projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'for-linus' of git://git.infradead.org/ubi-2.6
[deliverable/linux.git] / net / bluetooth / l2cap.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
ce5706bd 4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5d8868ff 5 Copyright (C) 2010 Google Inc.
1da177e4
LT		 6
7 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License version 2 as
11 published by the Free Software Foundation;
12
13 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
14 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
16 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 17 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
18 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 20 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21
8e87d142
YH		 22 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
23 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 24 SOFTWARE IS DISCLAIMED.
25*/
26
27/* Bluetooth L2CAP core and sockets. */
28
1da177e4
LT		 29#include <linux/module.h>
30
31#include <linux/types.h>
4fc268d2 32#include <linux/capability.h>
1da177e4
LT		 33#include <linux/errno.h>
34#include <linux/kernel.h>
1da177e4
LT		 35#include <linux/sched.h>
36#include <linux/slab.h>
37#include <linux/poll.h>
38#include <linux/fcntl.h>
39#include <linux/init.h>
40#include <linux/interrupt.h>
41#include <linux/socket.h>
42#include <linux/skbuff.h>
1da177e4 43#include <linux/list.h>
be9d1227 44#include <linux/device.h>
aef7d97c
MH		 45#include <linux/debugfs.h>
46#include <linux/seq_file.h>
af05b30b 47#include <linux/uaccess.h>
fcc203c3 48#include <linux/crc16.h>
1da177e4
LT		 49#include <net/sock.h>
50
51#include <asm/system.h>
1da177e4
LT		 52#include <asm/unaligned.h>
53
54#include <net/bluetooth/bluetooth.h>
55#include <net/bluetooth/hci_core.h>
56#include <net/bluetooth/l2cap.h>
57
dd135240 58#define VERSION "2.15"
44dd46de 59
894718a6 60static int disable_ertm;
f0709e03 61
47ec1dcd 62static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
e1027a7c 63static u8 l2cap_fixed_chan[8] = { 0x02, };
1da177e4 64
90ddc4f0 65static const struct proto_ops l2cap_sock_ops;
1da177e4 66
1890d36b
GP		 67static struct workqueue_struct *_busy_wq;
68
1da177e4 69static struct bt_sock_list l2cap_sk_list = {
d5fb2962 70 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
1da177e4
LT		 71};
72
1890d36b
GP		 73static void l2cap_busy_work(struct work_struct *work);
74
1da177e4
LT		 75static void __l2cap_sock_close(struct sock *sk, int reason);
76static void l2cap_sock_close(struct sock *sk);
77static void l2cap_sock_kill(struct sock *sk);
78
e9aeb2dd 79static int l2cap_build_conf_req(struct sock *sk, void *data);
1da177e4
LT		 80static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
81 u8 code, u8 ident, u16 dlen, void *data);
82
218bb9df
GP		 83static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb);
84
1da177e4 85/* ---- L2CAP timers ---- */
940a9eea
AE		 86static void l2cap_sock_set_timer(struct sock *sk, long timeout)
87{
88 BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
89 sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
90}
91
92static void l2cap_sock_clear_timer(struct sock *sk)
93{
94 BT_DBG("sock %p state %d", sk, sk->sk_state);
95 sk_stop_timer(sk, &sk->sk_timer);
96}
97
1da177e4
LT		 98static void l2cap_sock_timeout(unsigned long arg)
99{
100 struct sock *sk = (struct sock *) arg;
b1235d79 101 int reason;
1da177e4
LT		 102
103 BT_DBG("sock %p state %d", sk, sk->sk_state);
104
105 bh_lock_sock(sk);
b1235d79 106
940a9eea
AE		 107 if (sock_owned_by_user(sk)) {
108 /* sk is owned by user. Try again later */
109 l2cap_sock_set_timer(sk, HZ / 5);
110 bh_unlock_sock(sk);
111 sock_put(sk);
112 return;
113 }
114
f62e4323
MH		 115 if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
116 reason = ECONNREFUSED;
117 else if (sk->sk_state == BT_CONNECT &&
2af6b9d5 118 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
b1235d79
MH		 119 reason = ECONNREFUSED;
120 else
121 reason = ETIMEDOUT;
122
123 __l2cap_sock_close(sk, reason);
124
1da177e4
LT		 125 bh_unlock_sock(sk);
126
127 l2cap_sock_kill(sk);
128 sock_put(sk);
129}
130
0139418c
MH		 131/* ---- L2CAP channels ---- */
132static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
133{
134 struct sock *s;
135 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
136 if (l2cap_pi(s)->dcid == cid)
137 break;
138 }
139 return s;
140}
141
142static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
143{
144 struct sock *s;
145 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
146 if (l2cap_pi(s)->scid == cid)
147 break;
148 }
149 return s;
150}
151
152/* Find channel with given SCID.
153 * Returns locked socket */
154static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
155{
156 struct sock *s;
157 read_lock(&l->lock);
158 s = __l2cap_get_chan_by_scid(l, cid);
af05b30b
GP		 159 if (s)
160 bh_lock_sock(s);
0139418c
MH		 161 read_unlock(&l->lock);
162 return s;
163}
164
165static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
166{
167 struct sock *s;
168 for (s = l->head; s; s = l2cap_pi(s)->next_c) {
169 if (l2cap_pi(s)->ident == ident)
170 break;
171 }
172 return s;
173}
174
175static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
176{
177 struct sock *s;
178 read_lock(&l->lock);
179 s = __l2cap_get_chan_by_ident(l, ident);
af05b30b
GP		 180 if (s)
181 bh_lock_sock(s);
0139418c
MH		 182 read_unlock(&l->lock);
183 return s;
184}
185
186static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
187{
8db4dc46 188 u16 cid = L2CAP_CID_DYN_START;
0139418c 189
8db4dc46 190 for (; cid < L2CAP_CID_DYN_END; cid++) {
af05b30b 191 if (!__l2cap_get_chan_by_scid(l, cid))
0139418c
MH		 192 return cid;
193 }
194
195 return 0;
196}
197
198static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
199{
200 sock_hold(sk);
201
202 if (l->head)
203 l2cap_pi(l->head)->prev_c = sk;
204
205 l2cap_pi(sk)->next_c = l->head;
206 l2cap_pi(sk)->prev_c = NULL;
207 l->head = sk;
208}
209
210static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
211{
212 struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
213
fd1278d7 214 write_lock_bh(&l->lock);
0139418c
MH		 215 if (sk == l->head)
216 l->head = next;
217
218 if (next)
219 l2cap_pi(next)->prev_c = prev;
220 if (prev)
221 l2cap_pi(prev)->next_c = next;
fd1278d7 222 write_unlock_bh(&l->lock);
0139418c
MH		 223
224 __sock_put(sk);
225}
226
227static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
228{
229 struct l2cap_chan_list *l = &conn->chan_list;
230
af05b30b
GP		 231 BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
232 l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
0139418c 233
2950f21a
MH		 234 conn->disc_reason = 0x13;
235
0139418c
MH		 236 l2cap_pi(sk)->conn = conn;
237
bd3c9e25 238 if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
0139418c
MH		 239 /* Alloc CID for connection-oriented socket */
240 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
241 } else if (sk->sk_type == SOCK_DGRAM) {
242 /* Connectionless socket */
8db4dc46
GP		 243 l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
244 l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
0139418c
MH		 245 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
246 } else {
247 /* Raw socket can send/recv signalling messages only */
8db4dc46
GP		 248 l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
249 l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
0139418c
MH		 250 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
251 }
252
253 __l2cap_chan_link(l, sk);
254
255 if (parent)
256 bt_accept_enqueue(parent, sk);
257}
258
8e87d142 259/* Delete channel.
0139418c
MH		 260 * Must be called on the locked socket. */
261static void l2cap_chan_del(struct sock *sk, int err)
262{
263 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
264 struct sock *parent = bt_sk(sk)->parent;
265
266 l2cap_sock_clear_timer(sk);
267
268 BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
269
8e87d142 270 if (conn) {
0139418c
MH		 271 /* Unlink from channel list */
272 l2cap_chan_unlink(&conn->chan_list, sk);
273 l2cap_pi(sk)->conn = NULL;
274 hci_conn_put(conn->hcon);
275 }
276
b1235d79 277 sk->sk_state = BT_CLOSED;
0139418c
MH		 278 sock_set_flag(sk, SOCK_ZAPPED);
279
280 if (err)
281 sk->sk_err = err;
282
283 if (parent) {
284 bt_accept_unlink(sk);
285 parent->sk_data_ready(parent, 0);
286 } else
287 sk->sk_state_change(sk);
c13ffa62
GP		 288
289 skb_queue_purge(TX_QUEUE(sk));
290
291 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
292 struct srej_list *l, *tmp;
293
294 del_timer(&l2cap_pi(sk)->retrans_timer);
295 del_timer(&l2cap_pi(sk)->monitor_timer);
296 del_timer(&l2cap_pi(sk)->ack_timer);
297
298 skb_queue_purge(SREJ_QUEUE(sk));
299 skb_queue_purge(BUSY_QUEUE(sk));
300
301 list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
302 list_del(&l->list);
303 kfree(l);
304 }
305 }
0139418c
MH		 306}
307
8556edd3 308static inline u8 l2cap_get_auth_type(struct sock *sk)
79d554a6 309{
8556edd3
JH		 310 if (sk->sk_type == SOCK_RAW) {
311 switch (l2cap_pi(sk)->sec_level) {
312 case BT_SECURITY_HIGH:
313 return HCI_AT_DEDICATED_BONDING_MITM;
314 case BT_SECURITY_MEDIUM:
315 return HCI_AT_DEDICATED_BONDING;
316 default:
317 return HCI_AT_NO_BONDING;
318 }
319 } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
320 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
321 l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
0684e5f9 322
00ae4af9 323 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
8556edd3 324 return HCI_AT_NO_BONDING_MITM;
00ae4af9 325 else
8556edd3 326 return HCI_AT_NO_BONDING;
00ae4af9
MH		 327 } else {
328 switch (l2cap_pi(sk)->sec_level) {
329 case BT_SECURITY_HIGH:
8556edd3 330 return HCI_AT_GENERAL_BONDING_MITM;
00ae4af9 331 case BT_SECURITY_MEDIUM:
8556edd3 332 return HCI_AT_GENERAL_BONDING;
00ae4af9 333 default:
8556edd3 334 return HCI_AT_NO_BONDING;
00ae4af9 335 }
0684e5f9 336 }
8556edd3
JH		 337}
338
339/* Service level security */
340static inline int l2cap_check_security(struct sock *sk)
341{
342 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
343 __u8 auth_type;
344
345 auth_type = l2cap_get_auth_type(sk);
79d554a6 346
0684e5f9
MH		 347 return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
348 auth_type);
79d554a6
MH		 349}
350
4e8402a3
MH		 351static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
352{
353 u8 id;
354
355 /* Get next available identificator.
356 * 1 - 128 are used by kernel.
357 * 129 - 199 are reserved.
358 * 200 - 254 are used by utilities like l2ping, etc.
359 */
360
361 spin_lock_bh(&conn->lock);
362
363 if (++conn->tx_ident > 128)
364 conn->tx_ident = 1;
365
366 id = conn->tx_ident;
367
368 spin_unlock_bh(&conn->lock);
369
370 return id;
371}
372
9a9c6a34 373static inline void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
4e8402a3
MH		 374{
375 struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
376
377 BT_DBG("code 0x%2.2x", code);
378
379 if (!skb)
9a9c6a34 380 return;
4e8402a3 381
9a9c6a34 382 hci_send_acl(conn->hcon, skb, 0);
4e8402a3
MH		 383}
384
9a9c6a34 385static inline void l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
1c2acffb
GP		 386{
387 struct sk_buff *skb;
388 struct l2cap_hdr *lh;
389 struct l2cap_conn *conn = pi->conn;
c13ffa62 390 struct sock *sk = (struct sock *)pi;
fcc203c3
GP		 391 int count, hlen = L2CAP_HDR_SIZE + 2;
392
c13ffa62
GP		 393 if (sk->sk_state != BT_CONNECTED)
394 return;
395
fcc203c3
GP		 396 if (pi->fcs == L2CAP_FCS_CRC16)
397 hlen += 2;
1c2acffb
GP		 398
399 BT_DBG("pi %p, control 0x%2.2x", pi, control);
400
fcc203c3 401 count = min_t(unsigned int, conn->mtu, hlen);
1c2acffb
GP		 402 control |= L2CAP_CTRL_FRAME_TYPE;
403
9e917af1
GP		 404 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
405 control |= L2CAP_CTRL_FINAL;
406 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
407 }
408
f0946ccf
GP		 409 if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
410 control |= L2CAP_CTRL_POLL;
411 pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
412 }
413
1c2acffb
GP		 414 skb = bt_skb_alloc(count, GFP_ATOMIC);
415 if (!skb)
9a9c6a34 416 return;
1c2acffb
GP		 417
418 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
fcc203c3 419 lh->len = cpu_to_le16(hlen - L2CAP_HDR_SIZE);
1c2acffb
GP		 420 lh->cid = cpu_to_le16(pi->dcid);
421 put_unaligned_le16(control, skb_put(skb, 2));
422
fcc203c3
GP		 423 if (pi->fcs == L2CAP_FCS_CRC16) {
424 u16 fcs = crc16(0, (u8 *)lh, count - 2);
425 put_unaligned_le16(fcs, skb_put(skb, 2));
426 }
427
9a9c6a34 428 hci_send_acl(pi->conn->hcon, skb, 0);
1c2acffb
GP		 429}
430
9a9c6a34 431static inline void l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
7e743090 432{
1890d36b 433 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
7e743090 434 control |= L2CAP_SUPER_RCV_NOT_READY;
1890d36b
GP		 435 pi->conn_state |= L2CAP_CONN_RNR_SENT;
436 } else
7e743090
GP		 437 control |= L2CAP_SUPER_RCV_READY;
438
2ab25cdd
GP		 439 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
440
9a9c6a34 441 l2cap_send_sframe(pi, control);
7e743090
GP		 442}
443
e501d055
AE		 444static inline int __l2cap_no_conn_pending(struct sock *sk)
445{
446 return !(l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND);
447}
448
79d554a6
MH		 449static void l2cap_do_start(struct sock *sk)
450{
451 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
452
453 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
984947dc
MH		 454 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
455 return;
456
e501d055 457 if (l2cap_check_security(sk) && __l2cap_no_conn_pending(sk)) {
b1235d79
MH		 458 struct l2cap_conn_req req;
459 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
460 req.psm = l2cap_pi(sk)->psm;
79d554a6 461
b1235d79 462 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
e501d055 463 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
79d554a6 464
b1235d79 465 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
79d554a6 466 L2CAP_CONN_REQ, sizeof(req), &req);
b1235d79 467 }
79d554a6
MH		 468 } else {
469 struct l2cap_info_req req;
470 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
471
472 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
473 conn->info_ident = l2cap_get_ident(conn);
474
475 mod_timer(&conn->info_timer, jiffies +
476 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
477
478 l2cap_send_cmd(conn, conn->info_ident,
479 L2CAP_INFO_REQ, sizeof(req), &req);
480 }
481}
482
cf6c2c0b
GP		 483static inline int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
484{
485 u32 local_feat_mask = l2cap_feat_mask;
d1c4a17d 486 if (!disable_ertm)
cf6c2c0b
GP		 487 local_feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING;
488
489 switch (mode) {
490 case L2CAP_MODE_ERTM:
491 return L2CAP_FEAT_ERTM & feat_mask & local_feat_mask;
492 case L2CAP_MODE_STREAMING:
493 return L2CAP_FEAT_STREAMING & feat_mask & local_feat_mask;
494 default:
495 return 0x00;
496 }
497}
498
9b108fc0 499static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct sock *sk, int err)
22121fc9
GP		 500{
501 struct l2cap_disconn_req req;
502
c13ffa62
GP		 503 if (!conn)
504 return;
505
506 skb_queue_purge(TX_QUEUE(sk));
507
508 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
509 del_timer(&l2cap_pi(sk)->retrans_timer);
510 del_timer(&l2cap_pi(sk)->monitor_timer);
511 del_timer(&l2cap_pi(sk)->ack_timer);
512 }
513
22121fc9
GP		 514 req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
515 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
516 l2cap_send_cmd(conn, l2cap_get_ident(conn),
517 L2CAP_DISCONN_REQ, sizeof(req), &req);
c13ffa62
GP		 518
519 sk->sk_state = BT_DISCONN;
9b108fc0 520 sk->sk_err = err;
22121fc9
GP		 521}
522
1da177e4 523/* ---- L2CAP connections ---- */
4e8402a3
MH		 524static void l2cap_conn_start(struct l2cap_conn *conn)
525{
526 struct l2cap_chan_list *l = &conn->chan_list;
cf6c2c0b 527 struct sock_del_list del, *tmp1, *tmp2;
4e8402a3
MH		 528 struct sock *sk;
529
530 BT_DBG("conn %p", conn);
531
cf6c2c0b
GP		 532 INIT_LIST_HEAD(&del.list);
533
4e8402a3
MH		 534 read_lock(&l->lock);
535
536 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
537 bh_lock_sock(sk);
538
bd3c9e25
GP		 539 if (sk->sk_type != SOCK_SEQPACKET &&
540 sk->sk_type != SOCK_STREAM) {
79d554a6
MH		 541 bh_unlock_sock(sk);
542 continue;
543 }
544
545 if (sk->sk_state == BT_CONNECT) {
47731de7 546 struct l2cap_conn_req req;
79d554a6 547
47731de7
GP		 548 if (!l2cap_check_security(sk) ||
549 !__l2cap_no_conn_pending(sk)) {
550 bh_unlock_sock(sk);
551 continue;
552 }
79d554a6 553
47731de7
GP		 554 if (!l2cap_mode_supported(l2cap_pi(sk)->mode,
555 conn->feat_mask)
556 && l2cap_pi(sk)->conf_state &
557 L2CAP_CONF_STATE2_DEVICE) {
558 tmp1 = kzalloc(sizeof(struct sock_del_list),
559 GFP_ATOMIC);
560 tmp1->sk = sk;
561 list_add_tail(&tmp1->list, &del.list);
562 bh_unlock_sock(sk);
563 continue;
b1235d79 564 }
47731de7
GP		 565
566 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
567 req.psm = l2cap_pi(sk)->psm;
568
569 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
570 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
571
572 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
573 L2CAP_CONN_REQ, sizeof(req), &req);
574
79d554a6
MH		 575 } else if (sk->sk_state == BT_CONNECT2) {
576 struct l2cap_conn_rsp rsp;
e9aeb2dd 577 char buf[128];
79d554a6
MH		 578 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
579 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
580
2af6b9d5 581 if (l2cap_check_security(sk)) {
f66dc81f
MH		 582 if (bt_sk(sk)->defer_setup) {
583 struct sock *parent = bt_sk(sk)->parent;
584 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
585 rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
586 parent->sk_data_ready(parent, 0);
587
588 } else {
589 sk->sk_state = BT_CONFIG;
590 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
591 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
592 }
79d554a6
MH		 593 } else {
594 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
595 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
596 }
597
598 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
599 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
e9aeb2dd
GP		 600
601 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT ||
602 rsp.result != L2CAP_CR_SUCCESS) {
603 bh_unlock_sock(sk);
604 continue;
605 }
606
607 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
608 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
609 l2cap_build_conf_req(sk, buf), buf);
610 l2cap_pi(sk)->num_conf_req++;
4e8402a3
MH		 611 }
612
613 bh_unlock_sock(sk);
614 }
615
616 read_unlock(&l->lock);
cf6c2c0b
GP		 617
618 list_for_each_entry_safe(tmp1, tmp2, &del.list, list) {
619 bh_lock_sock(tmp1->sk);
620 __l2cap_sock_close(tmp1->sk, ECONNRESET);
621 bh_unlock_sock(tmp1->sk);
622 list_del(&tmp1->list);
623 kfree(tmp1);
624 }
4e8402a3
MH		 625}
626
627static void l2cap_conn_ready(struct l2cap_conn *conn)
628{
79d554a6
MH		 629 struct l2cap_chan_list *l = &conn->chan_list;
630 struct sock *sk;
4e8402a3 631
79d554a6 632 BT_DBG("conn %p", conn);
4e8402a3 633
79d554a6 634 read_lock(&l->lock);
4e8402a3 635
79d554a6
MH		 636 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
637 bh_lock_sock(sk);
4e8402a3 638
bd3c9e25
GP		 639 if (sk->sk_type != SOCK_SEQPACKET &&
640 sk->sk_type != SOCK_STREAM) {
79d554a6
MH		 641 l2cap_sock_clear_timer(sk);
642 sk->sk_state = BT_CONNECTED;
643 sk->sk_state_change(sk);
644 } else if (sk->sk_state == BT_CONNECT)
645 l2cap_do_start(sk);
4e8402a3 646
79d554a6 647 bh_unlock_sock(sk);
4e8402a3 648 }
79d554a6
MH		 649
650 read_unlock(&l->lock);
4e8402a3
MH		 651}
652
653/* Notify sockets that we cannot guaranty reliability anymore */
654static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
655{
656 struct l2cap_chan_list *l = &conn->chan_list;
657 struct sock *sk;
658
659 BT_DBG("conn %p", conn);
660
661 read_lock(&l->lock);
662
663 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2af6b9d5 664 if (l2cap_pi(sk)->force_reliable)
4e8402a3
MH		 665 sk->sk_err = err;
666 }
667
668 read_unlock(&l->lock);
669}
670
671static void l2cap_info_timeout(unsigned long arg)
672{
673 struct l2cap_conn *conn = (void *) arg;
674
984947dc 675 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 676 conn->info_ident = 0;
984947dc 677
4e8402a3
MH		 678 l2cap_conn_start(conn);
679}
680
1da177e4
LT		 681static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
682{
0139418c 683 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4 684
0139418c 685 if (conn || status)
1da177e4
LT		 686 return conn;
687
0139418c
MH		 688 conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
689 if (!conn)
1da177e4 690 return NULL;
1da177e4
LT		 691
692 hcon->l2cap_data = conn;
693 conn->hcon = hcon;
694
0139418c
MH		 695 BT_DBG("hcon %p conn %p", hcon, conn);
696
1da177e4
LT		 697 conn->mtu = hcon->hdev->acl_mtu;
698 conn->src = &hcon->hdev->bdaddr;
699 conn->dst = &hcon->dst;
700
4e8402a3
MH		 701 conn->feat_mask = 0;
702
1da177e4
LT		 703 spin_lock_init(&conn->lock);
704 rwlock_init(&conn->chan_list.lock);
705
45054dc1
DY		 706 setup_timer(&conn->info_timer, l2cap_info_timeout,
707 (unsigned long) conn);
708
2950f21a
MH		 709 conn->disc_reason = 0x13;
710
1da177e4
LT		 711 return conn;
712}
713
0139418c 714static void l2cap_conn_del(struct hci_conn *hcon, int err)
1da177e4 715{
0139418c 716 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4
LT		 717 struct sock *sk;
718
0139418c
MH		 719 if (!conn)
720 return;
1da177e4
LT		 721
722 BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
723
7585b97a 724 kfree_skb(conn->rx_skb);
1da177e4
LT		 725
726 /* Kill channels */
727 while ((sk = conn->chan_list.head)) {
728 bh_lock_sock(sk);
729 l2cap_chan_del(sk, err);
730 bh_unlock_sock(sk);
731 l2cap_sock_kill(sk);
732 }
733
8e8440f5
DY		 734 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
735 del_timer_sync(&conn->info_timer);
3ab22731 736
1da177e4
LT		 737 hcon->l2cap_data = NULL;
738 kfree(conn);
1da177e4
LT		 739}
740
741static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
742{
743 struct l2cap_chan_list *l = &conn->chan_list;
fd1278d7 744 write_lock_bh(&l->lock);
1da177e4 745 __l2cap_chan_add(conn, sk, parent);
fd1278d7 746 write_unlock_bh(&l->lock);
1da177e4
LT		 747}
748
1da177e4 749/* ---- Socket interface ---- */
8e036fc3 750static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
1da177e4
LT		 751{
752 struct sock *sk;
753 struct hlist_node *node;
754 sk_for_each(sk, node, &l2cap_sk_list.head)
755 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
756 goto found;
757 sk = NULL;
758found:
759 return sk;
760}
761
762/* Find socket with psm and source bdaddr.
763 * Returns closest match.
764 */
e0f0cb56 765static struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
1da177e4
LT		 766{
767 struct sock *sk = NULL, *sk1 = NULL;
768 struct hlist_node *node;
769
e0f0cb56
GP		 770 read_lock(&l2cap_sk_list.lock);
771
1da177e4
LT		 772 sk_for_each(sk, node, &l2cap_sk_list.head) {
773 if (state && sk->sk_state != state)
774 continue;
775
776 if (l2cap_pi(sk)->psm == psm) {
777 /* Exact match. */
778 if (!bacmp(&bt_sk(sk)->src, src))
779 break;
780
781 /* Closest match */
782 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
783 sk1 = sk;
784 }
785 }
1da177e4 786
1da177e4 787 read_unlock(&l2cap_sk_list.lock);
e0f0cb56
GP		 788
789 return node ? sk : sk1;
1da177e4
LT		 790}
791
792static void l2cap_sock_destruct(struct sock *sk)
793{
794 BT_DBG("sk %p", sk);
795
796 skb_queue_purge(&sk->sk_receive_queue);
797 skb_queue_purge(&sk->sk_write_queue);
798}
799
800static void l2cap_sock_cleanup_listen(struct sock *parent)
801{
802 struct sock *sk;
803
804 BT_DBG("parent %p", parent);
805
806 /* Close not yet accepted channels */
807 while ((sk = bt_accept_dequeue(parent, NULL)))
808 l2cap_sock_close(sk);
809
b1235d79 810 parent->sk_state = BT_CLOSED;
1da177e4
LT		 811 sock_set_flag(parent, SOCK_ZAPPED);
812}
813
814/* Kill socket (only if zapped and orphan)
815 * Must be called on unlocked socket.
816 */
817static void l2cap_sock_kill(struct sock *sk)
818{
819 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
820 return;
821
822 BT_DBG("sk %p state %d", sk, sk->sk_state);
823
824 /* Kill poor orphan */
825 bt_sock_unlink(&l2cap_sk_list, sk);
826 sock_set_flag(sk, SOCK_DEAD);
827 sock_put(sk);
828}
829
830static void __l2cap_sock_close(struct sock *sk, int reason)
831{
832 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
833
834 switch (sk->sk_state) {
835 case BT_LISTEN:
836 l2cap_sock_cleanup_listen(sk);
837 break;
838
839 case BT_CONNECTED:
840 case BT_CONFIG:
bd3c9e25
GP		 841 if (sk->sk_type == SOCK_SEQPACKET ||
842 sk->sk_type == SOCK_STREAM) {
1da177e4 843 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1da177e4 844
1da177e4 845 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
9b108fc0 846 l2cap_send_disconn_req(conn, sk, reason);
b1235d79 847 } else
1da177e4 848 l2cap_chan_del(sk, reason);
1da177e4
LT		 849 break;
850
f66dc81f 851 case BT_CONNECT2:
bd3c9e25
GP		 852 if (sk->sk_type == SOCK_SEQPACKET ||
853 sk->sk_type == SOCK_STREAM) {
f66dc81f
MH		 854 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
855 struct l2cap_conn_rsp rsp;
856 __u16 result;
857
858 if (bt_sk(sk)->defer_setup)
859 result = L2CAP_CR_SEC_BLOCK;
860 else
861 result = L2CAP_CR_BAD_PSM;
862
863 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
864 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
865 rsp.result = cpu_to_le16(result);
866 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
867 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
868 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
869 } else
870 l2cap_chan_del(sk, reason);
871 break;
872
1da177e4
LT		 873 case BT_CONNECT:
874 case BT_DISCONN:
875 l2cap_chan_del(sk, reason);
876 break;
877
878 default:
879 sock_set_flag(sk, SOCK_ZAPPED);
880 break;
881 }
882}
883
884/* Must be called on unlocked socket. */
885static void l2cap_sock_close(struct sock *sk)
886{
887 l2cap_sock_clear_timer(sk);
888 lock_sock(sk);
889 __l2cap_sock_close(sk, ECONNRESET);
890 release_sock(sk);
891 l2cap_sock_kill(sk);
892}
893
894static void l2cap_sock_init(struct sock *sk, struct sock *parent)
895{
896 struct l2cap_pinfo *pi = l2cap_pi(sk);
897
898 BT_DBG("sk %p", sk);
899
900 if (parent) {
901 sk->sk_type = parent->sk_type;
f66dc81f
MH		 902 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
903
1da177e4
LT		 904 pi->imtu = l2cap_pi(parent)->imtu;
905 pi->omtu = l2cap_pi(parent)->omtu;
85eb53c6 906 pi->conf_state = l2cap_pi(parent)->conf_state;
c6b03cf9
MH		 907 pi->mode = l2cap_pi(parent)->mode;
908 pi->fcs = l2cap_pi(parent)->fcs;
68d7f0ce 909 pi->max_tx = l2cap_pi(parent)->max_tx;
14b5aa71 910 pi->tx_win = l2cap_pi(parent)->tx_win;
2af6b9d5
MH		 911 pi->sec_level = l2cap_pi(parent)->sec_level;
912 pi->role_switch = l2cap_pi(parent)->role_switch;
913 pi->force_reliable = l2cap_pi(parent)->force_reliable;
1da177e4
LT		 914 } else {
915 pi->imtu = L2CAP_DEFAULT_MTU;
916 pi->omtu = 0;
d1c4a17d 917 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
bd3c9e25 918 pi->mode = L2CAP_MODE_ERTM;
85eb53c6
GP		 919 pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
920 } else {
bd3c9e25 921 pi->mode = L2CAP_MODE_BASIC;
85eb53c6 922 }
fd059b9b 923 pi->max_tx = L2CAP_DEFAULT_MAX_TX;
c6b03cf9 924 pi->fcs = L2CAP_FCS_CRC16;
fd059b9b 925 pi->tx_win = L2CAP_DEFAULT_TX_WINDOW;
2af6b9d5
MH		 926 pi->sec_level = BT_SECURITY_LOW;
927 pi->role_switch = 0;
928 pi->force_reliable = 0;
1da177e4
LT		 929 }
930
931 /* Default config options */
5dee9e7c 932 pi->conf_len = 0;
1da177e4 933 pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
45054dc1
DY		 934 skb_queue_head_init(TX_QUEUE(sk));
935 skb_queue_head_init(SREJ_QUEUE(sk));
1890d36b 936 skb_queue_head_init(BUSY_QUEUE(sk));
45054dc1 937 INIT_LIST_HEAD(SREJ_LIST(sk));
1da177e4
LT		 938}
939
940static struct proto l2cap_proto = {
941 .name = "L2CAP",
942 .owner = THIS_MODULE,
943 .obj_size = sizeof(struct l2cap_pinfo)
944};
945
1b8d7ae4 946static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
1da177e4
LT		 947{
948 struct sock *sk;
949
6257ff21 950 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1da177e4
LT		 951 if (!sk)
952 return NULL;
953
954 sock_init_data(sock, sk);
955 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
956
957 sk->sk_destruct = l2cap_sock_destruct;
4e8402a3 958 sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
1da177e4
LT		 959
960 sock_reset_flag(sk, SOCK_ZAPPED);
961
962 sk->sk_protocol = proto;
b1235d79 963 sk->sk_state = BT_OPEN;
1da177e4 964
b1235d79 965 setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
1da177e4
LT		 966
967 bt_sock_link(&l2cap_sk_list, sk);
968 return sk;
969}
970
3f378b68
EP		 971static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
972 int kern)
1da177e4
LT		 973{
974 struct sock *sk;
975
976 BT_DBG("sock %p", sock);
977
978 sock->state = SS_UNCONNECTED;
979
bd3c9e25 980 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1da177e4
LT		 981 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
982 return -ESOCKTNOSUPPORT;
983
c84b3268 984 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1da177e4
LT		 985 return -EPERM;
986
987 sock->ops = &l2cap_sock_ops;
988
1b8d7ae4 989 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1da177e4
LT		 990 if (!sk)
991 return -ENOMEM;
992
993 l2cap_sock_init(sk, NULL);
994 return 0;
995}
996
f29972de 997static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
1da177e4 998{
1da177e4 999 struct sock *sk = sock->sk;
f29972de
MH		 1000 struct sockaddr_l2 la;
1001 int len, err = 0;
1da177e4 1002
f29972de 1003 BT_DBG("sk %p", sk);
1da177e4
LT		 1004
1005 if (!addr || addr->sa_family != AF_BLUETOOTH)
1006 return -EINVAL;
1007
f29972de
MH		 1008 memset(&la, 0, sizeof(la));
1009 len = min_t(unsigned int, sizeof(la), alen);
1010 memcpy(&la, addr, len);
1011
2a517ca6
MH		 1012 if (la.l2_cid)
1013 return -EINVAL;
1014
1da177e4
LT		 1015 lock_sock(sk);
1016
1017 if (sk->sk_state != BT_OPEN) {
1018 err = -EBADFD;
1019 goto done;
1020 }
1021
0fba2558
MM		 1022 if (la.l2_psm) {
1023 __u16 psm = __le16_to_cpu(la.l2_psm);
1024
1025 /* PSM must be odd and lsb of upper byte must be 0 */
1026 if ((psm & 0x0101) != 0x0001) {
1027 err = -EINVAL;
1028 goto done;
1029 }
1030
1031 /* Restrict usage of well-known PSMs */
1032 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
1033 err = -EACCES;
1034 goto done;
1035 }
847641d7 1036 }
8e87d142 1037
1da177e4
LT		 1038 write_lock_bh(&l2cap_sk_list.lock);
1039
f29972de 1040 if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
1da177e4
LT		 1041 err = -EADDRINUSE;
1042 } else {
1043 /* Save source address */
f29972de
MH		 1044 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
1045 l2cap_pi(sk)->psm = la.l2_psm;
1046 l2cap_pi(sk)->sport = la.l2_psm;
1da177e4 1047 sk->sk_state = BT_BOUND;
2af6b9d5 1048
b4324b5d
MH		 1049 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
1050 __le16_to_cpu(la.l2_psm) == 0x0003)
2af6b9d5 1051 l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
1da177e4
LT		 1052 }
1053
1054 write_unlock_bh(&l2cap_sk_list.lock);
1055
1056done:
1057 release_sock(sk);
1058 return err;
1059}
1060
1061static int l2cap_do_connect(struct sock *sk)
1062{
1063 bdaddr_t *src = &bt_sk(sk)->src;
1064 bdaddr_t *dst = &bt_sk(sk)->dst;
1065 struct l2cap_conn *conn;
1066 struct hci_conn *hcon;
1067 struct hci_dev *hdev;
09ab6f4c 1068 __u8 auth_type;
44d0e48e 1069 int err;
1da177e4 1070
f29972de
MH		 1071 BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
1072 l2cap_pi(sk)->psm);
1da177e4 1073
af05b30b
GP		 1074 hdev = hci_get_route(dst, src);
1075 if (!hdev)
1da177e4
LT		 1076 return -EHOSTUNREACH;
1077
1078 hci_dev_lock_bh(hdev);
1079
1080 err = -ENOMEM;
1081
8556edd3 1082 auth_type = l2cap_get_auth_type(sk);
09ab6f4c 1083
2af6b9d5
MH		 1084 hcon = hci_connect(hdev, ACL_LINK, dst,
1085 l2cap_pi(sk)->sec_level, auth_type);
1da177e4
LT		 1086 if (!hcon)
1087 goto done;
1088
1089 conn = l2cap_conn_add(hcon, 0);
1090 if (!conn) {
1091 hci_conn_put(hcon);
1092 goto done;
1093 }
1094
1095 err = 0;
1096
1097 /* Update source addr of the socket */
1098 bacpy(src, conn->src);
1099
1100 l2cap_chan_add(conn, sk, NULL);
1101
1102 sk->sk_state = BT_CONNECT;
1103 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1104
1105 if (hcon->state == BT_CONNECTED) {
bd3c9e25
GP		 1106 if (sk->sk_type != SOCK_SEQPACKET &&
1107 sk->sk_type != SOCK_STREAM) {
1da177e4 1108 l2cap_sock_clear_timer(sk);
d00ef24f
JH		 1109 if (l2cap_check_security(sk))
1110 sk->sk_state = BT_CONNECTED;
79d554a6
MH		 1111 } else
1112 l2cap_do_start(sk);
1da177e4
LT		 1113 }
1114
1115done:
1116 hci_dev_unlock_bh(hdev);
1117 hci_dev_put(hdev);
1118 return err;
1119}
1120
1121static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
1122{
1da177e4 1123 struct sock *sk = sock->sk;
f29972de
MH		 1124 struct sockaddr_l2 la;
1125 int len, err = 0;
1da177e4 1126
1da177e4
LT		 1127 BT_DBG("sk %p", sk);
1128
6503d961
CG		 1129 if (!addr || alen < sizeof(addr->sa_family) ||
1130 addr->sa_family != AF_BLUETOOTH)
2a517ca6 1131 return -EINVAL;
1da177e4 1132
f29972de
MH		 1133 memset(&la, 0, sizeof(la));
1134 len = min_t(unsigned int, sizeof(la), alen);
1135 memcpy(&la, addr, len);
1136
2a517ca6
MH		 1137 if (la.l2_cid)
1138 return -EINVAL;
1139
1140 lock_sock(sk);
1141
bd3c9e25
GP		 1142 if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
1143 && !la.l2_psm) {
1da177e4
LT		 1144 err = -EINVAL;
1145 goto done;
1146 }
1147
c6b03cf9
MH		 1148 switch (l2cap_pi(sk)->mode) {
1149 case L2CAP_MODE_BASIC:
1150 break;
1151 case L2CAP_MODE_ERTM:
f2fcfcd6 1152 case L2CAP_MODE_STREAMING:
d1c4a17d 1153 if (!disable_ertm)
c6b03cf9
MH		 1154 break;
1155 /* fall through */
1156 default:
1157 err = -ENOTSUPP;
1158 goto done;
1159 }
1160
af05b30b 1161 switch (sk->sk_state) {
1da177e4
LT		 1162 case BT_CONNECT:
1163 case BT_CONNECT2:
1164 case BT_CONFIG:
1165 /* Already connecting */
1166 goto wait;
1167
1168 case BT_CONNECTED:
1169 /* Already connected */
8b0dc6dc 1170 err = -EISCONN;
1da177e4
LT		 1171 goto done;
1172
1173 case BT_OPEN:
1174 case BT_BOUND:
1175 /* Can connect */
1176 break;
1177
1178 default:
1179 err = -EBADFD;
1180 goto done;
1181 }
1182
0fba2558
MM		 1183 /* PSM must be odd and lsb of upper byte must be 0 */
1184 if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
1185 sk->sk_type != SOCK_RAW) {
1186 err = -EINVAL;
1187 goto done;
1188 }
1189
1da177e4 1190 /* Set destination address and psm */
f29972de
MH		 1191 bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
1192 l2cap_pi(sk)->psm = la.l2_psm;
1da177e4 1193
af05b30b
GP		 1194 err = l2cap_do_connect(sk);
1195 if (err)
1da177e4
LT		 1196 goto done;
1197
1198wait:
1199 err = bt_sock_wait_state(sk, BT_CONNECTED,
1200 sock_sndtimeo(sk, flags & O_NONBLOCK));
1201done:
1202 release_sock(sk);
1203 return err;
1204}
1205
1206static int l2cap_sock_listen(struct socket *sock, int backlog)
1207{
1208 struct sock *sk = sock->sk;
1209 int err = 0;
1210
1211 BT_DBG("sk %p backlog %d", sk, backlog);
1212
1213 lock_sock(sk);
1214
bd3c9e25
GP		 1215 if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
1216 || sk->sk_state != BT_BOUND) {
1da177e4
LT		 1217 err = -EBADFD;
1218 goto done;
1219 }
1220
c6b03cf9
MH		 1221 switch (l2cap_pi(sk)->mode) {
1222 case L2CAP_MODE_BASIC:
1223 break;
1224 case L2CAP_MODE_ERTM:
f2fcfcd6 1225 case L2CAP_MODE_STREAMING:
d1c4a17d 1226 if (!disable_ertm)
c6b03cf9
MH		 1227 break;
1228 /* fall through */
1229 default:
1230 err = -ENOTSUPP;
1231 goto done;
1232 }
1233
1da177e4
LT		 1234 if (!l2cap_pi(sk)->psm) {
1235 bdaddr_t *src = &bt_sk(sk)->src;
1236 u16 psm;
1237
1238 err = -EINVAL;
1239
1240 write_lock_bh(&l2cap_sk_list.lock);
1241
1242 for (psm = 0x1001; psm < 0x1100; psm += 2)
b4324b5d
MH		 1243 if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
1244 l2cap_pi(sk)->psm = cpu_to_le16(psm);
1245 l2cap_pi(sk)->sport = cpu_to_le16(psm);
1da177e4
LT		 1246 err = 0;
1247 break;
1248 }
1249
1250 write_unlock_bh(&l2cap_sk_list.lock);
1251
1252 if (err < 0)
1253 goto done;
1254 }
1255
1256 sk->sk_max_ack_backlog = backlog;
1257 sk->sk_ack_backlog = 0;
1258 sk->sk_state = BT_LISTEN;
1259
1260done:
1261 release_sock(sk);
1262 return err;
1263}
1264
1265static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
1266{
1267 DECLARE_WAITQUEUE(wait, current);
1268 struct sock *sk = sock->sk, *nsk;
1269 long timeo;
1270 int err = 0;
1271
fcc70d5f 1272 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1da177e4
LT		 1273
1274 if (sk->sk_state != BT_LISTEN) {
1275 err = -EBADFD;
1276 goto done;
1277 }
1278
1279 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1280
1281 BT_DBG("sk %p timeo %ld", sk, timeo);
1282
1283 /* Wait for an incoming connection. (wake-one). */
aa395145 1284 add_wait_queue_exclusive(sk_sleep(sk), &wait);
1da177e4
LT		 1285 while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1286 set_current_state(TASK_INTERRUPTIBLE);
1287 if (!timeo) {
1288 err = -EAGAIN;
1289 break;
1290 }
1291
1292 release_sock(sk);
1293 timeo = schedule_timeout(timeo);
fcc70d5f 1294 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1da177e4
LT		 1295
1296 if (sk->sk_state != BT_LISTEN) {
1297 err = -EBADFD;
1298 break;
1299 }
1300
1301 if (signal_pending(current)) {
1302 err = sock_intr_errno(timeo);
1303 break;
1304 }
1305 }
1306 set_current_state(TASK_RUNNING);
aa395145 1307 remove_wait_queue(sk_sleep(sk), &wait);
1da177e4
LT		 1308
1309 if (err)
1310 goto done;
1311
1312 newsock->state = SS_CONNECTED;
1313
1314 BT_DBG("new socket %p", nsk);
1315
1316done:
1317 release_sock(sk);
1318 return err;
1319}
1320
1321static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1322{
1323 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1324 struct sock *sk = sock->sk;
1325
1326 BT_DBG("sock %p, sk %p", sock, sk);
1327
1328 addr->sa_family = AF_BLUETOOTH;
1329 *len = sizeof(struct sockaddr_l2);
1330
f29972de
MH		 1331 if (peer) {
1332 la->l2_psm = l2cap_pi(sk)->psm;
1da177e4 1333 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
b4324b5d 1334 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
f29972de
MH		 1335 } else {
1336 la->l2_psm = l2cap_pi(sk)->sport;
1da177e4 1337 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
b4324b5d 1338 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
f29972de 1339 }
1da177e4 1340
1da177e4
LT		 1341 return 0;
1342}
1343
6161c038
GP		 1344static int __l2cap_wait_ack(struct sock *sk)
1345{
1346 DECLARE_WAITQUEUE(wait, current);
1347 int err = 0;
1348 int timeo = HZ/5;
1349
2b0b05dd 1350 add_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1351 while ((l2cap_pi(sk)->unacked_frames > 0 && l2cap_pi(sk)->conn)) {
1352 set_current_state(TASK_INTERRUPTIBLE);
1353
1354 if (!timeo)
1355 timeo = HZ/5;
1356
1357 if (signal_pending(current)) {
1358 err = sock_intr_errno(timeo);
1359 break;
1360 }
1361
1362 release_sock(sk);
1363 timeo = schedule_timeout(timeo);
1364 lock_sock(sk);
1365
1366 err = sock_error(sk);
1367 if (err)
1368 break;
1369 }
1370 set_current_state(TASK_RUNNING);
2b0b05dd 1371 remove_wait_queue(sk_sleep(sk), &wait);
6161c038
GP		 1372 return err;
1373}
1374
e90bac06
GP		 1375static void l2cap_monitor_timeout(unsigned long arg)
1376{
1377 struct sock *sk = (void *) arg;
e90bac06 1378
0e98958d
GP		 1379 BT_DBG("sk %p", sk);
1380
e686219a 1381 bh_lock_sock(sk);
e90bac06 1382 if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
9b108fc0 1383 l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk, ECONNABORTED);
b13f5860 1384 bh_unlock_sock(sk);
e90bac06
GP		 1385 return;
1386 }
1387
1388 l2cap_pi(sk)->retry_count++;
1389 __mod_monitor_timer();
1390
a2e12a2a 1391 l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
e686219a 1392 bh_unlock_sock(sk);
e90bac06
GP		 1393}
1394
1395static void l2cap_retrans_timeout(unsigned long arg)
1396{
1397 struct sock *sk = (void *) arg;
e90bac06 1398
0e98958d
GP		 1399 BT_DBG("sk %p", sk);
1400
e686219a 1401 bh_lock_sock(sk);
e90bac06
GP		 1402 l2cap_pi(sk)->retry_count = 1;
1403 __mod_monitor_timer();
1404
1405 l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
1406
a2e12a2a 1407 l2cap_send_rr_or_rnr(l2cap_pi(sk), L2CAP_CTRL_POLL);
e686219a 1408 bh_unlock_sock(sk);
e90bac06
GP		 1409}
1410
1c2acffb 1411static void l2cap_drop_acked_frames(struct sock *sk)
1da177e4 1412{
1c2acffb 1413 struct sk_buff *skb;
1da177e4 1414
812e737e
GP		 1415 while ((skb = skb_peek(TX_QUEUE(sk))) &&
1416 l2cap_pi(sk)->unacked_frames) {
1c2acffb
GP		 1417 if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
1418 break;
1da177e4 1419
1c2acffb
GP		 1420 skb = skb_dequeue(TX_QUEUE(sk));
1421 kfree_skb(skb);
1da177e4 1422
1c2acffb
GP		 1423 l2cap_pi(sk)->unacked_frames--;
1424 }
1da177e4 1425
e90bac06
GP		 1426 if (!l2cap_pi(sk)->unacked_frames)
1427 del_timer(&l2cap_pi(sk)->retrans_timer);
1c2acffb 1428}
1da177e4 1429
9a9c6a34 1430static inline void l2cap_do_send(struct sock *sk, struct sk_buff *skb)
1c2acffb
GP		 1431{
1432 struct l2cap_pinfo *pi = l2cap_pi(sk);
1c2acffb
GP		 1433
1434 BT_DBG("sk %p, skb %p len %d", sk, skb, skb->len);
1da177e4 1435
9a9c6a34 1436 hci_send_acl(pi->conn->hcon, skb, 0);
1c2acffb
GP		 1437}
1438
305682e8 1439static void l2cap_streaming_send(struct sock *sk)
6840ed07 1440{
ccbb84af 1441 struct sk_buff *skb;
6840ed07 1442 struct l2cap_pinfo *pi = l2cap_pi(sk);
fcc203c3 1443 u16 control, fcs;
6840ed07 1444
ccbb84af
GP		 1445 while ((skb = skb_dequeue(TX_QUEUE(sk)))) {
1446 control = get_unaligned_le16(skb->data + L2CAP_HDR_SIZE);
6840ed07 1447 control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
ccbb84af 1448 put_unaligned_le16(control, skb->data + L2CAP_HDR_SIZE);
6840ed07 1449
e8235c6b 1450 if (pi->fcs == L2CAP_FCS_CRC16) {
ccbb84af
GP		 1451 fcs = crc16(0, (u8 *)skb->data, skb->len - 2);
1452 put_unaligned_le16(fcs, skb->data + skb->len - 2);
fcc203c3
GP		 1453 }
1454
ccbb84af 1455 l2cap_do_send(sk, skb);
6840ed07
GP		 1456
1457 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
6840ed07 1458 }
6840ed07
GP		 1459}
1460
dfc909be 1461static void l2cap_retransmit_one_frame(struct sock *sk, u8 tx_seq)
8f17154f
GP		 1462{
1463 struct l2cap_pinfo *pi = l2cap_pi(sk);
1464 struct sk_buff *skb, *tx_skb;
1465 u16 control, fcs;
8f17154f
GP		 1466
1467 skb = skb_peek(TX_QUEUE(sk));
f11d676d
GP		 1468 if (!skb)
1469 return;
8f17154f 1470
f11d676d
GP		 1471 do {
1472 if (bt_cb(skb)->tx_seq == tx_seq)
8f17154f 1473 break;
8f17154f 1474
f11d676d
GP		 1475 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1476 return;
8f17154f 1477
f11d676d 1478 } while ((skb = skb_queue_next(TX_QUEUE(sk), skb)));
8f17154f 1479
f11d676d
GP		 1480 if (pi->remote_max_tx &&
1481 bt_cb(skb)->retries == pi->remote_max_tx) {
9b108fc0 1482 l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
f11d676d
GP		 1483 return;
1484 }
1485
1486 tx_skb = skb_clone(skb, GFP_ATOMIC);
1487 bt_cb(skb)->retries++;
1488 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
3cb123d1
GP		 1489
1490 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
1491 control |= L2CAP_CTRL_FINAL;
1492 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
1493 }
95ffa978 1494
f11d676d
GP		 1495 control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
1496 | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
3cb123d1 1497
f11d676d
GP		 1498 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1499
1500 if (pi->fcs == L2CAP_FCS_CRC16) {
1501 fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
1502 put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
1503 }
1504
1505 l2cap_do_send(sk, tx_skb);
8f17154f
GP		 1506}
1507
1c2acffb
GP		 1508static int l2cap_ertm_send(struct sock *sk)
1509{
1510 struct sk_buff *skb, *tx_skb;
1511 struct l2cap_pinfo *pi = l2cap_pi(sk);
fcc203c3 1512 u16 control, fcs;
9a9c6a34 1513 int nsent = 0;
1c2acffb 1514
c13ffa62
GP		 1515 if (sk->sk_state != BT_CONNECTED)
1516 return -ENOTCONN;
e90bac06 1517
6e2b6722 1518 while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))) {
1c2acffb 1519
e90bac06
GP		 1520 if (pi->remote_max_tx &&
1521 bt_cb(skb)->retries == pi->remote_max_tx) {
9b108fc0 1522 l2cap_send_disconn_req(pi->conn, sk, ECONNABORTED);
e90bac06
GP		 1523 break;
1524 }
1525
e420aba3
AE		 1526 tx_skb = skb_clone(skb, GFP_ATOMIC);
1527
e90bac06
GP		 1528 bt_cb(skb)->retries++;
1529
1c2acffb 1530 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
95ffa978
GP		 1531 control &= L2CAP_CTRL_SAR;
1532
d5392c8f
GP		 1533 if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
1534 control |= L2CAP_CTRL_FINAL;
1535 pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
1536 }
9f121a5a 1537 control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
1c2acffb
GP		 1538 | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
1539 put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
1540
e90bac06 1541
e8235c6b 1542 if (pi->fcs == L2CAP_FCS_CRC16) {
fcc203c3
GP		 1543 fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
1544 put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
1545 }
1546
9a9c6a34
GP		 1547 l2cap_do_send(sk, tx_skb);
1548
e90bac06 1549 __mod_retrans_timer();
1c2acffb
GP		 1550
1551 bt_cb(skb)->tx_seq = pi->next_tx_seq;
1552 pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
1553
1554 pi->unacked_frames++;
d5392c8f 1555 pi->frames_sent++;
1c2acffb
GP		 1556
1557 if (skb_queue_is_last(TX_QUEUE(sk), skb))
1558 sk->sk_send_head = NULL;
1559 else
1560 sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
9e917af1
GP		 1561
1562 nsent++;
1c2acffb
GP		 1563 }
1564
9e917af1
GP		 1565 return nsent;
1566}
1567
dfc909be
GP		 1568static int l2cap_retransmit_frames(struct sock *sk)
1569{
1570 struct l2cap_pinfo *pi = l2cap_pi(sk);
1571 int ret;
1572
dfc909be
GP		 1573 if (!skb_queue_empty(TX_QUEUE(sk)))
1574 sk->sk_send_head = TX_QUEUE(sk)->next;
1575
1576 pi->next_tx_seq = pi->expected_ack_seq;
1577 ret = l2cap_ertm_send(sk);
dfc909be
GP		 1578 return ret;
1579}
1580
9a9c6a34 1581static void l2cap_send_ack(struct l2cap_pinfo *pi)
9e917af1
GP		 1582{
1583 struct sock *sk = (struct sock *)pi;
1584 u16 control = 0;
1585
1586 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
1587
1588 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
1589 control |= L2CAP_SUPER_RCV_NOT_READY;
1890d36b 1590 pi->conn_state |= L2CAP_CONN_RNR_SENT;
9a9c6a34
GP		 1591 l2cap_send_sframe(pi, control);
1592 return;
9e917af1 1593 }
dfc909be 1594
e0f66218 1595 if (l2cap_ertm_send(sk) > 0)
dfc909be
GP		 1596 return;
1597
1598 control |= L2CAP_SUPER_RCV_READY;
1599 l2cap_send_sframe(pi, control);
1c2acffb
GP		 1600}
1601
9a9c6a34 1602static void l2cap_send_srejtail(struct sock *sk)
99b0d4b7
GP		 1603{
1604 struct srej_list *tail;
1605 u16 control;
1606
1607 control = L2CAP_SUPER_SELECT_REJECT;
1608 control |= L2CAP_CTRL_FINAL;
1609
1610 tail = list_entry(SREJ_LIST(sk)->prev, struct srej_list, list);
1611 control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
1612
1613 l2cap_send_sframe(l2cap_pi(sk), control);
99b0d4b7
GP		 1614}
1615
1c2acffb
GP		 1616static inline int l2cap_skbuff_fromiovec(struct sock *sk, struct msghdr *msg, int len, int count, struct sk_buff *skb)
1617{
1618 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1619 struct sk_buff **frag;
1620 int err, sent = 0;
1da177e4 1621
59203a21 1622 if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count))
1c2acffb 1623 return -EFAULT;
1da177e4
LT		 1624
1625 sent += count;
1626 len -= count;
1627
1628 /* Continuation fragments (no L2CAP header) */
1629 frag = &skb_shinfo(skb)->frag_list;
1630 while (len) {
1631 count = min_t(unsigned int, conn->mtu, len);
1632
1633 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1634 if (!*frag)
0175d629 1635 return err;
1c2acffb
GP		 1636 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count))
1637 return -EFAULT;
1da177e4
LT		 1638
1639 sent += count;
1640 len -= count;
1641
1642 frag = &(*frag)->next;
1643 }
1da177e4
LT		 1644
1645 return sent;
1c2acffb 1646}
1da177e4 1647
1c2acffb
GP		 1648static struct sk_buff *l2cap_create_connless_pdu(struct sock *sk, struct msghdr *msg, size_t len)
1649{
1650 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1651 struct sk_buff *skb;
1652 int err, count, hlen = L2CAP_HDR_SIZE + 2;
1653 struct l2cap_hdr *lh;
1654
1655 BT_DBG("sk %p len %d", sk, (int)len);
1656
1657 count = min_t(unsigned int, (conn->mtu - hlen), len);
1658 skb = bt_skb_send_alloc(sk, count + hlen,
1659 msg->msg_flags & MSG_DONTWAIT, &err);
1660 if (!skb)
0175d629 1661 return ERR_PTR(err);
1c2acffb
GP		 1662
1663 /* Create L2CAP header */
1664 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1665 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1666 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1667 put_unaligned_le16(l2cap_pi(sk)->psm, skb_put(skb, 2));
1668
1669 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1670 if (unlikely(err < 0)) {
1671 kfree_skb(skb);
1672 return ERR_PTR(err);
1673 }
1674 return skb;
1675}
1676
1677static struct sk_buff *l2cap_create_basic_pdu(struct sock *sk, struct msghdr *msg, size_t len)
1678{
1679 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1680 struct sk_buff *skb;
1681 int err, count, hlen = L2CAP_HDR_SIZE;
1682 struct l2cap_hdr *lh;
1683
1684 BT_DBG("sk %p len %d", sk, (int)len);
1685
1686 count = min_t(unsigned int, (conn->mtu - hlen), len);
1687 skb = bt_skb_send_alloc(sk, count + hlen,
1688 msg->msg_flags & MSG_DONTWAIT, &err);
1689 if (!skb)
0175d629 1690 return ERR_PTR(err);
1c2acffb
GP		 1691
1692 /* Create L2CAP header */
1693 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1694 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1695 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1696
1697 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1698 if (unlikely(err < 0)) {
1699 kfree_skb(skb);
1700 return ERR_PTR(err);
1701 }
1702 return skb;
1703}
1704
6840ed07 1705static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *msg, size_t len, u16 control, u16 sdulen)
1c2acffb
GP		 1706{
1707 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1708 struct sk_buff *skb;
1709 int err, count, hlen = L2CAP_HDR_SIZE + 2;
1710 struct l2cap_hdr *lh;
1711
1712 BT_DBG("sk %p len %d", sk, (int)len);
1713
0ee0d208
GP		 1714 if (!conn)
1715 return ERR_PTR(-ENOTCONN);
1716
c74e560c
GP		 1717 if (sdulen)
1718 hlen += 2;
1719
fcc203c3
GP		 1720 if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
1721 hlen += 2;
1722
1c2acffb
GP		 1723 count = min_t(unsigned int, (conn->mtu - hlen), len);
1724 skb = bt_skb_send_alloc(sk, count + hlen,
1725 msg->msg_flags & MSG_DONTWAIT, &err);
1726 if (!skb)
0175d629 1727 return ERR_PTR(err);
1c2acffb
GP		 1728
1729 /* Create L2CAP header */
1730 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1731 lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1732 lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1733 put_unaligned_le16(control, skb_put(skb, 2));
c74e560c
GP		 1734 if (sdulen)
1735 put_unaligned_le16(sdulen, skb_put(skb, 2));
1c2acffb
GP		 1736
1737 err = l2cap_skbuff_fromiovec(sk, msg, len, count, skb);
1738 if (unlikely(err < 0)) {
1739 kfree_skb(skb);
1740 return ERR_PTR(err);
1741 }
e90bac06 1742
fcc203c3
GP		 1743 if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16)
1744 put_unaligned_le16(0, skb_put(skb, 2));
1745
e90bac06 1746 bt_cb(skb)->retries = 0;
1c2acffb 1747 return skb;
1da177e4
LT		 1748}
1749
c74e560c
GP		 1750static inline int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, size_t len)
1751{
1752 struct l2cap_pinfo *pi = l2cap_pi(sk);
1753 struct sk_buff *skb;
1754 struct sk_buff_head sar_queue;
1755 u16 control;
1756 size_t size = 0;
1757
ff12fd64 1758 skb_queue_head_init(&sar_queue);
c74e560c 1759 control = L2CAP_SDU_START;
1c762159 1760 skb = l2cap_create_iframe_pdu(sk, msg, pi->remote_mps, control, len);
c74e560c
GP		 1761 if (IS_ERR(skb))
1762 return PTR_ERR(skb);
1763
1764 __skb_queue_tail(&sar_queue, skb);
1c762159
GP		 1765 len -= pi->remote_mps;
1766 size += pi->remote_mps;
c74e560c
GP		 1767
1768 while (len > 0) {
1769 size_t buflen;
1770
1c762159 1771 if (len > pi->remote_mps) {
44651b85 1772 control = L2CAP_SDU_CONTINUE;
1c762159 1773 buflen = pi->remote_mps;
c74e560c 1774 } else {
44651b85 1775 control = L2CAP_SDU_END;
c74e560c
GP		 1776 buflen = len;
1777 }
1778
6840ed07 1779 skb = l2cap_create_iframe_pdu(sk, msg, buflen, control, 0);
c74e560c
GP		 1780 if (IS_ERR(skb)) {
1781 skb_queue_purge(&sar_queue);
1782 return PTR_ERR(skb);
1783 }
1784
1785 __skb_queue_tail(&sar_queue, skb);
1786 len -= buflen;
1787 size += buflen;
c74e560c
GP		 1788 }
1789 skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
1790 if (sk->sk_send_head == NULL)
1791 sk->sk_send_head = sar_queue.next;
1792
1793 return size;
1794}
1795
1da177e4
LT		 1796static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1797{
1798 struct sock *sk = sock->sk;
1c2acffb
GP		 1799 struct l2cap_pinfo *pi = l2cap_pi(sk);
1800 struct sk_buff *skb;
1801 u16 control;
1802 int err;
1da177e4
LT		 1803
1804 BT_DBG("sock %p, sk %p", sock, sk);
1805
c1cbe4b7
BL		 1806 err = sock_error(sk);
1807 if (err)
1808 return err;
1da177e4
LT		 1809
1810 if (msg->msg_flags & MSG_OOB)
1811 return -EOPNOTSUPP;
1812
1da177e4
LT		 1813 lock_sock(sk);
1814
1c2acffb 1815 if (sk->sk_state != BT_CONNECTED) {
1da177e4 1816 err = -ENOTCONN;
1c2acffb
GP		 1817 goto done;
1818 }
1da177e4 1819
1c2acffb
GP		 1820 /* Connectionless channel */
1821 if (sk->sk_type == SOCK_DGRAM) {
1822 skb = l2cap_create_connless_pdu(sk, msg, len);
9a9c6a34 1823 if (IS_ERR(skb)) {
477fffb0 1824 err = PTR_ERR(skb);
9a9c6a34
GP		 1825 } else {
1826 l2cap_do_send(sk, skb);
1827 err = len;
1828 }
1c2acffb
GP		 1829 goto done;
1830 }
1831
1832 switch (pi->mode) {
1833 case L2CAP_MODE_BASIC:
c69163e9
GP		 1834 /* Check outgoing MTU */
1835 if (len > pi->omtu) {
f9dd11b0 1836 err = -EMSGSIZE;
c69163e9
GP		 1837 goto done;
1838 }
1839
1c2acffb
GP		 1840 /* Create a basic PDU */
1841 skb = l2cap_create_basic_pdu(sk, msg, len);
1842 if (IS_ERR(skb)) {
1843 err = PTR_ERR(skb);
1844 goto done;
1845 }
1846
9a9c6a34
GP		 1847 l2cap_do_send(sk, skb);
1848 err = len;
1c2acffb
GP		 1849 break;
1850
1851 case L2CAP_MODE_ERTM:
6840ed07 1852 case L2CAP_MODE_STREAMING:
1c2acffb 1853 /* Entire SDU fits into one PDU */
1c762159 1854 if (len <= pi->remote_mps) {
1c2acffb 1855 control = L2CAP_SDU_UNSEGMENTED;
6840ed07 1856 skb = l2cap_create_iframe_pdu(sk, msg, len, control, 0);
1c2acffb
GP		 1857 if (IS_ERR(skb)) {
1858 err = PTR_ERR(skb);
1859 goto done;
1860 }
c74e560c 1861 __skb_queue_tail(TX_QUEUE(sk), skb);
dfc909be 1862
c74e560c
GP		 1863 if (sk->sk_send_head == NULL)
1864 sk->sk_send_head = skb;
dfc909be 1865
1c2acffb 1866 } else {
c74e560c
GP		 1867 /* Segment SDU into multiples PDUs */
1868 err = l2cap_sar_segment_sdu(sk, msg, len);
1869 if (err < 0)
1870 goto done;
1c2acffb 1871 }
1c2acffb 1872
dfc909be 1873 if (pi->mode == L2CAP_MODE_STREAMING) {
305682e8 1874 l2cap_streaming_send(sk);
dfc909be 1875 } else {
4571928f
DS		 1876 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
1877 (pi->conn_state & L2CAP_CONN_WAIT_F)) {
6e2b6722
GP		 1878 err = len;
1879 break;
1880 }
6840ed07 1881 err = l2cap_ertm_send(sk);
dfc909be 1882 }
6840ed07 1883
9e917af1 1884 if (err >= 0)
1c2acffb
GP		 1885 err = len;
1886 break;
1887
1888 default:
1889 BT_DBG("bad state %1.1x", pi->mode);
bc766db2 1890 err = -EBADFD;
1c2acffb
GP		 1891 }
1892
1893done:
1da177e4
LT		 1894 release_sock(sk);
1895 return err;
1896}
1897
f66dc81f
MH		 1898static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1899{
1900 struct sock *sk = sock->sk;
1901
1902 lock_sock(sk);
1903
1904 if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1905 struct l2cap_conn_rsp rsp;
e9aeb2dd
GP		 1906 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1907 u8 buf[128];
f66dc81f
MH		 1908
1909 sk->sk_state = BT_CONFIG;
1910
1911 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
1912 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
1913 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1914 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1915 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1916 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1917
e9aeb2dd
GP		 1918 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) {
1919 release_sock(sk);
1920 return 0;
1921 }
1922
1923 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1924 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1925 l2cap_build_conf_req(sk, buf), buf);
1926 l2cap_pi(sk)->num_conf_req++;
1927
f66dc81f
MH		 1928 release_sock(sk);
1929 return 0;
1930 }
1931
1932 release_sock(sk);
1933
6fdf482b
MM		 1934 if (sock->type == SOCK_STREAM)
1935 return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1936
f66dc81f
MH		 1937 return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1938}
1939
b7058842 1940static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
1da177e4
LT		 1941{
1942 struct sock *sk = sock->sk;
1943 struct l2cap_options opts;
f29972de 1944 int len, err = 0;
1da177e4
LT		 1945 u32 opt;
1946
1947 BT_DBG("sk %p", sk);
1948
1949 lock_sock(sk);
1950
1951 switch (optname) {
1952 case L2CAP_OPTIONS:
eaa71b31
GP		 1953 if (sk->sk_state == BT_CONNECTED) {
1954 err = -EINVAL;
1955 break;
1956 }
1957
0878b666
MH		 1958 opts.imtu = l2cap_pi(sk)->imtu;
1959 opts.omtu = l2cap_pi(sk)->omtu;
1960 opts.flush_to = l2cap_pi(sk)->flush_to;
c6b03cf9 1961 opts.mode = l2cap_pi(sk)->mode;
fcc203c3 1962 opts.fcs = l2cap_pi(sk)->fcs;
68d7f0ce 1963 opts.max_tx = l2cap_pi(sk)->max_tx;
14b5aa71 1964 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
0878b666 1965
1da177e4
LT		 1966 len = min_t(unsigned int, sizeof(opts), optlen);
1967 if (copy_from_user((char *) &opts, optval, len)) {
1968 err = -EFAULT;
1969 break;
1970 }
0878b666 1971
45d65c46
GP		 1972 if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
1973 err = -EINVAL;
1974 break;
1975 }
1976
0041ecfa
JPRV		 1977 l2cap_pi(sk)->mode = opts.mode;
1978 switch (l2cap_pi(sk)->mode) {
1979 case L2CAP_MODE_BASIC:
85eb53c6 1980 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
0041ecfa
JPRV		 1981 break;
1982 case L2CAP_MODE_ERTM:
1983 case L2CAP_MODE_STREAMING:
d1c4a17d 1984 if (!disable_ertm)
0041ecfa
JPRV		 1985 break;
1986 /* fall through */
1987 default:
1988 err = -EINVAL;
1989 break;
1990 }
1991
c6b03cf9
MH		 1992 l2cap_pi(sk)->imtu = opts.imtu;
1993 l2cap_pi(sk)->omtu = opts.omtu;
fcc203c3 1994 l2cap_pi(sk)->fcs = opts.fcs;
68d7f0ce 1995 l2cap_pi(sk)->max_tx = opts.max_tx;
14b5aa71 1996 l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
1da177e4
LT		 1997 break;
1998
1999 case L2CAP_LM:
2000 if (get_user(opt, (u32 __user *) optval)) {
2001 err = -EFAULT;
2002 break;
2003 }
2004
2af6b9d5
MH		 2005 if (opt & L2CAP_LM_AUTH)
2006 l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
2007 if (opt & L2CAP_LM_ENCRYPT)
2008 l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
2009 if (opt & L2CAP_LM_SECURE)
2010 l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
2011
2012 l2cap_pi(sk)->role_switch = (opt & L2CAP_LM_MASTER);
2013 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
1da177e4
LT		 2014 break;
2015
2016 default:
2017 err = -ENOPROTOOPT;
2018 break;
2019 }
2020
2021 release_sock(sk);
2022 return err;
2023}
2024
b7058842 2025static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
d58daf42
MH		 2026{
2027 struct sock *sk = sock->sk;
2af6b9d5
MH		 2028 struct bt_security sec;
2029 int len, err = 0;
f66dc81f 2030 u32 opt;
d58daf42
MH		 2031
2032 BT_DBG("sk %p", sk);
2033
2034 if (level == SOL_L2CAP)
2035 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
2036
0588d94f
MH		 2037 if (level != SOL_BLUETOOTH)
2038 return -ENOPROTOOPT;
2039
d58daf42
MH		 2040 lock_sock(sk);
2041
2042 switch (optname) {
2af6b9d5 2043 case BT_SECURITY:
bd3c9e25
GP		 2044 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
2045 && sk->sk_type != SOCK_RAW) {
0588d94f
MH		 2046 err = -EINVAL;
2047 break;
2048 }
2049
2af6b9d5
MH		 2050 sec.level = BT_SECURITY_LOW;
2051
2052 len = min_t(unsigned int, sizeof(sec), optlen);
2053 if (copy_from_user((char *) &sec, optval, len)) {
2054 err = -EFAULT;
2055 break;
2056 }
2057
2058 if (sec.level < BT_SECURITY_LOW ||
2059 sec.level > BT_SECURITY_HIGH) {
2060 err = -EINVAL;
2061 break;
2062 }
2063
2064 l2cap_pi(sk)->sec_level = sec.level;
2065 break;
2066
f66dc81f
MH		 2067 case BT_DEFER_SETUP:
2068 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
2069 err = -EINVAL;
2070 break;
2071 }
2072
2073 if (get_user(opt, (u32 __user *) optval)) {
2074 err = -EFAULT;
2075 break;
2076 }
2077
2078 bt_sk(sk)->defer_setup = opt;
2079 break;
2080
d58daf42
MH		 2081 default:
2082 err = -ENOPROTOOPT;
2083 break;
2084 }
2085
2086 release_sock(sk);
2087 return err;
2088}
2089
2090static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1da177e4
LT		 2091{
2092 struct sock *sk = sock->sk;
2093 struct l2cap_options opts;
2094 struct l2cap_conninfo cinfo;
2095 int len, err = 0;
2af6b9d5 2096 u32 opt;
1da177e4
LT		 2097
2098 BT_DBG("sk %p", sk);
2099
2100 if (get_user(len, optlen))
2101 return -EFAULT;
2102
2103 lock_sock(sk);
2104
2105 switch (optname) {
2106 case L2CAP_OPTIONS:
2107 opts.imtu = l2cap_pi(sk)->imtu;
2108 opts.omtu = l2cap_pi(sk)->omtu;
2109 opts.flush_to = l2cap_pi(sk)->flush_to;
c6b03cf9 2110 opts.mode = l2cap_pi(sk)->mode;
fcc203c3 2111 opts.fcs = l2cap_pi(sk)->fcs;
68d7f0ce 2112 opts.max_tx = l2cap_pi(sk)->max_tx;
14b5aa71 2113 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
1da177e4
LT		 2114
2115 len = min_t(unsigned int, len, sizeof(opts));
2116 if (copy_to_user(optval, (char *) &opts, len))
2117 err = -EFAULT;
2118
2119 break;
2120
2121 case L2CAP_LM:
2af6b9d5
MH		 2122 switch (l2cap_pi(sk)->sec_level) {
2123 case BT_SECURITY_LOW:
2124 opt = L2CAP_LM_AUTH;
2125 break;
2126 case BT_SECURITY_MEDIUM:
2127 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
2128 break;
2129 case BT_SECURITY_HIGH:
2130 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
2131 L2CAP_LM_SECURE;
2132 break;
2133 default:
2134 opt = 0;
2135 break;
2136 }
2137
2138 if (l2cap_pi(sk)->role_switch)
2139 opt |= L2CAP_LM_MASTER;
2140
2141 if (l2cap_pi(sk)->force_reliable)
2142 opt |= L2CAP_LM_RELIABLE;
2143
2144 if (put_user(opt, (u32 __user *) optval))
1da177e4
LT		 2145 err = -EFAULT;
2146 break;
2147
2148 case L2CAP_CONNINFO:
f66dc81f
MH		 2149 if (sk->sk_state != BT_CONNECTED &&
2150 !(sk->sk_state == BT_CONNECT2 &&
2151 bt_sk(sk)->defer_setup)) {
1da177e4
LT		 2152 err = -ENOTCONN;
2153 break;
2154 }
2155
2156 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
2157 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
2158
2159 len = min_t(unsigned int, len, sizeof(cinfo));
2160 if (copy_to_user(optval, (char *) &cinfo, len))
2161 err = -EFAULT;
2162
2163 break;
2164
2165 default:
2166 err = -ENOPROTOOPT;
2167 break;
2168 }
2169
2170 release_sock(sk);
2171 return err;
2172}
2173
d58daf42
MH		 2174static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
2175{
2176 struct sock *sk = sock->sk;
2af6b9d5 2177 struct bt_security sec;
d58daf42
MH		 2178 int len, err = 0;
2179
2180 BT_DBG("sk %p", sk);
2181
2182 if (level == SOL_L2CAP)
2183 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
2184
0588d94f
MH		 2185 if (level != SOL_BLUETOOTH)
2186 return -ENOPROTOOPT;
2187
d58daf42
MH		 2188 if (get_user(len, optlen))
2189 return -EFAULT;
2190
2191 lock_sock(sk);
2192
2193 switch (optname) {
2af6b9d5 2194 case BT_SECURITY:
bd3c9e25
GP		 2195 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
2196 && sk->sk_type != SOCK_RAW) {
0588d94f
MH		 2197 err = -EINVAL;
2198 break;
2199 }
2200
2af6b9d5
MH		 2201 sec.level = l2cap_pi(sk)->sec_level;
2202
2203 len = min_t(unsigned int, len, sizeof(sec));
2204 if (copy_to_user(optval, (char *) &sec, len))
2205 err = -EFAULT;
2206
2207 break;
2208
f66dc81f
MH		 2209 case BT_DEFER_SETUP:
2210 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
2211 err = -EINVAL;
2212 break;
2213 }
2214
2215 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
2216 err = -EFAULT;
2217
2218 break;
2219
d58daf42
MH		 2220 default:
2221 err = -ENOPROTOOPT;
2222 break;
2223 }
2224
2225 release_sock(sk);
2226 return err;
2227}
2228
1da177e4
LT		 2229static int l2cap_sock_shutdown(struct socket *sock, int how)
2230{
2231 struct sock *sk = sock->sk;
2232 int err = 0;
2233
2234 BT_DBG("sock %p, sk %p", sock, sk);
2235
2236 if (!sk)
2237 return 0;
2238
2239 lock_sock(sk);
2240 if (!sk->sk_shutdown) {
6161c038
GP		 2241 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
2242 err = __l2cap_wait_ack(sk);
2243
1da177e4
LT		 2244 sk->sk_shutdown = SHUTDOWN_MASK;
2245 l2cap_sock_clear_timer(sk);
2246 __l2cap_sock_close(sk, 0);
2247
2248 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
b1235d79
MH		 2249 err = bt_sock_wait_state(sk, BT_CLOSED,
2250 sk->sk_lingertime);
1da177e4 2251 }
9b108fc0
GP		 2252
2253 if (!err && sk->sk_err)
2254 err = -sk->sk_err;
2255
1da177e4
LT		 2256 release_sock(sk);
2257 return err;
2258}
2259
2260static int l2cap_sock_release(struct socket *sock)
2261{
2262 struct sock *sk = sock->sk;
2263 int err;
2264
2265 BT_DBG("sock %p, sk %p", sock, sk);
2266
2267 if (!sk)
2268 return 0;
2269
2270 err = l2cap_sock_shutdown(sock, 2);
2271
2272 sock_orphan(sk);
2273 l2cap_sock_kill(sk);
2274 return err;
2275}
2276
1da177e4
LT		 2277static void l2cap_chan_ready(struct sock *sk)
2278{
2279 struct sock *parent = bt_sk(sk)->parent;
2280
2281 BT_DBG("sk %p, parent %p", sk, parent);
2282
2283 l2cap_pi(sk)->conf_state = 0;
2284 l2cap_sock_clear_timer(sk);
2285
2286 if (!parent) {
2287 /* Outgoing channel.
2288 * Wake up socket sleeping on connect.
2289 */
2290 sk->sk_state = BT_CONNECTED;
2291 sk->sk_state_change(sk);
2292 } else {
2293 /* Incoming channel.
2294 * Wake up socket sleeping on accept.
2295 */
2296 parent->sk_data_ready(parent, 0);
2297 }
2298}
2299
2300/* Copy frame to all raw sockets on that connection */
2301static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
2302{
2303 struct l2cap_chan_list *l = &conn->chan_list;
2304 struct sk_buff *nskb;
af05b30b 2305 struct sock *sk;
1da177e4
LT		 2306
2307 BT_DBG("conn %p", conn);
2308
2309 read_lock(&l->lock);
2310 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2311 if (sk->sk_type != SOCK_RAW)
2312 continue;
2313
2314 /* Don't send frame to the socket it came from */
2315 if (skb->sk == sk)
2316 continue;
af05b30b
GP		 2317 nskb = skb_clone(skb, GFP_ATOMIC);
2318 if (!nskb)
1da177e4
LT		 2319 continue;
2320
2321 if (sock_queue_rcv_skb(sk, nskb))
2322 kfree_skb(nskb);
2323 }
2324 read_unlock(&l->lock);
2325}
2326
2327/* ---- L2CAP signalling commands ---- */
2328static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
2329 u8 code, u8 ident, u16 dlen, void *data)
2330{
2331 struct sk_buff *skb, **frag;
2332 struct l2cap_cmd_hdr *cmd;
2333 struct l2cap_hdr *lh;
2334 int len, count;
2335
af05b30b
GP		 2336 BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
2337 conn, code, ident, dlen);
1da177e4
LT		 2338
2339 len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
2340 count = min_t(unsigned int, conn->mtu, len);
2341
2342 skb = bt_skb_alloc(count, GFP_ATOMIC);
2343 if (!skb)
2344 return NULL;
2345
2346 lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
aca3192c 2347 lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
8db4dc46 2348 lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1da177e4
LT		 2349
2350 cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
2351 cmd->code = code;
2352 cmd->ident = ident;
aca3192c 2353 cmd->len = cpu_to_le16(dlen);
1da177e4
LT		 2354
2355 if (dlen) {
2356 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
2357 memcpy(skb_put(skb, count), data, count);
2358 data += count;
2359 }
2360
2361 len -= skb->len;
2362
2363 /* Continuation fragments (no L2CAP header) */
2364 frag = &skb_shinfo(skb)->frag_list;
2365 while (len) {
2366 count = min_t(unsigned int, conn->mtu, len);
2367
2368 *frag = bt_skb_alloc(count, GFP_ATOMIC);
2369 if (!*frag)
2370 goto fail;
2371
2372 memcpy(skb_put(*frag, count), data, count);
2373
2374 len -= count;
2375 data += count;
2376
2377 frag = &(*frag)->next;
2378 }
2379
2380 return skb;
2381
2382fail:
2383 kfree_skb(skb);
2384 return NULL;
2385}
2386
2387static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
2388{
2389 struct l2cap_conf_opt *opt = *ptr;
2390 int len;
2391
2392 len = L2CAP_CONF_OPT_SIZE + opt->len;
2393 *ptr += len;
2394
2395 *type = opt->type;
2396 *olen = opt->len;
2397
2398 switch (opt->len) {
2399 case 1:
2400 *val = *((u8 *) opt->val);
2401 break;
2402
2403 case 2:
bfaaeb3e 2404 *val = get_unaligned_le16(opt->val);
1da177e4
LT		 2405 break;
2406
2407 case 4:
bfaaeb3e 2408 *val = get_unaligned_le32(opt->val);
1da177e4
LT		 2409 break;
2410
2411 default:
2412 *val = (unsigned long) opt->val;
2413 break;
2414 }
2415
2416 BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
2417 return len;
2418}
2419
1da177e4
LT		 2420static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
2421{
2422 struct l2cap_conf_opt *opt = *ptr;
2423
2424 BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
2425
2426 opt->type = type;
2427 opt->len = len;
2428
2429 switch (len) {
2430 case 1:
2431 *((u8 *) opt->val) = val;
2432 break;
2433
2434 case 2:
4f8b691c 2435 put_unaligned_le16(val, opt->val);
1da177e4
LT		 2436 break;
2437
2438 case 4:
4f8b691c 2439 put_unaligned_le32(val, opt->val);
1da177e4
LT		 2440 break;
2441
2442 default:
2443 memcpy(opt->val, (void *) val, len);
2444 break;
2445 }
2446
2447 *ptr += L2CAP_CONF_OPT_SIZE + len;
2448}
2449
c1b4f43b
GP		 2450static void l2cap_ack_timeout(unsigned long arg)
2451{
2452 struct sock *sk = (void *) arg;
2453
2454 bh_lock_sock(sk);
2455 l2cap_send_ack(l2cap_pi(sk));
2456 bh_unlock_sock(sk);
2457}
2458
0565c1c2
GP		 2459static inline void l2cap_ertm_init(struct sock *sk)
2460{
2461 l2cap_pi(sk)->expected_ack_seq = 0;
2462 l2cap_pi(sk)->unacked_frames = 0;
2463 l2cap_pi(sk)->buffer_seq = 0;
803020c6 2464 l2cap_pi(sk)->num_acked = 0;
d5392c8f 2465 l2cap_pi(sk)->frames_sent = 0;
0565c1c2
GP		 2466
2467 setup_timer(&l2cap_pi(sk)->retrans_timer,
2468 l2cap_retrans_timeout, (unsigned long) sk);
2469 setup_timer(&l2cap_pi(sk)->monitor_timer,
2470 l2cap_monitor_timeout, (unsigned long) sk);
c1b4f43b
GP		 2471 setup_timer(&l2cap_pi(sk)->ack_timer,
2472 l2cap_ack_timeout, (unsigned long) sk);
0565c1c2
GP		 2473
2474 __skb_queue_head_init(SREJ_QUEUE(sk));
1890d36b
GP		 2475 __skb_queue_head_init(BUSY_QUEUE(sk));
2476
2477 INIT_WORK(&l2cap_pi(sk)->busy_work, l2cap_busy_work);
218bb9df
GP		 2478
2479 sk->sk_backlog_rcv = l2cap_ertm_data_rcv;
0565c1c2
GP		 2480}
2481
f2fcfcd6
GP		 2482static inline __u8 l2cap_select_mode(__u8 mode, __u16 remote_feat_mask)
2483{
2484 switch (mode) {
2485 case L2CAP_MODE_STREAMING:
2486 case L2CAP_MODE_ERTM:
2487 if (l2cap_mode_supported(mode, remote_feat_mask))
2488 return mode;
2489 /* fall through */
2490 default:
2491 return L2CAP_MODE_BASIC;
2492 }
2493}
2494
1da177e4
LT		 2495static int l2cap_build_conf_req(struct sock *sk, void *data)
2496{
2497 struct l2cap_pinfo *pi = l2cap_pi(sk);
2498 struct l2cap_conf_req *req = data;
bd3c9e25 2499 struct l2cap_conf_rfc rfc = { .mode = pi->mode };
1da177e4
LT		 2500 void *ptr = req->data;
2501
2502 BT_DBG("sk %p", sk);
2503
f2fcfcd6
GP		 2504 if (pi->num_conf_req || pi->num_conf_rsp)
2505 goto done;
2506
2507 switch (pi->mode) {
2508 case L2CAP_MODE_STREAMING:
2509 case L2CAP_MODE_ERTM:
2ba13ed6 2510 if (pi->conf_state & L2CAP_CONF_STATE2_DEVICE)
85eb53c6 2511 break;
85eb53c6 2512
2ba13ed6 2513 /* fall through */
f2fcfcd6
GP		 2514 default:
2515 pi->mode = l2cap_select_mode(rfc.mode, pi->conn->feat_mask);
2516 break;
2517 }
2518
2519done:
65c7c491
MH		 2520 switch (pi->mode) {
2521 case L2CAP_MODE_BASIC:
2522 if (pi->imtu != L2CAP_DEFAULT_MTU)
2523 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
62547752 2524
63406504
GP		 2525 if (!(pi->conn->feat_mask & L2CAP_FEAT_ERTM) &&
2526 !(pi->conn->feat_mask & L2CAP_FEAT_STREAMING))
2527 break;
2528
62547752
GP		 2529 rfc.mode = L2CAP_MODE_BASIC;
2530 rfc.txwin_size = 0;
2531 rfc.max_transmit = 0;
2532 rfc.retrans_timeout = 0;
2533 rfc.monitor_timeout = 0;
2534 rfc.max_pdu_size = 0;
2535
63406504
GP		 2536 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2537 (unsigned long) &rfc);
65c7c491
MH		 2538 break;
2539
2540 case L2CAP_MODE_ERTM:
2541 rfc.mode = L2CAP_MODE_ERTM;
14b5aa71 2542 rfc.txwin_size = pi->tx_win;
68d7f0ce 2543 rfc.max_transmit = pi->max_tx;
f2fcfcd6
GP		 2544 rfc.retrans_timeout = 0;
2545 rfc.monitor_timeout = 0;
c74e560c 2546 rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
d1daa091 2547 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
1c762159 2548 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
f2fcfcd6 2549
63406504
GP		 2550 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2551 (unsigned long) &rfc);
2552
fcc203c3
GP		 2553 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
2554 break;
2555
2556 if (pi->fcs == L2CAP_FCS_NONE ||
2557 pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
2558 pi->fcs = L2CAP_FCS_NONE;
2559 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
2560 }
f2fcfcd6
GP		 2561 break;
2562
2563 case L2CAP_MODE_STREAMING:
2564 rfc.mode = L2CAP_MODE_STREAMING;
2565 rfc.txwin_size = 0;
2566 rfc.max_transmit = 0;
2567 rfc.retrans_timeout = 0;
2568 rfc.monitor_timeout = 0;
c74e560c 2569 rfc.max_pdu_size = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
d1daa091 2570 if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
1c762159 2571 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
65c7c491 2572
63406504
GP		 2573 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc),
2574 (unsigned long) &rfc);
2575
fcc203c3
GP		 2576 if (!(pi->conn->feat_mask & L2CAP_FEAT_FCS))
2577 break;
2578
2579 if (pi->fcs == L2CAP_FCS_NONE ||
2580 pi->conf_state & L2CAP_CONF_NO_FCS_RECV) {
2581 pi->fcs = L2CAP_FCS_NONE;
2582 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, pi->fcs);
2583 }
65c7c491
MH		 2584 break;
2585 }
1da177e4
LT		 2586
2587 /* FIXME: Need actual value of the flush timeout */
2588 //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
2589 // l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
2590
aca3192c
YH		 2591 req->dcid = cpu_to_le16(pi->dcid);
2592 req->flags = cpu_to_le16(0);
1da177e4
LT		 2593
2594 return ptr - data;
2595}
2596
5dee9e7c 2597static int l2cap_parse_conf_req(struct sock *sk, void *data)
1da177e4
LT		 2598{
2599 struct l2cap_pinfo *pi = l2cap_pi(sk);
5dee9e7c
MH		 2600 struct l2cap_conf_rsp *rsp = data;
2601 void *ptr = rsp->data;
2602 void *req = pi->conf_req;
2603 int len = pi->conf_len;
2604 int type, hint, olen;
2605 unsigned long val;
6464f35f 2606 struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
861d6882 2607 u16 mtu = L2CAP_DEFAULT_MTU;
5dee9e7c 2608 u16 result = L2CAP_CONF_SUCCESS;
1da177e4 2609
5dee9e7c 2610 BT_DBG("sk %p", sk);
820ae1b8 2611
5dee9e7c
MH		 2612 while (len >= L2CAP_CONF_OPT_SIZE) {
2613 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1da177e4 2614
589d2746 2615 hint = type & L2CAP_CONF_HINT;
47ec1dcd 2616 type &= L2CAP_CONF_MASK;
5dee9e7c
MH		 2617
2618 switch (type) {
2619 case L2CAP_CONF_MTU:
861d6882 2620 mtu = val;
5dee9e7c
MH		 2621 break;
2622
2623 case L2CAP_CONF_FLUSH_TO:
2624 pi->flush_to = val;
2625 break;
2626
2627 case L2CAP_CONF_QOS:
2628 break;
2629
6464f35f
MH		 2630 case L2CAP_CONF_RFC:
2631 if (olen == sizeof(rfc))
2632 memcpy(&rfc, (void *) val, olen);
2633 break;
2634
fcc203c3
GP		 2635 case L2CAP_CONF_FCS:
2636 if (val == L2CAP_FCS_NONE)
2637 pi->conf_state |= L2CAP_CONF_NO_FCS_RECV;
2638
2639 break;
2640
5dee9e7c
MH		 2641 default:
2642 if (hint)
2643 break;
2644
2645 result = L2CAP_CONF_UNKNOWN;
2646 *((u8 *) ptr++) = type;
2647 break;
2648 }
2649 }
2650
e9aeb2dd 2651 if (pi->num_conf_rsp || pi->num_conf_req > 1)
f2fcfcd6
GP		 2652 goto done;
2653
2654 switch (pi->mode) {
2655 case L2CAP_MODE_STREAMING:
2656 case L2CAP_MODE_ERTM:
85eb53c6
GP		 2657 if (!(pi->conf_state & L2CAP_CONF_STATE2_DEVICE)) {
2658 pi->mode = l2cap_select_mode(rfc.mode,
2659 pi->conn->feat_mask);
2660 break;
2661 }
2662
742e519b 2663 if (pi->mode != rfc.mode)
f2fcfcd6 2664 return -ECONNREFUSED;
742e519b 2665
f2fcfcd6 2666 break;
f2fcfcd6
GP		 2667 }
2668
2669done:
2670 if (pi->mode != rfc.mode) {
2671 result = L2CAP_CONF_UNACCEPT;
2672 rfc.mode = pi->mode;
2673
2674 if (pi->num_conf_rsp == 1)
2675 return -ECONNREFUSED;
2676
2677 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2678 sizeof(rfc), (unsigned long) &rfc);
2679 }
2680
2681
5dee9e7c
MH		 2682 if (result == L2CAP_CONF_SUCCESS) {
2683 /* Configure output options and let the other side know
2684 * which ones we don't like. */
2685
f2fcfcd6
GP		 2686 if (mtu < L2CAP_DEFAULT_MIN_MTU)
2687 result = L2CAP_CONF_UNACCEPT;
2688 else {
2689 pi->omtu = mtu;
2690 pi->conf_state |= L2CAP_CONF_MTU_DONE;
2691 }
2692 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
6464f35f 2693
f2fcfcd6
GP		 2694 switch (rfc.mode) {
2695 case L2CAP_MODE_BASIC:
2696 pi->fcs = L2CAP_FCS_NONE;
2697 pi->conf_state |= L2CAP_CONF_MODE_DONE;
2698 break;
2699
2700 case L2CAP_MODE_ERTM:
2701 pi->remote_tx_win = rfc.txwin_size;
2702 pi->remote_max_tx = rfc.max_transmit;
86b1b263
MM		 2703
2704 if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
2705 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
1c762159
GP		 2706
2707 pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6 2708
10467e9e
GP		 2709 rfc.retrans_timeout =
2710 le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
2711 rfc.monitor_timeout =
2712 le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
f2fcfcd6
GP		 2713
2714 pi->conf_state |= L2CAP_CONF_MODE_DONE;
68ae6639
GP		 2715
2716 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2717 sizeof(rfc), (unsigned long) &rfc);
2718
f2fcfcd6
GP		 2719 break;
2720
2721 case L2CAP_MODE_STREAMING:
86b1b263
MM		 2722 if (le16_to_cpu(rfc.max_pdu_size) > pi->conn->mtu - 10)
2723 rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
1c762159
GP		 2724
2725 pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2726
2727 pi->conf_state |= L2CAP_CONF_MODE_DONE;
68ae6639
GP		 2728
2729 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2730 sizeof(rfc), (unsigned long) &rfc);
2731
f2fcfcd6
GP		 2732 break;
2733
2734 default:
5dee9e7c 2735 result = L2CAP_CONF_UNACCEPT;
5dee9e7c 2736
6464f35f 2737 memset(&rfc, 0, sizeof(rfc));
f2fcfcd6
GP		 2738 rfc.mode = pi->mode;
2739 }
6464f35f 2740
f2fcfcd6
GP		 2741 if (result == L2CAP_CONF_SUCCESS)
2742 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
2743 }
5dee9e7c
MH		 2744 rsp->scid = cpu_to_le16(pi->dcid);
2745 rsp->result = cpu_to_le16(result);
2746 rsp->flags = cpu_to_le16(0x0000);
2747
2748 return ptr - data;
1da177e4
LT		 2749}
2750
f2fcfcd6
GP		 2751static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data, u16 *result)
2752{
2753 struct l2cap_pinfo *pi = l2cap_pi(sk);
2754 struct l2cap_conf_req *req = data;
2755 void *ptr = req->data;
2756 int type, olen;
2757 unsigned long val;
2758 struct l2cap_conf_rfc rfc;
2759
2760 BT_DBG("sk %p, rsp %p, len %d, req %p", sk, rsp, len, data);
2761
2762 while (len >= L2CAP_CONF_OPT_SIZE) {
2763 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2764
2765 switch (type) {
2766 case L2CAP_CONF_MTU:
2767 if (val < L2CAP_DEFAULT_MIN_MTU) {
2768 *result = L2CAP_CONF_UNACCEPT;
8183b775 2769 pi->imtu = L2CAP_DEFAULT_MIN_MTU;
f2fcfcd6 2770 } else
8183b775
AE		 2771 pi->imtu = val;
2772 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
f2fcfcd6
GP		 2773 break;
2774
2775 case L2CAP_CONF_FLUSH_TO:
2776 pi->flush_to = val;
2777 l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO,
2778 2, pi->flush_to);
2779 break;
2780
2781 case L2CAP_CONF_RFC:
2782 if (olen == sizeof(rfc))
2783 memcpy(&rfc, (void *)val, olen);
2784
2785 if ((pi->conf_state & L2CAP_CONF_STATE2_DEVICE) &&
2786 rfc.mode != pi->mode)
2787 return -ECONNREFUSED;
2788
f2fcfcd6
GP		 2789 pi->fcs = 0;
2790
2791 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
2792 sizeof(rfc), (unsigned long) &rfc);
2793 break;
2794 }
2795 }
2796
6c2ea7a8
GP		 2797 if (pi->mode == L2CAP_MODE_BASIC && pi->mode != rfc.mode)
2798 return -ECONNREFUSED;
2799
2800 pi->mode = rfc.mode;
2801
f2fcfcd6
GP		 2802 if (*result == L2CAP_CONF_SUCCESS) {
2803 switch (rfc.mode) {
2804 case L2CAP_MODE_ERTM:
10467e9e
GP		 2805 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2806 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
1c762159 2807 pi->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2808 break;
2809 case L2CAP_MODE_STREAMING:
1c762159 2810 pi->mps = le16_to_cpu(rfc.max_pdu_size);
f2fcfcd6
GP		 2811 }
2812 }
2813
2814 req->dcid = cpu_to_le16(pi->dcid);
2815 req->flags = cpu_to_le16(0x0000);
2816
2817 return ptr - data;
2818}
2819
5dee9e7c 2820static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1da177e4
LT		 2821{
2822 struct l2cap_conf_rsp *rsp = data;
2823 void *ptr = rsp->data;
1da177e4 2824
5dee9e7c 2825 BT_DBG("sk %p", sk);
1da177e4 2826
aca3192c 2827 rsp->scid = cpu_to_le16(l2cap_pi(sk)->dcid);
5dee9e7c 2828 rsp->result = cpu_to_le16(result);
aca3192c 2829 rsp->flags = cpu_to_le16(flags);
1da177e4
LT		 2830
2831 return ptr - data;
2832}
2833
7b1c0049
GP		 2834static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
2835{
2836 struct l2cap_pinfo *pi = l2cap_pi(sk);
2837 int type, olen;
2838 unsigned long val;
2839 struct l2cap_conf_rfc rfc;
2840
2841 BT_DBG("sk %p, rsp %p, len %d", sk, rsp, len);
2842
2843 if ((pi->mode != L2CAP_MODE_ERTM) && (pi->mode != L2CAP_MODE_STREAMING))
2844 return;
2845
2846 while (len >= L2CAP_CONF_OPT_SIZE) {
2847 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2848
2849 switch (type) {
2850 case L2CAP_CONF_RFC:
2851 if (olen == sizeof(rfc))
2852 memcpy(&rfc, (void *)val, olen);
2853 goto done;
2854 }
2855 }
2856
2857done:
2858 switch (rfc.mode) {
2859 case L2CAP_MODE_ERTM:
10467e9e
GP		 2860 pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
2861 pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
7b1c0049
GP		 2862 pi->mps = le16_to_cpu(rfc.max_pdu_size);
2863 break;
2864 case L2CAP_MODE_STREAMING:
2865 pi->mps = le16_to_cpu(rfc.max_pdu_size);
2866 }
2867}
2868
4e8402a3
MH		 2869static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2870{
2871 struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
2872
2873 if (rej->reason != 0x0000)
2874 return 0;
2875
2876 if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
2877 cmd->ident == conn->info_ident) {
4e8402a3 2878 del_timer(&conn->info_timer);
984947dc
MH		 2879
2880 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 2881 conn->info_ident = 0;
984947dc 2882
4e8402a3
MH		 2883 l2cap_conn_start(conn);
2884 }
2885
2886 return 0;
2887}
2888
1da177e4
LT		 2889static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2890{
2891 struct l2cap_chan_list *list = &conn->chan_list;
2892 struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
2893 struct l2cap_conn_rsp rsp;
d793fe8c 2894 struct sock *parent, *sk = NULL;
e7c29cb1 2895 int result, status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2896
2897 u16 dcid = 0, scid = __le16_to_cpu(req->scid);
e7c29cb1 2898 __le16 psm = req->psm;
1da177e4
LT		 2899
2900 BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
2901
2902 /* Check if we have socket listening on psm */
2903 parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
2904 if (!parent) {
2905 result = L2CAP_CR_BAD_PSM;
2906 goto sendresp;
2907 }
2908
e0f0cb56
GP		 2909 bh_lock_sock(parent);
2910
e7c29cb1
MH		 2911 /* Check if the ACL is secure enough (if not SDP) */
2912 if (psm != cpu_to_le16(0x0001) &&
2913 !hci_conn_check_link_mode(conn->hcon)) {
2950f21a 2914 conn->disc_reason = 0x05;
e7c29cb1
MH		 2915 result = L2CAP_CR_SEC_BLOCK;
2916 goto response;
2917 }
2918
1da177e4
LT		 2919 result = L2CAP_CR_NO_MEM;
2920
2921 /* Check for backlog size */
2922 if (sk_acceptq_is_full(parent)) {
8e87d142 2923 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 2924 goto response;
2925 }
2926
3b1e0a65 2927 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1da177e4
LT		 2928 if (!sk)
2929 goto response;
2930
fd1278d7 2931 write_lock_bh(&list->lock);
1da177e4
LT		 2932
2933 /* Check if we already have channel with that dcid */
2934 if (__l2cap_get_chan_by_dcid(list, scid)) {
fd1278d7 2935 write_unlock_bh(&list->lock);
1da177e4
LT		 2936 sock_set_flag(sk, SOCK_ZAPPED);
2937 l2cap_sock_kill(sk);
2938 goto response;
2939 }
2940
2941 hci_conn_hold(conn->hcon);
2942
2943 l2cap_sock_init(sk, parent);
2944 bacpy(&bt_sk(sk)->src, conn->src);
2945 bacpy(&bt_sk(sk)->dst, conn->dst);
2946 l2cap_pi(sk)->psm = psm;
2947 l2cap_pi(sk)->dcid = scid;
2948
2949 __l2cap_chan_add(conn, sk, parent);
2950 dcid = l2cap_pi(sk)->scid;
2951
2952 l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
2953
1da177e4
LT		 2954 l2cap_pi(sk)->ident = cmd->ident;
2955
984947dc 2956 if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
2af6b9d5 2957 if (l2cap_check_security(sk)) {
f66dc81f
MH		 2958 if (bt_sk(sk)->defer_setup) {
2959 sk->sk_state = BT_CONNECT2;
2960 result = L2CAP_CR_PEND;
2961 status = L2CAP_CS_AUTHOR_PEND;
2962 parent->sk_data_ready(parent, 0);
2963 } else {
2964 sk->sk_state = BT_CONFIG;
2965 result = L2CAP_CR_SUCCESS;
2966 status = L2CAP_CS_NO_INFO;
2967 }
79d554a6
MH		 2968 } else {
2969 sk->sk_state = BT_CONNECT2;
2970 result = L2CAP_CR_PEND;
2971 status = L2CAP_CS_AUTHEN_PEND;
2972 }
2973 } else {
2974 sk->sk_state = BT_CONNECT2;
2975 result = L2CAP_CR_PEND;
2976 status = L2CAP_CS_NO_INFO;
1da177e4
LT		 2977 }
2978
fd1278d7 2979 write_unlock_bh(&list->lock);
1da177e4
LT		 2980
2981response:
2982 bh_unlock_sock(parent);
2983
2984sendresp:
aca3192c
YH		 2985 rsp.scid = cpu_to_le16(scid);
2986 rsp.dcid = cpu_to_le16(dcid);
2987 rsp.result = cpu_to_le16(result);
2988 rsp.status = cpu_to_le16(status);
1da177e4 2989 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
79d554a6
MH		 2990
2991 if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
2992 struct l2cap_info_req info;
2993 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2994
2995 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
2996 conn->info_ident = l2cap_get_ident(conn);
2997
2998 mod_timer(&conn->info_timer, jiffies +
2999 msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
3000
3001 l2cap_send_cmd(conn, conn->info_ident,
3002 L2CAP_INFO_REQ, sizeof(info), &info);
3003 }
3004
d793fe8c 3005 if (sk && !(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) &&
e9aeb2dd
GP		 3006 result == L2CAP_CR_SUCCESS) {
3007 u8 buf[128];
3008 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
3009 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3010 l2cap_build_conf_req(sk, buf), buf);
3011 l2cap_pi(sk)->num_conf_req++;
3012 }
3013
1da177e4
LT		 3014 return 0;
3015}
3016
3017static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3018{
3019 struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
3020 u16 scid, dcid, result, status;
3021 struct sock *sk;
3022 u8 req[128];
3023
3024 scid = __le16_to_cpu(rsp->scid);
3025 dcid = __le16_to_cpu(rsp->dcid);
3026 result = __le16_to_cpu(rsp->result);
3027 status = __le16_to_cpu(rsp->status);
3028
3029 BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
3030
3031 if (scid) {
af05b30b
GP		 3032 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
3033 if (!sk)
57d3b22b 3034 return -EFAULT;
1da177e4 3035 } else {
af05b30b
GP		 3036 sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
3037 if (!sk)
57d3b22b 3038 return -EFAULT;
1da177e4
LT		 3039 }
3040
3041 switch (result) {
3042 case L2CAP_CR_SUCCESS:
3043 sk->sk_state = BT_CONFIG;
3044 l2cap_pi(sk)->ident = 0;
3045 l2cap_pi(sk)->dcid = dcid;
6a8d3010
MH		 3046 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
3047
e9aeb2dd
GP		 3048 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)
3049 break;
3050
3051 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
3052
1da177e4
LT		 3053 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
3054 l2cap_build_conf_req(sk, req), req);
f2fcfcd6 3055 l2cap_pi(sk)->num_conf_req++;
1da177e4
LT		 3056 break;
3057
3058 case L2CAP_CR_PEND:
6a8d3010 3059 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1da177e4
LT		 3060 break;
3061
3062 default:
a49184c2
AE		 3063 /* don't delete l2cap channel if sk is owned by user */
3064 if (sock_owned_by_user(sk)) {
3065 sk->sk_state = BT_DISCONN;
3066 l2cap_sock_clear_timer(sk);
3067 l2cap_sock_set_timer(sk, HZ / 5);
3068 break;
3069 }
3070
1da177e4
LT		 3071 l2cap_chan_del(sk, ECONNREFUSED);
3072 break;
3073 }
3074
3075 bh_unlock_sock(sk);
3076 return 0;
3077}
3078
8c462b60
MM		 3079static inline void set_default_fcs(struct l2cap_pinfo *pi)
3080{
3081 /* FCS is enabled only in ERTM or streaming mode, if one or both
3082 * sides request it.
3083 */
3084 if (pi->mode != L2CAP_MODE_ERTM && pi->mode != L2CAP_MODE_STREAMING)
3085 pi->fcs = L2CAP_FCS_NONE;
3086 else if (!(pi->conf_state & L2CAP_CONF_NO_FCS_RECV))
3087 pi->fcs = L2CAP_FCS_CRC16;
3088}
3089
88219a0f 3090static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1da177e4
LT		 3091{
3092 struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
3093 u16 dcid, flags;
3094 u8 rsp[64];
3095 struct sock *sk;
5dee9e7c 3096 int len;
1da177e4
LT		 3097
3098 dcid = __le16_to_cpu(req->dcid);
3099 flags = __le16_to_cpu(req->flags);
3100
3101 BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
3102
af05b30b
GP		 3103 sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
3104 if (!sk)
1da177e4
LT		 3105 return -ENOENT;
3106
df6bd743
GP		 3107 if (sk->sk_state != BT_CONFIG) {
3108 struct l2cap_cmd_rej rej;
3109
3110 rej.reason = cpu_to_le16(0x0002);
3111 l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
3112 sizeof(rej), &rej);
354f60a9 3113 goto unlock;
df6bd743 3114 }
354f60a9 3115
5dee9e7c 3116 /* Reject if config buffer is too small. */
88219a0f 3117 len = cmd_len - sizeof(*req);
5dee9e7c
MH		 3118 if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
3119 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
3120 l2cap_build_conf_rsp(sk, rsp,
3121 L2CAP_CONF_REJECT, flags), rsp);
3122 goto unlock;
3123 }
3124
3125 /* Store config. */
3126 memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
3127 l2cap_pi(sk)->conf_len += len;
1da177e4
LT		 3128
3129 if (flags & 0x0001) {
3130 /* Incomplete config. Send empty response. */
3131 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
5dee9e7c
MH		 3132 l2cap_build_conf_rsp(sk, rsp,
3133 L2CAP_CONF_SUCCESS, 0x0001), rsp);
1da177e4
LT		 3134 goto unlock;
3135 }
3136
3137 /* Complete config. */
5dee9e7c 3138 len = l2cap_parse_conf_req(sk, rsp);
f2fcfcd6 3139 if (len < 0) {
9b108fc0 3140 l2cap_send_disconn_req(conn, sk, ECONNRESET);
1da177e4 3141 goto unlock;
f2fcfcd6 3142 }
1da177e4 3143
5dee9e7c 3144 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
f2fcfcd6 3145 l2cap_pi(sk)->num_conf_rsp++;
5dee9e7c 3146
5dee9e7c
MH		 3147 /* Reset config buffer. */
3148 l2cap_pi(sk)->conf_len = 0;
3149
876d9484
MH		 3150 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
3151 goto unlock;
3152
1da177e4 3153 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
8c462b60 3154 set_default_fcs(l2cap_pi(sk));
fcc203c3 3155
1da177e4 3156 sk->sk_state = BT_CONNECTED;
e90bac06 3157
0565c1c2
GP		 3158 l2cap_pi(sk)->next_tx_seq = 0;
3159 l2cap_pi(sk)->expected_tx_seq = 0;
1c2acffb 3160 __skb_queue_head_init(TX_QUEUE(sk));
0565c1c2
GP		 3161 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
3162 l2cap_ertm_init(sk);
3163
1da177e4 3164 l2cap_chan_ready(sk);
876d9484
MH		 3165 goto unlock;
3166 }
3167
3168 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
79d554a6 3169 u8 buf[64];
ab3e5715 3170 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1da177e4 3171 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
79d554a6 3172 l2cap_build_conf_req(sk, buf), buf);
f2fcfcd6 3173 l2cap_pi(sk)->num_conf_req++;
1da177e4
LT		 3174 }
3175
3176unlock:
3177 bh_unlock_sock(sk);
3178 return 0;
3179}
3180
3181static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3182{
3183 struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
3184 u16 scid, flags, result;
3185 struct sock *sk;
7b1c0049 3186 int len = cmd->len - sizeof(*rsp);
1da177e4
LT		 3187
3188 scid = __le16_to_cpu(rsp->scid);
3189 flags = __le16_to_cpu(rsp->flags);
3190 result = __le16_to_cpu(rsp->result);
3191
af05b30b
GP		 3192 BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
3193 scid, flags, result);
1da177e4 3194
af05b30b
GP		 3195 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
3196 if (!sk)
1da177e4
LT		 3197 return 0;
3198
3199 switch (result) {
3200 case L2CAP_CONF_SUCCESS:
7b1c0049 3201 l2cap_conf_rfc_get(sk, rsp->data, len);
1da177e4
LT		 3202 break;
3203
3204 case L2CAP_CONF_UNACCEPT:
f2fcfcd6 3205 if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
f2fcfcd6
GP		 3206 char req[64];
3207
c2c77ec8 3208 if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
9b108fc0 3209 l2cap_send_disconn_req(conn, sk, ECONNRESET);
c2c77ec8
AE		 3210 goto done;
3211 }
3212
f2fcfcd6
GP		 3213 /* throw out any old stored conf requests */
3214 result = L2CAP_CONF_SUCCESS;
3215 len = l2cap_parse_conf_rsp(sk, rsp->data,
3216 len, req, &result);
3217 if (len < 0) {
9b108fc0 3218 l2cap_send_disconn_req(conn, sk, ECONNRESET);
f2fcfcd6
GP		 3219 goto done;
3220 }
3221
3222 l2cap_send_cmd(conn, l2cap_get_ident(conn),
3223 L2CAP_CONF_REQ, len, req);
3224 l2cap_pi(sk)->num_conf_req++;
3225 if (result != L2CAP_CONF_SUCCESS)
3226 goto done;
3227 break;
1da177e4
LT		 3228 }
3229
8e87d142 3230 default:
b1235d79 3231 sk->sk_err = ECONNRESET;
1da177e4 3232 l2cap_sock_set_timer(sk, HZ * 5);
9b108fc0 3233 l2cap_send_disconn_req(conn, sk, ECONNRESET);
1da177e4
LT		 3234 goto done;
3235 }
3236
3237 if (flags & 0x01)
3238 goto done;
3239
1da177e4
LT		 3240 l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
3241
3242 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
8c462b60 3243 set_default_fcs(l2cap_pi(sk));
fcc203c3 3244
1da177e4 3245 sk->sk_state = BT_CONNECTED;
0565c1c2 3246 l2cap_pi(sk)->next_tx_seq = 0;
1c2acffb 3247 l2cap_pi(sk)->expected_tx_seq = 0;
1c2acffb 3248 __skb_queue_head_init(TX_QUEUE(sk));
0565c1c2
GP		 3249 if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
3250 l2cap_ertm_init(sk);
3251
1da177e4
LT		 3252 l2cap_chan_ready(sk);
3253 }
3254
3255done:
3256 bh_unlock_sock(sk);
3257 return 0;
3258}
3259
3260static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3261{
3262 struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
3263 struct l2cap_disconn_rsp rsp;
3264 u16 dcid, scid;
3265 struct sock *sk;
3266
3267 scid = __le16_to_cpu(req->scid);
3268 dcid = __le16_to_cpu(req->dcid);
3269
3270 BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
3271
af05b30b
GP		 3272 sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
3273 if (!sk)
1da177e4
LT		 3274 return 0;
3275
aca3192c
YH		 3276 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
3277 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
1da177e4
LT		 3278 l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
3279
3280 sk->sk_shutdown = SHUTDOWN_MASK;
3281
a49184c2
AE		 3282 /* don't delete l2cap channel if sk is owned by user */
3283 if (sock_owned_by_user(sk)) {
3284 sk->sk_state = BT_DISCONN;
3285 l2cap_sock_clear_timer(sk);
3286 l2cap_sock_set_timer(sk, HZ / 5);
3287 bh_unlock_sock(sk);
3288 return 0;
3289 }
3290
1da177e4
LT		 3291 l2cap_chan_del(sk, ECONNRESET);
3292 bh_unlock_sock(sk);
3293
3294 l2cap_sock_kill(sk);
3295 return 0;
3296}
3297
3298static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3299{
3300 struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
3301 u16 dcid, scid;
3302 struct sock *sk;
3303
3304 scid = __le16_to_cpu(rsp->scid);
3305 dcid = __le16_to_cpu(rsp->dcid);
3306
3307 BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
3308
af05b30b
GP		 3309 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
3310 if (!sk)
1da177e4
LT		 3311 return 0;
3312
a49184c2
AE		 3313 /* don't delete l2cap channel if sk is owned by user */
3314 if (sock_owned_by_user(sk)) {
3315 sk->sk_state = BT_DISCONN;
3316 l2cap_sock_clear_timer(sk);
3317 l2cap_sock_set_timer(sk, HZ / 5);
3318 bh_unlock_sock(sk);
3319 return 0;
3320 }
3321
1da177e4
LT		 3322 l2cap_chan_del(sk, 0);
3323 bh_unlock_sock(sk);
3324
3325 l2cap_sock_kill(sk);
3326 return 0;
3327}
3328
3329static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3330{
3331 struct l2cap_info_req *req = (struct l2cap_info_req *) data;
1da177e4
LT		 3332 u16 type;
3333
3334 type = __le16_to_cpu(req->type);
3335
3336 BT_DBG("type 0x%4.4x", type);
3337
f0709e03
MH		 3338 if (type == L2CAP_IT_FEAT_MASK) {
3339 u8 buf[8];
44dd46de 3340 u32 feat_mask = l2cap_feat_mask;
f0709e03
MH		 3341 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3342 rsp->type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
3343 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
d1c4a17d 3344 if (!disable_ertm)
fcc203c3
GP		 3345 feat_mask |= L2CAP_FEAT_ERTM | L2CAP_FEAT_STREAMING
3346 | L2CAP_FEAT_FCS;
1b7bf4ed 3347 put_unaligned_le32(feat_mask, rsp->data);
f0709e03
MH		 3348 l2cap_send_cmd(conn, cmd->ident,
3349 L2CAP_INFO_RSP, sizeof(buf), buf);
e1027a7c
MH		 3350 } else if (type == L2CAP_IT_FIXED_CHAN) {
3351 u8 buf[12];
3352 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
3353 rsp->type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3354 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
3355 memcpy(buf + 4, l2cap_fixed_chan, 8);
3356 l2cap_send_cmd(conn, cmd->ident,
3357 L2CAP_INFO_RSP, sizeof(buf), buf);
f0709e03
MH		 3358 } else {
3359 struct l2cap_info_rsp rsp;
3360 rsp.type = cpu_to_le16(type);
3361 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
3362 l2cap_send_cmd(conn, cmd->ident,
3363 L2CAP_INFO_RSP, sizeof(rsp), &rsp);
3364 }
1da177e4
LT		 3365
3366 return 0;
3367}
3368
3369static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
3370{
3371 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
3372 u16 type, result;
3373
3374 type = __le16_to_cpu(rsp->type);
3375 result = __le16_to_cpu(rsp->result);
3376
3377 BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
3378
4e8402a3
MH		 3379 del_timer(&conn->info_timer);
3380
adb08ede
VT		 3381 if (result != L2CAP_IR_SUCCESS) {
3382 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3383 conn->info_ident = 0;
3384
3385 l2cap_conn_start(conn);
3386
3387 return 0;
3388 }
3389
984947dc 3390 if (type == L2CAP_IT_FEAT_MASK) {
83985319 3391 conn->feat_mask = get_unaligned_le32(rsp->data);
4e8402a3 3392
47ec1dcd 3393 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
e1027a7c
MH		 3394 struct l2cap_info_req req;
3395 req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
3396
3397 conn->info_ident = l2cap_get_ident(conn);
3398
3399 l2cap_send_cmd(conn, conn->info_ident,
3400 L2CAP_INFO_REQ, sizeof(req), &req);
3401 } else {
3402 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
3403 conn->info_ident = 0;
3404
3405 l2cap_conn_start(conn);
3406 }
3407 } else if (type == L2CAP_IT_FIXED_CHAN) {
984947dc 3408 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
e1027a7c 3409 conn->info_ident = 0;
984947dc
MH		 3410
3411 l2cap_conn_start(conn);
3412 }
4e8402a3 3413
1da177e4
LT		 3414 return 0;
3415}
3416
3417static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
3418{
3419 u8 *data = skb->data;
3420 int len = skb->len;
3421 struct l2cap_cmd_hdr cmd;
3422 int err = 0;
3423
3424 l2cap_raw_recv(conn, skb);
3425
3426 while (len >= L2CAP_CMD_HDR_SIZE) {
88219a0f 3427 u16 cmd_len;
1da177e4
LT		 3428 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
3429 data += L2CAP_CMD_HDR_SIZE;
3430 len -= L2CAP_CMD_HDR_SIZE;
3431
88219a0f 3432 cmd_len = le16_to_cpu(cmd.len);
1da177e4 3433
88219a0f 3434 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
1da177e4 3435
88219a0f 3436 if (cmd_len > len || !cmd.ident) {
1da177e4
LT		 3437 BT_DBG("corrupted command");
3438 break;
3439 }
3440
3441 switch (cmd.code) {
3442 case L2CAP_COMMAND_REJ:
4e8402a3 3443 l2cap_command_rej(conn, &cmd, data);
1da177e4
LT		 3444 break;
3445
3446 case L2CAP_CONN_REQ:
3447 err = l2cap_connect_req(conn, &cmd, data);
3448 break;
3449
3450 case L2CAP_CONN_RSP:
3451 err = l2cap_connect_rsp(conn, &cmd, data);
3452 break;
3453
3454 case L2CAP_CONF_REQ:
88219a0f 3455 err = l2cap_config_req(conn, &cmd, cmd_len, data);
1da177e4
LT		 3456 break;
3457
3458 case L2CAP_CONF_RSP:
3459 err = l2cap_config_rsp(conn, &cmd, data);
3460 break;
3461
3462 case L2CAP_DISCONN_REQ:
3463 err = l2cap_disconnect_req(conn, &cmd, data);
3464 break;
3465
3466 case L2CAP_DISCONN_RSP:
3467 err = l2cap_disconnect_rsp(conn, &cmd, data);
3468 break;
3469
3470 case L2CAP_ECHO_REQ:
88219a0f 3471 l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
1da177e4
LT		 3472 break;
3473
3474 case L2CAP_ECHO_RSP:
3475 break;
3476
3477 case L2CAP_INFO_REQ:
3478 err = l2cap_information_req(conn, &cmd, data);
3479 break;
3480
3481 case L2CAP_INFO_RSP:
3482 err = l2cap_information_rsp(conn, &cmd, data);
3483 break;
3484
3485 default:
3486 BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
3487 err = -EINVAL;
3488 break;
3489 }
3490
3491 if (err) {
3492 struct l2cap_cmd_rej rej;
3493 BT_DBG("error %d", err);
3494
3495 /* FIXME: Map err to a valid reason */
aca3192c 3496 rej.reason = cpu_to_le16(0);
1da177e4
LT		 3497 l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
3498 }
3499
88219a0f
AV		 3500 data += cmd_len;
3501 len -= cmd_len;
1da177e4
LT		 3502 }
3503
3504 kfree_skb(skb);
3505}
3506
fcc203c3
GP		 3507static int l2cap_check_fcs(struct l2cap_pinfo *pi, struct sk_buff *skb)
3508{
3509 u16 our_fcs, rcv_fcs;
3510 int hdr_size = L2CAP_HDR_SIZE + 2;
3511
3512 if (pi->fcs == L2CAP_FCS_CRC16) {
3513 skb_trim(skb, skb->len - 2);
3514 rcv_fcs = get_unaligned_le16(skb->data + skb->len);
3515 our_fcs = crc16(0, skb->data - hdr_size, skb->len + hdr_size);
3516
3517 if (our_fcs != rcv_fcs)
7a560e5c 3518 return -EBADMSG;
fcc203c3
GP		 3519 }
3520 return 0;
3521}
3522
d5392c8f
GP		 3523static inline void l2cap_send_i_or_rr_or_rnr(struct sock *sk)
3524{
3525 struct l2cap_pinfo *pi = l2cap_pi(sk);
3526 u16 control = 0;
3527
3528 pi->frames_sent = 0;
d5392c8f
GP		 3529
3530 control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3531
3532 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
64988868 3533 control |= L2CAP_SUPER_RCV_NOT_READY;
d5392c8f 3534 l2cap_send_sframe(pi, control);
1890d36b 3535 pi->conn_state |= L2CAP_CONN_RNR_SENT;
d5392c8f
GP		 3536 }
3537
4ea727ef
GP		 3538 if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
3539 l2cap_retransmit_frames(sk);
d5392c8f
GP		 3540
3541 l2cap_ertm_send(sk);
3542
3543 if (!(pi->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
3544 pi->frames_sent == 0) {
3545 control |= L2CAP_SUPER_RCV_READY;
d5392c8f
GP		 3546 l2cap_send_sframe(pi, control);
3547 }
3548}
3549
9b53350d 3550static int l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
8f17154f
GP		 3551{
3552 struct sk_buff *next_skb;
bfbacc11
JPRV		 3553 struct l2cap_pinfo *pi = l2cap_pi(sk);
3554 int tx_seq_offset, next_tx_seq_offset;
8f17154f
GP		 3555
3556 bt_cb(skb)->tx_seq = tx_seq;
3557 bt_cb(skb)->sar = sar;
3558
3559 next_skb = skb_peek(SREJ_QUEUE(sk));
3560 if (!next_skb) {
3561 __skb_queue_tail(SREJ_QUEUE(sk), skb);
9b53350d 3562 return 0;
8f17154f
GP		 3563 }
3564
bfbacc11
JPRV		 3565 tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
3566 if (tx_seq_offset < 0)
3567 tx_seq_offset += 64;
3568
8f17154f 3569 do {
9b53350d
JPRV		 3570 if (bt_cb(next_skb)->tx_seq == tx_seq)
3571 return -EINVAL;
3572
bfbacc11
JPRV		 3573 next_tx_seq_offset = (bt_cb(next_skb)->tx_seq -
3574 pi->buffer_seq) % 64;
3575 if (next_tx_seq_offset < 0)
3576 next_tx_seq_offset += 64;
3577
3578 if (next_tx_seq_offset > tx_seq_offset) {
8f17154f 3579 __skb_queue_before(SREJ_QUEUE(sk), next_skb, skb);
9b53350d 3580 return 0;
8f17154f
GP		 3581 }
3582
3583 if (skb_queue_is_last(SREJ_QUEUE(sk), next_skb))
3584 break;
3585
59203a21 3586 } while ((next_skb = skb_queue_next(SREJ_QUEUE(sk), next_skb)));
8f17154f
GP		 3587
3588 __skb_queue_tail(SREJ_QUEUE(sk), skb);
9b53350d
JPRV		 3589
3590 return 0;
8f17154f
GP		 3591}
3592
18778a63
GP		 3593static int l2cap_ertm_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
3594{
3595 struct l2cap_pinfo *pi = l2cap_pi(sk);
3596 struct sk_buff *_skb;
1890d36b 3597 int err;
18778a63
GP		 3598
3599 switch (control & L2CAP_CTRL_SAR) {
3600 case L2CAP_SDU_UNSEGMENTED:
3601 if (pi->conn_state & L2CAP_CONN_SAR_SDU)
3602 goto drop;
3603
3604 err = sock_queue_rcv_skb(sk, skb);
3605 if (!err)
3606 return err;
3607
3608 break;
3609
3610 case L2CAP_SDU_START:
3611 if (pi->conn_state & L2CAP_CONN_SAR_SDU)
3612 goto drop;
3613
3614 pi->sdu_len = get_unaligned_le16(skb->data);
18778a63
GP		 3615
3616 if (pi->sdu_len > pi->imtu)
3617 goto disconnect;
3618
3619 pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
1890d36b
GP		 3620 if (!pi->sdu)
3621 return -ENOMEM;
3622
3623 /* pull sdu_len bytes only after alloc, because of Local Busy
3624 * condition we have to be sure that this will be executed
3625 * only once, i.e., when alloc does not fail */
3626 skb_pull(skb, 2);
18778a63
GP		 3627
3628 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3629
3630 pi->conn_state |= L2CAP_CONN_SAR_SDU;
3631 pi->partial_sdu_len = skb->len;
3632 break;
3633
3634 case L2CAP_SDU_CONTINUE:
3635 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3636 goto disconnect;
3637
3638 if (!pi->sdu)
3639 goto disconnect;
3640
18778a63
GP		 3641 pi->partial_sdu_len += skb->len;
3642 if (pi->partial_sdu_len > pi->sdu_len)
3643 goto drop;
3644
4178ba46
GP		 3645 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3646
18778a63
GP		 3647 break;
3648
3649 case L2CAP_SDU_END:
3650 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3651 goto disconnect;
3652
3653 if (!pi->sdu)
3654 goto disconnect;
3655
1890d36b 3656 if (!(pi->conn_state & L2CAP_CONN_SAR_RETRY)) {
1890d36b 3657 pi->partial_sdu_len += skb->len;
18778a63 3658
1890d36b
GP		 3659 if (pi->partial_sdu_len > pi->imtu)
3660 goto drop;
18778a63 3661
1890d36b
GP		 3662 if (pi->partial_sdu_len != pi->sdu_len)
3663 goto drop;
4178ba46
GP		 3664
3665 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
1890d36b 3666 }
18778a63
GP		 3667
3668 _skb = skb_clone(pi->sdu, GFP_ATOMIC);
1890d36b
GP		 3669 if (!_skb) {
3670 pi->conn_state |= L2CAP_CONN_SAR_RETRY;
3671 return -ENOMEM;
3672 }
3673
18778a63 3674 err = sock_queue_rcv_skb(sk, _skb);
1890d36b 3675 if (err < 0) {
18778a63 3676 kfree_skb(_skb);
1890d36b
GP		 3677 pi->conn_state |= L2CAP_CONN_SAR_RETRY;
3678 return err;
3679 }
3680
3681 pi->conn_state &= ~L2CAP_CONN_SAR_RETRY;
3682 pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
18778a63
GP		 3683
3684 kfree_skb(pi->sdu);
3685 break;
3686 }
3687
3688 kfree_skb(skb);
1890d36b 3689 return 0;
18778a63
GP		 3690
3691drop:
3692 kfree_skb(pi->sdu);
3693 pi->sdu = NULL;
3694
3695disconnect:
9b108fc0 3696 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
18778a63
GP		 3697 kfree_skb(skb);
3698 return 0;
3699}
3700
712132eb
GP		 3701static int l2cap_try_push_rx_skb(struct sock *sk)
3702{
3703 struct l2cap_pinfo *pi = l2cap_pi(sk);
3704 struct sk_buff *skb;
3705 u16 control;
3706 int err;
3707
3708 while ((skb = skb_dequeue(BUSY_QUEUE(sk)))) {
3709 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
3710 err = l2cap_ertm_reassembly_sdu(sk, skb, control);
3711 if (err < 0) {
3712 skb_queue_head(BUSY_QUEUE(sk), skb);
3713 return -EBUSY;
3714 }
3715
3716 pi->buffer_seq = (pi->buffer_seq + 1) % 64;
3717 }
3718
3719 if (!(pi->conn_state & L2CAP_CONN_RNR_SENT))
3720 goto done;
3721
3722 control = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3723 control |= L2CAP_SUPER_RCV_READY | L2CAP_CTRL_POLL;
3724 l2cap_send_sframe(pi, control);
3725 l2cap_pi(sk)->retry_count = 1;
3726
3727 del_timer(&pi->retrans_timer);
3728 __mod_monitor_timer();
3729
3730 l2cap_pi(sk)->conn_state |= L2CAP_CONN_WAIT_F;
3731
3732done:
3733 pi->conn_state &= ~L2CAP_CONN_LOCAL_BUSY;
3734 pi->conn_state &= ~L2CAP_CONN_RNR_SENT;
3735
3736 BT_DBG("sk %p, Exit local busy", sk);
3737
3738 return 0;
3739}
3740
1890d36b
GP		 3741static void l2cap_busy_work(struct work_struct *work)
3742{
3743 DECLARE_WAITQUEUE(wait, current);
3744 struct l2cap_pinfo *pi =
3745 container_of(work, struct l2cap_pinfo, busy_work);
3746 struct sock *sk = (struct sock *)pi;
3747 int n_tries = 0, timeo = HZ/5, err;
3748 struct sk_buff *skb;
1890d36b
GP		 3749
3750 lock_sock(sk);
3751
2b0b05dd 3752 add_wait_queue(sk_sleep(sk), &wait);
1890d36b
GP		 3753 while ((skb = skb_peek(BUSY_QUEUE(sk)))) {
3754 set_current_state(TASK_INTERRUPTIBLE);
3755
3756 if (n_tries++ > L2CAP_LOCAL_BUSY_TRIES) {
3757 err = -EBUSY;
9b108fc0 3758 l2cap_send_disconn_req(pi->conn, sk, EBUSY);
712132eb 3759 break;
1890d36b
GP		 3760 }
3761
3762 if (!timeo)
3763 timeo = HZ/5;
3764
3765 if (signal_pending(current)) {
3766 err = sock_intr_errno(timeo);
712132eb 3767 break;
1890d36b
GP		 3768 }
3769
3770 release_sock(sk);
3771 timeo = schedule_timeout(timeo);
3772 lock_sock(sk);
3773
3774 err = sock_error(sk);
3775 if (err)
712132eb 3776 break;
1890d36b 3777
712132eb 3778 if (l2cap_try_push_rx_skb(sk) == 0)
1890d36b
GP		 3779 break;
3780 }
3781
1890d36b 3782 set_current_state(TASK_RUNNING);
2b0b05dd 3783 remove_wait_queue(sk_sleep(sk), &wait);
1890d36b
GP		 3784
3785 release_sock(sk);
3786}
3787
3788static int l2cap_push_rx_skb(struct sock *sk, struct sk_buff *skb, u16 control)
3789{
3790 struct l2cap_pinfo *pi = l2cap_pi(sk);
3791 int sctrl, err;
3792
3793 if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
3794 bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
3795 __skb_queue_tail(BUSY_QUEUE(sk), skb);
712132eb
GP		 3796 return l2cap_try_push_rx_skb(sk);
3797
3798
1890d36b
GP		 3799 }
3800
3801 err = l2cap_ertm_reassembly_sdu(sk, skb, control);
3802 if (err >= 0) {
3803 pi->buffer_seq = (pi->buffer_seq + 1) % 64;
3804 return err;
3805 }
3806
3807 /* Busy Condition */
0e98958d
GP		 3808 BT_DBG("sk %p, Enter local busy", sk);
3809
1890d36b
GP		 3810 pi->conn_state |= L2CAP_CONN_LOCAL_BUSY;
3811 bt_cb(skb)->sar = control >> L2CAP_CTRL_SAR_SHIFT;
3812 __skb_queue_tail(BUSY_QUEUE(sk), skb);
3813
3814 sctrl = pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3815 sctrl |= L2CAP_SUPER_RCV_NOT_READY;
3816 l2cap_send_sframe(pi, sctrl);
3817
3818 pi->conn_state |= L2CAP_CONN_RNR_SENT;
3819
7fe9b298
GP		 3820 del_timer(&pi->ack_timer);
3821
1890d36b
GP		 3822 queue_work(_busy_wq, &pi->busy_work);
3823
3824 return err;
3825}
3826
18778a63 3827static int l2cap_streaming_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 control)
c74e560c
GP		 3828{
3829 struct l2cap_pinfo *pi = l2cap_pi(sk);
3830 struct sk_buff *_skb;
3831 int err = -EINVAL;
3832
18778a63
GP		 3833 /*
3834 * TODO: We have to notify the userland if some data is lost with the
3835 * Streaming Mode.
3836 */
3837
c74e560c
GP		 3838 switch (control & L2CAP_CTRL_SAR) {
3839 case L2CAP_SDU_UNSEGMENTED:
3840 if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
3841 kfree_skb(pi->sdu);
3842 break;
3843 }
3844
3845 err = sock_queue_rcv_skb(sk, skb);
3846 if (!err)
3847 return 0;
3848
3849 break;
3850
3851 case L2CAP_SDU_START:
3852 if (pi->conn_state & L2CAP_CONN_SAR_SDU) {
3853 kfree_skb(pi->sdu);
3854 break;
3855 }
3856
3857 pi->sdu_len = get_unaligned_le16(skb->data);
3858 skb_pull(skb, 2);
3859
052897ca
GP		 3860 if (pi->sdu_len > pi->imtu) {
3861 err = -EMSGSIZE;
3862 break;
3863 }
3864
c74e560c
GP		 3865 pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
3866 if (!pi->sdu) {
3867 err = -ENOMEM;
3868 break;
3869 }
3870
3871 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3872
3873 pi->conn_state |= L2CAP_CONN_SAR_SDU;
3874 pi->partial_sdu_len = skb->len;
3875 err = 0;
3876 break;
3877
3878 case L2CAP_SDU_CONTINUE:
3879 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3880 break;
3881
3882 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3883
3884 pi->partial_sdu_len += skb->len;
3885 if (pi->partial_sdu_len > pi->sdu_len)
3886 kfree_skb(pi->sdu);
3887 else
3888 err = 0;
3889
3890 break;
3891
3892 case L2CAP_SDU_END:
3893 if (!(pi->conn_state & L2CAP_CONN_SAR_SDU))
3894 break;
3895
3896 memcpy(skb_put(pi->sdu, skb->len), skb->data, skb->len);
3897
3898 pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
3899 pi->partial_sdu_len += skb->len;
3900
36f2fd58
GP		 3901 if (pi->partial_sdu_len > pi->imtu)
3902 goto drop;
3903
c74e560c
GP		 3904 if (pi->partial_sdu_len == pi->sdu_len) {
3905 _skb = skb_clone(pi->sdu, GFP_ATOMIC);
3906 err = sock_queue_rcv_skb(sk, _skb);
3907 if (err < 0)
3908 kfree_skb(_skb);
3909 }
c74e560c
GP		 3910 err = 0;
3911
36f2fd58
GP		 3912drop:
3913 kfree_skb(pi->sdu);
c74e560c
GP		 3914 break;
3915 }
3916
3917 kfree_skb(skb);
3918 return err;
3919}
3920
8f17154f
GP		 3921static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
3922{
3923 struct sk_buff *skb;
afefdbc4 3924 u16 control;
8f17154f 3925
59203a21 3926 while ((skb = skb_peek(SREJ_QUEUE(sk)))) {
8f17154f
GP		 3927 if (bt_cb(skb)->tx_seq != tx_seq)
3928 break;
3929
3930 skb = skb_dequeue(SREJ_QUEUE(sk));
afefdbc4 3931 control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
18778a63 3932 l2cap_ertm_reassembly_sdu(sk, skb, control);
8f17154f
GP		 3933 l2cap_pi(sk)->buffer_seq_srej =
3934 (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
8ff50ec0 3935 tx_seq = (tx_seq + 1) % 64;
8f17154f
GP		 3936 }
3937}
3938
3939static void l2cap_resend_srejframe(struct sock *sk, u8 tx_seq)
3940{
3941 struct l2cap_pinfo *pi = l2cap_pi(sk);
3942 struct srej_list *l, *tmp;
3943 u16 control;
3944
59203a21 3945 list_for_each_entry_safe(l, tmp, SREJ_LIST(sk), list) {
8f17154f
GP		 3946 if (l->tx_seq == tx_seq) {
3947 list_del(&l->list);
3948 kfree(l);
3949 return;
3950 }
3951 control = L2CAP_SUPER_SELECT_REJECT;
3952 control |= l->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3953 l2cap_send_sframe(pi, control);
3954 list_del(&l->list);
3955 list_add_tail(&l->list, SREJ_LIST(sk));
3956 }
3957}
3958
3959static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
3960{
3961 struct l2cap_pinfo *pi = l2cap_pi(sk);
3962 struct srej_list *new;
3963 u16 control;
3964
3965 while (tx_seq != pi->expected_tx_seq) {
3966 control = L2CAP_SUPER_SELECT_REJECT;
3967 control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
3968 l2cap_send_sframe(pi, control);
3969
3970 new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
8ff50ec0
GP		 3971 new->tx_seq = pi->expected_tx_seq;
3972 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
8f17154f
GP		 3973 list_add_tail(&new->list, SREJ_LIST(sk));
3974 }
8ff50ec0 3975 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
8f17154f
GP		 3976}
3977
1c2acffb
GP		 3978static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
3979{
3980 struct l2cap_pinfo *pi = l2cap_pi(sk);
3981 u8 tx_seq = __get_txseq(rx_control);
9f121a5a 3982 u8 req_seq = __get_reqseq(rx_control);
8f17154f 3983 u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
f6337c77 3984 int tx_seq_offset, expected_tx_seq_offset;
803020c6 3985 int num_to_ack = (pi->tx_win/6) + 1;
1c2acffb
GP		 3986 int err = 0;
3987
0e98958d
GP		 3988 BT_DBG("sk %p len %d tx_seq %d rx_control 0x%4.4x", sk, skb->len, tx_seq,
3989 rx_control);
1c2acffb 3990
9b16dc65
GP		 3991 if (L2CAP_CTRL_FINAL & rx_control &&
3992 l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
1d8f5d16
GP		 3993 del_timer(&pi->monitor_timer);
3994 if (pi->unacked_frames > 0)
3995 __mod_retrans_timer();
3996 pi->conn_state &= ~L2CAP_CONN_WAIT_F;
3997 }
3998
9f121a5a
GP		 3999 pi->expected_ack_seq = req_seq;
4000 l2cap_drop_acked_frames(sk);
4001
8f17154f
GP		 4002 if (tx_seq == pi->expected_tx_seq)
4003 goto expected;
1c2acffb 4004
9b53350d
JPRV		 4005 tx_seq_offset = (tx_seq - pi->buffer_seq) % 64;
4006 if (tx_seq_offset < 0)
4007 tx_seq_offset += 64;
4008
4009 /* invalid tx_seq */
4010 if (tx_seq_offset >= pi->tx_win) {
9b108fc0 4011 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
9b53350d
JPRV		 4012 goto drop;
4013 }
4014
1890d36b
GP		 4015 if (pi->conn_state == L2CAP_CONN_LOCAL_BUSY)
4016 goto drop;
4017
8f17154f
GP		 4018 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
4019 struct srej_list *first;
30afb5b2 4020
8f17154f
GP		 4021 first = list_first_entry(SREJ_LIST(sk),
4022 struct srej_list, list);
4023 if (tx_seq == first->tx_seq) {
4024 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
4025 l2cap_check_srej_gap(sk, tx_seq);
4026
4027 list_del(&first->list);
4028 kfree(first);
4029
4030 if (list_empty(SREJ_LIST(sk))) {
4031 pi->buffer_seq = pi->buffer_seq_srej;
4032 pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
855666cc 4033 l2cap_send_ack(pi);
0e98958d 4034 BT_DBG("sk %p, Exit SREJ_SENT", sk);
8f17154f
GP		 4035 }
4036 } else {
4037 struct srej_list *l;
9b53350d
JPRV		 4038
4039 /* duplicated tx_seq */
4040 if (l2cap_add_to_srej_queue(sk, skb, tx_seq, sar) < 0)
4041 goto drop;
8f17154f
GP		 4042
4043 list_for_each_entry(l, SREJ_LIST(sk), list) {
4044 if (l->tx_seq == tx_seq) {
4045 l2cap_resend_srejframe(sk, tx_seq);
4046 return 0;
4047 }
4048 }
4049 l2cap_send_srejframe(sk, tx_seq);
30afb5b2
GP		 4050 }
4051 } else {
9b53350d
JPRV		 4052 expected_tx_seq_offset =
4053 (pi->expected_tx_seq - pi->buffer_seq) % 64;
4054 if (expected_tx_seq_offset < 0)
4055 expected_tx_seq_offset += 64;
4056
4057 /* duplicated tx_seq */
4058 if (tx_seq_offset < expected_tx_seq_offset)
4059 goto drop;
4060
8f17154f 4061 pi->conn_state |= L2CAP_CONN_SREJ_SENT;
1c2acffb 4062
0e98958d
GP		 4063 BT_DBG("sk %p, Enter SREJ", sk);
4064
8f17154f
GP		 4065 INIT_LIST_HEAD(SREJ_LIST(sk));
4066 pi->buffer_seq_srej = pi->buffer_seq;
4067
4068 __skb_queue_head_init(SREJ_QUEUE(sk));
1890d36b 4069 __skb_queue_head_init(BUSY_QUEUE(sk));
8f17154f
GP		 4070 l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
4071
ef54fd93
GP		 4072 pi->conn_state |= L2CAP_CONN_SEND_PBIT;
4073
8f17154f 4074 l2cap_send_srejframe(sk, tx_seq);
7fe9b298
GP		 4075
4076 del_timer(&pi->ack_timer);
1c2acffb 4077 }
30afb5b2
GP		 4078 return 0;
4079
8f17154f
GP		 4080expected:
4081 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
4082
4083 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
3b1a9f3f
GP		 4084 bt_cb(skb)->tx_seq = tx_seq;
4085 bt_cb(skb)->sar = sar;
4086 __skb_queue_tail(SREJ_QUEUE(sk), skb);
8f17154f
GP		 4087 return 0;
4088 }
4089
2ece3684
GP		 4090 err = l2cap_push_rx_skb(sk, skb, rx_control);
4091 if (err < 0)
4092 return 0;
4093
4ec10d97
GP		 4094 if (rx_control & L2CAP_CTRL_FINAL) {
4095 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
4096 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
dfc909be
GP		 4097 else
4098 l2cap_retransmit_frames(sk);
4ec10d97
GP		 4099 }
4100
c1b4f43b
GP		 4101 __mod_ack_timer();
4102
803020c6
GP		 4103 pi->num_acked = (pi->num_acked + 1) % num_to_ack;
4104 if (pi->num_acked == num_to_ack - 1)
9e917af1
GP		 4105 l2cap_send_ack(pi);
4106
8f17154f 4107 return 0;
9b53350d
JPRV		 4108
4109drop:
4110 kfree_skb(skb);
4111 return 0;
1c2acffb
GP		 4112}
4113
e072745f 4114static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
1c2acffb
GP		 4115{
4116 struct l2cap_pinfo *pi = l2cap_pi(sk);
6e3a5981 4117
0e98958d
GP		 4118 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, __get_reqseq(rx_control),
4119 rx_control);
4120
6e3a5981
GP		 4121 pi->expected_ack_seq = __get_reqseq(rx_control);
4122 l2cap_drop_acked_frames(sk);
1c2acffb 4123
e072745f 4124 if (rx_control & L2CAP_CTRL_POLL) {
3cb123d1 4125 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
05fbd89d
GP		 4126 if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
4127 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
4128 (pi->unacked_frames > 0))
4129 __mod_retrans_timer();
4130
4131 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
4132 l2cap_send_srejtail(sk);
4133 } else {
4134 l2cap_send_i_or_rr_or_rnr(sk);
05fbd89d 4135 }
1d8f5d16 4136
e072745f
GP		 4137 } else if (rx_control & L2CAP_CTRL_FINAL) {
4138 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
4ec10d97 4139
e072745f
GP		 4140 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
4141 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
dfc909be
GP		 4142 else
4143 l2cap_retransmit_frames(sk);
2246b2f1 4144
e072745f 4145 } else {
e072745f
GP		 4146 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
4147 (pi->unacked_frames > 0))
4148 __mod_retrans_timer();
1c2acffb 4149
2246b2f1 4150 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
894718a6 4151 if (pi->conn_state & L2CAP_CONN_SREJ_SENT)
e072745f 4152 l2cap_send_ack(pi);
894718a6 4153 else
e072745f
GP		 4154 l2cap_ertm_send(sk);
4155 }
4156}
2246b2f1 4157
e072745f
GP		 4158static inline void l2cap_data_channel_rejframe(struct sock *sk, u16 rx_control)
4159{
4160 struct l2cap_pinfo *pi = l2cap_pi(sk);
4161 u8 tx_seq = __get_reqseq(rx_control);
30afb5b2 4162
0e98958d
GP		 4163 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
4164
e072745f
GP		 4165 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
4166
8abb52ee 4167 pi->expected_ack_seq = tx_seq;
e072745f
GP		 4168 l2cap_drop_acked_frames(sk);
4169
4170 if (rx_control & L2CAP_CTRL_FINAL) {
4171 if (pi->conn_state & L2CAP_CONN_REJ_ACT)
4172 pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
dfc909be
GP		 4173 else
4174 l2cap_retransmit_frames(sk);
e072745f 4175 } else {
dfc909be 4176 l2cap_retransmit_frames(sk);
30afb5b2 4177
0301ef04 4178 if (pi->conn_state & L2CAP_CONN_WAIT_F)
e072745f 4179 pi->conn_state |= L2CAP_CONN_REJ_ACT;
e072745f
GP		 4180 }
4181}
4182static inline void l2cap_data_channel_srejframe(struct sock *sk, u16 rx_control)
4183{
4184 struct l2cap_pinfo *pi = l2cap_pi(sk);
4185 u8 tx_seq = __get_reqseq(rx_control);
30afb5b2 4186
0e98958d
GP		 4187 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
4188
e072745f 4189 pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
2246b2f1 4190
e072745f
GP		 4191 if (rx_control & L2CAP_CTRL_POLL) {
4192 pi->expected_ack_seq = tx_seq;
4193 l2cap_drop_acked_frames(sk);
3cb123d1
GP		 4194
4195 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
dfc909be
GP		 4196 l2cap_retransmit_one_frame(sk, tx_seq);
4197
e072745f 4198 l2cap_ertm_send(sk);
dfc909be 4199
e072745f
GP		 4200 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
4201 pi->srej_save_reqseq = tx_seq;
4202 pi->conn_state |= L2CAP_CONN_SREJ_ACT;
ef54fd93 4203 }
e072745f
GP		 4204 } else if (rx_control & L2CAP_CTRL_FINAL) {
4205 if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
4206 pi->srej_save_reqseq == tx_seq)
4207 pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
4208 else
dfc909be 4209 l2cap_retransmit_one_frame(sk, tx_seq);
e072745f 4210 } else {
dfc909be 4211 l2cap_retransmit_one_frame(sk, tx_seq);
e072745f
GP		 4212 if (pi->conn_state & L2CAP_CONN_WAIT_F) {
4213 pi->srej_save_reqseq = tx_seq;
4214 pi->conn_state |= L2CAP_CONN_SREJ_ACT;
ef54fd93 4215 }
e072745f
GP		 4216 }
4217}
4218
4219static inline void l2cap_data_channel_rnrframe(struct sock *sk, u16 rx_control)
4220{
4221 struct l2cap_pinfo *pi = l2cap_pi(sk);
4222 u8 tx_seq = __get_reqseq(rx_control);
4223
0e98958d
GP		 4224 BT_DBG("sk %p, req_seq %d ctrl 0x%4.4x", sk, tx_seq, rx_control);
4225
e072745f
GP		 4226 pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
4227 pi->expected_ack_seq = tx_seq;
4228 l2cap_drop_acked_frames(sk);
4229
3cb123d1
GP		 4230 if (rx_control & L2CAP_CTRL_POLL)
4231 pi->conn_state |= L2CAP_CONN_SEND_FBIT;
4232
99b0d4b7
GP		 4233 if (!(pi->conn_state & L2CAP_CONN_SREJ_SENT)) {
4234 del_timer(&pi->retrans_timer);
a2e12a2a
GP		 4235 if (rx_control & L2CAP_CTRL_POLL)
4236 l2cap_send_rr_or_rnr(pi, L2CAP_CTRL_FINAL);
99b0d4b7 4237 return;
e072745f 4238 }
99b0d4b7
GP		 4239
4240 if (rx_control & L2CAP_CTRL_POLL)
4241 l2cap_send_srejtail(sk);
4242 else
4243 l2cap_send_sframe(pi, L2CAP_SUPER_RCV_READY);
e072745f
GP		 4244}
4245
4246static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
4247{
4248 BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
4249
9b16dc65
GP		 4250 if (L2CAP_CTRL_FINAL & rx_control &&
4251 l2cap_pi(sk)->conn_state & L2CAP_CONN_WAIT_F) {
e072745f
GP		 4252 del_timer(&l2cap_pi(sk)->monitor_timer);
4253 if (l2cap_pi(sk)->unacked_frames > 0)
4254 __mod_retrans_timer();
4255 l2cap_pi(sk)->conn_state &= ~L2CAP_CONN_WAIT_F;
4256 }
4257
4258 switch (rx_control & L2CAP_CTRL_SUPERVISE) {
4259 case L2CAP_SUPER_RCV_READY:
4260 l2cap_data_channel_rrframe(sk, rx_control);
8f17154f
GP		 4261 break;
4262
e072745f
GP		 4263 case L2CAP_SUPER_REJECT:
4264 l2cap_data_channel_rejframe(sk, rx_control);
4265 break;
2246b2f1 4266
e072745f
GP		 4267 case L2CAP_SUPER_SELECT_REJECT:
4268 l2cap_data_channel_srejframe(sk, rx_control);
4269 break;
4270
4271 case L2CAP_SUPER_RCV_NOT_READY:
4272 l2cap_data_channel_rnrframe(sk, rx_control);
1c2acffb
GP		 4273 break;
4274 }
4275
faaebd19 4276 kfree_skb(skb);
1c2acffb
GP		 4277 return 0;
4278}
4279
218bb9df
GP		 4280static int l2cap_ertm_data_rcv(struct sock *sk, struct sk_buff *skb)
4281{
4282 struct l2cap_pinfo *pi = l2cap_pi(sk);
4283 u16 control;
4284 u8 req_seq;
4285 int len, next_tx_seq_offset, req_seq_offset;
4286
4287 control = get_unaligned_le16(skb->data);
4288 skb_pull(skb, 2);
4289 len = skb->len;
4290
4291 /*
4292 * We can just drop the corrupted I-frame here.
4293 * Receiver will miss it and start proper recovery
4294 * procedures and ask retransmission.
4295 */
4296 if (l2cap_check_fcs(pi, skb))
4297 goto drop;
4298
4299 if (__is_sar_start(control) && __is_iframe(control))
4300 len -= 2;
4301
4302 if (pi->fcs == L2CAP_FCS_CRC16)
4303 len -= 2;
4304
4305 if (len > pi->mps) {
4306 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
4307 goto drop;
4308 }
4309
4310 req_seq = __get_reqseq(control);
4311 req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
4312 if (req_seq_offset < 0)
4313 req_seq_offset += 64;
4314
4315 next_tx_seq_offset =
4316 (pi->next_tx_seq - pi->expected_ack_seq) % 64;
4317 if (next_tx_seq_offset < 0)
4318 next_tx_seq_offset += 64;
4319
4320 /* check for invalid req-seq */
4321 if (req_seq_offset > next_tx_seq_offset) {
4322 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
4323 goto drop;
4324 }
4325
4326 if (__is_iframe(control)) {
4327 if (len < 0) {
4328 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
4329 goto drop;
4330 }
4331
4332 l2cap_data_channel_iframe(sk, control, skb);
4333 } else {
4334 if (len != 0) {
4335 BT_ERR("%d", len);
4336 l2cap_send_disconn_req(pi->conn, sk, ECONNRESET);
4337 goto drop;
4338 }
4339
4340 l2cap_data_channel_sframe(sk, control, skb);
4341 }
4342
4343 return 0;
4344
4345drop:
4346 kfree_skb(skb);
4347 return 0;
4348}
4349
1da177e4
LT		 4350static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
4351{
4352 struct sock *sk;
6840ed07 4353 struct l2cap_pinfo *pi;
51893f88 4354 u16 control;
218bb9df
GP		 4355 u8 tx_seq;
4356 int len;
1da177e4
LT		 4357
4358 sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
4359 if (!sk) {
4360 BT_DBG("unknown cid 0x%4.4x", cid);
4361 goto drop;
4362 }
4363
6840ed07
GP		 4364 pi = l2cap_pi(sk);
4365
1da177e4
LT		 4366 BT_DBG("sk %p, len %d", sk, skb->len);
4367
4368 if (sk->sk_state != BT_CONNECTED)
4369 goto drop;
4370
6840ed07 4371 switch (pi->mode) {
1c2acffb
GP		 4372 case L2CAP_MODE_BASIC:
4373 /* If socket recv buffers overflows we drop data here
4374 * which is *bad* because L2CAP has to be reliable.
4375 * But we don't have any other choice. L2CAP doesn't
4376 * provide flow control mechanism. */
1da177e4 4377
6840ed07 4378 if (pi->imtu < skb->len)
1c2acffb 4379 goto drop;
1da177e4 4380
1c2acffb
GP		 4381 if (!sock_queue_rcv_skb(sk, skb))
4382 goto done;
4383 break;
4384
4385 case L2CAP_MODE_ERTM:
218bb9df
GP		 4386 if (!sock_owned_by_user(sk)) {
4387 l2cap_ertm_data_rcv(sk, skb);
277ffbe3 4388 } else {
218bb9df 4389 if (sk_add_backlog(sk, skb))
277ffbe3 4390 goto drop;
277ffbe3 4391 }
1c2acffb 4392
fcafde2e 4393 goto done;
1c2acffb 4394
6840ed07
GP		 4395 case L2CAP_MODE_STREAMING:
4396 control = get_unaligned_le16(skb->data);
4397 skb_pull(skb, 2);
4398 len = skb->len;
4399
26000089
GP		 4400 if (l2cap_check_fcs(pi, skb))
4401 goto drop;
4402
6840ed07
GP		 4403 if (__is_sar_start(control))
4404 len -= 2;
4405
fcc203c3
GP		 4406 if (pi->fcs == L2CAP_FCS_CRC16)
4407 len -= 2;
4408
51893f88 4409 if (len > pi->mps || len < 0 || __is_sframe(control))
6840ed07
GP		 4410 goto drop;
4411
4412 tx_seq = __get_txseq(control);
4413
4414 if (pi->expected_tx_seq == tx_seq)
4415 pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
4416 else
7dffe421 4417 pi->expected_tx_seq = (tx_seq + 1) % 64;
6840ed07 4418
18778a63 4419 l2cap_streaming_reassembly_sdu(sk, skb, control);
6840ed07
GP		 4420
4421 goto done;
4422
1c2acffb 4423 default:
e8235c6b 4424 BT_DBG("sk %p: bad mode 0x%2.2x", sk, pi->mode);
1c2acffb
GP		 4425 break;
4426 }
1da177e4
LT		 4427
4428drop:
4429 kfree_skb(skb);
4430
4431done:
0139418c
MH		 4432 if (sk)
4433 bh_unlock_sock(sk);
4434
1da177e4
LT		 4435 return 0;
4436}
4437
8e036fc3 4438static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
1da177e4
LT		 4439{
4440 struct sock *sk;
4441
4442 sk = l2cap_get_sock_by_psm(0, psm, conn->src);
4443 if (!sk)
4444 goto drop;
4445
e0f0cb56
GP		 4446 bh_lock_sock(sk);
4447
1da177e4
LT		 4448 BT_DBG("sk %p, len %d", sk, skb->len);
4449
4450 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
4451 goto drop;
4452
4453 if (l2cap_pi(sk)->imtu < skb->len)
4454 goto drop;
4455
4456 if (!sock_queue_rcv_skb(sk, skb))
4457 goto done;
4458
4459drop:
4460 kfree_skb(skb);
4461
4462done:
af05b30b
GP		 4463 if (sk)
4464 bh_unlock_sock(sk);
1da177e4
LT		 4465 return 0;
4466}
4467
4468static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
4469{
4470 struct l2cap_hdr *lh = (void *) skb->data;
8e036fc3
AV		 4471 u16 cid, len;
4472 __le16 psm;
1da177e4
LT		 4473
4474 skb_pull(skb, L2CAP_HDR_SIZE);
4475 cid = __le16_to_cpu(lh->cid);
4476 len = __le16_to_cpu(lh->len);
4477
1c2acffb
GP		 4478 if (len != skb->len) {
4479 kfree_skb(skb);
4480 return;
4481 }
4482
1da177e4
LT		 4483 BT_DBG("len %d, cid 0x%4.4x", len, cid);
4484
4485 switch (cid) {
8db4dc46 4486 case L2CAP_CID_SIGNALING:
1da177e4
LT		 4487 l2cap_sig_channel(conn, skb);
4488 break;
4489
8db4dc46 4490 case L2CAP_CID_CONN_LESS:
1b7bf4ed 4491 psm = get_unaligned_le16(skb->data);
1da177e4
LT		 4492 skb_pull(skb, 2);
4493 l2cap_conless_channel(conn, psm, skb);
4494 break;
4495
4496 default:
4497 l2cap_data_channel(conn, cid, skb);
4498 break;
4499 }
4500}
4501
4502/* ---- L2CAP interface with lower layer (HCI) ---- */
4503
4504static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
4505{
4506 int exact = 0, lm1 = 0, lm2 = 0;
4507 register struct sock *sk;
4508 struct hlist_node *node;
4509
4510 if (type != ACL_LINK)
963cf687 4511 return -EINVAL;
1da177e4
LT		 4512
4513 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
4514
4515 /* Find listening sockets and check their link_mode */
4516 read_lock(&l2cap_sk_list.lock);
4517 sk_for_each(sk, node, &l2cap_sk_list.head) {
4518 if (sk->sk_state != BT_LISTEN)
4519 continue;
4520
4521 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2af6b9d5
MH		 4522 lm1 |= HCI_LM_ACCEPT;
4523 if (l2cap_pi(sk)->role_switch)
4524 lm1 |= HCI_LM_MASTER;
1da177e4 4525 exact++;
2af6b9d5
MH		 4526 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
4527 lm2 |= HCI_LM_ACCEPT;
4528 if (l2cap_pi(sk)->role_switch)
4529 lm2 |= HCI_LM_MASTER;
4530 }
1da177e4
LT		 4531 }
4532 read_unlock(&l2cap_sk_list.lock);
4533
4534 return exact ? lm1 : lm2;
4535}
4536
4537static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
4538{
0139418c
MH		 4539 struct l2cap_conn *conn;
4540
1da177e4
LT		 4541 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
4542
4543 if (hcon->type != ACL_LINK)
963cf687 4544 return -EINVAL;
1da177e4
LT		 4545
4546 if (!status) {
1da177e4
LT		 4547 conn = l2cap_conn_add(hcon, status);
4548 if (conn)
4549 l2cap_conn_ready(conn);
0139418c 4550 } else
1da177e4
LT		 4551 l2cap_conn_del(hcon, bt_err(status));
4552
4553 return 0;
4554}
4555
2950f21a
MH		 4556static int l2cap_disconn_ind(struct hci_conn *hcon)
4557{
4558 struct l2cap_conn *conn = hcon->l2cap_data;
4559
4560 BT_DBG("hcon %p", hcon);
4561
4562 if (hcon->type != ACL_LINK || !conn)
4563 return 0x13;
4564
4565 return conn->disc_reason;
4566}
4567
4568static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
1da177e4
LT		 4569{
4570 BT_DBG("hcon %p reason %d", hcon, reason);
4571
4572 if (hcon->type != ACL_LINK)
963cf687 4573 return -EINVAL;
1da177e4
LT		 4574
4575 l2cap_conn_del(hcon, bt_err(reason));
0139418c 4576
1da177e4
LT		 4577 return 0;
4578}
4579
f62e4323
MH		 4580static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
4581{
bd3c9e25 4582 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
255c7601
MH		 4583 return;
4584
f62e4323
MH		 4585 if (encrypt == 0x00) {
4586 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
4587 l2cap_sock_clear_timer(sk);
4588 l2cap_sock_set_timer(sk, HZ * 5);
4589 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
4590 __l2cap_sock_close(sk, ECONNREFUSED);
4591 } else {
4592 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
4593 l2cap_sock_clear_timer(sk);
4594 }
4595}
4596
8c1b2355 4597static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
1da177e4
LT		 4598{
4599 struct l2cap_chan_list *l;
0139418c 4600 struct l2cap_conn *conn = hcon->l2cap_data;
1da177e4 4601 struct sock *sk;
1da177e4 4602
0139418c 4603 if (!conn)
1da177e4 4604 return 0;
0139418c 4605
1da177e4
LT		 4606 l = &conn->chan_list;
4607
4608 BT_DBG("conn %p", conn);
4609
4610 read_lock(&l->lock);
4611
4612 for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
4613 bh_lock_sock(sk);
4614
6a8d3010
MH		 4615 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
4616 bh_unlock_sock(sk);
4617 continue;
4618 }
4619
f62e4323 4620 if (!status && (sk->sk_state == BT_CONNECTED ||
8c1b2355 4621 sk->sk_state == BT_CONFIG)) {
f62e4323 4622 l2cap_check_encryption(sk, encrypt);
9719f8af
MH		 4623 bh_unlock_sock(sk);
4624 continue;
4625 }
4626
b1235d79
MH		 4627 if (sk->sk_state == BT_CONNECT) {
4628 if (!status) {
4629 struct l2cap_conn_req req;
4630 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
4631 req.psm = l2cap_pi(sk)->psm;
1da177e4 4632
b1235d79 4633 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
e501d055 4634 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1da177e4 4635
b1235d79
MH		 4636 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
4637 L2CAP_CONN_REQ, sizeof(req), &req);
4638 } else {
4639 l2cap_sock_clear_timer(sk);
4640 l2cap_sock_set_timer(sk, HZ / 10);
4641 }
4642 } else if (sk->sk_state == BT_CONNECT2) {
4643 struct l2cap_conn_rsp rsp;
4644 __u16 result;
1da177e4 4645
b1235d79
MH		 4646 if (!status) {
4647 sk->sk_state = BT_CONFIG;
4648 result = L2CAP_CR_SUCCESS;
4649 } else {
4650 sk->sk_state = BT_DISCONN;
4651 l2cap_sock_set_timer(sk, HZ / 10);
4652 result = L2CAP_CR_SEC_BLOCK;
4653 }
4654
4655 rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
4656 rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
4657 rsp.result = cpu_to_le16(result);
e7c29cb1 4658 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
b1235d79
MH		 4659 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
4660 L2CAP_CONN_RSP, sizeof(rsp), &rsp);
4661 }
1da177e4
LT		 4662
4663 bh_unlock_sock(sk);
4664 }
4665
4666 read_unlock(&l->lock);
b1235d79 4667
1da177e4
LT		 4668 return 0;
4669}
4670
4671static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
4672{
4673 struct l2cap_conn *conn = hcon->l2cap_data;
4674
4675 if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
4676 goto drop;
4677
4678 BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
4679
4680 if (flags & ACL_START) {
4681 struct l2cap_hdr *hdr;
89794813
AE		 4682 struct sock *sk;
4683 u16 cid;
1da177e4
LT		 4684 int len;
4685
4686 if (conn->rx_len) {
4687 BT_ERR("Unexpected start frame (len %d)", skb->len);
4688 kfree_skb(conn->rx_skb);
4689 conn->rx_skb = NULL;
4690 conn->rx_len = 0;
4691 l2cap_conn_unreliable(conn, ECOMM);
4692 }
4693
aae7fe22
AE		 4694 /* Start fragment always begin with Basic L2CAP header */
4695 if (skb->len < L2CAP_HDR_SIZE) {
1da177e4
LT		 4696 BT_ERR("Frame is too short (len %d)", skb->len);
4697 l2cap_conn_unreliable(conn, ECOMM);
4698 goto drop;
4699 }
4700
4701 hdr = (struct l2cap_hdr *) skb->data;
4702 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
89794813 4703 cid = __le16_to_cpu(hdr->cid);
1da177e4
LT		 4704
4705 if (len == skb->len) {
4706 /* Complete frame received */
4707 l2cap_recv_frame(conn, skb);
4708 return 0;
4709 }
4710
4711 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
4712
4713 if (skb->len > len) {
4714 BT_ERR("Frame is too long (len %d, expected len %d)",
4715 skb->len, len);
4716 l2cap_conn_unreliable(conn, ECOMM);
4717 goto drop;
4718 }
4719
89794813
AE		 4720 sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
4721
4722 if (sk && l2cap_pi(sk)->imtu < len - L2CAP_HDR_SIZE) {
4723 BT_ERR("Frame exceeding recv MTU (len %d, MTU %d)",
4724 len, l2cap_pi(sk)->imtu);
4725 bh_unlock_sock(sk);
4726 l2cap_conn_unreliable(conn, ECOMM);
4727 goto drop;
4728 }
4729
4730 if (sk)
4731 bh_unlock_sock(sk);
4732
1da177e4 4733 /* Allocate skb for the complete frame (with header) */
af05b30b
GP		 4734 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
4735 if (!conn->rx_skb)
1da177e4
LT		 4736 goto drop;
4737
d626f62b 4738 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4739 skb->len);
1da177e4
LT		 4740 conn->rx_len = len - skb->len;
4741 } else {
4742 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
4743
4744 if (!conn->rx_len) {
4745 BT_ERR("Unexpected continuation frame (len %d)", skb->len);
4746 l2cap_conn_unreliable(conn, ECOMM);
4747 goto drop;
4748 }
4749
4750 if (skb->len > conn->rx_len) {
4751 BT_ERR("Fragment is too long (len %d, expected %d)",
4752 skb->len, conn->rx_len);
4753 kfree_skb(conn->rx_skb);
4754 conn->rx_skb = NULL;
4755 conn->rx_len = 0;
4756 l2cap_conn_unreliable(conn, ECOMM);
4757 goto drop;
4758 }
4759
d626f62b 4760 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
e1027a7c 4761 skb->len);
1da177e4
LT		 4762 conn->rx_len -= skb->len;
4763
4764 if (!conn->rx_len) {
4765 /* Complete frame received */
4766 l2cap_recv_frame(conn, conn->rx_skb);
4767 conn->rx_skb = NULL;
4768 }
4769 }
4770
4771drop:
4772 kfree_skb(skb);
4773 return 0;
4774}
4775
aef7d97c 4776static int l2cap_debugfs_show(struct seq_file *f, void *p)
1da177e4
LT		 4777{
4778 struct sock *sk;
4779 struct hlist_node *node;
1da177e4
LT		 4780
4781 read_lock_bh(&l2cap_sk_list.lock);
4782
be9d1227
MH		 4783 sk_for_each(sk, node, &l2cap_sk_list.head) {
4784 struct l2cap_pinfo *pi = l2cap_pi(sk);
101545f6 4785
aef7d97c
MH		 4786 seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
4787 batostr(&bt_sk(sk)->src),
4788 batostr(&bt_sk(sk)->dst),
4789 sk->sk_state, __le16_to_cpu(pi->psm),
4790 pi->scid, pi->dcid,
4791 pi->imtu, pi->omtu, pi->sec_level);
be9d1227 4792 }
1da177e4 4793
1da177e4 4794 read_unlock_bh(&l2cap_sk_list.lock);
1da177e4 4795
aef7d97c 4796 return 0;
1da177e4
LT		 4797}
4798
aef7d97c
MH		 4799static int l2cap_debugfs_open(struct inode *inode, struct file *file)
4800{
4801 return single_open(file, l2cap_debugfs_show, inode->i_private);
4802}
4803
4804static const struct file_operations l2cap_debugfs_fops = {
4805 .open = l2cap_debugfs_open,
4806 .read = seq_read,
4807 .llseek = seq_lseek,
4808 .release = single_release,
4809};
4810
4811static struct dentry *l2cap_debugfs;
1da177e4 4812
90ddc4f0 4813static const struct proto_ops l2cap_sock_ops = {
1da177e4
LT		 4814 .family = PF_BLUETOOTH,
4815 .owner = THIS_MODULE,
4816 .release = l2cap_sock_release,
4817 .bind = l2cap_sock_bind,
4818 .connect = l2cap_sock_connect,
4819 .listen = l2cap_sock_listen,
4820 .accept = l2cap_sock_accept,
4821 .getname = l2cap_sock_getname,
4822 .sendmsg = l2cap_sock_sendmsg,
f66dc81f 4823 .recvmsg = l2cap_sock_recvmsg,
1da177e4 4824 .poll = bt_sock_poll,
3241ad82 4825 .ioctl = bt_sock_ioctl,
1da177e4
LT		 4826 .mmap = sock_no_mmap,
4827 .socketpair = sock_no_socketpair,
1da177e4
LT		 4828 .shutdown = l2cap_sock_shutdown,
4829 .setsockopt = l2cap_sock_setsockopt,
4830 .getsockopt = l2cap_sock_getsockopt
4831};
4832
ec1b4cf7 4833static const struct net_proto_family l2cap_sock_family_ops = {
1da177e4
LT		 4834 .family = PF_BLUETOOTH,
4835 .owner = THIS_MODULE,
4836 .create = l2cap_sock_create,
4837};
4838
4839static struct hci_proto l2cap_hci_proto = {
4840 .name = "L2CAP",
4841 .id = HCI_PROTO_L2CAP,
4842 .connect_ind = l2cap_connect_ind,
4843 .connect_cfm = l2cap_connect_cfm,
4844 .disconn_ind = l2cap_disconn_ind,
2950f21a 4845 .disconn_cfm = l2cap_disconn_cfm,
8c1b2355 4846 .security_cfm = l2cap_security_cfm,
1da177e4
LT		 4847 .recv_acldata = l2cap_recv_acldata
4848};
4849
4850static int __init l2cap_init(void)
4851{
4852 int err;
be9d1227 4853
1da177e4
LT		 4854 err = proto_register(&l2cap_proto, 0);
4855 if (err < 0)
4856 return err;
4857
1890d36b 4858 _busy_wq = create_singlethread_workqueue("l2cap");
b78d7b4f
AL		 4859 if (!_busy_wq) {
4860 proto_unregister(&l2cap_proto);
4861 return -ENOMEM;
4862 }
1890d36b 4863
1da177e4
LT		 4864 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
4865 if (err < 0) {
4866 BT_ERR("L2CAP socket registration failed");
4867 goto error;
4868 }
4869
4870 err = hci_register_proto(&l2cap_hci_proto);
4871 if (err < 0) {
4872 BT_ERR("L2CAP protocol registration failed");
4873 bt_sock_unregister(BTPROTO_L2CAP);
4874 goto error;
4875 }
4876
aef7d97c
MH		 4877 if (bt_debugfs) {
4878 l2cap_debugfs = debugfs_create_file("l2cap", 0444,
4879 bt_debugfs, NULL, &l2cap_debugfs_fops);
4880 if (!l2cap_debugfs)
4881 BT_ERR("Failed to create L2CAP debug file");
4882 }
1da177e4
LT		 4883
4884 BT_INFO("L2CAP ver %s", VERSION);
4885 BT_INFO("L2CAP socket layer initialized");
4886
4887 return 0;
4888
4889error:
b78d7b4f 4890 destroy_workqueue(_busy_wq);
1da177e4
LT		 4891 proto_unregister(&l2cap_proto);
4892 return err;
4893}
4894
4895static void __exit l2cap_exit(void)
4896{
aef7d97c 4897 debugfs_remove(l2cap_debugfs);
1da177e4 4898
1890d36b
GP		 4899 flush_workqueue(_busy_wq);
4900 destroy_workqueue(_busy_wq);
4901
1da177e4
LT		 4902 if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
4903 BT_ERR("L2CAP socket unregistration failed");
4904
4905 if (hci_unregister_proto(&l2cap_hci_proto) < 0)
4906 BT_ERR("L2CAP protocol unregistration failed");
4907
4908 proto_unregister(&l2cap_proto);
4909}
4910
4911void l2cap_load(void)
4912{
4913 /* Dummy function to trigger automatic L2CAP module loading by
4914 * other modules that use L2CAP sockets but don't use any other
4915 * symbols from it. */
1da177e4
LT		 4916}
4917EXPORT_SYMBOL(l2cap_load);
4918
4919module_init(l2cap_init);
4920module_exit(l2cap_exit);
4921
d1c4a17d
GP		 4922module_param(disable_ertm, bool, 0644);
4923MODULE_PARM_DESC(disable_ertm, "Disable enhanced retransmission mode");
44dd46de 4924
63fbd24e 4925MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1da177e4
LT		 4926MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
4927MODULE_VERSION(VERSION);
4928MODULE_LICENSE("GPL");
4929MODULE_ALIAS("bt-proto-0");
Linux kernel - Deliverables
This page took 0.868715 seconds and 5 git commands to generate.