Bluetooth: Don't set control bits to zero first
[safe/jmp/linux-2.6] / net / bluetooth / l2cap.c
index 947f8bb..cfb18cd 100644 (file)
@@ -40,6 +40,8 @@
 #include <linux/skbuff.h>
 #include <linux/list.h>
 #include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/crc16.h>
 #include <net/sock.h>
 
 #define VERSION "2.14"
 
+#ifdef CONFIG_BT_L2CAP_EXT_FEATURES
+static int enable_ertm = 1;
+#else
 static int enable_ertm = 0;
+#endif
+static int max_transmit = L2CAP_DEFAULT_MAX_TX;
+static int tx_window = L2CAP_DEFAULT_TX_WINDOW;
 
 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
 static u8 l2cap_fixed_chan[8] = { 0x02, };
@@ -216,7 +224,7 @@ static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct so
 
        l2cap_pi(sk)->conn = conn;
 
-       if (sk->sk_type == SOCK_SEQPACKET) {
+       if (sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM) {
                /* Alloc CID for connection-oriented socket */
                l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
        } else if (sk->sk_type == SOCK_DGRAM) {
@@ -349,6 +357,16 @@ static inline int l2cap_send_sframe(struct l2cap_pinfo *pi, u16 control)
        count = min_t(unsigned int, conn->mtu, hlen);
        control |= L2CAP_CTRL_FRAME_TYPE;
 
+       if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
+               control |= L2CAP_CTRL_FINAL;
+               pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+       }
+
+       if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
+               control |= L2CAP_CTRL_POLL;
+               pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
+       }
+
        skb = bt_skb_alloc(count, GFP_ATOMIC);
        if (!skb)
                return -ENOMEM;
@@ -373,6 +391,8 @@ static inline int l2cap_send_rr_or_rnr(struct l2cap_pinfo *pi, u16 control)
        else
                control |= L2CAP_SUPER_RCV_READY;
 
+       control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
        return l2cap_send_sframe(pi, control);
 }
 
@@ -432,7 +452,8 @@ static void l2cap_conn_start(struct l2cap_conn *conn)
        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
                bh_lock_sock(sk);
 
-               if (sk->sk_type != SOCK_SEQPACKET) {
+               if (sk->sk_type != SOCK_SEQPACKET &&
+                               sk->sk_type != SOCK_STREAM) {
                        bh_unlock_sock(sk);
                        continue;
                }
@@ -492,7 +513,8 @@ static void l2cap_conn_ready(struct l2cap_conn *conn)
        for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
                bh_lock_sock(sk);
 
-               if (sk->sk_type != SOCK_SEQPACKET) {
+               if (sk->sk_type != SOCK_SEQPACKET &&
+                               sk->sk_type != SOCK_STREAM) {
                        l2cap_sock_clear_timer(sk);
                        sk->sk_state = BT_CONNECTED;
                        sk->sk_state_change(sk);
@@ -701,7 +723,8 @@ static void __l2cap_sock_close(struct sock *sk, int reason)
 
        case BT_CONNECTED:
        case BT_CONFIG:
-               if (sk->sk_type == SOCK_SEQPACKET) {
+               if (sk->sk_type == SOCK_SEQPACKET ||
+                               sk->sk_type == SOCK_STREAM) {
                        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 
                        sk->sk_state = BT_DISCONN;
@@ -712,7 +735,8 @@ static void __l2cap_sock_close(struct sock *sk, int reason)
                break;
 
        case BT_CONNECT2:
-               if (sk->sk_type == SOCK_SEQPACKET) {
+               if (sk->sk_type == SOCK_SEQPACKET ||
+                               sk->sk_type == SOCK_STREAM) {
                        struct l2cap_conn *conn = l2cap_pi(sk)->conn;
                        struct l2cap_conn_rsp rsp;
                        __u16 result;
@@ -767,14 +791,21 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
                pi->omtu = l2cap_pi(parent)->omtu;
                pi->mode = l2cap_pi(parent)->mode;
                pi->fcs  = l2cap_pi(parent)->fcs;
+               pi->max_tx = l2cap_pi(parent)->max_tx;
+               pi->tx_win = l2cap_pi(parent)->tx_win;
                pi->sec_level = l2cap_pi(parent)->sec_level;
                pi->role_switch = l2cap_pi(parent)->role_switch;
                pi->force_reliable = l2cap_pi(parent)->force_reliable;
        } else {
                pi->imtu = L2CAP_DEFAULT_MTU;
                pi->omtu = 0;
-               pi->mode = L2CAP_MODE_BASIC;
+               if (enable_ertm && sk->sk_type == SOCK_STREAM)
+                       pi->mode = L2CAP_MODE_ERTM;
+               else
+                       pi->mode = L2CAP_MODE_BASIC;
+               pi->max_tx = max_transmit;
                pi->fcs  = L2CAP_FCS_CRC16;
+               pi->tx_win = tx_window;
                pi->sec_level = BT_SECURITY_LOW;
                pi->role_switch = 0;
                pi->force_reliable = 0;
@@ -819,7 +850,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int p
        return sk;
 }
 
-static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
+static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
+                            int kern)
 {
        struct sock *sk;
 
@@ -827,11 +859,11 @@ static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
 
        sock->state = SS_UNCONNECTED;
 
-       if (sock->type != SOCK_SEQPACKET &&
+       if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
                        sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
                return -ESOCKTNOSUPPORT;
 
-       if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
+       if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                return -EPERM;
 
        sock->ops = &l2cap_sock_ops;
@@ -975,7 +1007,8 @@ static int l2cap_do_connect(struct sock *sk)
        l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 
        if (hcon->state == BT_CONNECTED) {
-               if (sk->sk_type != SOCK_SEQPACKET) {
+               if (sk->sk_type != SOCK_SEQPACKET &&
+                               sk->sk_type != SOCK_STREAM) {
                        l2cap_sock_clear_timer(sk);
                        sk->sk_state = BT_CONNECTED;
                } else
@@ -996,7 +1029,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
 
        BT_DBG("sk %p", sk);
 
-       if (!addr || addr->sa_family != AF_BLUETOOTH)
+       if (!addr || alen < sizeof(addr->sa_family) ||
+           addr->sa_family != AF_BLUETOOTH)
                return -EINVAL;
 
        memset(&la, 0, sizeof(la));
@@ -1008,7 +1042,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
 
        lock_sock(sk);
 
-       if (sk->sk_type == SOCK_SEQPACKET && !la.l2_psm) {
+       if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
+                       && !la.l2_psm) {
                err = -EINVAL;
                goto done;
        }
@@ -1072,7 +1107,8 @@ static int l2cap_sock_listen(struct socket *sock, int backlog)
 
        lock_sock(sk);
 
-       if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
+       if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
+                       || sk->sk_state != BT_BOUND) {
                err = -EBADFD;
                goto done;
        }
@@ -1140,7 +1176,7 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
        BT_DBG("sk %p timeo %ld", sk, timeo);
 
        /* Wait for an incoming connection. (wake-one). */
-       add_wait_queue_exclusive(sk->sk_sleep, &wait);
+       add_wait_queue_exclusive(sk_sleep(sk), &wait);
        while (!(nsk = bt_accept_dequeue(sk, newsock))) {
                set_current_state(TASK_INTERRUPTIBLE);
                if (!timeo) {
@@ -1163,7 +1199,7 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
                }
        }
        set_current_state(TASK_RUNNING);
-       remove_wait_queue(sk->sk_sleep, &wait);
+       remove_wait_queue(sk_sleep(sk), &wait);
 
        if (err)
                goto done;
@@ -1208,6 +1244,7 @@ static void l2cap_monitor_timeout(unsigned long arg)
        bh_lock_sock(sk);
        if (l2cap_pi(sk)->retry_count >= l2cap_pi(sk)->remote_max_tx) {
                l2cap_send_disconn_req(l2cap_pi(sk)->conn, sk);
+               bh_unlock_sock(sk);
                return;
        }
 
@@ -1239,7 +1276,8 @@ static void l2cap_drop_acked_frames(struct sock *sk)
 {
        struct sk_buff *skb;
 
-       while ((skb = skb_peek(TX_QUEUE(sk)))) {
+       while ((skb = skb_peek(TX_QUEUE(sk))) &&
+                       l2cap_pi(sk)->unacked_frames) {
                if (bt_cb(skb)->tx_seq == l2cap_pi(sk)->expected_ack_seq)
                        break;
 
@@ -1283,7 +1321,7 @@ static int l2cap_streaming_send(struct sock *sk)
                control |= pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT;
                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
-               if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16) {
+               if (pi->fcs == L2CAP_FCS_CRC16) {
                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
                }
@@ -1332,11 +1370,11 @@ static int l2cap_retransmit_frame(struct sock *sk, u8 tx_seq)
                tx_skb = skb_clone(skb, GFP_ATOMIC);
                bt_cb(skb)->retries++;
                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-               control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+               control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                | (tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
-               if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16) {
+               if (pi->fcs == L2CAP_FCS_CRC16) {
                        fcs = crc16(0, (u8 *)tx_skb->data, tx_skb->len - 2);
                        put_unaligned_le16(fcs, tx_skb->data + tx_skb->len - 2);
                }
@@ -1356,14 +1394,13 @@ static int l2cap_ertm_send(struct sock *sk)
        struct sk_buff *skb, *tx_skb;
        struct l2cap_pinfo *pi = l2cap_pi(sk);
        u16 control, fcs;
-       int err;
+       int err, nsent = 0;
 
        if (pi->conn_state & L2CAP_CONN_WAIT_F)
                return 0;
 
-       while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk))
-                       && !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
-               tx_skb = skb_clone(skb, GFP_ATOMIC);
+       while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
+              !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
 
                if (pi->remote_max_tx &&
                                bt_cb(skb)->retries == pi->remote_max_tx) {
@@ -1371,15 +1408,21 @@ static int l2cap_ertm_send(struct sock *sk)
                        break;
                }
 
+               tx_skb = skb_clone(skb, GFP_ATOMIC);
+
                bt_cb(skb)->retries++;
 
                control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
-               control |= (pi->req_seq << L2CAP_CTRL_REQSEQ_SHIFT)
+               if (pi->conn_state & L2CAP_CONN_SEND_FBIT) {
+                       control |= L2CAP_CTRL_FINAL;
+                       pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+               }
+               control |= (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT)
                                | (pi->next_tx_seq << L2CAP_CTRL_TXSEQ_SHIFT);
                put_unaligned_le16(control, tx_skb->data + L2CAP_HDR_SIZE);
 
 
-               if (l2cap_pi(sk)->fcs == L2CAP_FCS_CRC16) {
+               if (pi->fcs == L2CAP_FCS_CRC16) {
                        fcs = crc16(0, (u8 *)skb->data, tx_skb->len - 2);
                        put_unaligned_le16(fcs, skb->data + tx_skb->len - 2);
                }
@@ -1395,13 +1438,49 @@ static int l2cap_ertm_send(struct sock *sk)
                pi->next_tx_seq = (pi->next_tx_seq + 1) % 64;
 
                pi->unacked_frames++;
+               pi->frames_sent++;
 
                if (skb_queue_is_last(TX_QUEUE(sk), skb))
                        sk->sk_send_head = NULL;
                else
                        sk->sk_send_head = skb_queue_next(TX_QUEUE(sk), skb);
+
+               nsent++;
        }
 
+       return nsent;
+}
+
+static int l2cap_send_ack(struct l2cap_pinfo *pi)
+{
+       struct sock *sk = (struct sock *)pi;
+       u16 control = 0;
+
+       control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+       if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+               control |= L2CAP_SUPER_RCV_NOT_READY;
+               return l2cap_send_sframe(pi, control);
+       } else if (l2cap_ertm_send(sk) == 0) {
+               control |= L2CAP_SUPER_RCV_READY;
+               return l2cap_send_sframe(pi, control);
+       }
+       return 0;
+}
+
+static int l2cap_send_srejtail(struct sock *sk)
+{
+       struct srej_list *tail;
+       u16 control;
+
+       control = L2CAP_SUPER_SELECT_REJECT;
+       control |= L2CAP_CTRL_FINAL;
+
+       tail = list_entry(SREJ_LIST(sk)->prev, struct srej_list, list);
+       control |= tail->tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+       l2cap_send_sframe(l2cap_pi(sk), control);
+
        return 0;
 }
 
@@ -1504,6 +1583,9 @@ static struct sk_buff *l2cap_create_iframe_pdu(struct sock *sk, struct msghdr *m
 
        BT_DBG("sk %p len %d", sk, (int)len);
 
+       if (!conn)
+               return ERR_PTR(-ENOTCONN);
+
        if (sdulen)
                hlen += 2;
 
@@ -1547,23 +1629,22 @@ static inline int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, siz
 
        __skb_queue_head_init(&sar_queue);
        control = L2CAP_SDU_START;
-       skb = l2cap_create_iframe_pdu(sk, msg, pi->max_pdu_size, control, len);
+       skb = l2cap_create_iframe_pdu(sk, msg, pi->remote_mps, control, len);
        if (IS_ERR(skb))
                return PTR_ERR(skb);
 
        __skb_queue_tail(&sar_queue, skb);
-       len -= pi->max_pdu_size;
-       size +=pi->max_pdu_size;
-       control = 0;
+       len -= pi->remote_mps;
+       size += pi->remote_mps;
 
        while (len > 0) {
                size_t buflen;
 
-               if (len > pi->max_pdu_size) {
-                       control |= L2CAP_SDU_CONTINUE;
-                       buflen = pi->max_pdu_size;
+               if (len > pi->remote_mps) {
+                       control = L2CAP_SDU_CONTINUE;
+                       buflen = pi->remote_mps;
                } else {
-                       control |= L2CAP_SDU_END;
+                       control = L2CAP_SDU_END;
                        buflen = len;
                }
 
@@ -1576,7 +1657,6 @@ static inline int l2cap_sar_segment_sdu(struct sock *sk, struct msghdr *msg, siz
                __skb_queue_tail(&sar_queue, skb);
                len -= buflen;
                size += buflen;
-               control = 0;
        }
        skb_queue_splice_tail(&sar_queue, TX_QUEUE(sk));
        if (sk->sk_send_head == NULL)
@@ -1602,11 +1682,6 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
        if (msg->msg_flags & MSG_OOB)
                return -EOPNOTSUPP;
 
-       /* Check outgoing MTU */
-       if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC
-                       && len > pi->omtu)
-               return -EINVAL;
-
        lock_sock(sk);
 
        if (sk->sk_state != BT_CONNECTED) {
@@ -1617,12 +1692,21 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
        /* Connectionless channel */
        if (sk->sk_type == SOCK_DGRAM) {
                skb = l2cap_create_connless_pdu(sk, msg, len);
-               err = l2cap_do_send(sk, skb);
+               if (IS_ERR(skb))
+                       err = PTR_ERR(skb);
+               else
+                       err = l2cap_do_send(sk, skb);
                goto done;
        }
 
        switch (pi->mode) {
        case L2CAP_MODE_BASIC:
+               /* Check outgoing MTU */
+               if (len > pi->omtu) {
+                       err = -EINVAL;
+                       goto done;
+               }
+
                /* Create a basic PDU */
                skb = l2cap_create_basic_pdu(sk, msg, len);
                if (IS_ERR(skb)) {
@@ -1638,7 +1722,7 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
        case L2CAP_MODE_ERTM:
        case L2CAP_MODE_STREAMING:
                /* Entire SDU fits into one PDU */
-               if (len <= pi->max_pdu_size) {
+               if (len <= pi->remote_mps) {
                        control = L2CAP_SDU_UNSEGMENTED;
                        skb = l2cap_create_iframe_pdu(sk, msg, len, control, 0);
                        if (IS_ERR(skb)) {
@@ -1660,7 +1744,7 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
                else
                        err = l2cap_ertm_send(sk);
 
-               if (!err)
+               if (err >= 0)
                        err = len;
                break;
 
@@ -1719,6 +1803,8 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                opts.flush_to = l2cap_pi(sk)->flush_to;
                opts.mode     = l2cap_pi(sk)->mode;
                opts.fcs      = l2cap_pi(sk)->fcs;
+               opts.max_tx   = l2cap_pi(sk)->max_tx;
+               opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
 
                len = min_t(unsigned int, sizeof(opts), optlen);
                if (copy_from_user((char *) &opts, optval, len)) {
@@ -1726,10 +1812,25 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
                        break;
                }
 
+               l2cap_pi(sk)->mode = opts.mode;
+               switch (l2cap_pi(sk)->mode) {
+               case L2CAP_MODE_BASIC:
+                       break;
+               case L2CAP_MODE_ERTM:
+               case L2CAP_MODE_STREAMING:
+                       if (enable_ertm)
+                               break;
+                       /* fall through */
+               default:
+                       err = -EINVAL;
+                       break;
+               }
+
                l2cap_pi(sk)->imtu = opts.imtu;
                l2cap_pi(sk)->omtu = opts.omtu;
-               l2cap_pi(sk)->mode = opts.mode;
                l2cap_pi(sk)->fcs  = opts.fcs;
+               l2cap_pi(sk)->max_tx = opts.max_tx;
+               l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
                break;
 
        case L2CAP_LM:
@@ -1777,7 +1878,8 @@ static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, ch
 
        switch (optname) {
        case BT_SECURITY:
-               if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_RAW) {
+               if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
+                               && sk->sk_type != SOCK_RAW) {
                        err = -EINVAL;
                        break;
                }
@@ -1844,6 +1946,8 @@ static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __us
                opts.flush_to = l2cap_pi(sk)->flush_to;
                opts.mode     = l2cap_pi(sk)->mode;
                opts.fcs      = l2cap_pi(sk)->fcs;
+               opts.max_tx   = l2cap_pi(sk)->max_tx;
+               opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
 
                len = min_t(unsigned int, len, sizeof(opts));
                if (copy_to_user(optval, (char *) &opts, len))
@@ -1925,7 +2029,8 @@ static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, ch
 
        switch (optname) {
        case BT_SECURITY:
-               if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_RAW) {
+               if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
+                               && sk->sk_type != SOCK_RAW) {
                        err = -EINVAL;
                        break;
                }
@@ -2172,6 +2277,33 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
        *ptr += L2CAP_CONF_OPT_SIZE + len;
 }
 
+static void l2cap_ack_timeout(unsigned long arg)
+{
+       struct sock *sk = (void *) arg;
+
+       bh_lock_sock(sk);
+       l2cap_send_ack(l2cap_pi(sk));
+       bh_unlock_sock(sk);
+}
+
+static inline void l2cap_ertm_init(struct sock *sk)
+{
+       l2cap_pi(sk)->expected_ack_seq = 0;
+       l2cap_pi(sk)->unacked_frames = 0;
+       l2cap_pi(sk)->buffer_seq = 0;
+       l2cap_pi(sk)->num_acked = 0;
+       l2cap_pi(sk)->frames_sent = 0;
+
+       setup_timer(&l2cap_pi(sk)->retrans_timer,
+                       l2cap_retrans_timeout, (unsigned long) sk);
+       setup_timer(&l2cap_pi(sk)->monitor_timer,
+                       l2cap_monitor_timeout, (unsigned long) sk);
+       setup_timer(&l2cap_pi(sk)->ack_timer,
+                       l2cap_ack_timeout, (unsigned long) sk);
+
+       __skb_queue_head_init(SREJ_QUEUE(sk));
+}
+
 static int l2cap_mode_supported(__u8 mode, __u32 feat_mask)
 {
        u32 local_feat_mask = l2cap_feat_mask;
@@ -2205,7 +2337,7 @@ static int l2cap_build_conf_req(struct sock *sk, void *data)
 {
        struct l2cap_pinfo *pi = l2cap_pi(sk);
        struct l2cap_conf_req *req = data;
-       struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
+       struct l2cap_conf_rfc rfc = { .mode = pi->mode };
        void *ptr = req->data;
 
        BT_DBG("sk %p", sk);
@@ -2234,11 +2366,13 @@ done:
 
        case L2CAP_MODE_ERTM:
                rfc.mode            = L2CAP_MODE_ERTM;
-               rfc.txwin_size      = L2CAP_DEFAULT_TX_WINDOW;
-               rfc.max_transmit    = L2CAP_DEFAULT_MAX_TX;
+               rfc.txwin_size      = pi->tx_win;
+               rfc.max_transmit    = pi->max_tx;
                rfc.retrans_timeout = 0;
                rfc.monitor_timeout = 0;
                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
+               if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
+                       rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                        sizeof(rfc), (unsigned long) &rfc);
@@ -2260,6 +2394,8 @@ done:
                rfc.retrans_timeout = 0;
                rfc.monitor_timeout = 0;
                rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_PDU_SIZE);
+               if (L2CAP_DEFAULT_MAX_PDU_SIZE > pi->conn->mtu - 10)
+                       rfc.max_pdu_size = cpu_to_le16(pi->conn->mtu - 10);
 
                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
                                        sizeof(rfc), (unsigned long) &rfc);
@@ -2388,10 +2524,15 @@ done:
                case L2CAP_MODE_ERTM:
                        pi->remote_tx_win = rfc.txwin_size;
                        pi->remote_max_tx = rfc.max_transmit;
-                       pi->max_pdu_size = rfc.max_pdu_size;
+                       if (rfc.max_pdu_size > pi->conn->mtu - 10)
+                               rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
+
+                       pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
-                       rfc.retrans_timeout = L2CAP_DEFAULT_RETRANS_TO;
-                       rfc.monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
+                       rfc.retrans_timeout =
+                               le16_to_cpu(L2CAP_DEFAULT_RETRANS_TO);
+                       rfc.monitor_timeout =
+                               le16_to_cpu(L2CAP_DEFAULT_MONITOR_TO);
 
                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
 
@@ -2401,8 +2542,10 @@ done:
                        break;
 
                case L2CAP_MODE_STREAMING:
-                       pi->remote_tx_win = rfc.txwin_size;
-                       pi->max_pdu_size = rfc.max_pdu_size;
+                       if (rfc.max_pdu_size > pi->conn->mtu - 10)
+                               rfc.max_pdu_size = le16_to_cpu(pi->conn->mtu - 10);
+
+                       pi->remote_mps = le16_to_cpu(rfc.max_pdu_size);
 
                        pi->conf_state |= L2CAP_CONF_MODE_DONE;
 
@@ -2479,13 +2622,12 @@ static int l2cap_parse_conf_rsp(struct sock *sk, void *rsp, int len, void *data,
                switch (rfc.mode) {
                case L2CAP_MODE_ERTM:
                        pi->remote_tx_win   = rfc.txwin_size;
-                       pi->retrans_timeout = rfc.retrans_timeout;
-                       pi->monitor_timeout = rfc.monitor_timeout;
-                       pi->max_pdu_size    = le16_to_cpu(rfc.max_pdu_size);
+                       pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+                       pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
+                       pi->mps    = le16_to_cpu(rfc.max_pdu_size);
                        break;
                case L2CAP_MODE_STREAMING:
-                       pi->max_pdu_size    = le16_to_cpu(rfc.max_pdu_size);
-                       break;
+                       pi->mps    = le16_to_cpu(rfc.max_pdu_size);
                }
        }
 
@@ -2509,6 +2651,42 @@ static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 fla
        return ptr - data;
 }
 
+static void l2cap_conf_rfc_get(struct sock *sk, void *rsp, int len)
+{
+       struct l2cap_pinfo *pi = l2cap_pi(sk);
+       int type, olen;
+       unsigned long val;
+       struct l2cap_conf_rfc rfc;
+
+       BT_DBG("sk %p, rsp %p, len %d", sk, rsp, len);
+
+       if ((pi->mode != L2CAP_MODE_ERTM) && (pi->mode != L2CAP_MODE_STREAMING))
+               return;
+
+       while (len >= L2CAP_CONF_OPT_SIZE) {
+               len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
+
+               switch (type) {
+               case L2CAP_CONF_RFC:
+                       if (olen == sizeof(rfc))
+                               memcpy(&rfc, (void *)val, olen);
+                       goto done;
+               }
+       }
+
+done:
+       switch (rfc.mode) {
+       case L2CAP_MODE_ERTM:
+               pi->remote_tx_win   = rfc.txwin_size;
+               pi->retrans_timeout = le16_to_cpu(rfc.retrans_timeout);
+               pi->monitor_timeout = le16_to_cpu(rfc.monitor_timeout);
+               pi->mps    = le16_to_cpu(rfc.max_pdu_size);
+               break;
+       case L2CAP_MODE_STREAMING:
+               pi->mps    = le16_to_cpu(rfc.max_pdu_size);
+       }
+}
+
 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
 {
        struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
@@ -2755,22 +2933,18 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
                goto unlock;
 
        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
-               if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
-                               || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+               if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                   l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
 
                sk->sk_state = BT_CONNECTED;
-               l2cap_pi(sk)->next_tx_seq = 0;
-               l2cap_pi(sk)->expected_ack_seq = 0;
-               l2cap_pi(sk)->unacked_frames = 0;
-
-               setup_timer(&l2cap_pi(sk)->retrans_timer,
-                               l2cap_retrans_timeout, (unsigned long) sk);
-               setup_timer(&l2cap_pi(sk)->monitor_timer,
-                               l2cap_monitor_timeout, (unsigned long) sk);
 
+               l2cap_pi(sk)->next_tx_seq = 0;
+               l2cap_pi(sk)->expected_tx_seq = 0;
                __skb_queue_head_init(TX_QUEUE(sk));
-               __skb_queue_head_init(SREJ_QUEUE(sk));
+               if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM)
+                       l2cap_ertm_init(sk);
+
                l2cap_chan_ready(sk);
                goto unlock;
        }
@@ -2792,6 +2966,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
        u16 scid, flags, result;
        struct sock *sk;
+       int len = cmd->len - sizeof(*rsp);
 
        scid   = __le16_to_cpu(rsp->scid);
        flags  = __le16_to_cpu(rsp->flags);
@@ -2806,13 +2981,18 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
 
        switch (result) {
        case L2CAP_CONF_SUCCESS:
+               l2cap_conf_rfc_get(sk, rsp->data, len);
                break;
 
        case L2CAP_CONF_UNACCEPT:
                if (l2cap_pi(sk)->num_conf_rsp <= L2CAP_CONF_MAX_CONF_RSP) {
-                       int len = cmd->len - sizeof(*rsp);
                        char req[64];
 
+                       if (len > sizeof(req) - sizeof(struct l2cap_conf_req)) {
+                               l2cap_send_disconn_req(conn, sk);
+                               goto done;
+                       }
+
                        /* throw out any old stored conf requests */
                        result = L2CAP_CONF_SUCCESS;
                        len = l2cap_parse_conf_rsp(sk, rsp->data,
@@ -2844,16 +3024,17 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
        l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
 
        if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
-               if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV)
-                               || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
+               if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
+                   l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
                        l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
 
                sk->sk_state = BT_CONNECTED;
+               l2cap_pi(sk)->next_tx_seq = 0;
                l2cap_pi(sk)->expected_tx_seq = 0;
-               l2cap_pi(sk)->buffer_seq = 0;
-               l2cap_pi(sk)->num_to_ack = 0;
                __skb_queue_head_init(TX_QUEUE(sk));
-               __skb_queue_head_init(SREJ_QUEUE(sk));
+               if (l2cap_pi(sk)->mode ==  L2CAP_MODE_ERTM)
+                       l2cap_ertm_init(sk);
+
                l2cap_chan_ready(sk);
        }
 
@@ -2885,9 +3066,13 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd
        sk->sk_shutdown = SHUTDOWN_MASK;
 
        skb_queue_purge(TX_QUEUE(sk));
-       skb_queue_purge(SREJ_QUEUE(sk));
-       del_timer(&l2cap_pi(sk)->retrans_timer);
-       del_timer(&l2cap_pi(sk)->monitor_timer);
+
+       if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+               skb_queue_purge(SREJ_QUEUE(sk));
+               del_timer(&l2cap_pi(sk)->retrans_timer);
+               del_timer(&l2cap_pi(sk)->monitor_timer);
+               del_timer(&l2cap_pi(sk)->ack_timer);
+       }
 
        l2cap_chan_del(sk, ECONNRESET);
        bh_unlock_sock(sk);
@@ -2912,9 +3097,13 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd
                return 0;
 
        skb_queue_purge(TX_QUEUE(sk));
-       skb_queue_purge(SREJ_QUEUE(sk));
-       del_timer(&l2cap_pi(sk)->retrans_timer);
-       del_timer(&l2cap_pi(sk)->monitor_timer);
+
+       if (l2cap_pi(sk)->mode == L2CAP_MODE_ERTM) {
+               skb_queue_purge(SREJ_QUEUE(sk));
+               del_timer(&l2cap_pi(sk)->retrans_timer);
+               del_timer(&l2cap_pi(sk)->monitor_timer);
+               del_timer(&l2cap_pi(sk)->ack_timer);
+       }
 
        l2cap_chan_del(sk, 0);
        bh_unlock_sock(sk);
@@ -3108,6 +3297,34 @@ static int l2cap_check_fcs(struct l2cap_pinfo *pi,  struct sk_buff *skb)
        return 0;
 }
 
+static inline void l2cap_send_i_or_rr_or_rnr(struct sock *sk)
+{
+       struct l2cap_pinfo *pi = l2cap_pi(sk);
+       u16 control = 0;
+
+       pi->frames_sent = 0;
+       pi->conn_state |= L2CAP_CONN_SEND_FBIT;
+
+       control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
+
+       if (pi->conn_state & L2CAP_CONN_LOCAL_BUSY) {
+               control |= L2CAP_SUPER_RCV_NOT_READY | L2CAP_CTRL_FINAL;
+               l2cap_send_sframe(pi, control);
+               pi->conn_state &= ~L2CAP_CONN_SEND_FBIT;
+       }
+
+       if (pi->conn_state & L2CAP_CONN_REMOTE_BUSY && pi->unacked_frames > 0)
+               __mod_retrans_timer();
+
+       l2cap_ertm_send(sk);
+
+       if (!(pi->conn_state & L2CAP_CONN_LOCAL_BUSY) &&
+                       pi->frames_sent == 0) {
+               control |= L2CAP_SUPER_RCV_READY;
+               l2cap_send_sframe(pi, control);
+       }
+}
+
 static void l2cap_add_to_srej_queue(struct sock *sk, struct sk_buff *skb, u8 tx_seq, u8 sar)
 {
        struct sk_buff *next_skb;
@@ -3163,6 +3380,11 @@ static int l2cap_sar_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 co
                pi->sdu_len = get_unaligned_le16(skb->data);
                skb_pull(skb, 2);
 
+               if (pi->sdu_len > pi->imtu) {
+                       err = -EMSGSIZE;
+                       break;
+               }
+
                pi->sdu = bt_skb_alloc(pi->sdu_len, GFP_ATOMIC);
                if (!pi->sdu) {
                        err = -ENOMEM;
@@ -3199,15 +3421,19 @@ static int l2cap_sar_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 co
                pi->conn_state &= ~L2CAP_CONN_SAR_SDU;
                pi->partial_sdu_len += skb->len;
 
+               if (pi->partial_sdu_len > pi->imtu)
+                       goto drop;
+
                if (pi->partial_sdu_len == pi->sdu_len) {
                        _skb = skb_clone(pi->sdu, GFP_ATOMIC);
                        err = sock_queue_rcv_skb(sk, _skb);
                        if (err < 0)
                                kfree_skb(_skb);
                }
-               kfree_skb(pi->sdu);
                err = 0;
 
+drop:
+               kfree_skb(pi->sdu);
                break;
        }
 
@@ -3218,14 +3444,14 @@ static int l2cap_sar_reassembly_sdu(struct sock *sk, struct sk_buff *skb, u16 co
 static void l2cap_check_srej_gap(struct sock *sk, u8 tx_seq)
 {
        struct sk_buff *skb;
-       u16 control = 0;
+       u16 control;
 
        while((skb = skb_peek(SREJ_QUEUE(sk)))) {
                if (bt_cb(skb)->tx_seq != tx_seq)
                        break;
 
                skb = skb_dequeue(SREJ_QUEUE(sk));
-               control |= bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
+               control = bt_cb(skb)->sar << L2CAP_CTRL_SAR_SHIFT;
                l2cap_sar_reassembly_sdu(sk, skb, control);
                l2cap_pi(sk)->buffer_seq_srej =
                        (l2cap_pi(sk)->buffer_seq_srej + 1) % 64;
@@ -3262,10 +3488,6 @@ static void l2cap_send_srejframe(struct sock *sk, u8 tx_seq)
        while (tx_seq != pi->expected_tx_seq) {
                control = L2CAP_SUPER_SELECT_REJECT;
                control |= pi->expected_tx_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-               if (pi->conn_state & L2CAP_CONN_SEND_PBIT) {
-                       control |= L2CAP_CTRL_POLL;
-                       pi->conn_state &= ~L2CAP_CONN_SEND_PBIT;
-               }
                l2cap_send_sframe(pi, control);
 
                new = kzalloc(sizeof(struct srej_list), GFP_ATOMIC);
@@ -3279,12 +3501,23 @@ static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, str
 {
        struct l2cap_pinfo *pi = l2cap_pi(sk);
        u8 tx_seq = __get_txseq(rx_control);
-       u16 tx_control = 0;
+       u8 req_seq = __get_reqseq(rx_control);
        u8 sar = rx_control >> L2CAP_CTRL_SAR_SHIFT;
+       int num_to_ack = (pi->tx_win/6) + 1;
        int err = 0;
 
        BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
 
+       if (L2CAP_CTRL_FINAL & rx_control) {
+               del_timer(&pi->monitor_timer);
+               if (pi->unacked_frames > 0)
+                       __mod_retrans_timer();
+               pi->conn_state &= ~L2CAP_CONN_WAIT_F;
+       }
+
+       pi->expected_ack_seq = req_seq;
+       l2cap_drop_acked_frames(sk);
+
        if (tx_seq == pi->expected_tx_seq)
                goto expected;
 
@@ -3303,6 +3536,7 @@ static inline int l2cap_data_channel_iframe(struct sock *sk, u16 rx_control, str
                        if (list_empty(SREJ_LIST(sk))) {
                                pi->buffer_seq = pi->buffer_seq_srej;
                                pi->conn_state &= ~L2CAP_CONN_SREJ_SENT;
+                               l2cap_send_ack(pi);
                        }
                } else {
                        struct srej_list *l;
@@ -3335,121 +3569,199 @@ expected:
        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
 
        if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
-               l2cap_add_to_srej_queue(sk, skb, tx_seq, sar);
+               bt_cb(skb)->tx_seq = tx_seq;
+               bt_cb(skb)->sar = sar;
+               __skb_queue_tail(SREJ_QUEUE(sk), skb);
                return 0;
        }
 
+       if (rx_control & L2CAP_CTRL_FINAL) {
+               if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                       pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+               else {
+                       if (!skb_queue_empty(TX_QUEUE(sk)))
+                               sk->sk_send_head = TX_QUEUE(sk)->next;
+                       pi->next_tx_seq = pi->expected_ack_seq;
+                       l2cap_ertm_send(sk);
+               }
+       }
+
        pi->buffer_seq = (pi->buffer_seq + 1) % 64;
 
        err = l2cap_sar_reassembly_sdu(sk, skb, rx_control);
        if (err < 0)
                return err;
 
-       pi->num_to_ack = (pi->num_to_ack + 1) % L2CAP_DEFAULT_NUM_TO_ACK;
-       if (pi->num_to_ack == L2CAP_DEFAULT_NUM_TO_ACK - 1) {
-               tx_control |= L2CAP_SUPER_RCV_READY;
-               tx_control |= pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT;
-               l2cap_send_sframe(pi, tx_control);
-       }
+       __mod_ack_timer();
+
+       pi->num_acked = (pi->num_acked + 1) % num_to_ack;
+       if (pi->num_acked == num_to_ack - 1)
+               l2cap_send_ack(pi);
+
        return 0;
 }
 
-static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
+static inline void l2cap_data_channel_rrframe(struct sock *sk, u16 rx_control)
 {
        struct l2cap_pinfo *pi = l2cap_pi(sk);
-       u8 tx_seq = __get_reqseq(rx_control);
 
-       BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
+       pi->expected_ack_seq = __get_reqseq(rx_control);
+       l2cap_drop_acked_frames(sk);
 
-       switch (rx_control & L2CAP_CTRL_SUPERVISE) {
-       case L2CAP_SUPER_RCV_READY:
-               if (rx_control & L2CAP_CTRL_POLL) {
-                       u16 control = L2CAP_CTRL_FINAL;
-                       control |= L2CAP_SUPER_RCV_READY |
-                               (pi->buffer_seq << L2CAP_CTRL_REQSEQ_SHIFT);
-                       l2cap_send_sframe(l2cap_pi(sk), control);
-                       pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+       if (rx_control & L2CAP_CTRL_POLL) {
+               if (pi->conn_state & L2CAP_CONN_SREJ_SENT) {
+                       if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                                       (pi->unacked_frames > 0))
+                               __mod_retrans_timer();
 
-               } else if (rx_control & L2CAP_CTRL_FINAL) {
                        pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
-                       pi->expected_ack_seq = tx_seq;
-                       l2cap_drop_acked_frames(sk);
-
-                       if (!(pi->conn_state & L2CAP_CONN_WAIT_F))
-                               break;
-
-                       pi->conn_state &= ~L2CAP_CONN_WAIT_F;
-                       del_timer(&pi->monitor_timer);
-
-                       if (pi->unacked_frames > 0)
-                               __mod_retrans_timer();
+                       l2cap_send_srejtail(sk);
                } else {
-                       pi->expected_ack_seq = tx_seq;
-                       l2cap_drop_acked_frames(sk);
+                       l2cap_send_i_or_rr_or_rnr(sk);
+                       pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+               }
 
-                       if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY)
-                                       && (pi->unacked_frames > 0))
-                               __mod_retrans_timer();
+       } else if (rx_control & L2CAP_CTRL_FINAL) {
+               pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
+               if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                       pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+               else {
+                       if (!skb_queue_empty(TX_QUEUE(sk)))
+                               sk->sk_send_head = TX_QUEUE(sk)->next;
+                       pi->next_tx_seq = pi->expected_ack_seq;
                        l2cap_ertm_send(sk);
-                       pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
                }
-               break;
 
-       case L2CAP_SUPER_REJECT:
+       } else {
+               if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
+                               (pi->unacked_frames > 0))
+                       __mod_retrans_timer();
+
                pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+               if (pi->conn_state & L2CAP_CONN_SREJ_SENT)
+                       l2cap_send_ack(pi);
+               else
+                       l2cap_ertm_send(sk);
+       }
+}
 
-               pi->expected_ack_seq = __get_reqseq(rx_control);
-               l2cap_drop_acked_frames(sk);
+static inline void l2cap_data_channel_rejframe(struct sock *sk, u16 rx_control)
+{
+       struct l2cap_pinfo *pi = l2cap_pi(sk);
+       u8 tx_seq = __get_reqseq(rx_control);
 
-               sk->sk_send_head = TX_QUEUE(sk)->next;
-               pi->next_tx_seq = pi->expected_ack_seq;
+       pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
+       pi->expected_ack_seq = tx_seq;
+       l2cap_drop_acked_frames(sk);
+
+       if (rx_control & L2CAP_CTRL_FINAL) {
+               if (pi->conn_state & L2CAP_CONN_REJ_ACT)
+                       pi->conn_state &= ~L2CAP_CONN_REJ_ACT;
+               else {
+                       if (!skb_queue_empty(TX_QUEUE(sk)))
+                               sk->sk_send_head = TX_QUEUE(sk)->next;
+                       pi->next_tx_seq = pi->expected_ack_seq;
+                       l2cap_ertm_send(sk);
+               }
+       } else {
+               if (!skb_queue_empty(TX_QUEUE(sk)))
+                       sk->sk_send_head = TX_QUEUE(sk)->next;
+               pi->next_tx_seq = pi->expected_ack_seq;
                l2cap_ertm_send(sk);
 
-               break;
+               if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                       pi->srej_save_reqseq = tx_seq;
+                       pi->conn_state |= L2CAP_CONN_REJ_ACT;
+               }
+       }
+}
+static inline void l2cap_data_channel_srejframe(struct sock *sk, u16 rx_control)
+{
+       struct l2cap_pinfo *pi = l2cap_pi(sk);
+       u8 tx_seq = __get_reqseq(rx_control);
 
-       case L2CAP_SUPER_SELECT_REJECT:
-               pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
+       pi->conn_state &= ~L2CAP_CONN_REMOTE_BUSY;
 
-               if (rx_control & L2CAP_CTRL_POLL) {
-                       l2cap_retransmit_frame(sk, tx_seq);
-                       pi->expected_ack_seq = tx_seq;
-                       l2cap_drop_acked_frames(sk);
-                       l2cap_ertm_send(sk);
-                       if (pi->conn_state & L2CAP_CONN_WAIT_F) {
-                               pi->srej_save_reqseq = tx_seq;
-                               pi->conn_state |= L2CAP_CONN_SREJ_ACT;
-                       }
-               } else if (rx_control & L2CAP_CTRL_FINAL) {
-                       if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
-                                       pi->srej_save_reqseq == tx_seq)
-                               pi->srej_save_reqseq &= ~L2CAP_CONN_SREJ_ACT;
-                       else
-                               l2cap_retransmit_frame(sk, tx_seq);
+       if (rx_control & L2CAP_CTRL_POLL) {
+               pi->expected_ack_seq = tx_seq;
+               l2cap_drop_acked_frames(sk);
+               l2cap_retransmit_frame(sk, tx_seq);
+               l2cap_ertm_send(sk);
+               if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                       pi->srej_save_reqseq = tx_seq;
+                       pi->conn_state |= L2CAP_CONN_SREJ_ACT;
                }
-               else {
+       } else if (rx_control & L2CAP_CTRL_FINAL) {
+               if ((pi->conn_state & L2CAP_CONN_SREJ_ACT) &&
+                               pi->srej_save_reqseq == tx_seq)
+                       pi->conn_state &= ~L2CAP_CONN_SREJ_ACT;
+               else
                        l2cap_retransmit_frame(sk, tx_seq);
-                       if (pi->conn_state & L2CAP_CONN_WAIT_F) {
-                               pi->srej_save_reqseq = tx_seq;
-                               pi->conn_state |= L2CAP_CONN_SREJ_ACT;
-                       }
+       } else {
+               l2cap_retransmit_frame(sk, tx_seq);
+               if (pi->conn_state & L2CAP_CONN_WAIT_F) {
+                       pi->srej_save_reqseq = tx_seq;
+                       pi->conn_state |= L2CAP_CONN_SREJ_ACT;
                }
-               break;
+       }
+}
 
-       case L2CAP_SUPER_RCV_NOT_READY:
-               pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
-               pi->expected_ack_seq = tx_seq;
-               l2cap_drop_acked_frames(sk);
+static inline void l2cap_data_channel_rnrframe(struct sock *sk, u16 rx_control)
+{
+       struct l2cap_pinfo *pi = l2cap_pi(sk);
+       u8 tx_seq = __get_reqseq(rx_control);
 
-               del_timer(&l2cap_pi(sk)->retrans_timer);
+       pi->conn_state |= L2CAP_CONN_REMOTE_BUSY;
+       pi->expected_ack_seq = tx_seq;
+       l2cap_drop_acked_frames(sk);
+
+       if (!(pi->conn_state & L2CAP_CONN_SREJ_SENT)) {
+               del_timer(&pi->retrans_timer);
                if (rx_control & L2CAP_CTRL_POLL) {
                        u16 control = L2CAP_CTRL_FINAL;
-                       l2cap_send_rr_or_rnr(l2cap_pi(sk), control);
+                       l2cap_send_rr_or_rnr(pi, control);
                }
+               return;
+       }
+
+       if (rx_control & L2CAP_CTRL_POLL)
+               l2cap_send_srejtail(sk);
+       else
+               l2cap_send_sframe(pi, L2CAP_SUPER_RCV_READY);
+}
+
+static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, struct sk_buff *skb)
+{
+       BT_DBG("sk %p rx_control 0x%4.4x len %d", sk, rx_control, skb->len);
+
+       if (L2CAP_CTRL_FINAL & rx_control) {
+               del_timer(&l2cap_pi(sk)->monitor_timer);
+               if (l2cap_pi(sk)->unacked_frames > 0)
+                       __mod_retrans_timer();
+               l2cap_pi(sk)->conn_state &= ~L2CAP_CONN_WAIT_F;
+       }
+
+       switch (rx_control & L2CAP_CTRL_SUPERVISE) {
+       case L2CAP_SUPER_RCV_READY:
+               l2cap_data_channel_rrframe(sk, rx_control);
+               break;
+
+       case L2CAP_SUPER_REJECT:
+               l2cap_data_channel_rejframe(sk, rx_control);
+               break;
+
+       case L2CAP_SUPER_SELECT_REJECT:
+               l2cap_data_channel_srejframe(sk, rx_control);
+               break;
+
+       case L2CAP_SUPER_RCV_NOT_READY:
+               l2cap_data_channel_rnrframe(sk, rx_control);
                break;
        }
 
+       kfree_skb(skb);
        return 0;
 }
 
@@ -3458,8 +3770,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
        struct sock *sk;
        struct l2cap_pinfo *pi;
        u16 control, len;
-       u8 tx_seq;
-       int err;
+       u8 tx_seq, req_seq, next_tx_seq_offset, req_seq_offset;
 
        sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
        if (!sk) {
@@ -3504,20 +3815,41 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 * Receiver will miss it and start proper recovery
                 * procedures and ask retransmission.
                 */
-               if (len > L2CAP_DEFAULT_MAX_PDU_SIZE)
+               if (len > pi->mps)
                        goto drop;
 
                if (l2cap_check_fcs(pi, skb))
                        goto drop;
 
-               if (__is_iframe(control))
-                       err = l2cap_data_channel_iframe(sk, control, skb);
-               else
-                       err = l2cap_data_channel_sframe(sk, control, skb);
+               req_seq = __get_reqseq(control);
+               req_seq_offset = (req_seq - pi->expected_ack_seq) % 64;
+               if (req_seq_offset < 0)
+                       req_seq_offset += 64;
 
-               if (!err)
-                       goto done;
-               break;
+               next_tx_seq_offset =
+                       (pi->next_tx_seq - pi->expected_ack_seq) % 64;
+               if (next_tx_seq_offset < 0)
+                       next_tx_seq_offset += 64;
+
+               /* check for invalid req-seq */
+               if (req_seq_offset > next_tx_seq_offset) {
+                       l2cap_send_disconn_req(pi->conn, sk);
+                       goto drop;
+               }
+
+               if (__is_iframe(control)) {
+                       if (len < 4)
+                               goto drop;
+
+                       l2cap_data_channel_iframe(sk, control, skb);
+               } else {
+                       if (len != 0)
+                               goto drop;
+
+                       l2cap_data_channel_sframe(sk, control, skb);
+               }
+
+               goto done;
 
        case L2CAP_MODE_STREAMING:
                control = get_unaligned_le16(skb->data);
@@ -3530,7 +3862,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                if (pi->fcs == L2CAP_FCS_CRC16)
                        len -= 2;
 
-               if (len > L2CAP_DEFAULT_MAX_PDU_SIZE || __is_sframe(control))
+               if (len > pi->mps || len < 4 || __is_sframe(control))
                        goto drop;
 
                if (l2cap_check_fcs(pi, skb))
@@ -3541,14 +3873,14 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                if (pi->expected_tx_seq == tx_seq)
                        pi->expected_tx_seq = (pi->expected_tx_seq + 1) % 64;
                else
-                       pi->expected_tx_seq = tx_seq + 1;
+                       pi->expected_tx_seq = (tx_seq + 1) % 64;
 
-               err = l2cap_sar_reassembly_sdu(sk, skb, control);
+               l2cap_sar_reassembly_sdu(sk, skb, control);
 
                goto done;
 
        default:
-               BT_DBG("sk %p: bad mode 0x%2.2x", sk, l2cap_pi(sk)->mode);
+               BT_DBG("sk %p: bad mode 0x%2.2x", sk, pi->mode);
                break;
        }
 
@@ -3704,7 +4036,7 @@ static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
 
 static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
 {
-       if (sk->sk_type != SOCK_SEQPACKET)
+       if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM)
                return;
 
        if (encrypt == 0x00) {
@@ -3880,29 +4212,42 @@ drop:
        return 0;
 }
 
-static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
+static int l2cap_debugfs_show(struct seq_file *f, void *p)
 {
        struct sock *sk;
        struct hlist_node *node;
-       char *str = buf;
 
        read_lock_bh(&l2cap_sk_list.lock);
 
        sk_for_each(sk, node, &l2cap_sk_list.head) {
                struct l2cap_pinfo *pi = l2cap_pi(sk);
 
-               str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
-                               batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
-                               sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
-                               pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
+               seq_printf(f, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
+                                       batostr(&bt_sk(sk)->src),
+                                       batostr(&bt_sk(sk)->dst),
+                                       sk->sk_state, __le16_to_cpu(pi->psm),
+                                       pi->scid, pi->dcid,
+                                       pi->imtu, pi->omtu, pi->sec_level);
        }
 
        read_unlock_bh(&l2cap_sk_list.lock);
 
-       return str - buf;
+       return 0;
 }
 
-static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
+static int l2cap_debugfs_open(struct inode *inode, struct file *file)
+{
+       return single_open(file, l2cap_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations l2cap_debugfs_fops = {
+       .open           = l2cap_debugfs_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = single_release,
+};
+
+static struct dentry *l2cap_debugfs;
 
 static const struct proto_ops l2cap_sock_ops = {
        .family         = PF_BLUETOOTH,
@@ -3924,7 +4269,7 @@ static const struct proto_ops l2cap_sock_ops = {
        .getsockopt     = l2cap_sock_getsockopt
 };
 
-static struct net_proto_family l2cap_sock_family_ops = {
+static const struct net_proto_family l2cap_sock_family_ops = {
        .family = PF_BLUETOOTH,
        .owner  = THIS_MODULE,
        .create = l2cap_sock_create,
@@ -3962,8 +4307,12 @@ static int __init l2cap_init(void)
                goto error;
        }
 
-       if (class_create_file(bt_class, &class_attr_l2cap) < 0)
-               BT_ERR("Failed to create L2CAP info file");
+       if (bt_debugfs) {
+               l2cap_debugfs = debugfs_create_file("l2cap", 0444,
+                                       bt_debugfs, NULL, &l2cap_debugfs_fops);
+               if (!l2cap_debugfs)
+                       BT_ERR("Failed to create L2CAP debug file");
+       }
 
        BT_INFO("L2CAP ver %s", VERSION);
        BT_INFO("L2CAP socket layer initialized");
@@ -3977,7 +4326,7 @@ error:
 
 static void __exit l2cap_exit(void)
 {
-       class_remove_file(bt_class, &class_attr_l2cap);
+       debugfs_remove(l2cap_debugfs);
 
        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
                BT_ERR("L2CAP socket unregistration failed");
@@ -4003,6 +4352,12 @@ module_exit(l2cap_exit);
 module_param(enable_ertm, bool, 0644);
 MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
 
+module_param(max_transmit, uint, 0644);
+MODULE_PARM_DESC(max_transmit, "Max transmit value (default = 3)");
+
+module_param(tx_window, uint, 0644);
+MODULE_PARM_DESC(tx_window, "Transmission window size value (default = 63)");
+
 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
 MODULE_VERSION(VERSION);