SMat Martineau chan->sdu_len = 0; 378884084a31SMat Martineau 378984084a31SMat Martineau /* TODO: Notify userland of missing data */ 379084084a31SMat Martineau } 379184084a31SMat Martineau 379242e5c802SGustavo F. Padovan chan->expected_tx_seq = (tx_seq + 1) % 64; 37930a708f8fSGustavo F. Padovan 379484084a31SMat Martineau if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE) 379584084a31SMat Martineau l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 37960a708f8fSGustavo F. Padovan 37970a708f8fSGustavo F. Padovan goto done; 37980a708f8fSGustavo F. Padovan 37990a708f8fSGustavo F. Padovan default: 38000c1bc5c6SGustavo F. Padovan BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 38010a708f8fSGustavo F. Padovan break; 38020a708f8fSGustavo F. Padovan } 38030a708f8fSGustavo F. Padovan 38040a708f8fSGustavo F. Padovan drop: 38050a708f8fSGustavo F. Padovan kfree_skb(skb); 38060a708f8fSGustavo F. Padovan 38070a708f8fSGustavo F. Padovan done: 38080a708f8fSGustavo F. Padovan if (sk) 38090a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 38100a708f8fSGustavo F. Padovan 38110a708f8fSGustavo F. Padovan return 0; 38120a708f8fSGustavo F. Padovan } 38130a708f8fSGustavo F. Padovan 38140a708f8fSGustavo F. Padovan static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb) 38150a708f8fSGustavo F. Padovan { 38166dcae1eaSDavid S. Miller struct sock *sk = NULL; 381723691d75SGustavo F. Padovan struct l2cap_chan *chan; 38180a708f8fSGustavo F. Padovan 381923691d75SGustavo F. Padovan chan = l2cap_global_chan_by_psm(0, psm, conn->src); 382023691d75SGustavo F. Padovan if (!chan) 38210a708f8fSGustavo F. Padovan goto drop; 38220a708f8fSGustavo F. Padovan 382323691d75SGustavo F. Padovan sk = chan->sk; 382423691d75SGustavo F. Padovan 38250a708f8fSGustavo F. Padovan bh_lock_sock(sk); 38260a708f8fSGustavo F. Padovan 38270a708f8fSGustavo F. Padovan BT_DBG("sk %p, len %d", sk, skb->len); 38280a708f8fSGustavo F. Padovan 382989bc500eSGustavo F. Padovan if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 38300a708f8fSGustavo F. Padovan goto drop; 38310a708f8fSGustavo F. Padovan 3832e13e21dcSVinicius Costa Gomes if (chan->imtu < skb->len) 38330a708f8fSGustavo F. Padovan goto drop; 38340a708f8fSGustavo F. Padovan 383523070494SGustavo F. Padovan if (!chan->ops->recv(chan->data, skb)) 38360a708f8fSGustavo F. Padovan goto done; 38370a708f8fSGustavo F. Padovan 38380a708f8fSGustavo F. Padovan drop: 38390a708f8fSGustavo F. Padovan kfree_skb(skb); 38400a708f8fSGustavo F. Padovan 38410a708f8fSGustavo F. Padovan done: 38420a708f8fSGustavo F. Padovan if (sk) 38430a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 38440a708f8fSGustavo F. Padovan return 0; 38450a708f8fSGustavo F. Padovan } 38460a708f8fSGustavo F. Padovan 38479f69bda6SGustavo F. Padovan static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb) 38489f69bda6SGustavo F. Padovan { 38496dcae1eaSDavid S. Miller struct sock *sk = NULL; 385023691d75SGustavo F. Padovan struct l2cap_chan *chan; 38519f69bda6SGustavo F. Padovan 385223691d75SGustavo F. Padovan chan = l2cap_global_chan_by_scid(0, cid, conn->src); 385323691d75SGustavo F. Padovan if (!chan) 38549f69bda6SGustavo F. Padovan goto drop; 38559f69bda6SGustavo F. Padovan 385623691d75SGustavo F. Padovan sk = chan->sk; 385723691d75SGustavo F. Padovan 38589f69bda6SGustavo F. Padovan bh_lock_sock(sk); 38599f69bda6SGustavo F. Padovan 38609f69bda6SGustavo F. Padovan BT_DBG("sk %p, len %d", sk, skb->len); 38619f69bda6SGustavo F. Padovan 386289bc500eSGustavo F. Padovan if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 38639f69bda6SGustavo F. Padovan goto drop; 38649f69bda6SGustavo F. Padovan 3865e13e21dcSVinicius Costa Gomes if (chan->imtu < skb->len) 38669f69bda6SGustavo F. Padovan goto drop; 38679f69bda6SGustavo F. Padovan 386823070494SGustavo F. Padovan if (!chan->ops->recv(chan->data, skb)) 38699f69bda6SGustavo F. Padovan goto done; 38709f69bda6SGustavo F. Padovan 38719f69bda6SGustavo F. Padovan drop: 38729f69bda6SGustavo F. Padovan kfree_skb(skb); 38739f69bda6SGustavo F. Padovan 38749f69bda6SGustavo F. Padovan done: 38759f69bda6SGustavo F. Padovan if (sk) 38769f69bda6SGustavo F. Padovan bh_unlock_sock(sk); 38779f69bda6SGustavo F. Padovan return 0; 38789f69bda6SGustavo F. Padovan } 38799f69bda6SGustavo F. Padovan 38800a708f8fSGustavo F. Padovan static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 38810a708f8fSGustavo F. Padovan { 38820a708f8fSGustavo F. Padovan struct l2cap_hdr *lh = (void *) skb->data; 38830a708f8fSGustavo F. Padovan u16 cid, len; 38840a708f8fSGustavo F. Padovan __le16 psm; 38850a708f8fSGustavo F. Padovan 38860a708f8fSGustavo F. Padovan skb_pull(skb, L2CAP_HDR_SIZE); 38870a708f8fSGustavo F. Padovan cid = __le16_to_cpu(lh->cid); 38880a708f8fSGustavo F. Padovan len = __le16_to_cpu(lh->len); 38890a708f8fSGustavo F. Padovan 38900a708f8fSGustavo F. Padovan if (len != skb->len) { 38910a708f8fSGustavo F. Padovan kfree_skb(skb); 38920a708f8fSGustavo F. Padovan return; 38930a708f8fSGustavo F. Padovan } 38940a708f8fSGustavo F. Padovan 38950a708f8fSGustavo F. Padovan BT_DBG("len %d, cid 0x%4.4x", len, cid); 38960a708f8fSGustavo F. Padovan 38970a708f8fSGustavo F. Padovan switch (cid) { 38983300d9a9SClaudio Takahasi case L2CAP_CID_LE_SIGNALING: 38990a708f8fSGustavo F. Padovan case L2CAP_CID_SIGNALING: 39000a708f8fSGustavo F. Padovan l2cap_sig_channel(conn, skb); 39010a708f8fSGustavo F. Padovan break; 39020a708f8fSGustavo F. Padovan 39030a708f8fSGustavo F. Padovan case L2CAP_CID_CONN_LESS: 39040a708f8fSGustavo F. Padovan psm = get_unaligned_le16(skb->data); 39050a708f8fSGustavo F. Padovan skb_pull(skb, 2); 39060a708f8fSGustavo F. Padovan l2cap_conless_channel(conn, psm, skb); 39070a708f8fSGustavo F. Padovan break; 39080a708f8fSGustavo F. Padovan 39099f69bda6SGustavo F. Padovan case L2CAP_CID_LE_DATA: 39109f69bda6SGustavo F. Padovan l2cap_att_channel(conn, cid, skb); 39119f69bda6SGustavo F. Padovan break; 39129f69bda6SGustavo F. Padovan 3913b501d6a1SAnderson Briglia case L2CAP_CID_SMP: 3914b501d6a1SAnderson Briglia if (smp_sig_channel(conn, skb)) 3915b501d6a1SAnderson Briglia l2cap_conn_del(conn->hcon, EACCES); 3916b501d6a1SAnderson Briglia break; 3917b501d6a1SAnderson Briglia 39180a708f8fSGustavo F. Padovan default: 39190a708f8fSGustavo F. Padovan l2cap_data_channel(conn, cid, skb); 39200a708f8fSGustavo F. Padovan break; 39210a708f8fSGustavo F. Padovan } 39220a708f8fSGustavo F. Padovan } 39230a708f8fSGustavo F. Padovan 39240a708f8fSGustavo F. Padovan /* ---- L2CAP interface with lower layer (HCI) ---- */ 39250a708f8fSGustavo F. Padovan 39260a708f8fSGustavo F. Padovan static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 39270a708f8fSGustavo F. Padovan { 39280a708f8fSGustavo F. Padovan int exact = 0, lm1 = 0, lm2 = 0; 392923691d75SGustavo F. Padovan struct l2cap_chan *c; 39300a708f8fSGustavo F. Padovan 39310a708f8fSGustavo F. Padovan if (type != ACL_LINK) 39320a708f8fSGustavo F. Padovan return -EINVAL; 39330a708f8fSGustavo F. Padovan 39340a708f8fSGustavo F. Padovan BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr)); 39350a708f8fSGustavo F. Padovan 39360a708f8fSGustavo F. Padovan /* Find listening sockets and check their link_mode */ 393723691d75SGustavo F. Padovan read_lock(&chan_list_lock); 393823691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 393923691d75SGustavo F. Padovan struct sock *sk = c->sk; 39404343478fSGustavo F. Padovan 394189bc500eSGustavo F. Padovan if (c->state != BT_LISTEN) 39420a708f8fSGustavo F. Padovan continue; 39430a708f8fSGustavo F. Padovan 39440a708f8fSGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) { 39450a708f8fSGustavo F. Padovan lm1 |= HCI_LM_ACCEPT; 394623691d75SGustavo F. Padovan if (c->role_switch) 39470a708f8fSGustavo F. Padovan lm1 |= HCI_LM_MASTER; 39480a708f8fSGustavo F. Padovan exact++; 39490a708f8fSGustavo F. Padovan } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) { 39500a708f8fSGustavo F. Padovan lm2 |= HCI_LM_ACCEPT; 395123691d75SGustavo F. Padovan if (c->role_switch) 39520a708f8fSGustavo F. Padovan lm2 |= HCI_LM_MASTER; 39530a708f8fSGustavo F. Padovan } 39540a708f8fSGustavo F. Padovan } 395523691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 39560a708f8fSGustavo F. Padovan 39570a708f8fSGustavo F. Padovan return exact ? lm1 : lm2; 39580a708f8fSGustavo F. Padovan } 39590a708f8fSGustavo F. Padovan 39600a708f8fSGustavo F. Padovan static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 39610a708f8fSGustavo F. Padovan { 39620a708f8fSGustavo F. Padovan struct l2cap_conn *conn; 39630a708f8fSGustavo F. Padovan 39640a708f8fSGustavo F. Padovan BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status); 39650a708f8fSGustavo F. Padovan 3966acd7d370SVille Tervo if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK)) 39670a708f8fSGustavo F. Padovan return -EINVAL; 39680a708f8fSGustavo F. Padovan 39690a708f8fSGustavo F. Padovan if (!status) { 39700a708f8fSGustavo F. Padovan conn = l2cap_conn_add(hcon, status); 39710a708f8fSGustavo F. Padovan if (conn) 39720a708f8fSGustavo F. Padovan l2cap_conn_ready(conn); 39730a708f8fSGustavo F. Padovan } else 3974e175072fSJoe Perches l2cap_conn_del(hcon, bt_to_errno(status)); 39750a708f8fSGustavo F. Padovan 39760a708f8fSGustavo F. Padovan return 0; 39770a708f8fSGustavo F. Padovan } 39780a708f8fSGustavo F. Padovan 39790a708f8fSGustavo F. Padovan static int l2cap_disconn_ind(struct hci_conn *hcon) 39800a708f8fSGustavo F. Padovan { 39810a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 39820a708f8fSGustavo F. Padovan 39830a708f8fSGustavo F. Padovan BT_DBG("hcon %p", hcon); 39840a708f8fSGustavo F. Padovan 3985b5694506SGustavo F. Padovan if ((hcon->type != ACL_LINK && hcon->type != LE_LINK) || !conn) 39860a708f8fSGustavo F. Padovan return 0x13; 39870a708f8fSGustavo F. Padovan 39880a708f8fSGustavo F. Padovan return conn->disc_reason; 39890a708f8fSGustavo F. Padovan } 39900a708f8fSGustavo F. Padovan 39910a708f8fSGustavo F. Padovan static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 39920a708f8fSGustavo F. Padovan { 39930a708f8fSGustavo F. Padovan BT_DBG("hcon %p reason %d", hcon, reason); 39940a708f8fSGustavo F. Padovan 3995acd7d370SVille Tervo if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK)) 39960a708f8fSGustavo F. Padovan return -EINVAL; 39970a708f8fSGustavo F. Padovan 3998e175072fSJoe Perches l2cap_conn_del(hcon, bt_to_errno(reason)); 39990a708f8fSGustavo F. Padovan 40000a708f8fSGustavo F. Padovan return 0; 40010a708f8fSGustavo F. Padovan } 40020a708f8fSGustavo F. Padovan 40034343478fSGustavo F. Padovan static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 40040a708f8fSGustavo F. Padovan { 4005715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 40060a708f8fSGustavo F. Padovan return; 40070a708f8fSGustavo F. Padovan 40080a708f8fSGustavo F. Padovan if (encrypt == 0x00) { 40094343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_MEDIUM) { 4010c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 4011f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_ENC_TIMEOUT); 40124343478fSGustavo F. Padovan } else if (chan->sec_level == BT_SECURITY_HIGH) 40130f852724SGustavo F. Padovan l2cap_chan_close(chan, ECONNREFUSED); 40140a708f8fSGustavo F. Padovan } else { 40154343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_MEDIUM) 4016c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 40170a708f8fSGustavo F. Padovan } 40180a708f8fSGustavo F. Padovan } 40190a708f8fSGustavo F. Padovan 40200a708f8fSGustavo F. Padovan static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 40210a708f8fSGustavo F. Padovan { 40220a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 402348454079SGustavo F. Padovan struct l2cap_chan *chan; 40240a708f8fSGustavo F. Padovan 40250a708f8fSGustavo F. Padovan if (!conn) 40260a708f8fSGustavo F. Padovan return 0; 40270a708f8fSGustavo F. Padovan 40280a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 40290a708f8fSGustavo F. Padovan 4030160dc6acSVinicius Costa Gomes if (hcon->type == LE_LINK) { 4031160dc6acSVinicius Costa Gomes smp_distribute_keys(conn, 0); 4032160dc6acSVinicius Costa Gomes del_timer(&conn->security_timer); 4033160dc6acSVinicius Costa Gomes } 4034160dc6acSVinicius Costa Gomes 4035baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 40360a708f8fSGustavo F. Padovan 4037baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 403848454079SGustavo F. Padovan struct sock *sk = chan->sk; 4039baa7e1faSGustavo F. Padovan 40400a708f8fSGustavo F. Padovan bh_lock_sock(sk); 40410a708f8fSGustavo F. Padovan 4042f1cb9af5SVinicius Costa Gomes BT_DBG("chan->scid %d", chan->scid); 4043f1cb9af5SVinicius Costa Gomes 4044f1cb9af5SVinicius Costa Gomes if (chan->scid == L2CAP_CID_LE_DATA) { 4045f1cb9af5SVinicius Costa Gomes if (!status && encrypt) { 4046f1cb9af5SVinicius Costa Gomes chan->sec_level = hcon->sec_level; 4047f1cb9af5SVinicius Costa Gomes l2cap_chan_ready(sk); 4048f1cb9af5SVinicius Costa Gomes } 4049f1cb9af5SVinicius Costa Gomes 4050f1cb9af5SVinicius Costa Gomes bh_unlock_sock(sk); 4051f1cb9af5SVinicius Costa Gomes continue; 4052f1cb9af5SVinicius Costa Gomes } 4053f1cb9af5SVinicius Costa Gomes 4054c1360a1cSGustavo F. Padovan if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) { 40550a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 40560a708f8fSGustavo F. Padovan continue; 40570a708f8fSGustavo F. Padovan } 40580a708f8fSGustavo F. Padovan 405989bc500eSGustavo F. Padovan if (!status && (chan->state == BT_CONNECTED || 406089bc500eSGustavo F. Padovan chan->state == BT_CONFIG)) { 40614343478fSGustavo F. Padovan l2cap_check_encryption(chan, encrypt); 40620a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 40630a708f8fSGustavo F. Padovan continue; 40640a708f8fSGustavo F. Padovan } 40650a708f8fSGustavo F. Padovan 406689bc500eSGustavo F. Padovan if (chan->state == BT_CONNECT) { 40670a708f8fSGustavo F. Padovan if (!status) { 40680a708f8fSGustavo F. Padovan struct l2cap_conn_req req; 4069fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 4070fe4128e0SGustavo F. Padovan req.psm = chan->psm; 40710a708f8fSGustavo F. Padovan 4072fc7f8a7eSGustavo F. Padovan chan->ident = l2cap_get_ident(conn); 4073c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 40740a708f8fSGustavo F. Padovan 4075fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, 40760a708f8fSGustavo F. Padovan L2CAP_CONN_REQ, sizeof(req), &req); 40770a708f8fSGustavo F. Padovan } else { 4078c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 4079f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 40800a708f8fSGustavo F. Padovan } 408189bc500eSGustavo F. Padovan } else if (chan->state == BT_CONNECT2) { 40820a708f8fSGustavo F. Padovan struct l2cap_conn_rsp rsp; 4083df3c3931SJohan Hedberg __u16 res, stat; 40840a708f8fSGustavo F. Padovan 40850a708f8fSGustavo F. Padovan if (!status) { 4086df3c3931SJohan Hedberg if (bt_sk(sk)->defer_setup) { 4087df3c3931SJohan Hedberg struct sock *parent = bt_sk(sk)->parent; 4088df3c3931SJohan Hedberg res = L2CAP_CR_PEND; 4089df3c3931SJohan Hedberg stat = L2CAP_CS_AUTHOR_PEND; 409005e9a2f6SIlia Kolomisnky if (parent) 4091df3c3931SJohan Hedberg parent->sk_data_ready(parent, 0); 4092df3c3931SJohan Hedberg } else { 409389bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 4094df3c3931SJohan Hedberg res = L2CAP_CR_SUCCESS; 4095df3c3931SJohan Hedberg stat = L2CAP_CS_NO_INFO; 4096df3c3931SJohan Hedberg } 40970a708f8fSGustavo F. Padovan } else { 409889bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 4099f3f668b0SAndrzej Kaczmarek __set_chan_timer(chan, L2CAP_DISC_TIMEOUT); 4100df3c3931SJohan Hedberg res = L2CAP_CR_SEC_BLOCK; 4101df3c3931SJohan Hedberg stat = L2CAP_CS_NO_INFO; 41020a708f8fSGustavo F. Padovan } 41030a708f8fSGustavo F. Padovan 4104fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 4105fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 4106df3c3931SJohan Hedberg rsp.result = cpu_to_le16(res); 4107df3c3931SJohan Hedberg rsp.status = cpu_to_le16(stat); 4108fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 4109fc7f8a7eSGustavo F. Padovan sizeof(rsp), &rsp); 41100a708f8fSGustavo F. Padovan } 41110a708f8fSGustavo F. Padovan 41120a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 41130a708f8fSGustavo F. Padovan } 41140a708f8fSGustavo F. Padovan 4115baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 41160a708f8fSGustavo F. Padovan 41170a708f8fSGustavo F. Padovan return 0; 41180a708f8fSGustavo F. Padovan } 41190a708f8fSGustavo F. Padovan 41200a708f8fSGustavo F. Padovan static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) 41210a708f8fSGustavo F. Padovan { 41220a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 41230a708f8fSGustavo F. Padovan 41240a708f8fSGustavo F. Padovan if (!conn) 41250a708f8fSGustavo F. Padovan conn = l2cap_conn_add(hcon, 0); 41260a708f8fSGustavo F. Padovan 41270a708f8fSGustavo F. Padovan if (!conn) 41280a708f8fSGustavo F. Padovan goto drop; 41290a708f8fSGustavo F. Padovan 41300a708f8fSGustavo F. Padovan BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags); 41310a708f8fSGustavo F. Padovan 41320a708f8fSGustavo F. Padovan if (!(flags & ACL_CONT)) { 41330a708f8fSGustavo F. Padovan struct l2cap_hdr *hdr; 413448454079SGustavo F. Padovan struct l2cap_chan *chan; 41350a708f8fSGustavo F. Padovan u16 cid; 41360a708f8fSGustavo F. Padovan int len; 41370a708f8fSGustavo F. Padovan 41380a708f8fSGustavo F. Padovan if (conn->rx_len) { 41390a708f8fSGustavo F. Padovan BT_ERR("Unexpected start frame (len %d)", skb->len); 41400a708f8fSGustavo F. Padovan kfree_skb(conn->rx_skb); 41410a708f8fSGustavo F. Padovan conn->rx_skb = NULL; 41420a708f8fSGustavo F. Padovan conn->rx_len = 0; 41430a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 41440a708f8fSGustavo F. Padovan } 41450a708f8fSGustavo F. Padovan 41460a708f8fSGustavo F. Padovan /* Start fragment always begin with Basic L2CAP header */ 41470a708f8fSGustavo F. Padovan if (skb->len < L2CAP_HDR_SIZE) { 41480a708f8fSGustavo F. Padovan BT_ERR("Frame is too short (len %d)", skb->len); 41490a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 41500a708f8fSGustavo F. Padovan goto drop; 41510a708f8fSGustavo F. Padovan } 41520a708f8fSGustavo F. Padovan 41530a708f8fSGustavo F. Padovan hdr = (struct l2cap_hdr *) skb->data; 41540a708f8fSGustavo F. Padovan len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE; 41550a708f8fSGustavo F. Padovan cid = __le16_to_cpu(hdr->cid); 41560a708f8fSGustavo F. Padovan 41570a708f8fSGustavo F. Padovan if (len == skb->len) { 41580a708f8fSGustavo F. Padovan /* Complete frame received */ 41590a708f8fSGustavo F. Padovan l2cap_recv_frame(conn, skb); 41600a708f8fSGustavo F. Padovan return 0; 41610a708f8fSGustavo F. Padovan } 41620a708f8fSGustavo F. Padovan 41630a708f8fSGustavo F. Padovan BT_DBG("Start: total len %d, frag len %d", len, skb->len); 41640a708f8fSGustavo F. Padovan 41650a708f8fSGustavo F. Padovan if (skb->len > len) { 41660a708f8fSGustavo F. Padovan BT_ERR("Frame is too long (len %d, expected len %d)", 41670a708f8fSGustavo F. Padovan skb->len, len); 41680a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 41690a708f8fSGustavo F. Padovan goto drop; 41700a708f8fSGustavo F. Padovan } 41710a708f8fSGustavo F. Padovan 4172baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, cid); 41730a708f8fSGustavo F. Padovan 417448454079SGustavo F. Padovan if (chan && chan->sk) { 417548454079SGustavo F. Padovan struct sock *sk = chan->sk; 417648454079SGustavo F. Padovan 41770c1bc5c6SGustavo F. Padovan if (chan->imtu < len - L2CAP_HDR_SIZE) { 417848454079SGustavo F. Padovan BT_ERR("Frame exceeding recv MTU (len %d, " 417948454079SGustavo F. Padovan "MTU %d)", len, 41800c1bc5c6SGustavo F. Padovan chan->imtu); 41810a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 41820a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 41830a708f8fSGustavo F. Padovan goto drop; 41840a708f8fSGustavo F. Padovan } 41850a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 418648454079SGustavo F. Padovan } 41870a708f8fSGustavo F. Padovan 41880a708f8fSGustavo F. Padovan /* Allocate skb for the complete frame (with header) */ 41890a708f8fSGustavo F. Padovan conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC); 41900a708f8fSGustavo F. Padovan if (!conn->rx_skb) 41910a708f8fSGustavo F. Padovan goto drop; 41920a708f8fSGustavo F. Padovan 41930a708f8fSGustavo F. Padovan skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), 41940a708f8fSGustavo F. Padovan skb->len); 41950a708f8fSGustavo F. Padovan conn->rx_len = len - skb->len; 41960a708f8fSGustavo F. Padovan } else { 41970a708f8fSGustavo F. Padovan BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len); 41980a708f8fSGustavo F. Padovan 41990a708f8fSGustavo F. Padovan if (!conn->rx_len) { 42000a708f8fSGustavo F. Padovan BT_ERR("Unexpected continuation frame (len %d)", skb->len); 42010a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 42020a708f8fSGustavo F. Padovan goto drop; 42030a708f8fSGustavo F. Padovan } 42040a708f8fSGustavo F. Padovan 42050a708f8fSGustavo F. Padovan if (skb->len > conn->rx_len) { 42060a708f8fSGustavo F. Padovan BT_ERR("Fragment is too long (len %d, expected %d)", 42070a708f8fSGustavo F. Padovan skb->len, conn->rx_len); 42080a708f8fSGustavo F. Padovan kfree_skb(conn->rx_skb); 42090a708f8fSGustavo F. Padovan conn->rx_skb = NULL; 42100a708f8fSGustavo F. Padovan conn->rx_len = 0; 42110a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 42120a708f8fSGustavo F. Padovan goto drop; 42130a708f8fSGustavo F. Padovan } 42140a708f8fSGustavo F. Padovan 42150a708f8fSGustavo F. Padovan skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), 42160a708f8fSGustavo F. Padovan skb->len); 42170a708f8fSGustavo F. Padovan conn->rx_len -= skb->len; 42180a708f8fSGustavo F. Padovan 42190a708f8fSGustavo F. Padovan if (!conn->rx_len) { 42200a708f8fSGustavo F. Padovan /* Complete frame received */ 42210a708f8fSGustavo F. Padovan l2cap_recv_frame(conn, conn->rx_skb); 42220a708f8fSGustavo F. Padovan conn->rx_skb = NULL; 42230a708f8fSGustavo F. Padovan } 42240a708f8fSGustavo F. Padovan } 42250a708f8fSGustavo F. Padovan 42260a708f8fSGustavo F. Padovan drop: 42270a708f8fSGustavo F. Padovan kfree_skb(skb); 42280a708f8fSGustavo F. Padovan return 0; 42290a708f8fSGustavo F. Padovan } 42300a708f8fSGustavo F. Padovan 42310a708f8fSGustavo F. Padovan static int l2cap_debugfs_show(struct seq_file *f, void *p) 42320a708f8fSGustavo F. Padovan { 423323691d75SGustavo F. Padovan struct l2cap_chan *c; 42340a708f8fSGustavo F. Padovan 423523691d75SGustavo F. Padovan read_lock_bh(&chan_list_lock); 42360a708f8fSGustavo F. Padovan 423723691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 423823691d75SGustavo F. Padovan struct sock *sk = c->sk; 42390a708f8fSGustavo F. Padovan 4240903d343eSGustavo F. Padovan seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 42410a708f8fSGustavo F. Padovan batostr(&bt_sk(sk)->src), 42420a708f8fSGustavo F. Padovan batostr(&bt_sk(sk)->dst), 424389bc500eSGustavo F. Padovan c->state, __le16_to_cpu(c->psm), 424423691d75SGustavo F. Padovan c->scid, c->dcid, c->imtu, c->omtu, 424523691d75SGustavo F. Padovan c->sec_level, c->mode); 42460a708f8fSGustavo F. Padovan } 42470a708f8fSGustavo F. Padovan 424823691d75SGustavo F. Padovan read_unlock_bh(&chan_list_lock); 42490a708f8fSGustavo F. Padovan 42500a708f8fSGustavo F. Padovan return 0; 42510a708f8fSGustavo F. Padovan } 42520a708f8fSGustavo F. Padovan 42530a708f8fSGustavo F. Padovan static int l2cap_debugfs_open(struct inode *inode, struct file *file) 42540a708f8fSGustavo F. Padovan { 42550a708f8fSGustavo F. Padovan return single_open(file, l2cap_debugfs_show, inode->i_private); 42560a708f8fSGustavo F. Padovan } 42570a708f8fSGustavo F. Padovan 42580a708f8fSGustavo F. Padovan static const struct file_operations l2cap_debugfs_fops = { 42590a708f8fSGustavo F. Padovan .open = l2cap_debugfs_open, 42600a708f8fSGustavo F. Padovan .read = seq_read, 42610a708f8fSGustavo F. Padovan .llseek = seq_lseek, 42620a708f8fSGustavo F. Padovan .release = single_release, 42630a708f8fSGustavo F. Padovan }; 42640a708f8fSGustavo F. Padovan 42650a708f8fSGustavo F. Padovan static struct dentry *l2cap_debugfs; 42660a708f8fSGustavo F. Padovan 42670a708f8fSGustavo F. Padovan static struct hci_proto l2cap_hci_proto = { 42680a708f8fSGustavo F. Padovan .name = "L2CAP", 42690a708f8fSGustavo F. Padovan .id = HCI_PROTO_L2CAP, 42700a708f8fSGustavo F. Padovan .connect_ind = l2cap_connect_ind, 42710a708f8fSGustavo F. Padovan .connect_cfm = l2cap_connect_cfm, 42720a708f8fSGustavo F. Padovan .disconn_ind = l2cap_disconn_ind, 42730a708f8fSGustavo F. Padovan .disconn_cfm = l2cap_disconn_cfm, 42740a708f8fSGustavo F. Padovan .security_cfm = l2cap_security_cfm, 42750a708f8fSGustavo F. Padovan .recv_acldata = l2cap_recv_acldata 42760a708f8fSGustavo F. Padovan }; 42770a708f8fSGustavo F. Padovan 427864274518SGustavo F. Padovan int __init l2cap_init(void) 42790a708f8fSGustavo F. Padovan { 42800a708f8fSGustavo F. Padovan int err; 42810a708f8fSGustavo F. Padovan 4282bb58f747SGustavo F. Padovan err = l2cap_init_sockets(); 42830a708f8fSGustavo F. Padovan if (err < 0) 42840a708f8fSGustavo F. Padovan return err; 42850a708f8fSGustavo F. Padovan 42860a708f8fSGustavo F. Padovan err = hci_register_proto(&l2cap_hci_proto); 42870a708f8fSGustavo F. Padovan if (err < 0) { 42880a708f8fSGustavo F. Padovan BT_ERR("L2CAP protocol registration failed"); 42890a708f8fSGustavo F. Padovan bt_sock_unregister(BTPROTO_L2CAP); 42900a708f8fSGustavo F. Padovan goto error; 42910a708f8fSGustavo F. Padovan } 42920a708f8fSGustavo F. Padovan 42930a708f8fSGustavo F. Padovan if (bt_debugfs) { 42940a708f8fSGustavo F. Padovan l2cap_debugfs = debugfs_create_file("l2cap", 0444, 42950a708f8fSGustavo F. Padovan bt_debugfs, NULL, &l2cap_debugfs_fops); 42960a708f8fSGustavo F. Padovan if (!l2cap_debugfs) 42970a708f8fSGustavo F. Padovan BT_ERR("Failed to create L2CAP debug file"); 42980a708f8fSGustavo F. Padovan } 42990a708f8fSGustavo F. Padovan 43000a708f8fSGustavo F. Padovan return 0; 43010a708f8fSGustavo F. Padovan 43020a708f8fSGustavo F. Padovan error: 4303bb58f747SGustavo F. Padovan l2cap_cleanup_sockets(); 43040a708f8fSGustavo F. Padovan return err; 43050a708f8fSGustavo F. Padovan } 43060a708f8fSGustavo F. Padovan 430764274518SGustavo F. Padovan void l2cap_exit(void) 43080a708f8fSGustavo F. Padovan { 43090a708f8fSGustavo F. Padovan debugfs_remove(l2cap_debugfs); 43100a708f8fSGustavo F. Padovan 43110a708f8fSGustavo F. Padovan if (hci_unregister_proto(&l2cap_hci_proto) < 0) 43120a708f8fSGustavo F. Padovan BT_ERR("L2CAP protocol unregistration failed"); 43130a708f8fSGustavo F. Padovan 4314bb58f747SGustavo F. Padovan l2cap_cleanup_sockets(); 43150a708f8fSGustavo F. Padovan } 43160a708f8fSGustavo F. Padovan 43170a708f8fSGustavo F. Padovan module_param(disable_ertm, bool, 0644); 43180a708f8fSGustavo F. Padovan MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 4319