10a708f8fSGustavo F. Padovan /* 20a708f8fSGustavo F. Padovan BlueZ - Bluetooth protocol stack for Linux 30a708f8fSGustavo F. Padovan Copyright (C) 2000-2001 Qualcomm Incorporated 40a708f8fSGustavo F. Padovan Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org> 50a708f8fSGustavo F. Padovan Copyright (C) 2010 Google Inc. 60a708f8fSGustavo F. Padovan 70a708f8fSGustavo F. Padovan Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 80a708f8fSGustavo F. Padovan 90a708f8fSGustavo F. Padovan This program is free software; you can redistribute it and/or modify 100a708f8fSGustavo F. Padovan it under the terms of the GNU General Public License version 2 as 110a708f8fSGustavo F. Padovan published by the Free Software Foundation; 120a708f8fSGustavo F. Padovan 130a708f8fSGustavo F. Padovan THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 140a708f8fSGustavo F. Padovan OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 150a708f8fSGustavo F. Padovan FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 160a708f8fSGustavo F. Padovan IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 170a708f8fSGustavo F. Padovan CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 180a708f8fSGustavo F. Padovan WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 190a708f8fSGustavo F. Padovan ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 200a708f8fSGustavo F. Padovan OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 210a708f8fSGustavo F. Padovan 220a708f8fSGustavo F. Padovan ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 230a708f8fSGustavo F. Padovan COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 240a708f8fSGustavo F. Padovan SOFTWARE IS DISCLAIMED. 250a708f8fSGustavo F. Padovan */ 260a708f8fSGustavo F. Padovan 27bb58f747SGustavo F. Padovan /* Bluetooth L2CAP core. */ 280a708f8fSGustavo F. Padovan 290a708f8fSGustavo F. Padovan #include <linux/module.h> 300a708f8fSGustavo F. Padovan 310a708f8fSGustavo F. Padovan #include <linux/types.h> 320a708f8fSGustavo F. Padovan #include <linux/capability.h> 330a708f8fSGustavo F. Padovan #include <linux/errno.h> 340a708f8fSGustavo F. Padovan #include <linux/kernel.h> 350a708f8fSGustavo F. Padovan #include <linux/sched.h> 360a708f8fSGustavo F. Padovan #include <linux/slab.h> 370a708f8fSGustavo F. Padovan #include <linux/poll.h> 380a708f8fSGustavo F. Padovan #include <linux/fcntl.h> 390a708f8fSGustavo F. Padovan #include <linux/init.h> 400a708f8fSGustavo F. Padovan #include <linux/interrupt.h> 410a708f8fSGustavo F. Padovan #include <linux/socket.h> 420a708f8fSGustavo F. Padovan #include <linux/skbuff.h> 430a708f8fSGustavo F. Padovan #include <linux/list.h> 440a708f8fSGustavo F. Padovan #include <linux/device.h> 450a708f8fSGustavo F. Padovan #include <linux/debugfs.h> 460a708f8fSGustavo F. Padovan #include <linux/seq_file.h> 470a708f8fSGustavo F. Padovan #include <linux/uaccess.h> 480a708f8fSGustavo F. Padovan #include <linux/crc16.h> 490a708f8fSGustavo F. Padovan #include <net/sock.h> 500a708f8fSGustavo F. Padovan 510a708f8fSGustavo F. Padovan #include <asm/system.h> 520a708f8fSGustavo F. Padovan #include <asm/unaligned.h> 530a708f8fSGustavo F. Padovan 540a708f8fSGustavo F. Padovan #include <net/bluetooth/bluetooth.h> 550a708f8fSGustavo F. Padovan #include <net/bluetooth/hci_core.h> 560a708f8fSGustavo F. Padovan #include <net/bluetooth/l2cap.h> 57b501d6a1SAnderson Briglia #include <net/bluetooth/smp.h> 580a708f8fSGustavo F. Padovan 59bb58f747SGustavo F. Padovan int disable_ertm; 60a5fd6f30SAndrei Emeltchenko int enable_hs; 610a708f8fSGustavo F. Padovan 620a708f8fSGustavo F. Padovan static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN; 630a708f8fSGustavo F. Padovan static u8 l2cap_fixed_chan[8] = { 0x02, }; 640a708f8fSGustavo F. Padovan 65b5ad8b7fSJohannes Berg static LIST_HEAD(chan_list); 66b5ad8b7fSJohannes Berg static DEFINE_RWLOCK(chan_list_lock); 670a708f8fSGustavo F. Padovan 680a708f8fSGustavo F. Padovan static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 690a708f8fSGustavo F. Padovan u8 code, u8 ident, u16 dlen, void *data); 704519de9aSGustavo F. Padovan static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, 714519de9aSGustavo F. Padovan void *data); 72710f9b0aSGustavo F. Padovan static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); 734519de9aSGustavo F. Padovan static void l2cap_send_disconn_req(struct l2cap_conn *conn, 744519de9aSGustavo F. Padovan struct l2cap_chan *chan, int err); 750a708f8fSGustavo F. Padovan 760a708f8fSGustavo F. Padovan static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb); 770a708f8fSGustavo F. Padovan 780a708f8fSGustavo F. Padovan /* ---- L2CAP channels ---- */ 7971ba0e56SGustavo F. Padovan 8071ba0e56SGustavo F. Padovan static inline void chan_hold(struct l2cap_chan *c) 8171ba0e56SGustavo F. Padovan { 8271ba0e56SGustavo F. Padovan atomic_inc(&c->refcnt); 8371ba0e56SGustavo F. Padovan } 8471ba0e56SGustavo F. Padovan 8571ba0e56SGustavo F. Padovan static inline void chan_put(struct l2cap_chan *c) 8671ba0e56SGustavo F. Padovan { 8771ba0e56SGustavo F. Padovan if (atomic_dec_and_test(&c->refcnt)) 8871ba0e56SGustavo F. Padovan kfree(c); 8971ba0e56SGustavo F. Padovan } 9071ba0e56SGustavo F. Padovan 91baa7e1faSGustavo F. Padovan static struct l2cap_chan *__l2cap_get_chan_by_dcid(struct l2cap_conn *conn, u16 cid) 920a708f8fSGustavo F. Padovan { 9348454079SGustavo F. Padovan struct l2cap_chan *c; 94baa7e1faSGustavo F. Padovan 95baa7e1faSGustavo F. Padovan list_for_each_entry(c, &conn->chan_l, list) { 96fe4128e0SGustavo F. Padovan if (c->dcid == cid) 9748454079SGustavo F. Padovan return c; 980a708f8fSGustavo F. Padovan } 99baa7e1faSGustavo F. Padovan return NULL; 100baa7e1faSGustavo F. Padovan 101baa7e1faSGustavo F. Padovan } 1020a708f8fSGustavo F. Padovan 103baa7e1faSGustavo F. Padovan static struct l2cap_chan *__l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) 1040a708f8fSGustavo F. Padovan { 10548454079SGustavo F. Padovan struct l2cap_chan *c; 106baa7e1faSGustavo F. Padovan 107baa7e1faSGustavo F. Padovan list_for_each_entry(c, &conn->chan_l, list) { 108fe4128e0SGustavo F. Padovan if (c->scid == cid) 10948454079SGustavo F. Padovan return c; 1100a708f8fSGustavo F. Padovan } 111baa7e1faSGustavo F. Padovan return NULL; 112baa7e1faSGustavo F. Padovan } 1130a708f8fSGustavo F. Padovan 1140a708f8fSGustavo F. Padovan /* Find channel with given SCID. 1150a708f8fSGustavo F. Padovan * Returns locked socket */ 116baa7e1faSGustavo F. Padovan static struct l2cap_chan *l2cap_get_chan_by_scid(struct l2cap_conn *conn, u16 cid) 1170a708f8fSGustavo F. Padovan { 11848454079SGustavo F. Padovan struct l2cap_chan *c; 119baa7e1faSGustavo F. Padovan 120baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 121baa7e1faSGustavo F. Padovan c = __l2cap_get_chan_by_scid(conn, cid); 12248454079SGustavo F. Padovan if (c) 12348454079SGustavo F. Padovan bh_lock_sock(c->sk); 124baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 12548454079SGustavo F. Padovan return c; 1260a708f8fSGustavo F. Padovan } 1270a708f8fSGustavo F. Padovan 128baa7e1faSGustavo F. Padovan static struct l2cap_chan *__l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident) 1290a708f8fSGustavo F. Padovan { 13048454079SGustavo F. Padovan struct l2cap_chan *c; 131baa7e1faSGustavo F. Padovan 132baa7e1faSGustavo F. Padovan list_for_each_entry(c, &conn->chan_l, list) { 133fc7f8a7eSGustavo F. Padovan if (c->ident == ident) 13448454079SGustavo F. Padovan return c; 1350a708f8fSGustavo F. Padovan } 136baa7e1faSGustavo F. Padovan return NULL; 137baa7e1faSGustavo F. Padovan } 1380a708f8fSGustavo F. Padovan 139baa7e1faSGustavo F. Padovan static inline struct l2cap_chan *l2cap_get_chan_by_ident(struct l2cap_conn *conn, u8 ident) 1400a708f8fSGustavo F. Padovan { 14148454079SGustavo F. Padovan struct l2cap_chan *c; 142baa7e1faSGustavo F. Padovan 143baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 144baa7e1faSGustavo F. Padovan c = __l2cap_get_chan_by_ident(conn, ident); 14548454079SGustavo F. Padovan if (c) 14648454079SGustavo F. Padovan bh_lock_sock(c->sk); 147baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 14848454079SGustavo F. Padovan return c; 1490a708f8fSGustavo F. Padovan } 1500a708f8fSGustavo F. Padovan 15123691d75SGustavo F. Padovan static struct l2cap_chan *__l2cap_global_chan_by_addr(__le16 psm, bdaddr_t *src) 1529e4425ffSGustavo F. Padovan { 15323691d75SGustavo F. Padovan struct l2cap_chan *c; 1549e4425ffSGustavo F. Padovan 15523691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 15623691d75SGustavo F. Padovan if (c->sport == psm && !bacmp(&bt_sk(c->sk)->src, src)) 1579e4425ffSGustavo F. Padovan goto found; 1589e4425ffSGustavo F. Padovan } 1599e4425ffSGustavo F. Padovan 16023691d75SGustavo F. Padovan c = NULL; 1619e4425ffSGustavo F. Padovan found: 16223691d75SGustavo F. Padovan return c; 1639e4425ffSGustavo F. Padovan } 1649e4425ffSGustavo F. Padovan 1659e4425ffSGustavo F. Padovan int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm) 1669e4425ffSGustavo F. Padovan { 16773b2ec18SGustavo F. Padovan int err; 16873b2ec18SGustavo F. Padovan 16923691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 1709e4425ffSGustavo F. Padovan 17123691d75SGustavo F. Padovan if (psm && __l2cap_global_chan_by_addr(psm, src)) { 17273b2ec18SGustavo F. Padovan err = -EADDRINUSE; 17373b2ec18SGustavo F. Padovan goto done; 1749e4425ffSGustavo F. Padovan } 1759e4425ffSGustavo F. Padovan 17673b2ec18SGustavo F. Padovan if (psm) { 1779e4425ffSGustavo F. Padovan chan->psm = psm; 1789e4425ffSGustavo F. Padovan chan->sport = psm; 17973b2ec18SGustavo F. Padovan err = 0; 18073b2ec18SGustavo F. Padovan } else { 18173b2ec18SGustavo F. Padovan u16 p; 1829e4425ffSGustavo F. Padovan 18373b2ec18SGustavo F. Padovan err = -EINVAL; 18473b2ec18SGustavo F. Padovan for (p = 0x1001; p < 0x1100; p += 2) 18523691d75SGustavo F. Padovan if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) { 18673b2ec18SGustavo F. Padovan chan->psm = cpu_to_le16(p); 18773b2ec18SGustavo F. Padovan chan->sport = cpu_to_le16(p); 18873b2ec18SGustavo F. Padovan err = 0; 18973b2ec18SGustavo F. Padovan break; 19073b2ec18SGustavo F. Padovan } 19173b2ec18SGustavo F. Padovan } 19273b2ec18SGustavo F. Padovan 19373b2ec18SGustavo F. Padovan done: 19423691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 19573b2ec18SGustavo F. Padovan return err; 1969e4425ffSGustavo F. Padovan } 1979e4425ffSGustavo F. Padovan 1989e4425ffSGustavo F. Padovan int l2cap_add_scid(struct l2cap_chan *chan, __u16 scid) 1999e4425ffSGustavo F. Padovan { 20023691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 2019e4425ffSGustavo F. Padovan 2029e4425ffSGustavo F. Padovan chan->scid = scid; 2039e4425ffSGustavo F. Padovan 20423691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 2059e4425ffSGustavo F. Padovan 2069e4425ffSGustavo F. Padovan return 0; 2079e4425ffSGustavo F. Padovan } 2089e4425ffSGustavo F. Padovan 209baa7e1faSGustavo F. Padovan static u16 l2cap_alloc_cid(struct l2cap_conn *conn) 2100a708f8fSGustavo F. Padovan { 2110a708f8fSGustavo F. Padovan u16 cid = L2CAP_CID_DYN_START; 2120a708f8fSGustavo F. Padovan 2130a708f8fSGustavo F. Padovan for (; cid < L2CAP_CID_DYN_END; cid++) { 214baa7e1faSGustavo F. Padovan if (!__l2cap_get_chan_by_scid(conn, cid)) 2150a708f8fSGustavo F. Padovan return cid; 2160a708f8fSGustavo F. Padovan } 2170a708f8fSGustavo F. Padovan 2180a708f8fSGustavo F. Padovan return 0; 2190a708f8fSGustavo F. Padovan } 2200a708f8fSGustavo F. Padovan 221c9b66675SGustavo F. Padovan static void l2cap_set_timer(struct l2cap_chan *chan, struct timer_list *timer, long timeout) 222ab07801dSGustavo F. Padovan { 22389bc500eSGustavo F. Padovan BT_DBG("chan %p state %d timeout %ld", chan->sk, chan->state, timeout); 22489bc500eSGustavo F. Padovan 225942ecc9cSMat Martineau if (!mod_timer(timer, jiffies + msecs_to_jiffies(timeout))) 22671ba0e56SGustavo F. Padovan chan_hold(chan); 227ab07801dSGustavo F. Padovan } 228ab07801dSGustavo F. Padovan 229c9b66675SGustavo F. Padovan static void l2cap_clear_timer(struct l2cap_chan *chan, struct timer_list *timer) 230ab07801dSGustavo F. Padovan { 23189bc500eSGustavo F. Padovan BT_DBG("chan %p state %d", chan, chan->state); 232ab07801dSGustavo F. Padovan 233c9b66675SGustavo F. Padovan if (timer_pending(timer) && del_timer(timer)) 23471ba0e56SGustavo F. Padovan chan_put(chan); 235ab07801dSGustavo F. Padovan } 236ab07801dSGustavo F. Padovan 23789bc500eSGustavo F. Padovan static void l2cap_state_change(struct l2cap_chan *chan, int state) 23889bc500eSGustavo F. Padovan { 23989bc500eSGustavo F. Padovan chan->state = state; 24089bc500eSGustavo F. Padovan chan->ops->state_change(chan->data, state); 24189bc500eSGustavo F. Padovan } 24289bc500eSGustavo F. Padovan 243ab07801dSGustavo F. Padovan static void l2cap_chan_timeout(unsigned long arg) 244ab07801dSGustavo F. Padovan { 245ab07801dSGustavo F. Padovan struct l2cap_chan *chan = (struct l2cap_chan *) arg; 246ab07801dSGustavo F. Padovan struct sock *sk = chan->sk; 247ab07801dSGustavo F. Padovan int reason; 248ab07801dSGustavo F. Padovan 24989bc500eSGustavo F. Padovan BT_DBG("chan %p state %d", chan, chan->state); 250ab07801dSGustavo F. Padovan 251ab07801dSGustavo F. Padovan bh_lock_sock(sk); 252ab07801dSGustavo F. Padovan 253ab07801dSGustavo F. Padovan if (sock_owned_by_user(sk)) { 254ab07801dSGustavo F. Padovan /* sk is owned by user. Try again later */ 255c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ / 5); 256ab07801dSGustavo F. Padovan bh_unlock_sock(sk); 25771ba0e56SGustavo F. Padovan chan_put(chan); 258ab07801dSGustavo F. Padovan return; 259ab07801dSGustavo F. Padovan } 260ab07801dSGustavo F. Padovan 26189bc500eSGustavo F. Padovan if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG) 262ab07801dSGustavo F. Padovan reason = ECONNREFUSED; 26389bc500eSGustavo F. Padovan else if (chan->state == BT_CONNECT && 264ab07801dSGustavo F. Padovan chan->sec_level != BT_SECURITY_SDP) 265ab07801dSGustavo F. Padovan reason = ECONNREFUSED; 266ab07801dSGustavo F. Padovan else 267ab07801dSGustavo F. Padovan reason = ETIMEDOUT; 268ab07801dSGustavo F. Padovan 2690f852724SGustavo F. Padovan l2cap_chan_close(chan, reason); 270ab07801dSGustavo F. Padovan 271ab07801dSGustavo F. Padovan bh_unlock_sock(sk); 272ab07801dSGustavo F. Padovan 273ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 27471ba0e56SGustavo F. Padovan chan_put(chan); 275ab07801dSGustavo F. Padovan } 276ab07801dSGustavo F. Padovan 27723691d75SGustavo F. Padovan struct l2cap_chan *l2cap_chan_create(struct sock *sk) 2780a708f8fSGustavo F. Padovan { 27948454079SGustavo F. Padovan struct l2cap_chan *chan; 2800a708f8fSGustavo F. Padovan 28148454079SGustavo F. Padovan chan = kzalloc(sizeof(*chan), GFP_ATOMIC); 28248454079SGustavo F. Padovan if (!chan) 28348454079SGustavo F. Padovan return NULL; 2840a708f8fSGustavo F. Padovan 28548454079SGustavo F. Padovan chan->sk = sk; 28648454079SGustavo F. Padovan 28723691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 28823691d75SGustavo F. Padovan list_add(&chan->global_l, &chan_list); 28923691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 29023691d75SGustavo F. Padovan 291ab07801dSGustavo F. Padovan setup_timer(&chan->chan_timer, l2cap_chan_timeout, (unsigned long) chan); 292ab07801dSGustavo F. Padovan 29389bc500eSGustavo F. Padovan chan->state = BT_OPEN; 29489bc500eSGustavo F. Padovan 29571ba0e56SGustavo F. Padovan atomic_set(&chan->refcnt, 1); 29671ba0e56SGustavo F. Padovan 29748454079SGustavo F. Padovan return chan; 2980a708f8fSGustavo F. Padovan } 2990a708f8fSGustavo F. Padovan 30023691d75SGustavo F. Padovan void l2cap_chan_destroy(struct l2cap_chan *chan) 3016ff5abbfSGustavo F. Padovan { 30223691d75SGustavo F. Padovan write_lock_bh(&chan_list_lock); 30323691d75SGustavo F. Padovan list_del(&chan->global_l); 30423691d75SGustavo F. Padovan write_unlock_bh(&chan_list_lock); 30523691d75SGustavo F. Padovan 30671ba0e56SGustavo F. Padovan chan_put(chan); 3076ff5abbfSGustavo F. Padovan } 3086ff5abbfSGustavo F. Padovan 30948454079SGustavo F. Padovan static void __l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 3100a708f8fSGustavo F. Padovan { 3110a708f8fSGustavo F. Padovan BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, 312fe4128e0SGustavo F. Padovan chan->psm, chan->dcid); 3130a708f8fSGustavo F. Padovan 3140a708f8fSGustavo F. Padovan conn->disc_reason = 0x13; 3150a708f8fSGustavo F. Padovan 3168c1d787bSGustavo F. Padovan chan->conn = conn; 3170a708f8fSGustavo F. Padovan 318715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED) { 319b62f328bSVille Tervo if (conn->hcon->type == LE_LINK) { 320b62f328bSVille Tervo /* LE connection */ 3210c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_LE_DEFAULT_MTU; 322fe4128e0SGustavo F. Padovan chan->scid = L2CAP_CID_LE_DATA; 323fe4128e0SGustavo F. Padovan chan->dcid = L2CAP_CID_LE_DATA; 324b62f328bSVille Tervo } else { 3250a708f8fSGustavo F. Padovan /* Alloc CID for connection-oriented socket */ 326fe4128e0SGustavo F. Padovan chan->scid = l2cap_alloc_cid(conn); 3270c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_DEFAULT_MTU; 328b62f328bSVille Tervo } 329715ec005SGustavo F. Padovan } else if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 3300a708f8fSGustavo F. Padovan /* Connectionless socket */ 331fe4128e0SGustavo F. Padovan chan->scid = L2CAP_CID_CONN_LESS; 332fe4128e0SGustavo F. Padovan chan->dcid = L2CAP_CID_CONN_LESS; 3330c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_DEFAULT_MTU; 3340a708f8fSGustavo F. Padovan } else { 3350a708f8fSGustavo F. Padovan /* Raw socket can send/recv signalling messages only */ 336fe4128e0SGustavo F. Padovan chan->scid = L2CAP_CID_SIGNALING; 337fe4128e0SGustavo F. Padovan chan->dcid = L2CAP_CID_SIGNALING; 3380c1bc5c6SGustavo F. Padovan chan->omtu = L2CAP_DEFAULT_MTU; 3390a708f8fSGustavo F. Padovan } 3400a708f8fSGustavo F. Padovan 34171ba0e56SGustavo F. Padovan chan_hold(chan); 342baa7e1faSGustavo F. Padovan 343baa7e1faSGustavo F. Padovan list_add(&chan->list, &conn->chan_l); 3440a708f8fSGustavo F. Padovan } 3450a708f8fSGustavo F. Padovan 3460a708f8fSGustavo F. Padovan /* Delete channel. 3470a708f8fSGustavo F. Padovan * Must be called on the locked socket. */ 3484519de9aSGustavo F. Padovan static void l2cap_chan_del(struct l2cap_chan *chan, int err) 3490a708f8fSGustavo F. Padovan { 35048454079SGustavo F. Padovan struct sock *sk = chan->sk; 3518c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 3520a708f8fSGustavo F. Padovan struct sock *parent = bt_sk(sk)->parent; 3530a708f8fSGustavo F. Padovan 354c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 3550a708f8fSGustavo F. Padovan 35649208c9cSGustavo F. Padovan BT_DBG("chan %p, conn %p, err %d", chan, conn, err); 3570a708f8fSGustavo F. Padovan 3580a708f8fSGustavo F. Padovan if (conn) { 359baa7e1faSGustavo F. Padovan /* Delete from channel list */ 360baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 361baa7e1faSGustavo F. Padovan list_del(&chan->list); 362baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 36371ba0e56SGustavo F. Padovan chan_put(chan); 364baa7e1faSGustavo F. Padovan 3658c1d787bSGustavo F. Padovan chan->conn = NULL; 3660a708f8fSGustavo F. Padovan hci_conn_put(conn->hcon); 3670a708f8fSGustavo F. Padovan } 3680a708f8fSGustavo F. Padovan 36989bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CLOSED); 3700a708f8fSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 3710a708f8fSGustavo F. Padovan 3720a708f8fSGustavo F. Padovan if (err) 3730a708f8fSGustavo F. Padovan sk->sk_err = err; 3740a708f8fSGustavo F. Padovan 3750a708f8fSGustavo F. Padovan if (parent) { 3760a708f8fSGustavo F. Padovan bt_accept_unlink(sk); 3770a708f8fSGustavo F. Padovan parent->sk_data_ready(parent, 0); 3780a708f8fSGustavo F. Padovan } else 3790a708f8fSGustavo F. Padovan sk->sk_state_change(sk); 3800a708f8fSGustavo F. Padovan 381c1360a1cSGustavo F. Padovan if (!(test_bit(CONF_OUTPUT_DONE, &chan->conf_state) && 382c1360a1cSGustavo F. Padovan test_bit(CONF_INPUT_DONE, &chan->conf_state))) 3836ff5abbfSGustavo F. Padovan return; 3842ead70b8SGustavo F. Padovan 38558d35f87SGustavo F. Padovan skb_queue_purge(&chan->tx_q); 3860a708f8fSGustavo F. Padovan 3870c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) { 3880a708f8fSGustavo F. Padovan struct srej_list *l, *tmp; 3890a708f8fSGustavo F. Padovan 3901a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 3911a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 3921a09bcb9SGustavo F. Padovan __clear_ack_timer(chan); 3930a708f8fSGustavo F. Padovan 394f1c6775bSGustavo F. Padovan skb_queue_purge(&chan->srej_q); 3950a708f8fSGustavo F. Padovan 39639d5a3eeSGustavo F. Padovan list_for_each_entry_safe(l, tmp, &chan->srej_l, list) { 3970a708f8fSGustavo F. Padovan list_del(&l->list); 3980a708f8fSGustavo F. Padovan kfree(l); 3990a708f8fSGustavo F. Padovan } 4000a708f8fSGustavo F. Padovan } 4010a708f8fSGustavo F. Padovan } 4020a708f8fSGustavo F. Padovan 4034519de9aSGustavo F. Padovan static void l2cap_chan_cleanup_listen(struct sock *parent) 4044519de9aSGustavo F. Padovan { 4054519de9aSGustavo F. Padovan struct sock *sk; 4064519de9aSGustavo F. Padovan 4074519de9aSGustavo F. Padovan BT_DBG("parent %p", parent); 4084519de9aSGustavo F. Padovan 4094519de9aSGustavo F. Padovan /* Close not yet accepted channels */ 4100f852724SGustavo F. Padovan while ((sk = bt_accept_dequeue(parent, NULL))) { 411ba3bd0eeSGustavo F. Padovan struct l2cap_chan *chan = l2cap_pi(sk)->chan; 412c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 4130f852724SGustavo F. Padovan lock_sock(sk); 414ba3bd0eeSGustavo F. Padovan l2cap_chan_close(chan, ECONNRESET); 4150f852724SGustavo F. Padovan release_sock(sk); 416ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 4170f852724SGustavo F. Padovan } 4184519de9aSGustavo F. Padovan } 4194519de9aSGustavo F. Padovan 4200f852724SGustavo F. Padovan void l2cap_chan_close(struct l2cap_chan *chan, int reason) 4214519de9aSGustavo F. Padovan { 4224519de9aSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 4234519de9aSGustavo F. Padovan struct sock *sk = chan->sk; 4244519de9aSGustavo F. Padovan 42589bc500eSGustavo F. Padovan BT_DBG("chan %p state %d socket %p", chan, chan->state, sk->sk_socket); 4264519de9aSGustavo F. Padovan 42789bc500eSGustavo F. Padovan switch (chan->state) { 4284519de9aSGustavo F. Padovan case BT_LISTEN: 4294519de9aSGustavo F. Padovan l2cap_chan_cleanup_listen(sk); 43089bc500eSGustavo F. Padovan 43189bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CLOSED); 43289bc500eSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 4334519de9aSGustavo F. Padovan break; 4344519de9aSGustavo F. Padovan 4354519de9aSGustavo F. Padovan case BT_CONNECTED: 4364519de9aSGustavo F. Padovan case BT_CONFIG: 437715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && 4384519de9aSGustavo F. Padovan conn->hcon->type == ACL_LINK) { 439c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 440c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 4414519de9aSGustavo F. Padovan l2cap_send_disconn_req(conn, chan, reason); 4424519de9aSGustavo F. Padovan } else 4434519de9aSGustavo F. Padovan l2cap_chan_del(chan, reason); 4444519de9aSGustavo F. Padovan break; 4454519de9aSGustavo F. Padovan 4464519de9aSGustavo F. Padovan case BT_CONNECT2: 447715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED && 4484519de9aSGustavo F. Padovan conn->hcon->type == ACL_LINK) { 4494519de9aSGustavo F. Padovan struct l2cap_conn_rsp rsp; 4504519de9aSGustavo F. Padovan __u16 result; 4514519de9aSGustavo F. Padovan 4524519de9aSGustavo F. Padovan if (bt_sk(sk)->defer_setup) 4534519de9aSGustavo F. Padovan result = L2CAP_CR_SEC_BLOCK; 4544519de9aSGustavo F. Padovan else 4554519de9aSGustavo F. Padovan result = L2CAP_CR_BAD_PSM; 45689bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 4574519de9aSGustavo F. Padovan 4584519de9aSGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 4594519de9aSGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 4604519de9aSGustavo F. Padovan rsp.result = cpu_to_le16(result); 4614519de9aSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 4624519de9aSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 4634519de9aSGustavo F. Padovan sizeof(rsp), &rsp); 4644519de9aSGustavo F. Padovan } 4654519de9aSGustavo F. Padovan 4664519de9aSGustavo F. Padovan l2cap_chan_del(chan, reason); 4674519de9aSGustavo F. Padovan break; 4684519de9aSGustavo F. Padovan 4694519de9aSGustavo F. Padovan case BT_CONNECT: 4704519de9aSGustavo F. Padovan case BT_DISCONN: 4714519de9aSGustavo F. Padovan l2cap_chan_del(chan, reason); 4724519de9aSGustavo F. Padovan break; 4734519de9aSGustavo F. Padovan 4744519de9aSGustavo F. Padovan default: 4754519de9aSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 4764519de9aSGustavo F. Padovan break; 4774519de9aSGustavo F. Padovan } 4784519de9aSGustavo F. Padovan } 4794519de9aSGustavo F. Padovan 4804343478fSGustavo F. Padovan static inline u8 l2cap_get_auth_type(struct l2cap_chan *chan) 4810a708f8fSGustavo F. Padovan { 482715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_RAW) { 4834343478fSGustavo F. Padovan switch (chan->sec_level) { 4840a708f8fSGustavo F. Padovan case BT_SECURITY_HIGH: 4850a708f8fSGustavo F. Padovan return HCI_AT_DEDICATED_BONDING_MITM; 4860a708f8fSGustavo F. Padovan case BT_SECURITY_MEDIUM: 4870a708f8fSGustavo F. Padovan return HCI_AT_DEDICATED_BONDING; 4880a708f8fSGustavo F. Padovan default: 4890a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING; 4900a708f8fSGustavo F. Padovan } 491fe4128e0SGustavo F. Padovan } else if (chan->psm == cpu_to_le16(0x0001)) { 4924343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_LOW) 4934343478fSGustavo F. Padovan chan->sec_level = BT_SECURITY_SDP; 4940a708f8fSGustavo F. Padovan 4954343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_HIGH) 4960a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING_MITM; 4970a708f8fSGustavo F. Padovan else 4980a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING; 4990a708f8fSGustavo F. Padovan } else { 5004343478fSGustavo F. Padovan switch (chan->sec_level) { 5010a708f8fSGustavo F. Padovan case BT_SECURITY_HIGH: 5020a708f8fSGustavo F. Padovan return HCI_AT_GENERAL_BONDING_MITM; 5030a708f8fSGustavo F. Padovan case BT_SECURITY_MEDIUM: 5040a708f8fSGustavo F. Padovan return HCI_AT_GENERAL_BONDING; 5050a708f8fSGustavo F. Padovan default: 5060a708f8fSGustavo F. Padovan return HCI_AT_NO_BONDING; 5070a708f8fSGustavo F. Padovan } 5080a708f8fSGustavo F. Padovan } 5090a708f8fSGustavo F. Padovan } 5100a708f8fSGustavo F. Padovan 5110a708f8fSGustavo F. Padovan /* Service level security */ 5124343478fSGustavo F. Padovan static inline int l2cap_check_security(struct l2cap_chan *chan) 5130a708f8fSGustavo F. Padovan { 5148c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 5150a708f8fSGustavo F. Padovan __u8 auth_type; 5160a708f8fSGustavo F. Padovan 5174343478fSGustavo F. Padovan auth_type = l2cap_get_auth_type(chan); 5180a708f8fSGustavo F. Padovan 5194343478fSGustavo F. Padovan return hci_conn_security(conn->hcon, chan->sec_level, auth_type); 5200a708f8fSGustavo F. Padovan } 5210a708f8fSGustavo F. Padovan 522b5ad8b7fSJohannes Berg static u8 l2cap_get_ident(struct l2cap_conn *conn) 5230a708f8fSGustavo F. Padovan { 5240a708f8fSGustavo F. Padovan u8 id; 5250a708f8fSGustavo F. Padovan 5260a708f8fSGustavo F. Padovan /* Get next available identificator. 5270a708f8fSGustavo F. Padovan * 1 - 128 are used by kernel. 5280a708f8fSGustavo F. Padovan * 129 - 199 are reserved. 5290a708f8fSGustavo F. Padovan * 200 - 254 are used by utilities like l2ping, etc. 5300a708f8fSGustavo F. Padovan */ 5310a708f8fSGustavo F. Padovan 5320a708f8fSGustavo F. Padovan spin_lock_bh(&conn->lock); 5330a708f8fSGustavo F. Padovan 5340a708f8fSGustavo F. Padovan if (++conn->tx_ident > 128) 5350a708f8fSGustavo F. Padovan conn->tx_ident = 1; 5360a708f8fSGustavo F. Padovan 5370a708f8fSGustavo F. Padovan id = conn->tx_ident; 5380a708f8fSGustavo F. Padovan 5390a708f8fSGustavo F. Padovan spin_unlock_bh(&conn->lock); 5400a708f8fSGustavo F. Padovan 5410a708f8fSGustavo F. Padovan return id; 5420a708f8fSGustavo F. Padovan } 5430a708f8fSGustavo F. Padovan 5444519de9aSGustavo F. Padovan static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data) 5450a708f8fSGustavo F. Padovan { 5460a708f8fSGustavo F. Padovan struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data); 5470a708f8fSGustavo F. Padovan u8 flags; 5480a708f8fSGustavo F. Padovan 5490a708f8fSGustavo F. Padovan BT_DBG("code 0x%2.2x", code); 5500a708f8fSGustavo F. Padovan 5510a708f8fSGustavo F. Padovan if (!skb) 5520a708f8fSGustavo F. Padovan return; 5530a708f8fSGustavo F. Padovan 5540a708f8fSGustavo F. Padovan if (lmp_no_flush_capable(conn->hcon->hdev)) 5550a708f8fSGustavo F. Padovan flags = ACL_START_NO_FLUSH; 5560a708f8fSGustavo F. Padovan else 5570a708f8fSGustavo F. Padovan flags = ACL_START; 5580a708f8fSGustavo F. Padovan 55914b12d0bSJaikumar Ganesh bt_cb(skb)->force_active = BT_POWER_FORCE_ACTIVE_ON; 56014b12d0bSJaikumar Ganesh 5610a708f8fSGustavo F. Padovan hci_send_acl(conn->hcon, skb, flags); 5620a708f8fSGustavo F. Padovan } 5630a708f8fSGustavo F. Padovan 564525cd185SGustavo F. Padovan static inline void l2cap_send_sframe(struct l2cap_chan *chan, u16 control) 5650a708f8fSGustavo F. Padovan { 5660a708f8fSGustavo F. Padovan struct sk_buff *skb; 5670a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 5688c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 5690a708f8fSGustavo F. Padovan int count, hlen = L2CAP_HDR_SIZE + 2; 5700a708f8fSGustavo F. Padovan u8 flags; 5710a708f8fSGustavo F. Padovan 57289bc500eSGustavo F. Padovan if (chan->state != BT_CONNECTED) 5730a708f8fSGustavo F. Padovan return; 5740a708f8fSGustavo F. Padovan 57547d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 5760a708f8fSGustavo F. Padovan hlen += 2; 5770a708f8fSGustavo F. Padovan 57849208c9cSGustavo F. Padovan BT_DBG("chan %p, control 0x%2.2x", chan, control); 5790a708f8fSGustavo F. Padovan 5800a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, hlen); 5810a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FRAME_TYPE; 5820a708f8fSGustavo F. Padovan 583e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 5840a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 5850a708f8fSGustavo F. Padovan 586e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_PBIT, &chan->conn_state)) 5870a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_POLL; 5880a708f8fSGustavo F. Padovan 5890a708f8fSGustavo F. Padovan skb = bt_skb_alloc(count, GFP_ATOMIC); 5900a708f8fSGustavo F. Padovan if (!skb) 5910a708f8fSGustavo F. Padovan return; 5920a708f8fSGustavo F. Padovan 5930a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 5940a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE); 595fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 5960a708f8fSGustavo F. Padovan put_unaligned_le16(control, skb_put(skb, 2)); 5970a708f8fSGustavo F. Padovan 59847d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 5990a708f8fSGustavo F. Padovan u16 fcs = crc16(0, (u8 *)lh, count - 2); 6000a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, skb_put(skb, 2)); 6010a708f8fSGustavo F. Padovan } 6020a708f8fSGustavo F. Padovan 6030a708f8fSGustavo F. Padovan if (lmp_no_flush_capable(conn->hcon->hdev)) 6040a708f8fSGustavo F. Padovan flags = ACL_START_NO_FLUSH; 6050a708f8fSGustavo F. Padovan else 6060a708f8fSGustavo F. Padovan flags = ACL_START; 6070a708f8fSGustavo F. Padovan 60815770b1aSAndrei Emeltchenko bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 60914b12d0bSJaikumar Ganesh 6108c1d787bSGustavo F. Padovan hci_send_acl(chan->conn->hcon, skb, flags); 6110a708f8fSGustavo F. Padovan } 6120a708f8fSGustavo F. Padovan 613525cd185SGustavo F. Padovan static inline void l2cap_send_rr_or_rnr(struct l2cap_chan *chan, u16 control) 6140a708f8fSGustavo F. Padovan { 615e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 6160a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_NOT_READY; 617e2ab4353SGustavo F. Padovan set_bit(CONN_RNR_SENT, &chan->conn_state); 6180a708f8fSGustavo F. Padovan } else 6190a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY; 6200a708f8fSGustavo F. Padovan 62142e5c802SGustavo F. Padovan control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 6220a708f8fSGustavo F. Padovan 623525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 6240a708f8fSGustavo F. Padovan } 6250a708f8fSGustavo F. Padovan 626b4450035SGustavo F. Padovan static inline int __l2cap_no_conn_pending(struct l2cap_chan *chan) 6270a708f8fSGustavo F. Padovan { 628c1360a1cSGustavo F. Padovan return !test_bit(CONF_CONNECT_PEND, &chan->conf_state); 6290a708f8fSGustavo F. Padovan } 6300a708f8fSGustavo F. Padovan 631fc7f8a7eSGustavo F. Padovan static void l2cap_do_start(struct l2cap_chan *chan) 6320a708f8fSGustavo F. Padovan { 6338c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 6340a708f8fSGustavo F. Padovan 6350a708f8fSGustavo F. Padovan if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) { 6360a708f8fSGustavo F. Padovan if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE)) 6370a708f8fSGustavo F. Padovan return; 6380a708f8fSGustavo F. Padovan 6394343478fSGustavo F. Padovan if (l2cap_check_security(chan) && 6404343478fSGustavo F. Padovan __l2cap_no_conn_pending(chan)) { 6410a708f8fSGustavo F. Padovan struct l2cap_conn_req req; 642fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 643fe4128e0SGustavo F. Padovan req.psm = chan->psm; 6440a708f8fSGustavo F. Padovan 645fc7f8a7eSGustavo F. Padovan chan->ident = l2cap_get_ident(conn); 646c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 6470a708f8fSGustavo F. Padovan 648fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, 649fc7f8a7eSGustavo F. Padovan sizeof(req), &req); 6500a708f8fSGustavo F. Padovan } 6510a708f8fSGustavo F. Padovan } else { 6520a708f8fSGustavo F. Padovan struct l2cap_info_req req; 6530a708f8fSGustavo F. Padovan req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 6540a708f8fSGustavo F. Padovan 6550a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 6560a708f8fSGustavo F. Padovan conn->info_ident = l2cap_get_ident(conn); 6570a708f8fSGustavo F. Padovan 6580a708f8fSGustavo F. Padovan mod_timer(&conn->info_timer, jiffies + 6590a708f8fSGustavo F. Padovan msecs_to_jiffies(L2CAP_INFO_TIMEOUT)); 6600a708f8fSGustavo F. Padovan 6610a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, conn->info_ident, 6620a708f8fSGustavo F. Padovan L2CAP_INFO_REQ, sizeof(req), &req); 6630a708f8fSGustavo F. Padovan } 6640a708f8fSGustavo F. Padovan } 6650a708f8fSGustavo F. Padovan 6660a708f8fSGustavo F. Padovan static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask) 6670a708f8fSGustavo F. Padovan { 6680a708f8fSGustavo F. Padovan u32 local_feat_mask = l2cap_feat_mask; 6690a708f8fSGustavo F. Padovan if (!disable_ertm) 6700a708f8fSGustavo F. Padovan local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING; 6710a708f8fSGustavo F. Padovan 6720a708f8fSGustavo F. Padovan switch (mode) { 6730a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 6740a708f8fSGustavo F. Padovan return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask; 6750a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 6760a708f8fSGustavo F. Padovan return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask; 6770a708f8fSGustavo F. Padovan default: 6780a708f8fSGustavo F. Padovan return 0x00; 6790a708f8fSGustavo F. Padovan } 6800a708f8fSGustavo F. Padovan } 6810a708f8fSGustavo F. Padovan 6824519de9aSGustavo F. Padovan static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *chan, int err) 6830a708f8fSGustavo F. Padovan { 684e92c8e70SGustavo F. Padovan struct sock *sk; 6850a708f8fSGustavo F. Padovan struct l2cap_disconn_req req; 6860a708f8fSGustavo F. Padovan 6870a708f8fSGustavo F. Padovan if (!conn) 6880a708f8fSGustavo F. Padovan return; 6890a708f8fSGustavo F. Padovan 690e92c8e70SGustavo F. Padovan sk = chan->sk; 691e92c8e70SGustavo F. Padovan 6920c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) { 6931a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 6941a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 6951a09bcb9SGustavo F. Padovan __clear_ack_timer(chan); 6960a708f8fSGustavo F. Padovan } 6970a708f8fSGustavo F. Padovan 698fe4128e0SGustavo F. Padovan req.dcid = cpu_to_le16(chan->dcid); 699fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 7000a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), 7010a708f8fSGustavo F. Padovan L2CAP_DISCONN_REQ, sizeof(req), &req); 7020a708f8fSGustavo F. Padovan 70389bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 7040a708f8fSGustavo F. Padovan sk->sk_err = err; 7050a708f8fSGustavo F. Padovan } 7060a708f8fSGustavo F. Padovan 7070a708f8fSGustavo F. Padovan /* ---- L2CAP connections ---- */ 7080a708f8fSGustavo F. Padovan static void l2cap_conn_start(struct l2cap_conn *conn) 7090a708f8fSGustavo F. Padovan { 710820ffdb3SGustavo F. Padovan struct l2cap_chan *chan, *tmp; 7110a708f8fSGustavo F. Padovan 7120a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 7130a708f8fSGustavo F. Padovan 714baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 7150a708f8fSGustavo F. Padovan 716820ffdb3SGustavo F. Padovan list_for_each_entry_safe(chan, tmp, &conn->chan_l, list) { 71748454079SGustavo F. Padovan struct sock *sk = chan->sk; 718baa7e1faSGustavo F. Padovan 7190a708f8fSGustavo F. Padovan bh_lock_sock(sk); 7200a708f8fSGustavo F. Padovan 721715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 7220a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7230a708f8fSGustavo F. Padovan continue; 7240a708f8fSGustavo F. Padovan } 7250a708f8fSGustavo F. Padovan 72689bc500eSGustavo F. Padovan if (chan->state == BT_CONNECT) { 7270a708f8fSGustavo F. Padovan struct l2cap_conn_req req; 7280a708f8fSGustavo F. Padovan 7294343478fSGustavo F. Padovan if (!l2cap_check_security(chan) || 730b4450035SGustavo F. Padovan !__l2cap_no_conn_pending(chan)) { 7310a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7320a708f8fSGustavo F. Padovan continue; 7330a708f8fSGustavo F. Padovan } 7340a708f8fSGustavo F. Padovan 735c1360a1cSGustavo F. Padovan if (!l2cap_mode_supported(chan->mode, conn->feat_mask) 736c1360a1cSGustavo F. Padovan && test_bit(CONF_STATE2_DEVICE, 737c1360a1cSGustavo F. Padovan &chan->conf_state)) { 7380f852724SGustavo F. Padovan /* l2cap_chan_close() calls list_del(chan) 739820ffdb3SGustavo F. Padovan * so release the lock */ 7402461daacSGustavo F. Padovan read_unlock(&conn->chan_lock); 7410f852724SGustavo F. Padovan l2cap_chan_close(chan, ECONNRESET); 7422461daacSGustavo F. Padovan read_lock(&conn->chan_lock); 7430a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7440a708f8fSGustavo F. Padovan continue; 7450a708f8fSGustavo F. Padovan } 7460a708f8fSGustavo F. Padovan 747fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 748fe4128e0SGustavo F. Padovan req.psm = chan->psm; 7490a708f8fSGustavo F. Padovan 750fc7f8a7eSGustavo F. Padovan chan->ident = l2cap_get_ident(conn); 751c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 7520a708f8fSGustavo F. Padovan 753fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_REQ, 754fc7f8a7eSGustavo F. Padovan sizeof(req), &req); 7550a708f8fSGustavo F. Padovan 75689bc500eSGustavo F. Padovan } else if (chan->state == BT_CONNECT2) { 7570a708f8fSGustavo F. Padovan struct l2cap_conn_rsp rsp; 7580a708f8fSGustavo F. Padovan char buf[128]; 759fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 760fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 7610a708f8fSGustavo F. Padovan 7624343478fSGustavo F. Padovan if (l2cap_check_security(chan)) { 7630a708f8fSGustavo F. Padovan if (bt_sk(sk)->defer_setup) { 7640a708f8fSGustavo F. Padovan struct sock *parent = bt_sk(sk)->parent; 7650a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_PEND); 7660a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND); 76705e9a2f6SIlia Kolomisnky if (parent) 7680a708f8fSGustavo F. Padovan parent->sk_data_ready(parent, 0); 7690a708f8fSGustavo F. Padovan 7700a708f8fSGustavo F. Padovan } else { 77189bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 7720a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 7730a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 7740a708f8fSGustavo F. Padovan } 7750a708f8fSGustavo F. Padovan } else { 7760a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_PEND); 7770a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND); 7780a708f8fSGustavo F. Padovan } 7790a708f8fSGustavo F. Padovan 780fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 781fc7f8a7eSGustavo F. Padovan sizeof(rsp), &rsp); 7820a708f8fSGustavo F. Padovan 783c1360a1cSGustavo F. Padovan if (test_bit(CONF_REQ_SENT, &chan->conf_state) || 7840a708f8fSGustavo F. Padovan rsp.result != L2CAP_CR_SUCCESS) { 7850a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7860a708f8fSGustavo F. Padovan continue; 7870a708f8fSGustavo F. Padovan } 7880a708f8fSGustavo F. Padovan 789c1360a1cSGustavo F. Padovan set_bit(CONF_REQ_SENT, &chan->conf_state); 7900a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 79173ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 79273ffa904SGustavo F. Padovan chan->num_conf_req++; 7930a708f8fSGustavo F. Padovan } 7940a708f8fSGustavo F. Padovan 7950a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 7960a708f8fSGustavo F. Padovan } 7970a708f8fSGustavo F. Padovan 798baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 7990a708f8fSGustavo F. Padovan } 8000a708f8fSGustavo F. Padovan 801b62f328bSVille Tervo /* Find socket with cid and source bdaddr. 802b62f328bSVille Tervo * Returns closest match, locked. 803b62f328bSVille Tervo */ 80423691d75SGustavo F. Padovan static struct l2cap_chan *l2cap_global_chan_by_scid(int state, __le16 cid, bdaddr_t *src) 805b62f328bSVille Tervo { 80623691d75SGustavo F. Padovan struct l2cap_chan *c, *c1 = NULL; 807b62f328bSVille Tervo 80823691d75SGustavo F. Padovan read_lock(&chan_list_lock); 809b62f328bSVille Tervo 81023691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 81123691d75SGustavo F. Padovan struct sock *sk = c->sk; 812fe4128e0SGustavo F. Padovan 81389bc500eSGustavo F. Padovan if (state && c->state != state) 814b62f328bSVille Tervo continue; 815b62f328bSVille Tervo 81623691d75SGustavo F. Padovan if (c->scid == cid) { 817b62f328bSVille Tervo /* Exact match. */ 81823691d75SGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, src)) { 81923691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 82023691d75SGustavo F. Padovan return c; 82123691d75SGustavo F. Padovan } 822b62f328bSVille Tervo 823b62f328bSVille Tervo /* Closest match */ 824b62f328bSVille Tervo if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) 82523691d75SGustavo F. Padovan c1 = c; 826b62f328bSVille Tervo } 827b62f328bSVille Tervo } 828280f294fSGustavo F. Padovan 82923691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 830b62f328bSVille Tervo 83123691d75SGustavo F. Padovan return c1; 832b62f328bSVille Tervo } 833b62f328bSVille Tervo 834b62f328bSVille Tervo static void l2cap_le_conn_ready(struct l2cap_conn *conn) 835b62f328bSVille Tervo { 836c916fbe4SGustavo F. Padovan struct sock *parent, *sk; 83723691d75SGustavo F. Padovan struct l2cap_chan *chan, *pchan; 838b62f328bSVille Tervo 839b62f328bSVille Tervo BT_DBG(""); 840b62f328bSVille Tervo 841b62f328bSVille Tervo /* Check if we have socket listening on cid */ 84223691d75SGustavo F. Padovan pchan = l2cap_global_chan_by_scid(BT_LISTEN, L2CAP_CID_LE_DATA, 843b62f328bSVille Tervo conn->src); 84423691d75SGustavo F. Padovan if (!pchan) 845b62f328bSVille Tervo return; 846b62f328bSVille Tervo 84723691d75SGustavo F. Padovan parent = pchan->sk; 84823691d75SGustavo F. Padovan 84962f3a2cfSGustavo F. Padovan bh_lock_sock(parent); 85062f3a2cfSGustavo F. Padovan 851b62f328bSVille Tervo /* Check for backlog size */ 852b62f328bSVille Tervo if (sk_acceptq_is_full(parent)) { 853b62f328bSVille Tervo BT_DBG("backlog full %d", parent->sk_ack_backlog); 854b62f328bSVille Tervo goto clean; 855b62f328bSVille Tervo } 856b62f328bSVille Tervo 85780808e43SGustavo F. Padovan chan = pchan->ops->new_connection(pchan->data); 85880808e43SGustavo F. Padovan if (!chan) 859b62f328bSVille Tervo goto clean; 860b62f328bSVille Tervo 86180808e43SGustavo F. Padovan sk = chan->sk; 8625d41ce1dSGustavo F. Padovan 863baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 864b62f328bSVille Tervo 865b62f328bSVille Tervo hci_conn_hold(conn->hcon); 866b62f328bSVille Tervo 867b62f328bSVille Tervo bacpy(&bt_sk(sk)->src, conn->src); 868b62f328bSVille Tervo bacpy(&bt_sk(sk)->dst, conn->dst); 869b62f328bSVille Tervo 870d1010240SGustavo F. Padovan bt_accept_enqueue(parent, sk); 871d1010240SGustavo F. Padovan 87248454079SGustavo F. Padovan __l2cap_chan_add(conn, chan); 87348454079SGustavo F. Padovan 874c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 875b62f328bSVille Tervo 87689bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 877b62f328bSVille Tervo parent->sk_data_ready(parent, 0); 878b62f328bSVille Tervo 879baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 880b62f328bSVille Tervo 881b62f328bSVille Tervo clean: 882b62f328bSVille Tervo bh_unlock_sock(parent); 883b62f328bSVille Tervo } 884b62f328bSVille Tervo 885f1cb9af5SVinicius Costa Gomes static void l2cap_chan_ready(struct sock *sk) 886f1cb9af5SVinicius Costa Gomes { 887f1cb9af5SVinicius Costa Gomes struct l2cap_chan *chan = l2cap_pi(sk)->chan; 888f1cb9af5SVinicius Costa Gomes struct sock *parent = bt_sk(sk)->parent; 889f1cb9af5SVinicius Costa Gomes 890f1cb9af5SVinicius Costa Gomes BT_DBG("sk %p, parent %p", sk, parent); 891f1cb9af5SVinicius Costa Gomes 892f1cb9af5SVinicius Costa Gomes chan->conf_state = 0; 893f1cb9af5SVinicius Costa Gomes __clear_chan_timer(chan); 894f1cb9af5SVinicius Costa Gomes 89543f3dc41SVinicius Costa Gomes l2cap_state_change(chan, BT_CONNECTED); 896f1cb9af5SVinicius Costa Gomes sk->sk_state_change(sk); 897f1cb9af5SVinicius Costa Gomes 898f1cb9af5SVinicius Costa Gomes if (parent) 899f1cb9af5SVinicius Costa Gomes parent->sk_data_ready(parent, 0); 900f1cb9af5SVinicius Costa Gomes } 901f1cb9af5SVinicius Costa Gomes 9020a708f8fSGustavo F. Padovan static void l2cap_conn_ready(struct l2cap_conn *conn) 9030a708f8fSGustavo F. Padovan { 90448454079SGustavo F. Padovan struct l2cap_chan *chan; 9050a708f8fSGustavo F. Padovan 9060a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 9070a708f8fSGustavo F. Padovan 908b62f328bSVille Tervo if (!conn->hcon->out && conn->hcon->type == LE_LINK) 909b62f328bSVille Tervo l2cap_le_conn_ready(conn); 910b62f328bSVille Tervo 911160dc6acSVinicius Costa Gomes if (conn->hcon->out && conn->hcon->type == LE_LINK) 912160dc6acSVinicius Costa Gomes smp_conn_security(conn, conn->hcon->pending_sec_level); 913160dc6acSVinicius Costa Gomes 914baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 9150a708f8fSGustavo F. Padovan 916baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 91748454079SGustavo F. Padovan struct sock *sk = chan->sk; 918baa7e1faSGustavo F. Padovan 9190a708f8fSGustavo F. Padovan bh_lock_sock(sk); 9200a708f8fSGustavo F. Padovan 92163128451SVinicius Costa Gomes if (conn->hcon->type == LE_LINK) { 922b501d6a1SAnderson Briglia if (smp_conn_security(conn, chan->sec_level)) 923f1cb9af5SVinicius Costa Gomes l2cap_chan_ready(sk); 924acd7d370SVille Tervo 92563128451SVinicius Costa Gomes } else if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 926c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 92789bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 9280a708f8fSGustavo F. Padovan sk->sk_state_change(sk); 929b501d6a1SAnderson Briglia 93089bc500eSGustavo F. Padovan } else if (chan->state == BT_CONNECT) 931fc7f8a7eSGustavo F. Padovan l2cap_do_start(chan); 9320a708f8fSGustavo F. Padovan 9330a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 9340a708f8fSGustavo F. Padovan } 9350a708f8fSGustavo F. Padovan 936baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 9370a708f8fSGustavo F. Padovan } 9380a708f8fSGustavo F. Padovan 9390a708f8fSGustavo F. Padovan /* Notify sockets that we cannot guaranty reliability anymore */ 9400a708f8fSGustavo F. Padovan static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err) 9410a708f8fSGustavo F. Padovan { 94248454079SGustavo F. Padovan struct l2cap_chan *chan; 9430a708f8fSGustavo F. Padovan 9440a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 9450a708f8fSGustavo F. Padovan 946baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 9470a708f8fSGustavo F. Padovan 948baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 94948454079SGustavo F. Padovan struct sock *sk = chan->sk; 950baa7e1faSGustavo F. Padovan 951ecf61bdbSAndrei Emeltchenko if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags)) 9520a708f8fSGustavo F. Padovan sk->sk_err = err; 9530a708f8fSGustavo F. Padovan } 9540a708f8fSGustavo F. Padovan 955baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 9560a708f8fSGustavo F. Padovan } 9570a708f8fSGustavo F. Padovan 9580a708f8fSGustavo F. Padovan static void l2cap_info_timeout(unsigned long arg) 9590a708f8fSGustavo F. Padovan { 9600a708f8fSGustavo F. Padovan struct l2cap_conn *conn = (void *) arg; 9610a708f8fSGustavo F. Padovan 9620a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 9630a708f8fSGustavo F. Padovan conn->info_ident = 0; 9640a708f8fSGustavo F. Padovan 9650a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 9660a708f8fSGustavo F. Padovan } 9670a708f8fSGustavo F. Padovan 9685d3de7dfSVinicius Costa Gomes static void l2cap_conn_del(struct hci_conn *hcon, int err) 9695d3de7dfSVinicius Costa Gomes { 9705d3de7dfSVinicius Costa Gomes struct l2cap_conn *conn = hcon->l2cap_data; 9715d3de7dfSVinicius Costa Gomes struct l2cap_chan *chan, *l; 9725d3de7dfSVinicius Costa Gomes struct sock *sk; 9735d3de7dfSVinicius Costa Gomes 9745d3de7dfSVinicius Costa Gomes if (!conn) 9755d3de7dfSVinicius Costa Gomes return; 9765d3de7dfSVinicius Costa Gomes 9775d3de7dfSVinicius Costa Gomes BT_DBG("hcon %p conn %p, err %d", hcon, conn, err); 9785d3de7dfSVinicius Costa Gomes 9795d3de7dfSVinicius Costa Gomes kfree_skb(conn->rx_skb); 9805d3de7dfSVinicius Costa Gomes 9815d3de7dfSVinicius Costa Gomes /* Kill channels */ 9825d3de7dfSVinicius Costa Gomes list_for_each_entry_safe(chan, l, &conn->chan_l, list) { 9835d3de7dfSVinicius Costa Gomes sk = chan->sk; 9845d3de7dfSVinicius Costa Gomes bh_lock_sock(sk); 9855d3de7dfSVinicius Costa Gomes l2cap_chan_del(chan, err); 9865d3de7dfSVinicius Costa Gomes bh_unlock_sock(sk); 9875d3de7dfSVinicius Costa Gomes chan->ops->close(chan->data); 9885d3de7dfSVinicius Costa Gomes } 9895d3de7dfSVinicius Costa Gomes 9905d3de7dfSVinicius Costa Gomes if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) 9915d3de7dfSVinicius Costa Gomes del_timer_sync(&conn->info_timer); 9925d3de7dfSVinicius Costa Gomes 993d26a2345SVinicius Costa Gomes if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &hcon->pend)) { 9945d3de7dfSVinicius Costa Gomes del_timer(&conn->security_timer); 9958aab4757SVinicius Costa Gomes smp_chan_destroy(conn); 996d26a2345SVinicius Costa Gomes } 9975d3de7dfSVinicius Costa Gomes 9985d3de7dfSVinicius Costa Gomes hcon->l2cap_data = NULL; 9995d3de7dfSVinicius Costa Gomes kfree(conn); 10005d3de7dfSVinicius Costa Gomes } 10015d3de7dfSVinicius Costa Gomes 10025d3de7dfSVinicius Costa Gomes static void security_timeout(unsigned long arg) 10035d3de7dfSVinicius Costa Gomes { 10045d3de7dfSVinicius Costa Gomes struct l2cap_conn *conn = (void *) arg; 10055d3de7dfSVinicius Costa Gomes 10065d3de7dfSVinicius Costa Gomes l2cap_conn_del(conn->hcon, ETIMEDOUT); 10075d3de7dfSVinicius Costa Gomes } 10085d3de7dfSVinicius Costa Gomes 10090a708f8fSGustavo F. Padovan static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status) 10100a708f8fSGustavo F. Padovan { 10110a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 10120a708f8fSGustavo F. Padovan 10130a708f8fSGustavo F. Padovan if (conn || status) 10140a708f8fSGustavo F. Padovan return conn; 10150a708f8fSGustavo F. Padovan 10160a708f8fSGustavo F. Padovan conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC); 10170a708f8fSGustavo F. Padovan if (!conn) 10180a708f8fSGustavo F. Padovan return NULL; 10190a708f8fSGustavo F. Padovan 10200a708f8fSGustavo F. Padovan hcon->l2cap_data = conn; 10210a708f8fSGustavo F. Padovan conn->hcon = hcon; 10220a708f8fSGustavo F. Padovan 10230a708f8fSGustavo F. Padovan BT_DBG("hcon %p conn %p", hcon, conn); 10240a708f8fSGustavo F. Padovan 1025acd7d370SVille Tervo if (hcon->hdev->le_mtu && hcon->type == LE_LINK) 1026acd7d370SVille Tervo conn->mtu = hcon->hdev->le_mtu; 1027acd7d370SVille Tervo else 10280a708f8fSGustavo F. Padovan conn->mtu = hcon->hdev->acl_mtu; 1029acd7d370SVille Tervo 10300a708f8fSGustavo F. Padovan conn->src = &hcon->hdev->bdaddr; 10310a708f8fSGustavo F. Padovan conn->dst = &hcon->dst; 10320a708f8fSGustavo F. Padovan 10330a708f8fSGustavo F. Padovan conn->feat_mask = 0; 10340a708f8fSGustavo F. Padovan 10350a708f8fSGustavo F. Padovan spin_lock_init(&conn->lock); 1036baa7e1faSGustavo F. Padovan rwlock_init(&conn->chan_lock); 1037baa7e1faSGustavo F. Padovan 1038baa7e1faSGustavo F. Padovan INIT_LIST_HEAD(&conn->chan_l); 10390a708f8fSGustavo F. Padovan 10405d3de7dfSVinicius Costa Gomes if (hcon->type == LE_LINK) 10415d3de7dfSVinicius Costa Gomes setup_timer(&conn->security_timer, security_timeout, 10425d3de7dfSVinicius Costa Gomes (unsigned long) conn); 10435d3de7dfSVinicius Costa Gomes else 10440a708f8fSGustavo F. Padovan setup_timer(&conn->info_timer, l2cap_info_timeout, 10450a708f8fSGustavo F. Padovan (unsigned long) conn); 10460a708f8fSGustavo F. Padovan 10470a708f8fSGustavo F. Padovan conn->disc_reason = 0x13; 10480a708f8fSGustavo F. Padovan 10490a708f8fSGustavo F. Padovan return conn; 10500a708f8fSGustavo F. Padovan } 10510a708f8fSGustavo F. Padovan 105248454079SGustavo F. Padovan static inline void l2cap_chan_add(struct l2cap_conn *conn, struct l2cap_chan *chan) 10530a708f8fSGustavo F. Padovan { 1054baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 105548454079SGustavo F. Padovan __l2cap_chan_add(conn, chan); 1056baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 10570a708f8fSGustavo F. Padovan } 10580a708f8fSGustavo F. Padovan 10590a708f8fSGustavo F. Padovan /* ---- Socket interface ---- */ 10600a708f8fSGustavo F. Padovan 10610a708f8fSGustavo F. Padovan /* Find socket with psm and source bdaddr. 10620a708f8fSGustavo F. Padovan * Returns closest match. 10630a708f8fSGustavo F. Padovan */ 106423691d75SGustavo F. Padovan static struct l2cap_chan *l2cap_global_chan_by_psm(int state, __le16 psm, bdaddr_t *src) 10650a708f8fSGustavo F. Padovan { 106623691d75SGustavo F. Padovan struct l2cap_chan *c, *c1 = NULL; 10670a708f8fSGustavo F. Padovan 106823691d75SGustavo F. Padovan read_lock(&chan_list_lock); 10690a708f8fSGustavo F. Padovan 107023691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 107123691d75SGustavo F. Padovan struct sock *sk = c->sk; 1072fe4128e0SGustavo F. Padovan 107389bc500eSGustavo F. Padovan if (state && c->state != state) 10740a708f8fSGustavo F. Padovan continue; 10750a708f8fSGustavo F. Padovan 107623691d75SGustavo F. Padovan if (c->psm == psm) { 10770a708f8fSGustavo F. Padovan /* Exact match. */ 107823691d75SGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, src)) { 1079a7567b20SJohannes Berg read_unlock(&chan_list_lock); 108023691d75SGustavo F. Padovan return c; 108123691d75SGustavo F. Padovan } 10820a708f8fSGustavo F. Padovan 10830a708f8fSGustavo F. Padovan /* Closest match */ 10840a708f8fSGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) 108523691d75SGustavo F. Padovan c1 = c; 10860a708f8fSGustavo F. Padovan } 10870a708f8fSGustavo F. Padovan } 10880a708f8fSGustavo F. Padovan 108923691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 10900a708f8fSGustavo F. Padovan 109123691d75SGustavo F. Padovan return c1; 10920a708f8fSGustavo F. Padovan } 10930a708f8fSGustavo F. Padovan 109477a74c7eSGustavo F. Padovan int l2cap_chan_connect(struct l2cap_chan *chan) 10950a708f8fSGustavo F. Padovan { 10965d41ce1dSGustavo F. Padovan struct sock *sk = chan->sk; 10970a708f8fSGustavo F. Padovan bdaddr_t *src = &bt_sk(sk)->src; 10980a708f8fSGustavo F. Padovan bdaddr_t *dst = &bt_sk(sk)->dst; 10990a708f8fSGustavo F. Padovan struct l2cap_conn *conn; 11000a708f8fSGustavo F. Padovan struct hci_conn *hcon; 11010a708f8fSGustavo F. Padovan struct hci_dev *hdev; 11020a708f8fSGustavo F. Padovan __u8 auth_type; 11030a708f8fSGustavo F. Padovan int err; 11040a708f8fSGustavo F. Padovan 11050a708f8fSGustavo F. Padovan BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), 1106fe4128e0SGustavo F. Padovan chan->psm); 11070a708f8fSGustavo F. Padovan 11080a708f8fSGustavo F. Padovan hdev = hci_get_route(dst, src); 11090a708f8fSGustavo F. Padovan if (!hdev) 11100a708f8fSGustavo F. Padovan return -EHOSTUNREACH; 11110a708f8fSGustavo F. Padovan 11120a708f8fSGustavo F. Padovan hci_dev_lock_bh(hdev); 11130a708f8fSGustavo F. Padovan 11144343478fSGustavo F. Padovan auth_type = l2cap_get_auth_type(chan); 11150a708f8fSGustavo F. Padovan 1116fe4128e0SGustavo F. Padovan if (chan->dcid == L2CAP_CID_LE_DATA) 1117acd7d370SVille Tervo hcon = hci_connect(hdev, LE_LINK, dst, 11184343478fSGustavo F. Padovan chan->sec_level, auth_type); 1119acd7d370SVille Tervo else 11200a708f8fSGustavo F. Padovan hcon = hci_connect(hdev, ACL_LINK, dst, 11214343478fSGustavo F. Padovan chan->sec_level, auth_type); 1122acd7d370SVille Tervo 112330e76272SVille Tervo if (IS_ERR(hcon)) { 112430e76272SVille Tervo err = PTR_ERR(hcon); 11250a708f8fSGustavo F. Padovan goto done; 112630e76272SVille Tervo } 11270a708f8fSGustavo F. Padovan 11280a708f8fSGustavo F. Padovan conn = l2cap_conn_add(hcon, 0); 11290a708f8fSGustavo F. Padovan if (!conn) { 11300a708f8fSGustavo F. Padovan hci_conn_put(hcon); 113130e76272SVille Tervo err = -ENOMEM; 11320a708f8fSGustavo F. Padovan goto done; 11330a708f8fSGustavo F. Padovan } 11340a708f8fSGustavo F. Padovan 11350a708f8fSGustavo F. Padovan /* Update source addr of the socket */ 11360a708f8fSGustavo F. Padovan bacpy(src, conn->src); 11370a708f8fSGustavo F. Padovan 113848454079SGustavo F. Padovan l2cap_chan_add(conn, chan); 113948454079SGustavo F. Padovan 114089bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT); 1141c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 11420a708f8fSGustavo F. Padovan 11430a708f8fSGustavo F. Padovan if (hcon->state == BT_CONNECTED) { 1144715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) { 1145c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 11464343478fSGustavo F. Padovan if (l2cap_check_security(chan)) 114789bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 11480a708f8fSGustavo F. Padovan } else 1149fc7f8a7eSGustavo F. Padovan l2cap_do_start(chan); 11500a708f8fSGustavo F. Padovan } 11510a708f8fSGustavo F. Padovan 115230e76272SVille Tervo err = 0; 115330e76272SVille Tervo 11540a708f8fSGustavo F. Padovan done: 11550a708f8fSGustavo F. Padovan hci_dev_unlock_bh(hdev); 11560a708f8fSGustavo F. Padovan hci_dev_put(hdev); 11570a708f8fSGustavo F. Padovan return err; 11580a708f8fSGustavo F. Padovan } 11590a708f8fSGustavo F. Padovan 1160dcba0dbaSGustavo F. Padovan int __l2cap_wait_ack(struct sock *sk) 11610a708f8fSGustavo F. Padovan { 11628c1d787bSGustavo F. Padovan struct l2cap_chan *chan = l2cap_pi(sk)->chan; 11630a708f8fSGustavo F. Padovan DECLARE_WAITQUEUE(wait, current); 11640a708f8fSGustavo F. Padovan int err = 0; 11650a708f8fSGustavo F. Padovan int timeo = HZ/5; 11660a708f8fSGustavo F. Padovan 11670a708f8fSGustavo F. Padovan add_wait_queue(sk_sleep(sk), &wait); 11680a708f8fSGustavo F. Padovan set_current_state(TASK_INTERRUPTIBLE); 1169a71a0cf4SPeter Hurley while (chan->unacked_frames > 0 && chan->conn) { 11700a708f8fSGustavo F. Padovan if (!timeo) 11710a708f8fSGustavo F. Padovan timeo = HZ/5; 11720a708f8fSGustavo F. Padovan 11730a708f8fSGustavo F. Padovan if (signal_pending(current)) { 11740a708f8fSGustavo F. Padovan err = sock_intr_errno(timeo); 11750a708f8fSGustavo F. Padovan break; 11760a708f8fSGustavo F. Padovan } 11770a708f8fSGustavo F. Padovan 11780a708f8fSGustavo F. Padovan release_sock(sk); 11790a708f8fSGustavo F. Padovan timeo = schedule_timeout(timeo); 11800a708f8fSGustavo F. Padovan lock_sock(sk); 1181a71a0cf4SPeter Hurley set_current_state(TASK_INTERRUPTIBLE); 11820a708f8fSGustavo F. Padovan 11830a708f8fSGustavo F. Padovan err = sock_error(sk); 11840a708f8fSGustavo F. Padovan if (err) 11850a708f8fSGustavo F. Padovan break; 11860a708f8fSGustavo F. Padovan } 11870a708f8fSGustavo F. Padovan set_current_state(TASK_RUNNING); 11880a708f8fSGustavo F. Padovan remove_wait_queue(sk_sleep(sk), &wait); 11890a708f8fSGustavo F. Padovan return err; 11900a708f8fSGustavo F. Padovan } 11910a708f8fSGustavo F. Padovan 11920a708f8fSGustavo F. Padovan static void l2cap_monitor_timeout(unsigned long arg) 11930a708f8fSGustavo F. Padovan { 1194525cd185SGustavo F. Padovan struct l2cap_chan *chan = (void *) arg; 1195525cd185SGustavo F. Padovan struct sock *sk = chan->sk; 11960a708f8fSGustavo F. Padovan 1197525cd185SGustavo F. Padovan BT_DBG("chan %p", chan); 11980a708f8fSGustavo F. Padovan 11990a708f8fSGustavo F. Padovan bh_lock_sock(sk); 12002c03a7a4SGustavo F. Padovan if (chan->retry_count >= chan->remote_max_tx) { 12018c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 12020a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 12030a708f8fSGustavo F. Padovan return; 12040a708f8fSGustavo F. Padovan } 12050a708f8fSGustavo F. Padovan 12066a026610SGustavo F. Padovan chan->retry_count++; 12071a09bcb9SGustavo F. Padovan __set_monitor_timer(chan); 12080a708f8fSGustavo F. Padovan 1209525cd185SGustavo F. Padovan l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL); 12100a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 12110a708f8fSGustavo F. Padovan } 12120a708f8fSGustavo F. Padovan 12130a708f8fSGustavo F. Padovan static void l2cap_retrans_timeout(unsigned long arg) 12140a708f8fSGustavo F. Padovan { 1215525cd185SGustavo F. Padovan struct l2cap_chan *chan = (void *) arg; 1216525cd185SGustavo F. Padovan struct sock *sk = chan->sk; 12170a708f8fSGustavo F. Padovan 121849208c9cSGustavo F. Padovan BT_DBG("chan %p", chan); 12190a708f8fSGustavo F. Padovan 12200a708f8fSGustavo F. Padovan bh_lock_sock(sk); 12216a026610SGustavo F. Padovan chan->retry_count = 1; 12221a09bcb9SGustavo F. Padovan __set_monitor_timer(chan); 12230a708f8fSGustavo F. Padovan 1224e2ab4353SGustavo F. Padovan set_bit(CONN_WAIT_F, &chan->conn_state); 12250a708f8fSGustavo F. Padovan 1226525cd185SGustavo F. Padovan l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL); 12270a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 12280a708f8fSGustavo F. Padovan } 12290a708f8fSGustavo F. Padovan 123042e5c802SGustavo F. Padovan static void l2cap_drop_acked_frames(struct l2cap_chan *chan) 12310a708f8fSGustavo F. Padovan { 12320a708f8fSGustavo F. Padovan struct sk_buff *skb; 12330a708f8fSGustavo F. Padovan 123458d35f87SGustavo F. Padovan while ((skb = skb_peek(&chan->tx_q)) && 12356a026610SGustavo F. Padovan chan->unacked_frames) { 123642e5c802SGustavo F. Padovan if (bt_cb(skb)->tx_seq == chan->expected_ack_seq) 12370a708f8fSGustavo F. Padovan break; 12380a708f8fSGustavo F. Padovan 123958d35f87SGustavo F. Padovan skb = skb_dequeue(&chan->tx_q); 12400a708f8fSGustavo F. Padovan kfree_skb(skb); 12410a708f8fSGustavo F. Padovan 12426a026610SGustavo F. Padovan chan->unacked_frames--; 12430a708f8fSGustavo F. Padovan } 12440a708f8fSGustavo F. Padovan 12456a026610SGustavo F. Padovan if (!chan->unacked_frames) 12461a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 12470a708f8fSGustavo F. Padovan } 12480a708f8fSGustavo F. Padovan 124967c9e840SSzymon Janc static void l2cap_do_send(struct l2cap_chan *chan, struct sk_buff *skb) 12500a708f8fSGustavo F. Padovan { 12518c1d787bSGustavo F. Padovan struct hci_conn *hcon = chan->conn->hcon; 12520a708f8fSGustavo F. Padovan u16 flags; 12530a708f8fSGustavo F. Padovan 12544343478fSGustavo F. Padovan BT_DBG("chan %p, skb %p len %d", chan, skb, skb->len); 12550a708f8fSGustavo F. Padovan 1256d57b0e8bSAndrei Emeltchenko if (!test_bit(FLAG_FLUSHABLE, &chan->flags) && 1257d57b0e8bSAndrei Emeltchenko lmp_no_flush_capable(hcon->hdev)) 12580a708f8fSGustavo F. Padovan flags = ACL_START_NO_FLUSH; 12590a708f8fSGustavo F. Padovan else 12600a708f8fSGustavo F. Padovan flags = ACL_START; 12610a708f8fSGustavo F. Padovan 126215770b1aSAndrei Emeltchenko bt_cb(skb)->force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags); 12630a708f8fSGustavo F. Padovan hci_send_acl(hcon, skb, flags); 12640a708f8fSGustavo F. Padovan } 12650a708f8fSGustavo F. Padovan 126667c9e840SSzymon Janc static void l2cap_streaming_send(struct l2cap_chan *chan) 12670a708f8fSGustavo F. Padovan { 12680a708f8fSGustavo F. Padovan struct sk_buff *skb; 12690a708f8fSGustavo F. Padovan u16 control, fcs; 12700a708f8fSGustavo F. Padovan 127158d35f87SGustavo F. Padovan while ((skb = skb_dequeue(&chan->tx_q))) { 12720a708f8fSGustavo F. Padovan control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE); 127342e5c802SGustavo F. Padovan control |= chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT; 12740a708f8fSGustavo F. Padovan put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE); 12750a708f8fSGustavo F. Padovan 127647d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 12770a708f8fSGustavo F. Padovan fcs = crc16(0, (u8 *)skb->data, skb->len - 2); 12780a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, skb->data + skb->len - 2); 12790a708f8fSGustavo F. Padovan } 12800a708f8fSGustavo F. Padovan 12814343478fSGustavo F. Padovan l2cap_do_send(chan, skb); 12820a708f8fSGustavo F. Padovan 128342e5c802SGustavo F. Padovan chan->next_tx_seq = (chan->next_tx_seq + 1) % 64; 12840a708f8fSGustavo F. Padovan } 12850a708f8fSGustavo F. Padovan } 12860a708f8fSGustavo F. Padovan 1287525cd185SGustavo F. Padovan static void l2cap_retransmit_one_frame(struct l2cap_chan *chan, u8 tx_seq) 12880a708f8fSGustavo F. Padovan { 12890a708f8fSGustavo F. Padovan struct sk_buff *skb, *tx_skb; 12900a708f8fSGustavo F. Padovan u16 control, fcs; 12910a708f8fSGustavo F. Padovan 129258d35f87SGustavo F. Padovan skb = skb_peek(&chan->tx_q); 12930a708f8fSGustavo F. Padovan if (!skb) 12940a708f8fSGustavo F. Padovan return; 12950a708f8fSGustavo F. Padovan 12960a708f8fSGustavo F. Padovan do { 12970a708f8fSGustavo F. Padovan if (bt_cb(skb)->tx_seq == tx_seq) 12980a708f8fSGustavo F. Padovan break; 12990a708f8fSGustavo F. Padovan 130058d35f87SGustavo F. Padovan if (skb_queue_is_last(&chan->tx_q, skb)) 13010a708f8fSGustavo F. Padovan return; 13020a708f8fSGustavo F. Padovan 130358d35f87SGustavo F. Padovan } while ((skb = skb_queue_next(&chan->tx_q, skb))); 13040a708f8fSGustavo F. Padovan 13052c03a7a4SGustavo F. Padovan if (chan->remote_max_tx && 13062c03a7a4SGustavo F. Padovan bt_cb(skb)->retries == chan->remote_max_tx) { 13078c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 13080a708f8fSGustavo F. Padovan return; 13090a708f8fSGustavo F. Padovan } 13100a708f8fSGustavo F. Padovan 13110a708f8fSGustavo F. Padovan tx_skb = skb_clone(skb, GFP_ATOMIC); 13120a708f8fSGustavo F. Padovan bt_cb(skb)->retries++; 13130a708f8fSGustavo F. Padovan control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE); 1314a429b519SRuiyi Zhang control &= L2CAP_CTRL_SAR; 13150a708f8fSGustavo F. Padovan 1316e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 13170a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 13180a708f8fSGustavo F. Padovan 131942e5c802SGustavo F. Padovan control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT) 13200a708f8fSGustavo F. Padovan | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT); 13210a708f8fSGustavo F. Padovan 13220a708f8fSGustavo F. Padovan put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE); 13230a708f8fSGustavo F. Padovan 132447d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 13250a708f8fSGustavo F. Padovan fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2); 13260a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2); 13270a708f8fSGustavo F. Padovan } 13280a708f8fSGustavo F. Padovan 13294343478fSGustavo F. Padovan l2cap_do_send(chan, tx_skb); 13300a708f8fSGustavo F. Padovan } 13310a708f8fSGustavo F. Padovan 133267c9e840SSzymon Janc static int l2cap_ertm_send(struct l2cap_chan *chan) 13330a708f8fSGustavo F. Padovan { 13340a708f8fSGustavo F. Padovan struct sk_buff *skb, *tx_skb; 13350a708f8fSGustavo F. Padovan u16 control, fcs; 13360a708f8fSGustavo F. Padovan int nsent = 0; 13370a708f8fSGustavo F. Padovan 133889bc500eSGustavo F. Padovan if (chan->state != BT_CONNECTED) 13390a708f8fSGustavo F. Padovan return -ENOTCONN; 13400a708f8fSGustavo F. Padovan 134158d35f87SGustavo F. Padovan while ((skb = chan->tx_send_head) && (!l2cap_tx_window_full(chan))) { 13420a708f8fSGustavo F. Padovan 13432c03a7a4SGustavo F. Padovan if (chan->remote_max_tx && 13442c03a7a4SGustavo F. Padovan bt_cb(skb)->retries == chan->remote_max_tx) { 13458c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 13460a708f8fSGustavo F. Padovan break; 13470a708f8fSGustavo F. Padovan } 13480a708f8fSGustavo F. Padovan 13490a708f8fSGustavo F. Padovan tx_skb = skb_clone(skb, GFP_ATOMIC); 13500a708f8fSGustavo F. Padovan 13510a708f8fSGustavo F. Padovan bt_cb(skb)->retries++; 13520a708f8fSGustavo F. Padovan 13530a708f8fSGustavo F. Padovan control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE); 13540a708f8fSGustavo F. Padovan control &= L2CAP_CTRL_SAR; 13550a708f8fSGustavo F. Padovan 1356e2ab4353SGustavo F. Padovan if (test_and_clear_bit(CONN_SEND_FBIT, &chan->conn_state)) 13570a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 1358e2ab4353SGustavo F. Padovan 135942e5c802SGustavo F. Padovan control |= (chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT) 136042e5c802SGustavo F. Padovan | (chan->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT); 13610a708f8fSGustavo F. Padovan put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE); 13620a708f8fSGustavo F. Padovan 13630a708f8fSGustavo F. Padovan 136447d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 13650a708f8fSGustavo F. Padovan fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2); 13660a708f8fSGustavo F. Padovan put_unaligned_le16(fcs, skb->data + tx_skb->len - 2); 13670a708f8fSGustavo F. Padovan } 13680a708f8fSGustavo F. Padovan 13694343478fSGustavo F. Padovan l2cap_do_send(chan, tx_skb); 13700a708f8fSGustavo F. Padovan 13711a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 13720a708f8fSGustavo F. Padovan 137342e5c802SGustavo F. Padovan bt_cb(skb)->tx_seq = chan->next_tx_seq; 137442e5c802SGustavo F. Padovan chan->next_tx_seq = (chan->next_tx_seq + 1) % 64; 13750a708f8fSGustavo F. Padovan 137623e9fde2SSuraj Sumangala if (bt_cb(skb)->retries == 1) 13776a026610SGustavo F. Padovan chan->unacked_frames++; 137823e9fde2SSuraj Sumangala 13796a026610SGustavo F. Padovan chan->frames_sent++; 13800a708f8fSGustavo F. Padovan 138158d35f87SGustavo F. Padovan if (skb_queue_is_last(&chan->tx_q, skb)) 138258d35f87SGustavo F. Padovan chan->tx_send_head = NULL; 13830a708f8fSGustavo F. Padovan else 138458d35f87SGustavo F. Padovan chan->tx_send_head = skb_queue_next(&chan->tx_q, skb); 13850a708f8fSGustavo F. Padovan 13860a708f8fSGustavo F. Padovan nsent++; 13870a708f8fSGustavo F. Padovan } 13880a708f8fSGustavo F. Padovan 13890a708f8fSGustavo F. Padovan return nsent; 13900a708f8fSGustavo F. Padovan } 13910a708f8fSGustavo F. Padovan 1392525cd185SGustavo F. Padovan static int l2cap_retransmit_frames(struct l2cap_chan *chan) 13930a708f8fSGustavo F. Padovan { 13940a708f8fSGustavo F. Padovan int ret; 13950a708f8fSGustavo F. Padovan 139658d35f87SGustavo F. Padovan if (!skb_queue_empty(&chan->tx_q)) 139758d35f87SGustavo F. Padovan chan->tx_send_head = chan->tx_q.next; 13980a708f8fSGustavo F. Padovan 139942e5c802SGustavo F. Padovan chan->next_tx_seq = chan->expected_ack_seq; 1400525cd185SGustavo F. Padovan ret = l2cap_ertm_send(chan); 14010a708f8fSGustavo F. Padovan return ret; 14020a708f8fSGustavo F. Padovan } 14030a708f8fSGustavo F. Padovan 1404525cd185SGustavo F. Padovan static void l2cap_send_ack(struct l2cap_chan *chan) 14050a708f8fSGustavo F. Padovan { 14060a708f8fSGustavo F. Padovan u16 control = 0; 14070a708f8fSGustavo F. Padovan 140842e5c802SGustavo F. Padovan control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 14090a708f8fSGustavo F. Padovan 1410e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 14110a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_NOT_READY; 1412e2ab4353SGustavo F. Padovan set_bit(CONN_RNR_SENT, &chan->conn_state); 1413525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 14140a708f8fSGustavo F. Padovan return; 14150a708f8fSGustavo F. Padovan } 14160a708f8fSGustavo F. Padovan 1417525cd185SGustavo F. Padovan if (l2cap_ertm_send(chan) > 0) 14180a708f8fSGustavo F. Padovan return; 14190a708f8fSGustavo F. Padovan 14200a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY; 1421525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 14220a708f8fSGustavo F. Padovan } 14230a708f8fSGustavo F. Padovan 1424525cd185SGustavo F. Padovan static void l2cap_send_srejtail(struct l2cap_chan *chan) 14250a708f8fSGustavo F. Padovan { 14260a708f8fSGustavo F. Padovan struct srej_list *tail; 14270a708f8fSGustavo F. Padovan u16 control; 14280a708f8fSGustavo F. Padovan 14290a708f8fSGustavo F. Padovan control = L2CAP_SUPER_SELECT_REJECT; 14300a708f8fSGustavo F. Padovan control |= L2CAP_CTRL_FINAL; 14310a708f8fSGustavo F. Padovan 143239d5a3eeSGustavo F. Padovan tail = list_entry((&chan->srej_l)->prev, struct srej_list, list); 14330a708f8fSGustavo F. Padovan control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT; 14340a708f8fSGustavo F. Padovan 1435525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 14360a708f8fSGustavo F. Padovan } 14370a708f8fSGustavo F. Padovan 14380a708f8fSGustavo F. Padovan static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb) 14390a708f8fSGustavo F. Padovan { 14408c1d787bSGustavo F. Padovan struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn; 14410a708f8fSGustavo F. Padovan struct sk_buff **frag; 14420a708f8fSGustavo F. Padovan int err, sent = 0; 14430a708f8fSGustavo F. Padovan 14440a708f8fSGustavo F. Padovan if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) 14450a708f8fSGustavo F. Padovan return -EFAULT; 14460a708f8fSGustavo F. Padovan 14470a708f8fSGustavo F. Padovan sent += count; 14480a708f8fSGustavo F. Padovan len -= count; 14490a708f8fSGustavo F. Padovan 14500a708f8fSGustavo F. Padovan /* Continuation fragments (no L2CAP header) */ 14510a708f8fSGustavo F. Padovan frag = &skb_shinfo(skb)->frag_list; 14520a708f8fSGustavo F. Padovan while (len) { 14530a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, len); 14540a708f8fSGustavo F. Padovan 14550a708f8fSGustavo F. Padovan *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err); 14560a708f8fSGustavo F. Padovan if (!*frag) 14570a708f8fSGustavo F. Padovan return err; 14580a708f8fSGustavo F. Padovan if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) 14590a708f8fSGustavo F. Padovan return -EFAULT; 14600a708f8fSGustavo F. Padovan 14610a708f8fSGustavo F. Padovan sent += count; 14620a708f8fSGustavo F. Padovan len -= count; 14630a708f8fSGustavo F. Padovan 14640a708f8fSGustavo F. Padovan frag = &(*frag)->next; 14650a708f8fSGustavo F. Padovan } 14660a708f8fSGustavo F. Padovan 14670a708f8fSGustavo F. Padovan return sent; 14680a708f8fSGustavo F. Padovan } 14690a708f8fSGustavo F. Padovan 147067c9e840SSzymon Janc static struct sk_buff *l2cap_create_connless_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 14710a708f8fSGustavo F. Padovan { 1472fe4128e0SGustavo F. Padovan struct sock *sk = chan->sk; 14738c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 14740a708f8fSGustavo F. Padovan struct sk_buff *skb; 14750a708f8fSGustavo F. Padovan int err, count, hlen = L2CAP_HDR_SIZE + 2; 14760a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 14770a708f8fSGustavo F. Padovan 14780a708f8fSGustavo F. Padovan BT_DBG("sk %p len %d", sk, (int)len); 14790a708f8fSGustavo F. Padovan 14800a708f8fSGustavo F. Padovan count = min_t(unsigned int, (conn->mtu - hlen), len); 14810a708f8fSGustavo F. Padovan skb = bt_skb_send_alloc(sk, count + hlen, 14820a708f8fSGustavo F. Padovan msg->msg_flags & MSG_DONTWAIT, &err); 14830a708f8fSGustavo F. Padovan if (!skb) 14840a708f8fSGustavo F. Padovan return ERR_PTR(err); 14850a708f8fSGustavo F. Padovan 14860a708f8fSGustavo F. Padovan /* Create L2CAP header */ 14870a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 1488fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 14890a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 1490fe4128e0SGustavo F. Padovan put_unaligned_le16(chan->psm, skb_put(skb, 2)); 14910a708f8fSGustavo F. Padovan 14920a708f8fSGustavo F. Padovan err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb); 14930a708f8fSGustavo F. Padovan if (unlikely(err < 0)) { 14940a708f8fSGustavo F. Padovan kfree_skb(skb); 14950a708f8fSGustavo F. Padovan return ERR_PTR(err); 14960a708f8fSGustavo F. Padovan } 14970a708f8fSGustavo F. Padovan return skb; 14980a708f8fSGustavo F. Padovan } 14990a708f8fSGustavo F. Padovan 150067c9e840SSzymon Janc static struct sk_buff *l2cap_create_basic_pdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 15010a708f8fSGustavo F. Padovan { 1502fe4128e0SGustavo F. Padovan struct sock *sk = chan->sk; 15038c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 15040a708f8fSGustavo F. Padovan struct sk_buff *skb; 15050a708f8fSGustavo F. Padovan int err, count, hlen = L2CAP_HDR_SIZE; 15060a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 15070a708f8fSGustavo F. Padovan 15080a708f8fSGustavo F. Padovan BT_DBG("sk %p len %d", sk, (int)len); 15090a708f8fSGustavo F. Padovan 15100a708f8fSGustavo F. Padovan count = min_t(unsigned int, (conn->mtu - hlen), len); 15110a708f8fSGustavo F. Padovan skb = bt_skb_send_alloc(sk, count + hlen, 15120a708f8fSGustavo F. Padovan msg->msg_flags & MSG_DONTWAIT, &err); 15130a708f8fSGustavo F. Padovan if (!skb) 15140a708f8fSGustavo F. Padovan return ERR_PTR(err); 15150a708f8fSGustavo F. Padovan 15160a708f8fSGustavo F. Padovan /* Create L2CAP header */ 15170a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 1518fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 15190a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 15200a708f8fSGustavo F. Padovan 15210a708f8fSGustavo F. Padovan err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb); 15220a708f8fSGustavo F. Padovan if (unlikely(err < 0)) { 15230a708f8fSGustavo F. Padovan kfree_skb(skb); 15240a708f8fSGustavo F. Padovan return ERR_PTR(err); 15250a708f8fSGustavo F. Padovan } 15260a708f8fSGustavo F. Padovan return skb; 15270a708f8fSGustavo F. Padovan } 15280a708f8fSGustavo F. Padovan 1529ab0ff76dSLuiz Augusto von Dentz static struct sk_buff *l2cap_create_iframe_pdu(struct l2cap_chan *chan, 1530ab0ff76dSLuiz Augusto von Dentz struct msghdr *msg, size_t len, 1531ab0ff76dSLuiz Augusto von Dentz u16 control, u16 sdulen) 15320a708f8fSGustavo F. Padovan { 153347d1ec61SGustavo F. Padovan struct sock *sk = chan->sk; 15348c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 15350a708f8fSGustavo F. Padovan struct sk_buff *skb; 15360a708f8fSGustavo F. Padovan int err, count, hlen = L2CAP_HDR_SIZE + 2; 15370a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 15380a708f8fSGustavo F. Padovan 15390a708f8fSGustavo F. Padovan BT_DBG("sk %p len %d", sk, (int)len); 15400a708f8fSGustavo F. Padovan 15410a708f8fSGustavo F. Padovan if (!conn) 15420a708f8fSGustavo F. Padovan return ERR_PTR(-ENOTCONN); 15430a708f8fSGustavo F. Padovan 15440a708f8fSGustavo F. Padovan if (sdulen) 15450a708f8fSGustavo F. Padovan hlen += 2; 15460a708f8fSGustavo F. Padovan 154747d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 15480a708f8fSGustavo F. Padovan hlen += 2; 15490a708f8fSGustavo F. Padovan 15500a708f8fSGustavo F. Padovan count = min_t(unsigned int, (conn->mtu - hlen), len); 15510a708f8fSGustavo F. Padovan skb = bt_skb_send_alloc(sk, count + hlen, 15520a708f8fSGustavo F. Padovan msg->msg_flags & MSG_DONTWAIT, &err); 15530a708f8fSGustavo F. Padovan if (!skb) 15540a708f8fSGustavo F. Padovan return ERR_PTR(err); 15550a708f8fSGustavo F. Padovan 15560a708f8fSGustavo F. Padovan /* Create L2CAP header */ 15570a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 1558fe4128e0SGustavo F. Padovan lh->cid = cpu_to_le16(chan->dcid); 15590a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE)); 15600a708f8fSGustavo F. Padovan put_unaligned_le16(control, skb_put(skb, 2)); 15610a708f8fSGustavo F. Padovan if (sdulen) 15620a708f8fSGustavo F. Padovan put_unaligned_le16(sdulen, skb_put(skb, 2)); 15630a708f8fSGustavo F. Padovan 15640a708f8fSGustavo F. Padovan err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb); 15650a708f8fSGustavo F. Padovan if (unlikely(err < 0)) { 15660a708f8fSGustavo F. Padovan kfree_skb(skb); 15670a708f8fSGustavo F. Padovan return ERR_PTR(err); 15680a708f8fSGustavo F. Padovan } 15690a708f8fSGustavo F. Padovan 157047d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 15710a708f8fSGustavo F. Padovan put_unaligned_le16(0, skb_put(skb, 2)); 15720a708f8fSGustavo F. Padovan 15730a708f8fSGustavo F. Padovan bt_cb(skb)->retries = 0; 15740a708f8fSGustavo F. Padovan return skb; 15750a708f8fSGustavo F. Padovan } 15760a708f8fSGustavo F. Padovan 157767c9e840SSzymon Janc static int l2cap_sar_segment_sdu(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 15780a708f8fSGustavo F. Padovan { 15790a708f8fSGustavo F. Padovan struct sk_buff *skb; 15800a708f8fSGustavo F. Padovan struct sk_buff_head sar_queue; 15810a708f8fSGustavo F. Padovan u16 control; 15820a708f8fSGustavo F. Padovan size_t size = 0; 15830a708f8fSGustavo F. Padovan 15840a708f8fSGustavo F. Padovan skb_queue_head_init(&sar_queue); 15850a708f8fSGustavo F. Padovan control = L2CAP_SDU_START; 158647d1ec61SGustavo F. Padovan skb = l2cap_create_iframe_pdu(chan, msg, chan->remote_mps, control, len); 15870a708f8fSGustavo F. Padovan if (IS_ERR(skb)) 15880a708f8fSGustavo F. Padovan return PTR_ERR(skb); 15890a708f8fSGustavo F. Padovan 15900a708f8fSGustavo F. Padovan __skb_queue_tail(&sar_queue, skb); 15912c03a7a4SGustavo F. Padovan len -= chan->remote_mps; 15922c03a7a4SGustavo F. Padovan size += chan->remote_mps; 15930a708f8fSGustavo F. Padovan 15940a708f8fSGustavo F. Padovan while (len > 0) { 15950a708f8fSGustavo F. Padovan size_t buflen; 15960a708f8fSGustavo F. Padovan 15972c03a7a4SGustavo F. Padovan if (len > chan->remote_mps) { 15980a708f8fSGustavo F. Padovan control = L2CAP_SDU_CONTINUE; 15992c03a7a4SGustavo F. Padovan buflen = chan->remote_mps; 16000a708f8fSGustavo F. Padovan } else { 16010a708f8fSGustavo F. Padovan control = L2CAP_SDU_END; 16020a708f8fSGustavo F. Padovan buflen = len; 16030a708f8fSGustavo F. Padovan } 16040a708f8fSGustavo F. Padovan 160547d1ec61SGustavo F. Padovan skb = l2cap_create_iframe_pdu(chan, msg, buflen, control, 0); 16060a708f8fSGustavo F. Padovan if (IS_ERR(skb)) { 16070a708f8fSGustavo F. Padovan skb_queue_purge(&sar_queue); 16080a708f8fSGustavo F. Padovan return PTR_ERR(skb); 16090a708f8fSGustavo F. Padovan } 16100a708f8fSGustavo F. Padovan 16110a708f8fSGustavo F. Padovan __skb_queue_tail(&sar_queue, skb); 16120a708f8fSGustavo F. Padovan len -= buflen; 16130a708f8fSGustavo F. Padovan size += buflen; 16140a708f8fSGustavo F. Padovan } 161558d35f87SGustavo F. Padovan skb_queue_splice_tail(&sar_queue, &chan->tx_q); 161658d35f87SGustavo F. Padovan if (chan->tx_send_head == NULL) 161758d35f87SGustavo F. Padovan chan->tx_send_head = sar_queue.next; 16180a708f8fSGustavo F. Padovan 16190a708f8fSGustavo F. Padovan return size; 16200a708f8fSGustavo F. Padovan } 16210a708f8fSGustavo F. Padovan 16229a91a04aSGustavo F. Padovan int l2cap_chan_send(struct l2cap_chan *chan, struct msghdr *msg, size_t len) 16239a91a04aSGustavo F. Padovan { 16249a91a04aSGustavo F. Padovan struct sk_buff *skb; 16259a91a04aSGustavo F. Padovan u16 control; 16269a91a04aSGustavo F. Padovan int err; 16279a91a04aSGustavo F. Padovan 16289a91a04aSGustavo F. Padovan /* Connectionless channel */ 1629715ec005SGustavo F. Padovan if (chan->chan_type == L2CAP_CHAN_CONN_LESS) { 16309a91a04aSGustavo F. Padovan skb = l2cap_create_connless_pdu(chan, msg, len); 16319a91a04aSGustavo F. Padovan if (IS_ERR(skb)) 16329a91a04aSGustavo F. Padovan return PTR_ERR(skb); 16339a91a04aSGustavo F. Padovan 16349a91a04aSGustavo F. Padovan l2cap_do_send(chan, skb); 16359a91a04aSGustavo F. Padovan return len; 16369a91a04aSGustavo F. Padovan } 16379a91a04aSGustavo F. Padovan 16389a91a04aSGustavo F. Padovan switch (chan->mode) { 16399a91a04aSGustavo F. Padovan case L2CAP_MODE_BASIC: 16409a91a04aSGustavo F. Padovan /* Check outgoing MTU */ 16419a91a04aSGustavo F. Padovan if (len > chan->omtu) 16429a91a04aSGustavo F. Padovan return -EMSGSIZE; 16439a91a04aSGustavo F. Padovan 16449a91a04aSGustavo F. Padovan /* Create a basic PDU */ 16459a91a04aSGustavo F. Padovan skb = l2cap_create_basic_pdu(chan, msg, len); 16469a91a04aSGustavo F. Padovan if (IS_ERR(skb)) 16479a91a04aSGustavo F. Padovan return PTR_ERR(skb); 16489a91a04aSGustavo F. Padovan 16499a91a04aSGustavo F. Padovan l2cap_do_send(chan, skb); 16509a91a04aSGustavo F. Padovan err = len; 16519a91a04aSGustavo F. Padovan break; 16529a91a04aSGustavo F. Padovan 16539a91a04aSGustavo F. Padovan case L2CAP_MODE_ERTM: 16549a91a04aSGustavo F. Padovan case L2CAP_MODE_STREAMING: 16559a91a04aSGustavo F. Padovan /* Entire SDU fits into one PDU */ 16569a91a04aSGustavo F. Padovan if (len <= chan->remote_mps) { 16579a91a04aSGustavo F. Padovan control = L2CAP_SDU_UNSEGMENTED; 16589a91a04aSGustavo F. Padovan skb = l2cap_create_iframe_pdu(chan, msg, len, control, 16599a91a04aSGustavo F. Padovan 0); 16609a91a04aSGustavo F. Padovan if (IS_ERR(skb)) 16619a91a04aSGustavo F. Padovan return PTR_ERR(skb); 16629a91a04aSGustavo F. Padovan 16639a91a04aSGustavo F. Padovan __skb_queue_tail(&chan->tx_q, skb); 16649a91a04aSGustavo F. Padovan 16659a91a04aSGustavo F. Padovan if (chan->tx_send_head == NULL) 16669a91a04aSGustavo F. Padovan chan->tx_send_head = skb; 16679a91a04aSGustavo F. Padovan 16689a91a04aSGustavo F. Padovan } else { 16699a91a04aSGustavo F. Padovan /* Segment SDU into multiples PDUs */ 16709a91a04aSGustavo F. Padovan err = l2cap_sar_segment_sdu(chan, msg, len); 16719a91a04aSGustavo F. Padovan if (err < 0) 16729a91a04aSGustavo F. Padovan return err; 16739a91a04aSGustavo F. Padovan } 16749a91a04aSGustavo F. Padovan 16759a91a04aSGustavo F. Padovan if (chan->mode == L2CAP_MODE_STREAMING) { 16769a91a04aSGustavo F. Padovan l2cap_streaming_send(chan); 16779a91a04aSGustavo F. Padovan err = len; 16789a91a04aSGustavo F. Padovan break; 16799a91a04aSGustavo F. Padovan } 16809a91a04aSGustavo F. Padovan 1681e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 1682e2ab4353SGustavo F. Padovan test_bit(CONN_WAIT_F, &chan->conn_state)) { 16839a91a04aSGustavo F. Padovan err = len; 16849a91a04aSGustavo F. Padovan break; 16859a91a04aSGustavo F. Padovan } 16869a91a04aSGustavo F. Padovan 16879a91a04aSGustavo F. Padovan err = l2cap_ertm_send(chan); 16889a91a04aSGustavo F. Padovan if (err >= 0) 16899a91a04aSGustavo F. Padovan err = len; 16909a91a04aSGustavo F. Padovan 16919a91a04aSGustavo F. Padovan break; 16929a91a04aSGustavo F. Padovan 16939a91a04aSGustavo F. Padovan default: 16949a91a04aSGustavo F. Padovan BT_DBG("bad state %1.1x", chan->mode); 16959a91a04aSGustavo F. Padovan err = -EBADFD; 16969a91a04aSGustavo F. Padovan } 16979a91a04aSGustavo F. Padovan 16989a91a04aSGustavo F. Padovan return err; 16999a91a04aSGustavo F. Padovan } 17009a91a04aSGustavo F. Padovan 17010a708f8fSGustavo F. Padovan /* Copy frame to all raw sockets on that connection */ 17020a708f8fSGustavo F. Padovan static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb) 17030a708f8fSGustavo F. Padovan { 17040a708f8fSGustavo F. Padovan struct sk_buff *nskb; 170548454079SGustavo F. Padovan struct l2cap_chan *chan; 17060a708f8fSGustavo F. Padovan 17070a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 17080a708f8fSGustavo F. Padovan 1709baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 1710baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 171148454079SGustavo F. Padovan struct sock *sk = chan->sk; 1712715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_RAW) 17130a708f8fSGustavo F. Padovan continue; 17140a708f8fSGustavo F. Padovan 17150a708f8fSGustavo F. Padovan /* Don't send frame to the socket it came from */ 17160a708f8fSGustavo F. Padovan if (skb->sk == sk) 17170a708f8fSGustavo F. Padovan continue; 17180a708f8fSGustavo F. Padovan nskb = skb_clone(skb, GFP_ATOMIC); 17190a708f8fSGustavo F. Padovan if (!nskb) 17200a708f8fSGustavo F. Padovan continue; 17210a708f8fSGustavo F. Padovan 172223070494SGustavo F. Padovan if (chan->ops->recv(chan->data, nskb)) 17230a708f8fSGustavo F. Padovan kfree_skb(nskb); 17240a708f8fSGustavo F. Padovan } 1725baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 17260a708f8fSGustavo F. Padovan } 17270a708f8fSGustavo F. Padovan 17280a708f8fSGustavo F. Padovan /* ---- L2CAP signalling commands ---- */ 17290a708f8fSGustavo F. Padovan static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, 17300a708f8fSGustavo F. Padovan u8 code, u8 ident, u16 dlen, void *data) 17310a708f8fSGustavo F. Padovan { 17320a708f8fSGustavo F. Padovan struct sk_buff *skb, **frag; 17330a708f8fSGustavo F. Padovan struct l2cap_cmd_hdr *cmd; 17340a708f8fSGustavo F. Padovan struct l2cap_hdr *lh; 17350a708f8fSGustavo F. Padovan int len, count; 17360a708f8fSGustavo F. Padovan 17370a708f8fSGustavo F. Padovan BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", 17380a708f8fSGustavo F. Padovan conn, code, ident, dlen); 17390a708f8fSGustavo F. Padovan 17400a708f8fSGustavo F. Padovan len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen; 17410a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, len); 17420a708f8fSGustavo F. Padovan 17430a708f8fSGustavo F. Padovan skb = bt_skb_alloc(count, GFP_ATOMIC); 17440a708f8fSGustavo F. Padovan if (!skb) 17450a708f8fSGustavo F. Padovan return NULL; 17460a708f8fSGustavo F. Padovan 17470a708f8fSGustavo F. Padovan lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE); 17480a708f8fSGustavo F. Padovan lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen); 17493300d9a9SClaudio Takahasi 17503300d9a9SClaudio Takahasi if (conn->hcon->type == LE_LINK) 17513300d9a9SClaudio Takahasi lh->cid = cpu_to_le16(L2CAP_CID_LE_SIGNALING); 17523300d9a9SClaudio Takahasi else 17530a708f8fSGustavo F. Padovan lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING); 17540a708f8fSGustavo F. Padovan 17550a708f8fSGustavo F. Padovan cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE); 17560a708f8fSGustavo F. Padovan cmd->code = code; 17570a708f8fSGustavo F. Padovan cmd->ident = ident; 17580a708f8fSGustavo F. Padovan cmd->len = cpu_to_le16(dlen); 17590a708f8fSGustavo F. Padovan 17600a708f8fSGustavo F. Padovan if (dlen) { 17610a708f8fSGustavo F. Padovan count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE; 17620a708f8fSGustavo F. Padovan memcpy(skb_put(skb, count), data, count); 17630a708f8fSGustavo F. Padovan data += count; 17640a708f8fSGustavo F. Padovan } 17650a708f8fSGustavo F. Padovan 17660a708f8fSGustavo F. Padovan len -= skb->len; 17670a708f8fSGustavo F. Padovan 17680a708f8fSGustavo F. Padovan /* Continuation fragments (no L2CAP header) */ 17690a708f8fSGustavo F. Padovan frag = &skb_shinfo(skb)->frag_list; 17700a708f8fSGustavo F. Padovan while (len) { 17710a708f8fSGustavo F. Padovan count = min_t(unsigned int, conn->mtu, len); 17720a708f8fSGustavo F. Padovan 17730a708f8fSGustavo F. Padovan *frag = bt_skb_alloc(count, GFP_ATOMIC); 17740a708f8fSGustavo F. Padovan if (!*frag) 17750a708f8fSGustavo F. Padovan goto fail; 17760a708f8fSGustavo F. Padovan 17770a708f8fSGustavo F. Padovan memcpy(skb_put(*frag, count), data, count); 17780a708f8fSGustavo F. Padovan 17790a708f8fSGustavo F. Padovan len -= count; 17800a708f8fSGustavo F. Padovan data += count; 17810a708f8fSGustavo F. Padovan 17820a708f8fSGustavo F. Padovan frag = &(*frag)->next; 17830a708f8fSGustavo F. Padovan } 17840a708f8fSGustavo F. Padovan 17850a708f8fSGustavo F. Padovan return skb; 17860a708f8fSGustavo F. Padovan 17870a708f8fSGustavo F. Padovan fail: 17880a708f8fSGustavo F. Padovan kfree_skb(skb); 17890a708f8fSGustavo F. Padovan return NULL; 17900a708f8fSGustavo F. Padovan } 17910a708f8fSGustavo F. Padovan 17920a708f8fSGustavo F. Padovan static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val) 17930a708f8fSGustavo F. Padovan { 17940a708f8fSGustavo F. Padovan struct l2cap_conf_opt *opt = *ptr; 17950a708f8fSGustavo F. Padovan int len; 17960a708f8fSGustavo F. Padovan 17970a708f8fSGustavo F. Padovan len = L2CAP_CONF_OPT_SIZE + opt->len; 17980a708f8fSGustavo F. Padovan *ptr += len; 17990a708f8fSGustavo F. Padovan 18000a708f8fSGustavo F. Padovan *type = opt->type; 18010a708f8fSGustavo F. Padovan *olen = opt->len; 18020a708f8fSGustavo F. Padovan 18030a708f8fSGustavo F. Padovan switch (opt->len) { 18040a708f8fSGustavo F. Padovan case 1: 18050a708f8fSGustavo F. Padovan *val = *((u8 *) opt->val); 18060a708f8fSGustavo F. Padovan break; 18070a708f8fSGustavo F. Padovan 18080a708f8fSGustavo F. Padovan case 2: 18090a708f8fSGustavo F. Padovan *val = get_unaligned_le16(opt->val); 18100a708f8fSGustavo F. Padovan break; 18110a708f8fSGustavo F. Padovan 18120a708f8fSGustavo F. Padovan case 4: 18130a708f8fSGustavo F. Padovan *val = get_unaligned_le32(opt->val); 18140a708f8fSGustavo F. Padovan break; 18150a708f8fSGustavo F. Padovan 18160a708f8fSGustavo F. Padovan default: 18170a708f8fSGustavo F. Padovan *val = (unsigned long) opt->val; 18180a708f8fSGustavo F. Padovan break; 18190a708f8fSGustavo F. Padovan } 18200a708f8fSGustavo F. Padovan 18210a708f8fSGustavo F. Padovan BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val); 18220a708f8fSGustavo F. Padovan return len; 18230a708f8fSGustavo F. Padovan } 18240a708f8fSGustavo F. Padovan 18250a708f8fSGustavo F. Padovan static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) 18260a708f8fSGustavo F. Padovan { 18270a708f8fSGustavo F. Padovan struct l2cap_conf_opt *opt = *ptr; 18280a708f8fSGustavo F. Padovan 18290a708f8fSGustavo F. Padovan BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val); 18300a708f8fSGustavo F. Padovan 18310a708f8fSGustavo F. Padovan opt->type = type; 18320a708f8fSGustavo F. Padovan opt->len = len; 18330a708f8fSGustavo F. Padovan 18340a708f8fSGustavo F. Padovan switch (len) { 18350a708f8fSGustavo F. Padovan case 1: 18360a708f8fSGustavo F. Padovan *((u8 *) opt->val) = val; 18370a708f8fSGustavo F. Padovan break; 18380a708f8fSGustavo F. Padovan 18390a708f8fSGustavo F. Padovan case 2: 18400a708f8fSGustavo F. Padovan put_unaligned_le16(val, opt->val); 18410a708f8fSGustavo F. Padovan break; 18420a708f8fSGustavo F. Padovan 18430a708f8fSGustavo F. Padovan case 4: 18440a708f8fSGustavo F. Padovan put_unaligned_le32(val, opt->val); 18450a708f8fSGustavo F. Padovan break; 18460a708f8fSGustavo F. Padovan 18470a708f8fSGustavo F. Padovan default: 18480a708f8fSGustavo F. Padovan memcpy(opt->val, (void *) val, len); 18490a708f8fSGustavo F. Padovan break; 18500a708f8fSGustavo F. Padovan } 18510a708f8fSGustavo F. Padovan 18520a708f8fSGustavo F. Padovan *ptr += L2CAP_CONF_OPT_SIZE + len; 18530a708f8fSGustavo F. Padovan } 18540a708f8fSGustavo F. Padovan 18550a708f8fSGustavo F. Padovan static void l2cap_ack_timeout(unsigned long arg) 18560a708f8fSGustavo F. Padovan { 1857525cd185SGustavo F. Padovan struct l2cap_chan *chan = (void *) arg; 18580a708f8fSGustavo F. Padovan 1859525cd185SGustavo F. Padovan bh_lock_sock(chan->sk); 1860525cd185SGustavo F. Padovan l2cap_send_ack(chan); 1861525cd185SGustavo F. Padovan bh_unlock_sock(chan->sk); 18620a708f8fSGustavo F. Padovan } 18630a708f8fSGustavo F. Padovan 1864525cd185SGustavo F. Padovan static inline void l2cap_ertm_init(struct l2cap_chan *chan) 18650a708f8fSGustavo F. Padovan { 1866525cd185SGustavo F. Padovan struct sock *sk = chan->sk; 1867525cd185SGustavo F. Padovan 186842e5c802SGustavo F. Padovan chan->expected_ack_seq = 0; 18696a026610SGustavo F. Padovan chan->unacked_frames = 0; 187042e5c802SGustavo F. Padovan chan->buffer_seq = 0; 18716a026610SGustavo F. Padovan chan->num_acked = 0; 18726a026610SGustavo F. Padovan chan->frames_sent = 0; 18730a708f8fSGustavo F. Padovan 1874e92c8e70SGustavo F. Padovan setup_timer(&chan->retrans_timer, l2cap_retrans_timeout, 1875e92c8e70SGustavo F. Padovan (unsigned long) chan); 1876e92c8e70SGustavo F. Padovan setup_timer(&chan->monitor_timer, l2cap_monitor_timeout, 1877e92c8e70SGustavo F. Padovan (unsigned long) chan); 1878e92c8e70SGustavo F. Padovan setup_timer(&chan->ack_timer, l2cap_ack_timeout, (unsigned long) chan); 18790a708f8fSGustavo F. Padovan 1880f1c6775bSGustavo F. Padovan skb_queue_head_init(&chan->srej_q); 18810a708f8fSGustavo F. Padovan 188239d5a3eeSGustavo F. Padovan INIT_LIST_HEAD(&chan->srej_l); 188339d5a3eeSGustavo F. Padovan 18840a708f8fSGustavo F. Padovan 18850a708f8fSGustavo F. Padovan sk->sk_backlog_rcv = l2cap_ertm_data_rcv; 18860a708f8fSGustavo F. Padovan } 18870a708f8fSGustavo F. Padovan 18880a708f8fSGustavo F. Padovan static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask) 18890a708f8fSGustavo F. Padovan { 18900a708f8fSGustavo F. Padovan switch (mode) { 18910a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 18920a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 18930a708f8fSGustavo F. Padovan if (l2cap_mode_supported(mode, remote_feat_mask)) 18940a708f8fSGustavo F. Padovan return mode; 18950a708f8fSGustavo F. Padovan /* fall through */ 18960a708f8fSGustavo F. Padovan default: 18970a708f8fSGustavo F. Padovan return L2CAP_MODE_BASIC; 18980a708f8fSGustavo F. Padovan } 18990a708f8fSGustavo F. Padovan } 19000a708f8fSGustavo F. Padovan 1901*6327eb98SAndrei Emeltchenko static inline bool __l2cap_ews_supported(struct l2cap_chan *chan) 1902*6327eb98SAndrei Emeltchenko { 1903*6327eb98SAndrei Emeltchenko return enable_hs && chan->conn->feat_mask & L2CAP_FEAT_EXT_WINDOW; 1904*6327eb98SAndrei Emeltchenko } 1905*6327eb98SAndrei Emeltchenko 1906*6327eb98SAndrei Emeltchenko static inline void l2cap_txwin_setup(struct l2cap_chan *chan) 1907*6327eb98SAndrei Emeltchenko { 1908*6327eb98SAndrei Emeltchenko if (chan->tx_win > L2CAP_DEFAULT_TX_WINDOW && 1909*6327eb98SAndrei Emeltchenko __l2cap_ews_supported(chan)) 1910*6327eb98SAndrei Emeltchenko /* use extended control field */ 1911*6327eb98SAndrei Emeltchenko set_bit(FLAG_EXT_CTRL, &chan->flags); 1912*6327eb98SAndrei Emeltchenko else 1913*6327eb98SAndrei Emeltchenko chan->tx_win = min_t(u16, chan->tx_win, 1914*6327eb98SAndrei Emeltchenko L2CAP_DEFAULT_TX_WINDOW); 1915*6327eb98SAndrei Emeltchenko } 1916*6327eb98SAndrei Emeltchenko 1917710f9b0aSGustavo F. Padovan static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) 19180a708f8fSGustavo F. Padovan { 19190a708f8fSGustavo F. Padovan struct l2cap_conf_req *req = data; 19200c1bc5c6SGustavo F. Padovan struct l2cap_conf_rfc rfc = { .mode = chan->mode }; 19210a708f8fSGustavo F. Padovan void *ptr = req->data; 19220a708f8fSGustavo F. Padovan 192349208c9cSGustavo F. Padovan BT_DBG("chan %p", chan); 19240a708f8fSGustavo F. Padovan 192573ffa904SGustavo F. Padovan if (chan->num_conf_req || chan->num_conf_rsp) 19260a708f8fSGustavo F. Padovan goto done; 19270a708f8fSGustavo F. Padovan 19280c1bc5c6SGustavo F. Padovan switch (chan->mode) { 19290a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 19300a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 1931c1360a1cSGustavo F. Padovan if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) 19320a708f8fSGustavo F. Padovan break; 19330a708f8fSGustavo F. Padovan 19340a708f8fSGustavo F. Padovan /* fall through */ 19350a708f8fSGustavo F. Padovan default: 19368c1d787bSGustavo F. Padovan chan->mode = l2cap_select_mode(rfc.mode, chan->conn->feat_mask); 19370a708f8fSGustavo F. Padovan break; 19380a708f8fSGustavo F. Padovan } 19390a708f8fSGustavo F. Padovan 19400a708f8fSGustavo F. Padovan done: 19410c1bc5c6SGustavo F. Padovan if (chan->imtu != L2CAP_DEFAULT_MTU) 19420c1bc5c6SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); 19430a708f8fSGustavo F. Padovan 19440c1bc5c6SGustavo F. Padovan switch (chan->mode) { 19450a708f8fSGustavo F. Padovan case L2CAP_MODE_BASIC: 19468c1d787bSGustavo F. Padovan if (!(chan->conn->feat_mask & L2CAP_FEAT_ERTM) && 19478c1d787bSGustavo F. Padovan !(chan->conn->feat_mask & L2CAP_FEAT_STREAMING)) 19480a708f8fSGustavo F. Padovan break; 19490a708f8fSGustavo F. Padovan 19500a708f8fSGustavo F. Padovan rfc.mode = L2CAP_MODE_BASIC; 19510a708f8fSGustavo F. Padovan rfc.txwin_size = 0; 19520a708f8fSGustavo F. Padovan rfc.max_transmit = 0; 19530a708f8fSGustavo F. Padovan rfc.retrans_timeout = 0; 19540a708f8fSGustavo F. Padovan rfc.monitor_timeout = 0; 19550a708f8fSGustavo F. Padovan rfc.max_pdu_size = 0; 19560a708f8fSGustavo F. Padovan 19570a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 19580a708f8fSGustavo F. Padovan (unsigned long) &rfc); 19590a708f8fSGustavo F. Padovan break; 19600a708f8fSGustavo F. Padovan 19610a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 19620a708f8fSGustavo F. Padovan rfc.mode = L2CAP_MODE_ERTM; 196347d1ec61SGustavo F. Padovan rfc.max_transmit = chan->max_tx; 19640a708f8fSGustavo F. Padovan rfc.retrans_timeout = 0; 19650a708f8fSGustavo F. Padovan rfc.monitor_timeout = 0; 19660a708f8fSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE); 19678c1d787bSGustavo F. Padovan if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10) 19688c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 19690a708f8fSGustavo F. Padovan 1970*6327eb98SAndrei Emeltchenko l2cap_txwin_setup(chan); 1971*6327eb98SAndrei Emeltchenko 1972*6327eb98SAndrei Emeltchenko rfc.txwin_size = min_t(u16, chan->tx_win, 1973*6327eb98SAndrei Emeltchenko L2CAP_DEFAULT_TX_WINDOW); 1974*6327eb98SAndrei Emeltchenko 19750a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 19760a708f8fSGustavo F. Padovan (unsigned long) &rfc); 19770a708f8fSGustavo F. Padovan 19788c1d787bSGustavo F. Padovan if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS)) 19790a708f8fSGustavo F. Padovan break; 19800a708f8fSGustavo F. Padovan 198147d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_NONE || 1982c1360a1cSGustavo F. Padovan test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) { 198347d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 198447d1ec61SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs); 19850a708f8fSGustavo F. Padovan } 1986*6327eb98SAndrei Emeltchenko 1987*6327eb98SAndrei Emeltchenko if (test_bit(FLAG_EXT_CTRL, &chan->flags)) 1988*6327eb98SAndrei Emeltchenko l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, 1989*6327eb98SAndrei Emeltchenko chan->tx_win); 19900a708f8fSGustavo F. Padovan break; 19910a708f8fSGustavo F. Padovan 19920a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 19930a708f8fSGustavo F. Padovan rfc.mode = L2CAP_MODE_STREAMING; 19940a708f8fSGustavo F. Padovan rfc.txwin_size = 0; 19950a708f8fSGustavo F. Padovan rfc.max_transmit = 0; 19960a708f8fSGustavo F. Padovan rfc.retrans_timeout = 0; 19970a708f8fSGustavo F. Padovan rfc.monitor_timeout = 0; 19980a708f8fSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE); 19998c1d787bSGustavo F. Padovan if (L2CAP_DEFAULT_MAX_PDU_SIZE > chan->conn->mtu - 10) 20008c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 20010a708f8fSGustavo F. Padovan 20020a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), 20030a708f8fSGustavo F. Padovan (unsigned long) &rfc); 20040a708f8fSGustavo F. Padovan 20058c1d787bSGustavo F. Padovan if (!(chan->conn->feat_mask & L2CAP_FEAT_FCS)) 20060a708f8fSGustavo F. Padovan break; 20070a708f8fSGustavo F. Padovan 200847d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_NONE || 2009c1360a1cSGustavo F. Padovan test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) { 201047d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 201147d1ec61SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, chan->fcs); 20120a708f8fSGustavo F. Padovan } 20130a708f8fSGustavo F. Padovan break; 20140a708f8fSGustavo F. Padovan } 20150a708f8fSGustavo F. Padovan 2016fe4128e0SGustavo F. Padovan req->dcid = cpu_to_le16(chan->dcid); 20170a708f8fSGustavo F. Padovan req->flags = cpu_to_le16(0); 20180a708f8fSGustavo F. Padovan 20190a708f8fSGustavo F. Padovan return ptr - data; 20200a708f8fSGustavo F. Padovan } 20210a708f8fSGustavo F. Padovan 202273ffa904SGustavo F. Padovan static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data) 20230a708f8fSGustavo F. Padovan { 20240a708f8fSGustavo F. Padovan struct l2cap_conf_rsp *rsp = data; 20250a708f8fSGustavo F. Padovan void *ptr = rsp->data; 202673ffa904SGustavo F. Padovan void *req = chan->conf_req; 202773ffa904SGustavo F. Padovan int len = chan->conf_len; 20280a708f8fSGustavo F. Padovan int type, hint, olen; 20290a708f8fSGustavo F. Padovan unsigned long val; 20300a708f8fSGustavo F. Padovan struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; 20310a708f8fSGustavo F. Padovan u16 mtu = L2CAP_DEFAULT_MTU; 20320a708f8fSGustavo F. Padovan u16 result = L2CAP_CONF_SUCCESS; 20330a708f8fSGustavo F. Padovan 203473ffa904SGustavo F. Padovan BT_DBG("chan %p", chan); 20350a708f8fSGustavo F. Padovan 20360a708f8fSGustavo F. Padovan while (len >= L2CAP_CONF_OPT_SIZE) { 20370a708f8fSGustavo F. Padovan len -= l2cap_get_conf_opt(&req, &type, &olen, &val); 20380a708f8fSGustavo F. Padovan 20390a708f8fSGustavo F. Padovan hint = type & L2CAP_CONF_HINT; 20400a708f8fSGustavo F. Padovan type &= L2CAP_CONF_MASK; 20410a708f8fSGustavo F. Padovan 20420a708f8fSGustavo F. Padovan switch (type) { 20430a708f8fSGustavo F. Padovan case L2CAP_CONF_MTU: 20440a708f8fSGustavo F. Padovan mtu = val; 20450a708f8fSGustavo F. Padovan break; 20460a708f8fSGustavo F. Padovan 20470a708f8fSGustavo F. Padovan case L2CAP_CONF_FLUSH_TO: 20480c1bc5c6SGustavo F. Padovan chan->flush_to = val; 20490a708f8fSGustavo F. Padovan break; 20500a708f8fSGustavo F. Padovan 20510a708f8fSGustavo F. Padovan case L2CAP_CONF_QOS: 20520a708f8fSGustavo F. Padovan break; 20530a708f8fSGustavo F. Padovan 20540a708f8fSGustavo F. Padovan case L2CAP_CONF_RFC: 20550a708f8fSGustavo F. Padovan if (olen == sizeof(rfc)) 20560a708f8fSGustavo F. Padovan memcpy(&rfc, (void *) val, olen); 20570a708f8fSGustavo F. Padovan break; 20580a708f8fSGustavo F. Padovan 20590a708f8fSGustavo F. Padovan case L2CAP_CONF_FCS: 20600a708f8fSGustavo F. Padovan if (val == L2CAP_FCS_NONE) 2061c1360a1cSGustavo F. Padovan set_bit(CONF_NO_FCS_RECV, &chan->conf_state); 20620a708f8fSGustavo F. Padovan 20630a708f8fSGustavo F. Padovan break; 20640a708f8fSGustavo F. Padovan 2065*6327eb98SAndrei Emeltchenko case L2CAP_CONF_EWS: 2066*6327eb98SAndrei Emeltchenko if (!enable_hs) 2067*6327eb98SAndrei Emeltchenko return -ECONNREFUSED; 2068*6327eb98SAndrei Emeltchenko 2069*6327eb98SAndrei Emeltchenko set_bit(FLAG_EXT_CTRL, &chan->flags); 2070*6327eb98SAndrei Emeltchenko set_bit(CONF_EWS_RECV, &chan->conf_state); 2071*6327eb98SAndrei Emeltchenko chan->remote_tx_win = val; 2072*6327eb98SAndrei Emeltchenko break; 2073*6327eb98SAndrei Emeltchenko 20740a708f8fSGustavo F. Padovan default: 20750a708f8fSGustavo F. Padovan if (hint) 20760a708f8fSGustavo F. Padovan break; 20770a708f8fSGustavo F. Padovan 20780a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNKNOWN; 20790a708f8fSGustavo F. Padovan *((u8 *) ptr++) = type; 20800a708f8fSGustavo F. Padovan break; 20810a708f8fSGustavo F. Padovan } 20820a708f8fSGustavo F. Padovan } 20830a708f8fSGustavo F. Padovan 208473ffa904SGustavo F. Padovan if (chan->num_conf_rsp || chan->num_conf_req > 1) 20850a708f8fSGustavo F. Padovan goto done; 20860a708f8fSGustavo F. Padovan 20870c1bc5c6SGustavo F. Padovan switch (chan->mode) { 20880a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 20890a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 2090c1360a1cSGustavo F. Padovan if (!test_bit(CONF_STATE2_DEVICE, &chan->conf_state)) { 20910c1bc5c6SGustavo F. Padovan chan->mode = l2cap_select_mode(rfc.mode, 20928c1d787bSGustavo F. Padovan chan->conn->feat_mask); 20930a708f8fSGustavo F. Padovan break; 20940a708f8fSGustavo F. Padovan } 20950a708f8fSGustavo F. Padovan 20960c1bc5c6SGustavo F. Padovan if (chan->mode != rfc.mode) 20970a708f8fSGustavo F. Padovan return -ECONNREFUSED; 20980a708f8fSGustavo F. Padovan 20990a708f8fSGustavo F. Padovan break; 21000a708f8fSGustavo F. Padovan } 21010a708f8fSGustavo F. Padovan 21020a708f8fSGustavo F. Padovan done: 21030c1bc5c6SGustavo F. Padovan if (chan->mode != rfc.mode) { 21040a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNACCEPT; 21050c1bc5c6SGustavo F. Padovan rfc.mode = chan->mode; 21060a708f8fSGustavo F. Padovan 210773ffa904SGustavo F. Padovan if (chan->num_conf_rsp == 1) 21080a708f8fSGustavo F. Padovan return -ECONNREFUSED; 21090a708f8fSGustavo F. Padovan 21100a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 21110a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 21120a708f8fSGustavo F. Padovan } 21130a708f8fSGustavo F. Padovan 21140a708f8fSGustavo F. Padovan 21150a708f8fSGustavo F. Padovan if (result == L2CAP_CONF_SUCCESS) { 21160a708f8fSGustavo F. Padovan /* Configure output options and let the other side know 21170a708f8fSGustavo F. Padovan * which ones we don't like. */ 21180a708f8fSGustavo F. Padovan 21190a708f8fSGustavo F. Padovan if (mtu < L2CAP_DEFAULT_MIN_MTU) 21200a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNACCEPT; 21210a708f8fSGustavo F. Padovan else { 21220c1bc5c6SGustavo F. Padovan chan->omtu = mtu; 2123c1360a1cSGustavo F. Padovan set_bit(CONF_MTU_DONE, &chan->conf_state); 21240a708f8fSGustavo F. Padovan } 21250c1bc5c6SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu); 21260a708f8fSGustavo F. Padovan 21270a708f8fSGustavo F. Padovan switch (rfc.mode) { 21280a708f8fSGustavo F. Padovan case L2CAP_MODE_BASIC: 212947d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 2130c1360a1cSGustavo F. Padovan set_bit(CONF_MODE_DONE, &chan->conf_state); 21310a708f8fSGustavo F. Padovan break; 21320a708f8fSGustavo F. Padovan 21330a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 2134*6327eb98SAndrei Emeltchenko if (!test_bit(CONF_EWS_RECV, &chan->conf_state)) 21352c03a7a4SGustavo F. Padovan chan->remote_tx_win = rfc.txwin_size; 2136*6327eb98SAndrei Emeltchenko else 2137*6327eb98SAndrei Emeltchenko rfc.txwin_size = L2CAP_DEFAULT_TX_WINDOW; 2138*6327eb98SAndrei Emeltchenko 21392c03a7a4SGustavo F. Padovan chan->remote_max_tx = rfc.max_transmit; 21400a708f8fSGustavo F. Padovan 21418c1d787bSGustavo F. Padovan if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10) 21428c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 21430a708f8fSGustavo F. Padovan 21442c03a7a4SGustavo F. Padovan chan->remote_mps = le16_to_cpu(rfc.max_pdu_size); 21450a708f8fSGustavo F. Padovan 21460a708f8fSGustavo F. Padovan rfc.retrans_timeout = 21470a708f8fSGustavo F. Padovan le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO); 21480a708f8fSGustavo F. Padovan rfc.monitor_timeout = 21490a708f8fSGustavo F. Padovan le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO); 21500a708f8fSGustavo F. Padovan 2151c1360a1cSGustavo F. Padovan set_bit(CONF_MODE_DONE, &chan->conf_state); 21520a708f8fSGustavo F. Padovan 21530a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 21540a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 21550a708f8fSGustavo F. Padovan 21560a708f8fSGustavo F. Padovan break; 21570a708f8fSGustavo F. Padovan 21580a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 21598c1d787bSGustavo F. Padovan if (le16_to_cpu(rfc.max_pdu_size) > chan->conn->mtu - 10) 21608c1d787bSGustavo F. Padovan rfc.max_pdu_size = cpu_to_le16(chan->conn->mtu - 10); 21610a708f8fSGustavo F. Padovan 21622c03a7a4SGustavo F. Padovan chan->remote_mps = le16_to_cpu(rfc.max_pdu_size); 21630a708f8fSGustavo F. Padovan 2164c1360a1cSGustavo F. Padovan set_bit(CONF_MODE_DONE, &chan->conf_state); 21650a708f8fSGustavo F. Padovan 21660a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 21670a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 21680a708f8fSGustavo F. Padovan 21690a708f8fSGustavo F. Padovan break; 21700a708f8fSGustavo F. Padovan 21710a708f8fSGustavo F. Padovan default: 21720a708f8fSGustavo F. Padovan result = L2CAP_CONF_UNACCEPT; 21730a708f8fSGustavo F. Padovan 21740a708f8fSGustavo F. Padovan memset(&rfc, 0, sizeof(rfc)); 21750c1bc5c6SGustavo F. Padovan rfc.mode = chan->mode; 21760a708f8fSGustavo F. Padovan } 21770a708f8fSGustavo F. Padovan 21780a708f8fSGustavo F. Padovan if (result == L2CAP_CONF_SUCCESS) 2179c1360a1cSGustavo F. Padovan set_bit(CONF_OUTPUT_DONE, &chan->conf_state); 21800a708f8fSGustavo F. Padovan } 2181fe4128e0SGustavo F. Padovan rsp->scid = cpu_to_le16(chan->dcid); 21820a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(result); 21830a708f8fSGustavo F. Padovan rsp->flags = cpu_to_le16(0x0000); 21840a708f8fSGustavo F. Padovan 21850a708f8fSGustavo F. Padovan return ptr - data; 21860a708f8fSGustavo F. Padovan } 21870a708f8fSGustavo F. Padovan 2188b4450035SGustavo F. Padovan static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, void *data, u16 *result) 21890a708f8fSGustavo F. Padovan { 21900a708f8fSGustavo F. Padovan struct l2cap_conf_req *req = data; 21910a708f8fSGustavo F. Padovan void *ptr = req->data; 21920a708f8fSGustavo F. Padovan int type, olen; 21930a708f8fSGustavo F. Padovan unsigned long val; 21940a708f8fSGustavo F. Padovan struct l2cap_conf_rfc rfc; 21950a708f8fSGustavo F. Padovan 2196fe4128e0SGustavo F. Padovan BT_DBG("chan %p, rsp %p, len %d, req %p", chan, rsp, len, data); 21970a708f8fSGustavo F. Padovan 21980a708f8fSGustavo F. Padovan while (len >= L2CAP_CONF_OPT_SIZE) { 21990a708f8fSGustavo F. Padovan len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 22000a708f8fSGustavo F. Padovan 22010a708f8fSGustavo F. Padovan switch (type) { 22020a708f8fSGustavo F. Padovan case L2CAP_CONF_MTU: 22030a708f8fSGustavo F. Padovan if (val < L2CAP_DEFAULT_MIN_MTU) { 22040a708f8fSGustavo F. Padovan *result = L2CAP_CONF_UNACCEPT; 22050c1bc5c6SGustavo F. Padovan chan->imtu = L2CAP_DEFAULT_MIN_MTU; 22060a708f8fSGustavo F. Padovan } else 22070c1bc5c6SGustavo F. Padovan chan->imtu = val; 22080c1bc5c6SGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); 22090a708f8fSGustavo F. Padovan break; 22100a708f8fSGustavo F. Padovan 22110a708f8fSGustavo F. Padovan case L2CAP_CONF_FLUSH_TO: 22120c1bc5c6SGustavo F. Padovan chan->flush_to = val; 22130a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 22140c1bc5c6SGustavo F. Padovan 2, chan->flush_to); 22150a708f8fSGustavo F. Padovan break; 22160a708f8fSGustavo F. Padovan 22170a708f8fSGustavo F. Padovan case L2CAP_CONF_RFC: 22180a708f8fSGustavo F. Padovan if (olen == sizeof(rfc)) 22190a708f8fSGustavo F. Padovan memcpy(&rfc, (void *)val, olen); 22200a708f8fSGustavo F. Padovan 2221c1360a1cSGustavo F. Padovan if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) && 22220c1bc5c6SGustavo F. Padovan rfc.mode != chan->mode) 22230a708f8fSGustavo F. Padovan return -ECONNREFUSED; 22240a708f8fSGustavo F. Padovan 222547d1ec61SGustavo F. Padovan chan->fcs = 0; 22260a708f8fSGustavo F. Padovan 22270a708f8fSGustavo F. Padovan l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, 22280a708f8fSGustavo F. Padovan sizeof(rfc), (unsigned long) &rfc); 22290a708f8fSGustavo F. Padovan break; 2230*6327eb98SAndrei Emeltchenko 2231*6327eb98SAndrei Emeltchenko case L2CAP_CONF_EWS: 2232*6327eb98SAndrei Emeltchenko chan->tx_win = min_t(u16, val, 2233*6327eb98SAndrei Emeltchenko L2CAP_DEFAULT_EXT_WINDOW); 2234*6327eb98SAndrei Emeltchenko l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2235*6327eb98SAndrei Emeltchenko 2, chan->tx_win); 2236*6327eb98SAndrei Emeltchenko break; 22370a708f8fSGustavo F. Padovan } 22380a708f8fSGustavo F. Padovan } 22390a708f8fSGustavo F. Padovan 22400c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_BASIC && chan->mode != rfc.mode) 22410a708f8fSGustavo F. Padovan return -ECONNREFUSED; 22420a708f8fSGustavo F. Padovan 22430c1bc5c6SGustavo F. Padovan chan->mode = rfc.mode; 22440a708f8fSGustavo F. Padovan 22450a708f8fSGustavo F. Padovan if (*result == L2CAP_CONF_SUCCESS) { 22460a708f8fSGustavo F. Padovan switch (rfc.mode) { 22470a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 224847d1ec61SGustavo F. Padovan chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 224947d1ec61SGustavo F. Padovan chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 225047d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 22510a708f8fSGustavo F. Padovan break; 22520a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 225347d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 22540a708f8fSGustavo F. Padovan } 22550a708f8fSGustavo F. Padovan } 22560a708f8fSGustavo F. Padovan 2257fe4128e0SGustavo F. Padovan req->dcid = cpu_to_le16(chan->dcid); 22580a708f8fSGustavo F. Padovan req->flags = cpu_to_le16(0x0000); 22590a708f8fSGustavo F. Padovan 22600a708f8fSGustavo F. Padovan return ptr - data; 22610a708f8fSGustavo F. Padovan } 22620a708f8fSGustavo F. Padovan 2263fe4128e0SGustavo F. Padovan static int l2cap_build_conf_rsp(struct l2cap_chan *chan, void *data, u16 result, u16 flags) 22640a708f8fSGustavo F. Padovan { 22650a708f8fSGustavo F. Padovan struct l2cap_conf_rsp *rsp = data; 22660a708f8fSGustavo F. Padovan void *ptr = rsp->data; 22670a708f8fSGustavo F. Padovan 2268fe4128e0SGustavo F. Padovan BT_DBG("chan %p", chan); 22690a708f8fSGustavo F. Padovan 2270fe4128e0SGustavo F. Padovan rsp->scid = cpu_to_le16(chan->dcid); 22710a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(result); 22720a708f8fSGustavo F. Padovan rsp->flags = cpu_to_le16(flags); 22730a708f8fSGustavo F. Padovan 22740a708f8fSGustavo F. Padovan return ptr - data; 22750a708f8fSGustavo F. Padovan } 22760a708f8fSGustavo F. Padovan 22778c1d787bSGustavo F. Padovan void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) 2278710f9b0aSGustavo F. Padovan { 2279710f9b0aSGustavo F. Padovan struct l2cap_conn_rsp rsp; 22808c1d787bSGustavo F. Padovan struct l2cap_conn *conn = chan->conn; 2281710f9b0aSGustavo F. Padovan u8 buf[128]; 2282710f9b0aSGustavo F. Padovan 2283fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 2284fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 2285710f9b0aSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS); 2286710f9b0aSGustavo F. Padovan rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO); 2287710f9b0aSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, 2288710f9b0aSGustavo F. Padovan L2CAP_CONN_RSP, sizeof(rsp), &rsp); 2289710f9b0aSGustavo F. Padovan 2290c1360a1cSGustavo F. Padovan if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 2291710f9b0aSGustavo F. Padovan return; 2292710f9b0aSGustavo F. Padovan 2293710f9b0aSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 2294710f9b0aSGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 2295710f9b0aSGustavo F. Padovan chan->num_conf_req++; 2296710f9b0aSGustavo F. Padovan } 2297710f9b0aSGustavo F. Padovan 229847d1ec61SGustavo F. Padovan static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len) 22990a708f8fSGustavo F. Padovan { 23000a708f8fSGustavo F. Padovan int type, olen; 23010a708f8fSGustavo F. Padovan unsigned long val; 23020a708f8fSGustavo F. Padovan struct l2cap_conf_rfc rfc; 23030a708f8fSGustavo F. Padovan 230447d1ec61SGustavo F. Padovan BT_DBG("chan %p, rsp %p, len %d", chan, rsp, len); 23050a708f8fSGustavo F. Padovan 23060c1bc5c6SGustavo F. Padovan if ((chan->mode != L2CAP_MODE_ERTM) && (chan->mode != L2CAP_MODE_STREAMING)) 23070a708f8fSGustavo F. Padovan return; 23080a708f8fSGustavo F. Padovan 23090a708f8fSGustavo F. Padovan while (len >= L2CAP_CONF_OPT_SIZE) { 23100a708f8fSGustavo F. Padovan len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 23110a708f8fSGustavo F. Padovan 23120a708f8fSGustavo F. Padovan switch (type) { 23130a708f8fSGustavo F. Padovan case L2CAP_CONF_RFC: 23140a708f8fSGustavo F. Padovan if (olen == sizeof(rfc)) 23150a708f8fSGustavo F. Padovan memcpy(&rfc, (void *)val, olen); 23160a708f8fSGustavo F. Padovan goto done; 23170a708f8fSGustavo F. Padovan } 23180a708f8fSGustavo F. Padovan } 23190a708f8fSGustavo F. Padovan 23200a708f8fSGustavo F. Padovan done: 23210a708f8fSGustavo F. Padovan switch (rfc.mode) { 23220a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 232347d1ec61SGustavo F. Padovan chan->retrans_timeout = le16_to_cpu(rfc.retrans_timeout); 232447d1ec61SGustavo F. Padovan chan->monitor_timeout = le16_to_cpu(rfc.monitor_timeout); 232547d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 23260a708f8fSGustavo F. Padovan break; 23270a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 232847d1ec61SGustavo F. Padovan chan->mps = le16_to_cpu(rfc.max_pdu_size); 23290a708f8fSGustavo F. Padovan } 23300a708f8fSGustavo F. Padovan } 23310a708f8fSGustavo F. Padovan 23320a708f8fSGustavo F. Padovan static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 23330a708f8fSGustavo F. Padovan { 2334e2fd318eSIlia Kolomisnky struct l2cap_cmd_rej_unk *rej = (struct l2cap_cmd_rej_unk *) data; 23350a708f8fSGustavo F. Padovan 2336e2fd318eSIlia Kolomisnky if (rej->reason != L2CAP_REJ_NOT_UNDERSTOOD) 23370a708f8fSGustavo F. Padovan return 0; 23380a708f8fSGustavo F. Padovan 23390a708f8fSGustavo F. Padovan if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) && 23400a708f8fSGustavo F. Padovan cmd->ident == conn->info_ident) { 23410a708f8fSGustavo F. Padovan del_timer(&conn->info_timer); 23420a708f8fSGustavo F. Padovan 23430a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 23440a708f8fSGustavo F. Padovan conn->info_ident = 0; 23450a708f8fSGustavo F. Padovan 23460a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 23470a708f8fSGustavo F. Padovan } 23480a708f8fSGustavo F. Padovan 23490a708f8fSGustavo F. Padovan return 0; 23500a708f8fSGustavo F. Padovan } 23510a708f8fSGustavo F. Padovan 23520a708f8fSGustavo F. Padovan static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 23530a708f8fSGustavo F. Padovan { 23540a708f8fSGustavo F. Padovan struct l2cap_conn_req *req = (struct l2cap_conn_req *) data; 23550a708f8fSGustavo F. Padovan struct l2cap_conn_rsp rsp; 235623691d75SGustavo F. Padovan struct l2cap_chan *chan = NULL, *pchan; 23570a708f8fSGustavo F. Padovan struct sock *parent, *sk = NULL; 23580a708f8fSGustavo F. Padovan int result, status = L2CAP_CS_NO_INFO; 23590a708f8fSGustavo F. Padovan 23600a708f8fSGustavo F. Padovan u16 dcid = 0, scid = __le16_to_cpu(req->scid); 23610a708f8fSGustavo F. Padovan __le16 psm = req->psm; 23620a708f8fSGustavo F. Padovan 23630a708f8fSGustavo F. Padovan BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid); 23640a708f8fSGustavo F. Padovan 23650a708f8fSGustavo F. Padovan /* Check if we have socket listening on psm */ 236623691d75SGustavo F. Padovan pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, conn->src); 236723691d75SGustavo F. Padovan if (!pchan) { 23680a708f8fSGustavo F. Padovan result = L2CAP_CR_BAD_PSM; 23690a708f8fSGustavo F. Padovan goto sendresp; 23700a708f8fSGustavo F. Padovan } 23710a708f8fSGustavo F. Padovan 237223691d75SGustavo F. Padovan parent = pchan->sk; 237323691d75SGustavo F. Padovan 23740a708f8fSGustavo F. Padovan bh_lock_sock(parent); 23750a708f8fSGustavo F. Padovan 23760a708f8fSGustavo F. Padovan /* Check if the ACL is secure enough (if not SDP) */ 23770a708f8fSGustavo F. Padovan if (psm != cpu_to_le16(0x0001) && 23780a708f8fSGustavo F. Padovan !hci_conn_check_link_mode(conn->hcon)) { 23790a708f8fSGustavo F. Padovan conn->disc_reason = 0x05; 23800a708f8fSGustavo F. Padovan result = L2CAP_CR_SEC_BLOCK; 23810a708f8fSGustavo F. Padovan goto response; 23820a708f8fSGustavo F. Padovan } 23830a708f8fSGustavo F. Padovan 23840a708f8fSGustavo F. Padovan result = L2CAP_CR_NO_MEM; 23850a708f8fSGustavo F. Padovan 23860a708f8fSGustavo F. Padovan /* Check for backlog size */ 23870a708f8fSGustavo F. Padovan if (sk_acceptq_is_full(parent)) { 23880a708f8fSGustavo F. Padovan BT_DBG("backlog full %d", parent->sk_ack_backlog); 23890a708f8fSGustavo F. Padovan goto response; 23900a708f8fSGustavo F. Padovan } 23910a708f8fSGustavo F. Padovan 239280808e43SGustavo F. Padovan chan = pchan->ops->new_connection(pchan->data); 239380808e43SGustavo F. Padovan if (!chan) 23940a708f8fSGustavo F. Padovan goto response; 23950a708f8fSGustavo F. Padovan 239680808e43SGustavo F. Padovan sk = chan->sk; 239780808e43SGustavo F. Padovan 2398baa7e1faSGustavo F. Padovan write_lock_bh(&conn->chan_lock); 23990a708f8fSGustavo F. Padovan 24000a708f8fSGustavo F. Padovan /* Check if we already have channel with that dcid */ 2401baa7e1faSGustavo F. Padovan if (__l2cap_get_chan_by_dcid(conn, scid)) { 2402baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 24030a708f8fSGustavo F. Padovan sock_set_flag(sk, SOCK_ZAPPED); 2404ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 24050a708f8fSGustavo F. Padovan goto response; 24060a708f8fSGustavo F. Padovan } 24070a708f8fSGustavo F. Padovan 24080a708f8fSGustavo F. Padovan hci_conn_hold(conn->hcon); 24090a708f8fSGustavo F. Padovan 24100a708f8fSGustavo F. Padovan bacpy(&bt_sk(sk)->src, conn->src); 24110a708f8fSGustavo F. Padovan bacpy(&bt_sk(sk)->dst, conn->dst); 2412fe4128e0SGustavo F. Padovan chan->psm = psm; 2413fe4128e0SGustavo F. Padovan chan->dcid = scid; 24140a708f8fSGustavo F. Padovan 2415d1010240SGustavo F. Padovan bt_accept_enqueue(parent, sk); 2416d1010240SGustavo F. Padovan 241748454079SGustavo F. Padovan __l2cap_chan_add(conn, chan); 241848454079SGustavo F. Padovan 2419fe4128e0SGustavo F. Padovan dcid = chan->scid; 24200a708f8fSGustavo F. Padovan 2421c9b66675SGustavo F. Padovan __set_chan_timer(chan, sk->sk_sndtimeo); 24220a708f8fSGustavo F. Padovan 2423fc7f8a7eSGustavo F. Padovan chan->ident = cmd->ident; 24240a708f8fSGustavo F. Padovan 24250a708f8fSGustavo F. Padovan if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) { 24264343478fSGustavo F. Padovan if (l2cap_check_security(chan)) { 24270a708f8fSGustavo F. Padovan if (bt_sk(sk)->defer_setup) { 242889bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT2); 24290a708f8fSGustavo F. Padovan result = L2CAP_CR_PEND; 24300a708f8fSGustavo F. Padovan status = L2CAP_CS_AUTHOR_PEND; 24310a708f8fSGustavo F. Padovan parent->sk_data_ready(parent, 0); 24320a708f8fSGustavo F. Padovan } else { 243389bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 24340a708f8fSGustavo F. Padovan result = L2CAP_CR_SUCCESS; 24350a708f8fSGustavo F. Padovan status = L2CAP_CS_NO_INFO; 24360a708f8fSGustavo F. Padovan } 24370a708f8fSGustavo F. Padovan } else { 243889bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT2); 24390a708f8fSGustavo F. Padovan result = L2CAP_CR_PEND; 24400a708f8fSGustavo F. Padovan status = L2CAP_CS_AUTHEN_PEND; 24410a708f8fSGustavo F. Padovan } 24420a708f8fSGustavo F. Padovan } else { 244389bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECT2); 24440a708f8fSGustavo F. Padovan result = L2CAP_CR_PEND; 24450a708f8fSGustavo F. Padovan status = L2CAP_CS_NO_INFO; 24460a708f8fSGustavo F. Padovan } 24470a708f8fSGustavo F. Padovan 2448baa7e1faSGustavo F. Padovan write_unlock_bh(&conn->chan_lock); 24490a708f8fSGustavo F. Padovan 24500a708f8fSGustavo F. Padovan response: 24510a708f8fSGustavo F. Padovan bh_unlock_sock(parent); 24520a708f8fSGustavo F. Padovan 24530a708f8fSGustavo F. Padovan sendresp: 24540a708f8fSGustavo F. Padovan rsp.scid = cpu_to_le16(scid); 24550a708f8fSGustavo F. Padovan rsp.dcid = cpu_to_le16(dcid); 24560a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(result); 24570a708f8fSGustavo F. Padovan rsp.status = cpu_to_le16(status); 24580a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp); 24590a708f8fSGustavo F. Padovan 24600a708f8fSGustavo F. Padovan if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) { 24610a708f8fSGustavo F. Padovan struct l2cap_info_req info; 24620a708f8fSGustavo F. Padovan info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 24630a708f8fSGustavo F. Padovan 24640a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT; 24650a708f8fSGustavo F. Padovan conn->info_ident = l2cap_get_ident(conn); 24660a708f8fSGustavo F. Padovan 24670a708f8fSGustavo F. Padovan mod_timer(&conn->info_timer, jiffies + 24680a708f8fSGustavo F. Padovan msecs_to_jiffies(L2CAP_INFO_TIMEOUT)); 24690a708f8fSGustavo F. Padovan 24700a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, conn->info_ident, 24710a708f8fSGustavo F. Padovan L2CAP_INFO_REQ, sizeof(info), &info); 24720a708f8fSGustavo F. Padovan } 24730a708f8fSGustavo F. Padovan 2474c1360a1cSGustavo F. Padovan if (chan && !test_bit(CONF_REQ_SENT, &chan->conf_state) && 24750a708f8fSGustavo F. Padovan result == L2CAP_CR_SUCCESS) { 24760a708f8fSGustavo F. Padovan u8 buf[128]; 2477c1360a1cSGustavo F. Padovan set_bit(CONF_REQ_SENT, &chan->conf_state); 24780a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 247973ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 248073ffa904SGustavo F. Padovan chan->num_conf_req++; 24810a708f8fSGustavo F. Padovan } 24820a708f8fSGustavo F. Padovan 24830a708f8fSGustavo F. Padovan return 0; 24840a708f8fSGustavo F. Padovan } 24850a708f8fSGustavo F. Padovan 24860a708f8fSGustavo F. Padovan static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 24870a708f8fSGustavo F. Padovan { 24880a708f8fSGustavo F. Padovan struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data; 24890a708f8fSGustavo F. Padovan u16 scid, dcid, result, status; 249048454079SGustavo F. Padovan struct l2cap_chan *chan; 24910a708f8fSGustavo F. Padovan struct sock *sk; 24920a708f8fSGustavo F. Padovan u8 req[128]; 24930a708f8fSGustavo F. Padovan 24940a708f8fSGustavo F. Padovan scid = __le16_to_cpu(rsp->scid); 24950a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(rsp->dcid); 24960a708f8fSGustavo F. Padovan result = __le16_to_cpu(rsp->result); 24970a708f8fSGustavo F. Padovan status = __le16_to_cpu(rsp->status); 24980a708f8fSGustavo F. Padovan 24990a708f8fSGustavo F. Padovan BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status); 25000a708f8fSGustavo F. Padovan 25010a708f8fSGustavo F. Padovan if (scid) { 2502baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, scid); 250348454079SGustavo F. Padovan if (!chan) 25040a708f8fSGustavo F. Padovan return -EFAULT; 25050a708f8fSGustavo F. Padovan } else { 2506baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_ident(conn, cmd->ident); 250748454079SGustavo F. Padovan if (!chan) 25080a708f8fSGustavo F. Padovan return -EFAULT; 25090a708f8fSGustavo F. Padovan } 25100a708f8fSGustavo F. Padovan 251148454079SGustavo F. Padovan sk = chan->sk; 251248454079SGustavo F. Padovan 25130a708f8fSGustavo F. Padovan switch (result) { 25140a708f8fSGustavo F. Padovan case L2CAP_CR_SUCCESS: 251589bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 2516fc7f8a7eSGustavo F. Padovan chan->ident = 0; 2517fe4128e0SGustavo F. Padovan chan->dcid = dcid; 2518c1360a1cSGustavo F. Padovan clear_bit(CONF_CONNECT_PEND, &chan->conf_state); 25190a708f8fSGustavo F. Padovan 2520c1360a1cSGustavo F. Padovan if (test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) 25210a708f8fSGustavo F. Padovan break; 25220a708f8fSGustavo F. Padovan 25230a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 252473ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, req), req); 252573ffa904SGustavo F. Padovan chan->num_conf_req++; 25260a708f8fSGustavo F. Padovan break; 25270a708f8fSGustavo F. Padovan 25280a708f8fSGustavo F. Padovan case L2CAP_CR_PEND: 2529c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 25300a708f8fSGustavo F. Padovan break; 25310a708f8fSGustavo F. Padovan 25320a708f8fSGustavo F. Padovan default: 25330a708f8fSGustavo F. Padovan /* don't delete l2cap channel if sk is owned by user */ 25340a708f8fSGustavo F. Padovan if (sock_owned_by_user(sk)) { 253589bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 2536c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 2537c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ / 5); 25380a708f8fSGustavo F. Padovan break; 25390a708f8fSGustavo F. Padovan } 25400a708f8fSGustavo F. Padovan 254148454079SGustavo F. Padovan l2cap_chan_del(chan, ECONNREFUSED); 25420a708f8fSGustavo F. Padovan break; 25430a708f8fSGustavo F. Padovan } 25440a708f8fSGustavo F. Padovan 25450a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 25460a708f8fSGustavo F. Padovan return 0; 25470a708f8fSGustavo F. Padovan } 25480a708f8fSGustavo F. Padovan 254947d1ec61SGustavo F. Padovan static inline void set_default_fcs(struct l2cap_chan *chan) 25500a708f8fSGustavo F. Padovan { 25510a708f8fSGustavo F. Padovan /* FCS is enabled only in ERTM or streaming mode, if one or both 25520a708f8fSGustavo F. Padovan * sides request it. 25530a708f8fSGustavo F. Padovan */ 25540c1bc5c6SGustavo F. Padovan if (chan->mode != L2CAP_MODE_ERTM && chan->mode != L2CAP_MODE_STREAMING) 255547d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_NONE; 2556c1360a1cSGustavo F. Padovan else if (!test_bit(CONF_NO_FCS_RECV, &chan->conf_state)) 255747d1ec61SGustavo F. Padovan chan->fcs = L2CAP_FCS_CRC16; 25580a708f8fSGustavo F. Padovan } 25590a708f8fSGustavo F. Padovan 25600a708f8fSGustavo F. Padovan static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 25610a708f8fSGustavo F. Padovan { 25620a708f8fSGustavo F. Padovan struct l2cap_conf_req *req = (struct l2cap_conf_req *) data; 25630a708f8fSGustavo F. Padovan u16 dcid, flags; 25640a708f8fSGustavo F. Padovan u8 rsp[64]; 256548454079SGustavo F. Padovan struct l2cap_chan *chan; 25660a708f8fSGustavo F. Padovan struct sock *sk; 25670a708f8fSGustavo F. Padovan int len; 25680a708f8fSGustavo F. Padovan 25690a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(req->dcid); 25700a708f8fSGustavo F. Padovan flags = __le16_to_cpu(req->flags); 25710a708f8fSGustavo F. Padovan 25720a708f8fSGustavo F. Padovan BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags); 25730a708f8fSGustavo F. Padovan 2574baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, dcid); 257548454079SGustavo F. Padovan if (!chan) 25760a708f8fSGustavo F. Padovan return -ENOENT; 25770a708f8fSGustavo F. Padovan 257848454079SGustavo F. Padovan sk = chan->sk; 257948454079SGustavo F. Padovan 2580033b1142SDavid S. Miller if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) { 2581e2fd318eSIlia Kolomisnky struct l2cap_cmd_rej_cid rej; 25820a708f8fSGustavo F. Padovan 2583e2fd318eSIlia Kolomisnky rej.reason = cpu_to_le16(L2CAP_REJ_INVALID_CID); 2584e2fd318eSIlia Kolomisnky rej.scid = cpu_to_le16(chan->scid); 2585e2fd318eSIlia Kolomisnky rej.dcid = cpu_to_le16(chan->dcid); 2586e2fd318eSIlia Kolomisnky 25870a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ, 25880a708f8fSGustavo F. Padovan sizeof(rej), &rej); 25890a708f8fSGustavo F. Padovan goto unlock; 25900a708f8fSGustavo F. Padovan } 25910a708f8fSGustavo F. Padovan 25920a708f8fSGustavo F. Padovan /* Reject if config buffer is too small. */ 25930a708f8fSGustavo F. Padovan len = cmd_len - sizeof(*req); 25947ac28817SDan Rosenberg if (len < 0 || chan->conf_len + len > sizeof(chan->conf_req)) { 25950a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 2596fe4128e0SGustavo F. Padovan l2cap_build_conf_rsp(chan, rsp, 25970a708f8fSGustavo F. Padovan L2CAP_CONF_REJECT, flags), rsp); 25980a708f8fSGustavo F. Padovan goto unlock; 25990a708f8fSGustavo F. Padovan } 26000a708f8fSGustavo F. Padovan 26010a708f8fSGustavo F. Padovan /* Store config. */ 260273ffa904SGustavo F. Padovan memcpy(chan->conf_req + chan->conf_len, req->data, len); 260373ffa904SGustavo F. Padovan chan->conf_len += len; 26040a708f8fSGustavo F. Padovan 26050a708f8fSGustavo F. Padovan if (flags & 0x0001) { 26060a708f8fSGustavo F. Padovan /* Incomplete config. Send empty response. */ 26070a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, 2608fe4128e0SGustavo F. Padovan l2cap_build_conf_rsp(chan, rsp, 26090a708f8fSGustavo F. Padovan L2CAP_CONF_SUCCESS, 0x0001), rsp); 26100a708f8fSGustavo F. Padovan goto unlock; 26110a708f8fSGustavo F. Padovan } 26120a708f8fSGustavo F. Padovan 26130a708f8fSGustavo F. Padovan /* Complete config. */ 261473ffa904SGustavo F. Padovan len = l2cap_parse_conf_req(chan, rsp); 26150a708f8fSGustavo F. Padovan if (len < 0) { 2616e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 26170a708f8fSGustavo F. Padovan goto unlock; 26180a708f8fSGustavo F. Padovan } 26190a708f8fSGustavo F. Padovan 26200a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp); 262173ffa904SGustavo F. Padovan chan->num_conf_rsp++; 26220a708f8fSGustavo F. Padovan 26230a708f8fSGustavo F. Padovan /* Reset config buffer. */ 262473ffa904SGustavo F. Padovan chan->conf_len = 0; 26250a708f8fSGustavo F. Padovan 2626c1360a1cSGustavo F. Padovan if (!test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) 26270a708f8fSGustavo F. Padovan goto unlock; 26280a708f8fSGustavo F. Padovan 2629c1360a1cSGustavo F. Padovan if (test_bit(CONF_INPUT_DONE, &chan->conf_state)) { 263047d1ec61SGustavo F. Padovan set_default_fcs(chan); 26310a708f8fSGustavo F. Padovan 263289bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 26330a708f8fSGustavo F. Padovan 263442e5c802SGustavo F. Padovan chan->next_tx_seq = 0; 263542e5c802SGustavo F. Padovan chan->expected_tx_seq = 0; 263658d35f87SGustavo F. Padovan skb_queue_head_init(&chan->tx_q); 26370c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) 2638525cd185SGustavo F. Padovan l2cap_ertm_init(chan); 26390a708f8fSGustavo F. Padovan 26400a708f8fSGustavo F. Padovan l2cap_chan_ready(sk); 26410a708f8fSGustavo F. Padovan goto unlock; 26420a708f8fSGustavo F. Padovan } 26430a708f8fSGustavo F. Padovan 2644c1360a1cSGustavo F. Padovan if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { 26450a708f8fSGustavo F. Padovan u8 buf[64]; 26460a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, 264773ffa904SGustavo F. Padovan l2cap_build_conf_req(chan, buf), buf); 264873ffa904SGustavo F. Padovan chan->num_conf_req++; 26490a708f8fSGustavo F. Padovan } 26500a708f8fSGustavo F. Padovan 26510a708f8fSGustavo F. Padovan unlock: 26520a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 26530a708f8fSGustavo F. Padovan return 0; 26540a708f8fSGustavo F. Padovan } 26550a708f8fSGustavo F. Padovan 26560a708f8fSGustavo F. Padovan static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 26570a708f8fSGustavo F. Padovan { 26580a708f8fSGustavo F. Padovan struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data; 26590a708f8fSGustavo F. Padovan u16 scid, flags, result; 266048454079SGustavo F. Padovan struct l2cap_chan *chan; 26610a708f8fSGustavo F. Padovan struct sock *sk; 26620a708f8fSGustavo F. Padovan int len = cmd->len - sizeof(*rsp); 26630a708f8fSGustavo F. Padovan 26640a708f8fSGustavo F. Padovan scid = __le16_to_cpu(rsp->scid); 26650a708f8fSGustavo F. Padovan flags = __le16_to_cpu(rsp->flags); 26660a708f8fSGustavo F. Padovan result = __le16_to_cpu(rsp->result); 26670a708f8fSGustavo F. Padovan 26680a708f8fSGustavo F. Padovan BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", 26690a708f8fSGustavo F. Padovan scid, flags, result); 26700a708f8fSGustavo F. Padovan 2671baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, scid); 267248454079SGustavo F. Padovan if (!chan) 26730a708f8fSGustavo F. Padovan return 0; 26740a708f8fSGustavo F. Padovan 267548454079SGustavo F. Padovan sk = chan->sk; 267648454079SGustavo F. Padovan 26770a708f8fSGustavo F. Padovan switch (result) { 26780a708f8fSGustavo F. Padovan case L2CAP_CONF_SUCCESS: 267947d1ec61SGustavo F. Padovan l2cap_conf_rfc_get(chan, rsp->data, len); 26800a708f8fSGustavo F. Padovan break; 26810a708f8fSGustavo F. Padovan 26820a708f8fSGustavo F. Padovan case L2CAP_CONF_UNACCEPT: 268373ffa904SGustavo F. Padovan if (chan->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) { 26840a708f8fSGustavo F. Padovan char req[64]; 26850a708f8fSGustavo F. Padovan 26860a708f8fSGustavo F. Padovan if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) { 2687e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 26880a708f8fSGustavo F. Padovan goto done; 26890a708f8fSGustavo F. Padovan } 26900a708f8fSGustavo F. Padovan 26910a708f8fSGustavo F. Padovan /* throw out any old stored conf requests */ 26920a708f8fSGustavo F. Padovan result = L2CAP_CONF_SUCCESS; 2693b4450035SGustavo F. Padovan len = l2cap_parse_conf_rsp(chan, rsp->data, len, 2694b4450035SGustavo F. Padovan req, &result); 26950a708f8fSGustavo F. Padovan if (len < 0) { 2696e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 26970a708f8fSGustavo F. Padovan goto done; 26980a708f8fSGustavo F. Padovan } 26990a708f8fSGustavo F. Padovan 27000a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, l2cap_get_ident(conn), 27010a708f8fSGustavo F. Padovan L2CAP_CONF_REQ, len, req); 270273ffa904SGustavo F. Padovan chan->num_conf_req++; 27030a708f8fSGustavo F. Padovan if (result != L2CAP_CONF_SUCCESS) 27040a708f8fSGustavo F. Padovan goto done; 27050a708f8fSGustavo F. Padovan break; 27060a708f8fSGustavo F. Padovan } 27070a708f8fSGustavo F. Padovan 27080a708f8fSGustavo F. Padovan default: 27090a708f8fSGustavo F. Padovan sk->sk_err = ECONNRESET; 2710c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ * 5); 2711e92c8e70SGustavo F. Padovan l2cap_send_disconn_req(conn, chan, ECONNRESET); 27120a708f8fSGustavo F. Padovan goto done; 27130a708f8fSGustavo F. Padovan } 27140a708f8fSGustavo F. Padovan 27150a708f8fSGustavo F. Padovan if (flags & 0x01) 27160a708f8fSGustavo F. Padovan goto done; 27170a708f8fSGustavo F. Padovan 2718c1360a1cSGustavo F. Padovan set_bit(CONF_INPUT_DONE, &chan->conf_state); 27190a708f8fSGustavo F. Padovan 2720c1360a1cSGustavo F. Padovan if (test_bit(CONF_OUTPUT_DONE, &chan->conf_state)) { 272147d1ec61SGustavo F. Padovan set_default_fcs(chan); 27220a708f8fSGustavo F. Padovan 272389bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONNECTED); 272442e5c802SGustavo F. Padovan chan->next_tx_seq = 0; 272542e5c802SGustavo F. Padovan chan->expected_tx_seq = 0; 272658d35f87SGustavo F. Padovan skb_queue_head_init(&chan->tx_q); 27270c1bc5c6SGustavo F. Padovan if (chan->mode == L2CAP_MODE_ERTM) 2728525cd185SGustavo F. Padovan l2cap_ertm_init(chan); 27290a708f8fSGustavo F. Padovan 27300a708f8fSGustavo F. Padovan l2cap_chan_ready(sk); 27310a708f8fSGustavo F. Padovan } 27320a708f8fSGustavo F. Padovan 27330a708f8fSGustavo F. Padovan done: 27340a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27350a708f8fSGustavo F. Padovan return 0; 27360a708f8fSGustavo F. Padovan } 27370a708f8fSGustavo F. Padovan 27380a708f8fSGustavo F. Padovan static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 27390a708f8fSGustavo F. Padovan { 27400a708f8fSGustavo F. Padovan struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data; 27410a708f8fSGustavo F. Padovan struct l2cap_disconn_rsp rsp; 27420a708f8fSGustavo F. Padovan u16 dcid, scid; 274348454079SGustavo F. Padovan struct l2cap_chan *chan; 27440a708f8fSGustavo F. Padovan struct sock *sk; 27450a708f8fSGustavo F. Padovan 27460a708f8fSGustavo F. Padovan scid = __le16_to_cpu(req->scid); 27470a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(req->dcid); 27480a708f8fSGustavo F. Padovan 27490a708f8fSGustavo F. Padovan BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid); 27500a708f8fSGustavo F. Padovan 2751baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, dcid); 275248454079SGustavo F. Padovan if (!chan) 27530a708f8fSGustavo F. Padovan return 0; 27540a708f8fSGustavo F. Padovan 275548454079SGustavo F. Padovan sk = chan->sk; 275648454079SGustavo F. Padovan 2757fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 2758fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 27590a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp); 27600a708f8fSGustavo F. Padovan 27610a708f8fSGustavo F. Padovan sk->sk_shutdown = SHUTDOWN_MASK; 27620a708f8fSGustavo F. Padovan 27630a708f8fSGustavo F. Padovan /* don't delete l2cap channel if sk is owned by user */ 27640a708f8fSGustavo F. Padovan if (sock_owned_by_user(sk)) { 276589bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 2766c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 2767c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ / 5); 27680a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27690a708f8fSGustavo F. Padovan return 0; 27700a708f8fSGustavo F. Padovan } 27710a708f8fSGustavo F. Padovan 277248454079SGustavo F. Padovan l2cap_chan_del(chan, ECONNRESET); 27730a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 27740a708f8fSGustavo F. Padovan 2775ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 27760a708f8fSGustavo F. Padovan return 0; 27770a708f8fSGustavo F. Padovan } 27780a708f8fSGustavo F. Padovan 27790a708f8fSGustavo F. Padovan static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 27800a708f8fSGustavo F. Padovan { 27810a708f8fSGustavo F. Padovan struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data; 27820a708f8fSGustavo F. Padovan u16 dcid, scid; 278348454079SGustavo F. Padovan struct l2cap_chan *chan; 27840a708f8fSGustavo F. Padovan struct sock *sk; 27850a708f8fSGustavo F. Padovan 27860a708f8fSGustavo F. Padovan scid = __le16_to_cpu(rsp->scid); 27870a708f8fSGustavo F. Padovan dcid = __le16_to_cpu(rsp->dcid); 27880a708f8fSGustavo F. Padovan 27890a708f8fSGustavo F. Padovan BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid); 27900a708f8fSGustavo F. Padovan 2791baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, scid); 279248454079SGustavo F. Padovan if (!chan) 27930a708f8fSGustavo F. Padovan return 0; 27940a708f8fSGustavo F. Padovan 279548454079SGustavo F. Padovan sk = chan->sk; 279648454079SGustavo F. Padovan 27970a708f8fSGustavo F. Padovan /* don't delete l2cap channel if sk is owned by user */ 27980a708f8fSGustavo F. Padovan if (sock_owned_by_user(sk)) { 279989bc500eSGustavo F. Padovan l2cap_state_change(chan,BT_DISCONN); 2800c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 2801c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ / 5); 28020a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 28030a708f8fSGustavo F. Padovan return 0; 28040a708f8fSGustavo F. Padovan } 28050a708f8fSGustavo F. Padovan 280648454079SGustavo F. Padovan l2cap_chan_del(chan, 0); 28070a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 28080a708f8fSGustavo F. Padovan 2809ba3bd0eeSGustavo F. Padovan chan->ops->close(chan->data); 28100a708f8fSGustavo F. Padovan return 0; 28110a708f8fSGustavo F. Padovan } 28120a708f8fSGustavo F. Padovan 28130a708f8fSGustavo F. Padovan static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 28140a708f8fSGustavo F. Padovan { 28150a708f8fSGustavo F. Padovan struct l2cap_info_req *req = (struct l2cap_info_req *) data; 28160a708f8fSGustavo F. Padovan u16 type; 28170a708f8fSGustavo F. Padovan 28180a708f8fSGustavo F. Padovan type = __le16_to_cpu(req->type); 28190a708f8fSGustavo F. Padovan 28200a708f8fSGustavo F. Padovan BT_DBG("type 0x%4.4x", type); 28210a708f8fSGustavo F. Padovan 28220a708f8fSGustavo F. Padovan if (type == L2CAP_IT_FEAT_MASK) { 28230a708f8fSGustavo F. Padovan u8 buf[8]; 28240a708f8fSGustavo F. Padovan u32 feat_mask = l2cap_feat_mask; 28250a708f8fSGustavo F. Padovan struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 28260a708f8fSGustavo F. Padovan rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK); 28270a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 28280a708f8fSGustavo F. Padovan if (!disable_ertm) 28290a708f8fSGustavo F. Padovan feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING 28300a708f8fSGustavo F. Padovan | L2CAP_FEAT_FCS; 2831a5fd6f30SAndrei Emeltchenko if (enable_hs) 2832*6327eb98SAndrei Emeltchenko feat_mask |= L2CAP_FEAT_EXT_FLOW 2833*6327eb98SAndrei Emeltchenko | L2CAP_FEAT_EXT_WINDOW; 2834a5fd6f30SAndrei Emeltchenko 28350a708f8fSGustavo F. Padovan put_unaligned_le32(feat_mask, rsp->data); 28360a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, 28370a708f8fSGustavo F. Padovan L2CAP_INFO_RSP, sizeof(buf), buf); 28380a708f8fSGustavo F. Padovan } else if (type == L2CAP_IT_FIXED_CHAN) { 28390a708f8fSGustavo F. Padovan u8 buf[12]; 28400a708f8fSGustavo F. Padovan struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf; 28410a708f8fSGustavo F. Padovan rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 28420a708f8fSGustavo F. Padovan rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS); 28430a708f8fSGustavo F. Padovan memcpy(buf + 4, l2cap_fixed_chan, 8); 28440a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, 28450a708f8fSGustavo F. Padovan L2CAP_INFO_RSP, sizeof(buf), buf); 28460a708f8fSGustavo F. Padovan } else { 28470a708f8fSGustavo F. Padovan struct l2cap_info_rsp rsp; 28480a708f8fSGustavo F. Padovan rsp.type = cpu_to_le16(type); 28490a708f8fSGustavo F. Padovan rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP); 28500a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd->ident, 28510a708f8fSGustavo F. Padovan L2CAP_INFO_RSP, sizeof(rsp), &rsp); 28520a708f8fSGustavo F. Padovan } 28530a708f8fSGustavo F. Padovan 28540a708f8fSGustavo F. Padovan return 0; 28550a708f8fSGustavo F. Padovan } 28560a708f8fSGustavo F. Padovan 28570a708f8fSGustavo F. Padovan static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data) 28580a708f8fSGustavo F. Padovan { 28590a708f8fSGustavo F. Padovan struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data; 28600a708f8fSGustavo F. Padovan u16 type, result; 28610a708f8fSGustavo F. Padovan 28620a708f8fSGustavo F. Padovan type = __le16_to_cpu(rsp->type); 28630a708f8fSGustavo F. Padovan result = __le16_to_cpu(rsp->result); 28640a708f8fSGustavo F. Padovan 28650a708f8fSGustavo F. Padovan BT_DBG("type 0x%4.4x result 0x%2.2x", type, result); 28660a708f8fSGustavo F. Padovan 2867e90165beSAndrei Emeltchenko /* L2CAP Info req/rsp are unbound to channels, add extra checks */ 2868e90165beSAndrei Emeltchenko if (cmd->ident != conn->info_ident || 2869e90165beSAndrei Emeltchenko conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) 2870e90165beSAndrei Emeltchenko return 0; 2871e90165beSAndrei Emeltchenko 28720a708f8fSGustavo F. Padovan del_timer(&conn->info_timer); 28730a708f8fSGustavo F. Padovan 28740a708f8fSGustavo F. Padovan if (result != L2CAP_IR_SUCCESS) { 28750a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 28760a708f8fSGustavo F. Padovan conn->info_ident = 0; 28770a708f8fSGustavo F. Padovan 28780a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 28790a708f8fSGustavo F. Padovan 28800a708f8fSGustavo F. Padovan return 0; 28810a708f8fSGustavo F. Padovan } 28820a708f8fSGustavo F. Padovan 28830a708f8fSGustavo F. Padovan if (type == L2CAP_IT_FEAT_MASK) { 28840a708f8fSGustavo F. Padovan conn->feat_mask = get_unaligned_le32(rsp->data); 28850a708f8fSGustavo F. Padovan 28860a708f8fSGustavo F. Padovan if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) { 28870a708f8fSGustavo F. Padovan struct l2cap_info_req req; 28880a708f8fSGustavo F. Padovan req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN); 28890a708f8fSGustavo F. Padovan 28900a708f8fSGustavo F. Padovan conn->info_ident = l2cap_get_ident(conn); 28910a708f8fSGustavo F. Padovan 28920a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, conn->info_ident, 28930a708f8fSGustavo F. Padovan L2CAP_INFO_REQ, sizeof(req), &req); 28940a708f8fSGustavo F. Padovan } else { 28950a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 28960a708f8fSGustavo F. Padovan conn->info_ident = 0; 28970a708f8fSGustavo F. Padovan 28980a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 28990a708f8fSGustavo F. Padovan } 29000a708f8fSGustavo F. Padovan } else if (type == L2CAP_IT_FIXED_CHAN) { 29010a708f8fSGustavo F. Padovan conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE; 29020a708f8fSGustavo F. Padovan conn->info_ident = 0; 29030a708f8fSGustavo F. Padovan 29040a708f8fSGustavo F. Padovan l2cap_conn_start(conn); 29050a708f8fSGustavo F. Padovan } 29060a708f8fSGustavo F. Padovan 29070a708f8fSGustavo F. Padovan return 0; 29080a708f8fSGustavo F. Padovan } 29090a708f8fSGustavo F. Padovan 2910e2174ca4SGustavo F. Padovan static inline int l2cap_check_conn_param(u16 min, u16 max, u16 latency, 2911de73115aSClaudio Takahasi u16 to_multiplier) 2912de73115aSClaudio Takahasi { 2913de73115aSClaudio Takahasi u16 max_latency; 2914de73115aSClaudio Takahasi 2915de73115aSClaudio Takahasi if (min > max || min < 6 || max > 3200) 2916de73115aSClaudio Takahasi return -EINVAL; 2917de73115aSClaudio Takahasi 2918de73115aSClaudio Takahasi if (to_multiplier < 10 || to_multiplier > 3200) 2919de73115aSClaudio Takahasi return -EINVAL; 2920de73115aSClaudio Takahasi 2921de73115aSClaudio Takahasi if (max >= to_multiplier * 8) 2922de73115aSClaudio Takahasi return -EINVAL; 2923de73115aSClaudio Takahasi 2924de73115aSClaudio Takahasi max_latency = (to_multiplier * 8 / max) - 1; 2925de73115aSClaudio Takahasi if (latency > 499 || latency > max_latency) 2926de73115aSClaudio Takahasi return -EINVAL; 2927de73115aSClaudio Takahasi 2928de73115aSClaudio Takahasi return 0; 2929de73115aSClaudio Takahasi } 2930de73115aSClaudio Takahasi 2931de73115aSClaudio Takahasi static inline int l2cap_conn_param_update_req(struct l2cap_conn *conn, 2932de73115aSClaudio Takahasi struct l2cap_cmd_hdr *cmd, u8 *data) 2933de73115aSClaudio Takahasi { 2934de73115aSClaudio Takahasi struct hci_conn *hcon = conn->hcon; 2935de73115aSClaudio Takahasi struct l2cap_conn_param_update_req *req; 2936de73115aSClaudio Takahasi struct l2cap_conn_param_update_rsp rsp; 2937de73115aSClaudio Takahasi u16 min, max, latency, to_multiplier, cmd_len; 29382ce603ebSClaudio Takahasi int err; 2939de73115aSClaudio Takahasi 2940de73115aSClaudio Takahasi if (!(hcon->link_mode & HCI_LM_MASTER)) 2941de73115aSClaudio Takahasi return -EINVAL; 2942de73115aSClaudio Takahasi 2943de73115aSClaudio Takahasi cmd_len = __le16_to_cpu(cmd->len); 2944de73115aSClaudio Takahasi if (cmd_len != sizeof(struct l2cap_conn_param_update_req)) 2945de73115aSClaudio Takahasi return -EPROTO; 2946de73115aSClaudio Takahasi 2947de73115aSClaudio Takahasi req = (struct l2cap_conn_param_update_req *) data; 2948de73115aSClaudio Takahasi min = __le16_to_cpu(req->min); 2949de73115aSClaudio Takahasi max = __le16_to_cpu(req->max); 2950de73115aSClaudio Takahasi latency = __le16_to_cpu(req->latency); 2951de73115aSClaudio Takahasi to_multiplier = __le16_to_cpu(req->to_multiplier); 2952de73115aSClaudio Takahasi 2953de73115aSClaudio Takahasi BT_DBG("min 0x%4.4x max 0x%4.4x latency: 0x%4.4x Timeout: 0x%4.4x", 2954de73115aSClaudio Takahasi min, max, latency, to_multiplier); 2955de73115aSClaudio Takahasi 2956de73115aSClaudio Takahasi memset(&rsp, 0, sizeof(rsp)); 29572ce603ebSClaudio Takahasi 29582ce603ebSClaudio Takahasi err = l2cap_check_conn_param(min, max, latency, to_multiplier); 29592ce603ebSClaudio Takahasi if (err) 2960de73115aSClaudio Takahasi rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_REJECTED); 2961de73115aSClaudio Takahasi else 2962de73115aSClaudio Takahasi rsp.result = cpu_to_le16(L2CAP_CONN_PARAM_ACCEPTED); 2963de73115aSClaudio Takahasi 2964de73115aSClaudio Takahasi l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_PARAM_UPDATE_RSP, 2965de73115aSClaudio Takahasi sizeof(rsp), &rsp); 2966de73115aSClaudio Takahasi 29672ce603ebSClaudio Takahasi if (!err) 29682ce603ebSClaudio Takahasi hci_le_conn_update(hcon, min, max, latency, to_multiplier); 29692ce603ebSClaudio Takahasi 2970de73115aSClaudio Takahasi return 0; 2971de73115aSClaudio Takahasi } 2972de73115aSClaudio Takahasi 29733300d9a9SClaudio Takahasi static inline int l2cap_bredr_sig_cmd(struct l2cap_conn *conn, 29743300d9a9SClaudio Takahasi struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data) 29753300d9a9SClaudio Takahasi { 29763300d9a9SClaudio Takahasi int err = 0; 29773300d9a9SClaudio Takahasi 29783300d9a9SClaudio Takahasi switch (cmd->code) { 29793300d9a9SClaudio Takahasi case L2CAP_COMMAND_REJ: 29803300d9a9SClaudio Takahasi l2cap_command_rej(conn, cmd, data); 29813300d9a9SClaudio Takahasi break; 29823300d9a9SClaudio Takahasi 29833300d9a9SClaudio Takahasi case L2CAP_CONN_REQ: 29843300d9a9SClaudio Takahasi err = l2cap_connect_req(conn, cmd, data); 29853300d9a9SClaudio Takahasi break; 29863300d9a9SClaudio Takahasi 29873300d9a9SClaudio Takahasi case L2CAP_CONN_RSP: 29883300d9a9SClaudio Takahasi err = l2cap_connect_rsp(conn, cmd, data); 29893300d9a9SClaudio Takahasi break; 29903300d9a9SClaudio Takahasi 29913300d9a9SClaudio Takahasi case L2CAP_CONF_REQ: 29923300d9a9SClaudio Takahasi err = l2cap_config_req(conn, cmd, cmd_len, data); 29933300d9a9SClaudio Takahasi break; 29943300d9a9SClaudio Takahasi 29953300d9a9SClaudio Takahasi case L2CAP_CONF_RSP: 29963300d9a9SClaudio Takahasi err = l2cap_config_rsp(conn, cmd, data); 29973300d9a9SClaudio Takahasi break; 29983300d9a9SClaudio Takahasi 29993300d9a9SClaudio Takahasi case L2CAP_DISCONN_REQ: 30003300d9a9SClaudio Takahasi err = l2cap_disconnect_req(conn, cmd, data); 30013300d9a9SClaudio Takahasi break; 30023300d9a9SClaudio Takahasi 30033300d9a9SClaudio Takahasi case L2CAP_DISCONN_RSP: 30043300d9a9SClaudio Takahasi err = l2cap_disconnect_rsp(conn, cmd, data); 30053300d9a9SClaudio Takahasi break; 30063300d9a9SClaudio Takahasi 30073300d9a9SClaudio Takahasi case L2CAP_ECHO_REQ: 30083300d9a9SClaudio Takahasi l2cap_send_cmd(conn, cmd->ident, L2CAP_ECHO_RSP, cmd_len, data); 30093300d9a9SClaudio Takahasi break; 30103300d9a9SClaudio Takahasi 30113300d9a9SClaudio Takahasi case L2CAP_ECHO_RSP: 30123300d9a9SClaudio Takahasi break; 30133300d9a9SClaudio Takahasi 30143300d9a9SClaudio Takahasi case L2CAP_INFO_REQ: 30153300d9a9SClaudio Takahasi err = l2cap_information_req(conn, cmd, data); 30163300d9a9SClaudio Takahasi break; 30173300d9a9SClaudio Takahasi 30183300d9a9SClaudio Takahasi case L2CAP_INFO_RSP: 30193300d9a9SClaudio Takahasi err = l2cap_information_rsp(conn, cmd, data); 30203300d9a9SClaudio Takahasi break; 30213300d9a9SClaudio Takahasi 30223300d9a9SClaudio Takahasi default: 30233300d9a9SClaudio Takahasi BT_ERR("Unknown BR/EDR signaling command 0x%2.2x", cmd->code); 30243300d9a9SClaudio Takahasi err = -EINVAL; 30253300d9a9SClaudio Takahasi break; 30263300d9a9SClaudio Takahasi } 30273300d9a9SClaudio Takahasi 30283300d9a9SClaudio Takahasi return err; 30293300d9a9SClaudio Takahasi } 30303300d9a9SClaudio Takahasi 30313300d9a9SClaudio Takahasi static inline int l2cap_le_sig_cmd(struct l2cap_conn *conn, 30323300d9a9SClaudio Takahasi struct l2cap_cmd_hdr *cmd, u8 *data) 30333300d9a9SClaudio Takahasi { 30343300d9a9SClaudio Takahasi switch (cmd->code) { 30353300d9a9SClaudio Takahasi case L2CAP_COMMAND_REJ: 30363300d9a9SClaudio Takahasi return 0; 30373300d9a9SClaudio Takahasi 30383300d9a9SClaudio Takahasi case L2CAP_CONN_PARAM_UPDATE_REQ: 3039de73115aSClaudio Takahasi return l2cap_conn_param_update_req(conn, cmd, data); 30403300d9a9SClaudio Takahasi 30413300d9a9SClaudio Takahasi case L2CAP_CONN_PARAM_UPDATE_RSP: 30423300d9a9SClaudio Takahasi return 0; 30433300d9a9SClaudio Takahasi 30443300d9a9SClaudio Takahasi default: 30453300d9a9SClaudio Takahasi BT_ERR("Unknown LE signaling command 0x%2.2x", cmd->code); 30463300d9a9SClaudio Takahasi return -EINVAL; 30473300d9a9SClaudio Takahasi } 30483300d9a9SClaudio Takahasi } 30493300d9a9SClaudio Takahasi 30503300d9a9SClaudio Takahasi static inline void l2cap_sig_channel(struct l2cap_conn *conn, 30513300d9a9SClaudio Takahasi struct sk_buff *skb) 30520a708f8fSGustavo F. Padovan { 30530a708f8fSGustavo F. Padovan u8 *data = skb->data; 30540a708f8fSGustavo F. Padovan int len = skb->len; 30550a708f8fSGustavo F. Padovan struct l2cap_cmd_hdr cmd; 30563300d9a9SClaudio Takahasi int err; 30570a708f8fSGustavo F. Padovan 30580a708f8fSGustavo F. Padovan l2cap_raw_recv(conn, skb); 30590a708f8fSGustavo F. Padovan 30600a708f8fSGustavo F. Padovan while (len >= L2CAP_CMD_HDR_SIZE) { 30610a708f8fSGustavo F. Padovan u16 cmd_len; 30620a708f8fSGustavo F. Padovan memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE); 30630a708f8fSGustavo F. Padovan data += L2CAP_CMD_HDR_SIZE; 30640a708f8fSGustavo F. Padovan len -= L2CAP_CMD_HDR_SIZE; 30650a708f8fSGustavo F. Padovan 30660a708f8fSGustavo F. Padovan cmd_len = le16_to_cpu(cmd.len); 30670a708f8fSGustavo F. Padovan 30680a708f8fSGustavo F. Padovan BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident); 30690a708f8fSGustavo F. Padovan 30700a708f8fSGustavo F. Padovan if (cmd_len > len || !cmd.ident) { 30710a708f8fSGustavo F. Padovan BT_DBG("corrupted command"); 30720a708f8fSGustavo F. Padovan break; 30730a708f8fSGustavo F. Padovan } 30740a708f8fSGustavo F. Padovan 30753300d9a9SClaudio Takahasi if (conn->hcon->type == LE_LINK) 30763300d9a9SClaudio Takahasi err = l2cap_le_sig_cmd(conn, &cmd, data); 30773300d9a9SClaudio Takahasi else 30783300d9a9SClaudio Takahasi err = l2cap_bredr_sig_cmd(conn, &cmd, cmd_len, data); 30790a708f8fSGustavo F. Padovan 30800a708f8fSGustavo F. Padovan if (err) { 3081e2fd318eSIlia Kolomisnky struct l2cap_cmd_rej_unk rej; 30822c6d1a2eSGustavo F. Padovan 30832c6d1a2eSGustavo F. Padovan BT_ERR("Wrong link type (%d)", err); 30840a708f8fSGustavo F. Padovan 30850a708f8fSGustavo F. Padovan /* FIXME: Map err to a valid reason */ 3086e2fd318eSIlia Kolomisnky rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD); 30870a708f8fSGustavo F. Padovan l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej); 30880a708f8fSGustavo F. Padovan } 30890a708f8fSGustavo F. Padovan 30900a708f8fSGustavo F. Padovan data += cmd_len; 30910a708f8fSGustavo F. Padovan len -= cmd_len; 30920a708f8fSGustavo F. Padovan } 30930a708f8fSGustavo F. Padovan 30940a708f8fSGustavo F. Padovan kfree_skb(skb); 30950a708f8fSGustavo F. Padovan } 30960a708f8fSGustavo F. Padovan 309747d1ec61SGustavo F. Padovan static int l2cap_check_fcs(struct l2cap_chan *chan, struct sk_buff *skb) 30980a708f8fSGustavo F. Padovan { 30990a708f8fSGustavo F. Padovan u16 our_fcs, rcv_fcs; 31000a708f8fSGustavo F. Padovan int hdr_size = L2CAP_HDR_SIZE + 2; 31010a708f8fSGustavo F. Padovan 310247d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) { 31030a708f8fSGustavo F. Padovan skb_trim(skb, skb->len - 2); 31040a708f8fSGustavo F. Padovan rcv_fcs = get_unaligned_le16(skb->data + skb->len); 31050a708f8fSGustavo F. Padovan our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size); 31060a708f8fSGustavo F. Padovan 31070a708f8fSGustavo F. Padovan if (our_fcs != rcv_fcs) 31080a708f8fSGustavo F. Padovan return -EBADMSG; 31090a708f8fSGustavo F. Padovan } 31100a708f8fSGustavo F. Padovan return 0; 31110a708f8fSGustavo F. Padovan } 31120a708f8fSGustavo F. Padovan 3113525cd185SGustavo F. Padovan static inline void l2cap_send_i_or_rr_or_rnr(struct l2cap_chan *chan) 31140a708f8fSGustavo F. Padovan { 31150a708f8fSGustavo F. Padovan u16 control = 0; 31160a708f8fSGustavo F. Padovan 31176a026610SGustavo F. Padovan chan->frames_sent = 0; 31180a708f8fSGustavo F. Padovan 311942e5c802SGustavo F. Padovan control |= chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 31200a708f8fSGustavo F. Padovan 3121e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 31220a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_NOT_READY; 3123525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 3124e2ab4353SGustavo F. Padovan set_bit(CONN_RNR_SENT, &chan->conn_state); 31250a708f8fSGustavo F. Padovan } 31260a708f8fSGustavo F. Padovan 3127e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state)) 3128525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 31290a708f8fSGustavo F. Padovan 3130525cd185SGustavo F. Padovan l2cap_ertm_send(chan); 31310a708f8fSGustavo F. Padovan 3132e2ab4353SGustavo F. Padovan if (!test_bit(CONN_LOCAL_BUSY, &chan->conn_state) && 31336a026610SGustavo F. Padovan chan->frames_sent == 0) { 31340a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY; 3135525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 31360a708f8fSGustavo F. Padovan } 31370a708f8fSGustavo F. Padovan } 31380a708f8fSGustavo F. Padovan 313942e5c802SGustavo F. Padovan static int l2cap_add_to_srej_queue(struct l2cap_chan *chan, struct sk_buff *skb, u8 tx_seq, u8 sar) 31400a708f8fSGustavo F. Padovan { 31410a708f8fSGustavo F. Padovan struct sk_buff *next_skb; 31420a708f8fSGustavo F. Padovan int tx_seq_offset, next_tx_seq_offset; 31430a708f8fSGustavo F. Padovan 31440a708f8fSGustavo F. Padovan bt_cb(skb)->tx_seq = tx_seq; 31450a708f8fSGustavo F. Padovan bt_cb(skb)->sar = sar; 31460a708f8fSGustavo F. Padovan 3147f1c6775bSGustavo F. Padovan next_skb = skb_peek(&chan->srej_q); 31480a708f8fSGustavo F. Padovan if (!next_skb) { 3149f1c6775bSGustavo F. Padovan __skb_queue_tail(&chan->srej_q, skb); 31500a708f8fSGustavo F. Padovan return 0; 31510a708f8fSGustavo F. Padovan } 31520a708f8fSGustavo F. Padovan 315342e5c802SGustavo F. Padovan tx_seq_offset = (tx_seq - chan->buffer_seq) % 64; 31540a708f8fSGustavo F. Padovan if (tx_seq_offset < 0) 31550a708f8fSGustavo F. Padovan tx_seq_offset += 64; 31560a708f8fSGustavo F. Padovan 31570a708f8fSGustavo F. Padovan do { 31580a708f8fSGustavo F. Padovan if (bt_cb(next_skb)->tx_seq == tx_seq) 31590a708f8fSGustavo F. Padovan return -EINVAL; 31600a708f8fSGustavo F. Padovan 31610a708f8fSGustavo F. Padovan next_tx_seq_offset = (bt_cb(next_skb)->tx_seq - 316242e5c802SGustavo F. Padovan chan->buffer_seq) % 64; 31630a708f8fSGustavo F. Padovan if (next_tx_seq_offset < 0) 31640a708f8fSGustavo F. Padovan next_tx_seq_offset += 64; 31650a708f8fSGustavo F. Padovan 31660a708f8fSGustavo F. Padovan if (next_tx_seq_offset > tx_seq_offset) { 3167f1c6775bSGustavo F. Padovan __skb_queue_before(&chan->srej_q, next_skb, skb); 31680a708f8fSGustavo F. Padovan return 0; 31690a708f8fSGustavo F. Padovan } 31700a708f8fSGustavo F. Padovan 3171f1c6775bSGustavo F. Padovan if (skb_queue_is_last(&chan->srej_q, next_skb)) 31720a708f8fSGustavo F. Padovan break; 31730a708f8fSGustavo F. Padovan 3174f1c6775bSGustavo F. Padovan } while ((next_skb = skb_queue_next(&chan->srej_q, next_skb))); 31750a708f8fSGustavo F. Padovan 3176f1c6775bSGustavo F. Padovan __skb_queue_tail(&chan->srej_q, skb); 31770a708f8fSGustavo F. Padovan 31780a708f8fSGustavo F. Padovan return 0; 31790a708f8fSGustavo F. Padovan } 31800a708f8fSGustavo F. Padovan 318184084a31SMat Martineau static void append_skb_frag(struct sk_buff *skb, 318284084a31SMat Martineau struct sk_buff *new_frag, struct sk_buff **last_frag) 31830a708f8fSGustavo F. Padovan { 318484084a31SMat Martineau /* skb->len reflects data in skb as well as all fragments 318584084a31SMat Martineau * skb->data_len reflects only data in fragments 318684084a31SMat Martineau */ 318784084a31SMat Martineau if (!skb_has_frag_list(skb)) 318884084a31SMat Martineau skb_shinfo(skb)->frag_list = new_frag; 318984084a31SMat Martineau 319084084a31SMat Martineau new_frag->next = NULL; 319184084a31SMat Martineau 319284084a31SMat Martineau (*last_frag)->next = new_frag; 319384084a31SMat Martineau *last_frag = new_frag; 319484084a31SMat Martineau 319584084a31SMat Martineau skb->len += new_frag->len; 319684084a31SMat Martineau skb->data_len += new_frag->len; 319784084a31SMat Martineau skb->truesize += new_frag->truesize; 319884084a31SMat Martineau } 319984084a31SMat Martineau 320084084a31SMat Martineau static int l2cap_reassemble_sdu(struct l2cap_chan *chan, struct sk_buff *skb, u16 control) 320184084a31SMat Martineau { 320284084a31SMat Martineau int err = -EINVAL; 32030a708f8fSGustavo F. Padovan 32040a708f8fSGustavo F. Padovan switch (control & L2CAP_CTRL_SAR) { 32050a708f8fSGustavo F. Padovan case L2CAP_SDU_UNSEGMENTED: 320684084a31SMat Martineau if (chan->sdu) 320784084a31SMat Martineau break; 32080a708f8fSGustavo F. Padovan 320984084a31SMat Martineau err = chan->ops->recv(chan->data, skb); 321084084a31SMat Martineau break; 32110a708f8fSGustavo F. Padovan 32120a708f8fSGustavo F. Padovan case L2CAP_SDU_START: 321384084a31SMat Martineau if (chan->sdu) 321484084a31SMat Martineau break; 32150a708f8fSGustavo F. Padovan 32166f61fd47SGustavo F. Padovan chan->sdu_len = get_unaligned_le16(skb->data); 32170a708f8fSGustavo F. Padovan skb_pull(skb, 2); 32180a708f8fSGustavo F. Padovan 321984084a31SMat Martineau if (chan->sdu_len > chan->imtu) { 322084084a31SMat Martineau err = -EMSGSIZE; 322184084a31SMat Martineau break; 322284084a31SMat Martineau } 32230a708f8fSGustavo F. Padovan 322484084a31SMat Martineau if (skb->len >= chan->sdu_len) 322584084a31SMat Martineau break; 322684084a31SMat Martineau 322784084a31SMat Martineau chan->sdu = skb; 322884084a31SMat Martineau chan->sdu_last_frag = skb; 322984084a31SMat Martineau 323084084a31SMat Martineau skb = NULL; 323184084a31SMat Martineau err = 0; 32320a708f8fSGustavo F. Padovan break; 32330a708f8fSGustavo F. Padovan 32340a708f8fSGustavo F. Padovan case L2CAP_SDU_CONTINUE: 32356f61fd47SGustavo F. Padovan if (!chan->sdu) 323684084a31SMat Martineau break; 32370a708f8fSGustavo F. Padovan 323884084a31SMat Martineau append_skb_frag(chan->sdu, skb, 323984084a31SMat Martineau &chan->sdu_last_frag); 324084084a31SMat Martineau skb = NULL; 32410a708f8fSGustavo F. Padovan 324284084a31SMat Martineau if (chan->sdu->len >= chan->sdu_len) 324384084a31SMat Martineau break; 32440a708f8fSGustavo F. Padovan 324584084a31SMat Martineau err = 0; 32460a708f8fSGustavo F. Padovan break; 32470a708f8fSGustavo F. Padovan 32480a708f8fSGustavo F. Padovan case L2CAP_SDU_END: 32496f61fd47SGustavo F. Padovan if (!chan->sdu) 325084084a31SMat Martineau break; 32510a708f8fSGustavo F. Padovan 325284084a31SMat Martineau append_skb_frag(chan->sdu, skb, 325384084a31SMat Martineau &chan->sdu_last_frag); 325484084a31SMat Martineau skb = NULL; 32550a708f8fSGustavo F. Padovan 325684084a31SMat Martineau if (chan->sdu->len != chan->sdu_len) 325784084a31SMat Martineau break; 32580a708f8fSGustavo F. Padovan 325984084a31SMat Martineau err = chan->ops->recv(chan->data, chan->sdu); 32600a708f8fSGustavo F. Padovan 326184084a31SMat Martineau if (!err) { 326284084a31SMat Martineau /* Reassembly complete */ 326384084a31SMat Martineau chan->sdu = NULL; 326484084a31SMat Martineau chan->sdu_last_frag = NULL; 326584084a31SMat Martineau chan->sdu_len = 0; 32660a708f8fSGustavo F. Padovan } 32670a708f8fSGustavo F. Padovan break; 32680a708f8fSGustavo F. Padovan } 32690a708f8fSGustavo F. Padovan 327084084a31SMat Martineau if (err) { 32710a708f8fSGustavo F. Padovan kfree_skb(skb); 32726f61fd47SGustavo F. Padovan kfree_skb(chan->sdu); 32736f61fd47SGustavo F. Padovan chan->sdu = NULL; 327484084a31SMat Martineau chan->sdu_last_frag = NULL; 327584084a31SMat Martineau chan->sdu_len = 0; 327684084a31SMat Martineau } 32770a708f8fSGustavo F. Padovan 327884084a31SMat Martineau return err; 32790a708f8fSGustavo F. Padovan } 32800a708f8fSGustavo F. Padovan 328126f880d2SMat Martineau static void l2cap_ertm_enter_local_busy(struct l2cap_chan *chan) 32820a708f8fSGustavo F. Padovan { 32830a708f8fSGustavo F. Padovan u16 control; 32840a708f8fSGustavo F. Padovan 328526f880d2SMat Martineau BT_DBG("chan %p, Enter local busy", chan); 328626f880d2SMat Martineau 328726f880d2SMat Martineau set_bit(CONN_LOCAL_BUSY, &chan->conn_state); 328826f880d2SMat Martineau 328926f880d2SMat Martineau control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 329026f880d2SMat Martineau control |= L2CAP_SUPER_RCV_NOT_READY; 329126f880d2SMat Martineau l2cap_send_sframe(chan, control); 329226f880d2SMat Martineau 329326f880d2SMat Martineau set_bit(CONN_RNR_SENT, &chan->conn_state); 329426f880d2SMat Martineau 329526f880d2SMat Martineau __clear_ack_timer(chan); 32960a708f8fSGustavo F. Padovan } 32970a708f8fSGustavo F. Padovan 329826f880d2SMat Martineau static void l2cap_ertm_exit_local_busy(struct l2cap_chan *chan) 329926f880d2SMat Martineau { 330026f880d2SMat Martineau u16 control; 33010a708f8fSGustavo F. Padovan 3302e2ab4353SGustavo F. Padovan if (!test_bit(CONN_RNR_SENT, &chan->conn_state)) 33030a708f8fSGustavo F. Padovan goto done; 33040a708f8fSGustavo F. Padovan 330542e5c802SGustavo F. Padovan control = chan->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT; 33060a708f8fSGustavo F. Padovan control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL; 3307525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 33086a026610SGustavo F. Padovan chan->retry_count = 1; 33090a708f8fSGustavo F. Padovan 33101a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 33111a09bcb9SGustavo F. Padovan __set_monitor_timer(chan); 33120a708f8fSGustavo F. Padovan 3313e2ab4353SGustavo F. Padovan set_bit(CONN_WAIT_F, &chan->conn_state); 33140a708f8fSGustavo F. Padovan 33150a708f8fSGustavo F. Padovan done: 3316e2ab4353SGustavo F. Padovan clear_bit(CONN_LOCAL_BUSY, &chan->conn_state); 3317e2ab4353SGustavo F. Padovan clear_bit(CONN_RNR_SENT, &chan->conn_state); 33180a708f8fSGustavo F. Padovan 331949208c9cSGustavo F. Padovan BT_DBG("chan %p, Exit local busy", chan); 33200a708f8fSGustavo F. Padovan } 33210a708f8fSGustavo F. Padovan 3322e328140fSMat Martineau void l2cap_chan_busy(struct l2cap_chan *chan, int busy) 33230a708f8fSGustavo F. Padovan { 3324e328140fSMat Martineau if (chan->mode == L2CAP_MODE_ERTM) { 3325e328140fSMat Martineau if (busy) 332626f880d2SMat Martineau l2cap_ertm_enter_local_busy(chan); 3327e328140fSMat Martineau else 3328e328140fSMat Martineau l2cap_ertm_exit_local_busy(chan); 33290a708f8fSGustavo F. Padovan } 33300a708f8fSGustavo F. Padovan } 33310a708f8fSGustavo F. Padovan 3332525cd185SGustavo F. Padovan static void l2cap_check_srej_gap(struct l2cap_chan *chan, u8 tx_seq) 33330a708f8fSGustavo F. Padovan { 33340a708f8fSGustavo F. Padovan struct sk_buff *skb; 33350a708f8fSGustavo F. Padovan u16 control; 33360a708f8fSGustavo F. Padovan 3337e328140fSMat Martineau while ((skb = skb_peek(&chan->srej_q)) && 3338e328140fSMat Martineau !test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) { 3339e328140fSMat Martineau int err; 3340e328140fSMat Martineau 33410a708f8fSGustavo F. Padovan if (bt_cb(skb)->tx_seq != tx_seq) 33420a708f8fSGustavo F. Padovan break; 33430a708f8fSGustavo F. Padovan 3344f1c6775bSGustavo F. Padovan skb = skb_dequeue(&chan->srej_q); 33450a708f8fSGustavo F. Padovan control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT; 334684084a31SMat Martineau err = l2cap_reassemble_sdu(chan, skb, control); 3347e328140fSMat Martineau 3348e328140fSMat Martineau if (err < 0) { 3349e328140fSMat Martineau l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 3350e328140fSMat Martineau break; 3351e328140fSMat Martineau } 3352e328140fSMat Martineau 335342e5c802SGustavo F. Padovan chan->buffer_seq_srej = 335442e5c802SGustavo F. Padovan (chan->buffer_seq_srej + 1) % 64; 33550a708f8fSGustavo F. Padovan tx_seq = (tx_seq + 1) % 64; 33560a708f8fSGustavo F. Padovan } 33570a708f8fSGustavo F. Padovan } 33580a708f8fSGustavo F. Padovan 3359525cd185SGustavo F. Padovan static void l2cap_resend_srejframe(struct l2cap_chan *chan, u8 tx_seq) 33600a708f8fSGustavo F. Padovan { 33610a708f8fSGustavo F. Padovan struct srej_list *l, *tmp; 33620a708f8fSGustavo F. Padovan u16 control; 33630a708f8fSGustavo F. Padovan 336439d5a3eeSGustavo F. Padovan list_for_each_entry_safe(l, tmp, &chan->srej_l, list) { 33650a708f8fSGustavo F. Padovan if (l->tx_seq == tx_seq) { 33660a708f8fSGustavo F. Padovan list_del(&l->list); 33670a708f8fSGustavo F. Padovan kfree(l); 33680a708f8fSGustavo F. Padovan return; 33690a708f8fSGustavo F. Padovan } 33700a708f8fSGustavo F. Padovan control = L2CAP_SUPER_SELECT_REJECT; 33710a708f8fSGustavo F. Padovan control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT; 3372525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 33730a708f8fSGustavo F. Padovan list_del(&l->list); 337439d5a3eeSGustavo F. Padovan list_add_tail(&l->list, &chan->srej_l); 33750a708f8fSGustavo F. Padovan } 33760a708f8fSGustavo F. Padovan } 33770a708f8fSGustavo F. Padovan 3378525cd185SGustavo F. Padovan static void l2cap_send_srejframe(struct l2cap_chan *chan, u8 tx_seq) 33790a708f8fSGustavo F. Padovan { 33800a708f8fSGustavo F. Padovan struct srej_list *new; 33810a708f8fSGustavo F. Padovan u16 control; 33820a708f8fSGustavo F. Padovan 338342e5c802SGustavo F. Padovan while (tx_seq != chan->expected_tx_seq) { 33840a708f8fSGustavo F. Padovan control = L2CAP_SUPER_SELECT_REJECT; 338542e5c802SGustavo F. Padovan control |= chan->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT; 3386525cd185SGustavo F. Padovan l2cap_send_sframe(chan, control); 33870a708f8fSGustavo F. Padovan 33880a708f8fSGustavo F. Padovan new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC); 338942e5c802SGustavo F. Padovan new->tx_seq = chan->expected_tx_seq; 339042e5c802SGustavo F. Padovan chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64; 339139d5a3eeSGustavo F. Padovan list_add_tail(&new->list, &chan->srej_l); 33920a708f8fSGustavo F. Padovan } 339342e5c802SGustavo F. Padovan chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64; 33940a708f8fSGustavo F. Padovan } 33950a708f8fSGustavo F. Padovan 3396525cd185SGustavo F. Padovan static inline int l2cap_data_channel_iframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb) 33970a708f8fSGustavo F. Padovan { 33980a708f8fSGustavo F. Padovan u8 tx_seq = __get_txseq(rx_control); 33990a708f8fSGustavo F. Padovan u8 req_seq = __get_reqseq(rx_control); 34000a708f8fSGustavo F. Padovan u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT; 34010a708f8fSGustavo F. Padovan int tx_seq_offset, expected_tx_seq_offset; 340247d1ec61SGustavo F. Padovan int num_to_ack = (chan->tx_win/6) + 1; 34030a708f8fSGustavo F. Padovan int err = 0; 34040a708f8fSGustavo F. Padovan 3405525cd185SGustavo F. Padovan BT_DBG("chan %p len %d tx_seq %d rx_control 0x%4.4x", chan, skb->len, 3406525cd185SGustavo F. Padovan tx_seq, rx_control); 34070a708f8fSGustavo F. Padovan 34080a708f8fSGustavo F. Padovan if (L2CAP_CTRL_FINAL & rx_control && 3409e2ab4353SGustavo F. Padovan test_bit(CONN_WAIT_F, &chan->conn_state)) { 34101a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 34116a026610SGustavo F. Padovan if (chan->unacked_frames > 0) 34121a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 3413e2ab4353SGustavo F. Padovan clear_bit(CONN_WAIT_F, &chan->conn_state); 34140a708f8fSGustavo F. Padovan } 34150a708f8fSGustavo F. Padovan 341642e5c802SGustavo F. Padovan chan->expected_ack_seq = req_seq; 341742e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 34180a708f8fSGustavo F. Padovan 341942e5c802SGustavo F. Padovan tx_seq_offset = (tx_seq - chan->buffer_seq) % 64; 34200a708f8fSGustavo F. Padovan if (tx_seq_offset < 0) 34210a708f8fSGustavo F. Padovan tx_seq_offset += 64; 34220a708f8fSGustavo F. Padovan 34230a708f8fSGustavo F. Padovan /* invalid tx_seq */ 342447d1ec61SGustavo F. Padovan if (tx_seq_offset >= chan->tx_win) { 34258c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 34260a708f8fSGustavo F. Padovan goto drop; 34270a708f8fSGustavo F. Padovan } 34280a708f8fSGustavo F. Padovan 3429e2ab4353SGustavo F. Padovan if (test_bit(CONN_LOCAL_BUSY, &chan->conn_state)) 34300a708f8fSGustavo F. Padovan goto drop; 34310a708f8fSGustavo F. Padovan 343202f1b641SMat Martineau if (tx_seq == chan->expected_tx_seq) 343302f1b641SMat Martineau goto expected; 343402f1b641SMat Martineau 3435e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 34360a708f8fSGustavo F. Padovan struct srej_list *first; 34370a708f8fSGustavo F. Padovan 343839d5a3eeSGustavo F. Padovan first = list_first_entry(&chan->srej_l, 34390a708f8fSGustavo F. Padovan struct srej_list, list); 34400a708f8fSGustavo F. Padovan if (tx_seq == first->tx_seq) { 344142e5c802SGustavo F. Padovan l2cap_add_to_srej_queue(chan, skb, tx_seq, sar); 3442525cd185SGustavo F. Padovan l2cap_check_srej_gap(chan, tx_seq); 34430a708f8fSGustavo F. Padovan 34440a708f8fSGustavo F. Padovan list_del(&first->list); 34450a708f8fSGustavo F. Padovan kfree(first); 34460a708f8fSGustavo F. Padovan 344739d5a3eeSGustavo F. Padovan if (list_empty(&chan->srej_l)) { 344842e5c802SGustavo F. Padovan chan->buffer_seq = chan->buffer_seq_srej; 3449e2ab4353SGustavo F. Padovan clear_bit(CONN_SREJ_SENT, &chan->conn_state); 3450525cd185SGustavo F. Padovan l2cap_send_ack(chan); 345149208c9cSGustavo F. Padovan BT_DBG("chan %p, Exit SREJ_SENT", chan); 34520a708f8fSGustavo F. Padovan } 34530a708f8fSGustavo F. Padovan } else { 34540a708f8fSGustavo F. Padovan struct srej_list *l; 34550a708f8fSGustavo F. Padovan 34560a708f8fSGustavo F. Padovan /* duplicated tx_seq */ 345742e5c802SGustavo F. Padovan if (l2cap_add_to_srej_queue(chan, skb, tx_seq, sar) < 0) 34580a708f8fSGustavo F. Padovan goto drop; 34590a708f8fSGustavo F. Padovan 346039d5a3eeSGustavo F. Padovan list_for_each_entry(l, &chan->srej_l, list) { 34610a708f8fSGustavo F. Padovan if (l->tx_seq == tx_seq) { 3462525cd185SGustavo F. Padovan l2cap_resend_srejframe(chan, tx_seq); 34630a708f8fSGustavo F. Padovan return 0; 34640a708f8fSGustavo F. Padovan } 34650a708f8fSGustavo F. Padovan } 3466525cd185SGustavo F. Padovan l2cap_send_srejframe(chan, tx_seq); 34670a708f8fSGustavo F. Padovan } 34680a708f8fSGustavo F. Padovan } else { 34690a708f8fSGustavo F. Padovan expected_tx_seq_offset = 347042e5c802SGustavo F. Padovan (chan->expected_tx_seq - chan->buffer_seq) % 64; 34710a708f8fSGustavo F. Padovan if (expected_tx_seq_offset < 0) 34720a708f8fSGustavo F. Padovan expected_tx_seq_offset += 64; 34730a708f8fSGustavo F. Padovan 34740a708f8fSGustavo F. Padovan /* duplicated tx_seq */ 34750a708f8fSGustavo F. Padovan if (tx_seq_offset < expected_tx_seq_offset) 34760a708f8fSGustavo F. Padovan goto drop; 34770a708f8fSGustavo F. Padovan 3478e2ab4353SGustavo F. Padovan set_bit(CONN_SREJ_SENT, &chan->conn_state); 34790a708f8fSGustavo F. Padovan 348049208c9cSGustavo F. Padovan BT_DBG("chan %p, Enter SREJ", chan); 34810a708f8fSGustavo F. Padovan 348239d5a3eeSGustavo F. Padovan INIT_LIST_HEAD(&chan->srej_l); 348342e5c802SGustavo F. Padovan chan->buffer_seq_srej = chan->buffer_seq; 34840a708f8fSGustavo F. Padovan 3485f1c6775bSGustavo F. Padovan __skb_queue_head_init(&chan->srej_q); 348642e5c802SGustavo F. Padovan l2cap_add_to_srej_queue(chan, skb, tx_seq, sar); 34870a708f8fSGustavo F. Padovan 3488e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_PBIT, &chan->conn_state); 34890a708f8fSGustavo F. Padovan 3490525cd185SGustavo F. Padovan l2cap_send_srejframe(chan, tx_seq); 34910a708f8fSGustavo F. Padovan 34921a09bcb9SGustavo F. Padovan __clear_ack_timer(chan); 34930a708f8fSGustavo F. Padovan } 34940a708f8fSGustavo F. Padovan return 0; 34950a708f8fSGustavo F. Padovan 34960a708f8fSGustavo F. Padovan expected: 349742e5c802SGustavo F. Padovan chan->expected_tx_seq = (chan->expected_tx_seq + 1) % 64; 34980a708f8fSGustavo F. Padovan 3499e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 35000a708f8fSGustavo F. Padovan bt_cb(skb)->tx_seq = tx_seq; 35010a708f8fSGustavo F. Padovan bt_cb(skb)->sar = sar; 3502f1c6775bSGustavo F. Padovan __skb_queue_tail(&chan->srej_q, skb); 35030a708f8fSGustavo F. Padovan return 0; 35040a708f8fSGustavo F. Padovan } 35050a708f8fSGustavo F. Padovan 350684084a31SMat Martineau err = l2cap_reassemble_sdu(chan, skb, rx_control); 3507fadd192eSMat Martineau chan->buffer_seq = (chan->buffer_seq + 1) % 64; 3508e328140fSMat Martineau if (err < 0) { 3509e328140fSMat Martineau l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 3510e328140fSMat Martineau return err; 3511e328140fSMat Martineau } 35120a708f8fSGustavo F. Padovan 35130a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_FINAL) { 3514e2ab4353SGustavo F. Padovan if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 3515525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35160a708f8fSGustavo F. Padovan } 35170a708f8fSGustavo F. Padovan 35181a09bcb9SGustavo F. Padovan __set_ack_timer(chan); 35190a708f8fSGustavo F. Padovan 35206a026610SGustavo F. Padovan chan->num_acked = (chan->num_acked + 1) % num_to_ack; 35216a026610SGustavo F. Padovan if (chan->num_acked == num_to_ack - 1) 3522525cd185SGustavo F. Padovan l2cap_send_ack(chan); 35230a708f8fSGustavo F. Padovan 35240a708f8fSGustavo F. Padovan return 0; 35250a708f8fSGustavo F. Padovan 35260a708f8fSGustavo F. Padovan drop: 35270a708f8fSGustavo F. Padovan kfree_skb(skb); 35280a708f8fSGustavo F. Padovan return 0; 35290a708f8fSGustavo F. Padovan } 35300a708f8fSGustavo F. Padovan 3531525cd185SGustavo F. Padovan static inline void l2cap_data_channel_rrframe(struct l2cap_chan *chan, u16 rx_control) 35320a708f8fSGustavo F. Padovan { 353349208c9cSGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, __get_reqseq(rx_control), 35340a708f8fSGustavo F. Padovan rx_control); 35350a708f8fSGustavo F. Padovan 353642e5c802SGustavo F. Padovan chan->expected_ack_seq = __get_reqseq(rx_control); 353742e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 35380a708f8fSGustavo F. Padovan 35390a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) { 3540e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_FBIT, &chan->conn_state); 3541e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 3542e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 35436a026610SGustavo F. Padovan (chan->unacked_frames > 0)) 35441a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 35450a708f8fSGustavo F. Padovan 3546e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 3547525cd185SGustavo F. Padovan l2cap_send_srejtail(chan); 35480a708f8fSGustavo F. Padovan } else { 3549525cd185SGustavo F. Padovan l2cap_send_i_or_rr_or_rnr(chan); 35500a708f8fSGustavo F. Padovan } 35510a708f8fSGustavo F. Padovan 35520a708f8fSGustavo F. Padovan } else if (rx_control & L2CAP_CTRL_FINAL) { 3553e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 35540a708f8fSGustavo F. Padovan 3555e2ab4353SGustavo F. Padovan if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 3556525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35570a708f8fSGustavo F. Padovan 35580a708f8fSGustavo F. Padovan } else { 3559e2ab4353SGustavo F. Padovan if (test_bit(CONN_REMOTE_BUSY, &chan->conn_state) && 35606a026610SGustavo F. Padovan (chan->unacked_frames > 0)) 35611a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 35620a708f8fSGustavo F. Padovan 3563e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 3564e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_SENT, &chan->conn_state)) 3565525cd185SGustavo F. Padovan l2cap_send_ack(chan); 35660a708f8fSGustavo F. Padovan else 3567525cd185SGustavo F. Padovan l2cap_ertm_send(chan); 35680a708f8fSGustavo F. Padovan } 35690a708f8fSGustavo F. Padovan } 35700a708f8fSGustavo F. Padovan 3571525cd185SGustavo F. Padovan static inline void l2cap_data_channel_rejframe(struct l2cap_chan *chan, u16 rx_control) 35720a708f8fSGustavo F. Padovan { 35730a708f8fSGustavo F. Padovan u8 tx_seq = __get_reqseq(rx_control); 35740a708f8fSGustavo F. Padovan 3575525cd185SGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control); 35760a708f8fSGustavo F. Padovan 3577e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 35780a708f8fSGustavo F. Padovan 357942e5c802SGustavo F. Padovan chan->expected_ack_seq = tx_seq; 358042e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 35810a708f8fSGustavo F. Padovan 35820a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_FINAL) { 3583e2ab4353SGustavo F. Padovan if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) 3584525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35850a708f8fSGustavo F. Padovan } else { 3586525cd185SGustavo F. Padovan l2cap_retransmit_frames(chan); 35870a708f8fSGustavo F. Padovan 3588e2ab4353SGustavo F. Padovan if (test_bit(CONN_WAIT_F, &chan->conn_state)) 3589e2ab4353SGustavo F. Padovan set_bit(CONN_REJ_ACT, &chan->conn_state); 35900a708f8fSGustavo F. Padovan } 35910a708f8fSGustavo F. Padovan } 3592525cd185SGustavo F. Padovan static inline void l2cap_data_channel_srejframe(struct l2cap_chan *chan, u16 rx_control) 35930a708f8fSGustavo F. Padovan { 35940a708f8fSGustavo F. Padovan u8 tx_seq = __get_reqseq(rx_control); 35950a708f8fSGustavo F. Padovan 3596525cd185SGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control); 35970a708f8fSGustavo F. Padovan 3598e2ab4353SGustavo F. Padovan clear_bit(CONN_REMOTE_BUSY, &chan->conn_state); 35990a708f8fSGustavo F. Padovan 36000a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) { 360142e5c802SGustavo F. Padovan chan->expected_ack_seq = tx_seq; 360242e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 36030a708f8fSGustavo F. Padovan 3604e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_FBIT, &chan->conn_state); 3605525cd185SGustavo F. Padovan l2cap_retransmit_one_frame(chan, tx_seq); 36060a708f8fSGustavo F. Padovan 3607525cd185SGustavo F. Padovan l2cap_ertm_send(chan); 36080a708f8fSGustavo F. Padovan 3609e2ab4353SGustavo F. Padovan if (test_bit(CONN_WAIT_F, &chan->conn_state)) { 36106a026610SGustavo F. Padovan chan->srej_save_reqseq = tx_seq; 3611e2ab4353SGustavo F. Padovan set_bit(CONN_SREJ_ACT, &chan->conn_state); 36120a708f8fSGustavo F. Padovan } 36130a708f8fSGustavo F. Padovan } else if (rx_control & L2CAP_CTRL_FINAL) { 3614e2ab4353SGustavo F. Padovan if (test_bit(CONN_SREJ_ACT, &chan->conn_state) && 36156a026610SGustavo F. Padovan chan->srej_save_reqseq == tx_seq) 3616e2ab4353SGustavo F. Padovan clear_bit(CONN_SREJ_ACT, &chan->conn_state); 36170a708f8fSGustavo F. Padovan else 3618525cd185SGustavo F. Padovan l2cap_retransmit_one_frame(chan, tx_seq); 36190a708f8fSGustavo F. Padovan } else { 3620525cd185SGustavo F. Padovan l2cap_retransmit_one_frame(chan, tx_seq); 3621e2ab4353SGustavo F. Padovan if (test_bit(CONN_WAIT_F, &chan->conn_state)) { 36226a026610SGustavo F. Padovan chan->srej_save_reqseq = tx_seq; 3623e2ab4353SGustavo F. Padovan set_bit(CONN_SREJ_ACT, &chan->conn_state); 36240a708f8fSGustavo F. Padovan } 36250a708f8fSGustavo F. Padovan } 36260a708f8fSGustavo F. Padovan } 36270a708f8fSGustavo F. Padovan 3628525cd185SGustavo F. Padovan static inline void l2cap_data_channel_rnrframe(struct l2cap_chan *chan, u16 rx_control) 36290a708f8fSGustavo F. Padovan { 36300a708f8fSGustavo F. Padovan u8 tx_seq = __get_reqseq(rx_control); 36310a708f8fSGustavo F. Padovan 3632525cd185SGustavo F. Padovan BT_DBG("chan %p, req_seq %d ctrl 0x%4.4x", chan, tx_seq, rx_control); 36330a708f8fSGustavo F. Padovan 3634e2ab4353SGustavo F. Padovan set_bit(CONN_REMOTE_BUSY, &chan->conn_state); 363542e5c802SGustavo F. Padovan chan->expected_ack_seq = tx_seq; 363642e5c802SGustavo F. Padovan l2cap_drop_acked_frames(chan); 36370a708f8fSGustavo F. Padovan 36380a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) 3639e2ab4353SGustavo F. Padovan set_bit(CONN_SEND_FBIT, &chan->conn_state); 36400a708f8fSGustavo F. Padovan 3641e2ab4353SGustavo F. Padovan if (!test_bit(CONN_SREJ_SENT, &chan->conn_state)) { 36421a09bcb9SGustavo F. Padovan __clear_retrans_timer(chan); 36430a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) 3644525cd185SGustavo F. Padovan l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_FINAL); 36450a708f8fSGustavo F. Padovan return; 36460a708f8fSGustavo F. Padovan } 36470a708f8fSGustavo F. Padovan 36480a708f8fSGustavo F. Padovan if (rx_control & L2CAP_CTRL_POLL) 3649525cd185SGustavo F. Padovan l2cap_send_srejtail(chan); 36500a708f8fSGustavo F. Padovan else 3651525cd185SGustavo F. Padovan l2cap_send_sframe(chan, L2CAP_SUPER_RCV_READY); 36520a708f8fSGustavo F. Padovan } 36530a708f8fSGustavo F. Padovan 3654525cd185SGustavo F. Padovan static inline int l2cap_data_channel_sframe(struct l2cap_chan *chan, u16 rx_control, struct sk_buff *skb) 36550a708f8fSGustavo F. Padovan { 3656525cd185SGustavo F. Padovan BT_DBG("chan %p rx_control 0x%4.4x len %d", chan, rx_control, skb->len); 36570a708f8fSGustavo F. Padovan 36580a708f8fSGustavo F. Padovan if (L2CAP_CTRL_FINAL & rx_control && 3659e2ab4353SGustavo F. Padovan test_bit(CONN_WAIT_F, &chan->conn_state)) { 36601a09bcb9SGustavo F. Padovan __clear_monitor_timer(chan); 36616a026610SGustavo F. Padovan if (chan->unacked_frames > 0) 36621a09bcb9SGustavo F. Padovan __set_retrans_timer(chan); 3663e2ab4353SGustavo F. Padovan clear_bit(CONN_WAIT_F, &chan->conn_state); 36640a708f8fSGustavo F. Padovan } 36650a708f8fSGustavo F. Padovan 36660a708f8fSGustavo F. Padovan switch (rx_control & L2CAP_CTRL_SUPERVISE) { 36670a708f8fSGustavo F. Padovan case L2CAP_SUPER_RCV_READY: 3668525cd185SGustavo F. Padovan l2cap_data_channel_rrframe(chan, rx_control); 36690a708f8fSGustavo F. Padovan break; 36700a708f8fSGustavo F. Padovan 36710a708f8fSGustavo F. Padovan case L2CAP_SUPER_REJECT: 3672525cd185SGustavo F. Padovan l2cap_data_channel_rejframe(chan, rx_control); 36730a708f8fSGustavo F. Padovan break; 36740a708f8fSGustavo F. Padovan 36750a708f8fSGustavo F. Padovan case L2CAP_SUPER_SELECT_REJECT: 3676525cd185SGustavo F. Padovan l2cap_data_channel_srejframe(chan, rx_control); 36770a708f8fSGustavo F. Padovan break; 36780a708f8fSGustavo F. Padovan 36790a708f8fSGustavo F. Padovan case L2CAP_SUPER_RCV_NOT_READY: 3680525cd185SGustavo F. Padovan l2cap_data_channel_rnrframe(chan, rx_control); 36810a708f8fSGustavo F. Padovan break; 36820a708f8fSGustavo F. Padovan } 36830a708f8fSGustavo F. Padovan 36840a708f8fSGustavo F. Padovan kfree_skb(skb); 36850a708f8fSGustavo F. Padovan return 0; 36860a708f8fSGustavo F. Padovan } 36870a708f8fSGustavo F. Padovan 36880a708f8fSGustavo F. Padovan static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb) 36890a708f8fSGustavo F. Padovan { 3690525cd185SGustavo F. Padovan struct l2cap_chan *chan = l2cap_pi(sk)->chan; 36910a708f8fSGustavo F. Padovan u16 control; 36920a708f8fSGustavo F. Padovan u8 req_seq; 36930a708f8fSGustavo F. Padovan int len, next_tx_seq_offset, req_seq_offset; 36940a708f8fSGustavo F. Padovan 36950a708f8fSGustavo F. Padovan control = get_unaligned_le16(skb->data); 36960a708f8fSGustavo F. Padovan skb_pull(skb, 2); 36970a708f8fSGustavo F. Padovan len = skb->len; 36980a708f8fSGustavo F. Padovan 36990a708f8fSGustavo F. Padovan /* 37000a708f8fSGustavo F. Padovan * We can just drop the corrupted I-frame here. 37010a708f8fSGustavo F. Padovan * Receiver will miss it and start proper recovery 37020a708f8fSGustavo F. Padovan * procedures and ask retransmission. 37030a708f8fSGustavo F. Padovan */ 370447d1ec61SGustavo F. Padovan if (l2cap_check_fcs(chan, skb)) 37050a708f8fSGustavo F. Padovan goto drop; 37060a708f8fSGustavo F. Padovan 37070a708f8fSGustavo F. Padovan if (__is_sar_start(control) && __is_iframe(control)) 37080a708f8fSGustavo F. Padovan len -= 2; 37090a708f8fSGustavo F. Padovan 371047d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 37110a708f8fSGustavo F. Padovan len -= 2; 37120a708f8fSGustavo F. Padovan 371347d1ec61SGustavo F. Padovan if (len > chan->mps) { 37148c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 37150a708f8fSGustavo F. Padovan goto drop; 37160a708f8fSGustavo F. Padovan } 37170a708f8fSGustavo F. Padovan 37180a708f8fSGustavo F. Padovan req_seq = __get_reqseq(control); 371942e5c802SGustavo F. Padovan req_seq_offset = (req_seq - chan->expected_ack_seq) % 64; 37200a708f8fSGustavo F. Padovan if (req_seq_offset < 0) 37210a708f8fSGustavo F. Padovan req_seq_offset += 64; 37220a708f8fSGustavo F. Padovan 37230a708f8fSGustavo F. Padovan next_tx_seq_offset = 372442e5c802SGustavo F. Padovan (chan->next_tx_seq - chan->expected_ack_seq) % 64; 37250a708f8fSGustavo F. Padovan if (next_tx_seq_offset < 0) 37260a708f8fSGustavo F. Padovan next_tx_seq_offset += 64; 37270a708f8fSGustavo F. Padovan 37280a708f8fSGustavo F. Padovan /* check for invalid req-seq */ 37290a708f8fSGustavo F. Padovan if (req_seq_offset > next_tx_seq_offset) { 37308c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 37310a708f8fSGustavo F. Padovan goto drop; 37320a708f8fSGustavo F. Padovan } 37330a708f8fSGustavo F. Padovan 37340a708f8fSGustavo F. Padovan if (__is_iframe(control)) { 37350a708f8fSGustavo F. Padovan if (len < 0) { 37368c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 37370a708f8fSGustavo F. Padovan goto drop; 37380a708f8fSGustavo F. Padovan } 37390a708f8fSGustavo F. Padovan 3740525cd185SGustavo F. Padovan l2cap_data_channel_iframe(chan, control, skb); 37410a708f8fSGustavo F. Padovan } else { 37420a708f8fSGustavo F. Padovan if (len != 0) { 37430a708f8fSGustavo F. Padovan BT_ERR("%d", len); 37448c1d787bSGustavo F. Padovan l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 37450a708f8fSGustavo F. Padovan goto drop; 37460a708f8fSGustavo F. Padovan } 37470a708f8fSGustavo F. Padovan 3748525cd185SGustavo F. Padovan l2cap_data_channel_sframe(chan, control, skb); 37490a708f8fSGustavo F. Padovan } 37500a708f8fSGustavo F. Padovan 37510a708f8fSGustavo F. Padovan return 0; 37520a708f8fSGustavo F. Padovan 37530a708f8fSGustavo F. Padovan drop: 37540a708f8fSGustavo F. Padovan kfree_skb(skb); 37550a708f8fSGustavo F. Padovan return 0; 37560a708f8fSGustavo F. Padovan } 37570a708f8fSGustavo F. Padovan 37580a708f8fSGustavo F. Padovan static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb) 37590a708f8fSGustavo F. Padovan { 376048454079SGustavo F. Padovan struct l2cap_chan *chan; 3761bf734843SDavid S. Miller struct sock *sk = NULL; 37620a708f8fSGustavo F. Padovan u16 control; 37630a708f8fSGustavo F. Padovan u8 tx_seq; 37640a708f8fSGustavo F. Padovan int len; 37650a708f8fSGustavo F. Padovan 3766baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, cid); 376748454079SGustavo F. Padovan if (!chan) { 37680a708f8fSGustavo F. Padovan BT_DBG("unknown cid 0x%4.4x", cid); 37690a708f8fSGustavo F. Padovan goto drop; 37700a708f8fSGustavo F. Padovan } 37710a708f8fSGustavo F. Padovan 377248454079SGustavo F. Padovan sk = chan->sk; 37730a708f8fSGustavo F. Padovan 377449208c9cSGustavo F. Padovan BT_DBG("chan %p, len %d", chan, skb->len); 37750a708f8fSGustavo F. Padovan 377689bc500eSGustavo F. Padovan if (chan->state != BT_CONNECTED) 37770a708f8fSGustavo F. Padovan goto drop; 37780a708f8fSGustavo F. Padovan 37790c1bc5c6SGustavo F. Padovan switch (chan->mode) { 37800a708f8fSGustavo F. Padovan case L2CAP_MODE_BASIC: 37810a708f8fSGustavo F. Padovan /* If socket recv buffers overflows we drop data here 37820a708f8fSGustavo F. Padovan * which is *bad* because L2CAP has to be reliable. 37830a708f8fSGustavo F. Padovan * But we don't have any other choice. L2CAP doesn't 37840a708f8fSGustavo F. Padovan * provide flow control mechanism. */ 37850a708f8fSGustavo F. Padovan 37860c1bc5c6SGustavo F. Padovan if (chan->imtu < skb->len) 37870a708f8fSGustavo F. Padovan goto drop; 37880a708f8fSGustavo F. Padovan 378923070494SGustavo F. Padovan if (!chan->ops->recv(chan->data, skb)) 37900a708f8fSGustavo F. Padovan goto done; 37910a708f8fSGustavo F. Padovan break; 37920a708f8fSGustavo F. Padovan 37930a708f8fSGustavo F. Padovan case L2CAP_MODE_ERTM: 37940a708f8fSGustavo F. Padovan if (!sock_owned_by_user(sk)) { 37950a708f8fSGustavo F. Padovan l2cap_ertm_data_rcv(sk, skb); 37960a708f8fSGustavo F. Padovan } else { 37970a708f8fSGustavo F. Padovan if (sk_add_backlog(sk, skb)) 37980a708f8fSGustavo F. Padovan goto drop; 37990a708f8fSGustavo F. Padovan } 38000a708f8fSGustavo F. Padovan 38010a708f8fSGustavo F. Padovan goto done; 38020a708f8fSGustavo F. Padovan 38030a708f8fSGustavo F. Padovan case L2CAP_MODE_STREAMING: 38040a708f8fSGustavo F. Padovan control = get_unaligned_le16(skb->data); 38050a708f8fSGustavo F. Padovan skb_pull(skb, 2); 38060a708f8fSGustavo F. Padovan len = skb->len; 38070a708f8fSGustavo F. Padovan 380847d1ec61SGustavo F. Padovan if (l2cap_check_fcs(chan, skb)) 38090a708f8fSGustavo F. Padovan goto drop; 38100a708f8fSGustavo F. Padovan 38110a708f8fSGustavo F. Padovan if (__is_sar_start(control)) 38120a708f8fSGustavo F. Padovan len -= 2; 38130a708f8fSGustavo F. Padovan 381447d1ec61SGustavo F. Padovan if (chan->fcs == L2CAP_FCS_CRC16) 38150a708f8fSGustavo F. Padovan len -= 2; 38160a708f8fSGustavo F. Padovan 381747d1ec61SGustavo F. Padovan if (len > chan->mps || len < 0 || __is_sframe(control)) 38180a708f8fSGustavo F. Padovan goto drop; 38190a708f8fSGustavo F. Padovan 38200a708f8fSGustavo F. Padovan tx_seq = __get_txseq(control); 38210a708f8fSGustavo F. Padovan 382284084a31SMat Martineau if (chan->expected_tx_seq != tx_seq) { 382384084a31SMat Martineau /* Frame(s) missing - must discard partial SDU */ 382484084a31SMat Martineau kfree_skb(chan->sdu); 382584084a31SMat Martineau chan->sdu = NULL; 382684084a31SMat Martineau chan->sdu_last_frag = NULL; 382784084a31SMat Martineau chan->sdu_len = 0; 382884084a31SMat Martineau 382984084a31SMat Martineau /* TODO: Notify userland of missing data */ 383084084a31SMat Martineau } 383184084a31SMat Martineau 383242e5c802SGustavo F. Padovan chan->expected_tx_seq = (tx_seq + 1) % 64; 38330a708f8fSGustavo F. Padovan 383484084a31SMat Martineau if (l2cap_reassemble_sdu(chan, skb, control) == -EMSGSIZE) 383584084a31SMat Martineau l2cap_send_disconn_req(chan->conn, chan, ECONNRESET); 38360a708f8fSGustavo F. Padovan 38370a708f8fSGustavo F. Padovan goto done; 38380a708f8fSGustavo F. Padovan 38390a708f8fSGustavo F. Padovan default: 38400c1bc5c6SGustavo F. Padovan BT_DBG("chan %p: bad mode 0x%2.2x", chan, chan->mode); 38410a708f8fSGustavo F. Padovan break; 38420a708f8fSGustavo F. Padovan } 38430a708f8fSGustavo F. Padovan 38440a708f8fSGustavo F. Padovan drop: 38450a708f8fSGustavo F. Padovan kfree_skb(skb); 38460a708f8fSGustavo F. Padovan 38470a708f8fSGustavo F. Padovan done: 38480a708f8fSGustavo F. Padovan if (sk) 38490a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 38500a708f8fSGustavo F. Padovan 38510a708f8fSGustavo F. Padovan return 0; 38520a708f8fSGustavo F. Padovan } 38530a708f8fSGustavo F. Padovan 38540a708f8fSGustavo F. Padovan static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb) 38550a708f8fSGustavo F. Padovan { 38566dcae1eaSDavid S. Miller struct sock *sk = NULL; 385723691d75SGustavo F. Padovan struct l2cap_chan *chan; 38580a708f8fSGustavo F. Padovan 385923691d75SGustavo F. Padovan chan = l2cap_global_chan_by_psm(0, psm, conn->src); 386023691d75SGustavo F. Padovan if (!chan) 38610a708f8fSGustavo F. Padovan goto drop; 38620a708f8fSGustavo F. Padovan 386323691d75SGustavo F. Padovan sk = chan->sk; 386423691d75SGustavo F. Padovan 38650a708f8fSGustavo F. Padovan bh_lock_sock(sk); 38660a708f8fSGustavo F. Padovan 38670a708f8fSGustavo F. Padovan BT_DBG("sk %p, len %d", sk, skb->len); 38680a708f8fSGustavo F. Padovan 386989bc500eSGustavo F. Padovan if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 38700a708f8fSGustavo F. Padovan goto drop; 38710a708f8fSGustavo F. Padovan 3872e13e21dcSVinicius Costa Gomes if (chan->imtu < skb->len) 38730a708f8fSGustavo F. Padovan goto drop; 38740a708f8fSGustavo F. Padovan 387523070494SGustavo F. Padovan if (!chan->ops->recv(chan->data, skb)) 38760a708f8fSGustavo F. Padovan goto done; 38770a708f8fSGustavo F. Padovan 38780a708f8fSGustavo F. Padovan drop: 38790a708f8fSGustavo F. Padovan kfree_skb(skb); 38800a708f8fSGustavo F. Padovan 38810a708f8fSGustavo F. Padovan done: 38820a708f8fSGustavo F. Padovan if (sk) 38830a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 38840a708f8fSGustavo F. Padovan return 0; 38850a708f8fSGustavo F. Padovan } 38860a708f8fSGustavo F. Padovan 38879f69bda6SGustavo F. Padovan static inline int l2cap_att_channel(struct l2cap_conn *conn, __le16 cid, struct sk_buff *skb) 38889f69bda6SGustavo F. Padovan { 38896dcae1eaSDavid S. Miller struct sock *sk = NULL; 389023691d75SGustavo F. Padovan struct l2cap_chan *chan; 38919f69bda6SGustavo F. Padovan 389223691d75SGustavo F. Padovan chan = l2cap_global_chan_by_scid(0, cid, conn->src); 389323691d75SGustavo F. Padovan if (!chan) 38949f69bda6SGustavo F. Padovan goto drop; 38959f69bda6SGustavo F. Padovan 389623691d75SGustavo F. Padovan sk = chan->sk; 389723691d75SGustavo F. Padovan 38989f69bda6SGustavo F. Padovan bh_lock_sock(sk); 38999f69bda6SGustavo F. Padovan 39009f69bda6SGustavo F. Padovan BT_DBG("sk %p, len %d", sk, skb->len); 39019f69bda6SGustavo F. Padovan 390289bc500eSGustavo F. Padovan if (chan->state != BT_BOUND && chan->state != BT_CONNECTED) 39039f69bda6SGustavo F. Padovan goto drop; 39049f69bda6SGustavo F. Padovan 3905e13e21dcSVinicius Costa Gomes if (chan->imtu < skb->len) 39069f69bda6SGustavo F. Padovan goto drop; 39079f69bda6SGustavo F. Padovan 390823070494SGustavo F. Padovan if (!chan->ops->recv(chan->data, skb)) 39099f69bda6SGustavo F. Padovan goto done; 39109f69bda6SGustavo F. Padovan 39119f69bda6SGustavo F. Padovan drop: 39129f69bda6SGustavo F. Padovan kfree_skb(skb); 39139f69bda6SGustavo F. Padovan 39149f69bda6SGustavo F. Padovan done: 39159f69bda6SGustavo F. Padovan if (sk) 39169f69bda6SGustavo F. Padovan bh_unlock_sock(sk); 39179f69bda6SGustavo F. Padovan return 0; 39189f69bda6SGustavo F. Padovan } 39199f69bda6SGustavo F. Padovan 39200a708f8fSGustavo F. Padovan static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb) 39210a708f8fSGustavo F. Padovan { 39220a708f8fSGustavo F. Padovan struct l2cap_hdr *lh = (void *) skb->data; 39230a708f8fSGustavo F. Padovan u16 cid, len; 39240a708f8fSGustavo F. Padovan __le16 psm; 39250a708f8fSGustavo F. Padovan 39260a708f8fSGustavo F. Padovan skb_pull(skb, L2CAP_HDR_SIZE); 39270a708f8fSGustavo F. Padovan cid = __le16_to_cpu(lh->cid); 39280a708f8fSGustavo F. Padovan len = __le16_to_cpu(lh->len); 39290a708f8fSGustavo F. Padovan 39300a708f8fSGustavo F. Padovan if (len != skb->len) { 39310a708f8fSGustavo F. Padovan kfree_skb(skb); 39320a708f8fSGustavo F. Padovan return; 39330a708f8fSGustavo F. Padovan } 39340a708f8fSGustavo F. Padovan 39350a708f8fSGustavo F. Padovan BT_DBG("len %d, cid 0x%4.4x", len, cid); 39360a708f8fSGustavo F. Padovan 39370a708f8fSGustavo F. Padovan switch (cid) { 39383300d9a9SClaudio Takahasi case L2CAP_CID_LE_SIGNALING: 39390a708f8fSGustavo F. Padovan case L2CAP_CID_SIGNALING: 39400a708f8fSGustavo F. Padovan l2cap_sig_channel(conn, skb); 39410a708f8fSGustavo F. Padovan break; 39420a708f8fSGustavo F. Padovan 39430a708f8fSGustavo F. Padovan case L2CAP_CID_CONN_LESS: 39440a708f8fSGustavo F. Padovan psm = get_unaligned_le16(skb->data); 39450a708f8fSGustavo F. Padovan skb_pull(skb, 2); 39460a708f8fSGustavo F. Padovan l2cap_conless_channel(conn, psm, skb); 39470a708f8fSGustavo F. Padovan break; 39480a708f8fSGustavo F. Padovan 39499f69bda6SGustavo F. Padovan case L2CAP_CID_LE_DATA: 39509f69bda6SGustavo F. Padovan l2cap_att_channel(conn, cid, skb); 39519f69bda6SGustavo F. Padovan break; 39529f69bda6SGustavo F. Padovan 3953b501d6a1SAnderson Briglia case L2CAP_CID_SMP: 3954b501d6a1SAnderson Briglia if (smp_sig_channel(conn, skb)) 3955b501d6a1SAnderson Briglia l2cap_conn_del(conn->hcon, EACCES); 3956b501d6a1SAnderson Briglia break; 3957b501d6a1SAnderson Briglia 39580a708f8fSGustavo F. Padovan default: 39590a708f8fSGustavo F. Padovan l2cap_data_channel(conn, cid, skb); 39600a708f8fSGustavo F. Padovan break; 39610a708f8fSGustavo F. Padovan } 39620a708f8fSGustavo F. Padovan } 39630a708f8fSGustavo F. Padovan 39640a708f8fSGustavo F. Padovan /* ---- L2CAP interface with lower layer (HCI) ---- */ 39650a708f8fSGustavo F. Padovan 39660a708f8fSGustavo F. Padovan static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 39670a708f8fSGustavo F. Padovan { 39680a708f8fSGustavo F. Padovan int exact = 0, lm1 = 0, lm2 = 0; 396923691d75SGustavo F. Padovan struct l2cap_chan *c; 39700a708f8fSGustavo F. Padovan 39710a708f8fSGustavo F. Padovan if (type != ACL_LINK) 39720a708f8fSGustavo F. Padovan return -EINVAL; 39730a708f8fSGustavo F. Padovan 39740a708f8fSGustavo F. Padovan BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr)); 39750a708f8fSGustavo F. Padovan 39760a708f8fSGustavo F. Padovan /* Find listening sockets and check their link_mode */ 397723691d75SGustavo F. Padovan read_lock(&chan_list_lock); 397823691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 397923691d75SGustavo F. Padovan struct sock *sk = c->sk; 39804343478fSGustavo F. Padovan 398189bc500eSGustavo F. Padovan if (c->state != BT_LISTEN) 39820a708f8fSGustavo F. Padovan continue; 39830a708f8fSGustavo F. Padovan 39840a708f8fSGustavo F. Padovan if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) { 39850a708f8fSGustavo F. Padovan lm1 |= HCI_LM_ACCEPT; 398643bd0f32SAndrei Emeltchenko if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 39870a708f8fSGustavo F. Padovan lm1 |= HCI_LM_MASTER; 39880a708f8fSGustavo F. Padovan exact++; 39890a708f8fSGustavo F. Padovan } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) { 39900a708f8fSGustavo F. Padovan lm2 |= HCI_LM_ACCEPT; 399143bd0f32SAndrei Emeltchenko if (test_bit(FLAG_ROLE_SWITCH, &c->flags)) 39920a708f8fSGustavo F. Padovan lm2 |= HCI_LM_MASTER; 39930a708f8fSGustavo F. Padovan } 39940a708f8fSGustavo F. Padovan } 399523691d75SGustavo F. Padovan read_unlock(&chan_list_lock); 39960a708f8fSGustavo F. Padovan 39970a708f8fSGustavo F. Padovan return exact ? lm1 : lm2; 39980a708f8fSGustavo F. Padovan } 39990a708f8fSGustavo F. Padovan 40000a708f8fSGustavo F. Padovan static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status) 40010a708f8fSGustavo F. Padovan { 40020a708f8fSGustavo F. Padovan struct l2cap_conn *conn; 40030a708f8fSGustavo F. Padovan 40040a708f8fSGustavo F. Padovan BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status); 40050a708f8fSGustavo F. Padovan 4006acd7d370SVille Tervo if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK)) 40070a708f8fSGustavo F. Padovan return -EINVAL; 40080a708f8fSGustavo F. Padovan 40090a708f8fSGustavo F. Padovan if (!status) { 40100a708f8fSGustavo F. Padovan conn = l2cap_conn_add(hcon, status); 40110a708f8fSGustavo F. Padovan if (conn) 40120a708f8fSGustavo F. Padovan l2cap_conn_ready(conn); 40130a708f8fSGustavo F. Padovan } else 4014e175072fSJoe Perches l2cap_conn_del(hcon, bt_to_errno(status)); 40150a708f8fSGustavo F. Padovan 40160a708f8fSGustavo F. Padovan return 0; 40170a708f8fSGustavo F. Padovan } 40180a708f8fSGustavo F. Padovan 40190a708f8fSGustavo F. Padovan static int l2cap_disconn_ind(struct hci_conn *hcon) 40200a708f8fSGustavo F. Padovan { 40210a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 40220a708f8fSGustavo F. Padovan 40230a708f8fSGustavo F. Padovan BT_DBG("hcon %p", hcon); 40240a708f8fSGustavo F. Padovan 4025b5694506SGustavo F. Padovan if ((hcon->type != ACL_LINK && hcon->type != LE_LINK) || !conn) 40260a708f8fSGustavo F. Padovan return 0x13; 40270a708f8fSGustavo F. Padovan 40280a708f8fSGustavo F. Padovan return conn->disc_reason; 40290a708f8fSGustavo F. Padovan } 40300a708f8fSGustavo F. Padovan 40310a708f8fSGustavo F. Padovan static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason) 40320a708f8fSGustavo F. Padovan { 40330a708f8fSGustavo F. Padovan BT_DBG("hcon %p reason %d", hcon, reason); 40340a708f8fSGustavo F. Padovan 4035acd7d370SVille Tervo if (!(hcon->type == ACL_LINK || hcon->type == LE_LINK)) 40360a708f8fSGustavo F. Padovan return -EINVAL; 40370a708f8fSGustavo F. Padovan 4038e175072fSJoe Perches l2cap_conn_del(hcon, bt_to_errno(reason)); 40390a708f8fSGustavo F. Padovan 40400a708f8fSGustavo F. Padovan return 0; 40410a708f8fSGustavo F. Padovan } 40420a708f8fSGustavo F. Padovan 40434343478fSGustavo F. Padovan static inline void l2cap_check_encryption(struct l2cap_chan *chan, u8 encrypt) 40440a708f8fSGustavo F. Padovan { 4045715ec005SGustavo F. Padovan if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED) 40460a708f8fSGustavo F. Padovan return; 40470a708f8fSGustavo F. Padovan 40480a708f8fSGustavo F. Padovan if (encrypt == 0x00) { 40494343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_MEDIUM) { 4050c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 4051c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ * 5); 40524343478fSGustavo F. Padovan } else if (chan->sec_level == BT_SECURITY_HIGH) 40530f852724SGustavo F. Padovan l2cap_chan_close(chan, ECONNREFUSED); 40540a708f8fSGustavo F. Padovan } else { 40554343478fSGustavo F. Padovan if (chan->sec_level == BT_SECURITY_MEDIUM) 4056c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 40570a708f8fSGustavo F. Padovan } 40580a708f8fSGustavo F. Padovan } 40590a708f8fSGustavo F. Padovan 40600a708f8fSGustavo F. Padovan static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) 40610a708f8fSGustavo F. Padovan { 40620a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 406348454079SGustavo F. Padovan struct l2cap_chan *chan; 40640a708f8fSGustavo F. Padovan 40650a708f8fSGustavo F. Padovan if (!conn) 40660a708f8fSGustavo F. Padovan return 0; 40670a708f8fSGustavo F. Padovan 40680a708f8fSGustavo F. Padovan BT_DBG("conn %p", conn); 40690a708f8fSGustavo F. Padovan 4070160dc6acSVinicius Costa Gomes if (hcon->type == LE_LINK) { 4071160dc6acSVinicius Costa Gomes smp_distribute_keys(conn, 0); 4072160dc6acSVinicius Costa Gomes del_timer(&conn->security_timer); 4073160dc6acSVinicius Costa Gomes } 4074160dc6acSVinicius Costa Gomes 4075baa7e1faSGustavo F. Padovan read_lock(&conn->chan_lock); 40760a708f8fSGustavo F. Padovan 4077baa7e1faSGustavo F. Padovan list_for_each_entry(chan, &conn->chan_l, list) { 407848454079SGustavo F. Padovan struct sock *sk = chan->sk; 4079baa7e1faSGustavo F. Padovan 40800a708f8fSGustavo F. Padovan bh_lock_sock(sk); 40810a708f8fSGustavo F. Padovan 4082f1cb9af5SVinicius Costa Gomes BT_DBG("chan->scid %d", chan->scid); 4083f1cb9af5SVinicius Costa Gomes 4084f1cb9af5SVinicius Costa Gomes if (chan->scid == L2CAP_CID_LE_DATA) { 4085f1cb9af5SVinicius Costa Gomes if (!status && encrypt) { 4086f1cb9af5SVinicius Costa Gomes chan->sec_level = hcon->sec_level; 4087f1cb9af5SVinicius Costa Gomes l2cap_chan_ready(sk); 4088f1cb9af5SVinicius Costa Gomes } 4089f1cb9af5SVinicius Costa Gomes 4090f1cb9af5SVinicius Costa Gomes bh_unlock_sock(sk); 4091f1cb9af5SVinicius Costa Gomes continue; 4092f1cb9af5SVinicius Costa Gomes } 4093f1cb9af5SVinicius Costa Gomes 4094c1360a1cSGustavo F. Padovan if (test_bit(CONF_CONNECT_PEND, &chan->conf_state)) { 40950a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 40960a708f8fSGustavo F. Padovan continue; 40970a708f8fSGustavo F. Padovan } 40980a708f8fSGustavo F. Padovan 409989bc500eSGustavo F. Padovan if (!status && (chan->state == BT_CONNECTED || 410089bc500eSGustavo F. Padovan chan->state == BT_CONFIG)) { 41014343478fSGustavo F. Padovan l2cap_check_encryption(chan, encrypt); 41020a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 41030a708f8fSGustavo F. Padovan continue; 41040a708f8fSGustavo F. Padovan } 41050a708f8fSGustavo F. Padovan 410689bc500eSGustavo F. Padovan if (chan->state == BT_CONNECT) { 41070a708f8fSGustavo F. Padovan if (!status) { 41080a708f8fSGustavo F. Padovan struct l2cap_conn_req req; 4109fe4128e0SGustavo F. Padovan req.scid = cpu_to_le16(chan->scid); 4110fe4128e0SGustavo F. Padovan req.psm = chan->psm; 41110a708f8fSGustavo F. Padovan 4112fc7f8a7eSGustavo F. Padovan chan->ident = l2cap_get_ident(conn); 4113c1360a1cSGustavo F. Padovan set_bit(CONF_CONNECT_PEND, &chan->conf_state); 41140a708f8fSGustavo F. Padovan 4115fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, 41160a708f8fSGustavo F. Padovan L2CAP_CONN_REQ, sizeof(req), &req); 41170a708f8fSGustavo F. Padovan } else { 4118c9b66675SGustavo F. Padovan __clear_chan_timer(chan); 4119c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ / 10); 41200a708f8fSGustavo F. Padovan } 412189bc500eSGustavo F. Padovan } else if (chan->state == BT_CONNECT2) { 41220a708f8fSGustavo F. Padovan struct l2cap_conn_rsp rsp; 4123df3c3931SJohan Hedberg __u16 res, stat; 41240a708f8fSGustavo F. Padovan 41250a708f8fSGustavo F. Padovan if (!status) { 4126df3c3931SJohan Hedberg if (bt_sk(sk)->defer_setup) { 4127df3c3931SJohan Hedberg struct sock *parent = bt_sk(sk)->parent; 4128df3c3931SJohan Hedberg res = L2CAP_CR_PEND; 4129df3c3931SJohan Hedberg stat = L2CAP_CS_AUTHOR_PEND; 413005e9a2f6SIlia Kolomisnky if (parent) 4131df3c3931SJohan Hedberg parent->sk_data_ready(parent, 0); 4132df3c3931SJohan Hedberg } else { 413389bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_CONFIG); 4134df3c3931SJohan Hedberg res = L2CAP_CR_SUCCESS; 4135df3c3931SJohan Hedberg stat = L2CAP_CS_NO_INFO; 4136df3c3931SJohan Hedberg } 41370a708f8fSGustavo F. Padovan } else { 413889bc500eSGustavo F. Padovan l2cap_state_change(chan, BT_DISCONN); 4139c9b66675SGustavo F. Padovan __set_chan_timer(chan, HZ / 10); 4140df3c3931SJohan Hedberg res = L2CAP_CR_SEC_BLOCK; 4141df3c3931SJohan Hedberg stat = L2CAP_CS_NO_INFO; 41420a708f8fSGustavo F. Padovan } 41430a708f8fSGustavo F. Padovan 4144fe4128e0SGustavo F. Padovan rsp.scid = cpu_to_le16(chan->dcid); 4145fe4128e0SGustavo F. Padovan rsp.dcid = cpu_to_le16(chan->scid); 4146df3c3931SJohan Hedberg rsp.result = cpu_to_le16(res); 4147df3c3931SJohan Hedberg rsp.status = cpu_to_le16(stat); 4148fc7f8a7eSGustavo F. Padovan l2cap_send_cmd(conn, chan->ident, L2CAP_CONN_RSP, 4149fc7f8a7eSGustavo F. Padovan sizeof(rsp), &rsp); 41500a708f8fSGustavo F. Padovan } 41510a708f8fSGustavo F. Padovan 41520a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 41530a708f8fSGustavo F. Padovan } 41540a708f8fSGustavo F. Padovan 4155baa7e1faSGustavo F. Padovan read_unlock(&conn->chan_lock); 41560a708f8fSGustavo F. Padovan 41570a708f8fSGustavo F. Padovan return 0; 41580a708f8fSGustavo F. Padovan } 41590a708f8fSGustavo F. Padovan 41600a708f8fSGustavo F. Padovan static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags) 41610a708f8fSGustavo F. Padovan { 41620a708f8fSGustavo F. Padovan struct l2cap_conn *conn = hcon->l2cap_data; 41630a708f8fSGustavo F. Padovan 41640a708f8fSGustavo F. Padovan if (!conn) 41650a708f8fSGustavo F. Padovan conn = l2cap_conn_add(hcon, 0); 41660a708f8fSGustavo F. Padovan 41670a708f8fSGustavo F. Padovan if (!conn) 41680a708f8fSGustavo F. Padovan goto drop; 41690a708f8fSGustavo F. Padovan 41700a708f8fSGustavo F. Padovan BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags); 41710a708f8fSGustavo F. Padovan 41720a708f8fSGustavo F. Padovan if (!(flags & ACL_CONT)) { 41730a708f8fSGustavo F. Padovan struct l2cap_hdr *hdr; 417448454079SGustavo F. Padovan struct l2cap_chan *chan; 41750a708f8fSGustavo F. Padovan u16 cid; 41760a708f8fSGustavo F. Padovan int len; 41770a708f8fSGustavo F. Padovan 41780a708f8fSGustavo F. Padovan if (conn->rx_len) { 41790a708f8fSGustavo F. Padovan BT_ERR("Unexpected start frame (len %d)", skb->len); 41800a708f8fSGustavo F. Padovan kfree_skb(conn->rx_skb); 41810a708f8fSGustavo F. Padovan conn->rx_skb = NULL; 41820a708f8fSGustavo F. Padovan conn->rx_len = 0; 41830a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 41840a708f8fSGustavo F. Padovan } 41850a708f8fSGustavo F. Padovan 41860a708f8fSGustavo F. Padovan /* Start fragment always begin with Basic L2CAP header */ 41870a708f8fSGustavo F. Padovan if (skb->len < L2CAP_HDR_SIZE) { 41880a708f8fSGustavo F. Padovan BT_ERR("Frame is too short (len %d)", skb->len); 41890a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 41900a708f8fSGustavo F. Padovan goto drop; 41910a708f8fSGustavo F. Padovan } 41920a708f8fSGustavo F. Padovan 41930a708f8fSGustavo F. Padovan hdr = (struct l2cap_hdr *) skb->data; 41940a708f8fSGustavo F. Padovan len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE; 41950a708f8fSGustavo F. Padovan cid = __le16_to_cpu(hdr->cid); 41960a708f8fSGustavo F. Padovan 41970a708f8fSGustavo F. Padovan if (len == skb->len) { 41980a708f8fSGustavo F. Padovan /* Complete frame received */ 41990a708f8fSGustavo F. Padovan l2cap_recv_frame(conn, skb); 42000a708f8fSGustavo F. Padovan return 0; 42010a708f8fSGustavo F. Padovan } 42020a708f8fSGustavo F. Padovan 42030a708f8fSGustavo F. Padovan BT_DBG("Start: total len %d, frag len %d", len, skb->len); 42040a708f8fSGustavo F. Padovan 42050a708f8fSGustavo F. Padovan if (skb->len > len) { 42060a708f8fSGustavo F. Padovan BT_ERR("Frame is too long (len %d, expected len %d)", 42070a708f8fSGustavo F. Padovan skb->len, len); 42080a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 42090a708f8fSGustavo F. Padovan goto drop; 42100a708f8fSGustavo F. Padovan } 42110a708f8fSGustavo F. Padovan 4212baa7e1faSGustavo F. Padovan chan = l2cap_get_chan_by_scid(conn, cid); 42130a708f8fSGustavo F. Padovan 421448454079SGustavo F. Padovan if (chan && chan->sk) { 421548454079SGustavo F. Padovan struct sock *sk = chan->sk; 421648454079SGustavo F. Padovan 42170c1bc5c6SGustavo F. Padovan if (chan->imtu < len - L2CAP_HDR_SIZE) { 421848454079SGustavo F. Padovan BT_ERR("Frame exceeding recv MTU (len %d, " 421948454079SGustavo F. Padovan "MTU %d)", len, 42200c1bc5c6SGustavo F. Padovan chan->imtu); 42210a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 42220a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 42230a708f8fSGustavo F. Padovan goto drop; 42240a708f8fSGustavo F. Padovan } 42250a708f8fSGustavo F. Padovan bh_unlock_sock(sk); 422648454079SGustavo F. Padovan } 42270a708f8fSGustavo F. Padovan 42280a708f8fSGustavo F. Padovan /* Allocate skb for the complete frame (with header) */ 42290a708f8fSGustavo F. Padovan conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC); 42300a708f8fSGustavo F. Padovan if (!conn->rx_skb) 42310a708f8fSGustavo F. Padovan goto drop; 42320a708f8fSGustavo F. Padovan 42330a708f8fSGustavo F. Padovan skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), 42340a708f8fSGustavo F. Padovan skb->len); 42350a708f8fSGustavo F. Padovan conn->rx_len = len - skb->len; 42360a708f8fSGustavo F. Padovan } else { 42370a708f8fSGustavo F. Padovan BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len); 42380a708f8fSGustavo F. Padovan 42390a708f8fSGustavo F. Padovan if (!conn->rx_len) { 42400a708f8fSGustavo F. Padovan BT_ERR("Unexpected continuation frame (len %d)", skb->len); 42410a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 42420a708f8fSGustavo F. Padovan goto drop; 42430a708f8fSGustavo F. Padovan } 42440a708f8fSGustavo F. Padovan 42450a708f8fSGustavo F. Padovan if (skb->len > conn->rx_len) { 42460a708f8fSGustavo F. Padovan BT_ERR("Fragment is too long (len %d, expected %d)", 42470a708f8fSGustavo F. Padovan skb->len, conn->rx_len); 42480a708f8fSGustavo F. Padovan kfree_skb(conn->rx_skb); 42490a708f8fSGustavo F. Padovan conn->rx_skb = NULL; 42500a708f8fSGustavo F. Padovan conn->rx_len = 0; 42510a708f8fSGustavo F. Padovan l2cap_conn_unreliable(conn, ECOMM); 42520a708f8fSGustavo F. Padovan goto drop; 42530a708f8fSGustavo F. Padovan } 42540a708f8fSGustavo F. Padovan 42550a708f8fSGustavo F. Padovan skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len), 42560a708f8fSGustavo F. Padovan skb->len); 42570a708f8fSGustavo F. Padovan conn->rx_len -= skb->len; 42580a708f8fSGustavo F. Padovan 42590a708f8fSGustavo F. Padovan if (!conn->rx_len) { 42600a708f8fSGustavo F. Padovan /* Complete frame received */ 42610a708f8fSGustavo F. Padovan l2cap_recv_frame(conn, conn->rx_skb); 42620a708f8fSGustavo F. Padovan conn->rx_skb = NULL; 42630a708f8fSGustavo F. Padovan } 42640a708f8fSGustavo F. Padovan } 42650a708f8fSGustavo F. Padovan 42660a708f8fSGustavo F. Padovan drop: 42670a708f8fSGustavo F. Padovan kfree_skb(skb); 42680a708f8fSGustavo F. Padovan return 0; 42690a708f8fSGustavo F. Padovan } 42700a708f8fSGustavo F. Padovan 42710a708f8fSGustavo F. Padovan static int l2cap_debugfs_show(struct seq_file *f, void *p) 42720a708f8fSGustavo F. Padovan { 427323691d75SGustavo F. Padovan struct l2cap_chan *c; 42740a708f8fSGustavo F. Padovan 427523691d75SGustavo F. Padovan read_lock_bh(&chan_list_lock); 42760a708f8fSGustavo F. Padovan 427723691d75SGustavo F. Padovan list_for_each_entry(c, &chan_list, global_l) { 427823691d75SGustavo F. Padovan struct sock *sk = c->sk; 42790a708f8fSGustavo F. Padovan 4280903d343eSGustavo F. Padovan seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d %d\n", 42810a708f8fSGustavo F. Padovan batostr(&bt_sk(sk)->src), 42820a708f8fSGustavo F. Padovan batostr(&bt_sk(sk)->dst), 428389bc500eSGustavo F. Padovan c->state, __le16_to_cpu(c->psm), 428423691d75SGustavo F. Padovan c->scid, c->dcid, c->imtu, c->omtu, 428523691d75SGustavo F. Padovan c->sec_level, c->mode); 42860a708f8fSGustavo F. Padovan } 42870a708f8fSGustavo F. Padovan 428823691d75SGustavo F. Padovan read_unlock_bh(&chan_list_lock); 42890a708f8fSGustavo F. Padovan 42900a708f8fSGustavo F. Padovan return 0; 42910a708f8fSGustavo F. Padovan } 42920a708f8fSGustavo F. Padovan 42930a708f8fSGustavo F. Padovan static int l2cap_debugfs_open(struct inode *inode, struct file *file) 42940a708f8fSGustavo F. Padovan { 42950a708f8fSGustavo F. Padovan return single_open(file, l2cap_debugfs_show, inode->i_private); 42960a708f8fSGustavo F. Padovan } 42970a708f8fSGustavo F. Padovan 42980a708f8fSGustavo F. Padovan static const struct file_operations l2cap_debugfs_fops = { 42990a708f8fSGustavo F. Padovan .open = l2cap_debugfs_open, 43000a708f8fSGustavo F. Padovan .read = seq_read, 43010a708f8fSGustavo F. Padovan .llseek = seq_lseek, 43020a708f8fSGustavo F. Padovan .release = single_release, 43030a708f8fSGustavo F. Padovan }; 43040a708f8fSGustavo F. Padovan 43050a708f8fSGustavo F. Padovan static struct dentry *l2cap_debugfs; 43060a708f8fSGustavo F. Padovan 43070a708f8fSGustavo F. Padovan static struct hci_proto l2cap_hci_proto = { 43080a708f8fSGustavo F. Padovan .name = "L2CAP", 43090a708f8fSGustavo F. Padovan .id = HCI_PROTO_L2CAP, 43100a708f8fSGustavo F. Padovan .connect_ind = l2cap_connect_ind, 43110a708f8fSGustavo F. Padovan .connect_cfm = l2cap_connect_cfm, 43120a708f8fSGustavo F. Padovan .disconn_ind = l2cap_disconn_ind, 43130a708f8fSGustavo F. Padovan .disconn_cfm = l2cap_disconn_cfm, 43140a708f8fSGustavo F. Padovan .security_cfm = l2cap_security_cfm, 43150a708f8fSGustavo F. Padovan .recv_acldata = l2cap_recv_acldata 43160a708f8fSGustavo F. Padovan }; 43170a708f8fSGustavo F. Padovan 431864274518SGustavo F. Padovan int __init l2cap_init(void) 43190a708f8fSGustavo F. Padovan { 43200a708f8fSGustavo F. Padovan int err; 43210a708f8fSGustavo F. Padovan 4322bb58f747SGustavo F. Padovan err = l2cap_init_sockets(); 43230a708f8fSGustavo F. Padovan if (err < 0) 43240a708f8fSGustavo F. Padovan return err; 43250a708f8fSGustavo F. Padovan 43260a708f8fSGustavo F. Padovan err = hci_register_proto(&l2cap_hci_proto); 43270a708f8fSGustavo F. Padovan if (err < 0) { 43280a708f8fSGustavo F. Padovan BT_ERR("L2CAP protocol registration failed"); 43290a708f8fSGustavo F. Padovan bt_sock_unregister(BTPROTO_L2CAP); 43300a708f8fSGustavo F. Padovan goto error; 43310a708f8fSGustavo F. Padovan } 43320a708f8fSGustavo F. Padovan 43330a708f8fSGustavo F. Padovan if (bt_debugfs) { 43340a708f8fSGustavo F. Padovan l2cap_debugfs = debugfs_create_file("l2cap", 0444, 43350a708f8fSGustavo F. Padovan bt_debugfs, NULL, &l2cap_debugfs_fops); 43360a708f8fSGustavo F. Padovan if (!l2cap_debugfs) 43370a708f8fSGustavo F. Padovan BT_ERR("Failed to create L2CAP debug file"); 43380a708f8fSGustavo F. Padovan } 43390a708f8fSGustavo F. Padovan 43400a708f8fSGustavo F. Padovan return 0; 43410a708f8fSGustavo F. Padovan 43420a708f8fSGustavo F. Padovan error: 4343bb58f747SGustavo F. Padovan l2cap_cleanup_sockets(); 43440a708f8fSGustavo F. Padovan return err; 43450a708f8fSGustavo F. Padovan } 43460a708f8fSGustavo F. Padovan 434764274518SGustavo F. Padovan void l2cap_exit(void) 43480a708f8fSGustavo F. Padovan { 43490a708f8fSGustavo F. Padovan debugfs_remove(l2cap_debugfs); 43500a708f8fSGustavo F. Padovan 43510a708f8fSGustavo F. Padovan if (hci_unregister_proto(&l2cap_hci_proto) < 0) 43520a708f8fSGustavo F. Padovan BT_ERR("L2CAP protocol unregistration failed"); 43530a708f8fSGustavo F. Padovan 4354bb58f747SGustavo F. Padovan l2cap_cleanup_sockets(); 43550a708f8fSGustavo F. Padovan } 43560a708f8fSGustavo F. Padovan 43570a708f8fSGustavo F. Padovan module_param(disable_ertm, bool, 0644); 43580a708f8fSGustavo F. Padovan MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode"); 4359a5fd6f30SAndrei Emeltchenko 4360a5fd6f30SAndrei Emeltchenko module_param(enable_hs, bool, 0644); 4361a5fd6f30SAndrei Emeltchenko MODULE_PARM_DESC(enable_hs, "Enable High Speed"); 4362