net/bluetooth/l2cap.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth L2CAP core and sockets. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/capability.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <net/sock.h>
  44
  45 #include <asm/system.h>
  46 #include <asm/uaccess.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/hci_core.h>
  51 #include <net/bluetooth/l2cap.h>
  52
  53 #define VERSION "2.11"
  54
  55 static u32 l2cap_feat_mask = 0x0000;
  56
  57 static const struct proto_ops l2cap_sock_ops;
  58
  59 static struct bt_sock_list l2cap_sk_list = {
  60         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  61 };
  62
  63 static void __l2cap_sock_close(struct sock *sk, int reason);
  64 static void l2cap_sock_close(struct sock *sk);
  65 static void l2cap_sock_kill(struct sock *sk);
  66
  67 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  68                                 u8 code, u8 ident, u16 dlen, void *data);
  69
  70 /* ---- L2CAP timers ---- */
  71 static void l2cap_sock_timeout(unsigned long arg)
  72 {
  73         struct sock *sk = (struct sock *) arg;
  74         int reason;
  75
  76         BT_DBG("sock %p state %d", sk, sk->sk_state);
  77
  78         bh_lock_sock(sk);
  79
  80         if (sk->sk_state == BT_CONNECT &&
  81                         (l2cap_pi(sk)->link_mode & (L2CAP_LM_AUTH |
  82                                         L2CAP_LM_ENCRYPT | L2CAP_LM_SECURE)))
  83                 reason = ECONNREFUSED;
  84         else
  85                 reason = ETIMEDOUT;
  86
  87         __l2cap_sock_close(sk, reason);
  88
  89         bh_unlock_sock(sk);
  90
  91         l2cap_sock_kill(sk);
  92         sock_put(sk);
  93 }
  94
  95 static void l2cap_sock_set_timer(struct sock *sk, long timeout)
  96 {
  97         BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
  98         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
  99 }
 100
 101 static void l2cap_sock_clear_timer(struct sock *sk)
 102 {
 103         BT_DBG("sock %p state %d", sk, sk->sk_state);
 104         sk_stop_timer(sk, &sk->sk_timer);
 105 }
 106
 107 /* ---- L2CAP channels ---- */
 108 static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
 109 {
 110         struct sock *s;
 111         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 112                 if (l2cap_pi(s)->dcid == cid)
 113                         break;
 114         }
 115         return s;
 116 }
 117
 118 static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 119 {
 120         struct sock *s;
 121         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 122                 if (l2cap_pi(s)->scid == cid)
 123                         break;
 124         }
 125         return s;
 126 }
 127
 128 /* Find channel with given SCID.
 129  * Returns locked socket */
 130 static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 131 {
 132         struct sock *s;
 133         read_lock(&l->lock);
 134         s = __l2cap_get_chan_by_scid(l, cid);
 135         if (s) bh_lock_sock(s);
 136         read_unlock(&l->lock);
 137         return s;
 138 }
 139
 140 static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 141 {
 142         struct sock *s;
 143         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 144                 if (l2cap_pi(s)->ident == ident)
 145                         break;
 146         }
 147         return s;
 148 }
 149
 150 static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 151 {
 152         struct sock *s;
 153         read_lock(&l->lock);
 154         s = __l2cap_get_chan_by_ident(l, ident);
 155         if (s) bh_lock_sock(s);
 156         read_unlock(&l->lock);
 157         return s;
 158 }
 159
 160 static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
 161 {
 162         u16 cid = 0x0040;
 163
 164         for (; cid < 0xffff; cid++) {
 165                 if(!__l2cap_get_chan_by_scid(l, cid))
 166                         return cid;
 167         }
 168
 169         return 0;
 170 }
 171
 172 static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
 173 {
 174         sock_hold(sk);
 175
 176         if (l->head)
 177                 l2cap_pi(l->head)->prev_c = sk;
 178
 179         l2cap_pi(sk)->next_c = l->head;
 180         l2cap_pi(sk)->prev_c = NULL;
 181         l->head = sk;
 182 }
 183
 184 static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 185 {
 186         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 187
 188         write_lock_bh(&l->lock);
 189         if (sk == l->head)
 190                 l->head = next;
 191
 192         if (next)
 193                 l2cap_pi(next)->prev_c = prev;
 194         if (prev)
 195                 l2cap_pi(prev)->next_c = next;
 196         write_unlock_bh(&l->lock);
 197
 198         __sock_put(sk);
 199 }
 200
 201 static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 202 {
 203         struct l2cap_chan_list *l = &conn->chan_list;
 204
 205         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn, l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
 206
 207         l2cap_pi(sk)->conn = conn;
 208
 209         if (sk->sk_type == SOCK_SEQPACKET) {
 210                 /* Alloc CID for connection-oriented socket */
 211                 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
 212         } else if (sk->sk_type == SOCK_DGRAM) {
 213                 /* Connectionless socket */
 214                 l2cap_pi(sk)->scid = 0x0002;
 215                 l2cap_pi(sk)->dcid = 0x0002;
 216                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 217         } else {
 218                 /* Raw socket can send/recv signalling messages only */
 219                 l2cap_pi(sk)->scid = 0x0001;
 220                 l2cap_pi(sk)->dcid = 0x0001;
 221                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 222         }
 223
 224         __l2cap_chan_link(l, sk);
 225
 226         if (parent)
 227                 bt_accept_enqueue(parent, sk);
 228 }
 229
 230 /* Delete channel.
 231  * Must be called on the locked socket. */
 232 static void l2cap_chan_del(struct sock *sk, int err)
 233 {
 234         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 235         struct sock *parent = bt_sk(sk)->parent;
 236
 237         l2cap_sock_clear_timer(sk);
 238
 239         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 240
 241         if (conn) {
 242                 /* Unlink from channel list */
 243                 l2cap_chan_unlink(&conn->chan_list, sk);
 244                 l2cap_pi(sk)->conn = NULL;
 245                 hci_conn_put(conn->hcon);
 246         }
 247
 248         sk->sk_state = BT_CLOSED;
 249         sock_set_flag(sk, SOCK_ZAPPED);
 250
 251         if (err)
 252                 sk->sk_err = err;
 253
 254         if (parent) {
 255                 bt_accept_unlink(sk);
 256                 parent->sk_data_ready(parent, 0);
 257         } else
 258                 sk->sk_state_change(sk);
 259 }
 260
 261 /* Service level security */
 262 static inline int l2cap_check_link_mode(struct sock *sk)
 263 {
 264         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 265
 266         if (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)
 267                 return hci_conn_security(conn->hcon, BT_SECURITY_HIGH);
 268
 269         if (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT)
 270                 return hci_conn_security(conn->hcon, BT_SECURITY_MEDIUM);
 271
 272         if (l2cap_pi(sk)->link_mode & L2CAP_LM_AUTH)
 273                 return hci_conn_security(conn->hcon, BT_SECURITY_LOW);
 274
 275         if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001))
 276                 return hci_conn_security(conn->hcon, BT_SECURITY_SDP);
 277
 278         return 1;
 279 }
 280
 281 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
 282 {
 283         u8 id;
 284
 285         /* Get next available identificator.
 286          *    1 - 128 are used by kernel.
 287          *  129 - 199 are reserved.
 288          *  200 - 254 are used by utilities like l2ping, etc.
 289          */
 290
 291         spin_lock_bh(&conn->lock);
 292
 293         if (++conn->tx_ident > 128)
 294                 conn->tx_ident = 1;
 295
 296         id = conn->tx_ident;
 297
 298         spin_unlock_bh(&conn->lock);
 299
 300         return id;
 301 }
 302
 303 static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 304 {
 305         struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 306
 307         BT_DBG("code 0x%2.2x", code);
 308
 309         if (!skb)
 310                 return -ENOMEM;
 311
 312         return hci_send_acl(conn->hcon, skb, 0);
 313 }
 314
 315 static void l2cap_do_start(struct sock *sk)
 316 {
 317         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 318
 319         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
 320                 if (l2cap_check_link_mode(sk)) {
 321                         struct l2cap_conn_req req;
 322                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 323                         req.psm  = l2cap_pi(sk)->psm;
 324
 325                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 326
 327                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 328                                         L2CAP_CONN_REQ, sizeof(req), &req);
 329                 }
 330         } else {
 331                 struct l2cap_info_req req;
 332                 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 333
 334                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
 335                 conn->info_ident = l2cap_get_ident(conn);
 336
 337                 mod_timer(&conn->info_timer, jiffies +
 338                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
 339
 340                 l2cap_send_cmd(conn, conn->info_ident,
 341                                         L2CAP_INFO_REQ, sizeof(req), &req);
 342         }
 343 }
 344
 345 /* ---- L2CAP connections ---- */
 346 static void l2cap_conn_start(struct l2cap_conn *conn)
 347 {
 348         struct l2cap_chan_list *l = &conn->chan_list;
 349         struct sock *sk;
 350
 351         BT_DBG("conn %p", conn);
 352
 353         read_lock(&l->lock);
 354
 355         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 356                 bh_lock_sock(sk);
 357
 358                 if (sk->sk_type != SOCK_SEQPACKET) {
 359                         bh_unlock_sock(sk);
 360                         continue;
 361                 }
 362
 363                 if (sk->sk_state == BT_CONNECT) {
 364                         if (l2cap_check_link_mode(sk)) {
 365                                 struct l2cap_conn_req req;
 366                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 367                                 req.psm  = l2cap_pi(sk)->psm;
 368
 369                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 370
 371                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 372                                         L2CAP_CONN_REQ, sizeof(req), &req);
 373                         }
 374                 } else if (sk->sk_state == BT_CONNECT2) {
 375                         struct l2cap_conn_rsp rsp;
 376                         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
 377                         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
 378
 379                         if (l2cap_check_link_mode(sk)) {
 380                                 if (bt_sk(sk)->defer_setup) {
 381                                         struct sock *parent = bt_sk(sk)->parent;
 382                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 383                                         rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
 384                                         parent->sk_data_ready(parent, 0);
 385
 386                                 } else {
 387                                         sk->sk_state = BT_CONFIG;
 388                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 389                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 390                                 }
 391                         } else {
 392                                 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 393                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
 394                         }
 395
 396                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 397                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 398                 }
 399
 400                 bh_unlock_sock(sk);
 401         }
 402
 403         read_unlock(&l->lock);
 404 }
 405
 406 static void l2cap_conn_ready(struct l2cap_conn *conn)
 407 {
 408         struct l2cap_chan_list *l = &conn->chan_list;
 409         struct sock *sk;
 410
 411         BT_DBG("conn %p", conn);
 412
 413         read_lock(&l->lock);
 414
 415         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 416                 bh_lock_sock(sk);
 417
 418                 if (sk->sk_type != SOCK_SEQPACKET) {
 419                         l2cap_sock_clear_timer(sk);
 420                         sk->sk_state = BT_CONNECTED;
 421                         sk->sk_state_change(sk);
 422                 } else if (sk->sk_state == BT_CONNECT)
 423                         l2cap_do_start(sk);
 424
 425                 bh_unlock_sock(sk);
 426         }
 427
 428         read_unlock(&l->lock);
 429 }
 430
 431 /* Notify sockets that we cannot guaranty reliability anymore */
 432 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 433 {
 434         struct l2cap_chan_list *l = &conn->chan_list;
 435         struct sock *sk;
 436
 437         BT_DBG("conn %p", conn);
 438
 439         read_lock(&l->lock);
 440
 441         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 442                 if (l2cap_pi(sk)->link_mode & L2CAP_LM_RELIABLE)
 443                         sk->sk_err = err;
 444         }
 445
 446         read_unlock(&l->lock);
 447 }
 448
 449 static void l2cap_info_timeout(unsigned long arg)
 450 {
 451         struct l2cap_conn *conn = (void *) arg;
 452
 453         conn->info_ident = 0;
 454
 455         l2cap_conn_start(conn);
 456 }
 457
 458 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 459 {
 460         struct l2cap_conn *conn = hcon->l2cap_data;
 461
 462         if (conn || status)
 463                 return conn;
 464
 465         conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
 466         if (!conn)
 467                 return NULL;
 468
 469         hcon->l2cap_data = conn;
 470         conn->hcon = hcon;
 471
 472         BT_DBG("hcon %p conn %p", hcon, conn);
 473
 474         conn->mtu = hcon->hdev->acl_mtu;
 475         conn->src = &hcon->hdev->bdaddr;
 476         conn->dst = &hcon->dst;
 477
 478         conn->feat_mask = 0;
 479
 480         setup_timer(&conn->info_timer, l2cap_info_timeout,
 481                                                 (unsigned long) conn);
 482
 483         spin_lock_init(&conn->lock);
 484         rwlock_init(&conn->chan_list.lock);
 485
 486         return conn;
 487 }
 488
 489 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 490 {
 491         struct l2cap_conn *conn = hcon->l2cap_data;
 492         struct sock *sk;
 493
 494         if (!conn)
 495                 return;
 496
 497         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 498
 499         if (conn->rx_skb)
 500                 kfree_skb(conn->rx_skb);
 501
 502         /* Kill channels */
 503         while ((sk = conn->chan_list.head)) {
 504                 bh_lock_sock(sk);
 505                 l2cap_chan_del(sk, err);
 506                 bh_unlock_sock(sk);
 507                 l2cap_sock_kill(sk);
 508         }
 509
 510         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 511                 del_timer_sync(&conn->info_timer);
 512
 513         hcon->l2cap_data = NULL;
 514         kfree(conn);
 515 }
 516
 517 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 518 {
 519         struct l2cap_chan_list *l = &conn->chan_list;
 520         write_lock_bh(&l->lock);
 521         __l2cap_chan_add(conn, sk, parent);
 522         write_unlock_bh(&l->lock);
 523 }
 524
 525 /* ---- Socket interface ---- */
 526 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 527 {
 528         struct sock *sk;
 529         struct hlist_node *node;
 530         sk_for_each(sk, node, &l2cap_sk_list.head)
 531                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
 532                         goto found;
 533         sk = NULL;
 534 found:
 535         return sk;
 536 }
 537
 538 /* Find socket with psm and source bdaddr.
 539  * Returns closest match.
 540  */
 541 static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 542 {
 543         struct sock *sk = NULL, *sk1 = NULL;
 544         struct hlist_node *node;
 545
 546         sk_for_each(sk, node, &l2cap_sk_list.head) {
 547                 if (state && sk->sk_state != state)
 548                         continue;
 549
 550                 if (l2cap_pi(sk)->psm == psm) {
 551                         /* Exact match. */
 552                         if (!bacmp(&bt_sk(sk)->src, src))
 553                                 break;
 554
 555                         /* Closest match */
 556                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 557                                 sk1 = sk;
 558                 }
 559         }
 560         return node ? sk : sk1;
 561 }
 562
 563 /* Find socket with given address (psm, src).
 564  * Returns locked socket */
 565 static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 566 {
 567         struct sock *s;
 568         read_lock(&l2cap_sk_list.lock);
 569         s = __l2cap_get_sock_by_psm(state, psm, src);
 570         if (s) bh_lock_sock(s);
 571         read_unlock(&l2cap_sk_list.lock);
 572         return s;
 573 }
 574
 575 static void l2cap_sock_destruct(struct sock *sk)
 576 {
 577         BT_DBG("sk %p", sk);
 578
 579         skb_queue_purge(&sk->sk_receive_queue);
 580         skb_queue_purge(&sk->sk_write_queue);
 581 }
 582
 583 static void l2cap_sock_cleanup_listen(struct sock *parent)
 584 {
 585         struct sock *sk;
 586
 587         BT_DBG("parent %p", parent);
 588
 589         /* Close not yet accepted channels */
 590         while ((sk = bt_accept_dequeue(parent, NULL)))
 591                 l2cap_sock_close(sk);
 592
 593         parent->sk_state = BT_CLOSED;
 594         sock_set_flag(parent, SOCK_ZAPPED);
 595 }
 596
 597 /* Kill socket (only if zapped and orphan)
 598  * Must be called on unlocked socket.
 599  */
 600 static void l2cap_sock_kill(struct sock *sk)
 601 {
 602         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 603                 return;
 604
 605         BT_DBG("sk %p state %d", sk, sk->sk_state);
 606
 607         /* Kill poor orphan */
 608         bt_sock_unlink(&l2cap_sk_list, sk);
 609         sock_set_flag(sk, SOCK_DEAD);
 610         sock_put(sk);
 611 }
 612
 613 static void __l2cap_sock_close(struct sock *sk, int reason)
 614 {
 615         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 616
 617         switch (sk->sk_state) {
 618         case BT_LISTEN:
 619                 l2cap_sock_cleanup_listen(sk);
 620                 break;
 621
 622         case BT_CONNECTED:
 623         case BT_CONFIG:
 624                 if (sk->sk_type == SOCK_SEQPACKET) {
 625                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 626                         struct l2cap_disconn_req req;
 627
 628                         sk->sk_state = BT_DISCONN;
 629                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 630
 631                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
 632                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 633                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
 634                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 635                 } else
 636                         l2cap_chan_del(sk, reason);
 637                 break;
 638
 639         case BT_CONNECT2:
 640                 if (sk->sk_type == SOCK_SEQPACKET) {
 641                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 642                         struct l2cap_conn_rsp rsp;
 643                         __u16 result;
 644
 645                         if (bt_sk(sk)->defer_setup)
 646                                 result = L2CAP_CR_SEC_BLOCK;
 647                         else
 648                                 result = L2CAP_CR_BAD_PSM;
 649
 650                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
 651                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
 652                         rsp.result = cpu_to_le16(result);
 653                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 654                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 655                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 656                 } else
 657                         l2cap_chan_del(sk, reason);
 658                 break;
 659
 660         case BT_CONNECT:
 661         case BT_DISCONN:
 662                 l2cap_chan_del(sk, reason);
 663                 break;
 664
 665         default:
 666                 sock_set_flag(sk, SOCK_ZAPPED);
 667                 break;
 668         }
 669 }
 670
 671 /* Must be called on unlocked socket. */
 672 static void l2cap_sock_close(struct sock *sk)
 673 {
 674         l2cap_sock_clear_timer(sk);
 675         lock_sock(sk);
 676         __l2cap_sock_close(sk, ECONNRESET);
 677         release_sock(sk);
 678         l2cap_sock_kill(sk);
 679 }
 680
 681 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 682 {
 683         struct l2cap_pinfo *pi = l2cap_pi(sk);
 684
 685         BT_DBG("sk %p", sk);
 686
 687         if (parent) {
 688                 sk->sk_type = parent->sk_type;
 689                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 690
 691                 pi->imtu = l2cap_pi(parent)->imtu;
 692                 pi->omtu = l2cap_pi(parent)->omtu;
 693                 pi->link_mode = l2cap_pi(parent)->link_mode;
 694         } else {
 695                 pi->imtu = L2CAP_DEFAULT_MTU;
 696                 pi->omtu = 0;
 697                 pi->link_mode = 0;
 698         }
 699
 700         /* Default config options */
 701         pi->conf_len = 0;
 702         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 703 }
 704
 705 static struct proto l2cap_proto = {
 706         .name           = "L2CAP",
 707         .owner          = THIS_MODULE,
 708         .obj_size       = sizeof(struct l2cap_pinfo)
 709 };
 710
 711 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 712 {
 713         struct sock *sk;
 714
 715         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 716         if (!sk)
 717                 return NULL;
 718
 719         sock_init_data(sock, sk);
 720         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 721
 722         sk->sk_destruct = l2cap_sock_destruct;
 723         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 724
 725         sock_reset_flag(sk, SOCK_ZAPPED);
 726
 727         sk->sk_protocol = proto;
 728         sk->sk_state = BT_OPEN;
 729
 730         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 731
 732         bt_sock_link(&l2cap_sk_list, sk);
 733         return sk;
 734 }
 735
 736 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
 737 {
 738         struct sock *sk;
 739
 740         BT_DBG("sock %p", sock);
 741
 742         sock->state = SS_UNCONNECTED;
 743
 744         if (sock->type != SOCK_SEQPACKET &&
 745                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 746                 return -ESOCKTNOSUPPORT;
 747
 748         if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
 749                 return -EPERM;
 750
 751         sock->ops = &l2cap_sock_ops;
 752
 753         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 754         if (!sk)
 755                 return -ENOMEM;
 756
 757         l2cap_sock_init(sk, NULL);
 758         return 0;
 759 }
 760
 761 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 762 {
 763         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 764         struct sock *sk = sock->sk;
 765         int err = 0;
 766
 767         BT_DBG("sk %p, %s %d", sk, batostr(&la->l2_bdaddr), la->l2_psm);
 768
 769         if (!addr || addr->sa_family != AF_BLUETOOTH)
 770                 return -EINVAL;
 771
 772         lock_sock(sk);
 773
 774         if (sk->sk_state != BT_OPEN) {
 775                 err = -EBADFD;
 776                 goto done;
 777         }
 778
 779         if (la->l2_psm && btohs(la->l2_psm) < 0x1001 &&
 780                                 !capable(CAP_NET_BIND_SERVICE)) {
 781                 err = -EACCES;
 782                 goto done;
 783         }
 784
 785         write_lock_bh(&l2cap_sk_list.lock);
 786
 787         if (la->l2_psm && __l2cap_get_sock_by_addr(la->l2_psm, &la->l2_bdaddr)) {
 788                 err = -EADDRINUSE;
 789         } else {
 790                 /* Save source address */
 791                 bacpy(&bt_sk(sk)->src, &la->l2_bdaddr);
 792                 l2cap_pi(sk)->psm   = la->l2_psm;
 793                 l2cap_pi(sk)->sport = la->l2_psm;
 794                 sk->sk_state = BT_BOUND;
 795         }
 796
 797         write_unlock_bh(&l2cap_sk_list.lock);
 798
 799 done:
 800         release_sock(sk);
 801         return err;
 802 }
 803
 804 static int l2cap_do_connect(struct sock *sk)
 805 {
 806         bdaddr_t *src = &bt_sk(sk)->src;
 807         bdaddr_t *dst = &bt_sk(sk)->dst;
 808         struct l2cap_conn *conn;
 809         struct hci_conn *hcon;
 810         struct hci_dev *hdev;
 811         __u8 sec_level;
 812         __u8 auth_type;
 813         int err = 0;
 814
 815         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst), l2cap_pi(sk)->psm);
 816
 817         if (!(hdev = hci_get_route(dst, src)))
 818                 return -EHOSTUNREACH;
 819
 820         hci_dev_lock_bh(hdev);
 821
 822         err = -ENOMEM;
 823
 824         if (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)
 825                 sec_level = BT_SECURITY_HIGH;
 826         else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001))
 827                 sec_level = BT_SECURITY_SDP;
 828         else if (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT)
 829                 sec_level = BT_SECURITY_MEDIUM;
 830         else
 831                 sec_level = BT_SECURITY_LOW;
 832
 833         if (sk->sk_type == SOCK_RAW) {
 834                 if (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)
 835                         auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 836                 else if (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT)
 837                         auth_type = HCI_AT_DEDICATED_BONDING;
 838                 else
 839                         auth_type = HCI_AT_NO_BONDING;
 840         } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 841                 if (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)
 842                         auth_type = HCI_AT_NO_BONDING_MITM;
 843                 else
 844                         auth_type = HCI_AT_NO_BONDING;
 845         } else {
 846                 if (l2cap_pi(sk)->link_mode & L2CAP_LM_SECURE)
 847                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 848                 else if (l2cap_pi(sk)->link_mode & L2CAP_LM_ENCRYPT)
 849                         auth_type = HCI_AT_GENERAL_BONDING;
 850                 else
 851                         auth_type = HCI_AT_NO_BONDING;
 852         }
 853
 854         hcon = hci_connect(hdev, ACL_LINK, dst, sec_level, auth_type);
 855         if (!hcon)
 856                 goto done;
 857
 858         conn = l2cap_conn_add(hcon, 0);
 859         if (!conn) {
 860                 hci_conn_put(hcon);
 861                 goto done;
 862         }
 863
 864         err = 0;
 865
 866         /* Update source addr of the socket */
 867         bacpy(src, conn->src);
 868
 869         l2cap_chan_add(conn, sk, NULL);
 870
 871         sk->sk_state = BT_CONNECT;
 872         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 873
 874         if (hcon->state == BT_CONNECTED) {
 875                 if (sk->sk_type != SOCK_SEQPACKET) {
 876                         l2cap_sock_clear_timer(sk);
 877                         sk->sk_state = BT_CONNECTED;
 878                 } else
 879                         l2cap_do_start(sk);
 880         }
 881
 882 done:
 883         hci_dev_unlock_bh(hdev);
 884         hci_dev_put(hdev);
 885         return err;
 886 }
 887
 888 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 889 {
 890         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 891         struct sock *sk = sock->sk;
 892         int err = 0;
 893
 894         lock_sock(sk);
 895
 896         BT_DBG("sk %p", sk);
 897
 898         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_l2)) {
 899                 err = -EINVAL;
 900                 goto done;
 901         }
 902
 903         if (sk->sk_type == SOCK_SEQPACKET && !la->l2_psm) {
 904                 err = -EINVAL;
 905                 goto done;
 906         }
 907
 908         switch(sk->sk_state) {
 909         case BT_CONNECT:
 910         case BT_CONNECT2:
 911         case BT_CONFIG:
 912                 /* Already connecting */
 913                 goto wait;
 914
 915         case BT_CONNECTED:
 916                 /* Already connected */
 917                 goto done;
 918
 919         case BT_OPEN:
 920         case BT_BOUND:
 921                 /* Can connect */
 922                 break;
 923
 924         default:
 925                 err = -EBADFD;
 926                 goto done;
 927         }
 928
 929         /* Set destination address and psm */
 930         bacpy(&bt_sk(sk)->dst, &la->l2_bdaddr);
 931         l2cap_pi(sk)->psm = la->l2_psm;
 932
 933         if ((err = l2cap_do_connect(sk)))
 934                 goto done;
 935
 936 wait:
 937         err = bt_sock_wait_state(sk, BT_CONNECTED,
 938                         sock_sndtimeo(sk, flags & O_NONBLOCK));
 939 done:
 940         release_sock(sk);
 941         return err;
 942 }
 943
 944 static int l2cap_sock_listen(struct socket *sock, int backlog)
 945 {
 946         struct sock *sk = sock->sk;
 947         int err = 0;
 948
 949         BT_DBG("sk %p backlog %d", sk, backlog);
 950
 951         lock_sock(sk);
 952
 953         if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
 954                 err = -EBADFD;
 955                 goto done;
 956         }
 957
 958         if (!l2cap_pi(sk)->psm) {
 959                 bdaddr_t *src = &bt_sk(sk)->src;
 960                 u16 psm;
 961
 962                 err = -EINVAL;
 963
 964                 write_lock_bh(&l2cap_sk_list.lock);
 965
 966                 for (psm = 0x1001; psm < 0x1100; psm += 2)
 967                         if (!__l2cap_get_sock_by_addr(htobs(psm), src)) {
 968                                 l2cap_pi(sk)->psm   = htobs(psm);
 969                                 l2cap_pi(sk)->sport = htobs(psm);
 970                                 err = 0;
 971                                 break;
 972                         }
 973
 974                 write_unlock_bh(&l2cap_sk_list.lock);
 975
 976                 if (err < 0)
 977                         goto done;
 978         }
 979
 980         sk->sk_max_ack_backlog = backlog;
 981         sk->sk_ack_backlog = 0;
 982         sk->sk_state = BT_LISTEN;
 983
 984 done:
 985         release_sock(sk);
 986         return err;
 987 }
 988
 989 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 990 {
 991         DECLARE_WAITQUEUE(wait, current);
 992         struct sock *sk = sock->sk, *nsk;
 993         long timeo;
 994         int err = 0;
 995
 996         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 997
 998         if (sk->sk_state != BT_LISTEN) {
 999                 err = -EBADFD;
1000                 goto done;
1001         }
1002
1003         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1004
1005         BT_DBG("sk %p timeo %ld", sk, timeo);
1006
1007         /* Wait for an incoming connection. (wake-one). */
1008         add_wait_queue_exclusive(sk->sk_sleep, &wait);
1009         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1010                 set_current_state(TASK_INTERRUPTIBLE);
1011                 if (!timeo) {
1012                         err = -EAGAIN;
1013                         break;
1014                 }
1015
1016                 release_sock(sk);
1017                 timeo = schedule_timeout(timeo);
1018                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1019
1020                 if (sk->sk_state != BT_LISTEN) {
1021                         err = -EBADFD;
1022                         break;
1023                 }
1024
1025                 if (signal_pending(current)) {
1026                         err = sock_intr_errno(timeo);
1027                         break;
1028                 }
1029         }
1030         set_current_state(TASK_RUNNING);
1031         remove_wait_queue(sk->sk_sleep, &wait);
1032
1033         if (err)
1034                 goto done;
1035
1036         newsock->state = SS_CONNECTED;
1037
1038         BT_DBG("new socket %p", nsk);
1039
1040 done:
1041         release_sock(sk);
1042         return err;
1043 }
1044
1045 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1046 {
1047         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1048         struct sock *sk = sock->sk;
1049
1050         BT_DBG("sock %p, sk %p", sock, sk);
1051
1052         addr->sa_family = AF_BLUETOOTH;
1053         *len = sizeof(struct sockaddr_l2);
1054
1055         if (peer)
1056                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
1057         else
1058                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
1059
1060         la->l2_psm = l2cap_pi(sk)->psm;
1061         return 0;
1062 }
1063
1064 static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
1065 {
1066         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1067         struct sk_buff *skb, **frag;
1068         int err, hlen, count, sent=0;
1069         struct l2cap_hdr *lh;
1070
1071         BT_DBG("sk %p len %d", sk, len);
1072
1073         /* First fragment (with L2CAP header) */
1074         if (sk->sk_type == SOCK_DGRAM)
1075                 hlen = L2CAP_HDR_SIZE + 2;
1076         else
1077                 hlen = L2CAP_HDR_SIZE;
1078
1079         count = min_t(unsigned int, (conn->mtu - hlen), len);
1080
1081         skb = bt_skb_send_alloc(sk, hlen + count,
1082                         msg->msg_flags & MSG_DONTWAIT, &err);
1083         if (!skb)
1084                 return err;
1085
1086         /* Create L2CAP header */
1087         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1088         lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1089         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1090
1091         if (sk->sk_type == SOCK_DGRAM)
1092                 put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
1093
1094         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
1095                 err = -EFAULT;
1096                 goto fail;
1097         }
1098
1099         sent += count;
1100         len  -= count;
1101
1102         /* Continuation fragments (no L2CAP header) */
1103         frag = &skb_shinfo(skb)->frag_list;
1104         while (len) {
1105                 count = min_t(unsigned int, conn->mtu, len);
1106
1107                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1108                 if (!*frag)
1109                         goto fail;
1110
1111                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
1112                         err = -EFAULT;
1113                         goto fail;
1114                 }
1115
1116                 sent += count;
1117                 len  -= count;
1118
1119                 frag = &(*frag)->next;
1120         }
1121
1122         if ((err = hci_send_acl(conn->hcon, skb, 0)) < 0)
1123                 goto fail;
1124
1125         return sent;
1126
1127 fail:
1128         kfree_skb(skb);
1129         return err;
1130 }
1131
1132 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1133 {
1134         struct sock *sk = sock->sk;
1135         int err = 0;
1136
1137         BT_DBG("sock %p, sk %p", sock, sk);
1138
1139         err = sock_error(sk);
1140         if (err)
1141                 return err;
1142
1143         if (msg->msg_flags & MSG_OOB)
1144                 return -EOPNOTSUPP;
1145
1146         /* Check outgoing MTU */
1147         if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
1148                 return -EINVAL;
1149
1150         lock_sock(sk);
1151
1152         if (sk->sk_state == BT_CONNECTED)
1153                 err = l2cap_do_send(sk, msg, len);
1154         else
1155                 err = -ENOTCONN;
1156
1157         release_sock(sk);
1158         return err;
1159 }
1160
1161 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1162 {
1163         struct sock *sk = sock->sk;
1164
1165         lock_sock(sk);
1166
1167         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1168                 struct l2cap_conn_rsp rsp;
1169
1170                 sk->sk_state = BT_CONFIG;
1171
1172                 rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1173                 rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
1174                 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1175                 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1176                 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1177                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1178
1179                 release_sock(sk);
1180                 return 0;
1181         }
1182
1183         release_sock(sk);
1184
1185         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1186 }
1187
1188 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
1189 {
1190         struct sock *sk = sock->sk;
1191         struct l2cap_options opts;
1192         int err = 0, len;
1193         u32 opt;
1194
1195         BT_DBG("sk %p", sk);
1196
1197         lock_sock(sk);
1198
1199         switch (optname) {
1200         case L2CAP_OPTIONS:
1201                 opts.imtu     = l2cap_pi(sk)->imtu;
1202                 opts.omtu     = l2cap_pi(sk)->omtu;
1203                 opts.flush_to = l2cap_pi(sk)->flush_to;
1204                 opts.mode     = L2CAP_MODE_BASIC;
1205
1206                 len = min_t(unsigned int, sizeof(opts), optlen);
1207                 if (copy_from_user((char *) &opts, optval, len)) {
1208                         err = -EFAULT;
1209                         break;
1210                 }
1211
1212                 l2cap_pi(sk)->imtu  = opts.imtu;
1213                 l2cap_pi(sk)->omtu  = opts.omtu;
1214                 break;
1215
1216         case L2CAP_LM:
1217                 if (get_user(opt, (u32 __user *) optval)) {
1218                         err = -EFAULT;
1219                         break;
1220                 }
1221
1222                 l2cap_pi(sk)->link_mode = opt;
1223                 break;
1224
1225         default:
1226                 err = -ENOPROTOOPT;
1227                 break;
1228         }
1229
1230         release_sock(sk);
1231         return err;
1232 }
1233
1234 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1235 {
1236         struct sock *sk = sock->sk;
1237         int err = 0;
1238         u32 opt;
1239
1240         BT_DBG("sk %p", sk);
1241
1242         if (level == SOL_L2CAP)
1243                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
1244
1245         lock_sock(sk);
1246
1247         switch (optname) {
1248         case BT_DEFER_SETUP:
1249                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1250                         err = -EINVAL;
1251                         break;
1252                 }
1253
1254                 if (get_user(opt, (u32 __user *) optval)) {
1255                         err = -EFAULT;
1256                         break;
1257                 }
1258
1259                 bt_sk(sk)->defer_setup = opt;
1260                 break;
1261
1262         default:
1263                 err = -ENOPROTOOPT;
1264                 break;
1265         }
1266
1267         release_sock(sk);
1268         return err;
1269 }
1270
1271 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1272 {
1273         struct sock *sk = sock->sk;
1274         struct l2cap_options opts;
1275         struct l2cap_conninfo cinfo;
1276         int len, err = 0;
1277
1278         BT_DBG("sk %p", sk);
1279
1280         if (get_user(len, optlen))
1281                 return -EFAULT;
1282
1283         lock_sock(sk);
1284
1285         switch (optname) {
1286         case L2CAP_OPTIONS:
1287                 opts.imtu     = l2cap_pi(sk)->imtu;
1288                 opts.omtu     = l2cap_pi(sk)->omtu;
1289                 opts.flush_to = l2cap_pi(sk)->flush_to;
1290                 opts.mode     = L2CAP_MODE_BASIC;
1291
1292                 len = min_t(unsigned int, len, sizeof(opts));
1293                 if (copy_to_user(optval, (char *) &opts, len))
1294                         err = -EFAULT;
1295
1296                 break;
1297
1298         case L2CAP_LM:
1299                 if (put_user(l2cap_pi(sk)->link_mode, (u32 __user *) optval))
1300                         err = -EFAULT;
1301                 break;
1302
1303         case L2CAP_CONNINFO:
1304                 if (sk->sk_state != BT_CONNECTED &&
1305                                         !(sk->sk_state == BT_CONNECT2 &&
1306                                                 bt_sk(sk)->defer_setup)) {
1307                         err = -ENOTCONN;
1308                         break;
1309                 }
1310
1311                 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
1312                 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
1313
1314                 len = min_t(unsigned int, len, sizeof(cinfo));
1315                 if (copy_to_user(optval, (char *) &cinfo, len))
1316                         err = -EFAULT;
1317
1318                 break;
1319
1320         default:
1321                 err = -ENOPROTOOPT;
1322                 break;
1323         }
1324
1325         release_sock(sk);
1326         return err;
1327 }
1328
1329 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
1330 {
1331         struct sock *sk = sock->sk;
1332         int len, err = 0;
1333
1334         BT_DBG("sk %p", sk);
1335
1336         if (level == SOL_L2CAP)
1337                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
1338
1339         if (get_user(len, optlen))
1340                 return -EFAULT;
1341
1342         lock_sock(sk);
1343
1344         switch (optname) {
1345         case BT_DEFER_SETUP:
1346                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1347                         err = -EINVAL;
1348                         break;
1349                 }
1350
1351                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
1352                         err = -EFAULT;
1353
1354                 break;
1355
1356         default:
1357                 err = -ENOPROTOOPT;
1358                 break;
1359         }
1360
1361         release_sock(sk);
1362         return err;
1363 }
1364
1365 static int l2cap_sock_shutdown(struct socket *sock, int how)
1366 {
1367         struct sock *sk = sock->sk;
1368         int err = 0;
1369
1370         BT_DBG("sock %p, sk %p", sock, sk);
1371
1372         if (!sk)
1373                 return 0;
1374
1375         lock_sock(sk);
1376         if (!sk->sk_shutdown) {
1377                 sk->sk_shutdown = SHUTDOWN_MASK;
1378                 l2cap_sock_clear_timer(sk);
1379                 __l2cap_sock_close(sk, 0);
1380
1381                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1382                         err = bt_sock_wait_state(sk, BT_CLOSED,
1383                                                         sk->sk_lingertime);
1384         }
1385         release_sock(sk);
1386         return err;
1387 }
1388
1389 static int l2cap_sock_release(struct socket *sock)
1390 {
1391         struct sock *sk = sock->sk;
1392         int err;
1393
1394         BT_DBG("sock %p, sk %p", sock, sk);
1395
1396         if (!sk)
1397                 return 0;
1398
1399         err = l2cap_sock_shutdown(sock, 2);
1400
1401         sock_orphan(sk);
1402         l2cap_sock_kill(sk);
1403         return err;
1404 }
1405
1406 static void l2cap_chan_ready(struct sock *sk)
1407 {
1408         struct sock *parent = bt_sk(sk)->parent;
1409
1410         BT_DBG("sk %p, parent %p", sk, parent);
1411
1412         l2cap_pi(sk)->conf_state = 0;
1413         l2cap_sock_clear_timer(sk);
1414
1415         if (!parent) {
1416                 /* Outgoing channel.
1417                  * Wake up socket sleeping on connect.
1418                  */
1419                 sk->sk_state = BT_CONNECTED;
1420                 sk->sk_state_change(sk);
1421         } else {
1422                 /* Incoming channel.
1423                  * Wake up socket sleeping on accept.
1424                  */
1425                 parent->sk_data_ready(parent, 0);
1426         }
1427 }
1428
1429 /* Copy frame to all raw sockets on that connection */
1430 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1431 {
1432         struct l2cap_chan_list *l = &conn->chan_list;
1433         struct sk_buff *nskb;
1434         struct sock * sk;
1435
1436         BT_DBG("conn %p", conn);
1437
1438         read_lock(&l->lock);
1439         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
1440                 if (sk->sk_type != SOCK_RAW)
1441                         continue;
1442
1443                 /* Don't send frame to the socket it came from */
1444                 if (skb->sk == sk)
1445                         continue;
1446
1447                 if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
1448                         continue;
1449
1450                 if (sock_queue_rcv_skb(sk, nskb))
1451                         kfree_skb(nskb);
1452         }
1453         read_unlock(&l->lock);
1454 }
1455
1456 /* ---- L2CAP signalling commands ---- */
1457 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1458                                 u8 code, u8 ident, u16 dlen, void *data)
1459 {
1460         struct sk_buff *skb, **frag;
1461         struct l2cap_cmd_hdr *cmd;
1462         struct l2cap_hdr *lh;
1463         int len, count;
1464
1465         BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d", conn, code, ident, dlen);
1466
1467         len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1468         count = min_t(unsigned int, conn->mtu, len);
1469
1470         skb = bt_skb_alloc(count, GFP_ATOMIC);
1471         if (!skb)
1472                 return NULL;
1473
1474         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1475         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
1476         lh->cid = cpu_to_le16(0x0001);
1477
1478         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1479         cmd->code  = code;
1480         cmd->ident = ident;
1481         cmd->len   = cpu_to_le16(dlen);
1482
1483         if (dlen) {
1484                 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1485                 memcpy(skb_put(skb, count), data, count);
1486                 data += count;
1487         }
1488
1489         len -= skb->len;
1490
1491         /* Continuation fragments (no L2CAP header) */
1492         frag = &skb_shinfo(skb)->frag_list;
1493         while (len) {
1494                 count = min_t(unsigned int, conn->mtu, len);
1495
1496                 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1497                 if (!*frag)
1498                         goto fail;
1499
1500                 memcpy(skb_put(*frag, count), data, count);
1501
1502                 len  -= count;
1503                 data += count;
1504
1505                 frag = &(*frag)->next;
1506         }
1507
1508         return skb;
1509
1510 fail:
1511         kfree_skb(skb);
1512         return NULL;
1513 }
1514
1515 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1516 {
1517         struct l2cap_conf_opt *opt = *ptr;
1518         int len;
1519
1520         len = L2CAP_CONF_OPT_SIZE + opt->len;
1521         *ptr += len;
1522
1523         *type = opt->type;
1524         *olen = opt->len;
1525
1526         switch (opt->len) {
1527         case 1:
1528                 *val = *((u8 *) opt->val);
1529                 break;
1530
1531         case 2:
1532                 *val = __le16_to_cpu(*((__le16 *) opt->val));
1533                 break;
1534
1535         case 4:
1536                 *val = __le32_to_cpu(*((__le32 *) opt->val));
1537                 break;
1538
1539         default:
1540                 *val = (unsigned long) opt->val;
1541                 break;
1542         }
1543
1544         BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1545         return len;
1546 }
1547
1548 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1549 {
1550         struct l2cap_conf_opt *opt = *ptr;
1551
1552         BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1553
1554         opt->type = type;
1555         opt->len  = len;
1556
1557         switch (len) {
1558         case 1:
1559                 *((u8 *) opt->val)  = val;
1560                 break;
1561
1562         case 2:
1563                 *((__le16 *) opt->val) = cpu_to_le16(val);
1564                 break;
1565
1566         case 4:
1567                 *((__le32 *) opt->val) = cpu_to_le32(val);
1568                 break;
1569
1570         default:
1571                 memcpy(opt->val, (void *) val, len);
1572                 break;
1573         }
1574
1575         *ptr += L2CAP_CONF_OPT_SIZE + len;
1576 }
1577
1578 static int l2cap_build_conf_req(struct sock *sk, void *data)
1579 {
1580         struct l2cap_pinfo *pi = l2cap_pi(sk);
1581         struct l2cap_conf_req *req = data;
1582         void *ptr = req->data;
1583
1584         BT_DBG("sk %p", sk);
1585
1586         if (pi->imtu != L2CAP_DEFAULT_MTU)
1587                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
1588
1589         /* FIXME: Need actual value of the flush timeout */
1590         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
1591         //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
1592
1593         req->dcid  = cpu_to_le16(pi->dcid);
1594         req->flags = cpu_to_le16(0);
1595
1596         return ptr - data;
1597 }
1598
1599 static int l2cap_parse_conf_req(struct sock *sk, void *data)
1600 {
1601         struct l2cap_pinfo *pi = l2cap_pi(sk);
1602         struct l2cap_conf_rsp *rsp = data;
1603         void *ptr = rsp->data;
1604         void *req = pi->conf_req;
1605         int len = pi->conf_len;
1606         int type, hint, olen;
1607         unsigned long val;
1608         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
1609         u16 mtu = L2CAP_DEFAULT_MTU;
1610         u16 result = L2CAP_CONF_SUCCESS;
1611
1612         BT_DBG("sk %p", sk);
1613
1614         while (len >= L2CAP_CONF_OPT_SIZE) {
1615                 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1616
1617                 hint  = type & 0x80;
1618                 type &= 0x7f;
1619
1620                 switch (type) {
1621                 case L2CAP_CONF_MTU:
1622                         mtu = val;
1623                         break;
1624
1625                 case L2CAP_CONF_FLUSH_TO:
1626                         pi->flush_to = val;
1627                         break;
1628
1629                 case L2CAP_CONF_QOS:
1630                         break;
1631
1632                 case L2CAP_CONF_RFC:
1633                         if (olen == sizeof(rfc))
1634                                 memcpy(&rfc, (void *) val, olen);
1635                         break;
1636
1637                 default:
1638                         if (hint)
1639                                 break;
1640
1641                         result = L2CAP_CONF_UNKNOWN;
1642                         *((u8 *) ptr++) = type;
1643                         break;
1644                 }
1645         }
1646
1647         if (result == L2CAP_CONF_SUCCESS) {
1648                 /* Configure output options and let the other side know
1649                  * which ones we don't like. */
1650
1651                 if (rfc.mode == L2CAP_MODE_BASIC) {
1652                         if (mtu < pi->omtu)
1653                                 result = L2CAP_CONF_UNACCEPT;
1654                         else {
1655                                 pi->omtu = mtu;
1656                                 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
1657                         }
1658
1659                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
1660                 } else {
1661                         result = L2CAP_CONF_UNACCEPT;
1662
1663                         memset(&rfc, 0, sizeof(rfc));
1664                         rfc.mode = L2CAP_MODE_BASIC;
1665
1666                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1667                                                 sizeof(rfc), (unsigned long) &rfc);
1668                 }
1669         }
1670
1671         rsp->scid   = cpu_to_le16(pi->dcid);
1672         rsp->result = cpu_to_le16(result);
1673         rsp->flags  = cpu_to_le16(0x0000);
1674
1675         return ptr - data;
1676 }
1677
1678 static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1679 {
1680         struct l2cap_conf_rsp *rsp = data;
1681         void *ptr = rsp->data;
1682
1683         BT_DBG("sk %p", sk);
1684
1685         rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1686         rsp->result = cpu_to_le16(result);
1687         rsp->flags  = cpu_to_le16(flags);
1688
1689         return ptr - data;
1690 }
1691
1692 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1693 {
1694         struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
1695
1696         if (rej->reason != 0x0000)
1697                 return 0;
1698
1699         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
1700                                         cmd->ident == conn->info_ident) {
1701                 conn->info_ident = 0;
1702                 del_timer(&conn->info_timer);
1703                 l2cap_conn_start(conn);
1704         }
1705
1706         return 0;
1707 }
1708
1709 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1710 {
1711         struct l2cap_chan_list *list = &conn->chan_list;
1712         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
1713         struct l2cap_conn_rsp rsp;
1714         struct sock *sk, *parent;
1715         int result, status = L2CAP_CS_NO_INFO;
1716
1717         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
1718         __le16 psm = req->psm;
1719
1720         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
1721
1722         /* Check if we have socket listening on psm */
1723         parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
1724         if (!parent) {
1725                 result = L2CAP_CR_BAD_PSM;
1726                 goto sendresp;
1727         }
1728
1729         /* Check if the ACL is secure enough (if not SDP) */
1730         if (psm != cpu_to_le16(0x0001) &&
1731                                 !hci_conn_check_link_mode(conn->hcon)) {
1732                 result = L2CAP_CR_SEC_BLOCK;
1733                 goto response;
1734         }
1735
1736         result = L2CAP_CR_NO_MEM;
1737
1738         /* Check for backlog size */
1739         if (sk_acceptq_is_full(parent)) {
1740                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1741                 goto response;
1742         }
1743
1744         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1745         if (!sk)
1746                 goto response;
1747
1748         write_lock_bh(&list->lock);
1749
1750         /* Check if we already have channel with that dcid */
1751         if (__l2cap_get_chan_by_dcid(list, scid)) {
1752                 write_unlock_bh(&list->lock);
1753                 sock_set_flag(sk, SOCK_ZAPPED);
1754                 l2cap_sock_kill(sk);
1755                 goto response;
1756         }
1757
1758         hci_conn_hold(conn->hcon);
1759
1760         l2cap_sock_init(sk, parent);
1761         bacpy(&bt_sk(sk)->src, conn->src);
1762         bacpy(&bt_sk(sk)->dst, conn->dst);
1763         l2cap_pi(sk)->psm  = psm;
1764         l2cap_pi(sk)->dcid = scid;
1765
1766         __l2cap_chan_add(conn, sk, parent);
1767         dcid = l2cap_pi(sk)->scid;
1768
1769         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1770
1771         l2cap_pi(sk)->ident = cmd->ident;
1772
1773         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
1774                 if (l2cap_check_link_mode(sk)) {
1775                         if (bt_sk(sk)->defer_setup) {
1776                                 sk->sk_state = BT_CONNECT2;
1777                                 result = L2CAP_CR_PEND;
1778                                 status = L2CAP_CS_AUTHOR_PEND;
1779                                 parent->sk_data_ready(parent, 0);
1780                         } else {
1781                                 sk->sk_state = BT_CONFIG;
1782                                 result = L2CAP_CR_SUCCESS;
1783                                 status = L2CAP_CS_NO_INFO;
1784                         }
1785                 } else {
1786                         sk->sk_state = BT_CONNECT2;
1787                         result = L2CAP_CR_PEND;
1788                         status = L2CAP_CS_AUTHEN_PEND;
1789                 }
1790         } else {
1791                 sk->sk_state = BT_CONNECT2;
1792                 result = L2CAP_CR_PEND;
1793                 status = L2CAP_CS_NO_INFO;
1794         }
1795
1796         write_unlock_bh(&list->lock);
1797
1798 response:
1799         bh_unlock_sock(parent);
1800
1801 sendresp:
1802         rsp.scid   = cpu_to_le16(scid);
1803         rsp.dcid   = cpu_to_le16(dcid);
1804         rsp.result = cpu_to_le16(result);
1805         rsp.status = cpu_to_le16(status);
1806         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1807
1808         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
1809                 struct l2cap_info_req info;
1810                 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1811
1812                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1813                 conn->info_ident = l2cap_get_ident(conn);
1814
1815                 mod_timer(&conn->info_timer, jiffies +
1816                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
1817
1818                 l2cap_send_cmd(conn, conn->info_ident,
1819                                         L2CAP_INFO_REQ, sizeof(info), &info);
1820         }
1821
1822         return 0;
1823 }
1824
1825 static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1826 {
1827         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
1828         u16 scid, dcid, result, status;
1829         struct sock *sk;
1830         u8 req[128];
1831
1832         scid   = __le16_to_cpu(rsp->scid);
1833         dcid   = __le16_to_cpu(rsp->dcid);
1834         result = __le16_to_cpu(rsp->result);
1835         status = __le16_to_cpu(rsp->status);
1836
1837         BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
1838
1839         if (scid) {
1840                 if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
1841                         return 0;
1842         } else {
1843                 if (!(sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident)))
1844                         return 0;
1845         }
1846
1847         switch (result) {
1848         case L2CAP_CR_SUCCESS:
1849                 sk->sk_state = BT_CONFIG;
1850                 l2cap_pi(sk)->ident = 0;
1851                 l2cap_pi(sk)->dcid = dcid;
1852                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1853
1854                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1855                                         l2cap_build_conf_req(sk, req), req);
1856                 break;
1857
1858         case L2CAP_CR_PEND:
1859                 break;
1860
1861         default:
1862                 l2cap_chan_del(sk, ECONNREFUSED);
1863                 break;
1864         }
1865
1866         bh_unlock_sock(sk);
1867         return 0;
1868 }
1869
1870 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
1871 {
1872         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
1873         u16 dcid, flags;
1874         u8 rsp[64];
1875         struct sock *sk;
1876         int len;
1877
1878         dcid  = __le16_to_cpu(req->dcid);
1879         flags = __le16_to_cpu(req->flags);
1880
1881         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
1882
1883         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
1884                 return -ENOENT;
1885
1886         if (sk->sk_state == BT_DISCONN)
1887                 goto unlock;
1888
1889         /* Reject if config buffer is too small. */
1890         len = cmd_len - sizeof(*req);
1891         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
1892                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
1893                                 l2cap_build_conf_rsp(sk, rsp,
1894                                         L2CAP_CONF_REJECT, flags), rsp);
1895                 goto unlock;
1896         }
1897
1898         /* Store config. */
1899         memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
1900         l2cap_pi(sk)->conf_len += len;
1901
1902         if (flags & 0x0001) {
1903                 /* Incomplete config. Send empty response. */
1904                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
1905                                 l2cap_build_conf_rsp(sk, rsp,
1906                                         L2CAP_CONF_SUCCESS, 0x0001), rsp);
1907                 goto unlock;
1908         }
1909
1910         /* Complete config. */
1911         len = l2cap_parse_conf_req(sk, rsp);
1912         if (len < 0)
1913                 goto unlock;
1914
1915         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
1916
1917         /* Reset config buffer. */
1918         l2cap_pi(sk)->conf_len = 0;
1919
1920         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
1921                 goto unlock;
1922
1923         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
1924                 sk->sk_state = BT_CONNECTED;
1925                 l2cap_chan_ready(sk);
1926                 goto unlock;
1927         }
1928
1929         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
1930                 u8 buf[64];
1931                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1932                                         l2cap_build_conf_req(sk, buf), buf);
1933         }
1934
1935 unlock:
1936         bh_unlock_sock(sk);
1937         return 0;
1938 }
1939
1940 static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1941 {
1942         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
1943         u16 scid, flags, result;
1944         struct sock *sk;
1945
1946         scid   = __le16_to_cpu(rsp->scid);
1947         flags  = __le16_to_cpu(rsp->flags);
1948         result = __le16_to_cpu(rsp->result);
1949
1950         BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x", scid, flags, result);
1951
1952         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
1953                 return 0;
1954
1955         switch (result) {
1956         case L2CAP_CONF_SUCCESS:
1957                 break;
1958
1959         case L2CAP_CONF_UNACCEPT:
1960                 if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
1961                         char req[128];
1962                         /* It does not make sense to adjust L2CAP parameters
1963                          * that are currently defined in the spec. We simply
1964                          * resend config request that we sent earlier. It is
1965                          * stupid, but it helps qualification testing which
1966                          * expects at least some response from us. */
1967                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1968                                                 l2cap_build_conf_req(sk, req), req);
1969                         goto done;
1970                 }
1971
1972         default:
1973                 sk->sk_state = BT_DISCONN;
1974                 sk->sk_err = ECONNRESET;
1975                 l2cap_sock_set_timer(sk, HZ * 5);
1976                 {
1977                         struct l2cap_disconn_req req;
1978                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
1979                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
1980                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
1981                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
1982                 }
1983                 goto done;
1984         }
1985
1986         if (flags & 0x01)
1987                 goto done;
1988
1989         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
1990
1991         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
1992                 sk->sk_state = BT_CONNECTED;
1993                 l2cap_chan_ready(sk);
1994         }
1995
1996 done:
1997         bh_unlock_sock(sk);
1998         return 0;
1999 }
2000
2001 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2002 {
2003         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2004         struct l2cap_disconn_rsp rsp;
2005         u16 dcid, scid;
2006         struct sock *sk;
2007
2008         scid = __le16_to_cpu(req->scid);
2009         dcid = __le16_to_cpu(req->dcid);
2010
2011         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2012
2013         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid)))
2014                 return 0;
2015
2016         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
2017         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
2018         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
2019
2020         sk->sk_shutdown = SHUTDOWN_MASK;
2021
2022         l2cap_chan_del(sk, ECONNRESET);
2023         bh_unlock_sock(sk);
2024
2025         l2cap_sock_kill(sk);
2026         return 0;
2027 }
2028
2029 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2030 {
2031         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
2032         u16 dcid, scid;
2033         struct sock *sk;
2034
2035         scid = __le16_to_cpu(rsp->scid);
2036         dcid = __le16_to_cpu(rsp->dcid);
2037
2038         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
2039
2040         if (!(sk = l2cap_get_chan_by_scid(&conn->chan_list, scid)))
2041                 return 0;
2042
2043         l2cap_chan_del(sk, 0);
2044         bh_unlock_sock(sk);
2045
2046         l2cap_sock_kill(sk);
2047         return 0;
2048 }
2049
2050 static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2051 {
2052         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
2053         u16 type;
2054
2055         type = __le16_to_cpu(req->type);
2056
2057         BT_DBG("type 0x%4.4x", type);
2058
2059         if (type == L2CAP_IT_FEAT_MASK) {
2060                 u8 buf[8];
2061                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2062                 rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2063                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2064                 put_unaligned(cpu_to_le32(l2cap_feat_mask), (__le32 *) rsp->data);
2065                 l2cap_send_cmd(conn, cmd->ident,
2066                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2067         } else {
2068                 struct l2cap_info_rsp rsp;
2069                 rsp.type   = cpu_to_le16(type);
2070                 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2071                 l2cap_send_cmd(conn, cmd->ident,
2072                                         L2CAP_INFO_RSP, sizeof(rsp), &rsp);
2073         }
2074
2075         return 0;
2076 }
2077
2078 static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2079 {
2080         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
2081         u16 type, result;
2082
2083         type   = __le16_to_cpu(rsp->type);
2084         result = __le16_to_cpu(rsp->result);
2085
2086         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
2087
2088         conn->info_ident = 0;
2089
2090         del_timer(&conn->info_timer);
2091
2092         if (type == L2CAP_IT_FEAT_MASK)
2093                 conn->feat_mask = get_unaligned_le32(rsp->data);
2094
2095         l2cap_conn_start(conn);
2096
2097         return 0;
2098 }
2099
2100 static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
2101 {
2102         u8 *data = skb->data;
2103         int len = skb->len;
2104         struct l2cap_cmd_hdr cmd;
2105         int err = 0;
2106
2107         l2cap_raw_recv(conn, skb);
2108
2109         while (len >= L2CAP_CMD_HDR_SIZE) {
2110                 u16 cmd_len;
2111                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
2112                 data += L2CAP_CMD_HDR_SIZE;
2113                 len  -= L2CAP_CMD_HDR_SIZE;
2114
2115                 cmd_len = le16_to_cpu(cmd.len);
2116
2117                 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
2118
2119                 if (cmd_len > len || !cmd.ident) {
2120                         BT_DBG("corrupted command");
2121                         break;
2122                 }
2123
2124                 switch (cmd.code) {
2125                 case L2CAP_COMMAND_REJ:
2126                         l2cap_command_rej(conn, &cmd, data);
2127                         break;
2128
2129                 case L2CAP_CONN_REQ:
2130                         err = l2cap_connect_req(conn, &cmd, data);
2131                         break;
2132
2133                 case L2CAP_CONN_RSP:
2134                         err = l2cap_connect_rsp(conn, &cmd, data);
2135                         break;
2136
2137                 case L2CAP_CONF_REQ:
2138                         err = l2cap_config_req(conn, &cmd, cmd_len, data);
2139                         break;
2140
2141                 case L2CAP_CONF_RSP:
2142                         err = l2cap_config_rsp(conn, &cmd, data);
2143                         break;
2144
2145                 case L2CAP_DISCONN_REQ:
2146                         err = l2cap_disconnect_req(conn, &cmd, data);
2147                         break;
2148
2149                 case L2CAP_DISCONN_RSP:
2150                         err = l2cap_disconnect_rsp(conn, &cmd, data);
2151                         break;
2152
2153                 case L2CAP_ECHO_REQ:
2154                         l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
2155                         break;
2156
2157                 case L2CAP_ECHO_RSP:
2158                         break;
2159
2160                 case L2CAP_INFO_REQ:
2161                         err = l2cap_information_req(conn, &cmd, data);
2162                         break;
2163
2164                 case L2CAP_INFO_RSP:
2165                         err = l2cap_information_rsp(conn, &cmd, data);
2166                         break;
2167
2168                 default:
2169                         BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
2170                         err = -EINVAL;
2171                         break;
2172                 }
2173
2174                 if (err) {
2175                         struct l2cap_cmd_rej rej;
2176                         BT_DBG("error %d", err);
2177
2178                         /* FIXME: Map err to a valid reason */
2179                         rej.reason = cpu_to_le16(0);
2180                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
2181                 }
2182
2183                 data += cmd_len;
2184                 len  -= cmd_len;
2185         }
2186
2187         kfree_skb(skb);
2188 }
2189
2190 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
2191 {
2192         struct sock *sk;
2193
2194         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
2195         if (!sk) {
2196                 BT_DBG("unknown cid 0x%4.4x", cid);
2197                 goto drop;
2198         }
2199
2200         BT_DBG("sk %p, len %d", sk, skb->len);
2201
2202         if (sk->sk_state != BT_CONNECTED)
2203                 goto drop;
2204
2205         if (l2cap_pi(sk)->imtu < skb->len)
2206                 goto drop;
2207
2208         /* If socket recv buffers overflows we drop data here
2209          * which is *bad* because L2CAP has to be reliable.
2210          * But we don't have any other choice. L2CAP doesn't
2211          * provide flow control mechanism. */
2212
2213         if (!sock_queue_rcv_skb(sk, skb))
2214                 goto done;
2215
2216 drop:
2217         kfree_skb(skb);
2218
2219 done:
2220         if (sk)
2221                 bh_unlock_sock(sk);
2222
2223         return 0;
2224 }
2225
2226 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
2227 {
2228         struct sock *sk;
2229
2230         sk = l2cap_get_sock_by_psm(0, psm, conn->src);
2231         if (!sk)
2232                 goto drop;
2233
2234         BT_DBG("sk %p, len %d", sk, skb->len);
2235
2236         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
2237                 goto drop;
2238
2239         if (l2cap_pi(sk)->imtu < skb->len)
2240                 goto drop;
2241
2242         if (!sock_queue_rcv_skb(sk, skb))
2243                 goto done;
2244
2245 drop:
2246         kfree_skb(skb);
2247
2248 done:
2249         if (sk) bh_unlock_sock(sk);
2250         return 0;
2251 }
2252
2253 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
2254 {
2255         struct l2cap_hdr *lh = (void *) skb->data;
2256         u16 cid, len;
2257         __le16 psm;
2258
2259         skb_pull(skb, L2CAP_HDR_SIZE);
2260         cid = __le16_to_cpu(lh->cid);
2261         len = __le16_to_cpu(lh->len);
2262
2263         BT_DBG("len %d, cid 0x%4.4x", len, cid);
2264
2265         switch (cid) {
2266         case 0x0001:
2267                 l2cap_sig_channel(conn, skb);
2268                 break;
2269
2270         case 0x0002:
2271                 psm = get_unaligned((__le16 *) skb->data);
2272                 skb_pull(skb, 2);
2273                 l2cap_conless_channel(conn, psm, skb);
2274                 break;
2275
2276         default:
2277                 l2cap_data_channel(conn, cid, skb);
2278                 break;
2279         }
2280 }
2281
2282 /* ---- L2CAP interface with lower layer (HCI) ---- */
2283
2284 static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2285 {
2286         int exact = 0, lm1 = 0, lm2 = 0;
2287         register struct sock *sk;
2288         struct hlist_node *node;
2289
2290         if (type != ACL_LINK)
2291                 return 0;
2292
2293         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
2294
2295         /* Find listening sockets and check their link_mode */
2296         read_lock(&l2cap_sk_list.lock);
2297         sk_for_each(sk, node, &l2cap_sk_list.head) {
2298                 if (sk->sk_state != BT_LISTEN)
2299                         continue;
2300
2301                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2302                         lm1 |= (HCI_LM_ACCEPT | l2cap_pi(sk)->link_mode);
2303                         exact++;
2304                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
2305                         lm2 |= (HCI_LM_ACCEPT | l2cap_pi(sk)->link_mode);
2306         }
2307         read_unlock(&l2cap_sk_list.lock);
2308
2309         return exact ? lm1 : lm2;
2310 }
2311
2312 static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
2313 {
2314         struct l2cap_conn *conn;
2315
2316         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
2317
2318         if (hcon->type != ACL_LINK)
2319                 return 0;
2320
2321         if (!status) {
2322                 conn = l2cap_conn_add(hcon, status);
2323                 if (conn)
2324                         l2cap_conn_ready(conn);
2325         } else
2326                 l2cap_conn_del(hcon, bt_err(status));
2327
2328         return 0;
2329 }
2330
2331 static int l2cap_disconn_ind(struct hci_conn *hcon, u8 reason)
2332 {
2333         BT_DBG("hcon %p reason %d", hcon, reason);
2334
2335         if (hcon->type != ACL_LINK)
2336                 return 0;
2337
2338         l2cap_conn_del(hcon, bt_err(reason));
2339
2340         return 0;
2341 }
2342
2343 static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
2344 {
2345         struct l2cap_chan_list *l;
2346         struct l2cap_conn *conn = hcon->l2cap_data;
2347         struct sock *sk;
2348
2349         if (!conn)
2350                 return 0;
2351
2352         l = &conn->chan_list;
2353
2354         BT_DBG("conn %p", conn);
2355
2356         read_lock(&l->lock);
2357
2358         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2359                 struct l2cap_pinfo *pi = l2cap_pi(sk);
2360
2361                 bh_lock_sock(sk);
2362
2363                 if (!status && encrypt == 0x00 &&
2364                                 (pi->link_mode & L2CAP_LM_SECURE) &&
2365                                         (sk->sk_state == BT_CONNECTED ||
2366                                                 sk->sk_state == BT_CONFIG)) {
2367                         __l2cap_sock_close(sk, ECONNREFUSED);
2368                         bh_unlock_sock(sk);
2369                         continue;
2370                 }
2371
2372                 if (sk->sk_state == BT_CONNECT) {
2373                         if (!status) {
2374                                 struct l2cap_conn_req req;
2375                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2376                                 req.psm  = l2cap_pi(sk)->psm;
2377
2378                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
2379
2380                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2381                                         L2CAP_CONN_REQ, sizeof(req), &req);
2382                         } else {
2383                                 l2cap_sock_clear_timer(sk);
2384                                 l2cap_sock_set_timer(sk, HZ / 10);
2385                         }
2386                 } else if (sk->sk_state == BT_CONNECT2) {
2387                         struct l2cap_conn_rsp rsp;
2388                         __u16 result;
2389
2390                         if (!status) {
2391                                 sk->sk_state = BT_CONFIG;
2392                                 result = L2CAP_CR_SUCCESS;
2393                         } else {
2394                                 sk->sk_state = BT_DISCONN;
2395                                 l2cap_sock_set_timer(sk, HZ / 10);
2396                                 result = L2CAP_CR_SEC_BLOCK;
2397                         }
2398
2399                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
2400                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
2401                         rsp.result = cpu_to_le16(result);
2402                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2403                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2404                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2405                 }
2406
2407                 bh_unlock_sock(sk);
2408         }
2409
2410         read_unlock(&l->lock);
2411
2412         return 0;
2413 }
2414
2415 static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
2416 {
2417         struct l2cap_conn *conn = hcon->l2cap_data;
2418
2419         if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
2420                 goto drop;
2421
2422         BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
2423
2424         if (flags & ACL_START) {
2425                 struct l2cap_hdr *hdr;
2426                 int len;
2427
2428                 if (conn->rx_len) {
2429                         BT_ERR("Unexpected start frame (len %d)", skb->len);
2430                         kfree_skb(conn->rx_skb);
2431                         conn->rx_skb = NULL;
2432                         conn->rx_len = 0;
2433                         l2cap_conn_unreliable(conn, ECOMM);
2434                 }
2435
2436                 if (skb->len < 2) {
2437                         BT_ERR("Frame is too short (len %d)", skb->len);
2438                         l2cap_conn_unreliable(conn, ECOMM);
2439                         goto drop;
2440                 }
2441
2442                 hdr = (struct l2cap_hdr *) skb->data;
2443                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
2444
2445                 if (len == skb->len) {
2446                         /* Complete frame received */
2447                         l2cap_recv_frame(conn, skb);
2448                         return 0;
2449                 }
2450
2451                 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
2452
2453                 if (skb->len > len) {
2454                         BT_ERR("Frame is too long (len %d, expected len %d)",
2455                                 skb->len, len);
2456                         l2cap_conn_unreliable(conn, ECOMM);
2457                         goto drop;
2458                 }
2459
2460                 /* Allocate skb for the complete frame (with header) */
2461                 if (!(conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC)))
2462                         goto drop;
2463
2464                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2465                               skb->len);
2466                 conn->rx_len = len - skb->len;
2467         } else {
2468                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
2469
2470                 if (!conn->rx_len) {
2471                         BT_ERR("Unexpected continuation frame (len %d)", skb->len);
2472                         l2cap_conn_unreliable(conn, ECOMM);
2473                         goto drop;
2474                 }
2475
2476                 if (skb->len > conn->rx_len) {
2477                         BT_ERR("Fragment is too long (len %d, expected %d)",
2478                                         skb->len, conn->rx_len);
2479                         kfree_skb(conn->rx_skb);
2480                         conn->rx_skb = NULL;
2481                         conn->rx_len = 0;
2482                         l2cap_conn_unreliable(conn, ECOMM);
2483                         goto drop;
2484                 }
2485
2486                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2487                               skb->len);
2488                 conn->rx_len -= skb->len;
2489
2490                 if (!conn->rx_len) {
2491                         /* Complete frame received */
2492                         l2cap_recv_frame(conn, conn->rx_skb);
2493                         conn->rx_skb = NULL;
2494                 }
2495         }
2496
2497 drop:
2498         kfree_skb(skb);
2499         return 0;
2500 }
2501
2502 static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
2503 {
2504         struct sock *sk;
2505         struct hlist_node *node;
2506         char *str = buf;
2507
2508         read_lock_bh(&l2cap_sk_list.lock);
2509
2510         sk_for_each(sk, node, &l2cap_sk_list.head) {
2511                 struct l2cap_pinfo *pi = l2cap_pi(sk);
2512
2513                 str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d 0x%x\n",
2514                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2515                                 sk->sk_state, btohs(pi->psm), pi->scid, pi->dcid,
2516                                 pi->imtu, pi->omtu, pi->link_mode);
2517         }
2518
2519         read_unlock_bh(&l2cap_sk_list.lock);
2520
2521         return (str - buf);
2522 }
2523
2524 static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
2525
2526 static const struct proto_ops l2cap_sock_ops = {
2527         .family         = PF_BLUETOOTH,
2528         .owner          = THIS_MODULE,
2529         .release        = l2cap_sock_release,
2530         .bind           = l2cap_sock_bind,
2531         .connect        = l2cap_sock_connect,
2532         .listen         = l2cap_sock_listen,
2533         .accept         = l2cap_sock_accept,
2534         .getname        = l2cap_sock_getname,
2535         .sendmsg        = l2cap_sock_sendmsg,
2536         .recvmsg        = l2cap_sock_recvmsg,
2537         .poll           = bt_sock_poll,
2538         .ioctl          = bt_sock_ioctl,
2539         .mmap           = sock_no_mmap,
2540         .socketpair     = sock_no_socketpair,
2541         .shutdown       = l2cap_sock_shutdown,
2542         .setsockopt     = l2cap_sock_setsockopt,
2543         .getsockopt     = l2cap_sock_getsockopt
2544 };
2545
2546 static struct net_proto_family l2cap_sock_family_ops = {
2547         .family = PF_BLUETOOTH,
2548         .owner  = THIS_MODULE,
2549         .create = l2cap_sock_create,
2550 };
2551
2552 static struct hci_proto l2cap_hci_proto = {
2553         .name           = "L2CAP",
2554         .id             = HCI_PROTO_L2CAP,
2555         .connect_ind    = l2cap_connect_ind,
2556         .connect_cfm    = l2cap_connect_cfm,
2557         .disconn_ind    = l2cap_disconn_ind,
2558         .security_cfm   = l2cap_security_cfm,
2559         .recv_acldata   = l2cap_recv_acldata
2560 };
2561
2562 static int __init l2cap_init(void)
2563 {
2564         int err;
2565
2566         err = proto_register(&l2cap_proto, 0);
2567         if (err < 0)
2568                 return err;
2569
2570         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2571         if (err < 0) {
2572                 BT_ERR("L2CAP socket registration failed");
2573                 goto error;
2574         }
2575
2576         err = hci_register_proto(&l2cap_hci_proto);
2577         if (err < 0) {
2578                 BT_ERR("L2CAP protocol registration failed");
2579                 bt_sock_unregister(BTPROTO_L2CAP);
2580                 goto error;
2581         }
2582
2583         if (class_create_file(bt_class, &class_attr_l2cap) < 0)
2584                 BT_ERR("Failed to create L2CAP info file");
2585
2586         BT_INFO("L2CAP ver %s", VERSION);
2587         BT_INFO("L2CAP socket layer initialized");
2588
2589         return 0;
2590
2591 error:
2592         proto_unregister(&l2cap_proto);
2593         return err;
2594 }
2595
2596 static void __exit l2cap_exit(void)
2597 {
2598         class_remove_file(bt_class, &class_attr_l2cap);
2599
2600         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
2601                 BT_ERR("L2CAP socket unregistration failed");
2602
2603         if (hci_unregister_proto(&l2cap_hci_proto) < 0)
2604                 BT_ERR("L2CAP protocol unregistration failed");
2605
2606         proto_unregister(&l2cap_proto);
2607 }
2608
2609 void l2cap_load(void)
2610 {
2611         /* Dummy function to trigger automatic L2CAP module loading by
2612          * other modules that use L2CAP sockets but don't use any other
2613          * symbols from it. */
2614         return;
2615 }
2616 EXPORT_SYMBOL(l2cap_load);
2617
2618 module_init(l2cap_init);
2619 module_exit(l2cap_exit);
2620
2621 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2622 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2623 MODULE_VERSION(VERSION);
2624 MODULE_LICENSE("GPL");
2625 MODULE_ALIAS("bt-proto-0");