net/bluetooth/l2cap.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth L2CAP core and sockets. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/capability.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <net/sock.h>
  44
  45 #include <asm/system.h>
  46 #include <asm/uaccess.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/hci_core.h>
  51 #include <net/bluetooth/l2cap.h>
  52
  53 #define VERSION "2.13"
  54
  55 static u32 l2cap_feat_mask = 0x0080;
  56 static u8 l2cap_fixed_chan[8] = { 0x02, };
  57
  58 static const struct proto_ops l2cap_sock_ops;
  59
  60 static struct bt_sock_list l2cap_sk_list = {
  61         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  62 };
  63
  64 static void __l2cap_sock_close(struct sock *sk, int reason);
  65 static void l2cap_sock_close(struct sock *sk);
  66 static void l2cap_sock_kill(struct sock *sk);
  67
  68 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  69                                 u8 code, u8 ident, u16 dlen, void *data);
  70
  71 /* ---- L2CAP timers ---- */
  72 static void l2cap_sock_timeout(unsigned long arg)
  73 {
  74         struct sock *sk = (struct sock *) arg;
  75         int reason;
  76
  77         BT_DBG("sock %p state %d", sk, sk->sk_state);
  78
  79         bh_lock_sock(sk);
  80
  81         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
  82                 reason = ECONNREFUSED;
  83         else if (sk->sk_state == BT_CONNECT &&
  84                                 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
  85                 reason = ECONNREFUSED;
  86         else
  87                 reason = ETIMEDOUT;
  88
  89         __l2cap_sock_close(sk, reason);
  90
  91         bh_unlock_sock(sk);
  92
  93         l2cap_sock_kill(sk);
  94         sock_put(sk);
  95 }
  96
  97 static void l2cap_sock_set_timer(struct sock *sk, long timeout)
  98 {
  99         BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
 100         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
 101 }
 102
 103 static void l2cap_sock_clear_timer(struct sock *sk)
 104 {
 105         BT_DBG("sock %p state %d", sk, sk->sk_state);
 106         sk_stop_timer(sk, &sk->sk_timer);
 107 }
 108
 109 /* ---- L2CAP channels ---- */
 110 static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
 111 {
 112         struct sock *s;
 113         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 114                 if (l2cap_pi(s)->dcid == cid)
 115                         break;
 116         }
 117         return s;
 118 }
 119
 120 static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 121 {
 122         struct sock *s;
 123         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 124                 if (l2cap_pi(s)->scid == cid)
 125                         break;
 126         }
 127         return s;
 128 }
 129
 130 /* Find channel with given SCID.
 131  * Returns locked socket */
 132 static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 133 {
 134         struct sock *s;
 135         read_lock(&l->lock);
 136         s = __l2cap_get_chan_by_scid(l, cid);
 137         if (s) bh_lock_sock(s);
 138         read_unlock(&l->lock);
 139         return s;
 140 }
 141
 142 static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 143 {
 144         struct sock *s;
 145         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 146                 if (l2cap_pi(s)->ident == ident)
 147                         break;
 148         }
 149         return s;
 150 }
 151
 152 static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 153 {
 154         struct sock *s;
 155         read_lock(&l->lock);
 156         s = __l2cap_get_chan_by_ident(l, ident);
 157         if (s) bh_lock_sock(s);
 158         read_unlock(&l->lock);
 159         return s;
 160 }
 161
 162 static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
 163 {
 164         u16 cid = 0x0040;
 165
 166         for (; cid < 0xffff; cid++) {
 167                 if(!__l2cap_get_chan_by_scid(l, cid))
 168                         return cid;
 169         }
 170
 171         return 0;
 172 }
 173
 174 static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
 175 {
 176         sock_hold(sk);
 177
 178         if (l->head)
 179                 l2cap_pi(l->head)->prev_c = sk;
 180
 181         l2cap_pi(sk)->next_c = l->head;
 182         l2cap_pi(sk)->prev_c = NULL;
 183         l->head = sk;
 184 }
 185
 186 static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 187 {
 188         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 189
 190         write_lock_bh(&l->lock);
 191         if (sk == l->head)
 192                 l->head = next;
 193
 194         if (next)
 195                 l2cap_pi(next)->prev_c = prev;
 196         if (prev)
 197                 l2cap_pi(prev)->next_c = next;
 198         write_unlock_bh(&l->lock);
 199
 200         __sock_put(sk);
 201 }
 202
 203 static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 204 {
 205         struct l2cap_chan_list *l = &conn->chan_list;
 206
 207         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
 208
 209         conn->disc_reason = 0x13;
 210
 211         l2cap_pi(sk)->conn = conn;
 212
 213         if (sk->sk_type == SOCK_SEQPACKET) {
 214                 /* Alloc CID for connection-oriented socket */
 215                 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
 216         } else if (sk->sk_type == SOCK_DGRAM) {
 217                 /* Connectionless socket */
 218                 l2cap_pi(sk)->scid = 0x0002;
 219                 l2cap_pi(sk)->dcid = 0x0002;
 220                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 221         } else {
 222                 /* Raw socket can send/recv signalling messages only */
 223                 l2cap_pi(sk)->scid = 0x0001;
 224                 l2cap_pi(sk)->dcid = 0x0001;
 225                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 226         }
 227
 228         __l2cap_chan_link(l, sk);
 229
 230         if (parent)
 231                 bt_accept_enqueue(parent, sk);
 232 }
 233
 234 /* Delete channel.
 235  * Must be called on the locked socket. */
 236 static void l2cap_chan_del(struct sock *sk, int err)
 237 {
 238         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 239         struct sock *parent = bt_sk(sk)->parent;
 240
 241         l2cap_sock_clear_timer(sk);
 242
 243         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 244
 245         if (conn) {
 246                 /* Unlink from channel list */
 247                 l2cap_chan_unlink(&conn->chan_list, sk);
 248                 l2cap_pi(sk)->conn = NULL;
 249                 hci_conn_put(conn->hcon);
 250         }
 251
 252         sk->sk_state = BT_CLOSED;
 253         sock_set_flag(sk, SOCK_ZAPPED);
 254
 255         if (err)
 256                 sk->sk_err = err;
 257
 258         if (parent) {
 259                 bt_accept_unlink(sk);
 260                 parent->sk_data_ready(parent, 0);
 261         } else
 262                 sk->sk_state_change(sk);
 263 }
 264
 265 /* Service level security */
 266 static inline int l2cap_check_security(struct sock *sk)
 267 {
 268         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 269         __u8 auth_type;
 270
 271         if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 272                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 273                         auth_type = HCI_AT_NO_BONDING_MITM;
 274                 else
 275                         auth_type = HCI_AT_NO_BONDING;
 276
 277                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 278                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 279         } else {
 280                 switch (l2cap_pi(sk)->sec_level) {
 281                 case BT_SECURITY_HIGH:
 282                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 283                         break;
 284                 case BT_SECURITY_MEDIUM:
 285                         auth_type = HCI_AT_GENERAL_BONDING;
 286                         break;
 287                 default:
 288                         auth_type = HCI_AT_NO_BONDING;
 289                         break;
 290                 }
 291         }
 292
 293         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
 294                                                                 auth_type);
 295 }
 296
 297 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
 298 {
 299         u8 id;
 300
 301         /* Get next available identificator.
 302          *    1 - 128 are used by kernel.
 303          *  129 - 199 are reserved.
 304          *  200 - 254 are used by utilities like l2ping, etc.
 305          */
 306
 307         spin_lock_bh(&conn->lock);
 308
 309         if (++conn->tx_ident > 128)
 310                 conn->tx_ident = 1;
 311
 312         id = conn->tx_ident;
 313
 314         spin_unlock_bh(&conn->lock);
 315
 316         return id;
 317 }
 318
 319 static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 320 {
 321         struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 322
 323         BT_DBG("code 0x%2.2x", code);
 324
 325         if (!skb)
 326                 return -ENOMEM;
 327
 328         return hci_send_acl(conn->hcon, skb, 0);
 329 }
 330
 331 static void l2cap_do_start(struct sock *sk)
 332 {
 333         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 334
 335         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
 336                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 337                         return;
 338
 339                 if (l2cap_check_security(sk)) {
 340                         struct l2cap_conn_req req;
 341                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 342                         req.psm  = l2cap_pi(sk)->psm;
 343
 344                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 345
 346                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 347                                         L2CAP_CONN_REQ, sizeof(req), &req);
 348                 }
 349         } else {
 350                 struct l2cap_info_req req;
 351                 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 352
 353                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
 354                 conn->info_ident = l2cap_get_ident(conn);
 355
 356                 mod_timer(&conn->info_timer, jiffies +
 357                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
 358
 359                 l2cap_send_cmd(conn, conn->info_ident,
 360                                         L2CAP_INFO_REQ, sizeof(req), &req);
 361         }
 362 }
 363
 364 /* ---- L2CAP connections ---- */
 365 static void l2cap_conn_start(struct l2cap_conn *conn)
 366 {
 367         struct l2cap_chan_list *l = &conn->chan_list;
 368         struct sock *sk;
 369
 370         BT_DBG("conn %p", conn);
 371
 372         read_lock(&l->lock);
 373
 374         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 375                 bh_lock_sock(sk);
 376
 377                 if (sk->sk_type != SOCK_SEQPACKET) {
 378                         bh_unlock_sock(sk);
 379                         continue;
 380                 }
 381
 382                 if (sk->sk_state == BT_CONNECT) {
 383                         if (l2cap_check_security(sk)) {
 384                                 struct l2cap_conn_req req;
 385                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 386                                 req.psm  = l2cap_pi(sk)->psm;
 387
 388                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 389
 390                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 391                                         L2CAP_CONN_REQ, sizeof(req), &req);
 392                         }
 393                 } else if (sk->sk_state == BT_CONNECT2) {
 394                         struct l2cap_conn_rsp rsp;
 395                         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
 396                         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
 397
 398                         if (l2cap_check_security(sk)) {
 399                                 if (bt_sk(sk)->defer_setup) {
 400                                         struct sock *parent = bt_sk(sk)->parent;
 401                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 402                                         rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
 403                                         parent->sk_data_ready(parent, 0);
 404
 405                                 } else {
 406                                         sk->sk_state = BT_CONFIG;
 407                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 408                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 409                                 }
 410                         } else {
 411                                 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 412                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
 413                         }
 414
 415                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 416                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 417                 }
 418
 419                 bh_unlock_sock(sk);
 420         }
 421
 422         read_unlock(&l->lock);
 423 }
 424
 425 static void l2cap_conn_ready(struct l2cap_conn *conn)
 426 {
 427         struct l2cap_chan_list *l = &conn->chan_list;
 428         struct sock *sk;
 429
 430         BT_DBG("conn %p", conn);
 431
 432         read_lock(&l->lock);
 433
 434         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 435                 bh_lock_sock(sk);
 436
 437                 if (sk->sk_type != SOCK_SEQPACKET) {
 438                         l2cap_sock_clear_timer(sk);
 439                         sk->sk_state = BT_CONNECTED;
 440                         sk->sk_state_change(sk);
 441                 } else if (sk->sk_state == BT_CONNECT)
 442                         l2cap_do_start(sk);
 443
 444                 bh_unlock_sock(sk);
 445         }
 446
 447         read_unlock(&l->lock);
 448 }
 449
 450 /* Notify sockets that we cannot guaranty reliability anymore */
 451 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 452 {
 453         struct l2cap_chan_list *l = &conn->chan_list;
 454         struct sock *sk;
 455
 456         BT_DBG("conn %p", conn);
 457
 458         read_lock(&l->lock);
 459
 460         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 461                 if (l2cap_pi(sk)->force_reliable)
 462                         sk->sk_err = err;
 463         }
 464
 465         read_unlock(&l->lock);
 466 }
 467
 468 static void l2cap_info_timeout(unsigned long arg)
 469 {
 470         struct l2cap_conn *conn = (void *) arg;
 471
 472         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 473         conn->info_ident = 0;
 474
 475         l2cap_conn_start(conn);
 476 }
 477
 478 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 479 {
 480         struct l2cap_conn *conn = hcon->l2cap_data;
 481
 482         if (conn || status)
 483                 return conn;
 484
 485         conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
 486         if (!conn)
 487                 return NULL;
 488
 489         hcon->l2cap_data = conn;
 490         conn->hcon = hcon;
 491
 492         BT_DBG("hcon %p conn %p", hcon, conn);
 493
 494         conn->mtu = hcon->hdev->acl_mtu;
 495         conn->src = &hcon->hdev->bdaddr;
 496         conn->dst = &hcon->dst;
 497
 498         conn->feat_mask = 0;
 499
 500         setup_timer(&conn->info_timer, l2cap_info_timeout,
 501                                                 (unsigned long) conn);
 502
 503         spin_lock_init(&conn->lock);
 504         rwlock_init(&conn->chan_list.lock);
 505
 506         conn->disc_reason = 0x13;
 507
 508         return conn;
 509 }
 510
 511 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 512 {
 513         struct l2cap_conn *conn = hcon->l2cap_data;
 514         struct sock *sk;
 515
 516         if (!conn)
 517                 return;
 518
 519         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 520
 521         if (conn->rx_skb)
 522                 kfree_skb(conn->rx_skb);
 523
 524         /* Kill channels */
 525         while ((sk = conn->chan_list.head)) {
 526                 bh_lock_sock(sk);
 527                 l2cap_chan_del(sk, err);
 528                 bh_unlock_sock(sk);
 529                 l2cap_sock_kill(sk);
 530         }
 531
 532         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 533                 del_timer_sync(&conn->info_timer);
 534
 535         hcon->l2cap_data = NULL;
 536         kfree(conn);
 537 }
 538
 539 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 540 {
 541         struct l2cap_chan_list *l = &conn->chan_list;
 542         write_lock_bh(&l->lock);
 543         __l2cap_chan_add(conn, sk, parent);
 544         write_unlock_bh(&l->lock);
 545 }
 546
 547 /* ---- Socket interface ---- */
 548 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 549 {
 550         struct sock *sk;
 551         struct hlist_node *node;
 552         sk_for_each(sk, node, &l2cap_sk_list.head)
 553                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
 554                         goto found;
 555         sk = NULL;
 556 found:
 557         return sk;
 558 }
 559
 560 /* Find socket with psm and source bdaddr.
 561  * Returns closest match.
 562  */
 563 static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 564 {
 565         struct sock *sk = NULL, *sk1 = NULL;
 566         struct hlist_node *node;
 567
 568         sk_for_each(sk, node, &l2cap_sk_list.head) {
 569                 if (state && sk->sk_state != state)
 570                         continue;
 571
 572                 if (l2cap_pi(sk)->psm == psm) {
 573                         /* Exact match. */
 574                         if (!bacmp(&bt_sk(sk)->src, src))
 575                                 break;
 576
 577                         /* Closest match */
 578                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 579                                 sk1 = sk;
 580                 }
 581         }
 582         return node ? sk : sk1;
 583 }
 584
 585 /* Find socket with given address (psm, src).
 586  * Returns locked socket */
 587 static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 588 {
 589         struct sock *s;
 590         read_lock(&l2cap_sk_list.lock);
 591         s = __l2cap_get_sock_by_psm(state, psm, src);
 592         if (s) bh_lock_sock(s);
 593         read_unlock(&l2cap_sk_list.lock);
 594         return s;
 595 }
 596
 597 static void l2cap_sock_destruct(struct sock *sk)
 598 {
 599         BT_DBG("sk %p", sk);
 600
 601         skb_queue_purge(&sk->sk_receive_queue);
 602         skb_queue_purge(&sk->sk_write_queue);
 603 }
 604
 605 static void l2cap_sock_cleanup_listen(struct sock *parent)
 606 {
 607         struct sock *sk;
 608
 609         BT_DBG("parent %p", parent);
 610
 611         /* Close not yet accepted channels */
 612         while ((sk = bt_accept_dequeue(parent, NULL)))
 613                 l2cap_sock_close(sk);
 614
 615         parent->sk_state = BT_CLOSED;
 616         sock_set_flag(parent, SOCK_ZAPPED);
 617 }
 618
 619 /* Kill socket (only if zapped and orphan)
 620  * Must be called on unlocked socket.
 621  */
 622 static void l2cap_sock_kill(struct sock *sk)
 623 {
 624         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 625                 return;
 626
 627         BT_DBG("sk %p state %d", sk, sk->sk_state);
 628
 629         /* Kill poor orphan */
 630         bt_sock_unlink(&l2cap_sk_list, sk);
 631         sock_set_flag(sk, SOCK_DEAD);
 632         sock_put(sk);
 633 }
 634
 635 static void __l2cap_sock_close(struct sock *sk, int reason)
 636 {
 637         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 638
 639         switch (sk->sk_state) {
 640         case BT_LISTEN:
 641                 l2cap_sock_cleanup_listen(sk);
 642                 break;
 643
 644         case BT_CONNECTED:
 645         case BT_CONFIG:
 646                 if (sk->sk_type == SOCK_SEQPACKET) {
 647                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 648                         struct l2cap_disconn_req req;
 649
 650                         sk->sk_state = BT_DISCONN;
 651                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 652
 653                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
 654                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 655                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
 656                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 657                 } else
 658                         l2cap_chan_del(sk, reason);
 659                 break;
 660
 661         case BT_CONNECT2:
 662                 if (sk->sk_type == SOCK_SEQPACKET) {
 663                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 664                         struct l2cap_conn_rsp rsp;
 665                         __u16 result;
 666
 667                         if (bt_sk(sk)->defer_setup)
 668                                 result = L2CAP_CR_SEC_BLOCK;
 669                         else
 670                                 result = L2CAP_CR_BAD_PSM;
 671
 672                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
 673                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
 674                         rsp.result = cpu_to_le16(result);
 675                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 676                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 677                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 678                 } else
 679                         l2cap_chan_del(sk, reason);
 680                 break;
 681
 682         case BT_CONNECT:
 683         case BT_DISCONN:
 684                 l2cap_chan_del(sk, reason);
 685                 break;
 686
 687         default:
 688                 sock_set_flag(sk, SOCK_ZAPPED);
 689                 break;
 690         }
 691 }
 692
 693 /* Must be called on unlocked socket. */
 694 static void l2cap_sock_close(struct sock *sk)
 695 {
 696         l2cap_sock_clear_timer(sk);
 697         lock_sock(sk);
 698         __l2cap_sock_close(sk, ECONNRESET);
 699         release_sock(sk);
 700         l2cap_sock_kill(sk);
 701 }
 702
 703 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 704 {
 705         struct l2cap_pinfo *pi = l2cap_pi(sk);
 706
 707         BT_DBG("sk %p", sk);
 708
 709         if (parent) {
 710                 sk->sk_type = parent->sk_type;
 711                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 712
 713                 pi->imtu = l2cap_pi(parent)->imtu;
 714                 pi->omtu = l2cap_pi(parent)->omtu;
 715                 pi->sec_level = l2cap_pi(parent)->sec_level;
 716                 pi->role_switch = l2cap_pi(parent)->role_switch;
 717                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
 718         } else {
 719                 pi->imtu = L2CAP_DEFAULT_MTU;
 720                 pi->omtu = 0;
 721                 pi->sec_level = BT_SECURITY_LOW;
 722                 pi->role_switch = 0;
 723                 pi->force_reliable = 0;
 724         }
 725
 726         /* Default config options */
 727         pi->conf_len = 0;
 728         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 729 }
 730
 731 static struct proto l2cap_proto = {
 732         .name           = "L2CAP",
 733         .owner          = THIS_MODULE,
 734         .obj_size       = sizeof(struct l2cap_pinfo)
 735 };
 736
 737 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 738 {
 739         struct sock *sk;
 740
 741         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 742         if (!sk)
 743                 return NULL;
 744
 745         sock_init_data(sock, sk);
 746         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 747
 748         sk->sk_destruct = l2cap_sock_destruct;
 749         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 750
 751         sock_reset_flag(sk, SOCK_ZAPPED);
 752
 753         sk->sk_protocol = proto;
 754         sk->sk_state = BT_OPEN;
 755
 756         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 757
 758         bt_sock_link(&l2cap_sk_list, sk);
 759         return sk;
 760 }
 761
 762 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
 763 {
 764         struct sock *sk;
 765
 766         BT_DBG("sock %p", sock);
 767
 768         sock->state = SS_UNCONNECTED;
 769
 770         if (sock->type != SOCK_SEQPACKET &&
 771                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 772                 return -ESOCKTNOSUPPORT;
 773
 774         if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
 775                 return -EPERM;
 776
 777         sock->ops = &l2cap_sock_ops;
 778
 779         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 780         if (!sk)
 781                 return -ENOMEM;
 782
 783         l2cap_sock_init(sk, NULL);
 784         return 0;
 785 }
 786
 787 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 788 {
 789         struct sock *sk = sock->sk;
 790         struct sockaddr_l2 la;
 791         int len, err = 0;
 792
 793         BT_DBG("sk %p", sk);
 794
 795         if (!addr || addr->sa_family != AF_BLUETOOTH)
 796                 return -EINVAL;
 797
 798         memset(&la, 0, sizeof(la));
 799         len = min_t(unsigned int, sizeof(la), alen);
 800         memcpy(&la, addr, len);
 801
 802         lock_sock(sk);
 803
 804         if (sk->sk_state != BT_OPEN) {
 805                 err = -EBADFD;
 806                 goto done;
 807         }
 808
 809         if (la.l2_psm && btohs(la.l2_psm) < 0x1001 &&
 810                                 !capable(CAP_NET_BIND_SERVICE)) {
 811                 err = -EACCES;
 812                 goto done;
 813         }
 814
 815         write_lock_bh(&l2cap_sk_list.lock);
 816
 817         if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
 818                 err = -EADDRINUSE;
 819         } else {
 820                 /* Save source address */
 821                 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 822                 l2cap_pi(sk)->psm   = la.l2_psm;
 823                 l2cap_pi(sk)->sport = la.l2_psm;
 824                 sk->sk_state = BT_BOUND;
 825
 826                 if (btohs(la.l2_psm) == 0x0001 || btohs(la.l2_psm) == 0x0003)
 827                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 828         }
 829
 830         write_unlock_bh(&l2cap_sk_list.lock);
 831
 832 done:
 833         release_sock(sk);
 834         return err;
 835 }
 836
 837 static int l2cap_do_connect(struct sock *sk)
 838 {
 839         bdaddr_t *src = &bt_sk(sk)->src;
 840         bdaddr_t *dst = &bt_sk(sk)->dst;
 841         struct l2cap_conn *conn;
 842         struct hci_conn *hcon;
 843         struct hci_dev *hdev;
 844         __u8 auth_type;
 845         int err = 0;
 846
 847         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
 848                                                         l2cap_pi(sk)->psm);
 849
 850         if (!(hdev = hci_get_route(dst, src)))
 851                 return -EHOSTUNREACH;
 852
 853         hci_dev_lock_bh(hdev);
 854
 855         err = -ENOMEM;
 856
 857         if (sk->sk_type == SOCK_RAW) {
 858                 switch (l2cap_pi(sk)->sec_level) {
 859                 case BT_SECURITY_HIGH:
 860                         auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 861                         break;
 862                 case BT_SECURITY_MEDIUM:
 863                         auth_type = HCI_AT_DEDICATED_BONDING;
 864                         break;
 865                 default:
 866                         auth_type = HCI_AT_NO_BONDING;
 867                         break;
 868                 }
 869         } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 870                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 871                         auth_type = HCI_AT_NO_BONDING_MITM;
 872                 else
 873                         auth_type = HCI_AT_NO_BONDING;
 874
 875                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 876                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 877         } else {
 878                 switch (l2cap_pi(sk)->sec_level) {
 879                 case BT_SECURITY_HIGH:
 880                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 881                         break;
 882                 case BT_SECURITY_MEDIUM:
 883                         auth_type = HCI_AT_GENERAL_BONDING;
 884                         break;
 885                 default:
 886                         auth_type = HCI_AT_NO_BONDING;
 887                         break;
 888                 }
 889         }
 890
 891         hcon = hci_connect(hdev, ACL_LINK, dst,
 892                                         l2cap_pi(sk)->sec_level, auth_type);
 893         if (!hcon)
 894                 goto done;
 895
 896         conn = l2cap_conn_add(hcon, 0);
 897         if (!conn) {
 898                 hci_conn_put(hcon);
 899                 goto done;
 900         }
 901
 902         err = 0;
 903
 904         /* Update source addr of the socket */
 905         bacpy(src, conn->src);
 906
 907         l2cap_chan_add(conn, sk, NULL);
 908
 909         sk->sk_state = BT_CONNECT;
 910         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 911
 912         if (hcon->state == BT_CONNECTED) {
 913                 if (sk->sk_type != SOCK_SEQPACKET) {
 914                         l2cap_sock_clear_timer(sk);
 915                         sk->sk_state = BT_CONNECTED;
 916                 } else
 917                         l2cap_do_start(sk);
 918         }
 919
 920 done:
 921         hci_dev_unlock_bh(hdev);
 922         hci_dev_put(hdev);
 923         return err;
 924 }
 925
 926 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 927 {
 928         struct sock *sk = sock->sk;
 929         struct sockaddr_l2 la;
 930         int len, err = 0;
 931
 932         lock_sock(sk);
 933
 934         BT_DBG("sk %p", sk);
 935
 936         if (!addr || addr->sa_family != AF_BLUETOOTH) {
 937                 err = -EINVAL;
 938                 goto done;
 939         }
 940
 941         memset(&la, 0, sizeof(la));
 942         len = min_t(unsigned int, sizeof(la), alen);
 943         memcpy(&la, addr, len);
 944
 945         if (sk->sk_type == SOCK_SEQPACKET && !la.l2_psm) {
 946                 err = -EINVAL;
 947                 goto done;
 948         }
 949
 950         switch(sk->sk_state) {
 951         case BT_CONNECT:
 952         case BT_CONNECT2:
 953         case BT_CONFIG:
 954                 /* Already connecting */
 955                 goto wait;
 956
 957         case BT_CONNECTED:
 958                 /* Already connected */
 959                 goto done;
 960
 961         case BT_OPEN:
 962         case BT_BOUND:
 963                 /* Can connect */
 964                 break;
 965
 966         default:
 967                 err = -EBADFD;
 968                 goto done;
 969         }
 970
 971         /* Set destination address and psm */
 972         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
 973         l2cap_pi(sk)->psm = la.l2_psm;
 974
 975         if ((err = l2cap_do_connect(sk)))
 976                 goto done;
 977
 978 wait:
 979         err = bt_sock_wait_state(sk, BT_CONNECTED,
 980                         sock_sndtimeo(sk, flags & O_NONBLOCK));
 981 done:
 982         release_sock(sk);
 983         return err;
 984 }
 985
 986 static int l2cap_sock_listen(struct socket *sock, int backlog)
 987 {
 988         struct sock *sk = sock->sk;
 989         int err = 0;
 990
 991         BT_DBG("sk %p backlog %d", sk, backlog);
 992
 993         lock_sock(sk);
 994
 995         if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
 996                 err = -EBADFD;
 997                 goto done;
 998         }
 999
1000         if (!l2cap_pi(sk)->psm) {
1001                 bdaddr_t *src = &bt_sk(sk)->src;
1002                 u16 psm;
1003
1004                 err = -EINVAL;
1005
1006                 write_lock_bh(&l2cap_sk_list.lock);
1007
1008                 for (psm = 0x1001; psm < 0x1100; psm += 2)
1009                         if (!__l2cap_get_sock_by_addr(htobs(psm), src)) {
1010                                 l2cap_pi(sk)->psm   = htobs(psm);
1011                                 l2cap_pi(sk)->sport = htobs(psm);
1012                                 err = 0;
1013                                 break;
1014                         }
1015
1016                 write_unlock_bh(&l2cap_sk_list.lock);
1017
1018                 if (err < 0)
1019                         goto done;
1020         }
1021
1022         sk->sk_max_ack_backlog = backlog;
1023         sk->sk_ack_backlog = 0;
1024         sk->sk_state = BT_LISTEN;
1025
1026 done:
1027         release_sock(sk);
1028         return err;
1029 }
1030
1031 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
1032 {
1033         DECLARE_WAITQUEUE(wait, current);
1034         struct sock *sk = sock->sk, *nsk;
1035         long timeo;
1036         int err = 0;
1037
1038         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1039
1040         if (sk->sk_state != BT_LISTEN) {
1041                 err = -EBADFD;
1042                 goto done;
1043         }
1044
1045         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1046
1047         BT_DBG("sk %p timeo %ld", sk, timeo);
1048
1049         /* Wait for an incoming connection. (wake-one). */
1050         add_wait_queue_exclusive(sk->sk_sleep, &wait);
1051         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1052                 set_current_state(TASK_INTERRUPTIBLE);
1053                 if (!timeo) {
1054                         err = -EAGAIN;
1055                         break;
1056                 }
1057
1058                 release_sock(sk);
1059                 timeo = schedule_timeout(timeo);
1060                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1061
1062                 if (sk->sk_state != BT_LISTEN) {
1063                         err = -EBADFD;
1064                         break;
1065                 }
1066
1067                 if (signal_pending(current)) {
1068                         err = sock_intr_errno(timeo);
1069                         break;
1070                 }
1071         }
1072         set_current_state(TASK_RUNNING);
1073         remove_wait_queue(sk->sk_sleep, &wait);
1074
1075         if (err)
1076                 goto done;
1077
1078         newsock->state = SS_CONNECTED;
1079
1080         BT_DBG("new socket %p", nsk);
1081
1082 done:
1083         release_sock(sk);
1084         return err;
1085 }
1086
1087 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1088 {
1089         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1090         struct sock *sk = sock->sk;
1091
1092         BT_DBG("sock %p, sk %p", sock, sk);
1093
1094         addr->sa_family = AF_BLUETOOTH;
1095         *len = sizeof(struct sockaddr_l2);
1096
1097         if (peer) {
1098                 la->l2_psm = l2cap_pi(sk)->psm;
1099                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
1100                 la->l2_cid = htobs(l2cap_pi(sk)->dcid);
1101         } else {
1102                 la->l2_psm = l2cap_pi(sk)->sport;
1103                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
1104                 la->l2_cid = htobs(l2cap_pi(sk)->scid);
1105         }
1106
1107         return 0;
1108 }
1109
1110 static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
1111 {
1112         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1113         struct sk_buff *skb, **frag;
1114         int err, hlen, count, sent=0;
1115         struct l2cap_hdr *lh;
1116
1117         BT_DBG("sk %p len %d", sk, len);
1118
1119         /* First fragment (with L2CAP header) */
1120         if (sk->sk_type == SOCK_DGRAM)
1121                 hlen = L2CAP_HDR_SIZE + 2;
1122         else
1123                 hlen = L2CAP_HDR_SIZE;
1124
1125         count = min_t(unsigned int, (conn->mtu - hlen), len);
1126
1127         skb = bt_skb_send_alloc(sk, hlen + count,
1128                         msg->msg_flags & MSG_DONTWAIT, &err);
1129         if (!skb)
1130                 return err;
1131
1132         /* Create L2CAP header */
1133         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1134         lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1135         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1136
1137         if (sk->sk_type == SOCK_DGRAM)
1138                 put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
1139
1140         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
1141                 err = -EFAULT;
1142                 goto fail;
1143         }
1144
1145         sent += count;
1146         len  -= count;
1147
1148         /* Continuation fragments (no L2CAP header) */
1149         frag = &skb_shinfo(skb)->frag_list;
1150         while (len) {
1151                 count = min_t(unsigned int, conn->mtu, len);
1152
1153                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1154                 if (!*frag)
1155                         goto fail;
1156
1157                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
1158                         err = -EFAULT;
1159                         goto fail;
1160                 }
1161
1162                 sent += count;
1163                 len  -= count;
1164
1165                 frag = &(*frag)->next;
1166         }
1167
1168         if ((err = hci_send_acl(conn->hcon, skb, 0)) < 0)
1169                 goto fail;
1170
1171         return sent;
1172
1173 fail:
1174         kfree_skb(skb);
1175         return err;
1176 }
1177
1178 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1179 {
1180         struct sock *sk = sock->sk;
1181         int err = 0;
1182
1183         BT_DBG("sock %p, sk %p", sock, sk);
1184
1185         err = sock_error(sk);
1186         if (err)
1187                 return err;
1188
1189         if (msg->msg_flags & MSG_OOB)
1190                 return -EOPNOTSUPP;
1191
1192         /* Check outgoing MTU */
1193         if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
1194                 return -EINVAL;
1195
1196         lock_sock(sk);
1197
1198         if (sk->sk_state == BT_CONNECTED)
1199                 err = l2cap_do_send(sk, msg, len);
1200         else
1201                 err = -ENOTCONN;
1202
1203         release_sock(sk);
1204         return err;
1205 }
1206
1207 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1208 {
1209         struct sock *sk = sock->sk;
1210
1211         lock_sock(sk);
1212
1213         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1214                 struct l2cap_conn_rsp rsp;
1215
1216                 sk->sk_state = BT_CONFIG;
1217
1218                 rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1219                 rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
1220                 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1221                 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1222                 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1223                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1224
1225                 release_sock(sk);
1226                 return 0;
1227         }
1228
1229         release_sock(sk);
1230
1231         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1232 }
1233
1234 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
1235 {
1236         struct sock *sk = sock->sk;
1237         struct l2cap_options opts;
1238         int len, err = 0;
1239         u32 opt;
1240
1241         BT_DBG("sk %p", sk);
1242
1243         lock_sock(sk);
1244
1245         switch (optname) {
1246         case L2CAP_OPTIONS:
1247                 opts.imtu     = l2cap_pi(sk)->imtu;
1248                 opts.omtu     = l2cap_pi(sk)->omtu;
1249                 opts.flush_to = l2cap_pi(sk)->flush_to;
1250                 opts.mode     = L2CAP_MODE_BASIC;
1251
1252                 len = min_t(unsigned int, sizeof(opts), optlen);
1253                 if (copy_from_user((char *) &opts, optval, len)) {
1254                         err = -EFAULT;
1255                         break;
1256                 }
1257
1258                 l2cap_pi(sk)->imtu  = opts.imtu;
1259                 l2cap_pi(sk)->omtu  = opts.omtu;
1260                 break;
1261
1262         case L2CAP_LM:
1263                 if (get_user(opt, (u32 __user *) optval)) {
1264                         err = -EFAULT;
1265                         break;
1266                 }
1267
1268                 if (opt & L2CAP_LM_AUTH)
1269                         l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
1270                 if (opt & L2CAP_LM_ENCRYPT)
1271                         l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
1272                 if (opt & L2CAP_LM_SECURE)
1273                         l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
1274
1275                 l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
1276                 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
1277                 break;
1278
1279         default:
1280                 err = -ENOPROTOOPT;
1281                 break;
1282         }
1283
1284         release_sock(sk);
1285         return err;
1286 }
1287
1288 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1289 {
1290         struct sock *sk = sock->sk;
1291         struct bt_security sec;
1292         int len, err = 0;
1293         u32 opt;
1294
1295         BT_DBG("sk %p", sk);
1296
1297         if (level == SOL_L2CAP)
1298                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
1299
1300         if (level != SOL_BLUETOOTH)
1301                 return -ENOPROTOOPT;
1302
1303         lock_sock(sk);
1304
1305         switch (optname) {
1306         case BT_SECURITY:
1307                 if (sk->sk_type != SOCK_SEQPACKET) {
1308                         err = -EINVAL;
1309                         break;
1310                 }
1311
1312                 sec.level = BT_SECURITY_LOW;
1313
1314                 len = min_t(unsigned int, sizeof(sec), optlen);
1315                 if (copy_from_user((char *) &sec, optval, len)) {
1316                         err = -EFAULT;
1317                         break;
1318                 }
1319
1320                 if (sec.level < BT_SECURITY_LOW ||
1321                                         sec.level > BT_SECURITY_HIGH) {
1322                         err = -EINVAL;
1323                         break;
1324                 }
1325
1326                 l2cap_pi(sk)->sec_level = sec.level;
1327                 break;
1328
1329         case BT_DEFER_SETUP:
1330                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1331                         err = -EINVAL;
1332                         break;
1333                 }
1334
1335                 if (get_user(opt, (u32 __user *) optval)) {
1336                         err = -EFAULT;
1337                         break;
1338                 }
1339
1340                 bt_sk(sk)->defer_setup = opt;
1341                 break;
1342
1343         default:
1344                 err = -ENOPROTOOPT;
1345                 break;
1346         }
1347
1348         release_sock(sk);
1349         return err;
1350 }
1351
1352 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1353 {
1354         struct sock *sk = sock->sk;
1355         struct l2cap_options opts;
1356         struct l2cap_conninfo cinfo;
1357         int len, err = 0;
1358         u32 opt;
1359
1360         BT_DBG("sk %p", sk);
1361
1362         if (get_user(len, optlen))
1363                 return -EFAULT;
1364
1365         lock_sock(sk);
1366
1367         switch (optname) {
1368         case L2CAP_OPTIONS:
1369                 opts.imtu     = l2cap_pi(sk)->imtu;
1370                 opts.omtu     = l2cap_pi(sk)->omtu;
1371                 opts.flush_to = l2cap_pi(sk)->flush_to;
1372                 opts.mode     = L2CAP_MODE_BASIC;
1373
1374                 len = min_t(unsigned int, len, sizeof(opts));
1375                 if (copy_to_user(optval, (char *) &opts, len))
1376                         err = -EFAULT;
1377
1378                 break;
1379
1380         case L2CAP_LM:
1381                 switch (l2cap_pi(sk)->sec_level) {
1382                 case BT_SECURITY_LOW:
1383                         opt = L2CAP_LM_AUTH;
1384                         break;
1385                 case BT_SECURITY_MEDIUM:
1386                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
1387                         break;
1388                 case BT_SECURITY_HIGH:
1389                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
1390                                                         L2CAP_LM_SECURE;
1391                         break;
1392                 default:
1393                         opt = 0;
1394                         break;
1395                 }
1396
1397                 if (l2cap_pi(sk)->role_switch)
1398                         opt |= L2CAP_LM_MASTER;
1399
1400                 if (l2cap_pi(sk)->force_reliable)
1401                         opt |= L2CAP_LM_RELIABLE;
1402
1403                 if (put_user(opt, (u32 __user *) optval))
1404                         err = -EFAULT;
1405                 break;
1406
1407         case L2CAP_CONNINFO:
1408                 if (sk->sk_state != BT_CONNECTED &&
1409                                         !(sk->sk_state == BT_CONNECT2 &&
1410                                                 bt_sk(sk)->defer_setup)) {
1411                         err = -ENOTCONN;
1412                         break;
1413                 }
1414
1415                 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
1416                 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
1417
1418                 len = min_t(unsigned int, len, sizeof(cinfo));
1419                 if (copy_to_user(optval, (char *) &cinfo, len))
1420                         err = -EFAULT;
1421
1422                 break;
1423
1424         default:
1425                 err = -ENOPROTOOPT;
1426                 break;
1427         }
1428
1429         release_sock(sk);
1430         return err;
1431 }
1432
1433 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
1434 {
1435         struct sock *sk = sock->sk;
1436         struct bt_security sec;
1437         int len, err = 0;
1438
1439         BT_DBG("sk %p", sk);
1440
1441         if (level == SOL_L2CAP)
1442                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
1443
1444         if (level != SOL_BLUETOOTH)
1445                 return -ENOPROTOOPT;
1446
1447         if (get_user(len, optlen))
1448                 return -EFAULT;
1449
1450         lock_sock(sk);
1451
1452         switch (optname) {
1453         case BT_SECURITY:
1454                 if (sk->sk_type != SOCK_SEQPACKET) {
1455                         err = -EINVAL;
1456                         break;
1457                 }
1458
1459                 sec.level = l2cap_pi(sk)->sec_level;
1460
1461                 len = min_t(unsigned int, len, sizeof(sec));
1462                 if (copy_to_user(optval, (char *) &sec, len))
1463                         err = -EFAULT;
1464
1465                 break;
1466
1467         case BT_DEFER_SETUP:
1468                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1469                         err = -EINVAL;
1470                         break;
1471                 }
1472
1473                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
1474                         err = -EFAULT;
1475
1476                 break;
1477
1478         default:
1479                 err = -ENOPROTOOPT;
1480                 break;
1481         }
1482
1483         release_sock(sk);
1484         return err;
1485 }
1486
1487 static int l2cap_sock_shutdown(struct socket *sock, int how)
1488 {
1489         struct sock *sk = sock->sk;
1490         int err = 0;
1491
1492         BT_DBG("sock %p, sk %p", sock, sk);
1493
1494         if (!sk)
1495                 return 0;
1496
1497         lock_sock(sk);
1498         if (!sk->sk_shutdown) {
1499                 sk->sk_shutdown = SHUTDOWN_MASK;
1500                 l2cap_sock_clear_timer(sk);
1501                 __l2cap_sock_close(sk, 0);
1502
1503                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1504                         err = bt_sock_wait_state(sk, BT_CLOSED,
1505                                                         sk->sk_lingertime);
1506         }
1507         release_sock(sk);
1508         return err;
1509 }
1510
1511 static int l2cap_sock_release(struct socket *sock)
1512 {
1513         struct sock *sk = sock->sk;
1514         int err;
1515
1516         BT_DBG("sock %p, sk %p", sock, sk);
1517
1518         if (!sk)
1519                 return 0;
1520
1521         err = l2cap_sock_shutdown(sock, 2);
1522
1523         sock_orphan(sk);
1524         l2cap_sock_kill(sk);
1525         return err;
1526 }
1527
1528 static void l2cap_chan_ready(struct sock *sk)
1529 {
1530         struct sock *parent = bt_sk(sk)->parent;
1531
1532         BT_DBG("sk %p, parent %p", sk, parent);
1533
1534         l2cap_pi(sk)->conf_state = 0;
1535         l2cap_sock_clear_timer(sk);
1536
1537         if (!parent) {
1538                 /* Outgoing channel.
1539                  * Wake up socket sleeping on connect.
1540                  */
1541                 sk->sk_state = BT_CONNECTED;
1542                 sk->sk_state_change(sk);
1543         } else {
1544                 /* Incoming channel.
1545                  * Wake up socket sleeping on accept.
1546                  */
1547                 parent->sk_data_ready(parent, 0);
1548         }
1549 }
1550
1551 /* Copy frame to all raw sockets on that connection */
1552 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1553 {
1554         struct l2cap_chan_list *l = &conn->chan_list;
1555         struct sk_buff *nskb;
1556         struct sock * sk;
1557
1558         BT_DBG("conn %p", conn);
1559
1560         read_lock(&l->lock);
1561         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
1562                 if (sk->sk_type != SOCK_RAW)
1563                         continue;
1564
1565                 /* Don't send frame to the socket it came from */
1566                 if (skb->sk == sk)
1567                         continue;
1568
1569                 if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
1570                         continue;
1571
1572                 if (sock_queue_rcv_skb(sk, nskb))
1573                         kfree_skb(nskb);
1574         }
1575         read_unlock(&l->lock);
1576 }
1577
1578 /* ---- L2CAP signalling commands ---- */
1579 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1580                                 u8 code, u8 ident, u16 dlen, void *data)
1581 {
1582         struct sk_buff *skb, **frag;
1583         struct l2cap_cmd_hdr *cmd;
1584         struct l2cap_hdr *lh;
1585         int len, count;
1586
1587         BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", conn, code, ident, dlen);
1588
1589         len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1590         count = min_t(unsigned int, conn->mtu, len);
1591
1592         skb = bt_skb_alloc(count, GFP_ATOMIC);
1593         if (!skb)
1594                 return NULL;
1595
1596         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1597         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
1598         lh->cid = cpu_to_le16(0x0001);
1599
1600         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1601         cmd->code  = code;
1602         cmd->ident = ident;
1603         cmd->len   = cpu_to_le16(dlen);
1604
1605         if (dlen) {
1606                 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1607                 memcpy(skb_put(skb, count), data, count);
1608                 data += count;
1609         }
1610
1611         len -= skb->len;
1612
1613         /* Continuation fragments (no L2CAP header) */
1614         frag = &skb_shinfo(skb)->frag_list;
1615         while (len) {
1616                 count = min_t(unsigned int, conn->mtu, len);
1617
1618                 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1619                 if (!*frag)
1620                         goto fail;
1621
1622                 memcpy(skb_put(*frag, count), data, count);
1623
1624                 len  -= count;
1625                 data += count;
1626
1627                 frag = &(*frag)->next;
1628         }
1629
1630         return skb;
1631
1632 fail:
1633         kfree_skb(skb);
1634         return NULL;
1635 }
1636
1637 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1638 {
1639         struct l2cap_conf_opt *opt = *ptr;
1640         int len;
1641
1642         len = L2CAP_CONF_OPT_SIZE + opt->len;
1643         *ptr += len;
1644
1645         *type = opt->type;
1646         *olen = opt->len;
1647
1648         switch (opt->len) {
1649         case 1:
1650                 *val = *((u8 *) opt->val);
1651                 break;
1652
1653         case 2:
1654                 *val = __le16_to_cpu(*((__le16 *) opt->val));
1655                 break;
1656
1657         case 4:
1658                 *val = __le32_to_cpu(*((__le32 *) opt->val));
1659                 break;
1660
1661         default:
1662                 *val = (unsigned long) opt->val;
1663                 break;
1664         }
1665
1666         BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1667         return len;
1668 }
1669
1670 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1671 {
1672         struct l2cap_conf_opt *opt = *ptr;
1673
1674         BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1675
1676         opt->type = type;
1677         opt->len  = len;
1678
1679         switch (len) {
1680         case 1:
1681                 *((u8 *) opt->val)  = val;
1682                 break;
1683
1684         case 2:
1685                 *((__le16 *) opt->val) = cpu_to_le16(val);
1686                 break;
1687
1688         case 4:
1689                 *((__le32 *) opt->val) = cpu_to_le32(val);
1690                 break;
1691
1692         default:
1693                 memcpy(opt->val, (void *) val, len);
1694                 break;
1695         }
1696
1697         *ptr += L2CAP_CONF_OPT_SIZE + len;
1698 }
1699
1700 static int l2cap_build_conf_req(struct sock *sk, void *data)
1701 {
1702         struct l2cap_pinfo *pi = l2cap_pi(sk);
1703         struct l2cap_conf_req *req = data;
1704         void *ptr = req->data;
1705
1706         BT_DBG("sk %p", sk);
1707
1708         if (pi->imtu != L2CAP_DEFAULT_MTU)
1709                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
1710
1711         /* FIXME: Need actual value of the flush timeout */
1712         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
1713         //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
1714
1715         req->dcid  = cpu_to_le16(pi->dcid);
1716         req->flags = cpu_to_le16(0);
1717
1718         return ptr - data;
1719 }
1720
1721 static int l2cap_parse_conf_req(struct sock *sk, void *data)
1722 {
1723         struct l2cap_pinfo *pi = l2cap_pi(sk);
1724         struct l2cap_conf_rsp *rsp = data;
1725         void *ptr = rsp->data;
1726         void *req = pi->conf_req;
1727         int len = pi->conf_len;
1728         int type, hint, olen;
1729         unsigned long val;
1730         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
1731         u16 mtu = L2CAP_DEFAULT_MTU;
1732         u16 result = L2CAP_CONF_SUCCESS;
1733
1734         BT_DBG("sk %p", sk);
1735
1736         while (len >= L2CAP_CONF_OPT_SIZE) {
1737                 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1738
1739                 hint  = type & 0x80;
1740                 type &= 0x7f;
1741
1742                 switch (type) {
1743                 case L2CAP_CONF_MTU:
1744                         mtu = val;
1745                         break;
1746
1747                 case L2CAP_CONF_FLUSH_TO:
1748                         pi->flush_to = val;
1749                         break;
1750
1751                 case L2CAP_CONF_QOS:
1752                         break;
1753
1754                 case L2CAP_CONF_RFC:
1755                         if (olen == sizeof(rfc))
1756                                 memcpy(&rfc, (void *) val, olen);
1757                         break;
1758
1759                 default:
1760                         if (hint)
1761                                 break;
1762
1763                         result = L2CAP_CONF_UNKNOWN;
1764                         *((u8 *) ptr++) = type;
1765                         break;
1766                 }
1767         }
1768
1769         if (result == L2CAP_CONF_SUCCESS) {
1770                 /* Configure output options and let the other side know
1771                  * which ones we don't like. */
1772
1773                 if (rfc.mode == L2CAP_MODE_BASIC) {
1774                         if (mtu < pi->omtu)
1775                                 result = L2CAP_CONF_UNACCEPT;
1776                         else {
1777                                 pi->omtu = mtu;
1778                                 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
1779                         }
1780
1781                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
1782                 } else {
1783                         result = L2CAP_CONF_UNACCEPT;
1784
1785                         memset(&rfc, 0, sizeof(rfc));
1786                         rfc.mode = L2CAP_MODE_BASIC;
1787
1788                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1789                                                 sizeof(rfc), (unsigned long) &rfc);
1790                 }
1791         }
1792
1793         rsp->scid   = cpu_to_le16(pi->dcid);
1794         rsp->result = cpu_to_le16(result);
1795         rsp->flags  = cpu_to_le16(0x0000);
1796
1797         return ptr - data;
1798 }
1799
1800 static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1801 {
1802         struct l2cap_conf_rsp *rsp = data;
1803         void *ptr = rsp->data;
1804
1805         BT_DBG("sk %p", sk);
1806
1807         rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1808         rsp->result = cpu_to_le16(result);
1809         rsp->flags  = cpu_to_le16(flags);
1810
1811         return ptr - data;
1812 }
1813
1814 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1815 {
1816         struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
1817
1818         if (rej->reason != 0x0000)
1819                 return 0;
1820
1821         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
1822                                         cmd->ident == conn->info_ident) {
1823                 del_timer(&conn->info_timer);
1824
1825                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1826                 conn->info_ident = 0;
1827
1828                 l2cap_conn_start(conn);
1829         }
1830
1831         return 0;
1832 }
1833
1834 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1835 {
1836         struct l2cap_chan_list *list = &conn->chan_list;
1837         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
1838         struct l2cap_conn_rsp rsp;
1839         struct sock *sk, *parent;
1840         int result, status = L2CAP_CS_NO_INFO;
1841
1842         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
1843         __le16 psm = req->psm;
1844
1845         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
1846
1847         /* Check if we have socket listening on psm */
1848         parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
1849         if (!parent) {
1850                 result = L2CAP_CR_BAD_PSM;
1851                 goto sendresp;
1852         }
1853
1854         /* Check if the ACL is secure enough (if not SDP) */
1855         if (psm != cpu_to_le16(0x0001) &&
1856                                 !hci_conn_check_link_mode(conn->hcon)) {
1857                 conn->disc_reason = 0x05;
1858                 result = L2CAP_CR_SEC_BLOCK;
1859                 goto response;
1860         }
1861
1862         result = L2CAP_CR_NO_MEM;
1863
1864         /* Check for backlog size */
1865         if (sk_acceptq_is_full(parent)) {
1866                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1867                 goto response;
1868         }
1869
1870         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1871         if (!sk)
1872                 goto response;
1873
1874         write_lock_bh(&list->lock);
1875
1876         /* Check if we already have channel with that dcid */
1877         if (__l2cap_get_chan_by_dcid(list, scid)) {
1878                 write_unlock_bh(&list->lock);
1879                 sock_set_flag(sk, SOCK_ZAPPED);
1880                 l2cap_sock_kill(sk);
1881                 goto response;
1882         }
1883
1884         hci_conn_hold(conn->hcon);
1885
1886         l2cap_sock_init(sk, parent);
1887         bacpy(&bt_sk(sk)->src, conn->src);
1888         bacpy(&bt_sk(sk)->dst, conn->dst);
1889         l2cap_pi(sk)->psm  = psm;
1890         l2cap_pi(sk)->dcid = scid;
1891
1892         __l2cap_chan_add(conn, sk, parent);
1893         dcid = l2cap_pi(sk)->scid;
1894
1895         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1896
1897         l2cap_pi(sk)->ident = cmd->ident;
1898
1899         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
1900                 if (l2cap_check_security(sk)) {
1901                         if (bt_sk(sk)->defer_setup) {
1902                                 sk->sk_state = BT_CONNECT2;
1903                                 result = L2CAP_CR_PEND;
1904                                 status = L2CAP_CS_AUTHOR_PEND;
1905                                 parent->sk_data_ready(parent, 0);
1906                         } else {
1907                                 sk->sk_state = BT_CONFIG;
1908                                 result = L2CAP_CR_SUCCESS;
1909                                 status = L2CAP_CS_NO_INFO;
1910                         }
1911                 } else {
1912                         sk->sk_state = BT_CONNECT2;
1913                         result = L2CAP_CR_PEND;
1914                         status = L2CAP_CS_AUTHEN_PEND;
1915                 }
1916         } else {
1917                 sk->sk_state = BT_CONNECT2;
1918                 result = L2CAP_CR_PEND;
1919                 status = L2CAP_CS_NO_INFO;
1920         }
1921
1922         write_unlock_bh(&list->lock);
1923
1924 response:
1925         bh_unlock_sock(parent);
1926
1927 sendresp:
1928         rsp.scid   = cpu_to_le16(scid);
1929         rsp.dcid   = cpu_to_le16(dcid);
1930         rsp.result = cpu_to_le16(result);
1931         rsp.status = cpu_to_le16(status);
1932         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1933
1934         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
1935                 struct l2cap_info_req info;
1936                 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1937
1938                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1939                 conn->info_ident = l2cap_get_ident(conn);
1940
1941                 mod_timer(&conn->info_timer, jiffies +
1942                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
1943
1944                 l2cap_send_cmd(conn, conn->info_ident,
1945                                         L2CAP_INFO_REQ, sizeof(info), &info);
1946         }
1947
1948         return 0;
1949 }
1950
1951 static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1952 {
1953         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
1954         u16 scid, dcid, result, status;
1955         struct sock *sk;
1956         u8 req[128];
1957
1958         scid   = __le16_to_cpu(rsp->scid);
1959         dcid   = __le16_to_cpu(rsp->dcid);
1960         result = __le16_to_cpu(rsp->result);
1961         status = __le16_to_cpu(rsp->status);
1962
1963         BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
1964
1965         if (scid) {
1966                 if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
1967                         return 0;
1968         } else {
1969                 if (!(sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident)))
1970                         return 0;
1971         }
1972
1973         switch (result) {
1974         case L2CAP_CR_SUCCESS:
1975                 sk->sk_state = BT_CONFIG;
1976                 l2cap_pi(sk)->ident = 0;
1977                 l2cap_pi(sk)->dcid = dcid;
1978                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1979
1980                 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
1981
1982                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1983                                         l2cap_build_conf_req(sk, req), req);
1984                 break;
1985
1986         case L2CAP_CR_PEND:
1987                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1988                 break;
1989
1990         default:
1991                 l2cap_chan_del(sk, ECONNREFUSED);
1992                 break;
1993         }
1994
1995         bh_unlock_sock(sk);
1996         return 0;
1997 }
1998
1999 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
2000 {
2001         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2002         u16 dcid, flags;
2003         u8 rsp[64];
2004         struct sock *sk;
2005         int len;
2006
2007         dcid  = __le16_to_cpu(req->dcid);
2008         flags = __le16_to_cpu(req->flags);
2009
2010         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2011
2012         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
2013                 return -ENOENT;
2014
2015         if (sk->sk_state == BT_DISCONN)
2016                 goto unlock;
2017
2018         /* Reject if config buffer is too small. */
2019         len = cmd_len - sizeof(*req);
2020         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
2021                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2022                                 l2cap_build_conf_rsp(sk, rsp,
2023                                         L2CAP_CONF_REJECT, flags), rsp);
2024                 goto unlock;
2025         }
2026
2027         /* Store config. */
2028         memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
2029         l2cap_pi(sk)->conf_len += len;
2030
2031         if (flags & 0x0001) {
2032                 /* Incomplete config. Send empty response. */
2033                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2034                                 l2cap_build_conf_rsp(sk, rsp,
2035                                         L2CAP_CONF_SUCCESS, 0x0001), rsp);
2036                 goto unlock;
2037         }
2038
2039         /* Complete config. */
2040         len = l2cap_parse_conf_req(sk, rsp);
2041         if (len < 0)
2042                 goto unlock;
2043
2044         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
2045
2046         /* Reset config buffer. */
2047         l2cap_pi(sk)->conf_len = 0;
2048
2049         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
2050                 goto unlock;
2051
2052         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
2053                 sk->sk_state = BT_CONNECTED;
2054                 l2cap_chan_ready(sk);
2055                 goto unlock;
2056         }
2057
2058         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
2059                 u8 buf[64];
2060                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2061                                         l2cap_build_conf_req(sk, buf), buf);
2062         }
2063
2064 unlock:
2065         bh_unlock_sock(sk);
2066         return 0;
2067 }
2068
2069 static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2070 {
2071         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2072         u16 scid, flags, result;
2073         struct sock *sk;
2074
2075         scid   = __le16_to_cpu(rsp->scid);
2076         flags  = __le16_to_cpu(rsp->flags);
2077         result = __le16_to_cpu(rsp->result);
2078
2079         BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", scid, flags, result);
2080
2081         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
2082                 return 0;
2083
2084         switch (result) {
2085         case L2CAP_CONF_SUCCESS:
2086                 break;
2087
2088         case L2CAP_CONF_UNACCEPT:
2089                 if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
2090                         char req[128];
2091                         /* It does not make sense to adjust L2CAP parameters
2092                          * that are currently defined in the spec. We simply
2093                          * resend config request that we sent earlier. It is
2094                          * stupid, but it helps qualification testing which
2095                          * expects at least some response from us. */
2096                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2097                                                 l2cap_build_conf_req(sk, req), req);
2098                         goto done;
2099                 }
2100
2101         default:
2102                 sk->sk_state = BT_DISCONN;
2103                 sk->sk_err = ECONNRESET;
2104                 l2cap_sock_set_timer(sk, HZ * 5);
2105                 {
2106                         struct l2cap_disconn_req req;
2107                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
2108                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2109                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
2110                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
2111                 }
2112                 goto done;
2113         }
2114
2115         if (flags & 0x01)
2116                 goto done;
2117
2118         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
2119
2120         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
2121                 sk->sk_state = BT_CONNECTED;
2122                 l2cap_chan_ready(sk);
2123         }
2124
2125 done:
2126         bh_unlock_sock(sk);
2127         return 0;
2128 }
2129
2130 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2131 {
2132         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2133         struct l2cap_disconn_rsp rsp;
2134         u16 dcid, scid;
2135         struct sock *sk;
2136
2137         scid = __le16_to_cpu(req->scid);
2138         dcid = __le16_to_cpu(req->dcid);
2139
2140         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2141
2142         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
2143                 return 0;
2144
2145         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
2146         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
2147         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
2148
2149         sk->sk_shutdown = SHUTDOWN_MASK;
2150
2151         l2cap_chan_del(sk, ECONNRESET);
2152         bh_unlock_sock(sk);
2153
2154         l2cap_sock_kill(sk);
2155         return 0;
2156 }
2157
2158 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2159 {
2160         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
2161         u16 dcid, scid;
2162         struct sock *sk;
2163
2164         scid = __le16_to_cpu(rsp->scid);
2165         dcid = __le16_to_cpu(rsp->dcid);
2166
2167         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
2168
2169         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
2170                 return 0;
2171
2172         l2cap_chan_del(sk, 0);
2173         bh_unlock_sock(sk);
2174
2175         l2cap_sock_kill(sk);
2176         return 0;
2177 }
2178
2179 static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2180 {
2181         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
2182         u16 type;
2183
2184         type = __le16_to_cpu(req->type);
2185
2186         BT_DBG("type 0x%4.4x", type);
2187
2188         if (type == L2CAP_IT_FEAT_MASK) {
2189                 u8 buf[8];
2190                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2191                 rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2192                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2193                 put_unaligned(cpu_to_le32(l2cap_feat_mask), (__le32 *) rsp->data);
2194                 l2cap_send_cmd(conn, cmd->ident,
2195                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2196         } else if (type == L2CAP_IT_FIXED_CHAN) {
2197                 u8 buf[12];
2198                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2199                 rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2200                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2201                 memcpy(buf + 4, l2cap_fixed_chan, 8);
2202                 l2cap_send_cmd(conn, cmd->ident,
2203                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2204         } else {
2205                 struct l2cap_info_rsp rsp;
2206                 rsp.type   = cpu_to_le16(type);
2207                 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2208                 l2cap_send_cmd(conn, cmd->ident,
2209                                         L2CAP_INFO_RSP, sizeof(rsp), &rsp);
2210         }
2211
2212         return 0;
2213 }
2214
2215 static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2216 {
2217         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
2218         u16 type, result;
2219
2220         type   = __le16_to_cpu(rsp->type);
2221         result = __le16_to_cpu(rsp->result);
2222
2223         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
2224
2225         del_timer(&conn->info_timer);
2226
2227         if (type == L2CAP_IT_FEAT_MASK) {
2228                 conn->feat_mask = get_unaligned_le32(rsp->data);
2229
2230                 if (conn->feat_mask & 0x0080) {
2231                         struct l2cap_info_req req;
2232                         req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2233
2234                         conn->info_ident = l2cap_get_ident(conn);
2235
2236                         l2cap_send_cmd(conn, conn->info_ident,
2237                                         L2CAP_INFO_REQ, sizeof(req), &req);
2238                 } else {
2239                         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2240                         conn->info_ident = 0;
2241
2242                         l2cap_conn_start(conn);
2243                 }
2244         } else if (type == L2CAP_IT_FIXED_CHAN) {
2245                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2246                 conn->info_ident = 0;
2247
2248                 l2cap_conn_start(conn);
2249         }
2250
2251         return 0;
2252 }
2253
2254 static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
2255 {
2256         u8 *data = skb->data;
2257         int len = skb->len;
2258         struct l2cap_cmd_hdr cmd;
2259         int err = 0;
2260
2261         l2cap_raw_recv(conn, skb);
2262
2263         while (len >= L2CAP_CMD_HDR_SIZE) {
2264                 u16 cmd_len;
2265                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
2266                 data += L2CAP_CMD_HDR_SIZE;
2267                 len  -= L2CAP_CMD_HDR_SIZE;
2268
2269                 cmd_len = le16_to_cpu(cmd.len);
2270
2271                 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
2272
2273                 if (cmd_len > len || !cmd.ident) {
2274                         BT_DBG("corrupted command");
2275                         break;
2276                 }
2277
2278                 switch (cmd.code) {
2279                 case L2CAP_COMMAND_REJ:
2280                         l2cap_command_rej(conn, &cmd, data);
2281                         break;
2282
2283                 case L2CAP_CONN_REQ:
2284                         err = l2cap_connect_req(conn, &cmd, data);
2285                         break;
2286
2287                 case L2CAP_CONN_RSP:
2288                         err = l2cap_connect_rsp(conn, &cmd, data);
2289                         break;
2290
2291                 case L2CAP_CONF_REQ:
2292                         err = l2cap_config_req(conn, &cmd, cmd_len, data);
2293                         break;
2294
2295                 case L2CAP_CONF_RSP:
2296                         err = l2cap_config_rsp(conn, &cmd, data);
2297                         break;
2298
2299                 case L2CAP_DISCONN_REQ:
2300                         err = l2cap_disconnect_req(conn, &cmd, data);
2301                         break;
2302
2303                 case L2CAP_DISCONN_RSP:
2304                         err = l2cap_disconnect_rsp(conn, &cmd, data);
2305                         break;
2306
2307                 case L2CAP_ECHO_REQ:
2308                         l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
2309                         break;
2310
2311                 case L2CAP_ECHO_RSP:
2312                         break;
2313
2314                 case L2CAP_INFO_REQ:
2315                         err = l2cap_information_req(conn, &cmd, data);
2316                         break;
2317
2318                 case L2CAP_INFO_RSP:
2319                         err = l2cap_information_rsp(conn, &cmd, data);
2320                         break;
2321
2322                 default:
2323                         BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
2324                         err = -EINVAL;
2325                         break;
2326                 }
2327
2328                 if (err) {
2329                         struct l2cap_cmd_rej rej;
2330                         BT_DBG("error %d", err);
2331
2332                         /* FIXME: Map err to a valid reason */
2333                         rej.reason = cpu_to_le16(0);
2334                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
2335                 }
2336
2337                 data += cmd_len;
2338                 len  -= cmd_len;
2339         }
2340
2341         kfree_skb(skb);
2342 }
2343
2344 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
2345 {
2346         struct sock *sk;
2347
2348         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
2349         if (!sk) {
2350                 BT_DBG("unknown cid 0x%4.4x", cid);
2351                 goto drop;
2352         }
2353
2354         BT_DBG("sk %p, len %d", sk, skb->len);
2355
2356         if (sk->sk_state != BT_CONNECTED)
2357                 goto drop;
2358
2359         if (l2cap_pi(sk)->imtu < skb->len)
2360                 goto drop;
2361
2362         /* If socket recv buffers overflows we drop data here
2363          * which is *bad* because L2CAP has to be reliable.
2364          * But we don't have any other choice. L2CAP doesn't
2365          * provide flow control mechanism. */
2366
2367         if (!sock_queue_rcv_skb(sk, skb))
2368                 goto done;
2369
2370 drop:
2371         kfree_skb(skb);
2372
2373 done:
2374         if (sk)
2375                 bh_unlock_sock(sk);
2376
2377         return 0;
2378 }
2379
2380 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
2381 {
2382         struct sock *sk;
2383
2384         sk = l2cap_get_sock_by_psm(0, psm, conn->src);
2385         if (!sk)
2386                 goto drop;
2387
2388         BT_DBG("sk %p, len %d", sk, skb->len);
2389
2390         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
2391                 goto drop;
2392
2393         if (l2cap_pi(sk)->imtu < skb->len)
2394                 goto drop;
2395
2396         if (!sock_queue_rcv_skb(sk, skb))
2397                 goto done;
2398
2399 drop:
2400         kfree_skb(skb);
2401
2402 done:
2403         if (sk) bh_unlock_sock(sk);
2404         return 0;
2405 }
2406
2407 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
2408 {
2409         struct l2cap_hdr *lh = (void *) skb->data;
2410         u16 cid, len;
2411         __le16 psm;
2412
2413         skb_pull(skb, L2CAP_HDR_SIZE);
2414         cid = __le16_to_cpu(lh->cid);
2415         len = __le16_to_cpu(lh->len);
2416
2417         BT_DBG("len %d, cid 0x%4.4x", len, cid);
2418
2419         switch (cid) {
2420         case 0x0001:
2421                 l2cap_sig_channel(conn, skb);
2422                 break;
2423
2424         case 0x0002:
2425                 psm = get_unaligned((__le16 *) skb->data);
2426                 skb_pull(skb, 2);
2427                 l2cap_conless_channel(conn, psm, skb);
2428                 break;
2429
2430         default:
2431                 l2cap_data_channel(conn, cid, skb);
2432                 break;
2433         }
2434 }
2435
2436 /* ---- L2CAP interface with lower layer (HCI) ---- */
2437
2438 static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2439 {
2440         int exact = 0, lm1 = 0, lm2 = 0;
2441         register struct sock *sk;
2442         struct hlist_node *node;
2443
2444         if (type != ACL_LINK)
2445                 return 0;
2446
2447         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
2448
2449         /* Find listening sockets and check their link_mode */
2450         read_lock(&l2cap_sk_list.lock);
2451         sk_for_each(sk, node, &l2cap_sk_list.head) {
2452                 if (sk->sk_state != BT_LISTEN)
2453                         continue;
2454
2455                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2456                         lm1 |= HCI_LM_ACCEPT;
2457                         if (l2cap_pi(sk)->role_switch)
2458                                 lm1 |= HCI_LM_MASTER;
2459                         exact++;
2460                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
2461                         lm2 |= HCI_LM_ACCEPT;
2462                         if (l2cap_pi(sk)->role_switch)
2463                                 lm2 |= HCI_LM_MASTER;
2464                 }
2465         }
2466         read_unlock(&l2cap_sk_list.lock);
2467
2468         return exact ? lm1 : lm2;
2469 }
2470
2471 static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
2472 {
2473         struct l2cap_conn *conn;
2474
2475         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
2476
2477         if (hcon->type != ACL_LINK)
2478                 return 0;
2479
2480         if (!status) {
2481                 conn = l2cap_conn_add(hcon, status);
2482                 if (conn)
2483                         l2cap_conn_ready(conn);
2484         } else
2485                 l2cap_conn_del(hcon, bt_err(status));
2486
2487         return 0;
2488 }
2489
2490 static int l2cap_disconn_ind(struct hci_conn *hcon)
2491 {
2492         struct l2cap_conn *conn = hcon->l2cap_data;
2493
2494         BT_DBG("hcon %p", hcon);
2495
2496         if (hcon->type != ACL_LINK || !conn)
2497                 return 0x13;
2498
2499         return conn->disc_reason;
2500 }
2501
2502 static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
2503 {
2504         BT_DBG("hcon %p reason %d", hcon, reason);
2505
2506         if (hcon->type != ACL_LINK)
2507                 return 0;
2508
2509         l2cap_conn_del(hcon, bt_err(reason));
2510
2511         return 0;
2512 }
2513
2514 static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
2515 {
2516         if (sk->sk_type != SOCK_SEQPACKET)
2517                 return;
2518
2519         if (encrypt == 0x00) {
2520                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
2521                         l2cap_sock_clear_timer(sk);
2522                         l2cap_sock_set_timer(sk, HZ * 5);
2523                 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
2524                         __l2cap_sock_close(sk, ECONNREFUSED);
2525         } else {
2526                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
2527                         l2cap_sock_clear_timer(sk);
2528         }
2529 }
2530
2531 static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
2532 {
2533         struct l2cap_chan_list *l;
2534         struct l2cap_conn *conn = hcon->l2cap_data;
2535         struct sock *sk;
2536
2537         if (!conn)
2538                 return 0;
2539
2540         l = &conn->chan_list;
2541
2542         BT_DBG("conn %p", conn);
2543
2544         read_lock(&l->lock);
2545
2546         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2547                 bh_lock_sock(sk);
2548
2549                 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
2550                         bh_unlock_sock(sk);
2551                         continue;
2552                 }
2553
2554                 if (!status && (sk->sk_state == BT_CONNECTED ||
2555                                                 sk->sk_state == BT_CONFIG)) {
2556                         l2cap_check_encryption(sk, encrypt);
2557                         bh_unlock_sock(sk);
2558                         continue;
2559                 }
2560
2561                 if (sk->sk_state == BT_CONNECT) {
2562                         if (!status) {
2563                                 struct l2cap_conn_req req;
2564                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2565                                 req.psm  = l2cap_pi(sk)->psm;
2566
2567                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
2568
2569                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2570                                         L2CAP_CONN_REQ, sizeof(req), &req);
2571                         } else {
2572                                 l2cap_sock_clear_timer(sk);
2573                                 l2cap_sock_set_timer(sk, HZ / 10);
2574                         }
2575                 } else if (sk->sk_state == BT_CONNECT2) {
2576                         struct l2cap_conn_rsp rsp;
2577                         __u16 result;
2578
2579                         if (!status) {
2580                                 sk->sk_state = BT_CONFIG;
2581                                 result = L2CAP_CR_SUCCESS;
2582                         } else {
2583                                 sk->sk_state = BT_DISCONN;
2584                                 l2cap_sock_set_timer(sk, HZ / 10);
2585                                 result = L2CAP_CR_SEC_BLOCK;
2586                         }
2587
2588                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
2589                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
2590                         rsp.result = cpu_to_le16(result);
2591                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2592                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2593                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2594                 }
2595
2596                 bh_unlock_sock(sk);
2597         }
2598
2599         read_unlock(&l->lock);
2600
2601         return 0;
2602 }
2603
2604 static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
2605 {
2606         struct l2cap_conn *conn = hcon->l2cap_data;
2607
2608         if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
2609                 goto drop;
2610
2611         BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
2612
2613         if (flags & ACL_START) {
2614                 struct l2cap_hdr *hdr;
2615                 int len;
2616
2617                 if (conn->rx_len) {
2618                         BT_ERR("Unexpected start frame (len %d)", skb->len);
2619                         kfree_skb(conn->rx_skb);
2620                         conn->rx_skb = NULL;
2621                         conn->rx_len = 0;
2622                         l2cap_conn_unreliable(conn, ECOMM);
2623                 }
2624
2625                 if (skb->len < 2) {
2626                         BT_ERR("Frame is too short (len %d)", skb->len);
2627                         l2cap_conn_unreliable(conn, ECOMM);
2628                         goto drop;
2629                 }
2630
2631                 hdr = (struct l2cap_hdr *) skb->data;
2632                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
2633
2634                 if (len == skb->len) {
2635                         /* Complete frame received */
2636                         l2cap_recv_frame(conn, skb);
2637                         return 0;
2638                 }
2639
2640                 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
2641
2642                 if (skb->len > len) {
2643                         BT_ERR("Frame is too long (len %d, expected len %d)",
2644                                 skb->len, len);
2645                         l2cap_conn_unreliable(conn, ECOMM);
2646                         goto drop;
2647                 }
2648
2649                 /* Allocate skb for the complete frame (with header) */
2650                 if (!(conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC)))
2651                         goto drop;
2652
2653                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2654                                                                 skb->len);
2655                 conn->rx_len = len - skb->len;
2656         } else {
2657                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
2658
2659                 if (!conn->rx_len) {
2660                         BT_ERR("Unexpected continuation frame (len %d)", skb->len);
2661                         l2cap_conn_unreliable(conn, ECOMM);
2662                         goto drop;
2663                 }
2664
2665                 if (skb->len > conn->rx_len) {
2666                         BT_ERR("Fragment is too long (len %d, expected %d)",
2667                                         skb->len, conn->rx_len);
2668                         kfree_skb(conn->rx_skb);
2669                         conn->rx_skb = NULL;
2670                         conn->rx_len = 0;
2671                         l2cap_conn_unreliable(conn, ECOMM);
2672                         goto drop;
2673                 }
2674
2675                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2676                                                                 skb->len);
2677                 conn->rx_len -= skb->len;
2678
2679                 if (!conn->rx_len) {
2680                         /* Complete frame received */
2681                         l2cap_recv_frame(conn, conn->rx_skb);
2682                         conn->rx_skb = NULL;
2683                 }
2684         }
2685
2686 drop:
2687         kfree_skb(skb);
2688         return 0;
2689 }
2690
2691 static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
2692 {
2693         struct sock *sk;
2694         struct hlist_node *node;
2695         char *str = buf;
2696
2697         read_lock_bh(&l2cap_sk_list.lock);
2698
2699         sk_for_each(sk, node, &l2cap_sk_list.head) {
2700                 struct l2cap_pinfo *pi = l2cap_pi(sk);
2701
2702                 str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
2703                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2704                                 sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
2705                                 pi->imtu, pi->omtu, pi->sec_level);
2706         }
2707
2708         read_unlock_bh(&l2cap_sk_list.lock);
2709
2710         return (str - buf);
2711 }
2712
2713 static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
2714
2715 static const struct proto_ops l2cap_sock_ops = {
2716         .family         = PF_BLUETOOTH,
2717         .owner          = THIS_MODULE,
2718         .release        = l2cap_sock_release,
2719         .bind           = l2cap_sock_bind,
2720         .connect        = l2cap_sock_connect,
2721         .listen         = l2cap_sock_listen,
2722         .accept         = l2cap_sock_accept,
2723         .getname        = l2cap_sock_getname,
2724         .sendmsg        = l2cap_sock_sendmsg,
2725         .recvmsg        = l2cap_sock_recvmsg,
2726         .poll           = bt_sock_poll,
2727         .ioctl          = bt_sock_ioctl,
2728         .mmap           = sock_no_mmap,
2729         .socketpair     = sock_no_socketpair,
2730         .shutdown       = l2cap_sock_shutdown,
2731         .setsockopt     = l2cap_sock_setsockopt,
2732         .getsockopt     = l2cap_sock_getsockopt
2733 };
2734
2735 static struct net_proto_family l2cap_sock_family_ops = {
2736         .family = PF_BLUETOOTH,
2737         .owner  = THIS_MODULE,
2738         .create = l2cap_sock_create,
2739 };
2740
2741 static struct hci_proto l2cap_hci_proto = {
2742         .name           = "L2CAP",
2743         .id             = HCI_PROTO_L2CAP,
2744         .connect_ind    = l2cap_connect_ind,
2745         .connect_cfm    = l2cap_connect_cfm,
2746         .disconn_ind    = l2cap_disconn_ind,
2747         .disconn_cfm    = l2cap_disconn_cfm,
2748         .security_cfm   = l2cap_security_cfm,
2749         .recv_acldata   = l2cap_recv_acldata
2750 };
2751
2752 static int __init l2cap_init(void)
2753 {
2754         int err;
2755
2756         err = proto_register(&l2cap_proto, 0);
2757         if (err < 0)
2758                 return err;
2759
2760         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2761         if (err < 0) {
2762                 BT_ERR("L2CAP socket registration failed");
2763                 goto error;
2764         }
2765
2766         err = hci_register_proto(&l2cap_hci_proto);
2767         if (err < 0) {
2768                 BT_ERR("L2CAP protocol registration failed");
2769                 bt_sock_unregister(BTPROTO_L2CAP);
2770                 goto error;
2771         }
2772
2773         if (class_create_file(bt_class, &class_attr_l2cap) < 0)
2774                 BT_ERR("Failed to create L2CAP info file");
2775
2776         BT_INFO("L2CAP ver %s", VERSION);
2777         BT_INFO("L2CAP socket layer initialized");
2778
2779         return 0;
2780
2781 error:
2782         proto_unregister(&l2cap_proto);
2783         return err;
2784 }
2785
2786 static void __exit l2cap_exit(void)
2787 {
2788         class_remove_file(bt_class, &class_attr_l2cap);
2789
2790         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
2791                 BT_ERR("L2CAP socket unregistration failed");
2792
2793         if (hci_unregister_proto(&l2cap_hci_proto) < 0)
2794                 BT_ERR("L2CAP protocol unregistration failed");
2795
2796         proto_unregister(&l2cap_proto);
2797 }
2798
2799 void l2cap_load(void)
2800 {
2801         /* Dummy function to trigger automatic L2CAP module loading by
2802          * other modules that use L2CAP sockets but don't use any other
2803          * symbols from it. */
2804         return;
2805 }
2806 EXPORT_SYMBOL(l2cap_load);
2807
2808 module_init(l2cap_init);
2809 module_exit(l2cap_exit);
2810
2811 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2812 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2813 MODULE_VERSION(VERSION);
2814 MODULE_LICENSE("GPL");
2815 MODULE_ALIAS("bt-proto-0");