net/bluetooth/l2cap.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth L2CAP core and sockets. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/capability.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <net/sock.h>
  44
  45 #include <asm/system.h>
  46 #include <asm/uaccess.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/hci_core.h>
  51 #include <net/bluetooth/l2cap.h>
  52
  53 #define VERSION "2.13"
  54
  55 static u32 l2cap_feat_mask = 0x0080;
  56 static u8 l2cap_fixed_chan[8] = { 0x02, };
  57
  58 static const struct proto_ops l2cap_sock_ops;
  59
  60 static struct bt_sock_list l2cap_sk_list = {
  61         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  62 };
  63
  64 static void __l2cap_sock_close(struct sock *sk, int reason);
  65 static void l2cap_sock_close(struct sock *sk);
  66 static void l2cap_sock_kill(struct sock *sk);
  67
  68 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  69                                 u8 code, u8 ident, u16 dlen, void *data);
  70
  71 /* ---- L2CAP timers ---- */
  72 static void l2cap_sock_timeout(unsigned long arg)
  73 {
  74         struct sock *sk = (struct sock *) arg;
  75         int reason;
  76
  77         BT_DBG("sock %p state %d", sk, sk->sk_state);
  78
  79         bh_lock_sock(sk);
  80
  81         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
  82                 reason = ECONNREFUSED;
  83         else if (sk->sk_state == BT_CONNECT &&
  84                                 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
  85                 reason = ECONNREFUSED;
  86         else
  87                 reason = ETIMEDOUT;
  88
  89         __l2cap_sock_close(sk, reason);
  90
  91         bh_unlock_sock(sk);
  92
  93         l2cap_sock_kill(sk);
  94         sock_put(sk);
  95 }
  96
  97 static void l2cap_sock_set_timer(struct sock *sk, long timeout)
  98 {
  99         BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
 100         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
 101 }
 102
 103 static void l2cap_sock_clear_timer(struct sock *sk)
 104 {
 105         BT_DBG("sock %p state %d", sk, sk->sk_state);
 106         sk_stop_timer(sk, &sk->sk_timer);
 107 }
 108
 109 /* ---- L2CAP channels ---- */
 110 static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
 111 {
 112         struct sock *s;
 113         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 114                 if (l2cap_pi(s)->dcid == cid)
 115                         break;
 116         }
 117         return s;
 118 }
 119
 120 static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 121 {
 122         struct sock *s;
 123         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 124                 if (l2cap_pi(s)->scid == cid)
 125                         break;
 126         }
 127         return s;
 128 }
 129
 130 /* Find channel with given SCID.
 131  * Returns locked socket */
 132 static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 133 {
 134         struct sock *s;
 135         read_lock(&l->lock);
 136         s = __l2cap_get_chan_by_scid(l, cid);
 137         if (s) bh_lock_sock(s);
 138         read_unlock(&l->lock);
 139         return s;
 140 }
 141
 142 static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 143 {
 144         struct sock *s;
 145         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 146                 if (l2cap_pi(s)->ident == ident)
 147                         break;
 148         }
 149         return s;
 150 }
 151
 152 static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 153 {
 154         struct sock *s;
 155         read_lock(&l->lock);
 156         s = __l2cap_get_chan_by_ident(l, ident);
 157         if (s) bh_lock_sock(s);
 158         read_unlock(&l->lock);
 159         return s;
 160 }
 161
 162 static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
 163 {
 164         u16 cid = 0x0040;
 165
 166         for (; cid < 0xffff; cid++) {
 167                 if(!__l2cap_get_chan_by_scid(l, cid))
 168                         return cid;
 169         }
 170
 171         return 0;
 172 }
 173
 174 static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
 175 {
 176         sock_hold(sk);
 177
 178         if (l->head)
 179                 l2cap_pi(l->head)->prev_c = sk;
 180
 181         l2cap_pi(sk)->next_c = l->head;
 182         l2cap_pi(sk)->prev_c = NULL;
 183         l->head = sk;
 184 }
 185
 186 static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 187 {
 188         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 189
 190         write_lock_bh(&l->lock);
 191         if (sk == l->head)
 192                 l->head = next;
 193
 194         if (next)
 195                 l2cap_pi(next)->prev_c = prev;
 196         if (prev)
 197                 l2cap_pi(prev)->next_c = next;
 198         write_unlock_bh(&l->lock);
 199
 200         __sock_put(sk);
 201 }
 202
 203 static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 204 {
 205         struct l2cap_chan_list *l = &conn->chan_list;
 206
 207         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
 208
 209         l2cap_pi(sk)->conn = conn;
 210
 211         if (sk->sk_type == SOCK_SEQPACKET) {
 212                 /* Alloc CID for connection-oriented socket */
 213                 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
 214         } else if (sk->sk_type == SOCK_DGRAM) {
 215                 /* Connectionless socket */
 216                 l2cap_pi(sk)->scid = 0x0002;
 217                 l2cap_pi(sk)->dcid = 0x0002;
 218                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 219         } else {
 220                 /* Raw socket can send/recv signalling messages only */
 221                 l2cap_pi(sk)->scid = 0x0001;
 222                 l2cap_pi(sk)->dcid = 0x0001;
 223                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 224         }
 225
 226         __l2cap_chan_link(l, sk);
 227
 228         if (parent)
 229                 bt_accept_enqueue(parent, sk);
 230 }
 231
 232 /* Delete channel.
 233  * Must be called on the locked socket. */
 234 static void l2cap_chan_del(struct sock *sk, int err)
 235 {
 236         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 237         struct sock *parent = bt_sk(sk)->parent;
 238
 239         l2cap_sock_clear_timer(sk);
 240
 241         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 242
 243         if (conn) {
 244                 /* Unlink from channel list */
 245                 l2cap_chan_unlink(&conn->chan_list, sk);
 246                 l2cap_pi(sk)->conn = NULL;
 247                 hci_conn_put(conn->hcon);
 248         }
 249
 250         sk->sk_state = BT_CLOSED;
 251         sock_set_flag(sk, SOCK_ZAPPED);
 252
 253         if (err)
 254                 sk->sk_err = err;
 255
 256         if (parent) {
 257                 bt_accept_unlink(sk);
 258                 parent->sk_data_ready(parent, 0);
 259         } else
 260                 sk->sk_state_change(sk);
 261 }
 262
 263 /* Service level security */
 264 static inline int l2cap_check_security(struct sock *sk)
 265 {
 266         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 267         __u8 auth_type;
 268
 269         switch (l2cap_pi(sk)->sec_level) {
 270         case BT_SECURITY_HIGH:
 271                 auth_type = HCI_AT_GENERAL_BONDING_MITM;
 272                 break;
 273         case BT_SECURITY_MEDIUM:
 274                 auth_type = HCI_AT_GENERAL_BONDING;
 275                 break;
 276         default:
 277                 auth_type = HCI_AT_NO_BONDING;
 278                 break;
 279         }
 280
 281         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
 282                                                                 auth_type);
 283 }
 284
 285 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
 286 {
 287         u8 id;
 288
 289         /* Get next available identificator.
 290          *    1 - 128 are used by kernel.
 291          *  129 - 199 are reserved.
 292          *  200 - 254 are used by utilities like l2ping, etc.
 293          */
 294
 295         spin_lock_bh(&conn->lock);
 296
 297         if (++conn->tx_ident > 128)
 298                 conn->tx_ident = 1;
 299
 300         id = conn->tx_ident;
 301
 302         spin_unlock_bh(&conn->lock);
 303
 304         return id;
 305 }
 306
 307 static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 308 {
 309         struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 310
 311         BT_DBG("code 0x%2.2x", code);
 312
 313         if (!skb)
 314                 return -ENOMEM;
 315
 316         return hci_send_acl(conn->hcon, skb, 0);
 317 }
 318
 319 static void l2cap_do_start(struct sock *sk)
 320 {
 321         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 322
 323         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
 324                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 325                         return;
 326
 327                 if (l2cap_check_security(sk)) {
 328                         struct l2cap_conn_req req;
 329                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 330                         req.psm  = l2cap_pi(sk)->psm;
 331
 332                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 333
 334                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 335                                         L2CAP_CONN_REQ, sizeof(req), &req);
 336                 }
 337         } else {
 338                 struct l2cap_info_req req;
 339                 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 340
 341                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
 342                 conn->info_ident = l2cap_get_ident(conn);
 343
 344                 mod_timer(&conn->info_timer, jiffies +
 345                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
 346
 347                 l2cap_send_cmd(conn, conn->info_ident,
 348                                         L2CAP_INFO_REQ, sizeof(req), &req);
 349         }
 350 }
 351
 352 /* ---- L2CAP connections ---- */
 353 static void l2cap_conn_start(struct l2cap_conn *conn)
 354 {
 355         struct l2cap_chan_list *l = &conn->chan_list;
 356         struct sock *sk;
 357
 358         BT_DBG("conn %p", conn);
 359
 360         read_lock(&l->lock);
 361
 362         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 363                 bh_lock_sock(sk);
 364
 365                 if (sk->sk_type != SOCK_SEQPACKET) {
 366                         bh_unlock_sock(sk);
 367                         continue;
 368                 }
 369
 370                 if (sk->sk_state == BT_CONNECT) {
 371                         if (l2cap_check_security(sk)) {
 372                                 struct l2cap_conn_req req;
 373                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 374                                 req.psm  = l2cap_pi(sk)->psm;
 375
 376                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 377
 378                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 379                                         L2CAP_CONN_REQ, sizeof(req), &req);
 380                         }
 381                 } else if (sk->sk_state == BT_CONNECT2) {
 382                         struct l2cap_conn_rsp rsp;
 383                         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
 384                         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
 385
 386                         if (l2cap_check_security(sk)) {
 387                                 if (bt_sk(sk)->defer_setup) {
 388                                         struct sock *parent = bt_sk(sk)->parent;
 389                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 390                                         rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
 391                                         parent->sk_data_ready(parent, 0);
 392
 393                                 } else {
 394                                         sk->sk_state = BT_CONFIG;
 395                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 396                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 397                                 }
 398                         } else {
 399                                 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 400                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
 401                         }
 402
 403                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 404                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 405                 }
 406
 407                 bh_unlock_sock(sk);
 408         }
 409
 410         read_unlock(&l->lock);
 411 }
 412
 413 static void l2cap_conn_ready(struct l2cap_conn *conn)
 414 {
 415         struct l2cap_chan_list *l = &conn->chan_list;
 416         struct sock *sk;
 417
 418         BT_DBG("conn %p", conn);
 419
 420         read_lock(&l->lock);
 421
 422         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 423                 bh_lock_sock(sk);
 424
 425                 if (sk->sk_type != SOCK_SEQPACKET) {
 426                         l2cap_sock_clear_timer(sk);
 427                         sk->sk_state = BT_CONNECTED;
 428                         sk->sk_state_change(sk);
 429                 } else if (sk->sk_state == BT_CONNECT)
 430                         l2cap_do_start(sk);
 431
 432                 bh_unlock_sock(sk);
 433         }
 434
 435         read_unlock(&l->lock);
 436 }
 437
 438 /* Notify sockets that we cannot guaranty reliability anymore */
 439 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 440 {
 441         struct l2cap_chan_list *l = &conn->chan_list;
 442         struct sock *sk;
 443
 444         BT_DBG("conn %p", conn);
 445
 446         read_lock(&l->lock);
 447
 448         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 449                 if (l2cap_pi(sk)->force_reliable)
 450                         sk->sk_err = err;
 451         }
 452
 453         read_unlock(&l->lock);
 454 }
 455
 456 static void l2cap_info_timeout(unsigned long arg)
 457 {
 458         struct l2cap_conn *conn = (void *) arg;
 459
 460         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 461         conn->info_ident = 0;
 462
 463         l2cap_conn_start(conn);
 464 }
 465
 466 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 467 {
 468         struct l2cap_conn *conn = hcon->l2cap_data;
 469
 470         if (conn || status)
 471                 return conn;
 472
 473         conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
 474         if (!conn)
 475                 return NULL;
 476
 477         hcon->l2cap_data = conn;
 478         conn->hcon = hcon;
 479
 480         BT_DBG("hcon %p conn %p", hcon, conn);
 481
 482         conn->mtu = hcon->hdev->acl_mtu;
 483         conn->src = &hcon->hdev->bdaddr;
 484         conn->dst = &hcon->dst;
 485
 486         conn->feat_mask = 0;
 487
 488         setup_timer(&conn->info_timer, l2cap_info_timeout,
 489                                                 (unsigned long) conn);
 490
 491         spin_lock_init(&conn->lock);
 492         rwlock_init(&conn->chan_list.lock);
 493
 494         return conn;
 495 }
 496
 497 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 498 {
 499         struct l2cap_conn *conn = hcon->l2cap_data;
 500         struct sock *sk;
 501
 502         if (!conn)
 503                 return;
 504
 505         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 506
 507         if (conn->rx_skb)
 508                 kfree_skb(conn->rx_skb);
 509
 510         /* Kill channels */
 511         while ((sk = conn->chan_list.head)) {
 512                 bh_lock_sock(sk);
 513                 l2cap_chan_del(sk, err);
 514                 bh_unlock_sock(sk);
 515                 l2cap_sock_kill(sk);
 516         }
 517
 518         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 519                 del_timer_sync(&conn->info_timer);
 520
 521         hcon->l2cap_data = NULL;
 522         kfree(conn);
 523 }
 524
 525 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 526 {
 527         struct l2cap_chan_list *l = &conn->chan_list;
 528         write_lock_bh(&l->lock);
 529         __l2cap_chan_add(conn, sk, parent);
 530         write_unlock_bh(&l->lock);
 531 }
 532
 533 /* ---- Socket interface ---- */
 534 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 535 {
 536         struct sock *sk;
 537         struct hlist_node *node;
 538         sk_for_each(sk, node, &l2cap_sk_list.head)
 539                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
 540                         goto found;
 541         sk = NULL;
 542 found:
 543         return sk;
 544 }
 545
 546 /* Find socket with psm and source bdaddr.
 547  * Returns closest match.
 548  */
 549 static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 550 {
 551         struct sock *sk = NULL, *sk1 = NULL;
 552         struct hlist_node *node;
 553
 554         sk_for_each(sk, node, &l2cap_sk_list.head) {
 555                 if (state && sk->sk_state != state)
 556                         continue;
 557
 558                 if (l2cap_pi(sk)->psm == psm) {
 559                         /* Exact match. */
 560                         if (!bacmp(&bt_sk(sk)->src, src))
 561                                 break;
 562
 563                         /* Closest match */
 564                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 565                                 sk1 = sk;
 566                 }
 567         }
 568         return node ? sk : sk1;
 569 }
 570
 571 /* Find socket with given address (psm, src).
 572  * Returns locked socket */
 573 static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 574 {
 575         struct sock *s;
 576         read_lock(&l2cap_sk_list.lock);
 577         s = __l2cap_get_sock_by_psm(state, psm, src);
 578         if (s) bh_lock_sock(s);
 579         read_unlock(&l2cap_sk_list.lock);
 580         return s;
 581 }
 582
 583 static void l2cap_sock_destruct(struct sock *sk)
 584 {
 585         BT_DBG("sk %p", sk);
 586
 587         skb_queue_purge(&sk->sk_receive_queue);
 588         skb_queue_purge(&sk->sk_write_queue);
 589 }
 590
 591 static void l2cap_sock_cleanup_listen(struct sock *parent)
 592 {
 593         struct sock *sk;
 594
 595         BT_DBG("parent %p", parent);
 596
 597         /* Close not yet accepted channels */
 598         while ((sk = bt_accept_dequeue(parent, NULL)))
 599                 l2cap_sock_close(sk);
 600
 601         parent->sk_state = BT_CLOSED;
 602         sock_set_flag(parent, SOCK_ZAPPED);
 603 }
 604
 605 /* Kill socket (only if zapped and orphan)
 606  * Must be called on unlocked socket.
 607  */
 608 static void l2cap_sock_kill(struct sock *sk)
 609 {
 610         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 611                 return;
 612
 613         BT_DBG("sk %p state %d", sk, sk->sk_state);
 614
 615         /* Kill poor orphan */
 616         bt_sock_unlink(&l2cap_sk_list, sk);
 617         sock_set_flag(sk, SOCK_DEAD);
 618         sock_put(sk);
 619 }
 620
 621 static void __l2cap_sock_close(struct sock *sk, int reason)
 622 {
 623         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 624
 625         switch (sk->sk_state) {
 626         case BT_LISTEN:
 627                 l2cap_sock_cleanup_listen(sk);
 628                 break;
 629
 630         case BT_CONNECTED:
 631         case BT_CONFIG:
 632                 if (sk->sk_type == SOCK_SEQPACKET) {
 633                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 634                         struct l2cap_disconn_req req;
 635
 636                         sk->sk_state = BT_DISCONN;
 637                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 638
 639                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
 640                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 641                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
 642                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 643                 } else
 644                         l2cap_chan_del(sk, reason);
 645                 break;
 646
 647         case BT_CONNECT2:
 648                 if (sk->sk_type == SOCK_SEQPACKET) {
 649                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 650                         struct l2cap_conn_rsp rsp;
 651                         __u16 result;
 652
 653                         if (bt_sk(sk)->defer_setup)
 654                                 result = L2CAP_CR_SEC_BLOCK;
 655                         else
 656                                 result = L2CAP_CR_BAD_PSM;
 657
 658                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
 659                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
 660                         rsp.result = cpu_to_le16(result);
 661                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 662                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 663                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 664                 } else
 665                         l2cap_chan_del(sk, reason);
 666                 break;
 667
 668         case BT_CONNECT:
 669         case BT_DISCONN:
 670                 l2cap_chan_del(sk, reason);
 671                 break;
 672
 673         default:
 674                 sock_set_flag(sk, SOCK_ZAPPED);
 675                 break;
 676         }
 677 }
 678
 679 /* Must be called on unlocked socket. */
 680 static void l2cap_sock_close(struct sock *sk)
 681 {
 682         l2cap_sock_clear_timer(sk);
 683         lock_sock(sk);
 684         __l2cap_sock_close(sk, ECONNRESET);
 685         release_sock(sk);
 686         l2cap_sock_kill(sk);
 687 }
 688
 689 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 690 {
 691         struct l2cap_pinfo *pi = l2cap_pi(sk);
 692
 693         BT_DBG("sk %p", sk);
 694
 695         if (parent) {
 696                 sk->sk_type = parent->sk_type;
 697                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 698
 699                 pi->imtu = l2cap_pi(parent)->imtu;
 700                 pi->omtu = l2cap_pi(parent)->omtu;
 701                 pi->sec_level = l2cap_pi(parent)->sec_level;
 702                 pi->role_switch = l2cap_pi(parent)->role_switch;
 703                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
 704         } else {
 705                 pi->imtu = L2CAP_DEFAULT_MTU;
 706                 pi->omtu = 0;
 707                 pi->sec_level = BT_SECURITY_LOW;
 708                 pi->role_switch = 0;
 709                 pi->force_reliable = 0;
 710         }
 711
 712         /* Default config options */
 713         pi->conf_len = 0;
 714         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 715 }
 716
 717 static struct proto l2cap_proto = {
 718         .name           = "L2CAP",
 719         .owner          = THIS_MODULE,
 720         .obj_size       = sizeof(struct l2cap_pinfo)
 721 };
 722
 723 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 724 {
 725         struct sock *sk;
 726
 727         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 728         if (!sk)
 729                 return NULL;
 730
 731         sock_init_data(sock, sk);
 732         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 733
 734         sk->sk_destruct = l2cap_sock_destruct;
 735         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 736
 737         sock_reset_flag(sk, SOCK_ZAPPED);
 738
 739         sk->sk_protocol = proto;
 740         sk->sk_state = BT_OPEN;
 741
 742         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 743
 744         bt_sock_link(&l2cap_sk_list, sk);
 745         return sk;
 746 }
 747
 748 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
 749 {
 750         struct sock *sk;
 751
 752         BT_DBG("sock %p", sock);
 753
 754         sock->state = SS_UNCONNECTED;
 755
 756         if (sock->type != SOCK_SEQPACKET &&
 757                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 758                 return -ESOCKTNOSUPPORT;
 759
 760         if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
 761                 return -EPERM;
 762
 763         sock->ops = &l2cap_sock_ops;
 764
 765         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 766         if (!sk)
 767                 return -ENOMEM;
 768
 769         l2cap_sock_init(sk, NULL);
 770         return 0;
 771 }
 772
 773 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 774 {
 775         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 776         struct sock *sk = sock->sk;
 777         int err = 0;
 778
 779         BT_DBG("sk %p, %s %d", sk, batostr(&la->l2_bdaddr), la->l2_psm);
 780
 781         if (!addr || addr->sa_family != AF_BLUETOOTH)
 782                 return -EINVAL;
 783
 784         lock_sock(sk);
 785
 786         if (sk->sk_state != BT_OPEN) {
 787                 err = -EBADFD;
 788                 goto done;
 789         }
 790
 791         if (la->l2_psm && btohs(la->l2_psm) < 0x1001 &&
 792                                 !capable(CAP_NET_BIND_SERVICE)) {
 793                 err = -EACCES;
 794                 goto done;
 795         }
 796
 797         write_lock_bh(&l2cap_sk_list.lock);
 798
 799         if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
 800                 err = -EADDRINUSE;
 801         } else {
 802                 /* Save source address */
 803                 bacpy(&bt_sk(sk)->src, &la->l2_bdaddr);
 804                 l2cap_pi(sk)->psm   = la->l2_psm;
 805                 l2cap_pi(sk)->sport = la->l2_psm;
 806                 sk->sk_state = BT_BOUND;
 807
 808                 if (btohs(la->l2_psm) == 0x0001 || btohs(la->l2_psm) == 0x0003)
 809                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 810         }
 811
 812         write_unlock_bh(&l2cap_sk_list.lock);
 813
 814 done:
 815         release_sock(sk);
 816         return err;
 817 }
 818
 819 static int l2cap_do_connect(struct sock *sk)
 820 {
 821         bdaddr_t *src = &bt_sk(sk)->src;
 822         bdaddr_t *dst = &bt_sk(sk)->dst;
 823         struct l2cap_conn *conn;
 824         struct hci_conn *hcon;
 825         struct hci_dev *hdev;
 826         __u8 auth_type;
 827         int err = 0;
 828
 829         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), l2cap_pi(sk)->psm);
 830
 831         if (!(hdev = hci_get_route(dst, src)))
 832                 return -EHOSTUNREACH;
 833
 834         hci_dev_lock_bh(hdev);
 835
 836         err = -ENOMEM;
 837
 838         if (sk->sk_type == SOCK_RAW) {
 839                 switch (l2cap_pi(sk)->sec_level) {
 840                 case BT_SECURITY_HIGH:
 841                         auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 842                         break;
 843                 case BT_SECURITY_MEDIUM:
 844                         auth_type = HCI_AT_DEDICATED_BONDING;
 845                         break;
 846                 default:
 847                         auth_type = HCI_AT_NO_BONDING;
 848                         break;
 849                 }
 850         } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 851                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 852                         auth_type = HCI_AT_NO_BONDING_MITM;
 853                 else
 854                         auth_type = HCI_AT_NO_BONDING;
 855
 856                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 857                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 858         } else {
 859                 switch (l2cap_pi(sk)->sec_level) {
 860                 case BT_SECURITY_HIGH:
 861                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 862                         break;
 863                 case BT_SECURITY_MEDIUM:
 864                         auth_type = HCI_AT_GENERAL_BONDING;
 865                         break;
 866                 default:
 867                         auth_type = HCI_AT_NO_BONDING;
 868                         break;
 869                 }
 870         }
 871
 872         hcon = hci_connect(hdev, ACL_LINK, dst,
 873                                         l2cap_pi(sk)->sec_level, auth_type);
 874         if (!hcon)
 875                 goto done;
 876
 877         conn = l2cap_conn_add(hcon, 0);
 878         if (!conn) {
 879                 hci_conn_put(hcon);
 880                 goto done;
 881         }
 882
 883         err = 0;
 884
 885         /* Update source addr of the socket */
 886         bacpy(src, conn->src);
 887
 888         l2cap_chan_add(conn, sk, NULL);
 889
 890         sk->sk_state = BT_CONNECT;
 891         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 892
 893         if (hcon->state == BT_CONNECTED) {
 894                 if (sk->sk_type != SOCK_SEQPACKET) {
 895                         l2cap_sock_clear_timer(sk);
 896                         sk->sk_state = BT_CONNECTED;
 897                 } else
 898                         l2cap_do_start(sk);
 899         }
 900
 901 done:
 902         hci_dev_unlock_bh(hdev);
 903         hci_dev_put(hdev);
 904         return err;
 905 }
 906
 907 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 908 {
 909         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 910         struct sock *sk = sock->sk;
 911         int err = 0;
 912
 913         lock_sock(sk);
 914
 915         BT_DBG("sk %p", sk);
 916
 917         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_l2)) {
 918                 err = -EINVAL;
 919                 goto done;
 920         }
 921
 922         if (sk->sk_type == SOCK_SEQPACKET && !la->l2_psm) {
 923                 err = -EINVAL;
 924                 goto done;
 925         }
 926
 927         switch(sk->sk_state) {
 928         case BT_CONNECT:
 929         case BT_CONNECT2:
 930         case BT_CONFIG:
 931                 /* Already connecting */
 932                 goto wait;
 933
 934         case BT_CONNECTED:
 935                 /* Already connected */
 936                 goto done;
 937
 938         case BT_OPEN:
 939         case BT_BOUND:
 940                 /* Can connect */
 941                 break;
 942
 943         default:
 944                 err = -EBADFD;
 945                 goto done;
 946         }
 947
 948         /* Set destination address and psm */
 949         bacpy(&bt_sk(sk)->dst, &la->l2_bdaddr);
 950         l2cap_pi(sk)->psm = la->l2_psm;
 951
 952         if ((err = l2cap_do_connect(sk)))
 953                 goto done;
 954
 955 wait:
 956         err = bt_sock_wait_state(sk, BT_CONNECTED,
 957                         sock_sndtimeo(sk, flags & O_NONBLOCK));
 958 done:
 959         release_sock(sk);
 960         return err;
 961 }
 962
 963 static int l2cap_sock_listen(struct socket *sock, int backlog)
 964 {
 965         struct sock *sk = sock->sk;
 966         int err = 0;
 967
 968         BT_DBG("sk %p backlog %d", sk, backlog);
 969
 970         lock_sock(sk);
 971
 972         if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
 973                 err = -EBADFD;
 974                 goto done;
 975         }
 976
 977         if (!l2cap_pi(sk)->psm) {
 978                 bdaddr_t *src = &bt_sk(sk)->src;
 979                 u16 psm;
 980
 981                 err = -EINVAL;
 982
 983                 write_lock_bh(&l2cap_sk_list.lock);
 984
 985                 for (psm = 0x1001; psm < 0x1100; psm += 2)
 986                         if (!__l2cap_get_sock_by_addr(htobs(psm), src)) {
 987                                 l2cap_pi(sk)->psm   = htobs(psm);
 988                                 l2cap_pi(sk)->sport = htobs(psm);
 989                                 err = 0;
 990                                 break;
 991                         }
 992
 993                 write_unlock_bh(&l2cap_sk_list.lock);
 994
 995                 if (err < 0)
 996                         goto done;
 997         }
 998
 999         sk->sk_max_ack_backlog = backlog;
1000         sk->sk_ack_backlog = 0;
1001         sk->sk_state = BT_LISTEN;
1002
1003 done:
1004         release_sock(sk);
1005         return err;
1006 }
1007
1008 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
1009 {
1010         DECLARE_WAITQUEUE(wait, current);
1011         struct sock *sk = sock->sk, *nsk;
1012         long timeo;
1013         int err = 0;
1014
1015         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1016
1017         if (sk->sk_state != BT_LISTEN) {
1018                 err = -EBADFD;
1019                 goto done;
1020         }
1021
1022         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1023
1024         BT_DBG("sk %p timeo %ld", sk, timeo);
1025
1026         /* Wait for an incoming connection. (wake-one). */
1027         add_wait_queue_exclusive(sk->sk_sleep, &wait);
1028         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1029                 set_current_state(TASK_INTERRUPTIBLE);
1030                 if (!timeo) {
1031                         err = -EAGAIN;
1032                         break;
1033                 }
1034
1035                 release_sock(sk);
1036                 timeo = schedule_timeout(timeo);
1037                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1038
1039                 if (sk->sk_state != BT_LISTEN) {
1040                         err = -EBADFD;
1041                         break;
1042                 }
1043
1044                 if (signal_pending(current)) {
1045                         err = sock_intr_errno(timeo);
1046                         break;
1047                 }
1048         }
1049         set_current_state(TASK_RUNNING);
1050         remove_wait_queue(sk->sk_sleep, &wait);
1051
1052         if (err)
1053                 goto done;
1054
1055         newsock->state = SS_CONNECTED;
1056
1057         BT_DBG("new socket %p", nsk);
1058
1059 done:
1060         release_sock(sk);
1061         return err;
1062 }
1063
1064 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1065 {
1066         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1067         struct sock *sk = sock->sk;
1068
1069         BT_DBG("sock %p, sk %p", sock, sk);
1070
1071         addr->sa_family = AF_BLUETOOTH;
1072         *len = sizeof(struct sockaddr_l2);
1073
1074         if (peer)
1075                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
1076         else
1077                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
1078
1079         la->l2_psm = l2cap_pi(sk)->psm;
1080         return 0;
1081 }
1082
1083 static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
1084 {
1085         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1086         struct sk_buff *skb, **frag;
1087         int err, hlen, count, sent=0;
1088         struct l2cap_hdr *lh;
1089
1090         BT_DBG("sk %p len %d", sk, len);
1091
1092         /* First fragment (with L2CAP header) */
1093         if (sk->sk_type == SOCK_DGRAM)
1094                 hlen = L2CAP_HDR_SIZE + 2;
1095         else
1096                 hlen = L2CAP_HDR_SIZE;
1097
1098         count = min_t(unsigned int, (conn->mtu - hlen), len);
1099
1100         skb = bt_skb_send_alloc(sk, hlen + count,
1101                         msg->msg_flags & MSG_DONTWAIT, &err);
1102         if (!skb)
1103                 return err;
1104
1105         /* Create L2CAP header */
1106         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1107         lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1108         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1109
1110         if (sk->sk_type == SOCK_DGRAM)
1111                 put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
1112
1113         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
1114                 err = -EFAULT;
1115                 goto fail;
1116         }
1117
1118         sent += count;
1119         len  -= count;
1120
1121         /* Continuation fragments (no L2CAP header) */
1122         frag = &skb_shinfo(skb)->frag_list;
1123         while (len) {
1124                 count = min_t(unsigned int, conn->mtu, len);
1125
1126                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1127                 if (!*frag)
1128                         goto fail;
1129
1130                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
1131                         err = -EFAULT;
1132                         goto fail;
1133                 }
1134
1135                 sent += count;
1136                 len  -= count;
1137
1138                 frag = &(*frag)->next;
1139         }
1140
1141         if ((err = hci_send_acl(conn->hcon, skb, 0)) < 0)
1142                 goto fail;
1143
1144         return sent;
1145
1146 fail:
1147         kfree_skb(skb);
1148         return err;
1149 }
1150
1151 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1152 {
1153         struct sock *sk = sock->sk;
1154         int err = 0;
1155
1156         BT_DBG("sock %p, sk %p", sock, sk);
1157
1158         err = sock_error(sk);
1159         if (err)
1160                 return err;
1161
1162         if (msg->msg_flags & MSG_OOB)
1163                 return -EOPNOTSUPP;
1164
1165         /* Check outgoing MTU */
1166         if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
1167                 return -EINVAL;
1168
1169         lock_sock(sk);
1170
1171         if (sk->sk_state == BT_CONNECTED)
1172                 err = l2cap_do_send(sk, msg, len);
1173         else
1174                 err = -ENOTCONN;
1175
1176         release_sock(sk);
1177         return err;
1178 }
1179
1180 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1181 {
1182         struct sock *sk = sock->sk;
1183
1184         lock_sock(sk);
1185
1186         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1187                 struct l2cap_conn_rsp rsp;
1188
1189                 sk->sk_state = BT_CONFIG;
1190
1191                 rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1192                 rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
1193                 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1194                 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1195                 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1196                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1197
1198                 release_sock(sk);
1199                 return 0;
1200         }
1201
1202         release_sock(sk);
1203
1204         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1205 }
1206
1207 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
1208 {
1209         struct sock *sk = sock->sk;
1210         struct l2cap_options opts;
1211         int err = 0, len;
1212         u32 opt;
1213
1214         BT_DBG("sk %p", sk);
1215
1216         lock_sock(sk);
1217
1218         switch (optname) {
1219         case L2CAP_OPTIONS:
1220                 opts.imtu     = l2cap_pi(sk)->imtu;
1221                 opts.omtu     = l2cap_pi(sk)->omtu;
1222                 opts.flush_to = l2cap_pi(sk)->flush_to;
1223                 opts.mode     = L2CAP_MODE_BASIC;
1224
1225                 len = min_t(unsigned int, sizeof(opts), optlen);
1226                 if (copy_from_user((char *) &opts, optval, len)) {
1227                         err = -EFAULT;
1228                         break;
1229                 }
1230
1231                 l2cap_pi(sk)->imtu  = opts.imtu;
1232                 l2cap_pi(sk)->omtu  = opts.omtu;
1233                 break;
1234
1235         case L2CAP_LM:
1236                 if (get_user(opt, (u32 __user *) optval)) {
1237                         err = -EFAULT;
1238                         break;
1239                 }
1240
1241                 if (opt & L2CAP_LM_AUTH)
1242                         l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
1243                 if (opt & L2CAP_LM_ENCRYPT)
1244                         l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
1245                 if (opt & L2CAP_LM_SECURE)
1246                         l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
1247
1248                 l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
1249                 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
1250                 break;
1251
1252         default:
1253                 err = -ENOPROTOOPT;
1254                 break;
1255         }
1256
1257         release_sock(sk);
1258         return err;
1259 }
1260
1261 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1262 {
1263         struct sock *sk = sock->sk;
1264         struct bt_security sec;
1265         int len, err = 0;
1266         u32 opt;
1267
1268         BT_DBG("sk %p", sk);
1269
1270         if (level == SOL_L2CAP)
1271                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
1272
1273         if (level != SOL_BLUETOOTH)
1274                 return -ENOPROTOOPT;
1275
1276         lock_sock(sk);
1277
1278         switch (optname) {
1279         case BT_SECURITY:
1280                 if (sk->sk_type != SOCK_SEQPACKET) {
1281                         err = -EINVAL;
1282                         break;
1283                 }
1284
1285                 sec.level = BT_SECURITY_LOW;
1286
1287                 len = min_t(unsigned int, sizeof(sec), optlen);
1288                 if (copy_from_user((char *) &sec, optval, len)) {
1289                         err = -EFAULT;
1290                         break;
1291                 }
1292
1293                 if (sec.level < BT_SECURITY_LOW ||
1294                                         sec.level > BT_SECURITY_HIGH) {
1295                         err = -EINVAL;
1296                         break;
1297                 }
1298
1299                 l2cap_pi(sk)->sec_level = sec.level;
1300                 break;
1301
1302         case BT_DEFER_SETUP:
1303                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1304                         err = -EINVAL;
1305                         break;
1306                 }
1307
1308                 if (get_user(opt, (u32 __user *) optval)) {
1309                         err = -EFAULT;
1310                         break;
1311                 }
1312
1313                 bt_sk(sk)->defer_setup = opt;
1314                 break;
1315
1316         default:
1317                 err = -ENOPROTOOPT;
1318                 break;
1319         }
1320
1321         release_sock(sk);
1322         return err;
1323 }
1324
1325 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1326 {
1327         struct sock *sk = sock->sk;
1328         struct l2cap_options opts;
1329         struct l2cap_conninfo cinfo;
1330         int len, err = 0;
1331         u32 opt;
1332
1333         BT_DBG("sk %p", sk);
1334
1335         if (get_user(len, optlen))
1336                 return -EFAULT;
1337
1338         lock_sock(sk);
1339
1340         switch (optname) {
1341         case L2CAP_OPTIONS:
1342                 opts.imtu     = l2cap_pi(sk)->imtu;
1343                 opts.omtu     = l2cap_pi(sk)->omtu;
1344                 opts.flush_to = l2cap_pi(sk)->flush_to;
1345                 opts.mode     = L2CAP_MODE_BASIC;
1346
1347                 len = min_t(unsigned int, len, sizeof(opts));
1348                 if (copy_to_user(optval, (char *) &opts, len))
1349                         err = -EFAULT;
1350
1351                 break;
1352
1353         case L2CAP_LM:
1354                 switch (l2cap_pi(sk)->sec_level) {
1355                 case BT_SECURITY_LOW:
1356                         opt = L2CAP_LM_AUTH;
1357                         break;
1358                 case BT_SECURITY_MEDIUM:
1359                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
1360                         break;
1361                 case BT_SECURITY_HIGH:
1362                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
1363                                                         L2CAP_LM_SECURE;
1364                         break;
1365                 default:
1366                         opt = 0;
1367                         break;
1368                 }
1369
1370                 if (l2cap_pi(sk)->role_switch)
1371                         opt |= L2CAP_LM_MASTER;
1372
1373                 if (l2cap_pi(sk)->force_reliable)
1374                         opt |= L2CAP_LM_RELIABLE;
1375
1376                 if (put_user(opt, (u32 __user *) optval))
1377                         err = -EFAULT;
1378                 break;
1379
1380         case L2CAP_CONNINFO:
1381                 if (sk->sk_state != BT_CONNECTED &&
1382                                         !(sk->sk_state == BT_CONNECT2 &&
1383                                                 bt_sk(sk)->defer_setup)) {
1384                         err = -ENOTCONN;
1385                         break;
1386                 }
1387
1388                 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
1389                 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
1390
1391                 len = min_t(unsigned int, len, sizeof(cinfo));
1392                 if (copy_to_user(optval, (char *) &cinfo, len))
1393                         err = -EFAULT;
1394
1395                 break;
1396
1397         default:
1398                 err = -ENOPROTOOPT;
1399                 break;
1400         }
1401
1402         release_sock(sk);
1403         return err;
1404 }
1405
1406 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
1407 {
1408         struct sock *sk = sock->sk;
1409         struct bt_security sec;
1410         int len, err = 0;
1411
1412         BT_DBG("sk %p", sk);
1413
1414         if (level == SOL_L2CAP)
1415                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
1416
1417         if (level != SOL_BLUETOOTH)
1418                 return -ENOPROTOOPT;
1419
1420         if (get_user(len, optlen))
1421                 return -EFAULT;
1422
1423         lock_sock(sk);
1424
1425         switch (optname) {
1426         case BT_SECURITY:
1427                 if (sk->sk_type != SOCK_SEQPACKET) {
1428                         err = -EINVAL;
1429                         break;
1430                 }
1431
1432                 sec.level = l2cap_pi(sk)->sec_level;
1433
1434                 len = min_t(unsigned int, len, sizeof(sec));
1435                 if (copy_to_user(optval, (char *) &sec, len))
1436                         err = -EFAULT;
1437
1438                 break;
1439
1440         case BT_DEFER_SETUP:
1441                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1442                         err = -EINVAL;
1443                         break;
1444                 }
1445
1446                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
1447                         err = -EFAULT;
1448
1449                 break;
1450
1451         default:
1452                 err = -ENOPROTOOPT;
1453                 break;
1454         }
1455
1456         release_sock(sk);
1457         return err;
1458 }
1459
1460 static int l2cap_sock_shutdown(struct socket *sock, int how)
1461 {
1462         struct sock *sk = sock->sk;
1463         int err = 0;
1464
1465         BT_DBG("sock %p, sk %p", sock, sk);
1466
1467         if (!sk)
1468                 return 0;
1469
1470         lock_sock(sk);
1471         if (!sk->sk_shutdown) {
1472                 sk->sk_shutdown = SHUTDOWN_MASK;
1473                 l2cap_sock_clear_timer(sk);
1474                 __l2cap_sock_close(sk, 0);
1475
1476                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1477                         err = bt_sock_wait_state(sk, BT_CLOSED,
1478                                                         sk->sk_lingertime);
1479         }
1480         release_sock(sk);
1481         return err;
1482 }
1483
1484 static int l2cap_sock_release(struct socket *sock)
1485 {
1486         struct sock *sk = sock->sk;
1487         int err;
1488
1489         BT_DBG("sock %p, sk %p", sock, sk);
1490
1491         if (!sk)
1492                 return 0;
1493
1494         err = l2cap_sock_shutdown(sock, 2);
1495
1496         sock_orphan(sk);
1497         l2cap_sock_kill(sk);
1498         return err;
1499 }
1500
1501 static void l2cap_chan_ready(struct sock *sk)
1502 {
1503         struct sock *parent = bt_sk(sk)->parent;
1504
1505         BT_DBG("sk %p, parent %p", sk, parent);
1506
1507         l2cap_pi(sk)->conf_state = 0;
1508         l2cap_sock_clear_timer(sk);
1509
1510         if (!parent) {
1511                 /* Outgoing channel.
1512                  * Wake up socket sleeping on connect.
1513                  */
1514                 sk->sk_state = BT_CONNECTED;
1515                 sk->sk_state_change(sk);
1516         } else {
1517                 /* Incoming channel.
1518                  * Wake up socket sleeping on accept.
1519                  */
1520                 parent->sk_data_ready(parent, 0);
1521         }
1522 }
1523
1524 /* Copy frame to all raw sockets on that connection */
1525 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1526 {
1527         struct l2cap_chan_list *l = &conn->chan_list;
1528         struct sk_buff *nskb;
1529         struct sock * sk;
1530
1531         BT_DBG("conn %p", conn);
1532
1533         read_lock(&l->lock);
1534         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
1535                 if (sk->sk_type != SOCK_RAW)
1536                         continue;
1537
1538                 /* Don't send frame to the socket it came from */
1539                 if (skb->sk == sk)
1540                         continue;
1541
1542                 if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
1543                         continue;
1544
1545                 if (sock_queue_rcv_skb(sk, nskb))
1546                         kfree_skb(nskb);
1547         }
1548         read_unlock(&l->lock);
1549 }
1550
1551 /* ---- L2CAP signalling commands ---- */
1552 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1553                                 u8 code, u8 ident, u16 dlen, void *data)
1554 {
1555         struct sk_buff *skb, **frag;
1556         struct l2cap_cmd_hdr *cmd;
1557         struct l2cap_hdr *lh;
1558         int len, count;
1559
1560         BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", conn, code, ident, dlen);
1561
1562         len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1563         count = min_t(unsigned int, conn->mtu, len);
1564
1565         skb = bt_skb_alloc(count, GFP_ATOMIC);
1566         if (!skb)
1567                 return NULL;
1568
1569         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1570         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
1571         lh->cid = cpu_to_le16(0x0001);
1572
1573         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1574         cmd->code  = code;
1575         cmd->ident = ident;
1576         cmd->len   = cpu_to_le16(dlen);
1577
1578         if (dlen) {
1579                 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1580                 memcpy(skb_put(skb, count), data, count);
1581                 data += count;
1582         }
1583
1584         len -= skb->len;
1585
1586         /* Continuation fragments (no L2CAP header) */
1587         frag = &skb_shinfo(skb)->frag_list;
1588         while (len) {
1589                 count = min_t(unsigned int, conn->mtu, len);
1590
1591                 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1592                 if (!*frag)
1593                         goto fail;
1594
1595                 memcpy(skb_put(*frag, count), data, count);
1596
1597                 len  -= count;
1598                 data += count;
1599
1600                 frag = &(*frag)->next;
1601         }
1602
1603         return skb;
1604
1605 fail:
1606         kfree_skb(skb);
1607         return NULL;
1608 }
1609
1610 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1611 {
1612         struct l2cap_conf_opt *opt = *ptr;
1613         int len;
1614
1615         len = L2CAP_CONF_OPT_SIZE + opt->len;
1616         *ptr += len;
1617
1618         *type = opt->type;
1619         *olen = opt->len;
1620
1621         switch (opt->len) {
1622         case 1:
1623                 *val = *((u8 *) opt->val);
1624                 break;
1625
1626         case 2:
1627                 *val = __le16_to_cpu(*((__le16 *) opt->val));
1628                 break;
1629
1630         case 4:
1631                 *val = __le32_to_cpu(*((__le32 *) opt->val));
1632                 break;
1633
1634         default:
1635                 *val = (unsigned long) opt->val;
1636                 break;
1637         }
1638
1639         BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1640         return len;
1641 }
1642
1643 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1644 {
1645         struct l2cap_conf_opt *opt = *ptr;
1646
1647         BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1648
1649         opt->type = type;
1650         opt->len  = len;
1651
1652         switch (len) {
1653         case 1:
1654                 *((u8 *) opt->val)  = val;
1655                 break;
1656
1657         case 2:
1658                 *((__le16 *) opt->val) = cpu_to_le16(val);
1659                 break;
1660
1661         case 4:
1662                 *((__le32 *) opt->val) = cpu_to_le32(val);
1663                 break;
1664
1665         default:
1666                 memcpy(opt->val, (void *) val, len);
1667                 break;
1668         }
1669
1670         *ptr += L2CAP_CONF_OPT_SIZE + len;
1671 }
1672
1673 static int l2cap_build_conf_req(struct sock *sk, void *data)
1674 {
1675         struct l2cap_pinfo *pi = l2cap_pi(sk);
1676         struct l2cap_conf_req *req = data;
1677         void *ptr = req->data;
1678
1679         BT_DBG("sk %p", sk);
1680
1681         if (pi->imtu != L2CAP_DEFAULT_MTU)
1682                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
1683
1684         /* FIXME: Need actual value of the flush timeout */
1685         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
1686         //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
1687
1688         req->dcid  = cpu_to_le16(pi->dcid);
1689         req->flags = cpu_to_le16(0);
1690
1691         return ptr - data;
1692 }
1693
1694 static int l2cap_parse_conf_req(struct sock *sk, void *data)
1695 {
1696         struct l2cap_pinfo *pi = l2cap_pi(sk);
1697         struct l2cap_conf_rsp *rsp = data;
1698         void *ptr = rsp->data;
1699         void *req = pi->conf_req;
1700         int len = pi->conf_len;
1701         int type, hint, olen;
1702         unsigned long val;
1703         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
1704         u16 mtu = L2CAP_DEFAULT_MTU;
1705         u16 result = L2CAP_CONF_SUCCESS;
1706
1707         BT_DBG("sk %p", sk);
1708
1709         while (len >= L2CAP_CONF_OPT_SIZE) {
1710                 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1711
1712                 hint  = type & 0x80;
1713                 type &= 0x7f;
1714
1715                 switch (type) {
1716                 case L2CAP_CONF_MTU:
1717                         mtu = val;
1718                         break;
1719
1720                 case L2CAP_CONF_FLUSH_TO:
1721                         pi->flush_to = val;
1722                         break;
1723
1724                 case L2CAP_CONF_QOS:
1725                         break;
1726
1727                 case L2CAP_CONF_RFC:
1728                         if (olen == sizeof(rfc))
1729                                 memcpy(&rfc, (void *) val, olen);
1730                         break;
1731
1732                 default:
1733                         if (hint)
1734                                 break;
1735
1736                         result = L2CAP_CONF_UNKNOWN;
1737                         *((u8 *) ptr++) = type;
1738                         break;
1739                 }
1740         }
1741
1742         if (result == L2CAP_CONF_SUCCESS) {
1743                 /* Configure output options and let the other side know
1744                  * which ones we don't like. */
1745
1746                 if (rfc.mode == L2CAP_MODE_BASIC) {
1747                         if (mtu < pi->omtu)
1748                                 result = L2CAP_CONF_UNACCEPT;
1749                         else {
1750                                 pi->omtu = mtu;
1751                                 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
1752                         }
1753
1754                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
1755                 } else {
1756                         result = L2CAP_CONF_UNACCEPT;
1757
1758                         memset(&rfc, 0, sizeof(rfc));
1759                         rfc.mode = L2CAP_MODE_BASIC;
1760
1761                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1762                                                 sizeof(rfc), (unsigned long) &rfc);
1763                 }
1764         }
1765
1766         rsp->scid   = cpu_to_le16(pi->dcid);
1767         rsp->result = cpu_to_le16(result);
1768         rsp->flags  = cpu_to_le16(0x0000);
1769
1770         return ptr - data;
1771 }
1772
1773 static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1774 {
1775         struct l2cap_conf_rsp *rsp = data;
1776         void *ptr = rsp->data;
1777
1778         BT_DBG("sk %p", sk);
1779
1780         rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1781         rsp->result = cpu_to_le16(result);
1782         rsp->flags  = cpu_to_le16(flags);
1783
1784         return ptr - data;
1785 }
1786
1787 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1788 {
1789         struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
1790
1791         if (rej->reason != 0x0000)
1792                 return 0;
1793
1794         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
1795                                         cmd->ident == conn->info_ident) {
1796                 del_timer(&conn->info_timer);
1797
1798                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1799                 conn->info_ident = 0;
1800
1801                 l2cap_conn_start(conn);
1802         }
1803
1804         return 0;
1805 }
1806
1807 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1808 {
1809         struct l2cap_chan_list *list = &conn->chan_list;
1810         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
1811         struct l2cap_conn_rsp rsp;
1812         struct sock *sk, *parent;
1813         int result, status = L2CAP_CS_NO_INFO;
1814
1815         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
1816         __le16 psm = req->psm;
1817
1818         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
1819
1820         /* Check if we have socket listening on psm */
1821         parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
1822         if (!parent) {
1823                 result = L2CAP_CR_BAD_PSM;
1824                 goto sendresp;
1825         }
1826
1827         /* Check if the ACL is secure enough (if not SDP) */
1828         if (psm != cpu_to_le16(0x0001) &&
1829                                 !hci_conn_check_link_mode(conn->hcon)) {
1830                 result = L2CAP_CR_SEC_BLOCK;
1831                 goto response;
1832         }
1833
1834         result = L2CAP_CR_NO_MEM;
1835
1836         /* Check for backlog size */
1837         if (sk_acceptq_is_full(parent)) {
1838                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1839                 goto response;
1840         }
1841
1842         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1843         if (!sk)
1844                 goto response;
1845
1846         write_lock_bh(&list->lock);
1847
1848         /* Check if we already have channel with that dcid */
1849         if (__l2cap_get_chan_by_dcid(list, scid)) {
1850                 write_unlock_bh(&list->lock);
1851                 sock_set_flag(sk, SOCK_ZAPPED);
1852                 l2cap_sock_kill(sk);
1853                 goto response;
1854         }
1855
1856         hci_conn_hold(conn->hcon);
1857
1858         l2cap_sock_init(sk, parent);
1859         bacpy(&bt_sk(sk)->src, conn->src);
1860         bacpy(&bt_sk(sk)->dst, conn->dst);
1861         l2cap_pi(sk)->psm  = psm;
1862         l2cap_pi(sk)->dcid = scid;
1863
1864         __l2cap_chan_add(conn, sk, parent);
1865         dcid = l2cap_pi(sk)->scid;
1866
1867         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1868
1869         l2cap_pi(sk)->ident = cmd->ident;
1870
1871         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
1872                 if (l2cap_check_security(sk)) {
1873                         if (bt_sk(sk)->defer_setup) {
1874                                 sk->sk_state = BT_CONNECT2;
1875                                 result = L2CAP_CR_PEND;
1876                                 status = L2CAP_CS_AUTHOR_PEND;
1877                                 parent->sk_data_ready(parent, 0);
1878                         } else {
1879                                 sk->sk_state = BT_CONFIG;
1880                                 result = L2CAP_CR_SUCCESS;
1881                                 status = L2CAP_CS_NO_INFO;
1882                         }
1883                 } else {
1884                         sk->sk_state = BT_CONNECT2;
1885                         result = L2CAP_CR_PEND;
1886                         status = L2CAP_CS_AUTHEN_PEND;
1887                 }
1888         } else {
1889                 sk->sk_state = BT_CONNECT2;
1890                 result = L2CAP_CR_PEND;
1891                 status = L2CAP_CS_NO_INFO;
1892         }
1893
1894         write_unlock_bh(&list->lock);
1895
1896 response:
1897         bh_unlock_sock(parent);
1898
1899 sendresp:
1900         rsp.scid   = cpu_to_le16(scid);
1901         rsp.dcid   = cpu_to_le16(dcid);
1902         rsp.result = cpu_to_le16(result);
1903         rsp.status = cpu_to_le16(status);
1904         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1905
1906         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
1907                 struct l2cap_info_req info;
1908                 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1909
1910                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1911                 conn->info_ident = l2cap_get_ident(conn);
1912
1913                 mod_timer(&conn->info_timer, jiffies +
1914                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
1915
1916                 l2cap_send_cmd(conn, conn->info_ident,
1917                                         L2CAP_INFO_REQ, sizeof(info), &info);
1918         }
1919
1920         return 0;
1921 }
1922
1923 static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1924 {
1925         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
1926         u16 scid, dcid, result, status;
1927         struct sock *sk;
1928         u8 req[128];
1929
1930         scid   = __le16_to_cpu(rsp->scid);
1931         dcid   = __le16_to_cpu(rsp->dcid);
1932         result = __le16_to_cpu(rsp->result);
1933         status = __le16_to_cpu(rsp->status);
1934
1935         BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
1936
1937         if (scid) {
1938                 if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
1939                         return 0;
1940         } else {
1941                 if (!(sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident)))
1942                         return 0;
1943         }
1944
1945         switch (result) {
1946         case L2CAP_CR_SUCCESS:
1947                 sk->sk_state = BT_CONFIG;
1948                 l2cap_pi(sk)->ident = 0;
1949                 l2cap_pi(sk)->dcid = dcid;
1950                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1951
1952                 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
1953
1954                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1955                                         l2cap_build_conf_req(sk, req), req);
1956                 break;
1957
1958         case L2CAP_CR_PEND:
1959                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
1960                 break;
1961
1962         default:
1963                 l2cap_chan_del(sk, ECONNREFUSED);
1964                 break;
1965         }
1966
1967         bh_unlock_sock(sk);
1968         return 0;
1969 }
1970
1971 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1972 {
1973         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
1974         u16 dcid, flags;
1975         u8 rsp[64];
1976         struct sock *sk;
1977         int len;
1978
1979         dcid  = __le16_to_cpu(req->dcid);
1980         flags = __le16_to_cpu(req->flags);
1981
1982         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
1983
1984         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
1985                 return -ENOENT;
1986
1987         if (sk->sk_state == BT_DISCONN)
1988                 goto unlock;
1989
1990         /* Reject if config buffer is too small. */
1991         len = cmd_len - sizeof(*req);
1992         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
1993                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
1994                                 l2cap_build_conf_rsp(sk, rsp,
1995                                         L2CAP_CONF_REJECT, flags), rsp);
1996                 goto unlock;
1997         }
1998
1999         /* Store config. */
2000         memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
2001         l2cap_pi(sk)->conf_len += len;
2002
2003         if (flags & 0x0001) {
2004                 /* Incomplete config. Send empty response. */
2005                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2006                                 l2cap_build_conf_rsp(sk, rsp,
2007                                         L2CAP_CONF_SUCCESS, 0x0001), rsp);
2008                 goto unlock;
2009         }
2010
2011         /* Complete config. */
2012         len = l2cap_parse_conf_req(sk, rsp);
2013         if (len < 0)
2014                 goto unlock;
2015
2016         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
2017
2018         /* Reset config buffer. */
2019         l2cap_pi(sk)->conf_len = 0;
2020
2021         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
2022                 goto unlock;
2023
2024         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
2025                 sk->sk_state = BT_CONNECTED;
2026                 l2cap_chan_ready(sk);
2027                 goto unlock;
2028         }
2029
2030         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
2031                 u8 buf[64];
2032                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2033                                         l2cap_build_conf_req(sk, buf), buf);
2034         }
2035
2036 unlock:
2037         bh_unlock_sock(sk);
2038         return 0;
2039 }
2040
2041 static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2042 {
2043         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2044         u16 scid, flags, result;
2045         struct sock *sk;
2046
2047         scid   = __le16_to_cpu(rsp->scid);
2048         flags  = __le16_to_cpu(rsp->flags);
2049         result = __le16_to_cpu(rsp->result);
2050
2051         BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", scid, flags, result);
2052
2053         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
2054                 return 0;
2055
2056         switch (result) {
2057         case L2CAP_CONF_SUCCESS:
2058                 break;
2059
2060         case L2CAP_CONF_UNACCEPT:
2061                 if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
2062                         char req[128];
2063                         /* It does not make sense to adjust L2CAP parameters
2064                          * that are currently defined in the spec. We simply
2065                          * resend config request that we sent earlier. It is
2066                          * stupid, but it helps qualification testing which
2067                          * expects at least some response from us. */
2068                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2069                                                 l2cap_build_conf_req(sk, req), req);
2070                         goto done;
2071                 }
2072
2073         default:
2074                 sk->sk_state = BT_DISCONN;
2075                 sk->sk_err = ECONNRESET;
2076                 l2cap_sock_set_timer(sk, HZ * 5);
2077                 {
2078                         struct l2cap_disconn_req req;
2079                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
2080                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2081                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
2082                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
2083                 }
2084                 goto done;
2085         }
2086
2087         if (flags & 0x01)
2088                 goto done;
2089
2090         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
2091
2092         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
2093                 sk->sk_state = BT_CONNECTED;
2094                 l2cap_chan_ready(sk);
2095         }
2096
2097 done:
2098         bh_unlock_sock(sk);
2099         return 0;
2100 }
2101
2102 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2103 {
2104         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2105         struct l2cap_disconn_rsp rsp;
2106         u16 dcid, scid;
2107         struct sock *sk;
2108
2109         scid = __le16_to_cpu(req->scid);
2110         dcid = __le16_to_cpu(req->dcid);
2111
2112         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2113
2114         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
2115                 return 0;
2116
2117         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
2118         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
2119         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
2120
2121         sk->sk_shutdown = SHUTDOWN_MASK;
2122
2123         l2cap_chan_del(sk, ECONNRESET);
2124         bh_unlock_sock(sk);
2125
2126         l2cap_sock_kill(sk);
2127         return 0;
2128 }
2129
2130 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2131 {
2132         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
2133         u16 dcid, scid;
2134         struct sock *sk;
2135
2136         scid = __le16_to_cpu(rsp->scid);
2137         dcid = __le16_to_cpu(rsp->dcid);
2138
2139         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
2140
2141         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
2142                 return 0;
2143
2144         l2cap_chan_del(sk, 0);
2145         bh_unlock_sock(sk);
2146
2147         l2cap_sock_kill(sk);
2148         return 0;
2149 }
2150
2151 static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2152 {
2153         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
2154         u16 type;
2155
2156         type = __le16_to_cpu(req->type);
2157
2158         BT_DBG("type 0x%4.4x", type);
2159
2160         if (type == L2CAP_IT_FEAT_MASK) {
2161                 u8 buf[8];
2162                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2163                 rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2164                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2165                 put_unaligned(cpu_to_le32(l2cap_feat_mask), (__le32 *) rsp->data);
2166                 l2cap_send_cmd(conn, cmd->ident,
2167                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2168         } else if (type == L2CAP_IT_FIXED_CHAN) {
2169                 u8 buf[12];
2170                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2171                 rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2172                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2173                 memcpy(buf + 4, l2cap_fixed_chan, 8);
2174                 l2cap_send_cmd(conn, cmd->ident,
2175                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2176         } else {
2177                 struct l2cap_info_rsp rsp;
2178                 rsp.type   = cpu_to_le16(type);
2179                 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2180                 l2cap_send_cmd(conn, cmd->ident,
2181                                         L2CAP_INFO_RSP, sizeof(rsp), &rsp);
2182         }
2183
2184         return 0;
2185 }
2186
2187 static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2188 {
2189         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
2190         u16 type, result;
2191
2192         type   = __le16_to_cpu(rsp->type);
2193         result = __le16_to_cpu(rsp->result);
2194
2195         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
2196
2197         del_timer(&conn->info_timer);
2198
2199         if (type == L2CAP_IT_FEAT_MASK) {
2200                 conn->feat_mask = get_unaligned_le32(rsp->data);
2201
2202                 if (conn->feat_mask & 0x0080) {
2203                         struct l2cap_info_req req;
2204                         req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2205
2206                         conn->info_ident = l2cap_get_ident(conn);
2207
2208                         l2cap_send_cmd(conn, conn->info_ident,
2209                                         L2CAP_INFO_REQ, sizeof(req), &req);
2210                 } else {
2211                         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2212                         conn->info_ident = 0;
2213
2214                         l2cap_conn_start(conn);
2215                 }
2216         } else if (type == L2CAP_IT_FIXED_CHAN) {
2217                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2218                 conn->info_ident = 0;
2219
2220                 l2cap_conn_start(conn);
2221         }
2222
2223         return 0;
2224 }
2225
2226 static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
2227 {
2228         u8 *data = skb->data;
2229         int len = skb->len;
2230         struct l2cap_cmd_hdr cmd;
2231         int err = 0;
2232
2233         l2cap_raw_recv(conn, skb);
2234
2235         while (len >= L2CAP_CMD_HDR_SIZE) {
2236                 u16 cmd_len;
2237                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
2238                 data += L2CAP_CMD_HDR_SIZE;
2239                 len  -= L2CAP_CMD_HDR_SIZE;
2240
2241                 cmd_len = le16_to_cpu(cmd.len);
2242
2243                 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
2244
2245                 if (cmd_len > len || !cmd.ident) {
2246                         BT_DBG("corrupted command");
2247                         break;
2248                 }
2249
2250                 switch (cmd.code) {
2251                 case L2CAP_COMMAND_REJ:
2252                         l2cap_command_rej(conn, &cmd, data);
2253                         break;
2254
2255                 case L2CAP_CONN_REQ:
2256                         err = l2cap_connect_req(conn, &cmd, data);
2257                         break;
2258
2259                 case L2CAP_CONN_RSP:
2260                         err = l2cap_connect_rsp(conn, &cmd, data);
2261                         break;
2262
2263                 case L2CAP_CONF_REQ:
2264                         err = l2cap_config_req(conn, &cmd, cmd_len, data);
2265                         break;
2266
2267                 case L2CAP_CONF_RSP:
2268                         err = l2cap_config_rsp(conn, &cmd, data);
2269                         break;
2270
2271                 case L2CAP_DISCONN_REQ:
2272                         err = l2cap_disconnect_req(conn, &cmd, data);
2273                         break;
2274
2275                 case L2CAP_DISCONN_RSP:
2276                         err = l2cap_disconnect_rsp(conn, &cmd, data);
2277                         break;
2278
2279                 case L2CAP_ECHO_REQ:
2280                         l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
2281                         break;
2282
2283                 case L2CAP_ECHO_RSP:
2284                         break;
2285
2286                 case L2CAP_INFO_REQ:
2287                         err = l2cap_information_req(conn, &cmd, data);
2288                         break;
2289
2290                 case L2CAP_INFO_RSP:
2291                         err = l2cap_information_rsp(conn, &cmd, data);
2292                         break;
2293
2294                 default:
2295                         BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
2296                         err = -EINVAL;
2297                         break;
2298                 }
2299
2300                 if (err) {
2301                         struct l2cap_cmd_rej rej;
2302                         BT_DBG("error %d", err);
2303
2304                         /* FIXME: Map err to a valid reason */
2305                         rej.reason = cpu_to_le16(0);
2306                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
2307                 }
2308
2309                 data += cmd_len;
2310                 len  -= cmd_len;
2311         }
2312
2313         kfree_skb(skb);
2314 }
2315
2316 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
2317 {
2318         struct sock *sk;
2319
2320         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
2321         if (!sk) {
2322                 BT_DBG("unknown cid 0x%4.4x", cid);
2323                 goto drop;
2324         }
2325
2326         BT_DBG("sk %p, len %d", sk, skb->len);
2327
2328         if (sk->sk_state != BT_CONNECTED)
2329                 goto drop;
2330
2331         if (l2cap_pi(sk)->imtu < skb->len)
2332                 goto drop;
2333
2334         /* If socket recv buffers overflows we drop data here
2335          * which is *bad* because L2CAP has to be reliable.
2336          * But we don't have any other choice. L2CAP doesn't
2337          * provide flow control mechanism. */
2338
2339         if (!sock_queue_rcv_skb(sk, skb))
2340                 goto done;
2341
2342 drop:
2343         kfree_skb(skb);
2344
2345 done:
2346         if (sk)
2347                 bh_unlock_sock(sk);
2348
2349         return 0;
2350 }
2351
2352 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
2353 {
2354         struct sock *sk;
2355
2356         sk = l2cap_get_sock_by_psm(0, psm, conn->src);
2357         if (!sk)
2358                 goto drop;
2359
2360         BT_DBG("sk %p, len %d", sk, skb->len);
2361
2362         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
2363                 goto drop;
2364
2365         if (l2cap_pi(sk)->imtu < skb->len)
2366                 goto drop;
2367
2368         if (!sock_queue_rcv_skb(sk, skb))
2369                 goto done;
2370
2371 drop:
2372         kfree_skb(skb);
2373
2374 done:
2375         if (sk) bh_unlock_sock(sk);
2376         return 0;
2377 }
2378
2379 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
2380 {
2381         struct l2cap_hdr *lh = (void *) skb->data;
2382         u16 cid, len;
2383         __le16 psm;
2384
2385         skb_pull(skb, L2CAP_HDR_SIZE);
2386         cid = __le16_to_cpu(lh->cid);
2387         len = __le16_to_cpu(lh->len);
2388
2389         BT_DBG("len %d, cid 0x%4.4x", len, cid);
2390
2391         switch (cid) {
2392         case 0x0001:
2393                 l2cap_sig_channel(conn, skb);
2394                 break;
2395
2396         case 0x0002:
2397                 psm = get_unaligned((__le16 *) skb->data);
2398                 skb_pull(skb, 2);
2399                 l2cap_conless_channel(conn, psm, skb);
2400                 break;
2401
2402         default:
2403                 l2cap_data_channel(conn, cid, skb);
2404                 break;
2405         }
2406 }
2407
2408 /* ---- L2CAP interface with lower layer (HCI) ---- */
2409
2410 static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2411 {
2412         int exact = 0, lm1 = 0, lm2 = 0;
2413         register struct sock *sk;
2414         struct hlist_node *node;
2415
2416         if (type != ACL_LINK)
2417                 return 0;
2418
2419         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
2420
2421         /* Find listening sockets and check their link_mode */
2422         read_lock(&l2cap_sk_list.lock);
2423         sk_for_each(sk, node, &l2cap_sk_list.head) {
2424                 if (sk->sk_state != BT_LISTEN)
2425                         continue;
2426
2427                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2428                         lm1 |= HCI_LM_ACCEPT;
2429                         if (l2cap_pi(sk)->role_switch)
2430                                 lm1 |= HCI_LM_MASTER;
2431                         exact++;
2432                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
2433                         lm2 |= HCI_LM_ACCEPT;
2434                         if (l2cap_pi(sk)->role_switch)
2435                                 lm2 |= HCI_LM_MASTER;
2436                 }
2437         }
2438         read_unlock(&l2cap_sk_list.lock);
2439
2440         return exact ? lm1 : lm2;
2441 }
2442
2443 static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
2444 {
2445         struct l2cap_conn *conn;
2446
2447         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
2448
2449         if (hcon->type != ACL_LINK)
2450                 return 0;
2451
2452         if (!status) {
2453                 conn = l2cap_conn_add(hcon, status);
2454                 if (conn)
2455                         l2cap_conn_ready(conn);
2456         } else
2457                 l2cap_conn_del(hcon, bt_err(status));
2458
2459         return 0;
2460 }
2461
2462 static int l2cap_disconn_ind(struct hci_conn *hcon, u8 reason)
2463 {
2464         BT_DBG("hcon %p reason %d", hcon, reason);
2465
2466         if (hcon->type != ACL_LINK)
2467                 return 0;
2468
2469         l2cap_conn_del(hcon, bt_err(reason));
2470
2471         return 0;
2472 }
2473
2474 static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
2475 {
2476         if (sk->sk_type != SOCK_SEQPACKET)
2477                 return;
2478
2479         if (encrypt == 0x00) {
2480                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
2481                         l2cap_sock_clear_timer(sk);
2482                         l2cap_sock_set_timer(sk, HZ * 5);
2483                 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
2484                         __l2cap_sock_close(sk, ECONNREFUSED);
2485         } else {
2486                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
2487                         l2cap_sock_clear_timer(sk);
2488         }
2489 }
2490
2491 static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
2492 {
2493         struct l2cap_chan_list *l;
2494         struct l2cap_conn *conn = hcon->l2cap_data;
2495         struct sock *sk;
2496
2497         if (!conn)
2498                 return 0;
2499
2500         l = &conn->chan_list;
2501
2502         BT_DBG("conn %p", conn);
2503
2504         read_lock(&l->lock);
2505
2506         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2507                 bh_lock_sock(sk);
2508
2509                 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
2510                         bh_unlock_sock(sk);
2511                         continue;
2512                 }
2513
2514                 if (!status && (sk->sk_state == BT_CONNECTED ||
2515                                                 sk->sk_state == BT_CONFIG)) {
2516                         l2cap_check_encryption(sk, encrypt);
2517                         bh_unlock_sock(sk);
2518                         continue;
2519                 }
2520
2521                 if (sk->sk_state == BT_CONNECT) {
2522                         if (!status) {
2523                                 struct l2cap_conn_req req;
2524                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2525                                 req.psm  = l2cap_pi(sk)->psm;
2526
2527                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
2528
2529                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2530                                         L2CAP_CONN_REQ, sizeof(req), &req);
2531                         } else {
2532                                 l2cap_sock_clear_timer(sk);
2533                                 l2cap_sock_set_timer(sk, HZ / 10);
2534                         }
2535                 } else if (sk->sk_state == BT_CONNECT2) {
2536                         struct l2cap_conn_rsp rsp;
2537                         __u16 result;
2538
2539                         if (!status) {
2540                                 sk->sk_state = BT_CONFIG;
2541                                 result = L2CAP_CR_SUCCESS;
2542                         } else {
2543                                 sk->sk_state = BT_DISCONN;
2544                                 l2cap_sock_set_timer(sk, HZ / 10);
2545                                 result = L2CAP_CR_SEC_BLOCK;
2546                         }
2547
2548                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
2549                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
2550                         rsp.result = cpu_to_le16(result);
2551                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2552                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2553                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2554                 }
2555
2556                 bh_unlock_sock(sk);
2557         }
2558
2559         read_unlock(&l->lock);
2560
2561         return 0;
2562 }
2563
2564 static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
2565 {
2566         struct l2cap_conn *conn = hcon->l2cap_data;
2567
2568         if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
2569                 goto drop;
2570
2571         BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
2572
2573         if (flags & ACL_START) {
2574                 struct l2cap_hdr *hdr;
2575                 int len;
2576
2577                 if (conn->rx_len) {
2578                         BT_ERR("Unexpected start frame (len %d)", skb->len);
2579                         kfree_skb(conn->rx_skb);
2580                         conn->rx_skb = NULL;
2581                         conn->rx_len = 0;
2582                         l2cap_conn_unreliable(conn, ECOMM);
2583                 }
2584
2585                 if (skb->len < 2) {
2586                         BT_ERR("Frame is too short (len %d)", skb->len);
2587                         l2cap_conn_unreliable(conn, ECOMM);
2588                         goto drop;
2589                 }
2590
2591                 hdr = (struct l2cap_hdr *) skb->data;
2592                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
2593
2594                 if (len == skb->len) {
2595                         /* Complete frame received */
2596                         l2cap_recv_frame(conn, skb);
2597                         return 0;
2598                 }
2599
2600                 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
2601
2602                 if (skb->len > len) {
2603                         BT_ERR("Frame is too long (len %d, expected len %d)",
2604                                 skb->len, len);
2605                         l2cap_conn_unreliable(conn, ECOMM);
2606                         goto drop;
2607                 }
2608
2609                 /* Allocate skb for the complete frame (with header) */
2610                 if (!(conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC)))
2611                         goto drop;
2612
2613                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2614                                                                 skb->len);
2615                 conn->rx_len = len - skb->len;
2616         } else {
2617                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
2618
2619                 if (!conn->rx_len) {
2620                         BT_ERR("Unexpected continuation frame (len %d)", skb->len);
2621                         l2cap_conn_unreliable(conn, ECOMM);
2622                         goto drop;
2623                 }
2624
2625                 if (skb->len > conn->rx_len) {
2626                         BT_ERR("Fragment is too long (len %d, expected %d)",
2627                                         skb->len, conn->rx_len);
2628                         kfree_skb(conn->rx_skb);
2629                         conn->rx_skb = NULL;
2630                         conn->rx_len = 0;
2631                         l2cap_conn_unreliable(conn, ECOMM);
2632                         goto drop;
2633                 }
2634
2635                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2636                                                                 skb->len);
2637                 conn->rx_len -= skb->len;
2638
2639                 if (!conn->rx_len) {
2640                         /* Complete frame received */
2641                         l2cap_recv_frame(conn, conn->rx_skb);
2642                         conn->rx_skb = NULL;
2643                 }
2644         }
2645
2646 drop:
2647         kfree_skb(skb);
2648         return 0;
2649 }
2650
2651 static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
2652 {
2653         struct sock *sk;
2654         struct hlist_node *node;
2655         char *str = buf;
2656
2657         read_lock_bh(&l2cap_sk_list.lock);
2658
2659         sk_for_each(sk, node, &l2cap_sk_list.head) {
2660                 struct l2cap_pinfo *pi = l2cap_pi(sk);
2661
2662                 str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
2663                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2664                                 sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
2665                                 pi->imtu, pi->omtu, pi->sec_level);
2666         }
2667
2668         read_unlock_bh(&l2cap_sk_list.lock);
2669
2670         return (str - buf);
2671 }
2672
2673 static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
2674
2675 static const struct proto_ops l2cap_sock_ops = {
2676         .family         = PF_BLUETOOTH,
2677         .owner          = THIS_MODULE,
2678         .release        = l2cap_sock_release,
2679         .bind           = l2cap_sock_bind,
2680         .connect        = l2cap_sock_connect,
2681         .listen         = l2cap_sock_listen,
2682         .accept         = l2cap_sock_accept,
2683         .getname        = l2cap_sock_getname,
2684         .sendmsg        = l2cap_sock_sendmsg,
2685         .recvmsg        = l2cap_sock_recvmsg,
2686         .poll           = bt_sock_poll,
2687         .ioctl          = bt_sock_ioctl,
2688         .mmap           = sock_no_mmap,
2689         .socketpair     = sock_no_socketpair,
2690         .shutdown       = l2cap_sock_shutdown,
2691         .setsockopt     = l2cap_sock_setsockopt,
2692         .getsockopt     = l2cap_sock_getsockopt
2693 };
2694
2695 static struct net_proto_family l2cap_sock_family_ops = {
2696         .family = PF_BLUETOOTH,
2697         .owner  = THIS_MODULE,
2698         .create = l2cap_sock_create,
2699 };
2700
2701 static struct hci_proto l2cap_hci_proto = {
2702         .name           = "L2CAP",
2703         .id             = HCI_PROTO_L2CAP,
2704         .connect_ind    = l2cap_connect_ind,
2705         .connect_cfm    = l2cap_connect_cfm,
2706         .disconn_ind    = l2cap_disconn_ind,
2707         .security_cfm   = l2cap_security_cfm,
2708         .recv_acldata   = l2cap_recv_acldata
2709 };
2710
2711 static int __init l2cap_init(void)
2712 {
2713         int err;
2714
2715         err = proto_register(&l2cap_proto, 0);
2716         if (err < 0)
2717                 return err;
2718
2719         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2720         if (err < 0) {
2721                 BT_ERR("L2CAP socket registration failed");
2722                 goto error;
2723         }
2724
2725         err = hci_register_proto(&l2cap_hci_proto);
2726         if (err < 0) {
2727                 BT_ERR("L2CAP protocol registration failed");
2728                 bt_sock_unregister(BTPROTO_L2CAP);
2729                 goto error;
2730         }
2731
2732         if (class_create_file(bt_class, &class_attr_l2cap) < 0)
2733                 BT_ERR("Failed to create L2CAP info file");
2734
2735         BT_INFO("L2CAP ver %s", VERSION);
2736         BT_INFO("L2CAP socket layer initialized");
2737
2738         return 0;
2739
2740 error:
2741         proto_unregister(&l2cap_proto);
2742         return err;
2743 }
2744
2745 static void __exit l2cap_exit(void)
2746 {
2747         class_remove_file(bt_class, &class_attr_l2cap);
2748
2749         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
2750                 BT_ERR("L2CAP socket unregistration failed");
2751
2752         if (hci_unregister_proto(&l2cap_hci_proto) < 0)
2753                 BT_ERR("L2CAP protocol unregistration failed");
2754
2755         proto_unregister(&l2cap_proto);
2756 }
2757
2758 void l2cap_load(void)
2759 {
2760         /* Dummy function to trigger automatic L2CAP module loading by
2761          * other modules that use L2CAP sockets but don't use any other
2762          * symbols from it. */
2763         return;
2764 }
2765 EXPORT_SYMBOL(l2cap_load);
2766
2767 module_init(l2cap_init);
2768 module_exit(l2cap_exit);
2769
2770 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2771 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2772 MODULE_VERSION(VERSION);
2773 MODULE_LICENSE("GPL");
2774 MODULE_ALIAS("bt-proto-0");