]> bbs.cooldavid.org Git - net-next-2.6.git/blame - net/bluetooth/l2cap.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix SDU reassembly under SREJ
[net-next-2.6.git] / net / bluetooth / l2cap.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth L2CAP core and sockets. */
26
1da177e4
LT		 27#include <linux/module.h>
28
29#include <linux/types.h>
4fc268d2 30#include <linux/capability.h>
1da177e4
LT		 31#include <linux/errno.h>
32#include <linux/kernel.h>
1da177e4
LT		 33#include <linux/sched.h>
34#include <linux/slab.h>
35#include <linux/poll.h>
36#include <linux/fcntl.h>
37#include <linux/init.h>
38#include <linux/interrupt.h>
39#include <linux/socket.h>
40#include <linux/skbuff.h>
1da177e4 41#include <linux/list.h>
be9d1227 42#include <linux/device.h>
aef7d97c
MH		 43#include <linux/debugfs.h>
44#include <linux/seq_file.h>
af05b30b 45#include <linux/uaccess.h>
fcc203c3 46#include <linux/crc16.h>
1da177e4
LT		 47#include <net/sock.h>
48
49#include <asm/system.h>
1da177e4
LT		 50#include <asm/unaligned.h>
51
52#include <net/bluetooth/bluetooth.h>
53#include <net/bluetooth/hci_core.h>
54#include <net/bluetooth/l2cap.h>
55
44dd46de
MH		 56#define VERSION "2.14"
57
84fb0a63
GP		 58#ifdef CONFIG_BT_L2CAP_EXT_FEATURES
59static int enable_ertm = 1;
60#else
44dd46de 61static int enable_ertm = 0;
84fb0a63 62#endif
5fbcd3d1 63static int max_transmit = L2CAP_DEFAULT_MAX_TX;
369ba302 64static int tx_window = L2CAP_DEFAULT_TX_WINDOW;
f0709e03 65
47ec1dcd 66static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
e1027a7c 67static u8 l2cap_fixed_chan[8] = { 0x02, };
1da177e4 68
90ddc4f0 69static const struct proto_ops l2cap_sock_ops;
1da177e4
LT		 70
71static struct bt_sock_list l2cap_sk_list = {
d5fb2962 72 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
1da177e4
LT		 73};
74
1da177e4
LT		 75static void __l2cap_sock_close(struct sock *sk, int reason);
76static void l2cap_sock_close(struct sock *sk);
77static void l2cap_sock_kill(struct sock *sk);
78
79static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
80 u8 code, u8 ident, u16 dlen, void *data);
81
82/* ---- L2CAP timers ---- */
83static void l2cap_sock_timeout(unsigned long arg)
84{
85 struct sock *sk = (struct sock *) arg;
b1235d79 86 int reason;
1da177e4
LT		 87
88 BT_DBG("sock %p state %d", sk, sk->sk_state);
89
90 bh_lock_sock(sk);
b1235d79 91
f62e4323
MH		 92 if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
93 reason = ECONNREFUSED;
94 else if (sk->sk_state == BT_CONNECT &&
2af6b9d5 95 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
b1235d79
MH		 96 reason = ECONNREFUSED;
97 else
98 reason = ETIMEDOUT;
99
100 __l2cap_sock_close(sk, reason);
101
1da177e4
LT		 102 bh_unlock_sock(sk);
103
104 l2cap_sock_kill(sk);
105 sock_put(sk);
106}
107
108static void l2cap_sock_set_timer(struct sock *sk, long timeout)
109{
110 BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
111 sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
112}
113
114static void l2cap_sock_clear_timer(struct sock *sk)
115{
116 BT_DBG("sock %p state %d", sk, sk->sk_state);
117 sk_stop_timer(sk, &sk->sk_timer);
118}
119
0139418c
MH		 120/* ---- L2CAP channels ---- */
121static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
122{
123 struct sock *s;
124 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
125 if (l2cap_pi(s)->dcid == cid)
126 break;
127 }
128 return s;
129}
130
131static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
132{
133 struct sock *s;
134 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
135 if (l2cap_pi(s)->scid == cid)
136 break;
137 }
138 return s;
139}
140
141/* Find channel with given SCID.
142 * Returns locked socket */
143static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
144{
145 struct sock *s;
146 read_lock(&l->lock);
147 s = __l2cap_get_chan_by_scid(l, cid);
af05b30b
GP		 148 if (s)
149 bh_lock_sock(s);
0139418c
MH		 150 read_unlock(&l->lock);
151 return s;
152}
153
154static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
155{
156 struct sock *s;
157 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
158 if (l2cap_pi(s)->ident == ident)
159 break;
160 }
161 return s;
162}
163
164static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
165{
166 struct sock *s;
167 read_lock(&l->lock);
168 s = __l2cap_get_chan_by_ident(l, ident);
af05b30b
GP		 169 if (s)
170 bh_lock_sock(s);
0139418c
MH		 171 read_unlock(&l->lock);
172 return s;
173}
174
175static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
176{
8db4dc46 177 u16 cid = L2CAP_CID_DYN_START;
0139418c 178
8db4dc46 179 for (; cid < L2CAP_CID_DYN_END; cid++) {
af05b30b 180 if (!__l2cap_get_chan_by_scid(l, cid))
0139418c
MH		 181 return cid;
182 }
183
184 return 0;
185}
186
187static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
188{
189 sock_hold(sk);
190
191 if (l->head)
192 l2cap_pi(l->head)->prev_c = sk;
193
194 l2cap_pi(sk)->next_c = l->head;
195 l2cap_pi(sk)->prev_c = NULL;
196 l->head = sk;
197}
198
199static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
200{
201 struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
202
fd1278d7 203 write_lock_bh(&l->lock);
0139418c
MH		 204 if (sk == l->head)
205 l->head = next;
206
207 if (next)
208 l2cap_pi(next)->prev_c = prev;
209 if (prev)
210 l2cap_pi(prev)->next_c = next;
fd1278d7 211 write_unlock_bh(&l->lock);
0139418c
MH		 212
213 __sock_put(sk);
214}
215
216static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
217{
218 struct l2cap_chan_list *l = &conn->chan_list;
219
af05b30b
GP		 220 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
221 l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
0139418c 222
2950f21a
MH		 223 conn->disc_reason = 0x13;
224
0139418c
MH		 225 l2cap_pi(sk)->conn = conn;
226
bd3c9e25 227 if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
0139418c
MH		 228 /* Alloc CID for connection-oriented socket */
229 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
230 } else if (sk->sk_type == SOCK_DGRAM) {
231 /* Connectionless socket */
8db4dc46
GP		 232 l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
233 l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
0139418c
MH		 234 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
235 } else {
236 /* Raw socket can send/recv signalling messages only */
8db4dc46
GP		 237 l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
238 l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
0139418c
MH		 239 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
240 }
241
242 __l2cap_chan_link(l, sk);
243
244 if (parent)
245 bt_accept_enqueue(parent, sk);
246}
247
8e87d142 248/* Delete channel.
0139418c
MH		 249 * Must be called on the locked socket. */
250static void l2cap_chan_del(struct sock *sk, int err)
251{
252 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
253 struct sock *parent = bt_sk(sk)->parent;
254
255 l2cap_sock_clear_timer(sk);
256
257 BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
258
8e87d142 259 if (conn) {
0139418c
MH		 260 /* Unlink from channel list */
261 l2cap_chan_unlink(&conn->chan_list, sk);
262 l2cap_pi(sk)->conn = NULL;
263 hci_conn_put(conn->hcon);
264 }
265
b1235d79 266 sk->sk_state = BT_CLOSED;
0139418c
MH		 267 sock_set_flag(sk, SOCK_ZAPPED);
268
269 if (err)
270 sk->sk_err = err;
271
272 if (parent) {
273 bt_accept_unlink(sk);
274 parent->sk_data_ready(parent, 0);
275 } else
276 sk->sk_state_change(sk);
277}
278
79d554a6 279/* Service level security */
2af6b9d5 280static inline int l2cap_check_security(struct sock *sk)
79d554a6
MH		 281{
282 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
0684e5f9
MH		 283 __u8 auth_type;
284
00ae4af9
MH		 285 if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
286 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
287 auth_type = HCI_AT_NO_BONDING_MITM;
288 else
af05b30b 289 auth_type = HCI_AT_NO_BONDING;
00ae4af9
MH		 290
291 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
292 l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
293 } else {
294 switch (l2cap_pi(sk)->sec_level) {
295 case BT_SECURITY_HIGH:
296 auth_type = HCI_AT_GENERAL_BONDING_MITM;
297 break;
298 case BT_SECURITY_MEDIUM:
299 auth_type = HCI_AT_GENERAL_BONDING;
300 break;
301 default:
302 auth_type = HCI_AT_NO_BONDING;
303 break;
304 }
0684e5f9 305 }
79d554a6 306
0684e5f9
MH		 307 return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
308 auth_type);
79d554a6
MH		 309}
310
4e8402a3
MH		 311static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
312{
313 u8 id;
314
315 /* Get next available identificator.
316 * 1 - 128 are used by kernel.
317 * 129 - 199 are reserved.
318 * 200 - 254 are used by utilities like l2ping, etc.
319 */
320
321 spin_lock_bh(&conn->lock);
322
323 if (++conn->tx_ident > 128)
324 conn->tx_ident = 1;
325
326 id = conn->tx_ident;
327
328 spin_unlock_bh(&conn->lock);
329
330 return id;
331}
332
333static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
334{
335 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
336
337 BT_DBG("code 0x%2.2x", code);
338
339 if (!skb)
340 return -ENOMEM;
341
342 return hci_send_acl(conn->hcon, skb, 0);
343}
344
1c2acffb
GP		 345static inline int l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
346{
347 struct sk_buff *skb;
348 struct l2cap_hdr *lh;
349 struct l2cap_conn *conn = pi->conn;
fcc203c3
GP		 350 int count, hlen = L2CAP_HDR_SIZE + 2;
351
352 if (pi->fcs == L2CAP_FCS_CRC16)
353 hlen += 2;
1c2acffb
GP		 354
355 BT_DBG("pi %p, control 0x%2.2x", pi, control);
356
fcc203c3 357 count = min_t(unsigned int, conn->mtu, hlen);
1c2acffb
GP		 358 control |= L2CAP_CTRL_FRAME_TYPE;
359
9e917af1
GP		 360 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
361 control |= L2CAP_CTRL_FINAL;
362 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
363 }
364
f0946ccf
GP		 365 if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
366 control |= L2CAP_CTRL_POLL;
367 pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
368 }
369
1c2acffb
GP		 370 skb = bt_skb_alloc(count, GFP_ATOMIC);
371 if (!skb)
372 return -ENOMEM;
373
374 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fcc203c3 375 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1c2acffb
GP		 376 lh->cid = cpu_to_le16(pi->dcid);
377 put_unaligned_le16(control, skb_put(skb, 2));
378
fcc203c3
GP		 379 if (pi->fcs == L2CAP_FCS_CRC16) {
380 u16 fcs = crc16(0, (u8 *)lh, count - 2);
381 put_unaligned_le16(fcs, skb_put(skb, 2));
382 }
383
1c2acffb
GP		 384 return hci_send_acl(pi->conn->hcon, skb, 0);
385}
386
7e743090
GP		 387static inline int l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
388{
389 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY)
390 control |= L2CAP_SUPER_RCV_NOT_READY;
391 else
392 control |= L2CAP_SUPER_RCV_READY;
393
2ab25cdd
GP		 394 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
395
7e743090
GP		 396 return l2cap_send_sframe(pi, control);
397}
398
79d554a6
MH		 399static void l2cap_do_start(struct sock *sk)
400{
401 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
402
403 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 404 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
405 return;
406
2af6b9d5 407 if (l2cap_check_security(sk)) {
b1235d79
MH		 408 struct l2cap_conn_req req;
409 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
410 req.psm = l2cap_pi(sk)->psm;
79d554a6 411
b1235d79 412 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
79d554a6 413
b1235d79 414 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
79d554a6 415 L2CAP_CONN_REQ, sizeof(req), &req);
b1235d79 416 }
79d554a6
MH		 417 } else {
418 struct l2cap_info_req req;
419 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
420
421 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
422 conn->info_ident = l2cap_get_ident(conn);
423
424 mod_timer(&conn->info_timer, jiffies +
425 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
426
427 l2cap_send_cmd(conn, conn->info_ident,
428 L2CAP_INFO_REQ, sizeof(req), &req);
429 }
430}
431
22121fc9
GP		 432static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk)
433{
434 struct l2cap_disconn_req req;
435
436 req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
437 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
438 l2cap_send_cmd(conn, l2cap_get_ident(conn),
439 L2CAP_DISCONN_REQ, sizeof(req), &req);
440}
441
1da177e4 442/* ---- L2CAP connections ---- */
4e8402a3
MH		 443static void l2cap_conn_start(struct l2cap_conn *conn)
444{
445 struct l2cap_chan_list *l = &conn->chan_list;
446 struct sock *sk;
447
448 BT_DBG("conn %p", conn);
449
450 read_lock(&l->lock);
451
452 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
453 bh_lock_sock(sk);
454
bd3c9e25
GP		 455 if (sk->sk_type != SOCK_SEQPACKET &&
456 sk->sk_type != SOCK_STREAM) {
79d554a6
MH		 457 bh_unlock_sock(sk);
458 continue;
459 }
460
461 if (sk->sk_state == BT_CONNECT) {
2af6b9d5 462 if (l2cap_check_security(sk)) {
b1235d79
MH		 463 struct l2cap_conn_req req;
464 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
465 req.psm = l2cap_pi(sk)->psm;
79d554a6 466
b1235d79 467 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
79d554a6 468
b1235d79 469 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
4e8402a3 470 L2CAP_CONN_REQ, sizeof(req), &req);
b1235d79 471 }
79d554a6
MH		 472 } else if (sk->sk_state == BT_CONNECT2) {
473 struct l2cap_conn_rsp rsp;
474 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
475 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
476
2af6b9d5 477 if (l2cap_check_security(sk)) {
f66dc81f
MH		 478 if (bt_sk(sk)->defer_setup) {
479 struct sock *parent = bt_sk(sk)->parent;
480 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
481 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
482 parent->sk_data_ready(parent, 0);
483
484 } else {
485 sk->sk_state = BT_CONFIG;
486 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
487 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
488 }
79d554a6
MH		 489 } else {
490 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
491 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
492 }
493
494 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
495 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
4e8402a3
MH		 496 }
497
498 bh_unlock_sock(sk);
499 }
500
501 read_unlock(&l->lock);
502}
503
504static void l2cap_conn_ready(struct l2cap_conn *conn)
505{
79d554a6
MH		 506 struct l2cap_chan_list *l = &conn->chan_list;
507 struct sock *sk;
4e8402a3 508
79d554a6 509 BT_DBG("conn %p", conn);
4e8402a3 510
79d554a6 511 read_lock(&l->lock);
4e8402a3 512
79d554a6
MH		 513 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
514 bh_lock_sock(sk);
4e8402a3 515
bd3c9e25
GP		 516 if (sk->sk_type != SOCK_SEQPACKET &&
517 sk->sk_type != SOCK_STREAM) {
79d554a6
MH		 518 l2cap_sock_clear_timer(sk);
519 sk->sk_state = BT_CONNECTED;
520 sk->sk_state_change(sk);
521 } else if (sk->sk_state == BT_CONNECT)
522 l2cap_do_start(sk);
4e8402a3 523
79d554a6 524 bh_unlock_sock(sk);
4e8402a3 525 }
79d554a6
MH		 526
527 read_unlock(&l->lock);
4e8402a3
MH		 528}
529
530/* Notify sockets that we cannot guaranty reliability anymore */
531static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
532{
533 struct l2cap_chan_list *l = &conn->chan_list;
534 struct sock *sk;
535
536 BT_DBG("conn %p", conn);
537
538 read_lock(&l->lock);
539
540 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2af6b9d5 541 if (l2cap_pi(sk)->force_reliable)
4e8402a3
MH		 542 sk->sk_err = err;
543 }
544
545 read_unlock(&l->lock);
546}
547
548static void l2cap_info_timeout(unsigned long arg)
549{
550 struct l2cap_conn *conn = (void *) arg;
551
984947dc 552 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 553 conn->info_ident = 0;
984947dc 554
4e8402a3
MH		 555 l2cap_conn_start(conn);
556}
557
1da177e4
LT		 558static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
559{
0139418c 560 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4 561
0139418c 562 if (conn || status)
1da177e4
LT		 563 return conn;
564
0139418c
MH		 565 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
566 if (!conn)
1da177e4 567 return NULL;
1da177e4
LT		 568
569 hcon->l2cap_data = conn;
570 conn->hcon = hcon;
571
0139418c
MH		 572 BT_DBG("hcon %p conn %p", hcon, conn);
573
1da177e4
LT		 574 conn->mtu = hcon->hdev->acl_mtu;
575 conn->src = &hcon->hdev->bdaddr;
576 conn->dst = &hcon->dst;
577
4e8402a3
MH		 578 conn->feat_mask = 0;
579
1da177e4
LT		 580 spin_lock_init(&conn->lock);
581 rwlock_init(&conn->chan_list.lock);
582
45054dc1
DY		 583 setup_timer(&conn->info_timer, l2cap_info_timeout,
584 (unsigned long) conn);
585
2950f21a
MH		 586 conn->disc_reason = 0x13;
587
1da177e4
LT		 588 return conn;
589}
590
0139418c 591static void l2cap_conn_del(struct hci_conn *hcon, int err)
1da177e4 592{
0139418c 593 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4
LT		 594 struct sock *sk;
595
0139418c
MH		 596 if (!conn)
597 return;
1da177e4
LT		 598
599 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
600
7585b97a 601 kfree_skb(conn->rx_skb);
1da177e4
LT		 602
603 /* Kill channels */
604 while ((sk = conn->chan_list.head)) {
605 bh_lock_sock(sk);
606 l2cap_chan_del(sk, err);
607 bh_unlock_sock(sk);
608 l2cap_sock_kill(sk);
609 }
610
8e8440f5
DY		 611 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
612 del_timer_sync(&conn->info_timer);
3ab22731 613
1da177e4
LT		 614 hcon->l2cap_data = NULL;
615 kfree(conn);
1da177e4
LT		 616}
617
618static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
619{
620 struct l2cap_chan_list *l = &conn->chan_list;
fd1278d7 621 write_lock_bh(&l->lock);
1da177e4 622 __l2cap_chan_add(conn, sk, parent);
fd1278d7 623 write_unlock_bh(&l->lock);
1da177e4
LT		 624}
625
1da177e4 626/* ---- Socket interface ---- */
8e036fc3 627static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
1da177e4
LT		 628{
629 struct sock *sk;
630 struct hlist_node *node;
631 sk_for_each(sk, node, &l2cap_sk_list.head)
632 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
633 goto found;
634 sk = NULL;
635found:
636 return sk;
637}
638
639/* Find socket with psm and source bdaddr.
640 * Returns closest match.
641 */
8e036fc3 642static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4
LT		 643{
644 struct sock *sk = NULL, *sk1 = NULL;
645 struct hlist_node *node;
646
647 sk_for_each(sk, node, &l2cap_sk_list.head) {
648 if (state && sk->sk_state != state)
649 continue;
650
651 if (l2cap_pi(sk)->psm == psm) {
652 /* Exact match. */
653 if (!bacmp(&bt_sk(sk)->src, src))
654 break;
655
656 /* Closest match */
657 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
658 sk1 = sk;
659 }
660 }
661 return node ? sk : sk1;
662}
663
664/* Find socket with given address (psm, src).
665 * Returns locked socket */
8e036fc3 666static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4
LT		 667{
668 struct sock *s;
669 read_lock(&l2cap_sk_list.lock);
670 s = __l2cap_get_sock_by_psm(state, psm, src);
af05b30b
GP		 671 if (s)
672 bh_lock_sock(s);
1da177e4
LT		 673 read_unlock(&l2cap_sk_list.lock);
674 return s;
675}
676
677static void l2cap_sock_destruct(struct sock *sk)
678{
679 BT_DBG("sk %p", sk);
680
681 skb_queue_purge(&sk->sk_receive_queue);
682 skb_queue_purge(&sk->sk_write_queue);
683}
684
685static void l2cap_sock_cleanup_listen(struct sock *parent)
686{
687 struct sock *sk;
688
689 BT_DBG("parent %p", parent);
690
691 /* Close not yet accepted channels */
692 while ((sk = bt_accept_dequeue(parent, NULL)))
693 l2cap_sock_close(sk);
694
b1235d79 695 parent->sk_state = BT_CLOSED;
1da177e4
LT		 696 sock_set_flag(parent, SOCK_ZAPPED);
697}
698
699/* Kill socket (only if zapped and orphan)
700 * Must be called on unlocked socket.
701 */
702static void l2cap_sock_kill(struct sock *sk)
703{
704 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
705 return;
706
707 BT_DBG("sk %p state %d", sk, sk->sk_state);
708
709 /* Kill poor orphan */
710 bt_sock_unlink(&l2cap_sk_list, sk);
711 sock_set_flag(sk, SOCK_DEAD);
712 sock_put(sk);
713}
714
715static void __l2cap_sock_close(struct sock *sk, int reason)
716{
717 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
718
719 switch (sk->sk_state) {
720 case BT_LISTEN:
721 l2cap_sock_cleanup_listen(sk);
722 break;
723
724 case BT_CONNECTED:
725 case BT_CONFIG:
bd3c9e25
GP		 726 if (sk->sk_type == SOCK_SEQPACKET ||
727 sk->sk_type == SOCK_STREAM) {
1da177e4 728 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1da177e4
LT		 729
730 sk->sk_state = BT_DISCONN;
731 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
22121fc9 732 l2cap_send_disconn_req(conn, sk);
b1235d79 733 } else
1da177e4 734 l2cap_chan_del(sk, reason);
1da177e4
LT		 735 break;
736
f66dc81f 737 case BT_CONNECT2:
bd3c9e25
GP		 738 if (sk->sk_type == SOCK_SEQPACKET ||
739 sk->sk_type == SOCK_STREAM) {
f66dc81f
MH		 740 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
741 struct l2cap_conn_rsp rsp;
742 __u16 result;
743
744 if (bt_sk(sk)->defer_setup)
745 result = L2CAP_CR_SEC_BLOCK;
746 else
747 result = L2CAP_CR_BAD_PSM;
748
749 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
750 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
751 rsp.result = cpu_to_le16(result);
752 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
753 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
754 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
755 } else
756 l2cap_chan_del(sk, reason);
757 break;
758
1da177e4
LT		 759 case BT_CONNECT:
760 case BT_DISCONN:
761 l2cap_chan_del(sk, reason);
762 break;
763
764 default:
765 sock_set_flag(sk, SOCK_ZAPPED);
766 break;
767 }
768}
769
770/* Must be called on unlocked socket. */
771static void l2cap_sock_close(struct sock *sk)
772{
773 l2cap_sock_clear_timer(sk);
774 lock_sock(sk);
775 __l2cap_sock_close(sk, ECONNRESET);
776 release_sock(sk);
777 l2cap_sock_kill(sk);
778}
779
780static void l2cap_sock_init(struct sock *sk, struct sock *parent)
781{
782 struct l2cap_pinfo *pi = l2cap_pi(sk);
783
784 BT_DBG("sk %p", sk);
785
786 if (parent) {
787 sk->sk_type = parent->sk_type;
f66dc81f
MH		 788 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
789
1da177e4
LT		 790 pi->imtu = l2cap_pi(parent)->imtu;
791 pi->omtu = l2cap_pi(parent)->omtu;
c6b03cf9
MH		 792 pi->mode = l2cap_pi(parent)->mode;
793 pi->fcs = l2cap_pi(parent)->fcs;
68d7f0ce 794 pi->max_tx = l2cap_pi(parent)->max_tx;
14b5aa71 795 pi->tx_win = l2cap_pi(parent)->tx_win;
2af6b9d5
MH		 796 pi->sec_level = l2cap_pi(parent)->sec_level;
797 pi->role_switch = l2cap_pi(parent)->role_switch;
798 pi->force_reliable = l2cap_pi(parent)->force_reliable;
1da177e4
LT		 799 } else {
800 pi->imtu = L2CAP_DEFAULT_MTU;
801 pi->omtu = 0;
bd3c9e25
GP		 802 if (enable_ertm && sk->sk_type == SOCK_STREAM)
803 pi->mode = L2CAP_MODE_ERTM;
804 else
805 pi->mode = L2CAP_MODE_BASIC;
68d7f0ce 806 pi->max_tx = max_transmit;
c6b03cf9 807 pi->fcs = L2CAP_FCS_CRC16;
369ba302 808 pi->tx_win = tx_window;
2af6b9d5
MH		 809 pi->sec_level = BT_SECURITY_LOW;
810 pi->role_switch = 0;
811 pi->force_reliable = 0;
1da177e4
LT		 812 }
813
814 /* Default config options */
5dee9e7c 815 pi->conf_len = 0;
1da177e4 816 pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
45054dc1
DY		 817 skb_queue_head_init(TX_QUEUE(sk));
818 skb_queue_head_init(SREJ_QUEUE(sk));
819 INIT_LIST_HEAD(SREJ_LIST(sk));
1da177e4
LT		 820}
821
822static struct proto l2cap_proto = {
823 .name = "L2CAP",
824 .owner = THIS_MODULE,
825 .obj_size = sizeof(struct l2cap_pinfo)
826};
827
1b8d7ae4 828static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
1da177e4
LT		 829{
830 struct sock *sk;
831
6257ff21 832 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1da177e4
LT		 833 if (!sk)
834 return NULL;
835
836 sock_init_data(sock, sk);
837 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
838
839 sk->sk_destruct = l2cap_sock_destruct;
4e8402a3 840 sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
1da177e4
LT		 841
842 sock_reset_flag(sk, SOCK_ZAPPED);
843
844 sk->sk_protocol = proto;
b1235d79 845 sk->sk_state = BT_OPEN;
1da177e4 846
b1235d79 847 setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
1da177e4
LT		 848
849 bt_sock_link(&l2cap_sk_list, sk);
850 return sk;
851}
852
3f378b68
EP		 853static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
854 int kern)
1da177e4
LT		 855{
856 struct sock *sk;
857
858 BT_DBG("sock %p", sock);
859
860 sock->state = SS_UNCONNECTED;
861
bd3c9e25 862 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1da177e4
LT		 863 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
864 return -ESOCKTNOSUPPORT;
865
c84b3268 866 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1da177e4
LT		 867 return -EPERM;
868
869 sock->ops = &l2cap_sock_ops;
870
1b8d7ae4 871 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1da177e4
LT		 872 if (!sk)
873 return -ENOMEM;
874
875 l2cap_sock_init(sk, NULL);
876 return 0;
877}
878
f29972de 879static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
1da177e4 880{
1da177e4 881 struct sock *sk = sock->sk;
f29972de
MH		 882 struct sockaddr_l2 la;
883 int len, err = 0;
1da177e4 884
f29972de 885 BT_DBG("sk %p", sk);
1da177e4
LT		 886
887 if (!addr || addr->sa_family != AF_BLUETOOTH)
888 return -EINVAL;
889
f29972de
MH		 890 memset(&la, 0, sizeof(la));
891 len = min_t(unsigned int, sizeof(la), alen);
892 memcpy(&la, addr, len);
893
2a517ca6
MH		 894 if (la.l2_cid)
895 return -EINVAL;
896
1da177e4
LT		 897 lock_sock(sk);
898
899 if (sk->sk_state != BT_OPEN) {
900 err = -EBADFD;
901 goto done;
902 }
903
b4324b5d 904 if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&
847641d7
MH		 905 !capable(CAP_NET_BIND_SERVICE)) {
906 err = -EACCES;
907 goto done;
908 }
8e87d142 909
1da177e4
LT		 910 write_lock_bh(&l2cap_sk_list.lock);
911
f29972de 912 if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
1da177e4
LT		 913 err = -EADDRINUSE;
914 } else {
915 /* Save source address */
f29972de
MH		 916 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
917 l2cap_pi(sk)->psm = la.l2_psm;
918 l2cap_pi(sk)->sport = la.l2_psm;
1da177e4 919 sk->sk_state = BT_BOUND;
2af6b9d5 920
b4324b5d
MH		 921 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
922 __le16_to_cpu(la.l2_psm) == 0x0003)
2af6b9d5 923 l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
1da177e4
LT		 924 }
925
926 write_unlock_bh(&l2cap_sk_list.lock);
927
928done:
929 release_sock(sk);
930 return err;
931}
932
933static int l2cap_do_connect(struct sock *sk)
934{
935 bdaddr_t *src = &bt_sk(sk)->src;
936 bdaddr_t *dst = &bt_sk(sk)->dst;
937 struct l2cap_conn *conn;
938 struct hci_conn *hcon;
939 struct hci_dev *hdev;
09ab6f4c 940 __u8 auth_type;
44d0e48e 941 int err;
1da177e4 942
f29972de
MH		 943 BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
944 l2cap_pi(sk)->psm);
1da177e4 945
af05b30b
GP		 946 hdev = hci_get_route(dst, src);
947 if (!hdev)
1da177e4
LT		 948 return -EHOSTUNREACH;
949
950 hci_dev_lock_bh(hdev);
951
952 err = -ENOMEM;
953
8c1b2355 954 if (sk->sk_type == SOCK_RAW) {
2af6b9d5
MH		 955 switch (l2cap_pi(sk)->sec_level) {
956 case BT_SECURITY_HIGH:
8c1b2355 957 auth_type = HCI_AT_DEDICATED_BONDING_MITM;
2af6b9d5
MH		 958 break;
959 case BT_SECURITY_MEDIUM:
8c1b2355 960 auth_type = HCI_AT_DEDICATED_BONDING;
2af6b9d5
MH		 961 break;
962 default:
09ab6f4c 963 auth_type = HCI_AT_NO_BONDING;
2af6b9d5
MH		 964 break;
965 }
8c1b2355 966 } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
2af6b9d5 967 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
8c1b2355 968 auth_type = HCI_AT_NO_BONDING_MITM;
09ab6f4c 969 else
8c1b2355 970 auth_type = HCI_AT_NO_BONDING;
435fef20
MH		 971
972 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
973 l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
8c1b2355 974 } else {
2af6b9d5
MH		 975 switch (l2cap_pi(sk)->sec_level) {
976 case BT_SECURITY_HIGH:
8c1b2355 977 auth_type = HCI_AT_GENERAL_BONDING_MITM;
2af6b9d5
MH		 978 break;
979 case BT_SECURITY_MEDIUM:
09ab6f4c 980 auth_type = HCI_AT_GENERAL_BONDING;
2af6b9d5
MH		 981 break;
982 default:
8c1b2355 983 auth_type = HCI_AT_NO_BONDING;
2af6b9d5
MH		 984 break;
985 }
09ab6f4c
MH		 986 }
987
2af6b9d5
MH		 988 hcon = hci_connect(hdev, ACL_LINK, dst,
989 l2cap_pi(sk)->sec_level, auth_type);
1da177e4
LT		 990 if (!hcon)
991 goto done;
992
993 conn = l2cap_conn_add(hcon, 0);
994 if (!conn) {
995 hci_conn_put(hcon);
996 goto done;
997 }
998
999 err = 0;
1000
1001 /* Update source addr of the socket */
1002 bacpy(src, conn->src);
1003
1004 l2cap_chan_add(conn, sk, NULL);
1005
1006 sk->sk_state = BT_CONNECT;
1007 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1008
1009 if (hcon->state == BT_CONNECTED) {
bd3c9e25
GP		 1010 if (sk->sk_type != SOCK_SEQPACKET &&
1011 sk->sk_type != SOCK_STREAM) {
1da177e4
LT		 1012 l2cap_sock_clear_timer(sk);
1013 sk->sk_state = BT_CONNECTED;
79d554a6
MH		 1014 } else
1015 l2cap_do_start(sk);
1da177e4
LT		 1016 }
1017
1018done:
1019 hci_dev_unlock_bh(hdev);
1020 hci_dev_put(hdev);
1021 return err;
1022}
1023
1024static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
1025{
1da177e4 1026 struct sock *sk = sock->sk;
f29972de
MH		 1027 struct sockaddr_l2 la;
1028 int len, err = 0;
1da177e4 1029
1da177e4
LT		 1030 BT_DBG("sk %p", sk);
1031
6503d961
CG		 1032 if (!addr || alen < sizeof(addr->sa_family) ||
1033 addr->sa_family != AF_BLUETOOTH)
2a517ca6 1034 return -EINVAL;
1da177e4 1035
f29972de
MH		 1036 memset(&la, 0, sizeof(la));
1037 len = min_t(unsigned int, sizeof(la), alen);
1038 memcpy(&la, addr, len);
1039
2a517ca6
MH		 1040 if (la.l2_cid)
1041 return -EINVAL;
1042
1043 lock_sock(sk);
1044
bd3c9e25
GP		 1045 if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
1046 && !la.l2_psm) {
1da177e4
LT		 1047 err = -EINVAL;
1048 goto done;
1049 }
1050
c6b03cf9
MH		 1051 switch (l2cap_pi(sk)->mode) {
1052 case L2CAP_MODE_BASIC:
1053 break;
1054 case L2CAP_MODE_ERTM:
f2fcfcd6 1055 case L2CAP_MODE_STREAMING:
c6b03cf9
MH		 1056 if (enable_ertm)
1057 break;
1058 /* fall through */
1059 default:
1060 err = -ENOTSUPP;
1061 goto done;
1062 }
1063
af05b30b 1064 switch (sk->sk_state) {
1da177e4
LT		 1065 case BT_CONNECT:
1066 case BT_CONNECT2:
1067 case BT_CONFIG:
1068 /* Already connecting */
1069 goto wait;
1070
1071 case BT_CONNECTED:
1072 /* Already connected */
1073 goto done;
1074
1075 case BT_OPEN:
1076 case BT_BOUND:
1077 /* Can connect */
1078 break;
1079
1080 default:
1081 err = -EBADFD;
1082 goto done;
1083 }
1084
1085 /* Set destination address and psm */
f29972de
MH		 1086 bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
1087 l2cap_pi(sk)->psm = la.l2_psm;
1da177e4 1088
af05b30b
GP		 1089 err = l2cap_do_connect(sk);
1090 if (err)
1da177e4
LT		 1091 goto done;
1092
1093wait:
1094 err = bt_sock_wait_state(sk, BT_CONNECTED,
1095 sock_sndtimeo(sk, flags & O_NONBLOCK));
1096done:
1097 release_sock(sk);
1098 return err;
1099}
1100
1101static int l2cap_sock_listen(struct socket *sock, int backlog)
1102{
1103 struct sock *sk = sock->sk;
1104 int err = 0;
1105
1106 BT_DBG("sk %p backlog %d", sk, backlog);
1107
1108 lock_sock(sk);
1109
bd3c9e25
GP		 1110 if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
1111 || sk->sk_state != BT_BOUND) {
1da177e4
LT		 1112 err = -EBADFD;
1113 goto done;
1114 }
1115
c6b03cf9
MH		 1116 switch (l2cap_pi(sk)->mode) {
1117 case L2CAP_MODE_BASIC:
1118 break;
1119 case L2CAP_MODE_ERTM:
f2fcfcd6 1120 case L2CAP_MODE_STREAMING:
c6b03cf9
MH		 1121 if (enable_ertm)
1122 break;
1123 /* fall through */
1124 default:
1125 err = -ENOTSUPP;
1126 goto done;
1127 }
1128
1da177e4
LT		 1129 if (!l2cap_pi(sk)->psm) {
1130 bdaddr_t *src = &bt_sk(sk)->src;
1131 u16 psm;
1132
1133 err = -EINVAL;
1134
1135 write_lock_bh(&l2cap_sk_list.lock);
1136
1137 for (psm = 0x1001; psm < 0x1100; psm += 2)
b4324b5d
MH		 1138 if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
1139 l2cap_pi(sk)->psm = cpu_to_le16(psm);
1140 l2cap_pi(sk)->sport = cpu_to_le16(psm);
1da177e4
LT		 1141 err = 0;
1142 break;
1143 }
1144
1145 write_unlock_bh(&l2cap_sk_list.lock);
1146
1147 if (err < 0)
1148 goto done;
1149 }
1150
1151 sk->sk_max_ack_backlog = backlog;
1152 sk->sk_ack_backlog = 0;
1153 sk->sk_state = BT_LISTEN;
1154
1155done:
1156 release_sock(sk);
1157 return err;
1158}
1159
1160static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
1161{
1162 DECLARE_WAITQUEUE(wait, current);
1163 struct sock *sk = sock->sk, *nsk;
1164 long timeo;
1165 int err = 0;
1166
fcc70d5f 1167 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1da177e4
LT		 1168
1169 if (sk->sk_state != BT_LISTEN) {
1170 err = -EBADFD;
1171 goto done;
1172 }
1173
1174 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1175
1176 BT_DBG("sk %p timeo %ld", sk, timeo);
1177
1178 /* Wait for an incoming connection. (wake-one). */
aa395145 1179 add_wait_queue_exclusive(sk_sleep(sk), &wait);
1da177e4
LT		 1180 while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1181 set_current_state(TASK_INTERRUPTIBLE);
1182 if (!timeo) {
1183 err = -EAGAIN;
1184 break;
1185 }
1186
1187 release_sock(sk);
1188 timeo = schedule_timeout(timeo);
fcc70d5f 1189 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1da177e4
LT		 1190
1191 if (sk->sk_state != BT_LISTEN) {
1192 err = -EBADFD;
1193 break;
1194 }
1195
1196 if (signal_pending(current)) {
1197 err = sock_intr_errno(timeo);
1198 break;
1199 }
1200 }
1201 set_current_state(TASK_RUNNING);
aa395145 1202 remove_wait_queue(sk_sleep(sk), &wait);
1da177e4
LT		 1203
1204 if (err)
1205 goto done;
1206
1207 newsock->state = SS_CONNECTED;
1208
1209 BT_DBG("new socket %p", nsk);
1210
1211done:
1212 release_sock(sk);
1213 return err;
1214}
1215
1216static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1217{
1218 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1219 struct sock *sk = sock->sk;
1220
1221 BT_DBG("sock %p, sk %p", sock, sk);
1222
1223 addr->sa_family = AF_BLUETOOTH;
1224 *len = sizeof(struct sockaddr_l2);
1225
f29972de
MH		 1226 if (peer) {
1227 la->l2_psm = l2cap_pi(sk)->psm;
1da177e4 1228 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
b4324b5d 1229 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
f29972de
MH		 1230 } else {
1231 la->l2_psm = l2cap_pi(sk)->sport;
1da177e4 1232 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
b4324b5d 1233 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
f29972de 1234 }
1da177e4 1235
1da177e4
LT		 1236 return 0;
1237}
1238
e90bac06
GP		 1239static void l2cap_monitor_timeout(unsigned long arg)
1240{
1241 struct sock *sk = (void *) arg;
1242 u16 control;
1243
e686219a 1244 bh_lock_sock(sk);
e90bac06
GP		 1245 if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
1246 l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);
b13f5860 1247 bh_unlock_sock(sk);
e90bac06
GP		 1248 return;
1249 }
1250
1251 l2cap_pi(sk)->retry_count++;
1252 __mod_monitor_timer();
1253
1254 control = L2CAP_CTRL_POLL;
7e743090 1255 l2cap_send_rr_or_rnr(l2cap_pi(sk), control);
e686219a 1256 bh_unlock_sock(sk);
e90bac06
GP		 1257}
1258
1259static void l2cap_retrans_timeout(unsigned long arg)
1260{
1261 struct sock *sk = (void *) arg;
1262 u16 control;
1263
e686219a 1264 bh_lock_sock(sk);
e90bac06
GP		 1265 l2cap_pi(sk)->retry_count = 1;
1266 __mod_monitor_timer();
1267
1268 l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
1269
1270 control = L2CAP_CTRL_POLL;
7e743090 1271 l2cap_send_rr_or_rnr(l2cap_pi(sk), control);
e686219a 1272 bh_unlock_sock(sk);
e90bac06
GP		 1273}
1274
1c2acffb 1275static void l2cap_drop_acked_frames(struct sock *sk)
1da177e4 1276{
1c2acffb 1277 struct sk_buff *skb;
1da177e4 1278
812e737e
GP		 1279 while ((skb = skb_peek(TX_QUEUE(sk))) &&
1280 l2cap_pi(sk)->unacked_frames) {
1c2acffb
GP		 1281 if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
1282 break;
1da177e4 1283
1c2acffb
GP		 1284 skb = skb_dequeue(TX_QUEUE(sk));
1285 kfree_skb(skb);
1da177e4 1286
1c2acffb
GP		 1287 l2cap_pi(sk)->unacked_frames--;
1288 }
1da177e4 1289
e90bac06
GP		 1290 if (!l2cap_pi(sk)->unacked_frames)
1291 del_timer(&l2cap_pi(sk)->retrans_timer);
1292
1c2acffb
GP		 1293 return;
1294}
1da177e4 1295
1c2acffb
GP		 1296static inline int l2cap_do_send(struct sock *sk, struct sk_buff *skb)
1297{
1298 struct l2cap_pinfo *pi = l2cap_pi(sk);
1299 int err;
1300
1301 BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
1da177e4 1302
1c2acffb
GP		 1303 err = hci_send_acl(pi->conn->hcon, skb, 0);
1304 if (err < 0)
1305 kfree_skb(skb);
1306
1307 return err;
1308}
1309
6840ed07
GP		 1310static int l2cap_streaming_send(struct sock *sk)
1311{
1312 struct sk_buff *skb, *tx_skb;
1313 struct l2cap_pinfo *pi = l2cap_pi(sk);
fcc203c3 1314 u16 control, fcs;
6840ed07
GP		 1315 int err;
1316
1317 while ((skb = sk->sk_send_head)) {
1318 tx_skb = skb_clone(skb, GFP_ATOMIC);
1319
1320 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
1321 control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
1322 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1323
e8235c6b 1324 if (pi->fcs == L2CAP_FCS_CRC16) {
fcc203c3
GP		 1325 fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
1326 put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
1327 }
1328
6840ed07
GP		 1329 err = l2cap_do_send(sk, tx_skb);
1330 if (err < 0) {
1331 l2cap_send_disconn_req(pi->conn, sk);
1332 return err;
1333 }
1334
1335 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
1336
1337 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1338 sk->sk_send_head = NULL;
1339 else
1340 sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
1341
1342 skb = skb_dequeue(TX_QUEUE(sk));
1343 kfree_skb(skb);
1344 }
1345 return 0;
1346}
1347
8f17154f
GP		 1348static int l2cap_retransmit_frame(struct sock *sk, u8 tx_seq)
1349{
1350 struct l2cap_pinfo *pi = l2cap_pi(sk);
1351 struct sk_buff *skb, *tx_skb;
1352 u16 control, fcs;
1353 int err;
1354
1355 skb = skb_peek(TX_QUEUE(sk));
1356 do {
1357 if (bt_cb(skb)->tx_seq != tx_seq) {
1358 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1359 break;
1360 skb = skb_queue_next(TX_QUEUE(sk), skb);
1361 continue;
1362 }
1363
1364 if (pi->remote_max_tx &&
1365 bt_cb(skb)->retries == pi->remote_max_tx) {
1366 l2cap_send_disconn_req(pi->conn, sk);
1367 break;
1368 }
1369
1370 tx_skb = skb_clone(skb, GFP_ATOMIC);
1371 bt_cb(skb)->retries++;
1372 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
9f121a5a 1373 control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
8f17154f
GP		 1374 | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
1375 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1376
e8235c6b 1377 if (pi->fcs == L2CAP_FCS_CRC16) {
8f17154f
GP		 1378 fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
1379 put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
1380 }
1381
1382 err = l2cap_do_send(sk, tx_skb);
1383 if (err < 0) {
1384 l2cap_send_disconn_req(pi->conn, sk);
1385 return err;
1386 }
1387 break;
1388 } while(1);
1389 return 0;
1390}
1391
1c2acffb
GP		 1392static int l2cap_ertm_send(struct sock *sk)
1393{
1394 struct sk_buff *skb, *tx_skb;
1395 struct l2cap_pinfo *pi = l2cap_pi(sk);
fcc203c3 1396 u16 control, fcs;
9e917af1 1397 int err, nsent = 0;
1c2acffb 1398
e90bac06
GP		 1399 if (pi->conn_state & L2CAP_CONN_WAIT_F)
1400 return 0;
1401
f64f9e71
JP		 1402 while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
1403 !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
1c2acffb 1404
e90bac06
GP		 1405 if (pi->remote_max_tx &&
1406 bt_cb(skb)->retries == pi->remote_max_tx) {
1407 l2cap_send_disconn_req(pi->conn, sk);
1408 break;
1409 }
1410
e420aba3
AE		 1411 tx_skb = skb_clone(skb, GFP_ATOMIC);
1412
e90bac06
GP		 1413 bt_cb(skb)->retries++;
1414
1c2acffb 1415 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
d5392c8f
GP		 1416 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
1417 control |= L2CAP_CTRL_FINAL;
1418 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
1419 }
9f121a5a 1420 control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
1c2acffb
GP		 1421 | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
1422 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1423
e90bac06 1424
e8235c6b 1425 if (pi->fcs == L2CAP_FCS_CRC16) {
fcc203c3
GP		 1426 fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
1427 put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
1428 }
1429
1c2acffb
GP		 1430 err = l2cap_do_send(sk, tx_skb);
1431 if (err < 0) {
1432 l2cap_send_disconn_req(pi->conn, sk);
1433 return err;
1434 }
e90bac06 1435 __mod_retrans_timer();
1c2acffb
GP		 1436
1437 bt_cb(skb)->tx_seq = pi->next_tx_seq;
1438 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
1439
1440 pi->unacked_frames++;
d5392c8f 1441 pi->frames_sent++;
1c2acffb
GP		 1442
1443 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1444 sk->sk_send_head = NULL;
1445 else
1446 sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
9e917af1
GP		 1447
1448 nsent++;
1c2acffb
GP		 1449 }
1450
9e917af1
GP		 1451 return nsent;
1452}
1453
1454static int l2cap_send_ack(struct l2cap_pinfo *pi)
1455{
1456 struct sock *sk = (struct sock *)pi;
1457 u16 control = 0;
1458
1459 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
1460
1461 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
1462 control |= L2CAP_SUPER_RCV_NOT_READY;
1463 return l2cap_send_sframe(pi, control);
1464 } else if (l2cap_ertm_send(sk) == 0) {
1465 control |= L2CAP_SUPER_RCV_READY;
1466 return l2cap_send_sframe(pi, control);
1467 }
1c2acffb
GP		 1468 return 0;
1469}
1470
99b0d4b7
GP		 1471static int l2cap_send_srejtail(struct sock *sk)
1472{
1473 struct srej_list *tail;
1474 u16 control;
1475
1476 control = L2CAP_SUPER_SELECT_REJECT;
1477 control |= L2CAP_CTRL_FINAL;
1478
1479 tail = list_entry(SREJ_LIST(sk)->prev, struct srej_list, list);
1480 control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
1481
1482 l2cap_send_sframe(l2cap_pi(sk), control);
1483
1484 return 0;
1485}
1486
1c2acffb
GP		 1487static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
1488{
1489 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1490 struct sk_buff **frag;
1491 int err, sent = 0;
1da177e4
LT		 1492
1493 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
1c2acffb 1494 return -EFAULT;
1da177e4
LT		 1495 }
1496
1497 sent += count;
1498 len -= count;
1499
1500 /* Continuation fragments (no L2CAP header) */
1501 frag = &skb_shinfo(skb)->frag_list;
1502 while (len) {
1503 count = min_t(unsigned int, conn->mtu, len);
1504
1505 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1506 if (!*frag)
1c2acffb
GP		 1507 return -EFAULT;
1508 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1509 return -EFAULT;
1da177e4
LT		 1510
1511 sent += count;
1512 len -= count;
1513
1514 frag = &(*frag)->next;
1515 }
1da177e4
LT		 1516
1517 return sent;
1c2acffb 1518}
1da177e4 1519
1c2acffb
GP		 1520static struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len)
1521{
1522 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1523 struct sk_buff *skb;
1524 int err, count, hlen = L2CAP_HDR_SIZE + 2;
1525 struct l2cap_hdr *lh;
1526
1527 BT_DBG("sk %p len %d", sk, (int)len);
1528
1529 count = min_t(unsigned int, (conn->mtu - hlen), len);
1530 skb = bt_skb_send_alloc(sk, count + hlen,
1531 msg->msg_flags & MSG_DONTWAIT, &err);
1532 if (!skb)
1533 return ERR_PTR(-ENOMEM);
1534
1535 /* Create L2CAP header */
1536 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1537 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1538 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1539 put_unaligned_le16(l2cap_pi(sk)->psm, skb_put(skb, 2));
1540
1541 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1542 if (unlikely(err < 0)) {
1543 kfree_skb(skb);
1544 return ERR_PTR(err);
1545 }
1546 return skb;
1547}
1548
1549static struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len)
1550{
1551 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1552 struct sk_buff *skb;
1553 int err, count, hlen = L2CAP_HDR_SIZE;
1554 struct l2cap_hdr *lh;
1555
1556 BT_DBG("sk %p len %d", sk, (int)len);
1557
1558 count = min_t(unsigned int, (conn->mtu - hlen), len);
1559 skb = bt_skb_send_alloc(sk, count + hlen,
1560 msg->msg_flags & MSG_DONTWAIT, &err);
1561 if (!skb)
1562 return ERR_PTR(-ENOMEM);
1563
1564 /* Create L2CAP header */
1565 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1566 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1567 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1568
1569 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1570 if (unlikely(err < 0)) {
1571 kfree_skb(skb);
1572 return ERR_PTR(err);
1573 }
1574 return skb;
1575}
1576
6840ed07 1577static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
1c2acffb
GP		 1578{
1579 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1580 struct sk_buff *skb;
1581 int err, count, hlen = L2CAP_HDR_SIZE + 2;
1582 struct l2cap_hdr *lh;
1583
1584 BT_DBG("sk %p len %d", sk, (int)len);
1585
0ee0d208
GP		 1586 if (!conn)
1587 return ERR_PTR(-ENOTCONN);
1588
c74e560c
GP		 1589 if (sdulen)
1590 hlen += 2;
1591
fcc203c3
GP		 1592 if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
1593 hlen += 2;
1594
1c2acffb
GP		 1595 count = min_t(unsigned int, (conn->mtu - hlen), len);
1596 skb = bt_skb_send_alloc(sk, count + hlen,
1597 msg->msg_flags & MSG_DONTWAIT, &err);
1598 if (!skb)
1599 return ERR_PTR(-ENOMEM);
1600
1601 /* Create L2CAP header */
1602 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1603 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1604 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1605 put_unaligned_le16(control, skb_put(skb, 2));
c74e560c
GP		 1606 if (sdulen)
1607 put_unaligned_le16(sdulen, skb_put(skb, 2));
1c2acffb
GP		 1608
1609 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1610 if (unlikely(err < 0)) {
1611 kfree_skb(skb);
1612 return ERR_PTR(err);
1613 }
e90bac06 1614
fcc203c3
GP		 1615 if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
1616 put_unaligned_le16(0, skb_put(skb, 2));
1617
e90bac06 1618 bt_cb(skb)->retries = 0;
1c2acffb 1619 return skb;
1da177e4
LT		 1620}
1621
c74e560c
GP		 1622static inline int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
1623{
1624 struct l2cap_pinfo *pi = l2cap_pi(sk);
1625 struct sk_buff *skb;
1626 struct sk_buff_head sar_queue;
1627 u16 control;
1628 size_t size = 0;
1629
1630 __skb_queue_head_init(&sar_queue);
1631 control = L2CAP_SDU_START;
1c762159 1632 skb = l2cap_create_iframe_pdu(sk, msg, pi->remote_mps, control, len);
c74e560c
GP		 1633 if (IS_ERR(skb))
1634 return PTR_ERR(skb);
1635
1636 __skb_queue_tail(&sar_queue, skb);
1c762159
GP		 1637 len -= pi->remote_mps;
1638 size += pi->remote_mps;
c74e560c
GP		 1639 control = 0;
1640
1641 while (len > 0) {
1642 size_t buflen;
1643
1c762159 1644 if (len > pi->remote_mps) {
c74e560c 1645 control |= L2CAP_SDU_CONTINUE;
1c762159 1646 buflen = pi->remote_mps;
c74e560c
GP		 1647 } else {
1648 control |= L2CAP_SDU_END;
1649 buflen = len;
1650 }
1651
6840ed07 1652 skb = l2cap_create_iframe_pdu(sk, msg, buflen, control, 0);
c74e560c
GP		 1653 if (IS_ERR(skb)) {
1654 skb_queue_purge(&sar_queue);
1655 return PTR_ERR(skb);
1656 }
1657
1658 __skb_queue_tail(&sar_queue, skb);
1659 len -= buflen;
1660 size += buflen;
1661 control = 0;
1662 }
1663 skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
1664 if (sk->sk_send_head == NULL)
1665 sk->sk_send_head = sar_queue.next;
1666
1667 return size;
1668}
1669
1da177e4
LT		 1670static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1671{
1672 struct sock *sk = sock->sk;
1c2acffb
GP		 1673 struct l2cap_pinfo *pi = l2cap_pi(sk);
1674 struct sk_buff *skb;
1675 u16 control;
1676 int err;
1da177e4
LT		 1677
1678 BT_DBG("sock %p, sk %p", sock, sk);
1679
c1cbe4b7
BL		 1680 err = sock_error(sk);
1681 if (err)
1682 return err;
1da177e4
LT		 1683
1684 if (msg->msg_flags & MSG_OOB)
1685 return -EOPNOTSUPP;
1686
1da177e4
LT		 1687 lock_sock(sk);
1688
1c2acffb 1689 if (sk->sk_state != BT_CONNECTED) {
1da177e4 1690 err = -ENOTCONN;
1c2acffb
GP		 1691 goto done;
1692 }
1da177e4 1693
1c2acffb
GP		 1694 /* Connectionless channel */
1695 if (sk->sk_type == SOCK_DGRAM) {
1696 skb = l2cap_create_connless_pdu(sk, msg, len);
477fffb0
DC		 1697 if (IS_ERR(skb))
1698 err = PTR_ERR(skb);
1699 else
1700 err = l2cap_do_send(sk, skb);
1c2acffb
GP		 1701 goto done;
1702 }
1703
1704 switch (pi->mode) {
1705 case L2CAP_MODE_BASIC:
c69163e9
GP		 1706 /* Check outgoing MTU */
1707 if (len > pi->omtu) {
1708 err = -EINVAL;
1709 goto done;
1710 }
1711
1c2acffb
GP		 1712 /* Create a basic PDU */
1713 skb = l2cap_create_basic_pdu(sk, msg, len);
1714 if (IS_ERR(skb)) {
1715 err = PTR_ERR(skb);
1716 goto done;
1717 }
1718
1719 err = l2cap_do_send(sk, skb);
1720 if (!err)
1721 err = len;
1722 break;
1723
1724 case L2CAP_MODE_ERTM:
6840ed07 1725 case L2CAP_MODE_STREAMING:
1c2acffb 1726 /* Entire SDU fits into one PDU */
1c762159 1727 if (len <= pi->remote_mps) {
1c2acffb 1728 control = L2CAP_SDU_UNSEGMENTED;
6840ed07 1729 skb = l2cap_create_iframe_pdu(sk, msg, len, control, 0);
1c2acffb
GP		 1730 if (IS_ERR(skb)) {
1731 err = PTR_ERR(skb);
1732 goto done;
1733 }
c74e560c
GP		 1734 __skb_queue_tail(TX_QUEUE(sk), skb);
1735 if (sk->sk_send_head == NULL)
1736 sk->sk_send_head = skb;
1c2acffb 1737 } else {
c74e560c
GP		 1738 /* Segment SDU into multiples PDUs */
1739 err = l2cap_sar_segment_sdu(sk, msg, len);
1740 if (err < 0)
1741 goto done;
1c2acffb 1742 }
1c2acffb 1743
6840ed07
GP		 1744 if (pi->mode == L2CAP_MODE_STREAMING)
1745 err = l2cap_streaming_send(sk);
1746 else
1747 err = l2cap_ertm_send(sk);
1748
9e917af1 1749 if (err >= 0)
1c2acffb
GP		 1750 err = len;
1751 break;
1752
1753 default:
1754 BT_DBG("bad state %1.1x", pi->mode);
1755 err = -EINVAL;
1756 }
1757
1758done:
1da177e4
LT		 1759 release_sock(sk);
1760 return err;
1761}
1762
f66dc81f
MH		 1763static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1764{
1765 struct sock *sk = sock->sk;
1766
1767 lock_sock(sk);
1768
1769 if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1770 struct l2cap_conn_rsp rsp;
1771
1772 sk->sk_state = BT_CONFIG;
1773
1774 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
1775 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
1776 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1777 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1778 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1779 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1780
1781 release_sock(sk);
1782 return 0;
1783 }
1784
1785 release_sock(sk);
1786
1787 return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1788}
1789
b7058842 1790static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
1da177e4
LT		 1791{
1792 struct sock *sk = sock->sk;
1793 struct l2cap_options opts;
f29972de 1794 int len, err = 0;
1da177e4
LT		 1795 u32 opt;
1796
1797 BT_DBG("sk %p", sk);
1798
1799 lock_sock(sk);
1800
1801 switch (optname) {
1802 case L2CAP_OPTIONS:
0878b666
MH		 1803 opts.imtu = l2cap_pi(sk)->imtu;
1804 opts.omtu = l2cap_pi(sk)->omtu;
1805 opts.flush_to = l2cap_pi(sk)->flush_to;
c6b03cf9 1806 opts.mode = l2cap_pi(sk)->mode;
fcc203c3 1807 opts.fcs = l2cap_pi(sk)->fcs;
68d7f0ce 1808 opts.max_tx = l2cap_pi(sk)->max_tx;
14b5aa71 1809 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
0878b666 1810
1da177e4
LT		 1811 len = min_t(unsigned int, sizeof(opts), optlen);
1812 if (copy_from_user((char *) &opts, optval, len)) {
1813 err = -EFAULT;
1814 break;
1815 }
0878b666 1816
0041ecfa
JPRV		 1817 l2cap_pi(sk)->mode = opts.mode;
1818 switch (l2cap_pi(sk)->mode) {
1819 case L2CAP_MODE_BASIC:
1820 break;
1821 case L2CAP_MODE_ERTM:
1822 case L2CAP_MODE_STREAMING:
1823 if (enable_ertm)
1824 break;
1825 /* fall through */
1826 default:
1827 err = -EINVAL;
1828 break;
1829 }
1830
c6b03cf9
MH		 1831 l2cap_pi(sk)->imtu = opts.imtu;
1832 l2cap_pi(sk)->omtu = opts.omtu;
fcc203c3 1833 l2cap_pi(sk)->fcs = opts.fcs;
68d7f0ce 1834 l2cap_pi(sk)->max_tx = opts.max_tx;
14b5aa71 1835 l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
1da177e4
LT		 1836 break;
1837
1838 case L2CAP_LM:
1839 if (get_user(opt, (u32 __user *) optval)) {
1840 err = -EFAULT;
1841 break;
1842 }
1843
2af6b9d5
MH		 1844 if (opt & L2CAP_LM_AUTH)
1845 l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
1846 if (opt & L2CAP_LM_ENCRYPT)
1847 l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
1848 if (opt & L2CAP_LM_SECURE)
1849 l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
1850
1851 l2cap_pi(sk)->role_switch = (opt & L2CAP_LM_MASTER);
1852 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
1da177e4
LT		 1853 break;
1854
1855 default:
1856 err = -ENOPROTOOPT;
1857 break;
1858 }
1859
1860 release_sock(sk);
1861 return err;
1862}
1863
b7058842 1864static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
d58daf42
MH		 1865{
1866 struct sock *sk = sock->sk;
2af6b9d5
MH		 1867 struct bt_security sec;
1868 int len, err = 0;
f66dc81f 1869 u32 opt;
d58daf42
MH		 1870
1871 BT_DBG("sk %p", sk);
1872
1873 if (level == SOL_L2CAP)
1874 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
1875
0588d94f
MH		 1876 if (level != SOL_BLUETOOTH)
1877 return -ENOPROTOOPT;
1878
d58daf42
MH		 1879 lock_sock(sk);
1880
1881 switch (optname) {
2af6b9d5 1882 case BT_SECURITY:
bd3c9e25
GP		 1883 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
1884 && sk->sk_type != SOCK_RAW) {
0588d94f
MH		 1885 err = -EINVAL;
1886 break;
1887 }
1888
2af6b9d5
MH		 1889 sec.level = BT_SECURITY_LOW;
1890
1891 len = min_t(unsigned int, sizeof(sec), optlen);
1892 if (copy_from_user((char *) &sec, optval, len)) {
1893 err = -EFAULT;
1894 break;
1895 }
1896
1897 if (sec.level < BT_SECURITY_LOW ||
1898 sec.level > BT_SECURITY_HIGH) {
1899 err = -EINVAL;
1900 break;
1901 }
1902
1903 l2cap_pi(sk)->sec_level = sec.level;
1904 break;
1905
f66dc81f
MH		 1906 case BT_DEFER_SETUP:
1907 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1908 err = -EINVAL;
1909 break;
1910 }
1911
1912 if (get_user(opt, (u32 __user *) optval)) {
1913 err = -EFAULT;
1914 break;
1915 }
1916
1917 bt_sk(sk)->defer_setup = opt;
1918 break;
1919
d58daf42
MH		 1920 default:
1921 err = -ENOPROTOOPT;
1922 break;
1923 }
1924
1925 release_sock(sk);
1926 return err;
1927}
1928
1929static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1da177e4
LT		 1930{
1931 struct sock *sk = sock->sk;
1932 struct l2cap_options opts;
1933 struct l2cap_conninfo cinfo;
1934 int len, err = 0;
2af6b9d5 1935 u32 opt;
1da177e4
LT		 1936
1937 BT_DBG("sk %p", sk);
1938
1939 if (get_user(len, optlen))
1940 return -EFAULT;
1941
1942 lock_sock(sk);
1943
1944 switch (optname) {
1945 case L2CAP_OPTIONS:
1946 opts.imtu = l2cap_pi(sk)->imtu;
1947 opts.omtu = l2cap_pi(sk)->omtu;
1948 opts.flush_to = l2cap_pi(sk)->flush_to;
c6b03cf9 1949 opts.mode = l2cap_pi(sk)->mode;
fcc203c3 1950 opts.fcs = l2cap_pi(sk)->fcs;
68d7f0ce 1951 opts.max_tx = l2cap_pi(sk)->max_tx;
14b5aa71 1952 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
1da177e4
LT		 1953
1954 len = min_t(unsigned int, len, sizeof(opts));
1955 if (copy_to_user(optval, (char *) &opts, len))
1956 err = -EFAULT;
1957
1958 break;
1959
1960 case L2CAP_LM:
2af6b9d5
MH		 1961 switch (l2cap_pi(sk)->sec_level) {
1962 case BT_SECURITY_LOW:
1963 opt = L2CAP_LM_AUTH;
1964 break;
1965 case BT_SECURITY_MEDIUM:
1966 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
1967 break;
1968 case BT_SECURITY_HIGH:
1969 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
1970 L2CAP_LM_SECURE;
1971 break;
1972 default:
1973 opt = 0;
1974 break;
1975 }
1976
1977 if (l2cap_pi(sk)->role_switch)
1978 opt |= L2CAP_LM_MASTER;
1979
1980 if (l2cap_pi(sk)->force_reliable)
1981 opt |= L2CAP_LM_RELIABLE;
1982
1983 if (put_user(opt, (u32 __user *) optval))
1da177e4
LT		 1984 err = -EFAULT;
1985 break;
1986
1987 case L2CAP_CONNINFO:
f66dc81f
MH		 1988 if (sk->sk_state != BT_CONNECTED &&
1989 !(sk->sk_state == BT_CONNECT2 &&
1990 bt_sk(sk)->defer_setup)) {
1da177e4
LT		 1991 err = -ENOTCONN;
1992 break;
1993 }
1994
1995 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
1996 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
1997
1998 len = min_t(unsigned int, len, sizeof(cinfo));
1999 if (copy_to_user(optval, (char *) &cinfo, len))
2000 err = -EFAULT;
2001
2002 break;
2003
2004 default:
2005 err = -ENOPROTOOPT;
2006 break;
2007 }
2008
2009 release_sock(sk);
2010 return err;
2011}
2012
d58daf42
MH		 2013static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
2014{
2015 struct sock *sk = sock->sk;
2af6b9d5 2016 struct bt_security sec;
d58daf42
MH		 2017 int len, err = 0;
2018
2019 BT_DBG("sk %p", sk);
2020
2021 if (level == SOL_L2CAP)
2022 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
2023
0588d94f
MH		 2024 if (level != SOL_BLUETOOTH)
2025 return -ENOPROTOOPT;
2026
d58daf42
MH		 2027 if (get_user(len, optlen))
2028 return -EFAULT;
2029
2030 lock_sock(sk);
2031
2032 switch (optname) {
2af6b9d5 2033 case BT_SECURITY:
bd3c9e25
GP		 2034 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
2035 && sk->sk_type != SOCK_RAW) {
0588d94f
MH		 2036 err = -EINVAL;
2037 break;
2038 }
2039
2af6b9d5
MH		 2040 sec.level = l2cap_pi(sk)->sec_level;
2041
2042 len = min_t(unsigned int, len, sizeof(sec));
2043 if (copy_to_user(optval, (char *) &sec, len))
2044 err = -EFAULT;
2045
2046 break;
2047
f66dc81f
MH		 2048 case BT_DEFER_SETUP:
2049 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
2050 err = -EINVAL;
2051 break;
2052 }
2053
2054 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
2055 err = -EFAULT;
2056
2057 break;
2058
d58daf42
MH		 2059 default:
2060 err = -ENOPROTOOPT;
2061 break;
2062 }
2063
2064 release_sock(sk);
2065 return err;
2066}
2067
1da177e4
LT		 2068static int l2cap_sock_shutdown(struct socket *sock, int how)
2069{
2070 struct sock *sk = sock->sk;
2071 int err = 0;
2072
2073 BT_DBG("sock %p, sk %p", sock, sk);
2074
2075 if (!sk)
2076 return 0;
2077
2078 lock_sock(sk);
2079 if (!sk->sk_shutdown) {
2080 sk->sk_shutdown = SHUTDOWN_MASK;
2081 l2cap_sock_clear_timer(sk);
2082 __l2cap_sock_close(sk, 0);
2083
2084 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
b1235d79
MH		 2085 err = bt_sock_wait_state(sk, BT_CLOSED,
2086 sk->sk_lingertime);
1da177e4
LT		 2087 }
2088 release_sock(sk);
2089 return err;
2090}
2091
2092static int l2cap_sock_release(struct socket *sock)
2093{
2094 struct sock *sk = sock->sk;
2095 int err;
2096
2097 BT_DBG("sock %p, sk %p", sock, sk);
2098
2099 if (!sk)
2100 return 0;
2101
2102 err = l2cap_sock_shutdown(sock, 2);
2103
2104 sock_orphan(sk);
2105 l2cap_sock_kill(sk);
2106 return err;
2107}
2108
1da177e4
LT		 2109static void l2cap_chan_ready(struct sock *sk)
2110{
2111 struct sock *parent = bt_sk(sk)->parent;
2112
2113 BT_DBG("sk %p, parent %p", sk, parent);
2114
2115 l2cap_pi(sk)->conf_state = 0;
2116 l2cap_sock_clear_timer(sk);
2117
2118 if (!parent) {
2119 /* Outgoing channel.
2120 * Wake up socket sleeping on connect.
2121 */
2122 sk->sk_state = BT_CONNECTED;
2123 sk->sk_state_change(sk);
2124 } else {
2125 /* Incoming channel.
2126 * Wake up socket sleeping on accept.
2127 */
2128 parent->sk_data_ready(parent, 0);
2129 }
2130}
2131
2132/* Copy frame to all raw sockets on that connection */
2133static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2134{
2135 struct l2cap_chan_list *l = &conn->chan_list;
2136 struct sk_buff *nskb;
af05b30b 2137 struct sock *sk;
1da177e4
LT		 2138
2139 BT_DBG("conn %p", conn);
2140
2141 read_lock(&l->lock);
2142 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2143 if (sk->sk_type != SOCK_RAW)
2144 continue;
2145
2146 /* Don't send frame to the socket it came from */
2147 if (skb->sk == sk)
2148 continue;
af05b30b
GP		 2149 nskb = skb_clone(skb, GFP_ATOMIC);
2150 if (!nskb)
1da177e4
LT		 2151 continue;
2152
2153 if (sock_queue_rcv_skb(sk, nskb))
2154 kfree_skb(nskb);
2155 }
2156 read_unlock(&l->lock);
2157}
2158
2159/* ---- L2CAP signalling commands ---- */
2160static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2161 u8 code, u8 ident, u16 dlen, void *data)
2162{
2163 struct sk_buff *skb, **frag;
2164 struct l2cap_cmd_hdr *cmd;
2165 struct l2cap_hdr *lh;
2166 int len, count;
2167
af05b30b
GP		 2168 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2169 conn, code, ident, dlen);
1da177e4
LT		 2170
2171 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2172 count = min_t(unsigned int, conn->mtu, len);
2173
2174 skb = bt_skb_alloc(count, GFP_ATOMIC);
2175 if (!skb)
2176 return NULL;
2177
2178 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2179 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
8db4dc46 2180 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2181
2182 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2183 cmd->code = code;
2184 cmd->ident = ident;
aca3192c 2185 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2186
2187 if (dlen) {
2188 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2189 memcpy(skb_put(skb, count), data, count);
2190 data += count;
2191 }
2192
2193 len -= skb->len;
2194
2195 /* Continuation fragments (no L2CAP header) */
2196 frag = &skb_shinfo(skb)->frag_list;
2197 while (len) {
2198 count = min_t(unsigned int, conn->mtu, len);
2199
2200 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2201 if (!*frag)
2202 goto fail;
2203
2204 memcpy(skb_put(*frag, count), data, count);
2205
2206 len -= count;
2207 data += count;
2208
2209 frag = &(*frag)->next;
2210 }
2211
2212 return skb;
2213
2214fail:
2215 kfree_skb(skb);
2216 return NULL;
2217}
2218
2219static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2220{
2221 struct l2cap_conf_opt *opt = *ptr;
2222 int len;
2223
2224 len = L2CAP_CONF_OPT_SIZE + opt->len;
2225 *ptr += len;
2226
2227 *type = opt->type;
2228 *olen = opt->len;
2229
2230 switch (opt->len) {
2231 case 1:
2232 *val = *((u8 *) opt->val);
2233 break;
2234
2235 case 2:
861d6882 2236 *val = __le16_to_cpu(*((__le16 *) opt->val));
1da177e4
LT		 2237 break;
2238
2239 case 4:
861d6882 2240 *val = __le32_to_cpu(*((__le32 *) opt->val));
1da177e4
LT		 2241 break;
2242
2243 default:
2244 *val = (unsigned long) opt->val;
2245 break;
2246 }
2247
2248 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2249 return len;
2250}
2251
1da177e4
LT		 2252static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2253{
2254 struct l2cap_conf_opt *opt = *ptr;
2255
2256 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2257
2258 opt->type = type;
2259 opt->len = len;
2260
2261 switch (len) {
2262 case 1:
2263 *((u8 *) opt->val) = val;
2264 break;
2265
2266 case 2:
8e036fc3 2267 *((__le16 *) opt->val) = cpu_to_le16(val);
1da177e4
LT		 2268 break;
2269
2270 case 4:
8e036fc3 2271 *((__le32 *) opt->val) = cpu_to_le32(val);
1da177e4
LT		 2272 break;
2273
2274 default:
2275 memcpy(opt->val, (void *) val, len);
2276 break;
2277 }
2278
2279 *ptr += L2CAP_CONF_OPT_SIZE + len;
2280}
2281
c1b4f43b
GP		 2282static void l2cap_ack_timeout(unsigned long arg)
2283{
2284 struct sock *sk = (void *) arg;
2285
2286 bh_lock_sock(sk);
2287 l2cap_send_ack(l2cap_pi(sk));
2288 bh_unlock_sock(sk);
2289}
2290
0565c1c2
GP		 2291static inline void l2cap_ertm_init(struct sock *sk)
2292{
2293 l2cap_pi(sk)->expected_ack_seq = 0;
2294 l2cap_pi(sk)->unacked_frames = 0;
2295 l2cap_pi(sk)->buffer_seq = 0;
803020c6 2296 l2cap_pi(sk)->num_acked = 0;
d5392c8f 2297 l2cap_pi(sk)->frames_sent = 0;
0565c1c2
GP		 2298
2299 setup_timer(&l2cap_pi(sk)->retrans_timer,
2300 l2cap_retrans_timeout, (unsigned long) sk);
2301 setup_timer(&l2cap_pi(sk)->monitor_timer,
2302 l2cap_monitor_timeout, (unsigned long) sk);
c1b4f43b
GP		 2303 setup_timer(&l2cap_pi(sk)->ack_timer,
2304 l2cap_ack_timeout, (unsigned long) sk);
0565c1c2
GP		 2305
2306 __skb_queue_head_init(SREJ_QUEUE(sk));
2307}
2308
f2fcfcd6
GP		 2309static int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
2310{
2311 u32 local_feat_mask = l2cap_feat_mask;
2312 if (enable_ertm)
6840ed07 2313 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
f2fcfcd6
GP		 2314
2315 switch (mode) {
2316 case L2CAP_MODE_ERTM:
2317 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
2318 case L2CAP_MODE_STREAMING:
2319 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
2320 default:
2321 return 0x00;
2322 }
2323}
2324
2325static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2326{
2327 switch (mode) {
2328 case L2CAP_MODE_STREAMING:
2329 case L2CAP_MODE_ERTM:
2330 if (l2cap_mode_supported(mode, remote_feat_mask))
2331 return mode;
2332 /* fall through */
2333 default:
2334 return L2CAP_MODE_BASIC;
2335 }
2336}
2337
1da177e4
LT		 2338static int l2cap_build_conf_req(struct sock *sk, void *data)
2339{
2340 struct l2cap_pinfo *pi = l2cap_pi(sk);
2341 struct l2cap_conf_req *req = data;
bd3c9e25 2342 struct l2cap_conf_rfc rfc = { .mode = pi->mode };
1da177e4
LT		 2343 void *ptr = req->data;
2344
2345 BT_DBG("sk %p", sk);
2346
f2fcfcd6
GP		 2347 if (pi->num_conf_req || pi->num_conf_rsp)
2348 goto done;
2349
2350 switch (pi->mode) {
2351 case L2CAP_MODE_STREAMING:
2352 case L2CAP_MODE_ERTM:
2353 pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
22121fc9
GP		 2354 if (!l2cap_mode_supported(pi->mode, pi->conn->feat_mask))
2355 l2cap_send_disconn_req(pi->conn, sk);
f2fcfcd6
GP		 2356 break;
2357 default:
2358 pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
2359 break;
2360 }
2361
2362done:
65c7c491
MH		 2363 switch (pi->mode) {
2364 case L2CAP_MODE_BASIC:
2365 if (pi->imtu != L2CAP_DEFAULT_MTU)
2366 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
2367 break;
2368
2369 case L2CAP_MODE_ERTM:
2370 rfc.mode = L2CAP_MODE_ERTM;
14b5aa71 2371 rfc.txwin_size = pi->tx_win;
68d7f0ce 2372 rfc.max_transmit = pi->max_tx;
f2fcfcd6
GP		 2373 rfc.retrans_timeout = 0;
2374 rfc.monitor_timeout = 0;
c74e560c 2375 rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
d1daa091 2376 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
1c762159 2377 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
f2fcfcd6
GP		 2378
2379 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2380 sizeof(rfc), (unsigned long) &rfc);
fcc203c3
GP		 2381
2382 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
2383 break;
2384
2385 if (pi->fcs == L2CAP_FCS_NONE ||
2386 pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
2387 pi->fcs = L2CAP_FCS_NONE;
2388 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
2389 }
f2fcfcd6
GP		 2390 break;
2391
2392 case L2CAP_MODE_STREAMING:
2393 rfc.mode = L2CAP_MODE_STREAMING;
2394 rfc.txwin_size = 0;
2395 rfc.max_transmit = 0;
2396 rfc.retrans_timeout = 0;
2397 rfc.monitor_timeout = 0;
c74e560c 2398 rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
d1daa091 2399 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
1c762159 2400 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
65c7c491
MH		 2401
2402 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2403 sizeof(rfc), (unsigned long) &rfc);
fcc203c3
GP		 2404
2405 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
2406 break;
2407
2408 if (pi->fcs == L2CAP_FCS_NONE ||
2409 pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
2410 pi->fcs = L2CAP_FCS_NONE;
2411 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
2412 }
65c7c491
MH		 2413 break;
2414 }
1da177e4
LT		 2415
2416 /* FIXME: Need actual value of the flush timeout */
2417 //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
2418 // l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
2419
aca3192c
YH		 2420 req->dcid = cpu_to_le16(pi->dcid);
2421 req->flags = cpu_to_le16(0);
1da177e4
LT		 2422
2423 return ptr - data;
2424}
2425
5dee9e7c 2426static int l2cap_parse_conf_req(struct sock *sk, void *data)
1da177e4
LT		 2427{
2428 struct l2cap_pinfo *pi = l2cap_pi(sk);
5dee9e7c
MH		 2429 struct l2cap_conf_rsp *rsp = data;
2430 void *ptr = rsp->data;
2431 void *req = pi->conf_req;
2432 int len = pi->conf_len;
2433 int type, hint, olen;
2434 unsigned long val;
6464f35f 2435 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
861d6882 2436 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2437 u16 result = L2CAP_CONF_SUCCESS;
1da177e4 2438
5dee9e7c 2439 BT_DBG("sk %p", sk);
820ae1b8 2440
5dee9e7c
MH		 2441 while (len >= L2CAP_CONF_OPT_SIZE) {
2442 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2443
589d2746 2444 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2445 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2446
2447 switch (type) {
2448 case L2CAP_CONF_MTU:
861d6882 2449 mtu = val;
5dee9e7c
MH		 2450 break;
2451
2452 case L2CAP_CONF_FLUSH_TO:
2453 pi->flush_to = val;
2454 break;
2455
2456 case L2CAP_CONF_QOS:
2457 break;
2458
6464f35f
MH		 2459 case L2CAP_CONF_RFC:
2460 if (olen == sizeof(rfc))
2461 memcpy(&rfc, (void *) val, olen);
2462 break;
2463
fcc203c3
GP		 2464 case L2CAP_CONF_FCS:
2465 if (val == L2CAP_FCS_NONE)
2466 pi->conf_state |= L2CAP_CONF_NO_FCS_RECV;
2467
2468 break;
2469
5dee9e7c
MH		 2470 default:
2471 if (hint)
2472 break;
2473
2474 result = L2CAP_CONF_UNKNOWN;
2475 *((u8 *) ptr++) = type;
2476 break;
2477 }
2478 }
2479
f2fcfcd6
GP		 2480 if (pi->num_conf_rsp || pi->num_conf_req)
2481 goto done;
2482
2483 switch (pi->mode) {
2484 case L2CAP_MODE_STREAMING:
2485 case L2CAP_MODE_ERTM:
2486 pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
2487 if (!l2cap_mode_supported(pi->mode, pi->conn->feat_mask))
2488 return -ECONNREFUSED;
2489 break;
2490 default:
2491 pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
2492 break;
2493 }
2494
2495done:
2496 if (pi->mode != rfc.mode) {
2497 result = L2CAP_CONF_UNACCEPT;
2498 rfc.mode = pi->mode;
2499
2500 if (pi->num_conf_rsp == 1)
2501 return -ECONNREFUSED;
2502
2503 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2504 sizeof(rfc), (unsigned long) &rfc);
2505 }
2506
2507
5dee9e7c
MH		 2508 if (result == L2CAP_CONF_SUCCESS) {
2509 /* Configure output options and let the other side know
2510 * which ones we don't like. */
2511
f2fcfcd6
GP		 2512 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2513 result = L2CAP_CONF_UNACCEPT;
2514 else {
2515 pi->omtu = mtu;
2516 pi->conf_state |= L2CAP_CONF_MTU_DONE;
2517 }
2518 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
6464f35f 2519
f2fcfcd6
GP		 2520 switch (rfc.mode) {
2521 case L2CAP_MODE_BASIC:
2522 pi->fcs = L2CAP_FCS_NONE;
2523 pi->conf_state |= L2CAP_CONF_MODE_DONE;
2524 break;
2525
2526 case L2CAP_MODE_ERTM:
2527 pi->remote_tx_win = rfc.txwin_size;
2528 pi->remote_max_tx = rfc.max_transmit;
1c762159
GP		 2529 if (rfc.max_pdu_size > pi->conn->mtu - 10)
2530 rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
2531
2532 pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6 2533
10467e9e
GP		 2534 rfc.retrans_timeout =
2535 le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
2536 rfc.monitor_timeout =
2537 le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6
GP		 2538
2539 pi->conf_state |= L2CAP_CONF_MODE_DONE;
68ae6639
GP		 2540
2541 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2542 sizeof(rfc), (unsigned long) &rfc);
2543
f2fcfcd6
GP		 2544 break;
2545
2546 case L2CAP_MODE_STREAMING:
1c762159
GP		 2547 if (rfc.max_pdu_size > pi->conn->mtu - 10)
2548 rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
2549
2550 pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2551
2552 pi->conf_state |= L2CAP_CONF_MODE_DONE;
68ae6639
GP		 2553
2554 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2555 sizeof(rfc), (unsigned long) &rfc);
2556
f2fcfcd6
GP		 2557 break;
2558
2559 default:
5dee9e7c 2560 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2561
6464f35f 2562 memset(&rfc, 0, sizeof(rfc));
f2fcfcd6
GP		 2563 rfc.mode = pi->mode;
2564 }
6464f35f 2565
f2fcfcd6
GP		 2566 if (result == L2CAP_CONF_SUCCESS)
2567 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
2568 }
5dee9e7c
MH		 2569 rsp->scid = cpu_to_le16(pi->dcid);
2570 rsp->result = cpu_to_le16(result);
2571 rsp->flags = cpu_to_le16(0x0000);
2572
2573 return ptr - data;
1da177e4
LT		 2574}
2575
f2fcfcd6
GP		 2576static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data, u16 *result)
2577{
2578 struct l2cap_pinfo *pi = l2cap_pi(sk);
2579 struct l2cap_conf_req *req = data;
2580 void *ptr = req->data;
2581 int type, olen;
2582 unsigned long val;
2583 struct l2cap_conf_rfc rfc;
2584
2585 BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
2586
2587 while (len >= L2CAP_CONF_OPT_SIZE) {
2588 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2589
2590 switch (type) {
2591 case L2CAP_CONF_MTU:
2592 if (val < L2CAP_DEFAULT_MIN_MTU) {
2593 *result = L2CAP_CONF_UNACCEPT;
2594 pi->omtu = L2CAP_DEFAULT_MIN_MTU;
2595 } else
2596 pi->omtu = val;
2597 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
2598 break;
2599
2600 case L2CAP_CONF_FLUSH_TO:
2601 pi->flush_to = val;
2602 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2603 2, pi->flush_to);
2604 break;
2605
2606 case L2CAP_CONF_RFC:
2607 if (olen == sizeof(rfc))
2608 memcpy(&rfc, (void *)val, olen);
2609
2610 if ((pi->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
2611 rfc.mode != pi->mode)
2612 return -ECONNREFUSED;
2613
2614 pi->mode = rfc.mode;
2615 pi->fcs = 0;
2616
2617 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2618 sizeof(rfc), (unsigned long) &rfc);
2619 break;
2620 }
2621 }
2622
2623 if (*result == L2CAP_CONF_SUCCESS) {
2624 switch (rfc.mode) {
2625 case L2CAP_MODE_ERTM:
2626 pi->remote_tx_win = rfc.txwin_size;
10467e9e
GP		 2627 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2628 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
1c762159 2629 pi->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2630 break;
2631 case L2CAP_MODE_STREAMING:
1c762159 2632 pi->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2633 }
2634 }
2635
2636 req->dcid = cpu_to_le16(pi->dcid);
2637 req->flags = cpu_to_le16(0x0000);
2638
2639 return ptr - data;
2640}
2641
5dee9e7c 2642static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1da177e4
LT		 2643{
2644 struct l2cap_conf_rsp *rsp = data;
2645 void *ptr = rsp->data;
1da177e4 2646
5dee9e7c 2647 BT_DBG("sk %p", sk);
1da177e4 2648
aca3192c 2649 rsp->scid = cpu_to_le16(l2cap_pi(sk)->dcid);
5dee9e7c 2650 rsp->result = cpu_to_le16(result);
aca3192c 2651 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2652
2653 return ptr - data;
2654}
2655
7b1c0049
GP		 2656static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
2657{
2658 struct l2cap_pinfo *pi = l2cap_pi(sk);
2659 int type, olen;
2660 unsigned long val;
2661 struct l2cap_conf_rfc rfc;
2662
2663 BT_DBG("sk %p, rsp %p, len %d", sk, rsp, len);
2664
2665 if ((pi->mode != L2CAP_MODE_ERTM) && (pi->mode != L2CAP_MODE_STREAMING))
2666 return;
2667
2668 while (len >= L2CAP_CONF_OPT_SIZE) {
2669 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2670
2671 switch (type) {
2672 case L2CAP_CONF_RFC:
2673 if (olen == sizeof(rfc))
2674 memcpy(&rfc, (void *)val, olen);
2675 goto done;
2676 }
2677 }
2678
2679done:
2680 switch (rfc.mode) {
2681 case L2CAP_MODE_ERTM:
2682 pi->remote_tx_win = rfc.txwin_size;
10467e9e
GP		 2683 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2684 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
7b1c0049
GP		 2685 pi->mps = le16_to_cpu(rfc.max_pdu_size);
2686 break;
2687 case L2CAP_MODE_STREAMING:
2688 pi->mps = le16_to_cpu(rfc.max_pdu_size);
2689 }
2690}
2691
4e8402a3
MH		 2692static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2693{
2694 struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
2695
2696 if (rej->reason != 0x0000)
2697 return 0;
2698
2699 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2700 cmd->ident == conn->info_ident) {
4e8402a3 2701 del_timer(&conn->info_timer);
984947dc
MH		 2702
2703 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2704 conn->info_ident = 0;
984947dc 2705
4e8402a3
MH		 2706 l2cap_conn_start(conn);
2707 }
2708
2709 return 0;
2710}
2711
1da177e4
LT		 2712static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2713{
2714 struct l2cap_chan_list *list = &conn->chan_list;
2715 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2716 struct l2cap_conn_rsp rsp;
2717 struct sock *sk, *parent;
e7c29cb1 2718 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2719
2720 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2721 __le16 psm = req->psm;
1da177e4
LT		 2722
2723 BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
2724
2725 /* Check if we have socket listening on psm */
2726 parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
2727 if (!parent) {
2728 result = L2CAP_CR_BAD_PSM;
2729 goto sendresp;
2730 }
2731
e7c29cb1
MH		 2732 /* Check if the ACL is secure enough (if not SDP) */
2733 if (psm != cpu_to_le16(0x0001) &&
2734 !hci_conn_check_link_mode(conn->hcon)) {
2950f21a 2735 conn->disc_reason = 0x05;
e7c29cb1
MH		 2736 result = L2CAP_CR_SEC_BLOCK;
2737 goto response;
2738 }
2739
1da177e4
LT		 2740 result = L2CAP_CR_NO_MEM;
2741
2742 /* Check for backlog size */
2743 if (sk_acceptq_is_full(parent)) {
8e87d142 2744 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2745 goto response;
2746 }
2747
3b1e0a65 2748 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1da177e4
LT		 2749 if (!sk)
2750 goto response;
2751
fd1278d7 2752 write_lock_bh(&list->lock);
1da177e4
LT		 2753
2754 /* Check if we already have channel with that dcid */
2755 if (__l2cap_get_chan_by_dcid(list, scid)) {
fd1278d7 2756 write_unlock_bh(&list->lock);
1da177e4
LT		 2757 sock_set_flag(sk, SOCK_ZAPPED);
2758 l2cap_sock_kill(sk);
2759 goto response;
2760 }
2761
2762 hci_conn_hold(conn->hcon);
2763
2764 l2cap_sock_init(sk, parent);
2765 bacpy(&bt_sk(sk)->src, conn->src);
2766 bacpy(&bt_sk(sk)->dst, conn->dst);
2767 l2cap_pi(sk)->psm = psm;
2768 l2cap_pi(sk)->dcid = scid;
2769
2770 __l2cap_chan_add(conn, sk, parent);
2771 dcid = l2cap_pi(sk)->scid;
2772
2773 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
2774
1da177e4
LT		 2775 l2cap_pi(sk)->ident = cmd->ident;
2776
984947dc 2777 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
2af6b9d5 2778 if (l2cap_check_security(sk)) {
f66dc81f
MH		 2779 if (bt_sk(sk)->defer_setup) {
2780 sk->sk_state = BT_CONNECT2;
2781 result = L2CAP_CR_PEND;
2782 status = L2CAP_CS_AUTHOR_PEND;
2783 parent->sk_data_ready(parent, 0);
2784 } else {
2785 sk->sk_state = BT_CONFIG;
2786 result = L2CAP_CR_SUCCESS;
2787 status = L2CAP_CS_NO_INFO;
2788 }
79d554a6
MH		 2789 } else {
2790 sk->sk_state = BT_CONNECT2;
2791 result = L2CAP_CR_PEND;
2792 status = L2CAP_CS_AUTHEN_PEND;
2793 }
2794 } else {
2795 sk->sk_state = BT_CONNECT2;
2796 result = L2CAP_CR_PEND;
2797 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2798 }
2799
fd1278d7 2800 write_unlock_bh(&list->lock);
1da177e4
LT		 2801
2802response:
2803 bh_unlock_sock(parent);
2804
2805sendresp:
aca3192c
YH		 2806 rsp.scid = cpu_to_le16(scid);
2807 rsp.dcid = cpu_to_le16(dcid);
2808 rsp.result = cpu_to_le16(result);
2809 rsp.status = cpu_to_le16(status);
1da177e4 2810 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 2811
2812 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
2813 struct l2cap_info_req info;
2814 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2815
2816 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
2817 conn->info_ident = l2cap_get_ident(conn);
2818
2819 mod_timer(&conn->info_timer, jiffies +
2820 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
2821
2822 l2cap_send_cmd(conn, conn->info_ident,
2823 L2CAP_INFO_REQ, sizeof(info), &info);
2824 }
2825
1da177e4
LT		 2826 return 0;
2827}
2828
2829static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2830{
2831 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
2832 u16 scid, dcid, result, status;
2833 struct sock *sk;
2834 u8 req[128];
2835
2836 scid = __le16_to_cpu(rsp->scid);
2837 dcid = __le16_to_cpu(rsp->dcid);
2838 result = __le16_to_cpu(rsp->result);
2839 status = __le16_to_cpu(rsp->status);
2840
2841 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
2842
2843 if (scid) {
af05b30b
GP		 2844 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2845 if (!sk)
1da177e4
LT		 2846 return 0;
2847 } else {
af05b30b
GP		 2848 sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
2849 if (!sk)
1da177e4
LT		 2850 return 0;
2851 }
2852
2853 switch (result) {
2854 case L2CAP_CR_SUCCESS:
2855 sk->sk_state = BT_CONFIG;
2856 l2cap_pi(sk)->ident = 0;
2857 l2cap_pi(sk)->dcid = dcid;
2858 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
2859
6a8d3010
MH		 2860 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
2861
1da177e4
LT		 2862 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2863 l2cap_build_conf_req(sk, req), req);
f2fcfcd6 2864 l2cap_pi(sk)->num_conf_req++;
1da177e4
LT		 2865 break;
2866
2867 case L2CAP_CR_PEND:
6a8d3010 2868 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1da177e4
LT		 2869 break;
2870
2871 default:
2872 l2cap_chan_del(sk, ECONNREFUSED);
2873 break;
2874 }
2875
2876 bh_unlock_sock(sk);
2877 return 0;
2878}
2879
88219a0f 2880static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 2881{
2882 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2883 u16 dcid, flags;
2884 u8 rsp[64];
2885 struct sock *sk;
5dee9e7c 2886 int len;
1da177e4
LT		 2887
2888 dcid = __le16_to_cpu(req->dcid);
2889 flags = __le16_to_cpu(req->flags);
2890
2891 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2892
af05b30b
GP		 2893 sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2894 if (!sk)
1da177e4
LT		 2895 return -ENOENT;
2896
354f60a9
MH		 2897 if (sk->sk_state == BT_DISCONN)
2898 goto unlock;
2899
5dee9e7c 2900 /* Reject if config buffer is too small. */
88219a0f 2901 len = cmd_len - sizeof(*req);
5dee9e7c
MH		 2902 if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
2903 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2904 l2cap_build_conf_rsp(sk, rsp,
2905 L2CAP_CONF_REJECT, flags), rsp);
2906 goto unlock;
2907 }
2908
2909 /* Store config. */
2910 memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
2911 l2cap_pi(sk)->conf_len += len;
1da177e4
LT		 2912
2913 if (flags & 0x0001) {
2914 /* Incomplete config. Send empty response. */
2915 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
5dee9e7c
MH		 2916 l2cap_build_conf_rsp(sk, rsp,
2917 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 2918 goto unlock;
2919 }
2920
2921 /* Complete config. */
5dee9e7c 2922 len = l2cap_parse_conf_req(sk, rsp);
f2fcfcd6 2923 if (len < 0) {
22121fc9 2924 l2cap_send_disconn_req(conn, sk);
1da177e4 2925 goto unlock;
f2fcfcd6 2926 }
1da177e4 2927
5dee9e7c 2928 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
f2fcfcd6 2929 l2cap_pi(sk)->num_conf_rsp++;
5dee9e7c 2930
5dee9e7c
MH		 2931 /* Reset config buffer. */
2932 l2cap_pi(sk)->conf_len = 0;
2933
876d9484
MH		 2934 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
2935 goto unlock;
2936
1da177e4 2937 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
f64f9e71
JP		 2938 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
2939 l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
fcc203c3
GP		 2940 l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
2941
1da177e4 2942 sk->sk_state = BT_CONNECTED;
e90bac06 2943
0565c1c2
GP		 2944 l2cap_pi(sk)->next_tx_seq = 0;
2945 l2cap_pi(sk)->expected_tx_seq = 0;
1c2acffb 2946 __skb_queue_head_init(TX_QUEUE(sk));
0565c1c2
GP		 2947 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
2948 l2cap_ertm_init(sk);
2949
1da177e4 2950 l2cap_chan_ready(sk);
876d9484
MH		 2951 goto unlock;
2952 }
2953
2954 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
79d554a6 2955 u8 buf[64];
1da177e4 2956 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
79d554a6 2957 l2cap_build_conf_req(sk, buf), buf);
f2fcfcd6 2958 l2cap_pi(sk)->num_conf_req++;
1da177e4
LT		 2959 }
2960
2961unlock:
2962 bh_unlock_sock(sk);
2963 return 0;
2964}
2965
2966static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2967{
2968 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2969 u16 scid, flags, result;
2970 struct sock *sk;
7b1c0049 2971 int len = cmd->len - sizeof(*rsp);
1da177e4
LT		 2972
2973 scid = __le16_to_cpu(rsp->scid);
2974 flags = __le16_to_cpu(rsp->flags);
2975 result = __le16_to_cpu(rsp->result);
2976
af05b30b
GP		 2977 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
2978 scid, flags, result);
1da177e4 2979
af05b30b
GP		 2980 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2981 if (!sk)
1da177e4
LT		 2982 return 0;
2983
2984 switch (result) {
2985 case L2CAP_CONF_SUCCESS:
7b1c0049 2986 l2cap_conf_rfc_get(sk, rsp->data, len);
1da177e4
LT		 2987 break;
2988
2989 case L2CAP_CONF_UNACCEPT:
f2fcfcd6 2990 if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 2991 char req[64];
2992
c2c77ec8
AE		 2993 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
2994 l2cap_send_disconn_req(conn, sk);
2995 goto done;
2996 }
2997
f2fcfcd6
GP		 2998 /* throw out any old stored conf requests */
2999 result = L2CAP_CONF_SUCCESS;
3000 len = l2cap_parse_conf_rsp(sk, rsp->data,
3001 len, req, &result);
3002 if (len < 0) {
22121fc9 3003 l2cap_send_disconn_req(conn, sk);
f2fcfcd6
GP		 3004 goto done;
3005 }
3006
3007 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3008 L2CAP_CONF_REQ, len, req);
3009 l2cap_pi(sk)->num_conf_req++;
3010 if (result != L2CAP_CONF_SUCCESS)
3011 goto done;
3012 break;
1da177e4
LT		 3013 }
3014
8e87d142 3015 default:
1da177e4 3016 sk->sk_state = BT_DISCONN;
b1235d79 3017 sk->sk_err = ECONNRESET;
1da177e4 3018 l2cap_sock_set_timer(sk, HZ * 5);
22121fc9 3019 l2cap_send_disconn_req(conn, sk);
1da177e4
LT		 3020 goto done;
3021 }
3022
3023 if (flags & 0x01)
3024 goto done;
3025
1da177e4
LT		 3026 l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
3027
3028 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
f64f9e71
JP		 3029 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
3030 l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
fcc203c3
GP		 3031 l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
3032
1da177e4 3033 sk->sk_state = BT_CONNECTED;
0565c1c2 3034 l2cap_pi(sk)->next_tx_seq = 0;
1c2acffb 3035 l2cap_pi(sk)->expected_tx_seq = 0;
1c2acffb 3036 __skb_queue_head_init(TX_QUEUE(sk));
0565c1c2
GP		 3037 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
3038 l2cap_ertm_init(sk);
3039
1da177e4
LT		 3040 l2cap_chan_ready(sk);
3041 }
3042
3043done:
3044 bh_unlock_sock(sk);
3045 return 0;
3046}
3047
3048static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3049{
3050 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3051 struct l2cap_disconn_rsp rsp;
3052 u16 dcid, scid;
3053 struct sock *sk;
3054
3055 scid = __le16_to_cpu(req->scid);
3056 dcid = __le16_to_cpu(req->dcid);
3057
3058 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3059
af05b30b
GP		 3060 sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
3061 if (!sk)
1da177e4
LT		 3062 return 0;
3063
aca3192c
YH		 3064 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
3065 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
1da177e4
LT		 3066 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3067
3068 sk->sk_shutdown = SHUTDOWN_MASK;
3069
1c2acffb 3070 skb_queue_purge(TX_QUEUE(sk));
0565c1c2
GP		 3071
3072 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
3073 skb_queue_purge(SREJ_QUEUE(sk));
3074 del_timer(&l2cap_pi(sk)->retrans_timer);
3075 del_timer(&l2cap_pi(sk)->monitor_timer);
c1b4f43b 3076 del_timer(&l2cap_pi(sk)->ack_timer);
0565c1c2 3077 }
1c2acffb 3078
1da177e4
LT		 3079 l2cap_chan_del(sk, ECONNRESET);
3080 bh_unlock_sock(sk);
3081
3082 l2cap_sock_kill(sk);
3083 return 0;
3084}
3085
3086static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3087{
3088 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3089 u16 dcid, scid;
3090 struct sock *sk;
3091
3092 scid = __le16_to_cpu(rsp->scid);
3093 dcid = __le16_to_cpu(rsp->dcid);
3094
3095 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3096
af05b30b
GP		 3097 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
3098 if (!sk)
1da177e4
LT		 3099 return 0;
3100
1c2acffb 3101 skb_queue_purge(TX_QUEUE(sk));
0565c1c2
GP		 3102
3103 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
3104 skb_queue_purge(SREJ_QUEUE(sk));
3105 del_timer(&l2cap_pi(sk)->retrans_timer);
3106 del_timer(&l2cap_pi(sk)->monitor_timer);
c1b4f43b 3107 del_timer(&l2cap_pi(sk)->ack_timer);
0565c1c2 3108 }
1c2acffb 3109
1da177e4
LT		 3110 l2cap_chan_del(sk, 0);
3111 bh_unlock_sock(sk);
3112
3113 l2cap_sock_kill(sk);
3114 return 0;
3115}
3116
3117static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3118{
3119 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3120 u16 type;
3121
3122 type = __le16_to_cpu(req->type);
3123
3124 BT_DBG("type 0x%4.4x", type);
3125
f0709e03
MH		 3126 if (type == L2CAP_IT_FEAT_MASK) {
3127 u8 buf[8];
44dd46de 3128 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3129 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3130 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3131 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
44dd46de 3132 if (enable_ertm)
fcc203c3
GP		 3133 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3134 | L2CAP_FEAT_FCS;
1b7bf4ed 3135 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3136 l2cap_send_cmd(conn, cmd->ident,
3137 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3138 } else if (type == L2CAP_IT_FIXED_CHAN) {
3139 u8 buf[12];
3140 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3141 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3142 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
3143 memcpy(buf + 4, l2cap_fixed_chan, 8);
3144 l2cap_send_cmd(conn, cmd->ident,
3145 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3146 } else {
3147 struct l2cap_info_rsp rsp;
3148 rsp.type = cpu_to_le16(type);
3149 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3150 l2cap_send_cmd(conn, cmd->ident,
3151 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3152 }
1da177e4
LT		 3153
3154 return 0;
3155}
3156
3157static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3158{
3159 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3160 u16 type, result;
3161
3162 type = __le16_to_cpu(rsp->type);
3163 result = __le16_to_cpu(rsp->result);
3164
3165 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3166
4e8402a3
MH		 3167 del_timer(&conn->info_timer);
3168
984947dc 3169 if (type == L2CAP_IT_FEAT_MASK) {
83985319 3170 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3171
47ec1dcd 3172 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3173 struct l2cap_info_req req;
3174 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3175
3176 conn->info_ident = l2cap_get_ident(conn);
3177
3178 l2cap_send_cmd(conn, conn->info_ident,
3179 L2CAP_INFO_REQ, sizeof(req), &req);
3180 } else {
3181 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3182 conn->info_ident = 0;
3183
3184 l2cap_conn_start(conn);
3185 }
3186 } else if (type == L2CAP_IT_FIXED_CHAN) {
984947dc 3187 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3188 conn->info_ident = 0;
984947dc
MH		 3189
3190 l2cap_conn_start(conn);
3191 }
4e8402a3 3192
1da177e4
LT		 3193 return 0;
3194}
3195
3196static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
3197{
3198 u8 *data = skb->data;
3199 int len = skb->len;
3200 struct l2cap_cmd_hdr cmd;
3201 int err = 0;
3202
3203 l2cap_raw_recv(conn, skb);
3204
3205 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3206 u16 cmd_len;
1da177e4
LT		 3207 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3208 data += L2CAP_CMD_HDR_SIZE;
3209 len -= L2CAP_CMD_HDR_SIZE;
3210
88219a0f 3211 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3212
88219a0f 3213 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3214
88219a0f 3215 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3216 BT_DBG("corrupted command");
3217 break;
3218 }
3219
3220 switch (cmd.code) {
3221 case L2CAP_COMMAND_REJ:
4e8402a3 3222 l2cap_command_rej(conn, &cmd, data);
1da177e4
LT		 3223 break;
3224
3225 case L2CAP_CONN_REQ:
3226 err = l2cap_connect_req(conn, &cmd, data);
3227 break;
3228
3229 case L2CAP_CONN_RSP:
3230 err = l2cap_connect_rsp(conn, &cmd, data);
3231 break;
3232
3233 case L2CAP_CONF_REQ:
88219a0f 3234 err = l2cap_config_req(conn, &cmd, cmd_len, data);
1da177e4
LT		 3235 break;
3236
3237 case L2CAP_CONF_RSP:
3238 err = l2cap_config_rsp(conn, &cmd, data);
3239 break;
3240
3241 case L2CAP_DISCONN_REQ:
3242 err = l2cap_disconnect_req(conn, &cmd, data);
3243 break;
3244
3245 case L2CAP_DISCONN_RSP:
3246 err = l2cap_disconnect_rsp(conn, &cmd, data);
3247 break;
3248
3249 case L2CAP_ECHO_REQ:
88219a0f 3250 l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
1da177e4
LT		 3251 break;
3252
3253 case L2CAP_ECHO_RSP:
3254 break;
3255
3256 case L2CAP_INFO_REQ:
3257 err = l2cap_information_req(conn, &cmd, data);
3258 break;
3259
3260 case L2CAP_INFO_RSP:
3261 err = l2cap_information_rsp(conn, &cmd, data);
3262 break;
3263
3264 default:
3265 BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
3266 err = -EINVAL;
3267 break;
3268 }
3269
3270 if (err) {
3271 struct l2cap_cmd_rej rej;
3272 BT_DBG("error %d", err);
3273
3274 /* FIXME: Map err to a valid reason */
aca3192c 3275 rej.reason = cpu_to_le16(0);
1da177e4
LT		 3276 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3277 }
3278
88219a0f
AV		 3279 data += cmd_len;
3280 len -= cmd_len;
1da177e4
LT		 3281 }
3282
3283 kfree_skb(skb);
3284}
3285
fcc203c3
GP		 3286static int l2cap_check_fcs(struct l2cap_pinfo *pi, struct sk_buff *skb)
3287{
3288 u16 our_fcs, rcv_fcs;
3289 int hdr_size = L2CAP_HDR_SIZE + 2;
3290
3291 if (pi->fcs == L2CAP_FCS_CRC16) {
3292 skb_trim(skb, skb->len - 2);
3293 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3294 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3295
3296 if (our_fcs != rcv_fcs)
3297 return -EINVAL;
3298 }
3299 return 0;
3300}
3301
d5392c8f
GP		 3302static inline void l2cap_send_i_or_rr_or_rnr(struct sock *sk)
3303{
3304 struct l2cap_pinfo *pi = l2cap_pi(sk);
3305 u16 control = 0;
3306
3307 pi->frames_sent = 0;
3308 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
3309
3310 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3311
3312 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
3313 control |= L2CAP_SUPER_RCV_NOT_READY | L2CAP_CTRL_FINAL;
3314 l2cap_send_sframe(pi, control);
3315 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
3316 }
3317
3318 if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY && pi->unacked_frames > 0)
3319 __mod_retrans_timer();
3320
3321 l2cap_ertm_send(sk);
3322
3323 if (!(pi->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
3324 pi->frames_sent == 0) {
3325 control |= L2CAP_SUPER_RCV_READY;
d5392c8f
GP		 3326 l2cap_send_sframe(pi, control);
3327 }
3328}
3329
8f17154f
GP		 3330static void l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
3331{
3332 struct sk_buff *next_skb;
3333
3334 bt_cb(skb)->tx_seq = tx_seq;
3335 bt_cb(skb)->sar = sar;
3336
3337 next_skb = skb_peek(SREJ_QUEUE(sk));
3338 if (!next_skb) {
3339 __skb_queue_tail(SREJ_QUEUE(sk), skb);
3340 return;
3341 }
3342
3343 do {
3344 if (bt_cb(next_skb)->tx_seq > tx_seq) {
3345 __skb_queue_before(SREJ_QUEUE(sk), next_skb, skb);
3346 return;
3347 }
3348
3349 if (skb_queue_is_last(SREJ_QUEUE(sk), next_skb))
3350 break;
3351
3352 } while((next_skb = skb_queue_next(SREJ_QUEUE(sk), next_skb)));
3353
3354 __skb_queue_tail(SREJ_QUEUE(sk), skb);
3355}
3356
c74e560c
GP		 3357static int l2cap_sar_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
3358{
3359 struct l2cap_pinfo *pi = l2cap_pi(sk);
3360 struct sk_buff *_skb;
3361 int err = -EINVAL;
3362
3363 switch (control & L2CAP_CTRL_SAR) {
3364 case L2CAP_SDU_UNSEGMENTED:
3365 if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
3366 kfree_skb(pi->sdu);
3367 break;
3368 }
3369
3370 err = sock_queue_rcv_skb(sk, skb);
3371 if (!err)
3372 return 0;
3373
3374 break;
3375
3376 case L2CAP_SDU_START:
3377 if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
3378 kfree_skb(pi->sdu);
3379 break;
3380 }
3381
3382 pi->sdu_len = get_unaligned_le16(skb->data);
3383 skb_pull(skb, 2);
3384
052897ca
GP		 3385 if (pi->sdu_len > pi->imtu) {
3386 err = -EMSGSIZE;
3387 break;
3388 }
3389
c74e560c
GP		 3390 pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
3391 if (!pi->sdu) {
3392 err = -ENOMEM;
3393 break;
3394 }
3395
3396 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3397
3398 pi->conn_state |= L2CAP_CONN_SAR_SDU;
3399 pi->partial_sdu_len = skb->len;
3400 err = 0;
3401 break;
3402
3403 case L2CAP_SDU_CONTINUE:
3404 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3405 break;
3406
3407 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3408
3409 pi->partial_sdu_len += skb->len;
3410 if (pi->partial_sdu_len > pi->sdu_len)
3411 kfree_skb(pi->sdu);
3412 else
3413 err = 0;
3414
3415 break;
3416
3417 case L2CAP_SDU_END:
3418 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3419 break;
3420
3421 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3422
3423 pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
3424 pi->partial_sdu_len += skb->len;
3425
36f2fd58
GP		 3426 if (pi->partial_sdu_len > pi->imtu)
3427 goto drop;
3428
c74e560c
GP		 3429 if (pi->partial_sdu_len == pi->sdu_len) {
3430 _skb = skb_clone(pi->sdu, GFP_ATOMIC);
3431 err = sock_queue_rcv_skb(sk, _skb);
3432 if (err < 0)
3433 kfree_skb(_skb);
3434 }
c74e560c
GP		 3435 err = 0;
3436
36f2fd58
GP		 3437drop:
3438 kfree_skb(pi->sdu);
c74e560c
GP		 3439 break;
3440 }
3441
3442 kfree_skb(skb);
3443 return err;
3444}
3445
8f17154f
GP		 3446static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
3447{
3448 struct sk_buff *skb;
afefdbc4 3449 u16 control;
8f17154f
GP		 3450
3451 while((skb = skb_peek(SREJ_QUEUE(sk)))) {
3452 if (bt_cb(skb)->tx_seq != tx_seq)
3453 break;
3454
3455 skb = skb_dequeue(SREJ_QUEUE(sk));
afefdbc4 3456 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
8f17154f
GP		 3457 l2cap_sar_reassembly_sdu(sk, skb, control);
3458 l2cap_pi(sk)->buffer_seq_srej =
3459 (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
3460 tx_seq++;
3461 }
3462}
3463
3464static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
3465{
3466 struct l2cap_pinfo *pi = l2cap_pi(sk);
3467 struct srej_list *l, *tmp;
3468 u16 control;
3469
3470 list_for_each_entry_safe(l,tmp, SREJ_LIST(sk), list) {
3471 if (l->tx_seq == tx_seq) {
3472 list_del(&l->list);
3473 kfree(l);
3474 return;
3475 }
3476 control = L2CAP_SUPER_SELECT_REJECT;
3477 control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3478 l2cap_send_sframe(pi, control);
3479 list_del(&l->list);
3480 list_add_tail(&l->list, SREJ_LIST(sk));
3481 }
3482}
3483
3484static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
3485{
3486 struct l2cap_pinfo *pi = l2cap_pi(sk);
3487 struct srej_list *new;
3488 u16 control;
3489
3490 while (tx_seq != pi->expected_tx_seq) {
3491 control = L2CAP_SUPER_SELECT_REJECT;
3492 control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3493 l2cap_send_sframe(pi, control);
3494
3495 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
3496 new->tx_seq = pi->expected_tx_seq++;
3497 list_add_tail(&new->list, SREJ_LIST(sk));
3498 }
3499 pi->expected_tx_seq++;
3500}
3501
1c2acffb
GP		 3502static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
3503{
3504 struct l2cap_pinfo *pi = l2cap_pi(sk);
3505 u8 tx_seq = __get_txseq(rx_control);
9f121a5a 3506 u8 req_seq = __get_reqseq(rx_control);
8f17154f 3507 u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
803020c6 3508 int num_to_ack = (pi->tx_win/6) + 1;
1c2acffb
GP		 3509 int err = 0;
3510
3511 BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
3512
1d8f5d16
GP		 3513 if (L2CAP_CTRL_FINAL & rx_control) {
3514 del_timer(&pi->monitor_timer);
3515 if (pi->unacked_frames > 0)
3516 __mod_retrans_timer();
3517 pi->conn_state &= ~L2CAP_CONN_WAIT_F;
3518 }
3519
9f121a5a
GP		 3520 pi->expected_ack_seq = req_seq;
3521 l2cap_drop_acked_frames(sk);
3522
8f17154f
GP		 3523 if (tx_seq == pi->expected_tx_seq)
3524 goto expected;
1c2acffb 3525
8f17154f
GP		 3526 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3527 struct srej_list *first;
30afb5b2 3528
8f17154f
GP		 3529 first = list_first_entry(SREJ_LIST(sk),
3530 struct srej_list, list);
3531 if (tx_seq == first->tx_seq) {
3532 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
3533 l2cap_check_srej_gap(sk, tx_seq);
3534
3535 list_del(&first->list);
3536 kfree(first);
3537
3538 if (list_empty(SREJ_LIST(sk))) {
3539 pi->buffer_seq = pi->buffer_seq_srej;
3540 pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
855666cc 3541 l2cap_send_ack(pi);
8f17154f
GP		 3542 }
3543 } else {
3544 struct srej_list *l;
3545 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
3546
3547 list_for_each_entry(l, SREJ_LIST(sk), list) {
3548 if (l->tx_seq == tx_seq) {
3549 l2cap_resend_srejframe(sk, tx_seq);
3550 return 0;
3551 }
3552 }
3553 l2cap_send_srejframe(sk, tx_seq);
30afb5b2
GP		 3554 }
3555 } else {
8f17154f 3556 pi->conn_state |= L2CAP_CONN_SREJ_SENT;
1c2acffb 3557
8f17154f
GP		 3558 INIT_LIST_HEAD(SREJ_LIST(sk));
3559 pi->buffer_seq_srej = pi->buffer_seq;
3560
3561 __skb_queue_head_init(SREJ_QUEUE(sk));
3562 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
3563
ef54fd93
GP		 3564 pi->conn_state |= L2CAP_CONN_SEND_PBIT;
3565
8f17154f 3566 l2cap_send_srejframe(sk, tx_seq);
1c2acffb 3567 }
30afb5b2
GP		 3568 return 0;
3569
8f17154f
GP		 3570expected:
3571 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
3572
3573 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3b1a9f3f
GP		 3574 bt_cb(skb)->tx_seq = tx_seq;
3575 bt_cb(skb)->sar = sar;
3576 __skb_queue_tail(SREJ_QUEUE(sk), skb);
8f17154f
GP		 3577 return 0;
3578 }
3579
4ec10d97
GP		 3580 if (rx_control & L2CAP_CTRL_FINAL) {
3581 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
3582 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
3583 else {
f6e6b168
GP		 3584 if (!skb_queue_empty(TX_QUEUE(sk)))
3585 sk->sk_send_head = TX_QUEUE(sk)->next;
4ec10d97
GP		 3586 pi->next_tx_seq = pi->expected_ack_seq;
3587 l2cap_ertm_send(sk);
3588 }
3589 }
3590
8f17154f
GP		 3591 pi->buffer_seq = (pi->buffer_seq + 1) % 64;
3592
3593 err = l2cap_sar_reassembly_sdu(sk, skb, rx_control);
3594 if (err < 0)
3595 return err;
3596
c1b4f43b
GP		 3597 __mod_ack_timer();
3598
803020c6
GP		 3599 pi->num_acked = (pi->num_acked + 1) % num_to_ack;
3600 if (pi->num_acked == num_to_ack - 1)
9e917af1
GP		 3601 l2cap_send_ack(pi);
3602
8f17154f 3603 return 0;
1c2acffb
GP		 3604}
3605
e072745f 3606static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
1c2acffb
GP		 3607{
3608 struct l2cap_pinfo *pi = l2cap_pi(sk);
6e3a5981
GP		 3609
3610 pi->expected_ack_seq = __get_reqseq(rx_control);
3611 l2cap_drop_acked_frames(sk);
1c2acffb 3612
e072745f 3613 if (rx_control & L2CAP_CTRL_POLL) {
05fbd89d
GP		 3614 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3615 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
3616 (pi->unacked_frames > 0))
3617 __mod_retrans_timer();
3618
3619 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
3620 l2cap_send_srejtail(sk);
3621 } else {
3622 l2cap_send_i_or_rr_or_rnr(sk);
3623 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
3624 }
1d8f5d16 3625
e072745f
GP		 3626 } else if (rx_control & L2CAP_CTRL_FINAL) {
3627 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
4ec10d97 3628
e072745f
GP		 3629 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
3630 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
3631 else {
f6e6b168
GP		 3632 if (!skb_queue_empty(TX_QUEUE(sk)))
3633 sk->sk_send_head = TX_QUEUE(sk)->next;
e072745f
GP		 3634 pi->next_tx_seq = pi->expected_ack_seq;
3635 l2cap_ertm_send(sk);
3636 }
2246b2f1 3637
e072745f 3638 } else {
e072745f
GP		 3639 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
3640 (pi->unacked_frames > 0))
3641 __mod_retrans_timer();
1c2acffb 3642
2246b2f1 3643 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
e072745f
GP		 3644 if (pi->conn_state & L2CAP_CONN_SREJ_SENT)
3645 l2cap_send_ack(pi);
3646 else
3647 l2cap_ertm_send(sk);
3648 }
3649}
2246b2f1 3650
e072745f
GP		 3651static inline void l2cap_data_channel_rejframe(struct sock *sk, u16 rx_control)
3652{
3653 struct l2cap_pinfo *pi = l2cap_pi(sk);
3654 u8 tx_seq = __get_reqseq(rx_control);
30afb5b2 3655
e072745f
GP		 3656 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
3657
8abb52ee 3658 pi->expected_ack_seq = tx_seq;
e072745f
GP		 3659 l2cap_drop_acked_frames(sk);
3660
3661 if (rx_control & L2CAP_CTRL_FINAL) {
3662 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
3663 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
3664 else {
f6e6b168
GP		 3665 if (!skb_queue_empty(TX_QUEUE(sk)))
3666 sk->sk_send_head = TX_QUEUE(sk)->next;
4ec10d97
GP		 3667 pi->next_tx_seq = pi->expected_ack_seq;
3668 l2cap_ertm_send(sk);
4ec10d97 3669 }
e072745f 3670 } else {
f6e6b168
GP		 3671 if (!skb_queue_empty(TX_QUEUE(sk)))
3672 sk->sk_send_head = TX_QUEUE(sk)->next;
e072745f
GP		 3673 pi->next_tx_seq = pi->expected_ack_seq;
3674 l2cap_ertm_send(sk);
30afb5b2 3675
e072745f
GP		 3676 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
3677 pi->srej_save_reqseq = tx_seq;
3678 pi->conn_state |= L2CAP_CONN_REJ_ACT;
3679 }
3680 }
3681}
3682static inline void l2cap_data_channel_srejframe(struct sock *sk, u16 rx_control)
3683{
3684 struct l2cap_pinfo *pi = l2cap_pi(sk);
3685 u8 tx_seq = __get_reqseq(rx_control);
30afb5b2 3686
e072745f 3687 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
2246b2f1 3688
e072745f
GP		 3689 if (rx_control & L2CAP_CTRL_POLL) {
3690 pi->expected_ack_seq = tx_seq;
3691 l2cap_drop_acked_frames(sk);
3692 l2cap_retransmit_frame(sk, tx_seq);
3693 l2cap_ertm_send(sk);
3694 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
3695 pi->srej_save_reqseq = tx_seq;
3696 pi->conn_state |= L2CAP_CONN_SREJ_ACT;
ef54fd93 3697 }
e072745f
GP		 3698 } else if (rx_control & L2CAP_CTRL_FINAL) {
3699 if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
3700 pi->srej_save_reqseq == tx_seq)
3701 pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
3702 else
ef54fd93 3703 l2cap_retransmit_frame(sk, tx_seq);
e072745f
GP		 3704 } else {
3705 l2cap_retransmit_frame(sk, tx_seq);
3706 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
3707 pi->srej_save_reqseq = tx_seq;
3708 pi->conn_state |= L2CAP_CONN_SREJ_ACT;
ef54fd93 3709 }
e072745f
GP		 3710 }
3711}
3712
3713static inline void l2cap_data_channel_rnrframe(struct sock *sk, u16 rx_control)
3714{
3715 struct l2cap_pinfo *pi = l2cap_pi(sk);
3716 u8 tx_seq = __get_reqseq(rx_control);
3717
3718 pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
3719 pi->expected_ack_seq = tx_seq;
3720 l2cap_drop_acked_frames(sk);
3721
99b0d4b7
GP		 3722 if (!(pi->conn_state & L2CAP_CONN_SREJ_SENT)) {
3723 del_timer(&pi->retrans_timer);
3724 if (rx_control & L2CAP_CTRL_POLL) {
3725 u16 control = L2CAP_CTRL_FINAL;
3726 l2cap_send_rr_or_rnr(pi, control);
3727 }
3728 return;
e072745f 3729 }
99b0d4b7
GP		 3730
3731 if (rx_control & L2CAP_CTRL_POLL)
3732 l2cap_send_srejtail(sk);
3733 else
3734 l2cap_send_sframe(pi, L2CAP_SUPER_RCV_READY);
e072745f
GP		 3735}
3736
3737static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
3738{
3739 BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
3740
3741 if (L2CAP_CTRL_FINAL & rx_control) {
3742 del_timer(&l2cap_pi(sk)->monitor_timer);
3743 if (l2cap_pi(sk)->unacked_frames > 0)
3744 __mod_retrans_timer();
3745 l2cap_pi(sk)->conn_state &= ~L2CAP_CONN_WAIT_F;
3746 }
3747
3748 switch (rx_control & L2CAP_CTRL_SUPERVISE) {
3749 case L2CAP_SUPER_RCV_READY:
3750 l2cap_data_channel_rrframe(sk, rx_control);
8f17154f
GP		 3751 break;
3752
e072745f
GP		 3753 case L2CAP_SUPER_REJECT:
3754 l2cap_data_channel_rejframe(sk, rx_control);
3755 break;
2246b2f1 3756
e072745f
GP		 3757 case L2CAP_SUPER_SELECT_REJECT:
3758 l2cap_data_channel_srejframe(sk, rx_control);
3759 break;
3760
3761 case L2CAP_SUPER_RCV_NOT_READY:
3762 l2cap_data_channel_rnrframe(sk, rx_control);
1c2acffb
GP		 3763 break;
3764 }
3765
faaebd19 3766 kfree_skb(skb);
1c2acffb
GP		 3767 return 0;
3768}
3769
1da177e4
LT		 3770static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
3771{
3772 struct sock *sk;
6840ed07 3773 struct l2cap_pinfo *pi;
c74e560c 3774 u16 control, len;
6840ed07 3775 u8 tx_seq;
1da177e4
LT		 3776
3777 sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
3778 if (!sk) {
3779 BT_DBG("unknown cid 0x%4.4x", cid);
3780 goto drop;
3781 }
3782
6840ed07
GP		 3783 pi = l2cap_pi(sk);
3784
1da177e4
LT		 3785 BT_DBG("sk %p, len %d", sk, skb->len);
3786
3787 if (sk->sk_state != BT_CONNECTED)
3788 goto drop;
3789
6840ed07 3790 switch (pi->mode) {
1c2acffb
GP		 3791 case L2CAP_MODE_BASIC:
3792 /* If socket recv buffers overflows we drop data here
3793 * which is *bad* because L2CAP has to be reliable.
3794 * But we don't have any other choice. L2CAP doesn't
3795 * provide flow control mechanism. */
1da177e4 3796
6840ed07 3797 if (pi->imtu < skb->len)
1c2acffb 3798 goto drop;
1da177e4 3799
1c2acffb
GP		 3800 if (!sock_queue_rcv_skb(sk, skb))
3801 goto done;
3802 break;
3803
3804 case L2CAP_MODE_ERTM:
3805 control = get_unaligned_le16(skb->data);
3806 skb_pull(skb, 2);
c74e560c 3807 len = skb->len;
1c2acffb 3808
c74e560c
GP		 3809 if (__is_sar_start(control))
3810 len -= 2;
3811
fcc203c3
GP		 3812 if (pi->fcs == L2CAP_FCS_CRC16)
3813 len -= 2;
3814
30afb5b2
GP		 3815 /*
3816 * We can just drop the corrupted I-frame here.
3817 * Receiver will miss it and start proper recovery
3818 * procedures and ask retransmission.
3819 */
1c762159 3820 if (len > pi->mps)
1c2acffb
GP		 3821 goto drop;
3822
fcc203c3
GP		 3823 if (l2cap_check_fcs(pi, skb))
3824 goto drop;
3825
277ffbe3
GP		 3826 if (__is_iframe(control)) {
3827 if (len < 4)
3828 goto drop;
3829
fcafde2e 3830 l2cap_data_channel_iframe(sk, control, skb);
277ffbe3
GP		 3831 } else {
3832 if (len != 0)
3833 goto drop;
3834
fcafde2e 3835 l2cap_data_channel_sframe(sk, control, skb);
277ffbe3 3836 }
1c2acffb 3837
fcafde2e 3838 goto done;
1c2acffb 3839
6840ed07
GP		 3840 case L2CAP_MODE_STREAMING:
3841 control = get_unaligned_le16(skb->data);
3842 skb_pull(skb, 2);
3843 len = skb->len;
3844
3845 if (__is_sar_start(control))
3846 len -= 2;
3847
fcc203c3
GP		 3848 if (pi->fcs == L2CAP_FCS_CRC16)
3849 len -= 2;
3850
1c762159 3851 if (len > pi->mps || len < 4 || __is_sframe(control))
6840ed07
GP		 3852 goto drop;
3853
fcc203c3
GP		 3854 if (l2cap_check_fcs(pi, skb))
3855 goto drop;
3856
6840ed07
GP		 3857 tx_seq = __get_txseq(control);
3858
3859 if (pi->expected_tx_seq == tx_seq)
3860 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
3861 else
7dffe421 3862 pi->expected_tx_seq = (tx_seq + 1) % 64;
6840ed07 3863
fcafde2e 3864 l2cap_sar_reassembly_sdu(sk, skb, control);
6840ed07
GP		 3865
3866 goto done;
3867
1c2acffb 3868 default:
e8235c6b 3869 BT_DBG("sk %p: bad mode 0x%2.2x", sk, pi->mode);
1c2acffb
GP		 3870 break;
3871 }
1da177e4
LT		 3872
3873drop:
3874 kfree_skb(skb);
3875
3876done:
0139418c
MH		 3877 if (sk)
3878 bh_unlock_sock(sk);
3879
1da177e4
LT		 3880 return 0;
3881}
3882
8e036fc3 3883static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4
LT		 3884{
3885 struct sock *sk;
3886
3887 sk = l2cap_get_sock_by_psm(0, psm, conn->src);
3888 if (!sk)
3889 goto drop;
3890
3891 BT_DBG("sk %p, len %d", sk, skb->len);
3892
3893 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
3894 goto drop;
3895
3896 if (l2cap_pi(sk)->imtu < skb->len)
3897 goto drop;
3898
3899 if (!sock_queue_rcv_skb(sk, skb))
3900 goto done;
3901
3902drop:
3903 kfree_skb(skb);
3904
3905done:
af05b30b
GP		 3906 if (sk)
3907 bh_unlock_sock(sk);
1da177e4
LT		 3908 return 0;
3909}
3910
3911static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
3912{
3913 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 3914 u16 cid, len;
3915 __le16 psm;
1da177e4
LT		 3916
3917 skb_pull(skb, L2CAP_HDR_SIZE);
3918 cid = __le16_to_cpu(lh->cid);
3919 len = __le16_to_cpu(lh->len);
3920
1c2acffb
GP		 3921 if (len != skb->len) {
3922 kfree_skb(skb);
3923 return;
3924 }
3925
1da177e4
LT		 3926 BT_DBG("len %d, cid 0x%4.4x", len, cid);
3927
3928 switch (cid) {
8db4dc46 3929 case L2CAP_CID_SIGNALING:
1da177e4
LT		 3930 l2cap_sig_channel(conn, skb);
3931 break;
3932
8db4dc46 3933 case L2CAP_CID_CONN_LESS:
1b7bf4ed 3934 psm = get_unaligned_le16(skb->data);
1da177e4
LT		 3935 skb_pull(skb, 2);
3936 l2cap_conless_channel(conn, psm, skb);
3937 break;
3938
3939 default:
3940 l2cap_data_channel(conn, cid, skb);
3941 break;
3942 }
3943}
3944
3945/* ---- L2CAP interface with lower layer (HCI) ---- */
3946
3947static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3948{
3949 int exact = 0, lm1 = 0, lm2 = 0;
3950 register struct sock *sk;
3951 struct hlist_node *node;
3952
3953 if (type != ACL_LINK)
3954 return 0;
3955
3956 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
3957
3958 /* Find listening sockets and check their link_mode */
3959 read_lock(&l2cap_sk_list.lock);
3960 sk_for_each(sk, node, &l2cap_sk_list.head) {
3961 if (sk->sk_state != BT_LISTEN)
3962 continue;
3963
3964 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5
MH		 3965 lm1 |= HCI_LM_ACCEPT;
3966 if (l2cap_pi(sk)->role_switch)
3967 lm1 |= HCI_LM_MASTER;
1da177e4 3968 exact++;
2af6b9d5
MH		 3969 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
3970 lm2 |= HCI_LM_ACCEPT;
3971 if (l2cap_pi(sk)->role_switch)
3972 lm2 |= HCI_LM_MASTER;
3973 }
1da177e4
LT		 3974 }
3975 read_unlock(&l2cap_sk_list.lock);
3976
3977 return exact ? lm1 : lm2;
3978}
3979
3980static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
3981{
0139418c
MH		 3982 struct l2cap_conn *conn;
3983
1da177e4
LT		 3984 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
3985
3986 if (hcon->type != ACL_LINK)
3987 return 0;
3988
3989 if (!status) {
1da177e4
LT		 3990 conn = l2cap_conn_add(hcon, status);
3991 if (conn)
3992 l2cap_conn_ready(conn);
0139418c 3993 } else
1da177e4
LT		 3994 l2cap_conn_del(hcon, bt_err(status));
3995
3996 return 0;
3997}
3998
2950f21a
MH		 3999static int l2cap_disconn_ind(struct hci_conn *hcon)
4000{
4001 struct l2cap_conn *conn = hcon->l2cap_data;
4002
4003 BT_DBG("hcon %p", hcon);
4004
4005 if (hcon->type != ACL_LINK || !conn)
4006 return 0x13;
4007
4008 return conn->disc_reason;
4009}
4010
4011static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4012{
4013 BT_DBG("hcon %p reason %d", hcon, reason);
4014
4015 if (hcon->type != ACL_LINK)
4016 return 0;
4017
4018 l2cap_conn_del(hcon, bt_err(reason));
0139418c 4019
1da177e4
LT		 4020 return 0;
4021}
4022
f62e4323
MH		 4023static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
4024{
bd3c9e25 4025 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
255c7601
MH		 4026 return;
4027
f62e4323
MH		 4028 if (encrypt == 0x00) {
4029 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
4030 l2cap_sock_clear_timer(sk);
4031 l2cap_sock_set_timer(sk, HZ * 5);
4032 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
4033 __l2cap_sock_close(sk, ECONNREFUSED);
4034 } else {
4035 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
4036 l2cap_sock_clear_timer(sk);
4037 }
4038}
4039
8c1b2355 4040static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4
LT		 4041{
4042 struct l2cap_chan_list *l;
0139418c 4043 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4 4044 struct sock *sk;
1da177e4 4045
0139418c 4046 if (!conn)
1da177e4 4047 return 0;
0139418c 4048
1da177e4
LT		 4049 l = &conn->chan_list;
4050
4051 BT_DBG("conn %p", conn);
4052
4053 read_lock(&l->lock);
4054
4055 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
4056 bh_lock_sock(sk);
4057
6a8d3010
MH		 4058 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
4059 bh_unlock_sock(sk);
4060 continue;
4061 }
4062
f62e4323 4063 if (!status && (sk->sk_state == BT_CONNECTED ||
8c1b2355 4064 sk->sk_state == BT_CONFIG)) {
f62e4323 4065 l2cap_check_encryption(sk, encrypt);
9719f8af
MH		 4066 bh_unlock_sock(sk);
4067 continue;
4068 }
4069
b1235d79
MH		 4070 if (sk->sk_state == BT_CONNECT) {
4071 if (!status) {
4072 struct l2cap_conn_req req;
4073 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
4074 req.psm = l2cap_pi(sk)->psm;
1da177e4 4075
b1235d79 4076 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
1da177e4 4077
b1235d79
MH		 4078 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
4079 L2CAP_CONN_REQ, sizeof(req), &req);
4080 } else {
4081 l2cap_sock_clear_timer(sk);
4082 l2cap_sock_set_timer(sk, HZ / 10);
4083 }
4084 } else if (sk->sk_state == BT_CONNECT2) {
4085 struct l2cap_conn_rsp rsp;
4086 __u16 result;
1da177e4 4087
b1235d79
MH		 4088 if (!status) {
4089 sk->sk_state = BT_CONFIG;
4090 result = L2CAP_CR_SUCCESS;
4091 } else {
4092 sk->sk_state = BT_DISCONN;
4093 l2cap_sock_set_timer(sk, HZ / 10);
4094 result = L2CAP_CR_SEC_BLOCK;
4095 }
4096
4097 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
4098 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
4099 rsp.result = cpu_to_le16(result);
e7c29cb1 4100 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
b1235d79
MH		 4101 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
4102 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
4103 }
1da177e4
LT		 4104
4105 bh_unlock_sock(sk);
4106 }
4107
4108 read_unlock(&l->lock);
b1235d79 4109
1da177e4
LT		 4110 return 0;
4111}
4112
4113static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
4114{
4115 struct l2cap_conn *conn = hcon->l2cap_data;
4116
4117 if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
4118 goto drop;
4119
4120 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4121
4122 if (flags & ACL_START) {
4123 struct l2cap_hdr *hdr;
4124 int len;
4125
4126 if (conn->rx_len) {
4127 BT_ERR("Unexpected start frame (len %d)", skb->len);
4128 kfree_skb(conn->rx_skb);
4129 conn->rx_skb = NULL;
4130 conn->rx_len = 0;
4131 l2cap_conn_unreliable(conn, ECOMM);
4132 }
4133
4134 if (skb->len < 2) {
4135 BT_ERR("Frame is too short (len %d)", skb->len);
4136 l2cap_conn_unreliable(conn, ECOMM);
4137 goto drop;
4138 }
4139
4140 hdr = (struct l2cap_hdr *) skb->data;
4141 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
4142
4143 if (len == skb->len) {
4144 /* Complete frame received */
4145 l2cap_recv_frame(conn, skb);
4146 return 0;
4147 }
4148
4149 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
4150
4151 if (skb->len > len) {
4152 BT_ERR("Frame is too long (len %d, expected len %d)",
4153 skb->len, len);
4154 l2cap_conn_unreliable(conn, ECOMM);
4155 goto drop;
4156 }
4157
4158 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 4159 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
4160 if (!conn->rx_skb)
1da177e4
LT		 4161 goto drop;
4162
d626f62b 4163 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4164 skb->len);
1da177e4
LT		 4165 conn->rx_len = len - skb->len;
4166 } else {
4167 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
4168
4169 if (!conn->rx_len) {
4170 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
4171 l2cap_conn_unreliable(conn, ECOMM);
4172 goto drop;
4173 }
4174
4175 if (skb->len > conn->rx_len) {
4176 BT_ERR("Fragment is too long (len %d, expected %d)",
4177 skb->len, conn->rx_len);
4178 kfree_skb(conn->rx_skb);
4179 conn->rx_skb = NULL;
4180 conn->rx_len = 0;
4181 l2cap_conn_unreliable(conn, ECOMM);
4182 goto drop;
4183 }
4184
d626f62b 4185 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4186 skb->len);
1da177e4
LT		 4187 conn->rx_len -= skb->len;
4188
4189 if (!conn->rx_len) {
4190 /* Complete frame received */
4191 l2cap_recv_frame(conn, conn->rx_skb);
4192 conn->rx_skb = NULL;
4193 }
4194 }
4195
4196drop:
4197 kfree_skb(skb);
4198 return 0;
4199}
4200
aef7d97c 4201static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4
LT		 4202{
4203 struct sock *sk;
4204 struct hlist_node *node;
1da177e4
LT		 4205
4206 read_lock_bh(&l2cap_sk_list.lock);
4207
be9d1227
MH		 4208 sk_for_each(sk, node, &l2cap_sk_list.head) {
4209 struct l2cap_pinfo *pi = l2cap_pi(sk);
101545f6 4210
aef7d97c
MH		 4211 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
4212 batostr(&bt_sk(sk)->src),
4213 batostr(&bt_sk(sk)->dst),
4214 sk->sk_state, __le16_to_cpu(pi->psm),
4215 pi->scid, pi->dcid,
4216 pi->imtu, pi->omtu, pi->sec_level);
be9d1227 4217 }
1da177e4 4218
1da177e4 4219 read_unlock_bh(&l2cap_sk_list.lock);
1da177e4 4220
aef7d97c 4221 return 0;
1da177e4
LT		 4222}
4223
aef7d97c
MH		 4224static int l2cap_debugfs_open(struct inode *inode, struct file *file)
4225{
4226 return single_open(file, l2cap_debugfs_show, inode->i_private);
4227}
4228
4229static const struct file_operations l2cap_debugfs_fops = {
4230 .open = l2cap_debugfs_open,
4231 .read = seq_read,
4232 .llseek = seq_lseek,
4233 .release = single_release,
4234};
4235
4236static struct dentry *l2cap_debugfs;
1da177e4 4237
90ddc4f0 4238static const struct proto_ops l2cap_sock_ops = {
1da177e4
LT		 4239 .family = PF_BLUETOOTH,
4240 .owner = THIS_MODULE,
4241 .release = l2cap_sock_release,
4242 .bind = l2cap_sock_bind,
4243 .connect = l2cap_sock_connect,
4244 .listen = l2cap_sock_listen,
4245 .accept = l2cap_sock_accept,
4246 .getname = l2cap_sock_getname,
4247 .sendmsg = l2cap_sock_sendmsg,
f66dc81f 4248 .recvmsg = l2cap_sock_recvmsg,
1da177e4 4249 .poll = bt_sock_poll,
3241ad82 4250 .ioctl = bt_sock_ioctl,
1da177e4
LT		 4251 .mmap = sock_no_mmap,
4252 .socketpair = sock_no_socketpair,
1da177e4
LT		 4253 .shutdown = l2cap_sock_shutdown,
4254 .setsockopt = l2cap_sock_setsockopt,
4255 .getsockopt = l2cap_sock_getsockopt
4256};
4257
ec1b4cf7 4258static const struct net_proto_family l2cap_sock_family_ops = {
1da177e4
LT		 4259 .family = PF_BLUETOOTH,
4260 .owner = THIS_MODULE,
4261 .create = l2cap_sock_create,
4262};
4263
4264static struct hci_proto l2cap_hci_proto = {
4265 .name = "L2CAP",
4266 .id = HCI_PROTO_L2CAP,
4267 .connect_ind = l2cap_connect_ind,
4268 .connect_cfm = l2cap_connect_cfm,
4269 .disconn_ind = l2cap_disconn_ind,
2950f21a 4270 .disconn_cfm = l2cap_disconn_cfm,
8c1b2355 4271 .security_cfm = l2cap_security_cfm,
1da177e4
LT		 4272 .recv_acldata = l2cap_recv_acldata
4273};
4274
4275static int __init l2cap_init(void)
4276{
4277 int err;
be9d1227 4278
1da177e4
LT		 4279 err = proto_register(&l2cap_proto, 0);
4280 if (err < 0)
4281 return err;
4282
4283 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
4284 if (err < 0) {
4285 BT_ERR("L2CAP socket registration failed");
4286 goto error;
4287 }
4288
4289 err = hci_register_proto(&l2cap_hci_proto);
4290 if (err < 0) {
4291 BT_ERR("L2CAP protocol registration failed");
4292 bt_sock_unregister(BTPROTO_L2CAP);
4293 goto error;
4294 }
4295
aef7d97c
MH		 4296 if (bt_debugfs) {
4297 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
4298 bt_debugfs, NULL, &l2cap_debugfs_fops);
4299 if (!l2cap_debugfs)
4300 BT_ERR("Failed to create L2CAP debug file");
4301 }
1da177e4
LT		 4302
4303 BT_INFO("L2CAP ver %s", VERSION);
4304 BT_INFO("L2CAP socket layer initialized");
4305
4306 return 0;
4307
4308error:
4309 proto_unregister(&l2cap_proto);
4310 return err;
4311}
4312
4313static void __exit l2cap_exit(void)
4314{
aef7d97c 4315 debugfs_remove(l2cap_debugfs);
1da177e4
LT		 4316
4317 if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
4318 BT_ERR("L2CAP socket unregistration failed");
4319
4320 if (hci_unregister_proto(&l2cap_hci_proto) < 0)
4321 BT_ERR("L2CAP protocol unregistration failed");
4322
4323 proto_unregister(&l2cap_proto);
4324}
4325
4326void l2cap_load(void)
4327{
4328 /* Dummy function to trigger automatic L2CAP module loading by
4329 * other modules that use L2CAP sockets but don't use any other
4330 * symbols from it. */
4331 return;
4332}
4333EXPORT_SYMBOL(l2cap_load);
4334
4335module_init(l2cap_init);
4336module_exit(l2cap_exit);
4337
44dd46de
MH		 4338module_param(enable_ertm, bool, 0644);
4339MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
4340
5fbcd3d1
MH		 4341module_param(max_transmit, uint, 0644);
4342MODULE_PARM_DESC(max_transmit, "Max transmit value (default = 3)");
4343
369ba302
GP		 4344module_param(tx_window, uint, 0644);
4345MODULE_PARM_DESC(tx_window, "Transmission window size value (default = 63)");
4346
63fbd24e 4347MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1da177e4
LT		 4348MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
4349MODULE_VERSION(VERSION);
4350MODULE_LICENSE("GPL");
4351MODULE_ALIAS("bt-proto-0");
Clone of davem's net-next-2.6 tree