net/bluetooth/l2cap.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth L2CAP core and sockets. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/capability.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <linux/uaccess.h>
  44 #include <net/sock.h>
  45
  46 #include <asm/system.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/hci_core.h>
  51 #include <net/bluetooth/l2cap.h>
  52
  53 #define VERSION "2.14"
  54
  55 static int enable_ertm = 0;
  56
  57 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
  58 static u8 l2cap_fixed_chan[8] = { 0x02, };
  59
  60 static const struct proto_ops l2cap_sock_ops;
  61
  62 static struct bt_sock_list l2cap_sk_list = {
  63         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  64 };
  65
  66 static void __l2cap_sock_close(struct sock *sk, int reason);
  67 static void l2cap_sock_close(struct sock *sk);
  68 static void l2cap_sock_kill(struct sock *sk);
  69
  70 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  71                                 u8 code, u8 ident, u16 dlen, void *data);
  72
  73 /* ---- L2CAP timers ---- */
  74 static void l2cap_sock_timeout(unsigned long arg)
  75 {
  76         struct sock *sk = (struct sock *) arg;
  77         int reason;
  78
  79         BT_DBG("sock %p state %d", sk, sk->sk_state);
  80
  81         bh_lock_sock(sk);
  82
  83         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
  84                 reason = ECONNREFUSED;
  85         else if (sk->sk_state == BT_CONNECT &&
  86                                 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
  87                 reason = ECONNREFUSED;
  88         else
  89                 reason = ETIMEDOUT;
  90
  91         __l2cap_sock_close(sk, reason);
  92
  93         bh_unlock_sock(sk);
  94
  95         l2cap_sock_kill(sk);
  96         sock_put(sk);
  97 }
  98
  99 static void l2cap_sock_set_timer(struct sock *sk, long timeout)
 100 {
 101         BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
 102         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
 103 }
 104
 105 static void l2cap_sock_clear_timer(struct sock *sk)
 106 {
 107         BT_DBG("sock %p state %d", sk, sk->sk_state);
 108         sk_stop_timer(sk, &sk->sk_timer);
 109 }
 110
 111 /* ---- L2CAP channels ---- */
 112 static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
 113 {
 114         struct sock *s;
 115         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 116                 if (l2cap_pi(s)->dcid == cid)
 117                         break;
 118         }
 119         return s;
 120 }
 121
 122 static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 123 {
 124         struct sock *s;
 125         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 126                 if (l2cap_pi(s)->scid == cid)
 127                         break;
 128         }
 129         return s;
 130 }
 131
 132 /* Find channel with given SCID.
 133  * Returns locked socket */
 134 static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 135 {
 136         struct sock *s;
 137         read_lock(&l->lock);
 138         s = __l2cap_get_chan_by_scid(l, cid);
 139         if (s)
 140                 bh_lock_sock(s);
 141         read_unlock(&l->lock);
 142         return s;
 143 }
 144
 145 static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 146 {
 147         struct sock *s;
 148         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 149                 if (l2cap_pi(s)->ident == ident)
 150                         break;
 151         }
 152         return s;
 153 }
 154
 155 static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 156 {
 157         struct sock *s;
 158         read_lock(&l->lock);
 159         s = __l2cap_get_chan_by_ident(l, ident);
 160         if (s)
 161                 bh_lock_sock(s);
 162         read_unlock(&l->lock);
 163         return s;
 164 }
 165
 166 static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
 167 {
 168         u16 cid = L2CAP_CID_DYN_START;
 169
 170         for (; cid < L2CAP_CID_DYN_END; cid++) {
 171                 if (!__l2cap_get_chan_by_scid(l, cid))
 172                         return cid;
 173         }
 174
 175         return 0;
 176 }
 177
 178 static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
 179 {
 180         sock_hold(sk);
 181
 182         if (l->head)
 183                 l2cap_pi(l->head)->prev_c = sk;
 184
 185         l2cap_pi(sk)->next_c = l->head;
 186         l2cap_pi(sk)->prev_c = NULL;
 187         l->head = sk;
 188 }
 189
 190 static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 191 {
 192         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 193
 194         write_lock_bh(&l->lock);
 195         if (sk == l->head)
 196                 l->head = next;
 197
 198         if (next)
 199                 l2cap_pi(next)->prev_c = prev;
 200         if (prev)
 201                 l2cap_pi(prev)->next_c = next;
 202         write_unlock_bh(&l->lock);
 203
 204         __sock_put(sk);
 205 }
 206
 207 static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 208 {
 209         struct l2cap_chan_list *l = &conn->chan_list;
 210
 211         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
 212                         l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
 213
 214         conn->disc_reason = 0x13;
 215
 216         l2cap_pi(sk)->conn = conn;
 217
 218         if (sk->sk_type == SOCK_SEQPACKET) {
 219                 /* Alloc CID for connection-oriented socket */
 220                 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
 221         } else if (sk->sk_type == SOCK_DGRAM) {
 222                 /* Connectionless socket */
 223                 l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
 224                 l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
 225                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 226         } else {
 227                 /* Raw socket can send/recv signalling messages only */
 228                 l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
 229                 l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
 230                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 231         }
 232
 233         __l2cap_chan_link(l, sk);
 234
 235         if (parent)
 236                 bt_accept_enqueue(parent, sk);
 237 }
 238
 239 /* Delete channel.
 240  * Must be called on the locked socket. */
 241 static void l2cap_chan_del(struct sock *sk, int err)
 242 {
 243         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 244         struct sock *parent = bt_sk(sk)->parent;
 245
 246         l2cap_sock_clear_timer(sk);
 247
 248         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 249
 250         if (conn) {
 251                 /* Unlink from channel list */
 252                 l2cap_chan_unlink(&conn->chan_list, sk);
 253                 l2cap_pi(sk)->conn = NULL;
 254                 hci_conn_put(conn->hcon);
 255         }
 256
 257         sk->sk_state = BT_CLOSED;
 258         sock_set_flag(sk, SOCK_ZAPPED);
 259
 260         if (err)
 261                 sk->sk_err = err;
 262
 263         if (parent) {
 264                 bt_accept_unlink(sk);
 265                 parent->sk_data_ready(parent, 0);
 266         } else
 267                 sk->sk_state_change(sk);
 268 }
 269
 270 /* Service level security */
 271 static inline int l2cap_check_security(struct sock *sk)
 272 {
 273         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 274         __u8 auth_type;
 275
 276         if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 277                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 278                         auth_type = HCI_AT_NO_BONDING_MITM;
 279                 else
 280                         auth_type = HCI_AT_NO_BONDING;
 281
 282                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 283                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 284         } else {
 285                 switch (l2cap_pi(sk)->sec_level) {
 286                 case BT_SECURITY_HIGH:
 287                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 288                         break;
 289                 case BT_SECURITY_MEDIUM:
 290                         auth_type = HCI_AT_GENERAL_BONDING;
 291                         break;
 292                 default:
 293                         auth_type = HCI_AT_NO_BONDING;
 294                         break;
 295                 }
 296         }
 297
 298         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
 299                                                                 auth_type);
 300 }
 301
 302 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
 303 {
 304         u8 id;
 305
 306         /* Get next available identificator.
 307          *    1 - 128 are used by kernel.
 308          *  129 - 199 are reserved.
 309          *  200 - 254 are used by utilities like l2ping, etc.
 310          */
 311
 312         spin_lock_bh(&conn->lock);
 313
 314         if (++conn->tx_ident > 128)
 315                 conn->tx_ident = 1;
 316
 317         id = conn->tx_ident;
 318
 319         spin_unlock_bh(&conn->lock);
 320
 321         return id;
 322 }
 323
 324 static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 325 {
 326         struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 327
 328         BT_DBG("code 0x%2.2x", code);
 329
 330         if (!skb)
 331                 return -ENOMEM;
 332
 333         return hci_send_acl(conn->hcon, skb, 0);
 334 }
 335
 336 static void l2cap_do_start(struct sock *sk)
 337 {
 338         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 339
 340         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
 341                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 342                         return;
 343
 344                 if (l2cap_check_security(sk)) {
 345                         struct l2cap_conn_req req;
 346                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 347                         req.psm  = l2cap_pi(sk)->psm;
 348
 349                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 350
 351                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 352                                         L2CAP_CONN_REQ, sizeof(req), &req);
 353                 }
 354         } else {
 355                 struct l2cap_info_req req;
 356                 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 357
 358                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
 359                 conn->info_ident = l2cap_get_ident(conn);
 360
 361                 mod_timer(&conn->info_timer, jiffies +
 362                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
 363
 364                 l2cap_send_cmd(conn, conn->info_ident,
 365                                         L2CAP_INFO_REQ, sizeof(req), &req);
 366         }
 367 }
 368
 369 /* ---- L2CAP connections ---- */
 370 static void l2cap_conn_start(struct l2cap_conn *conn)
 371 {
 372         struct l2cap_chan_list *l = &conn->chan_list;
 373         struct sock *sk;
 374
 375         BT_DBG("conn %p", conn);
 376
 377         read_lock(&l->lock);
 378
 379         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 380                 bh_lock_sock(sk);
 381
 382                 if (sk->sk_type != SOCK_SEQPACKET) {
 383                         bh_unlock_sock(sk);
 384                         continue;
 385                 }
 386
 387                 if (sk->sk_state == BT_CONNECT) {
 388                         if (l2cap_check_security(sk)) {
 389                                 struct l2cap_conn_req req;
 390                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 391                                 req.psm  = l2cap_pi(sk)->psm;
 392
 393                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 394
 395                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 396                                         L2CAP_CONN_REQ, sizeof(req), &req);
 397                         }
 398                 } else if (sk->sk_state == BT_CONNECT2) {
 399                         struct l2cap_conn_rsp rsp;
 400                         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
 401                         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
 402
 403                         if (l2cap_check_security(sk)) {
 404                                 if (bt_sk(sk)->defer_setup) {
 405                                         struct sock *parent = bt_sk(sk)->parent;
 406                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 407                                         rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
 408                                         parent->sk_data_ready(parent, 0);
 409
 410                                 } else {
 411                                         sk->sk_state = BT_CONFIG;
 412                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 413                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 414                                 }
 415                         } else {
 416                                 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 417                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
 418                         }
 419
 420                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 421                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 422                 }
 423
 424                 bh_unlock_sock(sk);
 425         }
 426
 427         read_unlock(&l->lock);
 428 }
 429
 430 static void l2cap_conn_ready(struct l2cap_conn *conn)
 431 {
 432         struct l2cap_chan_list *l = &conn->chan_list;
 433         struct sock *sk;
 434
 435         BT_DBG("conn %p", conn);
 436
 437         read_lock(&l->lock);
 438
 439         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 440                 bh_lock_sock(sk);
 441
 442                 if (sk->sk_type != SOCK_SEQPACKET) {
 443                         l2cap_sock_clear_timer(sk);
 444                         sk->sk_state = BT_CONNECTED;
 445                         sk->sk_state_change(sk);
 446                 } else if (sk->sk_state == BT_CONNECT)
 447                         l2cap_do_start(sk);
 448
 449                 bh_unlock_sock(sk);
 450         }
 451
 452         read_unlock(&l->lock);
 453 }
 454
 455 /* Notify sockets that we cannot guaranty reliability anymore */
 456 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 457 {
 458         struct l2cap_chan_list *l = &conn->chan_list;
 459         struct sock *sk;
 460
 461         BT_DBG("conn %p", conn);
 462
 463         read_lock(&l->lock);
 464
 465         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 466                 if (l2cap_pi(sk)->force_reliable)
 467                         sk->sk_err = err;
 468         }
 469
 470         read_unlock(&l->lock);
 471 }
 472
 473 static void l2cap_info_timeout(unsigned long arg)
 474 {
 475         struct l2cap_conn *conn = (void *) arg;
 476
 477         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 478         conn->info_ident = 0;
 479
 480         l2cap_conn_start(conn);
 481 }
 482
 483 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 484 {
 485         struct l2cap_conn *conn = hcon->l2cap_data;
 486
 487         if (conn || status)
 488                 return conn;
 489
 490         conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
 491         if (!conn)
 492                 return NULL;
 493
 494         hcon->l2cap_data = conn;
 495         conn->hcon = hcon;
 496
 497         BT_DBG("hcon %p conn %p", hcon, conn);
 498
 499         conn->mtu = hcon->hdev->acl_mtu;
 500         conn->src = &hcon->hdev->bdaddr;
 501         conn->dst = &hcon->dst;
 502
 503         conn->feat_mask = 0;
 504
 505         setup_timer(&conn->info_timer, l2cap_info_timeout,
 506                                                 (unsigned long) conn);
 507
 508         spin_lock_init(&conn->lock);
 509         rwlock_init(&conn->chan_list.lock);
 510
 511         conn->disc_reason = 0x13;
 512
 513         return conn;
 514 }
 515
 516 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 517 {
 518         struct l2cap_conn *conn = hcon->l2cap_data;
 519         struct sock *sk;
 520
 521         if (!conn)
 522                 return;
 523
 524         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 525
 526         kfree_skb(conn->rx_skb);
 527
 528         /* Kill channels */
 529         while ((sk = conn->chan_list.head)) {
 530                 bh_lock_sock(sk);
 531                 l2cap_chan_del(sk, err);
 532                 bh_unlock_sock(sk);
 533                 l2cap_sock_kill(sk);
 534         }
 535
 536         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 537                 del_timer_sync(&conn->info_timer);
 538
 539         hcon->l2cap_data = NULL;
 540         kfree(conn);
 541 }
 542
 543 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 544 {
 545         struct l2cap_chan_list *l = &conn->chan_list;
 546         write_lock_bh(&l->lock);
 547         __l2cap_chan_add(conn, sk, parent);
 548         write_unlock_bh(&l->lock);
 549 }
 550
 551 /* ---- Socket interface ---- */
 552 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 553 {
 554         struct sock *sk;
 555         struct hlist_node *node;
 556         sk_for_each(sk, node, &l2cap_sk_list.head)
 557                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
 558                         goto found;
 559         sk = NULL;
 560 found:
 561         return sk;
 562 }
 563
 564 /* Find socket with psm and source bdaddr.
 565  * Returns closest match.
 566  */
 567 static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 568 {
 569         struct sock *sk = NULL, *sk1 = NULL;
 570         struct hlist_node *node;
 571
 572         sk_for_each(sk, node, &l2cap_sk_list.head) {
 573                 if (state && sk->sk_state != state)
 574                         continue;
 575
 576                 if (l2cap_pi(sk)->psm == psm) {
 577                         /* Exact match. */
 578                         if (!bacmp(&bt_sk(sk)->src, src))
 579                                 break;
 580
 581                         /* Closest match */
 582                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 583                                 sk1 = sk;
 584                 }
 585         }
 586         return node ? sk : sk1;
 587 }
 588
 589 /* Find socket with given address (psm, src).
 590  * Returns locked socket */
 591 static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 592 {
 593         struct sock *s;
 594         read_lock(&l2cap_sk_list.lock);
 595         s = __l2cap_get_sock_by_psm(state, psm, src);
 596         if (s)
 597                 bh_lock_sock(s);
 598         read_unlock(&l2cap_sk_list.lock);
 599         return s;
 600 }
 601
 602 static void l2cap_sock_destruct(struct sock *sk)
 603 {
 604         BT_DBG("sk %p", sk);
 605
 606         skb_queue_purge(&sk->sk_receive_queue);
 607         skb_queue_purge(&sk->sk_write_queue);
 608 }
 609
 610 static void l2cap_sock_cleanup_listen(struct sock *parent)
 611 {
 612         struct sock *sk;
 613
 614         BT_DBG("parent %p", parent);
 615
 616         /* Close not yet accepted channels */
 617         while ((sk = bt_accept_dequeue(parent, NULL)))
 618                 l2cap_sock_close(sk);
 619
 620         parent->sk_state = BT_CLOSED;
 621         sock_set_flag(parent, SOCK_ZAPPED);
 622 }
 623
 624 /* Kill socket (only if zapped and orphan)
 625  * Must be called on unlocked socket.
 626  */
 627 static void l2cap_sock_kill(struct sock *sk)
 628 {
 629         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 630                 return;
 631
 632         BT_DBG("sk %p state %d", sk, sk->sk_state);
 633
 634         /* Kill poor orphan */
 635         bt_sock_unlink(&l2cap_sk_list, sk);
 636         sock_set_flag(sk, SOCK_DEAD);
 637         sock_put(sk);
 638 }
 639
 640 static void __l2cap_sock_close(struct sock *sk, int reason)
 641 {
 642         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 643
 644         switch (sk->sk_state) {
 645         case BT_LISTEN:
 646                 l2cap_sock_cleanup_listen(sk);
 647                 break;
 648
 649         case BT_CONNECTED:
 650         case BT_CONFIG:
 651                 if (sk->sk_type == SOCK_SEQPACKET) {
 652                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 653                         struct l2cap_disconn_req req;
 654
 655                         sk->sk_state = BT_DISCONN;
 656                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 657
 658                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
 659                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 660                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
 661                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 662                 } else
 663                         l2cap_chan_del(sk, reason);
 664                 break;
 665
 666         case BT_CONNECT2:
 667                 if (sk->sk_type == SOCK_SEQPACKET) {
 668                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 669                         struct l2cap_conn_rsp rsp;
 670                         __u16 result;
 671
 672                         if (bt_sk(sk)->defer_setup)
 673                                 result = L2CAP_CR_SEC_BLOCK;
 674                         else
 675                                 result = L2CAP_CR_BAD_PSM;
 676
 677                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
 678                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
 679                         rsp.result = cpu_to_le16(result);
 680                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 681                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 682                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 683                 } else
 684                         l2cap_chan_del(sk, reason);
 685                 break;
 686
 687         case BT_CONNECT:
 688         case BT_DISCONN:
 689                 l2cap_chan_del(sk, reason);
 690                 break;
 691
 692         default:
 693                 sock_set_flag(sk, SOCK_ZAPPED);
 694                 break;
 695         }
 696 }
 697
 698 /* Must be called on unlocked socket. */
 699 static void l2cap_sock_close(struct sock *sk)
 700 {
 701         l2cap_sock_clear_timer(sk);
 702         lock_sock(sk);
 703         __l2cap_sock_close(sk, ECONNRESET);
 704         release_sock(sk);
 705         l2cap_sock_kill(sk);
 706 }
 707
 708 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 709 {
 710         struct l2cap_pinfo *pi = l2cap_pi(sk);
 711
 712         BT_DBG("sk %p", sk);
 713
 714         if (parent) {
 715                 sk->sk_type = parent->sk_type;
 716                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 717
 718                 pi->imtu = l2cap_pi(parent)->imtu;
 719                 pi->omtu = l2cap_pi(parent)->omtu;
 720                 pi->mode = l2cap_pi(parent)->mode;
 721                 pi->fcs  = l2cap_pi(parent)->fcs;
 722                 pi->sec_level = l2cap_pi(parent)->sec_level;
 723                 pi->role_switch = l2cap_pi(parent)->role_switch;
 724                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
 725         } else {
 726                 pi->imtu = L2CAP_DEFAULT_MTU;
 727                 pi->omtu = 0;
 728                 pi->mode = L2CAP_MODE_BASIC;
 729                 pi->fcs  = L2CAP_FCS_CRC16;
 730                 pi->sec_level = BT_SECURITY_LOW;
 731                 pi->role_switch = 0;
 732                 pi->force_reliable = 0;
 733         }
 734
 735         /* Default config options */
 736         pi->conf_len = 0;
 737         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 738 }
 739
 740 static struct proto l2cap_proto = {
 741         .name           = "L2CAP",
 742         .owner          = THIS_MODULE,
 743         .obj_size       = sizeof(struct l2cap_pinfo)
 744 };
 745
 746 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 747 {
 748         struct sock *sk;
 749
 750         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 751         if (!sk)
 752                 return NULL;
 753
 754         sock_init_data(sock, sk);
 755         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 756
 757         sk->sk_destruct = l2cap_sock_destruct;
 758         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 759
 760         sock_reset_flag(sk, SOCK_ZAPPED);
 761
 762         sk->sk_protocol = proto;
 763         sk->sk_state = BT_OPEN;
 764
 765         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 766
 767         bt_sock_link(&l2cap_sk_list, sk);
 768         return sk;
 769 }
 770
 771 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
 772 {
 773         struct sock *sk;
 774
 775         BT_DBG("sock %p", sock);
 776
 777         sock->state = SS_UNCONNECTED;
 778
 779         if (sock->type != SOCK_SEQPACKET &&
 780                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 781                 return -ESOCKTNOSUPPORT;
 782
 783         if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
 784                 return -EPERM;
 785
 786         sock->ops = &l2cap_sock_ops;
 787
 788         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 789         if (!sk)
 790                 return -ENOMEM;
 791
 792         l2cap_sock_init(sk, NULL);
 793         return 0;
 794 }
 795
 796 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 797 {
 798         struct sock *sk = sock->sk;
 799         struct sockaddr_l2 la;
 800         int len, err = 0;
 801
 802         BT_DBG("sk %p", sk);
 803
 804         if (!addr || addr->sa_family != AF_BLUETOOTH)
 805                 return -EINVAL;
 806
 807         memset(&la, 0, sizeof(la));
 808         len = min_t(unsigned int, sizeof(la), alen);
 809         memcpy(&la, addr, len);
 810
 811         if (la.l2_cid)
 812                 return -EINVAL;
 813
 814         lock_sock(sk);
 815
 816         if (sk->sk_state != BT_OPEN) {
 817                 err = -EBADFD;
 818                 goto done;
 819         }
 820
 821         if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&
 822                                 !capable(CAP_NET_BIND_SERVICE)) {
 823                 err = -EACCES;
 824                 goto done;
 825         }
 826
 827         write_lock_bh(&l2cap_sk_list.lock);
 828
 829         if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
 830                 err = -EADDRINUSE;
 831         } else {
 832                 /* Save source address */
 833                 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 834                 l2cap_pi(sk)->psm   = la.l2_psm;
 835                 l2cap_pi(sk)->sport = la.l2_psm;
 836                 sk->sk_state = BT_BOUND;
 837
 838                 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
 839                                         __le16_to_cpu(la.l2_psm) == 0x0003)
 840                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 841         }
 842
 843         write_unlock_bh(&l2cap_sk_list.lock);
 844
 845 done:
 846         release_sock(sk);
 847         return err;
 848 }
 849
 850 static int l2cap_do_connect(struct sock *sk)
 851 {
 852         bdaddr_t *src = &bt_sk(sk)->src;
 853         bdaddr_t *dst = &bt_sk(sk)->dst;
 854         struct l2cap_conn *conn;
 855         struct hci_conn *hcon;
 856         struct hci_dev *hdev;
 857         __u8 auth_type;
 858         int err;
 859
 860         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
 861                                                         l2cap_pi(sk)->psm);
 862
 863         hdev = hci_get_route(dst, src);
 864         if (!hdev)
 865                 return -EHOSTUNREACH;
 866
 867         hci_dev_lock_bh(hdev);
 868
 869         err = -ENOMEM;
 870
 871         if (sk->sk_type == SOCK_RAW) {
 872                 switch (l2cap_pi(sk)->sec_level) {
 873                 case BT_SECURITY_HIGH:
 874                         auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 875                         break;
 876                 case BT_SECURITY_MEDIUM:
 877                         auth_type = HCI_AT_DEDICATED_BONDING;
 878                         break;
 879                 default:
 880                         auth_type = HCI_AT_NO_BONDING;
 881                         break;
 882                 }
 883         } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 884                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 885                         auth_type = HCI_AT_NO_BONDING_MITM;
 886                 else
 887                         auth_type = HCI_AT_NO_BONDING;
 888
 889                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 890                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 891         } else {
 892                 switch (l2cap_pi(sk)->sec_level) {
 893                 case BT_SECURITY_HIGH:
 894                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 895                         break;
 896                 case BT_SECURITY_MEDIUM:
 897                         auth_type = HCI_AT_GENERAL_BONDING;
 898                         break;
 899                 default:
 900                         auth_type = HCI_AT_NO_BONDING;
 901                         break;
 902                 }
 903         }
 904
 905         hcon = hci_connect(hdev, ACL_LINK, dst,
 906                                         l2cap_pi(sk)->sec_level, auth_type);
 907         if (!hcon)
 908                 goto done;
 909
 910         conn = l2cap_conn_add(hcon, 0);
 911         if (!conn) {
 912                 hci_conn_put(hcon);
 913                 goto done;
 914         }
 915
 916         err = 0;
 917
 918         /* Update source addr of the socket */
 919         bacpy(src, conn->src);
 920
 921         l2cap_chan_add(conn, sk, NULL);
 922
 923         sk->sk_state = BT_CONNECT;
 924         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 925
 926         if (hcon->state == BT_CONNECTED) {
 927                 if (sk->sk_type != SOCK_SEQPACKET) {
 928                         l2cap_sock_clear_timer(sk);
 929                         sk->sk_state = BT_CONNECTED;
 930                 } else
 931                         l2cap_do_start(sk);
 932         }
 933
 934 done:
 935         hci_dev_unlock_bh(hdev);
 936         hci_dev_put(hdev);
 937         return err;
 938 }
 939
 940 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 941 {
 942         struct sock *sk = sock->sk;
 943         struct sockaddr_l2 la;
 944         int len, err = 0;
 945
 946         BT_DBG("sk %p", sk);
 947
 948         if (!addr || addr->sa_family != AF_BLUETOOTH)
 949                 return -EINVAL;
 950
 951         memset(&la, 0, sizeof(la));
 952         len = min_t(unsigned int, sizeof(la), alen);
 953         memcpy(&la, addr, len);
 954
 955         if (la.l2_cid)
 956                 return -EINVAL;
 957
 958         lock_sock(sk);
 959
 960         if (sk->sk_type == SOCK_SEQPACKET && !la.l2_psm) {
 961                 err = -EINVAL;
 962                 goto done;
 963         }
 964
 965         switch (l2cap_pi(sk)->mode) {
 966         case L2CAP_MODE_BASIC:
 967                 break;
 968         case L2CAP_MODE_ERTM:
 969                 if (enable_ertm)
 970                         break;
 971                 /* fall through */
 972         default:
 973                 err = -ENOTSUPP;
 974                 goto done;
 975         }
 976
 977         switch (sk->sk_state) {
 978         case BT_CONNECT:
 979         case BT_CONNECT2:
 980         case BT_CONFIG:
 981                 /* Already connecting */
 982                 goto wait;
 983
 984         case BT_CONNECTED:
 985                 /* Already connected */
 986                 goto done;
 987
 988         case BT_OPEN:
 989         case BT_BOUND:
 990                 /* Can connect */
 991                 break;
 992
 993         default:
 994                 err = -EBADFD;
 995                 goto done;
 996         }
 997
 998         /* Set destination address and psm */
 999         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
1000         l2cap_pi(sk)->psm = la.l2_psm;
1001
1002         err = l2cap_do_connect(sk);
1003         if (err)
1004                 goto done;
1005
1006 wait:
1007         err = bt_sock_wait_state(sk, BT_CONNECTED,
1008                         sock_sndtimeo(sk, flags & O_NONBLOCK));
1009 done:
1010         release_sock(sk);
1011         return err;
1012 }
1013
1014 static int l2cap_sock_listen(struct socket *sock, int backlog)
1015 {
1016         struct sock *sk = sock->sk;
1017         int err = 0;
1018
1019         BT_DBG("sk %p backlog %d", sk, backlog);
1020
1021         lock_sock(sk);
1022
1023         if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
1024                 err = -EBADFD;
1025                 goto done;
1026         }
1027
1028         switch (l2cap_pi(sk)->mode) {
1029         case L2CAP_MODE_BASIC:
1030                 break;
1031         case L2CAP_MODE_ERTM:
1032                 if (enable_ertm)
1033                         break;
1034                 /* fall through */
1035         default:
1036                 err = -ENOTSUPP;
1037                 goto done;
1038         }
1039
1040         if (!l2cap_pi(sk)->psm) {
1041                 bdaddr_t *src = &bt_sk(sk)->src;
1042                 u16 psm;
1043
1044                 err = -EINVAL;
1045
1046                 write_lock_bh(&l2cap_sk_list.lock);
1047
1048                 for (psm = 0x1001; psm < 0x1100; psm += 2)
1049                         if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
1050                                 l2cap_pi(sk)->psm   = cpu_to_le16(psm);
1051                                 l2cap_pi(sk)->sport = cpu_to_le16(psm);
1052                                 err = 0;
1053                                 break;
1054                         }
1055
1056                 write_unlock_bh(&l2cap_sk_list.lock);
1057
1058                 if (err < 0)
1059                         goto done;
1060         }
1061
1062         sk->sk_max_ack_backlog = backlog;
1063         sk->sk_ack_backlog = 0;
1064         sk->sk_state = BT_LISTEN;
1065
1066 done:
1067         release_sock(sk);
1068         return err;
1069 }
1070
1071 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
1072 {
1073         DECLARE_WAITQUEUE(wait, current);
1074         struct sock *sk = sock->sk, *nsk;
1075         long timeo;
1076         int err = 0;
1077
1078         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1079
1080         if (sk->sk_state != BT_LISTEN) {
1081                 err = -EBADFD;
1082                 goto done;
1083         }
1084
1085         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1086
1087         BT_DBG("sk %p timeo %ld", sk, timeo);
1088
1089         /* Wait for an incoming connection. (wake-one). */
1090         add_wait_queue_exclusive(sk->sk_sleep, &wait);
1091         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1092                 set_current_state(TASK_INTERRUPTIBLE);
1093                 if (!timeo) {
1094                         err = -EAGAIN;
1095                         break;
1096                 }
1097
1098                 release_sock(sk);
1099                 timeo = schedule_timeout(timeo);
1100                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1101
1102                 if (sk->sk_state != BT_LISTEN) {
1103                         err = -EBADFD;
1104                         break;
1105                 }
1106
1107                 if (signal_pending(current)) {
1108                         err = sock_intr_errno(timeo);
1109                         break;
1110                 }
1111         }
1112         set_current_state(TASK_RUNNING);
1113         remove_wait_queue(sk->sk_sleep, &wait);
1114
1115         if (err)
1116                 goto done;
1117
1118         newsock->state = SS_CONNECTED;
1119
1120         BT_DBG("new socket %p", nsk);
1121
1122 done:
1123         release_sock(sk);
1124         return err;
1125 }
1126
1127 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1128 {
1129         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1130         struct sock *sk = sock->sk;
1131
1132         BT_DBG("sock %p, sk %p", sock, sk);
1133
1134         addr->sa_family = AF_BLUETOOTH;
1135         *len = sizeof(struct sockaddr_l2);
1136
1137         if (peer) {
1138                 la->l2_psm = l2cap_pi(sk)->psm;
1139                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
1140                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1141         } else {
1142                 la->l2_psm = l2cap_pi(sk)->sport;
1143                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
1144                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
1145         }
1146
1147         return 0;
1148 }
1149
1150 static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
1151 {
1152         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1153         struct sk_buff *skb, **frag;
1154         int err, hlen, count, sent = 0;
1155         struct l2cap_hdr *lh;
1156
1157         BT_DBG("sk %p len %d", sk, len);
1158
1159         /* First fragment (with L2CAP header) */
1160         if (sk->sk_type == SOCK_DGRAM)
1161                 hlen = L2CAP_HDR_SIZE + 2;
1162         else
1163                 hlen = L2CAP_HDR_SIZE;
1164
1165         count = min_t(unsigned int, (conn->mtu - hlen), len);
1166
1167         skb = bt_skb_send_alloc(sk, hlen + count,
1168                         msg->msg_flags & MSG_DONTWAIT, &err);
1169         if (!skb)
1170                 return err;
1171
1172         /* Create L2CAP header */
1173         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1174         lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1175         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1176
1177         if (sk->sk_type == SOCK_DGRAM)
1178                 put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
1179
1180         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
1181                 err = -EFAULT;
1182                 goto fail;
1183         }
1184
1185         sent += count;
1186         len  -= count;
1187
1188         /* Continuation fragments (no L2CAP header) */
1189         frag = &skb_shinfo(skb)->frag_list;
1190         while (len) {
1191                 count = min_t(unsigned int, conn->mtu, len);
1192
1193                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1194                 if (!*frag)
1195                         goto fail;
1196
1197                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
1198                         err = -EFAULT;
1199                         goto fail;
1200                 }
1201
1202                 sent += count;
1203                 len  -= count;
1204
1205                 frag = &(*frag)->next;
1206         }
1207         err = hci_send_acl(conn->hcon, skb, 0);
1208         if (err < 0)
1209                 goto fail;
1210
1211         return sent;
1212
1213 fail:
1214         kfree_skb(skb);
1215         return err;
1216 }
1217
1218 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1219 {
1220         struct sock *sk = sock->sk;
1221         int err = 0;
1222
1223         BT_DBG("sock %p, sk %p", sock, sk);
1224
1225         err = sock_error(sk);
1226         if (err)
1227                 return err;
1228
1229         if (msg->msg_flags & MSG_OOB)
1230                 return -EOPNOTSUPP;
1231
1232         /* Check outgoing MTU */
1233         if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
1234                 return -EINVAL;
1235
1236         lock_sock(sk);
1237
1238         if (sk->sk_state == BT_CONNECTED)
1239                 err = l2cap_do_send(sk, msg, len);
1240         else
1241                 err = -ENOTCONN;
1242
1243         release_sock(sk);
1244         return err;
1245 }
1246
1247 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1248 {
1249         struct sock *sk = sock->sk;
1250
1251         lock_sock(sk);
1252
1253         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1254                 struct l2cap_conn_rsp rsp;
1255
1256                 sk->sk_state = BT_CONFIG;
1257
1258                 rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1259                 rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
1260                 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1261                 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1262                 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1263                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1264
1265                 release_sock(sk);
1266                 return 0;
1267         }
1268
1269         release_sock(sk);
1270
1271         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1272 }
1273
1274 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
1275 {
1276         struct sock *sk = sock->sk;
1277         struct l2cap_options opts;
1278         int len, err = 0;
1279         u32 opt;
1280
1281         BT_DBG("sk %p", sk);
1282
1283         lock_sock(sk);
1284
1285         switch (optname) {
1286         case L2CAP_OPTIONS:
1287                 opts.imtu     = l2cap_pi(sk)->imtu;
1288                 opts.omtu     = l2cap_pi(sk)->omtu;
1289                 opts.flush_to = l2cap_pi(sk)->flush_to;
1290                 opts.mode     = l2cap_pi(sk)->mode;
1291
1292                 len = min_t(unsigned int, sizeof(opts), optlen);
1293                 if (copy_from_user((char *) &opts, optval, len)) {
1294                         err = -EFAULT;
1295                         break;
1296                 }
1297
1298                 l2cap_pi(sk)->imtu = opts.imtu;
1299                 l2cap_pi(sk)->omtu = opts.omtu;
1300                 l2cap_pi(sk)->mode = opts.mode;
1301                 break;
1302
1303         case L2CAP_LM:
1304                 if (get_user(opt, (u32 __user *) optval)) {
1305                         err = -EFAULT;
1306                         break;
1307                 }
1308
1309                 if (opt & L2CAP_LM_AUTH)
1310                         l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
1311                 if (opt & L2CAP_LM_ENCRYPT)
1312                         l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
1313                 if (opt & L2CAP_LM_SECURE)
1314                         l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
1315
1316                 l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
1317                 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
1318                 break;
1319
1320         default:
1321                 err = -ENOPROTOOPT;
1322                 break;
1323         }
1324
1325         release_sock(sk);
1326         return err;
1327 }
1328
1329 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1330 {
1331         struct sock *sk = sock->sk;
1332         struct bt_security sec;
1333         int len, err = 0;
1334         u32 opt;
1335
1336         BT_DBG("sk %p", sk);
1337
1338         if (level == SOL_L2CAP)
1339                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
1340
1341         if (level != SOL_BLUETOOTH)
1342                 return -ENOPROTOOPT;
1343
1344         lock_sock(sk);
1345
1346         switch (optname) {
1347         case BT_SECURITY:
1348                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_RAW) {
1349                         err = -EINVAL;
1350                         break;
1351                 }
1352
1353                 sec.level = BT_SECURITY_LOW;
1354
1355                 len = min_t(unsigned int, sizeof(sec), optlen);
1356                 if (copy_from_user((char *) &sec, optval, len)) {
1357                         err = -EFAULT;
1358                         break;
1359                 }
1360
1361                 if (sec.level < BT_SECURITY_LOW ||
1362                                         sec.level > BT_SECURITY_HIGH) {
1363                         err = -EINVAL;
1364                         break;
1365                 }
1366
1367                 l2cap_pi(sk)->sec_level = sec.level;
1368                 break;
1369
1370         case BT_DEFER_SETUP:
1371                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1372                         err = -EINVAL;
1373                         break;
1374                 }
1375
1376                 if (get_user(opt, (u32 __user *) optval)) {
1377                         err = -EFAULT;
1378                         break;
1379                 }
1380
1381                 bt_sk(sk)->defer_setup = opt;
1382                 break;
1383
1384         default:
1385                 err = -ENOPROTOOPT;
1386                 break;
1387         }
1388
1389         release_sock(sk);
1390         return err;
1391 }
1392
1393 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1394 {
1395         struct sock *sk = sock->sk;
1396         struct l2cap_options opts;
1397         struct l2cap_conninfo cinfo;
1398         int len, err = 0;
1399         u32 opt;
1400
1401         BT_DBG("sk %p", sk);
1402
1403         if (get_user(len, optlen))
1404                 return -EFAULT;
1405
1406         lock_sock(sk);
1407
1408         switch (optname) {
1409         case L2CAP_OPTIONS:
1410                 opts.imtu     = l2cap_pi(sk)->imtu;
1411                 opts.omtu     = l2cap_pi(sk)->omtu;
1412                 opts.flush_to = l2cap_pi(sk)->flush_to;
1413                 opts.mode     = l2cap_pi(sk)->mode;
1414
1415                 len = min_t(unsigned int, len, sizeof(opts));
1416                 if (copy_to_user(optval, (char *) &opts, len))
1417                         err = -EFAULT;
1418
1419                 break;
1420
1421         case L2CAP_LM:
1422                 switch (l2cap_pi(sk)->sec_level) {
1423                 case BT_SECURITY_LOW:
1424                         opt = L2CAP_LM_AUTH;
1425                         break;
1426                 case BT_SECURITY_MEDIUM:
1427                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
1428                         break;
1429                 case BT_SECURITY_HIGH:
1430                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
1431                                                         L2CAP_LM_SECURE;
1432                         break;
1433                 default:
1434                         opt = 0;
1435                         break;
1436                 }
1437
1438                 if (l2cap_pi(sk)->role_switch)
1439                         opt |= L2CAP_LM_MASTER;
1440
1441                 if (l2cap_pi(sk)->force_reliable)
1442                         opt |= L2CAP_LM_RELIABLE;
1443
1444                 if (put_user(opt, (u32 __user *) optval))
1445                         err = -EFAULT;
1446                 break;
1447
1448         case L2CAP_CONNINFO:
1449                 if (sk->sk_state != BT_CONNECTED &&
1450                                         !(sk->sk_state == BT_CONNECT2 &&
1451                                                 bt_sk(sk)->defer_setup)) {
1452                         err = -ENOTCONN;
1453                         break;
1454                 }
1455
1456                 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
1457                 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
1458
1459                 len = min_t(unsigned int, len, sizeof(cinfo));
1460                 if (copy_to_user(optval, (char *) &cinfo, len))
1461                         err = -EFAULT;
1462
1463                 break;
1464
1465         default:
1466                 err = -ENOPROTOOPT;
1467                 break;
1468         }
1469
1470         release_sock(sk);
1471         return err;
1472 }
1473
1474 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
1475 {
1476         struct sock *sk = sock->sk;
1477         struct bt_security sec;
1478         int len, err = 0;
1479
1480         BT_DBG("sk %p", sk);
1481
1482         if (level == SOL_L2CAP)
1483                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
1484
1485         if (level != SOL_BLUETOOTH)
1486                 return -ENOPROTOOPT;
1487
1488         if (get_user(len, optlen))
1489                 return -EFAULT;
1490
1491         lock_sock(sk);
1492
1493         switch (optname) {
1494         case BT_SECURITY:
1495                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_RAW) {
1496                         err = -EINVAL;
1497                         break;
1498                 }
1499
1500                 sec.level = l2cap_pi(sk)->sec_level;
1501
1502                 len = min_t(unsigned int, len, sizeof(sec));
1503                 if (copy_to_user(optval, (char *) &sec, len))
1504                         err = -EFAULT;
1505
1506                 break;
1507
1508         case BT_DEFER_SETUP:
1509                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1510                         err = -EINVAL;
1511                         break;
1512                 }
1513
1514                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
1515                         err = -EFAULT;
1516
1517                 break;
1518
1519         default:
1520                 err = -ENOPROTOOPT;
1521                 break;
1522         }
1523
1524         release_sock(sk);
1525         return err;
1526 }
1527
1528 static int l2cap_sock_shutdown(struct socket *sock, int how)
1529 {
1530         struct sock *sk = sock->sk;
1531         int err = 0;
1532
1533         BT_DBG("sock %p, sk %p", sock, sk);
1534
1535         if (!sk)
1536                 return 0;
1537
1538         lock_sock(sk);
1539         if (!sk->sk_shutdown) {
1540                 sk->sk_shutdown = SHUTDOWN_MASK;
1541                 l2cap_sock_clear_timer(sk);
1542                 __l2cap_sock_close(sk, 0);
1543
1544                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1545                         err = bt_sock_wait_state(sk, BT_CLOSED,
1546                                                         sk->sk_lingertime);
1547         }
1548         release_sock(sk);
1549         return err;
1550 }
1551
1552 static int l2cap_sock_release(struct socket *sock)
1553 {
1554         struct sock *sk = sock->sk;
1555         int err;
1556
1557         BT_DBG("sock %p, sk %p", sock, sk);
1558
1559         if (!sk)
1560                 return 0;
1561
1562         err = l2cap_sock_shutdown(sock, 2);
1563
1564         sock_orphan(sk);
1565         l2cap_sock_kill(sk);
1566         return err;
1567 }
1568
1569 static void l2cap_chan_ready(struct sock *sk)
1570 {
1571         struct sock *parent = bt_sk(sk)->parent;
1572
1573         BT_DBG("sk %p, parent %p", sk, parent);
1574
1575         l2cap_pi(sk)->conf_state = 0;
1576         l2cap_sock_clear_timer(sk);
1577
1578         if (!parent) {
1579                 /* Outgoing channel.
1580                  * Wake up socket sleeping on connect.
1581                  */
1582                 sk->sk_state = BT_CONNECTED;
1583                 sk->sk_state_change(sk);
1584         } else {
1585                 /* Incoming channel.
1586                  * Wake up socket sleeping on accept.
1587                  */
1588                 parent->sk_data_ready(parent, 0);
1589         }
1590 }
1591
1592 /* Copy frame to all raw sockets on that connection */
1593 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1594 {
1595         struct l2cap_chan_list *l = &conn->chan_list;
1596         struct sk_buff *nskb;
1597         struct sock *sk;
1598
1599         BT_DBG("conn %p", conn);
1600
1601         read_lock(&l->lock);
1602         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
1603                 if (sk->sk_type != SOCK_RAW)
1604                         continue;
1605
1606                 /* Don't send frame to the socket it came from */
1607                 if (skb->sk == sk)
1608                         continue;
1609                 nskb = skb_clone(skb, GFP_ATOMIC);
1610                 if (!nskb)
1611                         continue;
1612
1613                 if (sock_queue_rcv_skb(sk, nskb))
1614                         kfree_skb(nskb);
1615         }
1616         read_unlock(&l->lock);
1617 }
1618
1619 /* ---- L2CAP signalling commands ---- */
1620 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1621                                 u8 code, u8 ident, u16 dlen, void *data)
1622 {
1623         struct sk_buff *skb, **frag;
1624         struct l2cap_cmd_hdr *cmd;
1625         struct l2cap_hdr *lh;
1626         int len, count;
1627
1628         BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
1629                         conn, code, ident, dlen);
1630
1631         len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1632         count = min_t(unsigned int, conn->mtu, len);
1633
1634         skb = bt_skb_alloc(count, GFP_ATOMIC);
1635         if (!skb)
1636                 return NULL;
1637
1638         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1639         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
1640         lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1641
1642         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1643         cmd->code  = code;
1644         cmd->ident = ident;
1645         cmd->len   = cpu_to_le16(dlen);
1646
1647         if (dlen) {
1648                 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1649                 memcpy(skb_put(skb, count), data, count);
1650                 data += count;
1651         }
1652
1653         len -= skb->len;
1654
1655         /* Continuation fragments (no L2CAP header) */
1656         frag = &skb_shinfo(skb)->frag_list;
1657         while (len) {
1658                 count = min_t(unsigned int, conn->mtu, len);
1659
1660                 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1661                 if (!*frag)
1662                         goto fail;
1663
1664                 memcpy(skb_put(*frag, count), data, count);
1665
1666                 len  -= count;
1667                 data += count;
1668
1669                 frag = &(*frag)->next;
1670         }
1671
1672         return skb;
1673
1674 fail:
1675         kfree_skb(skb);
1676         return NULL;
1677 }
1678
1679 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1680 {
1681         struct l2cap_conf_opt *opt = *ptr;
1682         int len;
1683
1684         len = L2CAP_CONF_OPT_SIZE + opt->len;
1685         *ptr += len;
1686
1687         *type = opt->type;
1688         *olen = opt->len;
1689
1690         switch (opt->len) {
1691         case 1:
1692                 *val = *((u8 *) opt->val);
1693                 break;
1694
1695         case 2:
1696                 *val = __le16_to_cpu(*((__le16 *) opt->val));
1697                 break;
1698
1699         case 4:
1700                 *val = __le32_to_cpu(*((__le32 *) opt->val));
1701                 break;
1702
1703         default:
1704                 *val = (unsigned long) opt->val;
1705                 break;
1706         }
1707
1708         BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1709         return len;
1710 }
1711
1712 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1713 {
1714         struct l2cap_conf_opt *opt = *ptr;
1715
1716         BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1717
1718         opt->type = type;
1719         opt->len  = len;
1720
1721         switch (len) {
1722         case 1:
1723                 *((u8 *) opt->val)  = val;
1724                 break;
1725
1726         case 2:
1727                 *((__le16 *) opt->val) = cpu_to_le16(val);
1728                 break;
1729
1730         case 4:
1731                 *((__le32 *) opt->val) = cpu_to_le32(val);
1732                 break;
1733
1734         default:
1735                 memcpy(opt->val, (void *) val, len);
1736                 break;
1737         }
1738
1739         *ptr += L2CAP_CONF_OPT_SIZE + len;
1740 }
1741
1742 static int l2cap_build_conf_req(struct sock *sk, void *data)
1743 {
1744         struct l2cap_pinfo *pi = l2cap_pi(sk);
1745         struct l2cap_conf_req *req = data;
1746         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
1747         void *ptr = req->data;
1748
1749         BT_DBG("sk %p", sk);
1750
1751         switch (pi->mode) {
1752         case L2CAP_MODE_BASIC:
1753                 if (pi->imtu != L2CAP_DEFAULT_MTU)
1754                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
1755                 break;
1756
1757         case L2CAP_MODE_ERTM:
1758                 rfc.mode            = L2CAP_MODE_ERTM;
1759                 rfc.txwin_size      = L2CAP_DEFAULT_RX_WINDOW;
1760                 rfc.max_transmit    = L2CAP_DEFAULT_MAX_RECEIVE;
1761                 rfc.retrans_timeout = cpu_to_le16(L2CAP_DEFAULT_RETRANS_TO);
1762                 rfc.monitor_timeout = cpu_to_le16(L2CAP_DEFAULT_MONITOR_TO);
1763                 rfc.max_pdu_size    = cpu_to_le16(L2CAP_DEFAULT_MAX_RX_APDU);
1764
1765                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1766                                         sizeof(rfc), (unsigned long) &rfc);
1767                 break;
1768         }
1769
1770         /* FIXME: Need actual value of the flush timeout */
1771         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
1772         //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
1773
1774         req->dcid  = cpu_to_le16(pi->dcid);
1775         req->flags = cpu_to_le16(0);
1776
1777         return ptr - data;
1778 }
1779
1780 static int l2cap_parse_conf_req(struct sock *sk, void *data)
1781 {
1782         struct l2cap_pinfo *pi = l2cap_pi(sk);
1783         struct l2cap_conf_rsp *rsp = data;
1784         void *ptr = rsp->data;
1785         void *req = pi->conf_req;
1786         int len = pi->conf_len;
1787         int type, hint, olen;
1788         unsigned long val;
1789         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
1790         u16 mtu = L2CAP_DEFAULT_MTU;
1791         u16 result = L2CAP_CONF_SUCCESS;
1792
1793         BT_DBG("sk %p", sk);
1794
1795         while (len >= L2CAP_CONF_OPT_SIZE) {
1796                 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1797
1798                 hint  = type & L2CAP_CONF_HINT;
1799                 type &= L2CAP_CONF_MASK;
1800
1801                 switch (type) {
1802                 case L2CAP_CONF_MTU:
1803                         mtu = val;
1804                         break;
1805
1806                 case L2CAP_CONF_FLUSH_TO:
1807                         pi->flush_to = val;
1808                         break;
1809
1810                 case L2CAP_CONF_QOS:
1811                         break;
1812
1813                 case L2CAP_CONF_RFC:
1814                         if (olen == sizeof(rfc))
1815                                 memcpy(&rfc, (void *) val, olen);
1816                         break;
1817
1818                 default:
1819                         if (hint)
1820                                 break;
1821
1822                         result = L2CAP_CONF_UNKNOWN;
1823                         *((u8 *) ptr++) = type;
1824                         break;
1825                 }
1826         }
1827
1828         if (result == L2CAP_CONF_SUCCESS) {
1829                 /* Configure output options and let the other side know
1830                  * which ones we don't like. */
1831
1832                 if (rfc.mode == L2CAP_MODE_BASIC) {
1833                         if (mtu < pi->omtu)
1834                                 result = L2CAP_CONF_UNACCEPT;
1835                         else {
1836                                 pi->omtu = mtu;
1837                                 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
1838                         }
1839
1840                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
1841                 } else {
1842                         result = L2CAP_CONF_UNACCEPT;
1843
1844                         memset(&rfc, 0, sizeof(rfc));
1845                         rfc.mode = L2CAP_MODE_BASIC;
1846
1847                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1848                                         sizeof(rfc), (unsigned long) &rfc);
1849                 }
1850         }
1851
1852         rsp->scid   = cpu_to_le16(pi->dcid);
1853         rsp->result = cpu_to_le16(result);
1854         rsp->flags  = cpu_to_le16(0x0000);
1855
1856         return ptr - data;
1857 }
1858
1859 static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1860 {
1861         struct l2cap_conf_rsp *rsp = data;
1862         void *ptr = rsp->data;
1863
1864         BT_DBG("sk %p", sk);
1865
1866         rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1867         rsp->result = cpu_to_le16(result);
1868         rsp->flags  = cpu_to_le16(flags);
1869
1870         return ptr - data;
1871 }
1872
1873 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1874 {
1875         struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
1876
1877         if (rej->reason != 0x0000)
1878                 return 0;
1879
1880         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
1881                                         cmd->ident == conn->info_ident) {
1882                 del_timer(&conn->info_timer);
1883
1884                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1885                 conn->info_ident = 0;
1886
1887                 l2cap_conn_start(conn);
1888         }
1889
1890         return 0;
1891 }
1892
1893 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1894 {
1895         struct l2cap_chan_list *list = &conn->chan_list;
1896         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
1897         struct l2cap_conn_rsp rsp;
1898         struct sock *sk, *parent;
1899         int result, status = L2CAP_CS_NO_INFO;
1900
1901         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
1902         __le16 psm = req->psm;
1903
1904         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
1905
1906         /* Check if we have socket listening on psm */
1907         parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
1908         if (!parent) {
1909                 result = L2CAP_CR_BAD_PSM;
1910                 goto sendresp;
1911         }
1912
1913         /* Check if the ACL is secure enough (if not SDP) */
1914         if (psm != cpu_to_le16(0x0001) &&
1915                                 !hci_conn_check_link_mode(conn->hcon)) {
1916                 conn->disc_reason = 0x05;
1917                 result = L2CAP_CR_SEC_BLOCK;
1918                 goto response;
1919         }
1920
1921         result = L2CAP_CR_NO_MEM;
1922
1923         /* Check for backlog size */
1924         if (sk_acceptq_is_full(parent)) {
1925                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1926                 goto response;
1927         }
1928
1929         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1930         if (!sk)
1931                 goto response;
1932
1933         write_lock_bh(&list->lock);
1934
1935         /* Check if we already have channel with that dcid */
1936         if (__l2cap_get_chan_by_dcid(list, scid)) {
1937                 write_unlock_bh(&list->lock);
1938                 sock_set_flag(sk, SOCK_ZAPPED);
1939                 l2cap_sock_kill(sk);
1940                 goto response;
1941         }
1942
1943         hci_conn_hold(conn->hcon);
1944
1945         l2cap_sock_init(sk, parent);
1946         bacpy(&bt_sk(sk)->src, conn->src);
1947         bacpy(&bt_sk(sk)->dst, conn->dst);
1948         l2cap_pi(sk)->psm  = psm;
1949         l2cap_pi(sk)->dcid = scid;
1950
1951         __l2cap_chan_add(conn, sk, parent);
1952         dcid = l2cap_pi(sk)->scid;
1953
1954         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1955
1956         l2cap_pi(sk)->ident = cmd->ident;
1957
1958         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
1959                 if (l2cap_check_security(sk)) {
1960                         if (bt_sk(sk)->defer_setup) {
1961                                 sk->sk_state = BT_CONNECT2;
1962                                 result = L2CAP_CR_PEND;
1963                                 status = L2CAP_CS_AUTHOR_PEND;
1964                                 parent->sk_data_ready(parent, 0);
1965                         } else {
1966                                 sk->sk_state = BT_CONFIG;
1967                                 result = L2CAP_CR_SUCCESS;
1968                                 status = L2CAP_CS_NO_INFO;
1969                         }
1970                 } else {
1971                         sk->sk_state = BT_CONNECT2;
1972                         result = L2CAP_CR_PEND;
1973                         status = L2CAP_CS_AUTHEN_PEND;
1974                 }
1975         } else {
1976                 sk->sk_state = BT_CONNECT2;
1977                 result = L2CAP_CR_PEND;
1978                 status = L2CAP_CS_NO_INFO;
1979         }
1980
1981         write_unlock_bh(&list->lock);
1982
1983 response:
1984         bh_unlock_sock(parent);
1985
1986 sendresp:
1987         rsp.scid   = cpu_to_le16(scid);
1988         rsp.dcid   = cpu_to_le16(dcid);
1989         rsp.result = cpu_to_le16(result);
1990         rsp.status = cpu_to_le16(status);
1991         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1992
1993         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
1994                 struct l2cap_info_req info;
1995                 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1996
1997                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1998                 conn->info_ident = l2cap_get_ident(conn);
1999
2000                 mod_timer(&conn->info_timer, jiffies +
2001                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
2002
2003                 l2cap_send_cmd(conn, conn->info_ident,
2004                                         L2CAP_INFO_REQ, sizeof(info), &info);
2005         }
2006
2007         return 0;
2008 }
2009
2010 static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2011 {
2012         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
2013         u16 scid, dcid, result, status;
2014         struct sock *sk;
2015         u8 req[128];
2016
2017         scid   = __le16_to_cpu(rsp->scid);
2018         dcid   = __le16_to_cpu(rsp->dcid);
2019         result = __le16_to_cpu(rsp->result);
2020         status = __le16_to_cpu(rsp->status);
2021
2022         BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
2023
2024         if (scid) {
2025                 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2026                 if (!sk)
2027                         return 0;
2028         } else {
2029                 sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
2030                 if (!sk)
2031                         return 0;
2032         }
2033
2034         switch (result) {
2035         case L2CAP_CR_SUCCESS:
2036                 sk->sk_state = BT_CONFIG;
2037                 l2cap_pi(sk)->ident = 0;
2038                 l2cap_pi(sk)->dcid = dcid;
2039                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
2040
2041                 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
2042
2043                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2044                                         l2cap_build_conf_req(sk, req), req);
2045                 break;
2046
2047         case L2CAP_CR_PEND:
2048                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
2049                 break;
2050
2051         default:
2052                 l2cap_chan_del(sk, ECONNREFUSED);
2053                 break;
2054         }
2055
2056         bh_unlock_sock(sk);
2057         return 0;
2058 }
2059
2060 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
2061 {
2062         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2063         u16 dcid, flags;
2064         u8 rsp[64];
2065         struct sock *sk;
2066         int len;
2067
2068         dcid  = __le16_to_cpu(req->dcid);
2069         flags = __le16_to_cpu(req->flags);
2070
2071         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2072
2073         sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2074         if (!sk)
2075                 return -ENOENT;
2076
2077         if (sk->sk_state == BT_DISCONN)
2078                 goto unlock;
2079
2080         /* Reject if config buffer is too small. */
2081         len = cmd_len - sizeof(*req);
2082         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
2083                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2084                                 l2cap_build_conf_rsp(sk, rsp,
2085                                         L2CAP_CONF_REJECT, flags), rsp);
2086                 goto unlock;
2087         }
2088
2089         /* Store config. */
2090         memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
2091         l2cap_pi(sk)->conf_len += len;
2092
2093         if (flags & 0x0001) {
2094                 /* Incomplete config. Send empty response. */
2095                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2096                                 l2cap_build_conf_rsp(sk, rsp,
2097                                         L2CAP_CONF_SUCCESS, 0x0001), rsp);
2098                 goto unlock;
2099         }
2100
2101         /* Complete config. */
2102         len = l2cap_parse_conf_req(sk, rsp);
2103         if (len < 0)
2104                 goto unlock;
2105
2106         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
2107
2108         /* Reset config buffer. */
2109         l2cap_pi(sk)->conf_len = 0;
2110
2111         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
2112                 goto unlock;
2113
2114         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
2115                 sk->sk_state = BT_CONNECTED;
2116                 l2cap_chan_ready(sk);
2117                 goto unlock;
2118         }
2119
2120         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
2121                 u8 buf[64];
2122                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2123                                         l2cap_build_conf_req(sk, buf), buf);
2124         }
2125
2126 unlock:
2127         bh_unlock_sock(sk);
2128         return 0;
2129 }
2130
2131 static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2132 {
2133         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2134         u16 scid, flags, result;
2135         struct sock *sk;
2136
2137         scid   = __le16_to_cpu(rsp->scid);
2138         flags  = __le16_to_cpu(rsp->flags);
2139         result = __le16_to_cpu(rsp->result);
2140
2141         BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
2142                         scid, flags, result);
2143
2144         sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2145         if (!sk)
2146                 return 0;
2147
2148         switch (result) {
2149         case L2CAP_CONF_SUCCESS:
2150                 break;
2151
2152         case L2CAP_CONF_UNACCEPT:
2153                 if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
2154                         char req[128];
2155                         /* It does not make sense to adjust L2CAP parameters
2156                          * that are currently defined in the spec. We simply
2157                          * resend config request that we sent earlier. It is
2158                          * stupid, but it helps qualification testing which
2159                          * expects at least some response from us. */
2160                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2161                                                 l2cap_build_conf_req(sk, req), req);
2162                         goto done;
2163                 }
2164
2165         default:
2166                 sk->sk_state = BT_DISCONN;
2167                 sk->sk_err = ECONNRESET;
2168                 l2cap_sock_set_timer(sk, HZ * 5);
2169                 {
2170                         struct l2cap_disconn_req req;
2171                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
2172                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2173                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
2174                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
2175                 }
2176                 goto done;
2177         }
2178
2179         if (flags & 0x01)
2180                 goto done;
2181
2182         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
2183
2184         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
2185                 sk->sk_state = BT_CONNECTED;
2186                 l2cap_chan_ready(sk);
2187         }
2188
2189 done:
2190         bh_unlock_sock(sk);
2191         return 0;
2192 }
2193
2194 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2195 {
2196         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2197         struct l2cap_disconn_rsp rsp;
2198         u16 dcid, scid;
2199         struct sock *sk;
2200
2201         scid = __le16_to_cpu(req->scid);
2202         dcid = __le16_to_cpu(req->dcid);
2203
2204         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2205
2206         sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2207         if (!sk)
2208                 return 0;
2209
2210         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
2211         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
2212         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
2213
2214         sk->sk_shutdown = SHUTDOWN_MASK;
2215
2216         l2cap_chan_del(sk, ECONNRESET);
2217         bh_unlock_sock(sk);
2218
2219         l2cap_sock_kill(sk);
2220         return 0;
2221 }
2222
2223 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2224 {
2225         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
2226         u16 dcid, scid;
2227         struct sock *sk;
2228
2229         scid = __le16_to_cpu(rsp->scid);
2230         dcid = __le16_to_cpu(rsp->dcid);
2231
2232         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
2233
2234         sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2235         if (!sk)
2236                 return 0;
2237
2238         l2cap_chan_del(sk, 0);
2239         bh_unlock_sock(sk);
2240
2241         l2cap_sock_kill(sk);
2242         return 0;
2243 }
2244
2245 static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2246 {
2247         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
2248         u16 type;
2249
2250         type = __le16_to_cpu(req->type);
2251
2252         BT_DBG("type 0x%4.4x", type);
2253
2254         if (type == L2CAP_IT_FEAT_MASK) {
2255                 u8 buf[8];
2256                 u32 feat_mask = l2cap_feat_mask;
2257                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2258                 rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2259                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2260                 if (enable_ertm)
2261                         feat_mask |= L2CAP_FEAT_ERTM;
2262                 put_unaligned(cpu_to_le32(feat_mask), (__le32 *) rsp->data);
2263                 l2cap_send_cmd(conn, cmd->ident,
2264                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2265         } else if (type == L2CAP_IT_FIXED_CHAN) {
2266                 u8 buf[12];
2267                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2268                 rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2269                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2270                 memcpy(buf + 4, l2cap_fixed_chan, 8);
2271                 l2cap_send_cmd(conn, cmd->ident,
2272                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2273         } else {
2274                 struct l2cap_info_rsp rsp;
2275                 rsp.type   = cpu_to_le16(type);
2276                 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2277                 l2cap_send_cmd(conn, cmd->ident,
2278                                         L2CAP_INFO_RSP, sizeof(rsp), &rsp);
2279         }
2280
2281         return 0;
2282 }
2283
2284 static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2285 {
2286         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
2287         u16 type, result;
2288
2289         type   = __le16_to_cpu(rsp->type);
2290         result = __le16_to_cpu(rsp->result);
2291
2292         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
2293
2294         del_timer(&conn->info_timer);
2295
2296         if (type == L2CAP_IT_FEAT_MASK) {
2297                 conn->feat_mask = get_unaligned_le32(rsp->data);
2298
2299                 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
2300                         struct l2cap_info_req req;
2301                         req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2302
2303                         conn->info_ident = l2cap_get_ident(conn);
2304
2305                         l2cap_send_cmd(conn, conn->info_ident,
2306                                         L2CAP_INFO_REQ, sizeof(req), &req);
2307                 } else {
2308                         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2309                         conn->info_ident = 0;
2310
2311                         l2cap_conn_start(conn);
2312                 }
2313         } else if (type == L2CAP_IT_FIXED_CHAN) {
2314                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2315                 conn->info_ident = 0;
2316
2317                 l2cap_conn_start(conn);
2318         }
2319
2320         return 0;
2321 }
2322
2323 static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
2324 {
2325         u8 *data = skb->data;
2326         int len = skb->len;
2327         struct l2cap_cmd_hdr cmd;
2328         int err = 0;
2329
2330         l2cap_raw_recv(conn, skb);
2331
2332         while (len >= L2CAP_CMD_HDR_SIZE) {
2333                 u16 cmd_len;
2334                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
2335                 data += L2CAP_CMD_HDR_SIZE;
2336                 len  -= L2CAP_CMD_HDR_SIZE;
2337
2338                 cmd_len = le16_to_cpu(cmd.len);
2339
2340                 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
2341
2342                 if (cmd_len > len || !cmd.ident) {
2343                         BT_DBG("corrupted command");
2344                         break;
2345                 }
2346
2347                 switch (cmd.code) {
2348                 case L2CAP_COMMAND_REJ:
2349                         l2cap_command_rej(conn, &cmd, data);
2350                         break;
2351
2352                 case L2CAP_CONN_REQ:
2353                         err = l2cap_connect_req(conn, &cmd, data);
2354                         break;
2355
2356                 case L2CAP_CONN_RSP:
2357                         err = l2cap_connect_rsp(conn, &cmd, data);
2358                         break;
2359
2360                 case L2CAP_CONF_REQ:
2361                         err = l2cap_config_req(conn, &cmd, cmd_len, data);
2362                         break;
2363
2364                 case L2CAP_CONF_RSP:
2365                         err = l2cap_config_rsp(conn, &cmd, data);
2366                         break;
2367
2368                 case L2CAP_DISCONN_REQ:
2369                         err = l2cap_disconnect_req(conn, &cmd, data);
2370                         break;
2371
2372                 case L2CAP_DISCONN_RSP:
2373                         err = l2cap_disconnect_rsp(conn, &cmd, data);
2374                         break;
2375
2376                 case L2CAP_ECHO_REQ:
2377                         l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
2378                         break;
2379
2380                 case L2CAP_ECHO_RSP:
2381                         break;
2382
2383                 case L2CAP_INFO_REQ:
2384                         err = l2cap_information_req(conn, &cmd, data);
2385                         break;
2386
2387                 case L2CAP_INFO_RSP:
2388                         err = l2cap_information_rsp(conn, &cmd, data);
2389                         break;
2390
2391                 default:
2392                         BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
2393                         err = -EINVAL;
2394                         break;
2395                 }
2396
2397                 if (err) {
2398                         struct l2cap_cmd_rej rej;
2399                         BT_DBG("error %d", err);
2400
2401                         /* FIXME: Map err to a valid reason */
2402                         rej.reason = cpu_to_le16(0);
2403                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
2404                 }
2405
2406                 data += cmd_len;
2407                 len  -= cmd_len;
2408         }
2409
2410         kfree_skb(skb);
2411 }
2412
2413 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
2414 {
2415         struct sock *sk;
2416
2417         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
2418         if (!sk) {
2419                 BT_DBG("unknown cid 0x%4.4x", cid);
2420                 goto drop;
2421         }
2422
2423         BT_DBG("sk %p, len %d", sk, skb->len);
2424
2425         if (sk->sk_state != BT_CONNECTED)
2426                 goto drop;
2427
2428         if (l2cap_pi(sk)->imtu < skb->len)
2429                 goto drop;
2430
2431         /* If socket recv buffers overflows we drop data here
2432          * which is *bad* because L2CAP has to be reliable.
2433          * But we don't have any other choice. L2CAP doesn't
2434          * provide flow control mechanism. */
2435
2436         if (!sock_queue_rcv_skb(sk, skb))
2437                 goto done;
2438
2439 drop:
2440         kfree_skb(skb);
2441
2442 done:
2443         if (sk)
2444                 bh_unlock_sock(sk);
2445
2446         return 0;
2447 }
2448
2449 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
2450 {
2451         struct sock *sk;
2452
2453         sk = l2cap_get_sock_by_psm(0, psm, conn->src);
2454         if (!sk)
2455                 goto drop;
2456
2457         BT_DBG("sk %p, len %d", sk, skb->len);
2458
2459         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
2460                 goto drop;
2461
2462         if (l2cap_pi(sk)->imtu < skb->len)
2463                 goto drop;
2464
2465         if (!sock_queue_rcv_skb(sk, skb))
2466                 goto done;
2467
2468 drop:
2469         kfree_skb(skb);
2470
2471 done:
2472         if (sk)
2473                 bh_unlock_sock(sk);
2474         return 0;
2475 }
2476
2477 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
2478 {
2479         struct l2cap_hdr *lh = (void *) skb->data;
2480         u16 cid, len;
2481         __le16 psm;
2482
2483         skb_pull(skb, L2CAP_HDR_SIZE);
2484         cid = __le16_to_cpu(lh->cid);
2485         len = __le16_to_cpu(lh->len);
2486
2487         BT_DBG("len %d, cid 0x%4.4x", len, cid);
2488
2489         switch (cid) {
2490         case L2CAP_CID_SIGNALING:
2491                 l2cap_sig_channel(conn, skb);
2492                 break;
2493
2494         case L2CAP_CID_CONN_LESS:
2495                 psm = get_unaligned((__le16 *) skb->data);
2496                 skb_pull(skb, 2);
2497                 l2cap_conless_channel(conn, psm, skb);
2498                 break;
2499
2500         default:
2501                 l2cap_data_channel(conn, cid, skb);
2502                 break;
2503         }
2504 }
2505
2506 /* ---- L2CAP interface with lower layer (HCI) ---- */
2507
2508 static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2509 {
2510         int exact = 0, lm1 = 0, lm2 = 0;
2511         register struct sock *sk;
2512         struct hlist_node *node;
2513
2514         if (type != ACL_LINK)
2515                 return 0;
2516
2517         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
2518
2519         /* Find listening sockets and check their link_mode */
2520         read_lock(&l2cap_sk_list.lock);
2521         sk_for_each(sk, node, &l2cap_sk_list.head) {
2522                 if (sk->sk_state != BT_LISTEN)
2523                         continue;
2524
2525                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2526                         lm1 |= HCI_LM_ACCEPT;
2527                         if (l2cap_pi(sk)->role_switch)
2528                                 lm1 |= HCI_LM_MASTER;
2529                         exact++;
2530                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
2531                         lm2 |= HCI_LM_ACCEPT;
2532                         if (l2cap_pi(sk)->role_switch)
2533                                 lm2 |= HCI_LM_MASTER;
2534                 }
2535         }
2536         read_unlock(&l2cap_sk_list.lock);
2537
2538         return exact ? lm1 : lm2;
2539 }
2540
2541 static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
2542 {
2543         struct l2cap_conn *conn;
2544
2545         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
2546
2547         if (hcon->type != ACL_LINK)
2548                 return 0;
2549
2550         if (!status) {
2551                 conn = l2cap_conn_add(hcon, status);
2552                 if (conn)
2553                         l2cap_conn_ready(conn);
2554         } else
2555                 l2cap_conn_del(hcon, bt_err(status));
2556
2557         return 0;
2558 }
2559
2560 static int l2cap_disconn_ind(struct hci_conn *hcon)
2561 {
2562         struct l2cap_conn *conn = hcon->l2cap_data;
2563
2564         BT_DBG("hcon %p", hcon);
2565
2566         if (hcon->type != ACL_LINK || !conn)
2567                 return 0x13;
2568
2569         return conn->disc_reason;
2570 }
2571
2572 static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
2573 {
2574         BT_DBG("hcon %p reason %d", hcon, reason);
2575
2576         if (hcon->type != ACL_LINK)
2577                 return 0;
2578
2579         l2cap_conn_del(hcon, bt_err(reason));
2580
2581         return 0;
2582 }
2583
2584 static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
2585 {
2586         if (sk->sk_type != SOCK_SEQPACKET)
2587                 return;
2588
2589         if (encrypt == 0x00) {
2590                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
2591                         l2cap_sock_clear_timer(sk);
2592                         l2cap_sock_set_timer(sk, HZ * 5);
2593                 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
2594                         __l2cap_sock_close(sk, ECONNREFUSED);
2595         } else {
2596                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
2597                         l2cap_sock_clear_timer(sk);
2598         }
2599 }
2600
2601 static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
2602 {
2603         struct l2cap_chan_list *l;
2604         struct l2cap_conn *conn = hcon->l2cap_data;
2605         struct sock *sk;
2606
2607         if (!conn)
2608                 return 0;
2609
2610         l = &conn->chan_list;
2611
2612         BT_DBG("conn %p", conn);
2613
2614         read_lock(&l->lock);
2615
2616         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2617                 bh_lock_sock(sk);
2618
2619                 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
2620                         bh_unlock_sock(sk);
2621                         continue;
2622                 }
2623
2624                 if (!status && (sk->sk_state == BT_CONNECTED ||
2625                                                 sk->sk_state == BT_CONFIG)) {
2626                         l2cap_check_encryption(sk, encrypt);
2627                         bh_unlock_sock(sk);
2628                         continue;
2629                 }
2630
2631                 if (sk->sk_state == BT_CONNECT) {
2632                         if (!status) {
2633                                 struct l2cap_conn_req req;
2634                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2635                                 req.psm  = l2cap_pi(sk)->psm;
2636
2637                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
2638
2639                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2640                                         L2CAP_CONN_REQ, sizeof(req), &req);
2641                         } else {
2642                                 l2cap_sock_clear_timer(sk);
2643                                 l2cap_sock_set_timer(sk, HZ / 10);
2644                         }
2645                 } else if (sk->sk_state == BT_CONNECT2) {
2646                         struct l2cap_conn_rsp rsp;
2647                         __u16 result;
2648
2649                         if (!status) {
2650                                 sk->sk_state = BT_CONFIG;
2651                                 result = L2CAP_CR_SUCCESS;
2652                         } else {
2653                                 sk->sk_state = BT_DISCONN;
2654                                 l2cap_sock_set_timer(sk, HZ / 10);
2655                                 result = L2CAP_CR_SEC_BLOCK;
2656                         }
2657
2658                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
2659                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
2660                         rsp.result = cpu_to_le16(result);
2661                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2662                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2663                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2664                 }
2665
2666                 bh_unlock_sock(sk);
2667         }
2668
2669         read_unlock(&l->lock);
2670
2671         return 0;
2672 }
2673
2674 static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
2675 {
2676         struct l2cap_conn *conn = hcon->l2cap_data;
2677
2678         if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
2679                 goto drop;
2680
2681         BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
2682
2683         if (flags & ACL_START) {
2684                 struct l2cap_hdr *hdr;
2685                 int len;
2686
2687                 if (conn->rx_len) {
2688                         BT_ERR("Unexpected start frame (len %d)", skb->len);
2689                         kfree_skb(conn->rx_skb);
2690                         conn->rx_skb = NULL;
2691                         conn->rx_len = 0;
2692                         l2cap_conn_unreliable(conn, ECOMM);
2693                 }
2694
2695                 if (skb->len < 2) {
2696                         BT_ERR("Frame is too short (len %d)", skb->len);
2697                         l2cap_conn_unreliable(conn, ECOMM);
2698                         goto drop;
2699                 }
2700
2701                 hdr = (struct l2cap_hdr *) skb->data;
2702                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
2703
2704                 if (len == skb->len) {
2705                         /* Complete frame received */
2706                         l2cap_recv_frame(conn, skb);
2707                         return 0;
2708                 }
2709
2710                 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
2711
2712                 if (skb->len > len) {
2713                         BT_ERR("Frame is too long (len %d, expected len %d)",
2714                                 skb->len, len);
2715                         l2cap_conn_unreliable(conn, ECOMM);
2716                         goto drop;
2717                 }
2718
2719                 /* Allocate skb for the complete frame (with header) */
2720                 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
2721                 if (!conn->rx_skb)
2722                         goto drop;
2723
2724                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2725                                                                 skb->len);
2726                 conn->rx_len = len - skb->len;
2727         } else {
2728                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
2729
2730                 if (!conn->rx_len) {
2731                         BT_ERR("Unexpected continuation frame (len %d)", skb->len);
2732                         l2cap_conn_unreliable(conn, ECOMM);
2733                         goto drop;
2734                 }
2735
2736                 if (skb->len > conn->rx_len) {
2737                         BT_ERR("Fragment is too long (len %d, expected %d)",
2738                                         skb->len, conn->rx_len);
2739                         kfree_skb(conn->rx_skb);
2740                         conn->rx_skb = NULL;
2741                         conn->rx_len = 0;
2742                         l2cap_conn_unreliable(conn, ECOMM);
2743                         goto drop;
2744                 }
2745
2746                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2747                                                                 skb->len);
2748                 conn->rx_len -= skb->len;
2749
2750                 if (!conn->rx_len) {
2751                         /* Complete frame received */
2752                         l2cap_recv_frame(conn, conn->rx_skb);
2753                         conn->rx_skb = NULL;
2754                 }
2755         }
2756
2757 drop:
2758         kfree_skb(skb);
2759         return 0;
2760 }
2761
2762 static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
2763 {
2764         struct sock *sk;
2765         struct hlist_node *node;
2766         char *str = buf;
2767
2768         read_lock_bh(&l2cap_sk_list.lock);
2769
2770         sk_for_each(sk, node, &l2cap_sk_list.head) {
2771                 struct l2cap_pinfo *pi = l2cap_pi(sk);
2772
2773                 str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
2774                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2775                                 sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
2776                                 pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
2777         }
2778
2779         read_unlock_bh(&l2cap_sk_list.lock);
2780
2781         return str - buf;
2782 }
2783
2784 static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
2785
2786 static const struct proto_ops l2cap_sock_ops = {
2787         .family         = PF_BLUETOOTH,
2788         .owner          = THIS_MODULE,
2789         .release        = l2cap_sock_release,
2790         .bind           = l2cap_sock_bind,
2791         .connect        = l2cap_sock_connect,
2792         .listen         = l2cap_sock_listen,
2793         .accept         = l2cap_sock_accept,
2794         .getname        = l2cap_sock_getname,
2795         .sendmsg        = l2cap_sock_sendmsg,
2796         .recvmsg        = l2cap_sock_recvmsg,
2797         .poll           = bt_sock_poll,
2798         .ioctl          = bt_sock_ioctl,
2799         .mmap           = sock_no_mmap,
2800         .socketpair     = sock_no_socketpair,
2801         .shutdown       = l2cap_sock_shutdown,
2802         .setsockopt     = l2cap_sock_setsockopt,
2803         .getsockopt     = l2cap_sock_getsockopt
2804 };
2805
2806 static struct net_proto_family l2cap_sock_family_ops = {
2807         .family = PF_BLUETOOTH,
2808         .owner  = THIS_MODULE,
2809         .create = l2cap_sock_create,
2810 };
2811
2812 static struct hci_proto l2cap_hci_proto = {
2813         .name           = "L2CAP",
2814         .id             = HCI_PROTO_L2CAP,
2815         .connect_ind    = l2cap_connect_ind,
2816         .connect_cfm    = l2cap_connect_cfm,
2817         .disconn_ind    = l2cap_disconn_ind,
2818         .disconn_cfm    = l2cap_disconn_cfm,
2819         .security_cfm   = l2cap_security_cfm,
2820         .recv_acldata   = l2cap_recv_acldata
2821 };
2822
2823 static int __init l2cap_init(void)
2824 {
2825         int err;
2826
2827         err = proto_register(&l2cap_proto, 0);
2828         if (err < 0)
2829                 return err;
2830
2831         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2832         if (err < 0) {
2833                 BT_ERR("L2CAP socket registration failed");
2834                 goto error;
2835         }
2836
2837         err = hci_register_proto(&l2cap_hci_proto);
2838         if (err < 0) {
2839                 BT_ERR("L2CAP protocol registration failed");
2840                 bt_sock_unregister(BTPROTO_L2CAP);
2841                 goto error;
2842         }
2843
2844         if (class_create_file(bt_class, &class_attr_l2cap) < 0)
2845                 BT_ERR("Failed to create L2CAP info file");
2846
2847         BT_INFO("L2CAP ver %s", VERSION);
2848         BT_INFO("L2CAP socket layer initialized");
2849
2850         return 0;
2851
2852 error:
2853         proto_unregister(&l2cap_proto);
2854         return err;
2855 }
2856
2857 static void __exit l2cap_exit(void)
2858 {
2859         class_remove_file(bt_class, &class_attr_l2cap);
2860
2861         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
2862                 BT_ERR("L2CAP socket unregistration failed");
2863
2864         if (hci_unregister_proto(&l2cap_hci_proto) < 0)
2865                 BT_ERR("L2CAP protocol unregistration failed");
2866
2867         proto_unregister(&l2cap_proto);
2868 }
2869
2870 void l2cap_load(void)
2871 {
2872         /* Dummy function to trigger automatic L2CAP module loading by
2873          * other modules that use L2CAP sockets but don't use any other
2874          * symbols from it. */
2875         return;
2876 }
2877 EXPORT_SYMBOL(l2cap_load);
2878
2879 module_init(l2cap_init);
2880 module_exit(l2cap_exit);
2881
2882 module_param(enable_ertm, bool, 0644);
2883 MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
2884
2885 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2886 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2887 MODULE_VERSION(VERSION);
2888 MODULE_LICENSE("GPL");
2889 MODULE_ALIAS("bt-proto-0");