net/bluetooth/l2cap.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth L2CAP core and sockets. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/capability.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <linux/uaccess.h>
  44 #include <net/sock.h>
  45
  46 #include <asm/system.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/hci_core.h>
  51 #include <net/bluetooth/l2cap.h>
  52
  53 #define VERSION "2.14"
  54
  55 static int enable_ertm = 0;
  56
  57 static u32 l2cap_feat_mask = L2CAP_FEAT_FIXED_CHAN;
  58 static u8 l2cap_fixed_chan[8] = { 0x02, };
  59
  60 static const struct proto_ops l2cap_sock_ops;
  61
  62 static struct bt_sock_list l2cap_sk_list = {
  63         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  64 };
  65
  66 static void __l2cap_sock_close(struct sock *sk, int reason);
  67 static void l2cap_sock_close(struct sock *sk);
  68 static void l2cap_sock_kill(struct sock *sk);
  69
  70 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
  71                                 u8 code, u8 ident, u16 dlen, void *data);
  72
  73 /* ---- L2CAP timers ---- */
  74 static void l2cap_sock_timeout(unsigned long arg)
  75 {
  76         struct sock *sk = (struct sock *) arg;
  77         int reason;
  78
  79         BT_DBG("sock %p state %d", sk, sk->sk_state);
  80
  81         bh_lock_sock(sk);
  82
  83         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
  84                 reason = ECONNREFUSED;
  85         else if (sk->sk_state == BT_CONNECT &&
  86                                 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
  87                 reason = ECONNREFUSED;
  88         else
  89                 reason = ETIMEDOUT;
  90
  91         __l2cap_sock_close(sk, reason);
  92
  93         bh_unlock_sock(sk);
  94
  95         l2cap_sock_kill(sk);
  96         sock_put(sk);
  97 }
  98
  99 static void l2cap_sock_set_timer(struct sock *sk, long timeout)
 100 {
 101         BT_DBG("sk %p state %d timeout %ld", sk, sk->sk_state, timeout);
 102         sk_reset_timer(sk, &sk->sk_timer, jiffies + timeout);
 103 }
 104
 105 static void l2cap_sock_clear_timer(struct sock *sk)
 106 {
 107         BT_DBG("sock %p state %d", sk, sk->sk_state);
 108         sk_stop_timer(sk, &sk->sk_timer);
 109 }
 110
 111 /* ---- L2CAP channels ---- */
 112 static struct sock *__l2cap_get_chan_by_dcid(struct l2cap_chan_list *l, u16 cid)
 113 {
 114         struct sock *s;
 115         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 116                 if (l2cap_pi(s)->dcid == cid)
 117                         break;
 118         }
 119         return s;
 120 }
 121
 122 static struct sock *__l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 123 {
 124         struct sock *s;
 125         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 126                 if (l2cap_pi(s)->scid == cid)
 127                         break;
 128         }
 129         return s;
 130 }
 131
 132 /* Find channel with given SCID.
 133  * Returns locked socket */
 134 static inline struct sock *l2cap_get_chan_by_scid(struct l2cap_chan_list *l, u16 cid)
 135 {
 136         struct sock *s;
 137         read_lock(&l->lock);
 138         s = __l2cap_get_chan_by_scid(l, cid);
 139         if (s)
 140                 bh_lock_sock(s);
 141         read_unlock(&l->lock);
 142         return s;
 143 }
 144
 145 static struct sock *__l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 146 {
 147         struct sock *s;
 148         for (s = l->head; s; s = l2cap_pi(s)->next_c) {
 149                 if (l2cap_pi(s)->ident == ident)
 150                         break;
 151         }
 152         return s;
 153 }
 154
 155 static inline struct sock *l2cap_get_chan_by_ident(struct l2cap_chan_list *l, u8 ident)
 156 {
 157         struct sock *s;
 158         read_lock(&l->lock);
 159         s = __l2cap_get_chan_by_ident(l, ident);
 160         if (s)
 161                 bh_lock_sock(s);
 162         read_unlock(&l->lock);
 163         return s;
 164 }
 165
 166 static u16 l2cap_alloc_cid(struct l2cap_chan_list *l)
 167 {
 168         u16 cid = L2CAP_CID_DYN_START;
 169
 170         for (; cid < L2CAP_CID_DYN_END; cid++) {
 171                 if (!__l2cap_get_chan_by_scid(l, cid))
 172                         return cid;
 173         }
 174
 175         return 0;
 176 }
 177
 178 static inline void __l2cap_chan_link(struct l2cap_chan_list *l, struct sock *sk)
 179 {
 180         sock_hold(sk);
 181
 182         if (l->head)
 183                 l2cap_pi(l->head)->prev_c = sk;
 184
 185         l2cap_pi(sk)->next_c = l->head;
 186         l2cap_pi(sk)->prev_c = NULL;
 187         l->head = sk;
 188 }
 189
 190 static inline void l2cap_chan_unlink(struct l2cap_chan_list *l, struct sock *sk)
 191 {
 192         struct sock *next = l2cap_pi(sk)->next_c, *prev = l2cap_pi(sk)->prev_c;
 193
 194         write_lock_bh(&l->lock);
 195         if (sk == l->head)
 196                 l->head = next;
 197
 198         if (next)
 199                 l2cap_pi(next)->prev_c = prev;
 200         if (prev)
 201                 l2cap_pi(prev)->next_c = next;
 202         write_unlock_bh(&l->lock);
 203
 204         __sock_put(sk);
 205 }
 206
 207 static void __l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 208 {
 209         struct l2cap_chan_list *l = &conn->chan_list;
 210
 211         BT_DBG("conn %p, psm 0x%2.2x, dcid 0x%4.4x", conn,
 212                         l2cap_pi(sk)->psm, l2cap_pi(sk)->dcid);
 213
 214         conn->disc_reason = 0x13;
 215
 216         l2cap_pi(sk)->conn = conn;
 217
 218         if (sk->sk_type == SOCK_SEQPACKET) {
 219                 /* Alloc CID for connection-oriented socket */
 220                 l2cap_pi(sk)->scid = l2cap_alloc_cid(l);
 221         } else if (sk->sk_type == SOCK_DGRAM) {
 222                 /* Connectionless socket */
 223                 l2cap_pi(sk)->scid = L2CAP_CID_CONN_LESS;
 224                 l2cap_pi(sk)->dcid = L2CAP_CID_CONN_LESS;
 225                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 226         } else {
 227                 /* Raw socket can send/recv signalling messages only */
 228                 l2cap_pi(sk)->scid = L2CAP_CID_SIGNALING;
 229                 l2cap_pi(sk)->dcid = L2CAP_CID_SIGNALING;
 230                 l2cap_pi(sk)->omtu = L2CAP_DEFAULT_MTU;
 231         }
 232
 233         __l2cap_chan_link(l, sk);
 234
 235         if (parent)
 236                 bt_accept_enqueue(parent, sk);
 237 }
 238
 239 /* Delete channel.
 240  * Must be called on the locked socket. */
 241 static void l2cap_chan_del(struct sock *sk, int err)
 242 {
 243         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 244         struct sock *parent = bt_sk(sk)->parent;
 245
 246         l2cap_sock_clear_timer(sk);
 247
 248         BT_DBG("sk %p, conn %p, err %d", sk, conn, err);
 249
 250         if (conn) {
 251                 /* Unlink from channel list */
 252                 l2cap_chan_unlink(&conn->chan_list, sk);
 253                 l2cap_pi(sk)->conn = NULL;
 254                 hci_conn_put(conn->hcon);
 255         }
 256
 257         sk->sk_state = BT_CLOSED;
 258         sock_set_flag(sk, SOCK_ZAPPED);
 259
 260         if (err)
 261                 sk->sk_err = err;
 262
 263         if (parent) {
 264                 bt_accept_unlink(sk);
 265                 parent->sk_data_ready(parent, 0);
 266         } else
 267                 sk->sk_state_change(sk);
 268 }
 269
 270 /* Service level security */
 271 static inline int l2cap_check_security(struct sock *sk)
 272 {
 273         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 274         __u8 auth_type;
 275
 276         if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 277                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 278                         auth_type = HCI_AT_NO_BONDING_MITM;
 279                 else
 280                         auth_type = HCI_AT_NO_BONDING;
 281
 282                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 283                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 284         } else {
 285                 switch (l2cap_pi(sk)->sec_level) {
 286                 case BT_SECURITY_HIGH:
 287                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 288                         break;
 289                 case BT_SECURITY_MEDIUM:
 290                         auth_type = HCI_AT_GENERAL_BONDING;
 291                         break;
 292                 default:
 293                         auth_type = HCI_AT_NO_BONDING;
 294                         break;
 295                 }
 296         }
 297
 298         return hci_conn_security(conn->hcon, l2cap_pi(sk)->sec_level,
 299                                                                 auth_type);
 300 }
 301
 302 static inline u8 l2cap_get_ident(struct l2cap_conn *conn)
 303 {
 304         u8 id;
 305
 306         /* Get next available identificator.
 307          *    1 - 128 are used by kernel.
 308          *  129 - 199 are reserved.
 309          *  200 - 254 are used by utilities like l2ping, etc.
 310          */
 311
 312         spin_lock_bh(&conn->lock);
 313
 314         if (++conn->tx_ident > 128)
 315                 conn->tx_ident = 1;
 316
 317         id = conn->tx_ident;
 318
 319         spin_unlock_bh(&conn->lock);
 320
 321         return id;
 322 }
 323
 324 static inline int l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, void *data)
 325 {
 326         struct sk_buff *skb = l2cap_build_cmd(conn, code, ident, len, data);
 327
 328         BT_DBG("code 0x%2.2x", code);
 329
 330         if (!skb)
 331                 return -ENOMEM;
 332
 333         return hci_send_acl(conn->hcon, skb, 0);
 334 }
 335
 336 static void l2cap_do_start(struct sock *sk)
 337 {
 338         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 339
 340         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) {
 341                 if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 342                         return;
 343
 344                 if (l2cap_check_security(sk)) {
 345                         struct l2cap_conn_req req;
 346                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 347                         req.psm  = l2cap_pi(sk)->psm;
 348
 349                         l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 350
 351                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 352                                         L2CAP_CONN_REQ, sizeof(req), &req);
 353                 }
 354         } else {
 355                 struct l2cap_info_req req;
 356                 req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
 357
 358                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
 359                 conn->info_ident = l2cap_get_ident(conn);
 360
 361                 mod_timer(&conn->info_timer, jiffies +
 362                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
 363
 364                 l2cap_send_cmd(conn, conn->info_ident,
 365                                         L2CAP_INFO_REQ, sizeof(req), &req);
 366         }
 367 }
 368
 369 /* ---- L2CAP connections ---- */
 370 static void l2cap_conn_start(struct l2cap_conn *conn)
 371 {
 372         struct l2cap_chan_list *l = &conn->chan_list;
 373         struct sock *sk;
 374
 375         BT_DBG("conn %p", conn);
 376
 377         read_lock(&l->lock);
 378
 379         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 380                 bh_lock_sock(sk);
 381
 382                 if (sk->sk_type != SOCK_SEQPACKET) {
 383                         bh_unlock_sock(sk);
 384                         continue;
 385                 }
 386
 387                 if (sk->sk_state == BT_CONNECT) {
 388                         if (l2cap_check_security(sk)) {
 389                                 struct l2cap_conn_req req;
 390                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 391                                 req.psm  = l2cap_pi(sk)->psm;
 392
 393                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
 394
 395                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 396                                         L2CAP_CONN_REQ, sizeof(req), &req);
 397                         }
 398                 } else if (sk->sk_state == BT_CONNECT2) {
 399                         struct l2cap_conn_rsp rsp;
 400                         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
 401                         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
 402
 403                         if (l2cap_check_security(sk)) {
 404                                 if (bt_sk(sk)->defer_setup) {
 405                                         struct sock *parent = bt_sk(sk)->parent;
 406                                         rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 407                                         rsp.status = cpu_to_le16(L2CAP_CS_AUTHOR_PEND);
 408                                         parent->sk_data_ready(parent, 0);
 409
 410                                 } else {
 411                                         sk->sk_state = BT_CONFIG;
 412                                         rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 413                                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 414                                 }
 415                         } else {
 416                                 rsp.result = cpu_to_le16(L2CAP_CR_PEND);
 417                                 rsp.status = cpu_to_le16(L2CAP_CS_AUTHEN_PEND);
 418                         }
 419
 420                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 421                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 422                 }
 423
 424                 bh_unlock_sock(sk);
 425         }
 426
 427         read_unlock(&l->lock);
 428 }
 429
 430 static void l2cap_conn_ready(struct l2cap_conn *conn)
 431 {
 432         struct l2cap_chan_list *l = &conn->chan_list;
 433         struct sock *sk;
 434
 435         BT_DBG("conn %p", conn);
 436
 437         read_lock(&l->lock);
 438
 439         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 440                 bh_lock_sock(sk);
 441
 442                 if (sk->sk_type != SOCK_SEQPACKET) {
 443                         l2cap_sock_clear_timer(sk);
 444                         sk->sk_state = BT_CONNECTED;
 445                         sk->sk_state_change(sk);
 446                 } else if (sk->sk_state == BT_CONNECT)
 447                         l2cap_do_start(sk);
 448
 449                 bh_unlock_sock(sk);
 450         }
 451
 452         read_unlock(&l->lock);
 453 }
 454
 455 /* Notify sockets that we cannot guaranty reliability anymore */
 456 static void l2cap_conn_unreliable(struct l2cap_conn *conn, int err)
 457 {
 458         struct l2cap_chan_list *l = &conn->chan_list;
 459         struct sock *sk;
 460
 461         BT_DBG("conn %p", conn);
 462
 463         read_lock(&l->lock);
 464
 465         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
 466                 if (l2cap_pi(sk)->force_reliable)
 467                         sk->sk_err = err;
 468         }
 469
 470         read_unlock(&l->lock);
 471 }
 472
 473 static void l2cap_info_timeout(unsigned long arg)
 474 {
 475         struct l2cap_conn *conn = (void *) arg;
 476
 477         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
 478         conn->info_ident = 0;
 479
 480         l2cap_conn_start(conn);
 481 }
 482
 483 static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 484 {
 485         struct l2cap_conn *conn = hcon->l2cap_data;
 486
 487         if (conn || status)
 488                 return conn;
 489
 490         conn = kzalloc(sizeof(struct l2cap_conn), GFP_ATOMIC);
 491         if (!conn)
 492                 return NULL;
 493
 494         hcon->l2cap_data = conn;
 495         conn->hcon = hcon;
 496
 497         BT_DBG("hcon %p conn %p", hcon, conn);
 498
 499         conn->mtu = hcon->hdev->acl_mtu;
 500         conn->src = &hcon->hdev->bdaddr;
 501         conn->dst = &hcon->dst;
 502
 503         conn->feat_mask = 0;
 504
 505         setup_timer(&conn->info_timer, l2cap_info_timeout,
 506                                                 (unsigned long) conn);
 507
 508         spin_lock_init(&conn->lock);
 509         rwlock_init(&conn->chan_list.lock);
 510
 511         conn->disc_reason = 0x13;
 512
 513         return conn;
 514 }
 515
 516 static void l2cap_conn_del(struct hci_conn *hcon, int err)
 517 {
 518         struct l2cap_conn *conn = hcon->l2cap_data;
 519         struct sock *sk;
 520
 521         if (!conn)
 522                 return;
 523
 524         BT_DBG("hcon %p conn %p, err %d", hcon, conn, err);
 525
 526         kfree_skb(conn->rx_skb);
 527
 528         /* Kill channels */
 529         while ((sk = conn->chan_list.head)) {
 530                 bh_lock_sock(sk);
 531                 l2cap_chan_del(sk, err);
 532                 bh_unlock_sock(sk);
 533                 l2cap_sock_kill(sk);
 534         }
 535
 536         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT)
 537                 del_timer_sync(&conn->info_timer);
 538
 539         hcon->l2cap_data = NULL;
 540         kfree(conn);
 541 }
 542
 543 static inline void l2cap_chan_add(struct l2cap_conn *conn, struct sock *sk, struct sock *parent)
 544 {
 545         struct l2cap_chan_list *l = &conn->chan_list;
 546         write_lock_bh(&l->lock);
 547         __l2cap_chan_add(conn, sk, parent);
 548         write_unlock_bh(&l->lock);
 549 }
 550
 551 /* ---- Socket interface ---- */
 552 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
 553 {
 554         struct sock *sk;
 555         struct hlist_node *node;
 556         sk_for_each(sk, node, &l2cap_sk_list.head)
 557                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
 558                         goto found;
 559         sk = NULL;
 560 found:
 561         return sk;
 562 }
 563
 564 /* Find socket with psm and source bdaddr.
 565  * Returns closest match.
 566  */
 567 static struct sock *__l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 568 {
 569         struct sock *sk = NULL, *sk1 = NULL;
 570         struct hlist_node *node;
 571
 572         sk_for_each(sk, node, &l2cap_sk_list.head) {
 573                 if (state && sk->sk_state != state)
 574                         continue;
 575
 576                 if (l2cap_pi(sk)->psm == psm) {
 577                         /* Exact match. */
 578                         if (!bacmp(&bt_sk(sk)->src, src))
 579                                 break;
 580
 581                         /* Closest match */
 582                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 583                                 sk1 = sk;
 584                 }
 585         }
 586         return node ? sk : sk1;
 587 }
 588
 589 /* Find socket with given address (psm, src).
 590  * Returns locked socket */
 591 static inline struct sock *l2cap_get_sock_by_psm(int state, __le16 psm, bdaddr_t *src)
 592 {
 593         struct sock *s;
 594         read_lock(&l2cap_sk_list.lock);
 595         s = __l2cap_get_sock_by_psm(state, psm, src);
 596         if (s)
 597                 bh_lock_sock(s);
 598         read_unlock(&l2cap_sk_list.lock);
 599         return s;
 600 }
 601
 602 static void l2cap_sock_destruct(struct sock *sk)
 603 {
 604         BT_DBG("sk %p", sk);
 605
 606         skb_queue_purge(&sk->sk_receive_queue);
 607         skb_queue_purge(&sk->sk_write_queue);
 608 }
 609
 610 static void l2cap_sock_cleanup_listen(struct sock *parent)
 611 {
 612         struct sock *sk;
 613
 614         BT_DBG("parent %p", parent);
 615
 616         /* Close not yet accepted channels */
 617         while ((sk = bt_accept_dequeue(parent, NULL)))
 618                 l2cap_sock_close(sk);
 619
 620         parent->sk_state = BT_CLOSED;
 621         sock_set_flag(parent, SOCK_ZAPPED);
 622 }
 623
 624 /* Kill socket (only if zapped and orphan)
 625  * Must be called on unlocked socket.
 626  */
 627 static void l2cap_sock_kill(struct sock *sk)
 628 {
 629         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 630                 return;
 631
 632         BT_DBG("sk %p state %d", sk, sk->sk_state);
 633
 634         /* Kill poor orphan */
 635         bt_sock_unlink(&l2cap_sk_list, sk);
 636         sock_set_flag(sk, SOCK_DEAD);
 637         sock_put(sk);
 638 }
 639
 640 static void __l2cap_sock_close(struct sock *sk, int reason)
 641 {
 642         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 643
 644         switch (sk->sk_state) {
 645         case BT_LISTEN:
 646                 l2cap_sock_cleanup_listen(sk);
 647                 break;
 648
 649         case BT_CONNECTED:
 650         case BT_CONFIG:
 651                 if (sk->sk_type == SOCK_SEQPACKET) {
 652                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 653                         struct l2cap_disconn_req req;
 654
 655                         sk->sk_state = BT_DISCONN;
 656                         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 657
 658                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
 659                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
 660                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
 661                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
 662                 } else
 663                         l2cap_chan_del(sk, reason);
 664                 break;
 665
 666         case BT_CONNECT2:
 667                 if (sk->sk_type == SOCK_SEQPACKET) {
 668                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 669                         struct l2cap_conn_rsp rsp;
 670                         __u16 result;
 671
 672                         if (bt_sk(sk)->defer_setup)
 673                                 result = L2CAP_CR_SEC_BLOCK;
 674                         else
 675                                 result = L2CAP_CR_BAD_PSM;
 676
 677                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
 678                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
 679                         rsp.result = cpu_to_le16(result);
 680                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 681                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
 682                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 683                 } else
 684                         l2cap_chan_del(sk, reason);
 685                 break;
 686
 687         case BT_CONNECT:
 688         case BT_DISCONN:
 689                 l2cap_chan_del(sk, reason);
 690                 break;
 691
 692         default:
 693                 sock_set_flag(sk, SOCK_ZAPPED);
 694                 break;
 695         }
 696 }
 697
 698 /* Must be called on unlocked socket. */
 699 static void l2cap_sock_close(struct sock *sk)
 700 {
 701         l2cap_sock_clear_timer(sk);
 702         lock_sock(sk);
 703         __l2cap_sock_close(sk, ECONNRESET);
 704         release_sock(sk);
 705         l2cap_sock_kill(sk);
 706 }
 707
 708 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 709 {
 710         struct l2cap_pinfo *pi = l2cap_pi(sk);
 711
 712         BT_DBG("sk %p", sk);
 713
 714         if (parent) {
 715                 sk->sk_type = parent->sk_type;
 716                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 717
 718                 pi->imtu = l2cap_pi(parent)->imtu;
 719                 pi->omtu = l2cap_pi(parent)->omtu;
 720                 pi->sec_level = l2cap_pi(parent)->sec_level;
 721                 pi->role_switch = l2cap_pi(parent)->role_switch;
 722                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
 723         } else {
 724                 pi->imtu = L2CAP_DEFAULT_MTU;
 725                 pi->omtu = 0;
 726                 pi->sec_level = BT_SECURITY_LOW;
 727                 pi->role_switch = 0;
 728                 pi->force_reliable = 0;
 729         }
 730
 731         /* Default config options */
 732         pi->conf_len = 0;
 733         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 734 }
 735
 736 static struct proto l2cap_proto = {
 737         .name           = "L2CAP",
 738         .owner          = THIS_MODULE,
 739         .obj_size       = sizeof(struct l2cap_pinfo)
 740 };
 741
 742 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 743 {
 744         struct sock *sk;
 745
 746         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 747         if (!sk)
 748                 return NULL;
 749
 750         sock_init_data(sock, sk);
 751         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 752
 753         sk->sk_destruct = l2cap_sock_destruct;
 754         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 755
 756         sock_reset_flag(sk, SOCK_ZAPPED);
 757
 758         sk->sk_protocol = proto;
 759         sk->sk_state = BT_OPEN;
 760
 761         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 762
 763         bt_sock_link(&l2cap_sk_list, sk);
 764         return sk;
 765 }
 766
 767 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol)
 768 {
 769         struct sock *sk;
 770
 771         BT_DBG("sock %p", sock);
 772
 773         sock->state = SS_UNCONNECTED;
 774
 775         if (sock->type != SOCK_SEQPACKET &&
 776                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 777                 return -ESOCKTNOSUPPORT;
 778
 779         if (sock->type == SOCK_RAW && !capable(CAP_NET_RAW))
 780                 return -EPERM;
 781
 782         sock->ops = &l2cap_sock_ops;
 783
 784         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 785         if (!sk)
 786                 return -ENOMEM;
 787
 788         l2cap_sock_init(sk, NULL);
 789         return 0;
 790 }
 791
 792 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 793 {
 794         struct sock *sk = sock->sk;
 795         struct sockaddr_l2 la;
 796         int len, err = 0;
 797
 798         BT_DBG("sk %p", sk);
 799
 800         if (!addr || addr->sa_family != AF_BLUETOOTH)
 801                 return -EINVAL;
 802
 803         memset(&la, 0, sizeof(la));
 804         len = min_t(unsigned int, sizeof(la), alen);
 805         memcpy(&la, addr, len);
 806
 807         if (la.l2_cid)
 808                 return -EINVAL;
 809
 810         lock_sock(sk);
 811
 812         if (sk->sk_state != BT_OPEN) {
 813                 err = -EBADFD;
 814                 goto done;
 815         }
 816
 817         if (la.l2_psm && __le16_to_cpu(la.l2_psm) < 0x1001 &&
 818                                 !capable(CAP_NET_BIND_SERVICE)) {
 819                 err = -EACCES;
 820                 goto done;
 821         }
 822
 823         write_lock_bh(&l2cap_sk_list.lock);
 824
 825         if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
 826                 err = -EADDRINUSE;
 827         } else {
 828                 /* Save source address */
 829                 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 830                 l2cap_pi(sk)->psm   = la.l2_psm;
 831                 l2cap_pi(sk)->sport = la.l2_psm;
 832                 sk->sk_state = BT_BOUND;
 833
 834                 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
 835                                         __le16_to_cpu(la.l2_psm) == 0x0003)
 836                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 837         }
 838
 839         write_unlock_bh(&l2cap_sk_list.lock);
 840
 841 done:
 842         release_sock(sk);
 843         return err;
 844 }
 845
 846 static int l2cap_do_connect(struct sock *sk)
 847 {
 848         bdaddr_t *src = &bt_sk(sk)->src;
 849         bdaddr_t *dst = &bt_sk(sk)->dst;
 850         struct l2cap_conn *conn;
 851         struct hci_conn *hcon;
 852         struct hci_dev *hdev;
 853         __u8 auth_type;
 854         int err;
 855
 856         BT_DBG("%s -> %s psm 0x%2.2x", batostr(src), batostr(dst),
 857                                                         l2cap_pi(sk)->psm);
 858
 859         hdev = hci_get_route(dst, src);
 860         if (!hdev)
 861                 return -EHOSTUNREACH;
 862
 863         hci_dev_lock_bh(hdev);
 864
 865         err = -ENOMEM;
 866
 867         if (sk->sk_type == SOCK_RAW) {
 868                 switch (l2cap_pi(sk)->sec_level) {
 869                 case BT_SECURITY_HIGH:
 870                         auth_type = HCI_AT_DEDICATED_BONDING_MITM;
 871                         break;
 872                 case BT_SECURITY_MEDIUM:
 873                         auth_type = HCI_AT_DEDICATED_BONDING;
 874                         break;
 875                 default:
 876                         auth_type = HCI_AT_NO_BONDING;
 877                         break;
 878                 }
 879         } else if (l2cap_pi(sk)->psm == cpu_to_le16(0x0001)) {
 880                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
 881                         auth_type = HCI_AT_NO_BONDING_MITM;
 882                 else
 883                         auth_type = HCI_AT_NO_BONDING;
 884
 885                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_LOW)
 886                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 887         } else {
 888                 switch (l2cap_pi(sk)->sec_level) {
 889                 case BT_SECURITY_HIGH:
 890                         auth_type = HCI_AT_GENERAL_BONDING_MITM;
 891                         break;
 892                 case BT_SECURITY_MEDIUM:
 893                         auth_type = HCI_AT_GENERAL_BONDING;
 894                         break;
 895                 default:
 896                         auth_type = HCI_AT_NO_BONDING;
 897                         break;
 898                 }
 899         }
 900
 901         hcon = hci_connect(hdev, ACL_LINK, dst,
 902                                         l2cap_pi(sk)->sec_level, auth_type);
 903         if (!hcon)
 904                 goto done;
 905
 906         conn = l2cap_conn_add(hcon, 0);
 907         if (!conn) {
 908                 hci_conn_put(hcon);
 909                 goto done;
 910         }
 911
 912         err = 0;
 913
 914         /* Update source addr of the socket */
 915         bacpy(src, conn->src);
 916
 917         l2cap_chan_add(conn, sk, NULL);
 918
 919         sk->sk_state = BT_CONNECT;
 920         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
 921
 922         if (hcon->state == BT_CONNECTED) {
 923                 if (sk->sk_type != SOCK_SEQPACKET) {
 924                         l2cap_sock_clear_timer(sk);
 925                         sk->sk_state = BT_CONNECTED;
 926                 } else
 927                         l2cap_do_start(sk);
 928         }
 929
 930 done:
 931         hci_dev_unlock_bh(hdev);
 932         hci_dev_put(hdev);
 933         return err;
 934 }
 935
 936 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 937 {
 938         struct sock *sk = sock->sk;
 939         struct sockaddr_l2 la;
 940         int len, err = 0;
 941
 942         BT_DBG("sk %p", sk);
 943
 944         if (!addr || addr->sa_family != AF_BLUETOOTH)
 945                 return -EINVAL;
 946
 947         memset(&la, 0, sizeof(la));
 948         len = min_t(unsigned int, sizeof(la), alen);
 949         memcpy(&la, addr, len);
 950
 951         if (la.l2_cid)
 952                 return -EINVAL;
 953
 954         lock_sock(sk);
 955
 956         if (sk->sk_type == SOCK_SEQPACKET && !la.l2_psm) {
 957                 err = -EINVAL;
 958                 goto done;
 959         }
 960
 961         switch (sk->sk_state) {
 962         case BT_CONNECT:
 963         case BT_CONNECT2:
 964         case BT_CONFIG:
 965                 /* Already connecting */
 966                 goto wait;
 967
 968         case BT_CONNECTED:
 969                 /* Already connected */
 970                 goto done;
 971
 972         case BT_OPEN:
 973         case BT_BOUND:
 974                 /* Can connect */
 975                 break;
 976
 977         default:
 978                 err = -EBADFD;
 979                 goto done;
 980         }
 981
 982         /* Set destination address and psm */
 983         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
 984         l2cap_pi(sk)->psm = la.l2_psm;
 985
 986         err = l2cap_do_connect(sk);
 987         if (err)
 988                 goto done;
 989
 990 wait:
 991         err = bt_sock_wait_state(sk, BT_CONNECTED,
 992                         sock_sndtimeo(sk, flags & O_NONBLOCK));
 993 done:
 994         release_sock(sk);
 995         return err;
 996 }
 997
 998 static int l2cap_sock_listen(struct socket *sock, int backlog)
 999 {
1000         struct sock *sk = sock->sk;
1001         int err = 0;
1002
1003         BT_DBG("sk %p backlog %d", sk, backlog);
1004
1005         lock_sock(sk);
1006
1007         if (sk->sk_state != BT_BOUND || sock->type != SOCK_SEQPACKET) {
1008                 err = -EBADFD;
1009                 goto done;
1010         }
1011
1012         if (!l2cap_pi(sk)->psm) {
1013                 bdaddr_t *src = &bt_sk(sk)->src;
1014                 u16 psm;
1015
1016                 err = -EINVAL;
1017
1018                 write_lock_bh(&l2cap_sk_list.lock);
1019
1020                 for (psm = 0x1001; psm < 0x1100; psm += 2)
1021                         if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
1022                                 l2cap_pi(sk)->psm   = cpu_to_le16(psm);
1023                                 l2cap_pi(sk)->sport = cpu_to_le16(psm);
1024                                 err = 0;
1025                                 break;
1026                         }
1027
1028                 write_unlock_bh(&l2cap_sk_list.lock);
1029
1030                 if (err < 0)
1031                         goto done;
1032         }
1033
1034         sk->sk_max_ack_backlog = backlog;
1035         sk->sk_ack_backlog = 0;
1036         sk->sk_state = BT_LISTEN;
1037
1038 done:
1039         release_sock(sk);
1040         return err;
1041 }
1042
1043 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
1044 {
1045         DECLARE_WAITQUEUE(wait, current);
1046         struct sock *sk = sock->sk, *nsk;
1047         long timeo;
1048         int err = 0;
1049
1050         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1051
1052         if (sk->sk_state != BT_LISTEN) {
1053                 err = -EBADFD;
1054                 goto done;
1055         }
1056
1057         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
1058
1059         BT_DBG("sk %p timeo %ld", sk, timeo);
1060
1061         /* Wait for an incoming connection. (wake-one). */
1062         add_wait_queue_exclusive(sk->sk_sleep, &wait);
1063         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
1064                 set_current_state(TASK_INTERRUPTIBLE);
1065                 if (!timeo) {
1066                         err = -EAGAIN;
1067                         break;
1068                 }
1069
1070                 release_sock(sk);
1071                 timeo = schedule_timeout(timeo);
1072                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1073
1074                 if (sk->sk_state != BT_LISTEN) {
1075                         err = -EBADFD;
1076                         break;
1077                 }
1078
1079                 if (signal_pending(current)) {
1080                         err = sock_intr_errno(timeo);
1081                         break;
1082                 }
1083         }
1084         set_current_state(TASK_RUNNING);
1085         remove_wait_queue(sk->sk_sleep, &wait);
1086
1087         if (err)
1088                 goto done;
1089
1090         newsock->state = SS_CONNECTED;
1091
1092         BT_DBG("new socket %p", nsk);
1093
1094 done:
1095         release_sock(sk);
1096         return err;
1097 }
1098
1099 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
1100 {
1101         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
1102         struct sock *sk = sock->sk;
1103
1104         BT_DBG("sock %p, sk %p", sock, sk);
1105
1106         addr->sa_family = AF_BLUETOOTH;
1107         *len = sizeof(struct sockaddr_l2);
1108
1109         if (peer) {
1110                 la->l2_psm = l2cap_pi(sk)->psm;
1111                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
1112                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1113         } else {
1114                 la->l2_psm = l2cap_pi(sk)->sport;
1115                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
1116                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
1117         }
1118
1119         return 0;
1120 }
1121
1122 static inline int l2cap_do_send(struct sock *sk, struct msghdr *msg, int len)
1123 {
1124         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
1125         struct sk_buff *skb, **frag;
1126         int err, hlen, count, sent = 0;
1127         struct l2cap_hdr *lh;
1128
1129         BT_DBG("sk %p len %d", sk, len);
1130
1131         /* First fragment (with L2CAP header) */
1132         if (sk->sk_type == SOCK_DGRAM)
1133                 hlen = L2CAP_HDR_SIZE + 2;
1134         else
1135                 hlen = L2CAP_HDR_SIZE;
1136
1137         count = min_t(unsigned int, (conn->mtu - hlen), len);
1138
1139         skb = bt_skb_send_alloc(sk, hlen + count,
1140                         msg->msg_flags & MSG_DONTWAIT, &err);
1141         if (!skb)
1142                 return err;
1143
1144         /* Create L2CAP header */
1145         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1146         lh->cid = cpu_to_le16(l2cap_pi(sk)->dcid);
1147         lh->len = cpu_to_le16(len + (hlen - L2CAP_HDR_SIZE));
1148
1149         if (sk->sk_type == SOCK_DGRAM)
1150                 put_unaligned(l2cap_pi(sk)->psm, (__le16 *) skb_put(skb, 2));
1151
1152         if (memcpy_fromiovec(skb_put(skb, count), msg->msg_iov, count)) {
1153                 err = -EFAULT;
1154                 goto fail;
1155         }
1156
1157         sent += count;
1158         len  -= count;
1159
1160         /* Continuation fragments (no L2CAP header) */
1161         frag = &skb_shinfo(skb)->frag_list;
1162         while (len) {
1163                 count = min_t(unsigned int, conn->mtu, len);
1164
1165                 *frag = bt_skb_send_alloc(sk, count, msg->msg_flags & MSG_DONTWAIT, &err);
1166                 if (!*frag)
1167                         goto fail;
1168
1169                 if (memcpy_fromiovec(skb_put(*frag, count), msg->msg_iov, count)) {
1170                         err = -EFAULT;
1171                         goto fail;
1172                 }
1173
1174                 sent += count;
1175                 len  -= count;
1176
1177                 frag = &(*frag)->next;
1178         }
1179         err = hci_send_acl(conn->hcon, skb, 0);
1180         if (err < 0)
1181                 goto fail;
1182
1183         return sent;
1184
1185 fail:
1186         kfree_skb(skb);
1187         return err;
1188 }
1189
1190 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
1191 {
1192         struct sock *sk = sock->sk;
1193         int err = 0;
1194
1195         BT_DBG("sock %p, sk %p", sock, sk);
1196
1197         err = sock_error(sk);
1198         if (err)
1199                 return err;
1200
1201         if (msg->msg_flags & MSG_OOB)
1202                 return -EOPNOTSUPP;
1203
1204         /* Check outgoing MTU */
1205         if (sk->sk_type != SOCK_RAW && len > l2cap_pi(sk)->omtu)
1206                 return -EINVAL;
1207
1208         lock_sock(sk);
1209
1210         if (sk->sk_state == BT_CONNECTED)
1211                 err = l2cap_do_send(sk, msg, len);
1212         else
1213                 err = -ENOTCONN;
1214
1215         release_sock(sk);
1216         return err;
1217 }
1218
1219 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
1220 {
1221         struct sock *sk = sock->sk;
1222
1223         lock_sock(sk);
1224
1225         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
1226                 struct l2cap_conn_rsp rsp;
1227
1228                 sk->sk_state = BT_CONFIG;
1229
1230                 rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1231                 rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
1232                 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
1233                 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
1234                 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
1235                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1236
1237                 release_sock(sk);
1238                 return 0;
1239         }
1240
1241         release_sock(sk);
1242
1243         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
1244 }
1245
1246 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
1247 {
1248         struct sock *sk = sock->sk;
1249         struct l2cap_options opts;
1250         int len, err = 0;
1251         u32 opt;
1252
1253         BT_DBG("sk %p", sk);
1254
1255         lock_sock(sk);
1256
1257         switch (optname) {
1258         case L2CAP_OPTIONS:
1259                 opts.imtu     = l2cap_pi(sk)->imtu;
1260                 opts.omtu     = l2cap_pi(sk)->omtu;
1261                 opts.flush_to = l2cap_pi(sk)->flush_to;
1262                 opts.mode     = L2CAP_MODE_BASIC;
1263
1264                 len = min_t(unsigned int, sizeof(opts), optlen);
1265                 if (copy_from_user((char *) &opts, optval, len)) {
1266                         err = -EFAULT;
1267                         break;
1268                 }
1269
1270                 l2cap_pi(sk)->imtu  = opts.imtu;
1271                 l2cap_pi(sk)->omtu  = opts.omtu;
1272                 break;
1273
1274         case L2CAP_LM:
1275                 if (get_user(opt, (u32 __user *) optval)) {
1276                         err = -EFAULT;
1277                         break;
1278                 }
1279
1280                 if (opt & L2CAP_LM_AUTH)
1281                         l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
1282                 if (opt & L2CAP_LM_ENCRYPT)
1283                         l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
1284                 if (opt & L2CAP_LM_SECURE)
1285                         l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
1286
1287                 l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
1288                 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
1289                 break;
1290
1291         default:
1292                 err = -ENOPROTOOPT;
1293                 break;
1294         }
1295
1296         release_sock(sk);
1297         return err;
1298 }
1299
1300 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
1301 {
1302         struct sock *sk = sock->sk;
1303         struct bt_security sec;
1304         int len, err = 0;
1305         u32 opt;
1306
1307         BT_DBG("sk %p", sk);
1308
1309         if (level == SOL_L2CAP)
1310                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
1311
1312         if (level != SOL_BLUETOOTH)
1313                 return -ENOPROTOOPT;
1314
1315         lock_sock(sk);
1316
1317         switch (optname) {
1318         case BT_SECURITY:
1319                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_RAW) {
1320                         err = -EINVAL;
1321                         break;
1322                 }
1323
1324                 sec.level = BT_SECURITY_LOW;
1325
1326                 len = min_t(unsigned int, sizeof(sec), optlen);
1327                 if (copy_from_user((char *) &sec, optval, len)) {
1328                         err = -EFAULT;
1329                         break;
1330                 }
1331
1332                 if (sec.level < BT_SECURITY_LOW ||
1333                                         sec.level > BT_SECURITY_HIGH) {
1334                         err = -EINVAL;
1335                         break;
1336                 }
1337
1338                 l2cap_pi(sk)->sec_level = sec.level;
1339                 break;
1340
1341         case BT_DEFER_SETUP:
1342                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1343                         err = -EINVAL;
1344                         break;
1345                 }
1346
1347                 if (get_user(opt, (u32 __user *) optval)) {
1348                         err = -EFAULT;
1349                         break;
1350                 }
1351
1352                 bt_sk(sk)->defer_setup = opt;
1353                 break;
1354
1355         default:
1356                 err = -ENOPROTOOPT;
1357                 break;
1358         }
1359
1360         release_sock(sk);
1361         return err;
1362 }
1363
1364 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1365 {
1366         struct sock *sk = sock->sk;
1367         struct l2cap_options opts;
1368         struct l2cap_conninfo cinfo;
1369         int len, err = 0;
1370         u32 opt;
1371
1372         BT_DBG("sk %p", sk);
1373
1374         if (get_user(len, optlen))
1375                 return -EFAULT;
1376
1377         lock_sock(sk);
1378
1379         switch (optname) {
1380         case L2CAP_OPTIONS:
1381                 opts.imtu     = l2cap_pi(sk)->imtu;
1382                 opts.omtu     = l2cap_pi(sk)->omtu;
1383                 opts.flush_to = l2cap_pi(sk)->flush_to;
1384                 opts.mode     = L2CAP_MODE_BASIC;
1385
1386                 len = min_t(unsigned int, len, sizeof(opts));
1387                 if (copy_to_user(optval, (char *) &opts, len))
1388                         err = -EFAULT;
1389
1390                 break;
1391
1392         case L2CAP_LM:
1393                 switch (l2cap_pi(sk)->sec_level) {
1394                 case BT_SECURITY_LOW:
1395                         opt = L2CAP_LM_AUTH;
1396                         break;
1397                 case BT_SECURITY_MEDIUM:
1398                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
1399                         break;
1400                 case BT_SECURITY_HIGH:
1401                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
1402                                                         L2CAP_LM_SECURE;
1403                         break;
1404                 default:
1405                         opt = 0;
1406                         break;
1407                 }
1408
1409                 if (l2cap_pi(sk)->role_switch)
1410                         opt |= L2CAP_LM_MASTER;
1411
1412                 if (l2cap_pi(sk)->force_reliable)
1413                         opt |= L2CAP_LM_RELIABLE;
1414
1415                 if (put_user(opt, (u32 __user *) optval))
1416                         err = -EFAULT;
1417                 break;
1418
1419         case L2CAP_CONNINFO:
1420                 if (sk->sk_state != BT_CONNECTED &&
1421                                         !(sk->sk_state == BT_CONNECT2 &&
1422                                                 bt_sk(sk)->defer_setup)) {
1423                         err = -ENOTCONN;
1424                         break;
1425                 }
1426
1427                 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
1428                 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
1429
1430                 len = min_t(unsigned int, len, sizeof(cinfo));
1431                 if (copy_to_user(optval, (char *) &cinfo, len))
1432                         err = -EFAULT;
1433
1434                 break;
1435
1436         default:
1437                 err = -ENOPROTOOPT;
1438                 break;
1439         }
1440
1441         release_sock(sk);
1442         return err;
1443 }
1444
1445 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
1446 {
1447         struct sock *sk = sock->sk;
1448         struct bt_security sec;
1449         int len, err = 0;
1450
1451         BT_DBG("sk %p", sk);
1452
1453         if (level == SOL_L2CAP)
1454                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
1455
1456         if (level != SOL_BLUETOOTH)
1457                 return -ENOPROTOOPT;
1458
1459         if (get_user(len, optlen))
1460                 return -EFAULT;
1461
1462         lock_sock(sk);
1463
1464         switch (optname) {
1465         case BT_SECURITY:
1466                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_RAW) {
1467                         err = -EINVAL;
1468                         break;
1469                 }
1470
1471                 sec.level = l2cap_pi(sk)->sec_level;
1472
1473                 len = min_t(unsigned int, len, sizeof(sec));
1474                 if (copy_to_user(optval, (char *) &sec, len))
1475                         err = -EFAULT;
1476
1477                 break;
1478
1479         case BT_DEFER_SETUP:
1480                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
1481                         err = -EINVAL;
1482                         break;
1483                 }
1484
1485                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
1486                         err = -EFAULT;
1487
1488                 break;
1489
1490         default:
1491                 err = -ENOPROTOOPT;
1492                 break;
1493         }
1494
1495         release_sock(sk);
1496         return err;
1497 }
1498
1499 static int l2cap_sock_shutdown(struct socket *sock, int how)
1500 {
1501         struct sock *sk = sock->sk;
1502         int err = 0;
1503
1504         BT_DBG("sock %p, sk %p", sock, sk);
1505
1506         if (!sk)
1507                 return 0;
1508
1509         lock_sock(sk);
1510         if (!sk->sk_shutdown) {
1511                 sk->sk_shutdown = SHUTDOWN_MASK;
1512                 l2cap_sock_clear_timer(sk);
1513                 __l2cap_sock_close(sk, 0);
1514
1515                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1516                         err = bt_sock_wait_state(sk, BT_CLOSED,
1517                                                         sk->sk_lingertime);
1518         }
1519         release_sock(sk);
1520         return err;
1521 }
1522
1523 static int l2cap_sock_release(struct socket *sock)
1524 {
1525         struct sock *sk = sock->sk;
1526         int err;
1527
1528         BT_DBG("sock %p, sk %p", sock, sk);
1529
1530         if (!sk)
1531                 return 0;
1532
1533         err = l2cap_sock_shutdown(sock, 2);
1534
1535         sock_orphan(sk);
1536         l2cap_sock_kill(sk);
1537         return err;
1538 }
1539
1540 static void l2cap_chan_ready(struct sock *sk)
1541 {
1542         struct sock *parent = bt_sk(sk)->parent;
1543
1544         BT_DBG("sk %p, parent %p", sk, parent);
1545
1546         l2cap_pi(sk)->conf_state = 0;
1547         l2cap_sock_clear_timer(sk);
1548
1549         if (!parent) {
1550                 /* Outgoing channel.
1551                  * Wake up socket sleeping on connect.
1552                  */
1553                 sk->sk_state = BT_CONNECTED;
1554                 sk->sk_state_change(sk);
1555         } else {
1556                 /* Incoming channel.
1557                  * Wake up socket sleeping on accept.
1558                  */
1559                 parent->sk_data_ready(parent, 0);
1560         }
1561 }
1562
1563 /* Copy frame to all raw sockets on that connection */
1564 static void l2cap_raw_recv(struct l2cap_conn *conn, struct sk_buff *skb)
1565 {
1566         struct l2cap_chan_list *l = &conn->chan_list;
1567         struct sk_buff *nskb;
1568         struct sock *sk;
1569
1570         BT_DBG("conn %p", conn);
1571
1572         read_lock(&l->lock);
1573         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
1574                 if (sk->sk_type != SOCK_RAW)
1575                         continue;
1576
1577                 /* Don't send frame to the socket it came from */
1578                 if (skb->sk == sk)
1579                         continue;
1580                 nskb = skb_clone(skb, GFP_ATOMIC);
1581                 if (!nskb)
1582                         continue;
1583
1584                 if (sock_queue_rcv_skb(sk, nskb))
1585                         kfree_skb(nskb);
1586         }
1587         read_unlock(&l->lock);
1588 }
1589
1590 /* ---- L2CAP signalling commands ---- */
1591 static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn,
1592                                 u8 code, u8 ident, u16 dlen, void *data)
1593 {
1594         struct sk_buff *skb, **frag;
1595         struct l2cap_cmd_hdr *cmd;
1596         struct l2cap_hdr *lh;
1597         int len, count;
1598
1599         BT_DBG("conn %p, code 0x%2.2x, ident 0x%2.2x, len %d",
1600                         conn, code, ident, dlen);
1601
1602         len = L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE + dlen;
1603         count = min_t(unsigned int, conn->mtu, len);
1604
1605         skb = bt_skb_alloc(count, GFP_ATOMIC);
1606         if (!skb)
1607                 return NULL;
1608
1609         lh = (struct l2cap_hdr *) skb_put(skb, L2CAP_HDR_SIZE);
1610         lh->len = cpu_to_le16(L2CAP_CMD_HDR_SIZE + dlen);
1611         lh->cid = cpu_to_le16(L2CAP_CID_SIGNALING);
1612
1613         cmd = (struct l2cap_cmd_hdr *) skb_put(skb, L2CAP_CMD_HDR_SIZE);
1614         cmd->code  = code;
1615         cmd->ident = ident;
1616         cmd->len   = cpu_to_le16(dlen);
1617
1618         if (dlen) {
1619                 count -= L2CAP_HDR_SIZE + L2CAP_CMD_HDR_SIZE;
1620                 memcpy(skb_put(skb, count), data, count);
1621                 data += count;
1622         }
1623
1624         len -= skb->len;
1625
1626         /* Continuation fragments (no L2CAP header) */
1627         frag = &skb_shinfo(skb)->frag_list;
1628         while (len) {
1629                 count = min_t(unsigned int, conn->mtu, len);
1630
1631                 *frag = bt_skb_alloc(count, GFP_ATOMIC);
1632                 if (!*frag)
1633                         goto fail;
1634
1635                 memcpy(skb_put(*frag, count), data, count);
1636
1637                 len  -= count;
1638                 data += count;
1639
1640                 frag = &(*frag)->next;
1641         }
1642
1643         return skb;
1644
1645 fail:
1646         kfree_skb(skb);
1647         return NULL;
1648 }
1649
1650 static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned long *val)
1651 {
1652         struct l2cap_conf_opt *opt = *ptr;
1653         int len;
1654
1655         len = L2CAP_CONF_OPT_SIZE + opt->len;
1656         *ptr += len;
1657
1658         *type = opt->type;
1659         *olen = opt->len;
1660
1661         switch (opt->len) {
1662         case 1:
1663                 *val = *((u8 *) opt->val);
1664                 break;
1665
1666         case 2:
1667                 *val = __le16_to_cpu(*((__le16 *) opt->val));
1668                 break;
1669
1670         case 4:
1671                 *val = __le32_to_cpu(*((__le32 *) opt->val));
1672                 break;
1673
1674         default:
1675                 *val = (unsigned long) opt->val;
1676                 break;
1677         }
1678
1679         BT_DBG("type 0x%2.2x len %d val 0x%lx", *type, opt->len, *val);
1680         return len;
1681 }
1682
1683 static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
1684 {
1685         struct l2cap_conf_opt *opt = *ptr;
1686
1687         BT_DBG("type 0x%2.2x len %d val 0x%lx", type, len, val);
1688
1689         opt->type = type;
1690         opt->len  = len;
1691
1692         switch (len) {
1693         case 1:
1694                 *((u8 *) opt->val)  = val;
1695                 break;
1696
1697         case 2:
1698                 *((__le16 *) opt->val) = cpu_to_le16(val);
1699                 break;
1700
1701         case 4:
1702                 *((__le32 *) opt->val) = cpu_to_le32(val);
1703                 break;
1704
1705         default:
1706                 memcpy(opt->val, (void *) val, len);
1707                 break;
1708         }
1709
1710         *ptr += L2CAP_CONF_OPT_SIZE + len;
1711 }
1712
1713 static int l2cap_build_conf_req(struct sock *sk, void *data)
1714 {
1715         struct l2cap_pinfo *pi = l2cap_pi(sk);
1716         struct l2cap_conf_req *req = data;
1717         void *ptr = req->data;
1718
1719         BT_DBG("sk %p", sk);
1720
1721         if (pi->imtu != L2CAP_DEFAULT_MTU)
1722                 l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->imtu);
1723
1724         /* FIXME: Need actual value of the flush timeout */
1725         //if (flush_to != L2CAP_DEFAULT_FLUSH_TO)
1726         //   l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, 2, pi->flush_to);
1727
1728         req->dcid  = cpu_to_le16(pi->dcid);
1729         req->flags = cpu_to_le16(0);
1730
1731         return ptr - data;
1732 }
1733
1734 static int l2cap_parse_conf_req(struct sock *sk, void *data)
1735 {
1736         struct l2cap_pinfo *pi = l2cap_pi(sk);
1737         struct l2cap_conf_rsp *rsp = data;
1738         void *ptr = rsp->data;
1739         void *req = pi->conf_req;
1740         int len = pi->conf_len;
1741         int type, hint, olen;
1742         unsigned long val;
1743         struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
1744         u16 mtu = L2CAP_DEFAULT_MTU;
1745         u16 result = L2CAP_CONF_SUCCESS;
1746
1747         BT_DBG("sk %p", sk);
1748
1749         while (len >= L2CAP_CONF_OPT_SIZE) {
1750                 len -= l2cap_get_conf_opt(&req, &type, &olen, &val);
1751
1752                 hint  = type & L2CAP_CONF_HINT;
1753                 type &= L2CAP_CONF_MASK;
1754
1755                 switch (type) {
1756                 case L2CAP_CONF_MTU:
1757                         mtu = val;
1758                         break;
1759
1760                 case L2CAP_CONF_FLUSH_TO:
1761                         pi->flush_to = val;
1762                         break;
1763
1764                 case L2CAP_CONF_QOS:
1765                         break;
1766
1767                 case L2CAP_CONF_RFC:
1768                         if (olen == sizeof(rfc))
1769                                 memcpy(&rfc, (void *) val, olen);
1770                         break;
1771
1772                 default:
1773                         if (hint)
1774                                 break;
1775
1776                         result = L2CAP_CONF_UNKNOWN;
1777                         *((u8 *) ptr++) = type;
1778                         break;
1779                 }
1780         }
1781
1782         if (result == L2CAP_CONF_SUCCESS) {
1783                 /* Configure output options and let the other side know
1784                  * which ones we don't like. */
1785
1786                 if (rfc.mode == L2CAP_MODE_BASIC) {
1787                         if (mtu < pi->omtu)
1788                                 result = L2CAP_CONF_UNACCEPT;
1789                         else {
1790                                 pi->omtu = mtu;
1791                                 pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
1792                         }
1793
1794                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, pi->omtu);
1795                 } else {
1796                         result = L2CAP_CONF_UNACCEPT;
1797
1798                         memset(&rfc, 0, sizeof(rfc));
1799                         rfc.mode = L2CAP_MODE_BASIC;
1800
1801                         l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
1802                                                 sizeof(rfc), (unsigned long) &rfc);
1803                 }
1804         }
1805
1806         rsp->scid   = cpu_to_le16(pi->dcid);
1807         rsp->result = cpu_to_le16(result);
1808         rsp->flags  = cpu_to_le16(0x0000);
1809
1810         return ptr - data;
1811 }
1812
1813 static int l2cap_build_conf_rsp(struct sock *sk, void *data, u16 result, u16 flags)
1814 {
1815         struct l2cap_conf_rsp *rsp = data;
1816         void *ptr = rsp->data;
1817
1818         BT_DBG("sk %p", sk);
1819
1820         rsp->scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
1821         rsp->result = cpu_to_le16(result);
1822         rsp->flags  = cpu_to_le16(flags);
1823
1824         return ptr - data;
1825 }
1826
1827 static inline int l2cap_command_rej(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1828 {
1829         struct l2cap_cmd_rej *rej = (struct l2cap_cmd_rej *) data;
1830
1831         if (rej->reason != 0x0000)
1832                 return 0;
1833
1834         if ((conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_SENT) &&
1835                                         cmd->ident == conn->info_ident) {
1836                 del_timer(&conn->info_timer);
1837
1838                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
1839                 conn->info_ident = 0;
1840
1841                 l2cap_conn_start(conn);
1842         }
1843
1844         return 0;
1845 }
1846
1847 static inline int l2cap_connect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1848 {
1849         struct l2cap_chan_list *list = &conn->chan_list;
1850         struct l2cap_conn_req *req = (struct l2cap_conn_req *) data;
1851         struct l2cap_conn_rsp rsp;
1852         struct sock *sk, *parent;
1853         int result, status = L2CAP_CS_NO_INFO;
1854
1855         u16 dcid = 0, scid = __le16_to_cpu(req->scid);
1856         __le16 psm = req->psm;
1857
1858         BT_DBG("psm 0x%2.2x scid 0x%4.4x", psm, scid);
1859
1860         /* Check if we have socket listening on psm */
1861         parent = l2cap_get_sock_by_psm(BT_LISTEN, psm, conn->src);
1862         if (!parent) {
1863                 result = L2CAP_CR_BAD_PSM;
1864                 goto sendresp;
1865         }
1866
1867         /* Check if the ACL is secure enough (if not SDP) */
1868         if (psm != cpu_to_le16(0x0001) &&
1869                                 !hci_conn_check_link_mode(conn->hcon)) {
1870                 conn->disc_reason = 0x05;
1871                 result = L2CAP_CR_SEC_BLOCK;
1872                 goto response;
1873         }
1874
1875         result = L2CAP_CR_NO_MEM;
1876
1877         /* Check for backlog size */
1878         if (sk_acceptq_is_full(parent)) {
1879                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1880                 goto response;
1881         }
1882
1883         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP, GFP_ATOMIC);
1884         if (!sk)
1885                 goto response;
1886
1887         write_lock_bh(&list->lock);
1888
1889         /* Check if we already have channel with that dcid */
1890         if (__l2cap_get_chan_by_dcid(list, scid)) {
1891                 write_unlock_bh(&list->lock);
1892                 sock_set_flag(sk, SOCK_ZAPPED);
1893                 l2cap_sock_kill(sk);
1894                 goto response;
1895         }
1896
1897         hci_conn_hold(conn->hcon);
1898
1899         l2cap_sock_init(sk, parent);
1900         bacpy(&bt_sk(sk)->src, conn->src);
1901         bacpy(&bt_sk(sk)->dst, conn->dst);
1902         l2cap_pi(sk)->psm  = psm;
1903         l2cap_pi(sk)->dcid = scid;
1904
1905         __l2cap_chan_add(conn, sk, parent);
1906         dcid = l2cap_pi(sk)->scid;
1907
1908         l2cap_sock_set_timer(sk, sk->sk_sndtimeo);
1909
1910         l2cap_pi(sk)->ident = cmd->ident;
1911
1912         if (conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE) {
1913                 if (l2cap_check_security(sk)) {
1914                         if (bt_sk(sk)->defer_setup) {
1915                                 sk->sk_state = BT_CONNECT2;
1916                                 result = L2CAP_CR_PEND;
1917                                 status = L2CAP_CS_AUTHOR_PEND;
1918                                 parent->sk_data_ready(parent, 0);
1919                         } else {
1920                                 sk->sk_state = BT_CONFIG;
1921                                 result = L2CAP_CR_SUCCESS;
1922                                 status = L2CAP_CS_NO_INFO;
1923                         }
1924                 } else {
1925                         sk->sk_state = BT_CONNECT2;
1926                         result = L2CAP_CR_PEND;
1927                         status = L2CAP_CS_AUTHEN_PEND;
1928                 }
1929         } else {
1930                 sk->sk_state = BT_CONNECT2;
1931                 result = L2CAP_CR_PEND;
1932                 status = L2CAP_CS_NO_INFO;
1933         }
1934
1935         write_unlock_bh(&list->lock);
1936
1937 response:
1938         bh_unlock_sock(parent);
1939
1940 sendresp:
1941         rsp.scid   = cpu_to_le16(scid);
1942         rsp.dcid   = cpu_to_le16(dcid);
1943         rsp.result = cpu_to_le16(result);
1944         rsp.status = cpu_to_le16(status);
1945         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONN_RSP, sizeof(rsp), &rsp);
1946
1947         if (result == L2CAP_CR_PEND && status == L2CAP_CS_NO_INFO) {
1948                 struct l2cap_info_req info;
1949                 info.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
1950
1951                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_SENT;
1952                 conn->info_ident = l2cap_get_ident(conn);
1953
1954                 mod_timer(&conn->info_timer, jiffies +
1955                                         msecs_to_jiffies(L2CAP_INFO_TIMEOUT));
1956
1957                 l2cap_send_cmd(conn, conn->info_ident,
1958                                         L2CAP_INFO_REQ, sizeof(info), &info);
1959         }
1960
1961         return 0;
1962 }
1963
1964 static inline int l2cap_connect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
1965 {
1966         struct l2cap_conn_rsp *rsp = (struct l2cap_conn_rsp *) data;
1967         u16 scid, dcid, result, status;
1968         struct sock *sk;
1969         u8 req[128];
1970
1971         scid   = __le16_to_cpu(rsp->scid);
1972         dcid   = __le16_to_cpu(rsp->dcid);
1973         result = __le16_to_cpu(rsp->result);
1974         status = __le16_to_cpu(rsp->status);
1975
1976         BT_DBG("dcid 0x%4.4x scid 0x%4.4x result 0x%2.2x status 0x%2.2x", dcid, scid, result, status);
1977
1978         if (scid) {
1979                 sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
1980                 if (!sk)
1981                         return 0;
1982         } else {
1983                 sk = l2cap_get_chan_by_ident(&conn->chan_list, cmd->ident);
1984                 if (!sk)
1985                         return 0;
1986         }
1987
1988         switch (result) {
1989         case L2CAP_CR_SUCCESS:
1990                 sk->sk_state = BT_CONFIG;
1991                 l2cap_pi(sk)->ident = 0;
1992                 l2cap_pi(sk)->dcid = dcid;
1993                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
1994
1995                 l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_CONNECT_PEND;
1996
1997                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
1998                                         l2cap_build_conf_req(sk, req), req);
1999                 break;
2000
2001         case L2CAP_CR_PEND:
2002                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_CONNECT_PEND;
2003                 break;
2004
2005         default:
2006                 l2cap_chan_del(sk, ECONNREFUSED);
2007                 break;
2008         }
2009
2010         bh_unlock_sock(sk);
2011         return 0;
2012 }
2013
2014 static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u16 cmd_len, u8 *data)
2015 {
2016         struct l2cap_conf_req *req = (struct l2cap_conf_req *) data;
2017         u16 dcid, flags;
2018         u8 rsp[64];
2019         struct sock *sk;
2020         int len;
2021
2022         dcid  = __le16_to_cpu(req->dcid);
2023         flags = __le16_to_cpu(req->flags);
2024
2025         BT_DBG("dcid 0x%4.4x flags 0x%2.2x", dcid, flags);
2026
2027         sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2028         if (!sk)
2029                 return -ENOENT;
2030
2031         if (sk->sk_state == BT_DISCONN)
2032                 goto unlock;
2033
2034         /* Reject if config buffer is too small. */
2035         len = cmd_len - sizeof(*req);
2036         if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
2037                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2038                                 l2cap_build_conf_rsp(sk, rsp,
2039                                         L2CAP_CONF_REJECT, flags), rsp);
2040                 goto unlock;
2041         }
2042
2043         /* Store config. */
2044         memcpy(l2cap_pi(sk)->conf_req + l2cap_pi(sk)->conf_len, req->data, len);
2045         l2cap_pi(sk)->conf_len += len;
2046
2047         if (flags & 0x0001) {
2048                 /* Incomplete config. Send empty response. */
2049                 l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
2050                                 l2cap_build_conf_rsp(sk, rsp,
2051                                         L2CAP_CONF_SUCCESS, 0x0001), rsp);
2052                 goto unlock;
2053         }
2054
2055         /* Complete config. */
2056         len = l2cap_parse_conf_req(sk, rsp);
2057         if (len < 0)
2058                 goto unlock;
2059
2060         l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP, len, rsp);
2061
2062         /* Reset config buffer. */
2063         l2cap_pi(sk)->conf_len = 0;
2064
2065         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE))
2066                 goto unlock;
2067
2068         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
2069                 sk->sk_state = BT_CONNECTED;
2070                 l2cap_chan_ready(sk);
2071                 goto unlock;
2072         }
2073
2074         if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT)) {
2075                 u8 buf[64];
2076                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2077                                         l2cap_build_conf_req(sk, buf), buf);
2078         }
2079
2080 unlock:
2081         bh_unlock_sock(sk);
2082         return 0;
2083 }
2084
2085 static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2086 {
2087         struct l2cap_conf_rsp *rsp = (struct l2cap_conf_rsp *)data;
2088         u16 scid, flags, result;
2089         struct sock *sk;
2090
2091         scid   = __le16_to_cpu(rsp->scid);
2092         flags  = __le16_to_cpu(rsp->flags);
2093         result = __le16_to_cpu(rsp->result);
2094
2095         BT_DBG("scid 0x%4.4x flags 0x%2.2x result 0x%2.2x",
2096                         scid, flags, result);
2097
2098         sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2099         if (!sk)
2100                 return 0;
2101
2102         switch (result) {
2103         case L2CAP_CONF_SUCCESS:
2104                 break;
2105
2106         case L2CAP_CONF_UNACCEPT:
2107                 if (++l2cap_pi(sk)->conf_retry < L2CAP_CONF_MAX_RETRIES) {
2108                         char req[128];
2109                         /* It does not make sense to adjust L2CAP parameters
2110                          * that are currently defined in the spec. We simply
2111                          * resend config request that we sent earlier. It is
2112                          * stupid, but it helps qualification testing which
2113                          * expects at least some response from us. */
2114                         l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
2115                                                 l2cap_build_conf_req(sk, req), req);
2116                         goto done;
2117                 }
2118
2119         default:
2120                 sk->sk_state = BT_DISCONN;
2121                 sk->sk_err = ECONNRESET;
2122                 l2cap_sock_set_timer(sk, HZ * 5);
2123                 {
2124                         struct l2cap_disconn_req req;
2125                         req.dcid = cpu_to_le16(l2cap_pi(sk)->dcid);
2126                         req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2127                         l2cap_send_cmd(conn, l2cap_get_ident(conn),
2128                                         L2CAP_DISCONN_REQ, sizeof(req), &req);
2129                 }
2130                 goto done;
2131         }
2132
2133         if (flags & 0x01)
2134                 goto done;
2135
2136         l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
2137
2138         if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
2139                 sk->sk_state = BT_CONNECTED;
2140                 l2cap_chan_ready(sk);
2141         }
2142
2143 done:
2144         bh_unlock_sock(sk);
2145         return 0;
2146 }
2147
2148 static inline int l2cap_disconnect_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2149 {
2150         struct l2cap_disconn_req *req = (struct l2cap_disconn_req *) data;
2151         struct l2cap_disconn_rsp rsp;
2152         u16 dcid, scid;
2153         struct sock *sk;
2154
2155         scid = __le16_to_cpu(req->scid);
2156         dcid = __le16_to_cpu(req->dcid);
2157
2158         BT_DBG("scid 0x%4.4x dcid 0x%4.4x", scid, dcid);
2159
2160         sk = l2cap_get_chan_by_scid(&conn->chan_list, dcid);
2161         if (!sk)
2162                 return 0;
2163
2164         rsp.dcid = cpu_to_le16(l2cap_pi(sk)->scid);
2165         rsp.scid = cpu_to_le16(l2cap_pi(sk)->dcid);
2166         l2cap_send_cmd(conn, cmd->ident, L2CAP_DISCONN_RSP, sizeof(rsp), &rsp);
2167
2168         sk->sk_shutdown = SHUTDOWN_MASK;
2169
2170         l2cap_chan_del(sk, ECONNRESET);
2171         bh_unlock_sock(sk);
2172
2173         l2cap_sock_kill(sk);
2174         return 0;
2175 }
2176
2177 static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2178 {
2179         struct l2cap_disconn_rsp *rsp = (struct l2cap_disconn_rsp *) data;
2180         u16 dcid, scid;
2181         struct sock *sk;
2182
2183         scid = __le16_to_cpu(rsp->scid);
2184         dcid = __le16_to_cpu(rsp->dcid);
2185
2186         BT_DBG("dcid 0x%4.4x scid 0x%4.4x", dcid, scid);
2187
2188         sk = l2cap_get_chan_by_scid(&conn->chan_list, scid);
2189         if (!sk)
2190                 return 0;
2191
2192         l2cap_chan_del(sk, 0);
2193         bh_unlock_sock(sk);
2194
2195         l2cap_sock_kill(sk);
2196         return 0;
2197 }
2198
2199 static inline int l2cap_information_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2200 {
2201         struct l2cap_info_req *req = (struct l2cap_info_req *) data;
2202         u16 type;
2203
2204         type = __le16_to_cpu(req->type);
2205
2206         BT_DBG("type 0x%4.4x", type);
2207
2208         if (type == L2CAP_IT_FEAT_MASK) {
2209                 u8 buf[8];
2210                 u32 feat_mask = l2cap_feat_mask;
2211                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2212                 rsp->type   = cpu_to_le16(L2CAP_IT_FEAT_MASK);
2213                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2214                 if (enable_ertm)
2215                         feat_mask |= L2CAP_FEAT_ERTM;
2216                 put_unaligned(cpu_to_le32(feat_mask), (__le32 *) rsp->data);
2217                 l2cap_send_cmd(conn, cmd->ident,
2218                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2219         } else if (type == L2CAP_IT_FIXED_CHAN) {
2220                 u8 buf[12];
2221                 struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) buf;
2222                 rsp->type   = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2223                 rsp->result = cpu_to_le16(L2CAP_IR_SUCCESS);
2224                 memcpy(buf + 4, l2cap_fixed_chan, 8);
2225                 l2cap_send_cmd(conn, cmd->ident,
2226                                         L2CAP_INFO_RSP, sizeof(buf), buf);
2227         } else {
2228                 struct l2cap_info_rsp rsp;
2229                 rsp.type   = cpu_to_le16(type);
2230                 rsp.result = cpu_to_le16(L2CAP_IR_NOTSUPP);
2231                 l2cap_send_cmd(conn, cmd->ident,
2232                                         L2CAP_INFO_RSP, sizeof(rsp), &rsp);
2233         }
2234
2235         return 0;
2236 }
2237
2238 static inline int l2cap_information_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr *cmd, u8 *data)
2239 {
2240         struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
2241         u16 type, result;
2242
2243         type   = __le16_to_cpu(rsp->type);
2244         result = __le16_to_cpu(rsp->result);
2245
2246         BT_DBG("type 0x%4.4x result 0x%2.2x", type, result);
2247
2248         del_timer(&conn->info_timer);
2249
2250         if (type == L2CAP_IT_FEAT_MASK) {
2251                 conn->feat_mask = get_unaligned_le32(rsp->data);
2252
2253                 if (conn->feat_mask & L2CAP_FEAT_FIXED_CHAN) {
2254                         struct l2cap_info_req req;
2255                         req.type = cpu_to_le16(L2CAP_IT_FIXED_CHAN);
2256
2257                         conn->info_ident = l2cap_get_ident(conn);
2258
2259                         l2cap_send_cmd(conn, conn->info_ident,
2260                                         L2CAP_INFO_REQ, sizeof(req), &req);
2261                 } else {
2262                         conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2263                         conn->info_ident = 0;
2264
2265                         l2cap_conn_start(conn);
2266                 }
2267         } else if (type == L2CAP_IT_FIXED_CHAN) {
2268                 conn->info_state |= L2CAP_INFO_FEAT_MASK_REQ_DONE;
2269                 conn->info_ident = 0;
2270
2271                 l2cap_conn_start(conn);
2272         }
2273
2274         return 0;
2275 }
2276
2277 static inline void l2cap_sig_channel(struct l2cap_conn *conn, struct sk_buff *skb)
2278 {
2279         u8 *data = skb->data;
2280         int len = skb->len;
2281         struct l2cap_cmd_hdr cmd;
2282         int err = 0;
2283
2284         l2cap_raw_recv(conn, skb);
2285
2286         while (len >= L2CAP_CMD_HDR_SIZE) {
2287                 u16 cmd_len;
2288                 memcpy(&cmd, data, L2CAP_CMD_HDR_SIZE);
2289                 data += L2CAP_CMD_HDR_SIZE;
2290                 len  -= L2CAP_CMD_HDR_SIZE;
2291
2292                 cmd_len = le16_to_cpu(cmd.len);
2293
2294                 BT_DBG("code 0x%2.2x len %d id 0x%2.2x", cmd.code, cmd_len, cmd.ident);
2295
2296                 if (cmd_len > len || !cmd.ident) {
2297                         BT_DBG("corrupted command");
2298                         break;
2299                 }
2300
2301                 switch (cmd.code) {
2302                 case L2CAP_COMMAND_REJ:
2303                         l2cap_command_rej(conn, &cmd, data);
2304                         break;
2305
2306                 case L2CAP_CONN_REQ:
2307                         err = l2cap_connect_req(conn, &cmd, data);
2308                         break;
2309
2310                 case L2CAP_CONN_RSP:
2311                         err = l2cap_connect_rsp(conn, &cmd, data);
2312                         break;
2313
2314                 case L2CAP_CONF_REQ:
2315                         err = l2cap_config_req(conn, &cmd, cmd_len, data);
2316                         break;
2317
2318                 case L2CAP_CONF_RSP:
2319                         err = l2cap_config_rsp(conn, &cmd, data);
2320                         break;
2321
2322                 case L2CAP_DISCONN_REQ:
2323                         err = l2cap_disconnect_req(conn, &cmd, data);
2324                         break;
2325
2326                 case L2CAP_DISCONN_RSP:
2327                         err = l2cap_disconnect_rsp(conn, &cmd, data);
2328                         break;
2329
2330                 case L2CAP_ECHO_REQ:
2331                         l2cap_send_cmd(conn, cmd.ident, L2CAP_ECHO_RSP, cmd_len, data);
2332                         break;
2333
2334                 case L2CAP_ECHO_RSP:
2335                         break;
2336
2337                 case L2CAP_INFO_REQ:
2338                         err = l2cap_information_req(conn, &cmd, data);
2339                         break;
2340
2341                 case L2CAP_INFO_RSP:
2342                         err = l2cap_information_rsp(conn, &cmd, data);
2343                         break;
2344
2345                 default:
2346                         BT_ERR("Unknown signaling command 0x%2.2x", cmd.code);
2347                         err = -EINVAL;
2348                         break;
2349                 }
2350
2351                 if (err) {
2352                         struct l2cap_cmd_rej rej;
2353                         BT_DBG("error %d", err);
2354
2355                         /* FIXME: Map err to a valid reason */
2356                         rej.reason = cpu_to_le16(0);
2357                         l2cap_send_cmd(conn, cmd.ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
2358                 }
2359
2360                 data += cmd_len;
2361                 len  -= cmd_len;
2362         }
2363
2364         kfree_skb(skb);
2365 }
2366
2367 static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk_buff *skb)
2368 {
2369         struct sock *sk;
2370
2371         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
2372         if (!sk) {
2373                 BT_DBG("unknown cid 0x%4.4x", cid);
2374                 goto drop;
2375         }
2376
2377         BT_DBG("sk %p, len %d", sk, skb->len);
2378
2379         if (sk->sk_state != BT_CONNECTED)
2380                 goto drop;
2381
2382         if (l2cap_pi(sk)->imtu < skb->len)
2383                 goto drop;
2384
2385         /* If socket recv buffers overflows we drop data here
2386          * which is *bad* because L2CAP has to be reliable.
2387          * But we don't have any other choice. L2CAP doesn't
2388          * provide flow control mechanism. */
2389
2390         if (!sock_queue_rcv_skb(sk, skb))
2391                 goto done;
2392
2393 drop:
2394         kfree_skb(skb);
2395
2396 done:
2397         if (sk)
2398                 bh_unlock_sock(sk);
2399
2400         return 0;
2401 }
2402
2403 static inline int l2cap_conless_channel(struct l2cap_conn *conn, __le16 psm, struct sk_buff *skb)
2404 {
2405         struct sock *sk;
2406
2407         sk = l2cap_get_sock_by_psm(0, psm, conn->src);
2408         if (!sk)
2409                 goto drop;
2410
2411         BT_DBG("sk %p, len %d", sk, skb->len);
2412
2413         if (sk->sk_state != BT_BOUND && sk->sk_state != BT_CONNECTED)
2414                 goto drop;
2415
2416         if (l2cap_pi(sk)->imtu < skb->len)
2417                 goto drop;
2418
2419         if (!sock_queue_rcv_skb(sk, skb))
2420                 goto done;
2421
2422 drop:
2423         kfree_skb(skb);
2424
2425 done:
2426         if (sk)
2427                 bh_unlock_sock(sk);
2428         return 0;
2429 }
2430
2431 static void l2cap_recv_frame(struct l2cap_conn *conn, struct sk_buff *skb)
2432 {
2433         struct l2cap_hdr *lh = (void *) skb->data;
2434         u16 cid, len;
2435         __le16 psm;
2436
2437         skb_pull(skb, L2CAP_HDR_SIZE);
2438         cid = __le16_to_cpu(lh->cid);
2439         len = __le16_to_cpu(lh->len);
2440
2441         BT_DBG("len %d, cid 0x%4.4x", len, cid);
2442
2443         switch (cid) {
2444         case L2CAP_CID_SIGNALING:
2445                 l2cap_sig_channel(conn, skb);
2446                 break;
2447
2448         case L2CAP_CID_CONN_LESS:
2449                 psm = get_unaligned((__le16 *) skb->data);
2450                 skb_pull(skb, 2);
2451                 l2cap_conless_channel(conn, psm, skb);
2452                 break;
2453
2454         default:
2455                 l2cap_data_channel(conn, cid, skb);
2456                 break;
2457         }
2458 }
2459
2460 /* ---- L2CAP interface with lower layer (HCI) ---- */
2461
2462 static int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2463 {
2464         int exact = 0, lm1 = 0, lm2 = 0;
2465         register struct sock *sk;
2466         struct hlist_node *node;
2467
2468         if (type != ACL_LINK)
2469                 return 0;
2470
2471         BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
2472
2473         /* Find listening sockets and check their link_mode */
2474         read_lock(&l2cap_sk_list.lock);
2475         sk_for_each(sk, node, &l2cap_sk_list.head) {
2476                 if (sk->sk_state != BT_LISTEN)
2477                         continue;
2478
2479                 if (!bacmp(&bt_sk(sk)->src, &hdev->bdaddr)) {
2480                         lm1 |= HCI_LM_ACCEPT;
2481                         if (l2cap_pi(sk)->role_switch)
2482                                 lm1 |= HCI_LM_MASTER;
2483                         exact++;
2484                 } else if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY)) {
2485                         lm2 |= HCI_LM_ACCEPT;
2486                         if (l2cap_pi(sk)->role_switch)
2487                                 lm2 |= HCI_LM_MASTER;
2488                 }
2489         }
2490         read_unlock(&l2cap_sk_list.lock);
2491
2492         return exact ? lm1 : lm2;
2493 }
2494
2495 static int l2cap_connect_cfm(struct hci_conn *hcon, u8 status)
2496 {
2497         struct l2cap_conn *conn;
2498
2499         BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
2500
2501         if (hcon->type != ACL_LINK)
2502                 return 0;
2503
2504         if (!status) {
2505                 conn = l2cap_conn_add(hcon, status);
2506                 if (conn)
2507                         l2cap_conn_ready(conn);
2508         } else
2509                 l2cap_conn_del(hcon, bt_err(status));
2510
2511         return 0;
2512 }
2513
2514 static int l2cap_disconn_ind(struct hci_conn *hcon)
2515 {
2516         struct l2cap_conn *conn = hcon->l2cap_data;
2517
2518         BT_DBG("hcon %p", hcon);
2519
2520         if (hcon->type != ACL_LINK || !conn)
2521                 return 0x13;
2522
2523         return conn->disc_reason;
2524 }
2525
2526 static int l2cap_disconn_cfm(struct hci_conn *hcon, u8 reason)
2527 {
2528         BT_DBG("hcon %p reason %d", hcon, reason);
2529
2530         if (hcon->type != ACL_LINK)
2531                 return 0;
2532
2533         l2cap_conn_del(hcon, bt_err(reason));
2534
2535         return 0;
2536 }
2537
2538 static inline void l2cap_check_encryption(struct sock *sk, u8 encrypt)
2539 {
2540         if (sk->sk_type != SOCK_SEQPACKET)
2541                 return;
2542
2543         if (encrypt == 0x00) {
2544                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM) {
2545                         l2cap_sock_clear_timer(sk);
2546                         l2cap_sock_set_timer(sk, HZ * 5);
2547                 } else if (l2cap_pi(sk)->sec_level == BT_SECURITY_HIGH)
2548                         __l2cap_sock_close(sk, ECONNREFUSED);
2549         } else {
2550                 if (l2cap_pi(sk)->sec_level == BT_SECURITY_MEDIUM)
2551                         l2cap_sock_clear_timer(sk);
2552         }
2553 }
2554
2555 static int l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt)
2556 {
2557         struct l2cap_chan_list *l;
2558         struct l2cap_conn *conn = hcon->l2cap_data;
2559         struct sock *sk;
2560
2561         if (!conn)
2562                 return 0;
2563
2564         l = &conn->chan_list;
2565
2566         BT_DBG("conn %p", conn);
2567
2568         read_lock(&l->lock);
2569
2570         for (sk = l->head; sk; sk = l2cap_pi(sk)->next_c) {
2571                 bh_lock_sock(sk);
2572
2573                 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_CONNECT_PEND) {
2574                         bh_unlock_sock(sk);
2575                         continue;
2576                 }
2577
2578                 if (!status && (sk->sk_state == BT_CONNECTED ||
2579                                                 sk->sk_state == BT_CONFIG)) {
2580                         l2cap_check_encryption(sk, encrypt);
2581                         bh_unlock_sock(sk);
2582                         continue;
2583                 }
2584
2585                 if (sk->sk_state == BT_CONNECT) {
2586                         if (!status) {
2587                                 struct l2cap_conn_req req;
2588                                 req.scid = cpu_to_le16(l2cap_pi(sk)->scid);
2589                                 req.psm  = l2cap_pi(sk)->psm;
2590
2591                                 l2cap_pi(sk)->ident = l2cap_get_ident(conn);
2592
2593                                 l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2594                                         L2CAP_CONN_REQ, sizeof(req), &req);
2595                         } else {
2596                                 l2cap_sock_clear_timer(sk);
2597                                 l2cap_sock_set_timer(sk, HZ / 10);
2598                         }
2599                 } else if (sk->sk_state == BT_CONNECT2) {
2600                         struct l2cap_conn_rsp rsp;
2601                         __u16 result;
2602
2603                         if (!status) {
2604                                 sk->sk_state = BT_CONFIG;
2605                                 result = L2CAP_CR_SUCCESS;
2606                         } else {
2607                                 sk->sk_state = BT_DISCONN;
2608                                 l2cap_sock_set_timer(sk, HZ / 10);
2609                                 result = L2CAP_CR_SEC_BLOCK;
2610                         }
2611
2612                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
2613                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
2614                         rsp.result = cpu_to_le16(result);
2615                         rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
2616                         l2cap_send_cmd(conn, l2cap_pi(sk)->ident,
2617                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
2618                 }
2619
2620                 bh_unlock_sock(sk);
2621         }
2622
2623         read_unlock(&l->lock);
2624
2625         return 0;
2626 }
2627
2628 static int l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags)
2629 {
2630         struct l2cap_conn *conn = hcon->l2cap_data;
2631
2632         if (!conn && !(conn = l2cap_conn_add(hcon, 0)))
2633                 goto drop;
2634
2635         BT_DBG("conn %p len %d flags 0x%x", conn, skb->len, flags);
2636
2637         if (flags & ACL_START) {
2638                 struct l2cap_hdr *hdr;
2639                 int len;
2640
2641                 if (conn->rx_len) {
2642                         BT_ERR("Unexpected start frame (len %d)", skb->len);
2643                         kfree_skb(conn->rx_skb);
2644                         conn->rx_skb = NULL;
2645                         conn->rx_len = 0;
2646                         l2cap_conn_unreliable(conn, ECOMM);
2647                 }
2648
2649                 if (skb->len < 2) {
2650                         BT_ERR("Frame is too short (len %d)", skb->len);
2651                         l2cap_conn_unreliable(conn, ECOMM);
2652                         goto drop;
2653                 }
2654
2655                 hdr = (struct l2cap_hdr *) skb->data;
2656                 len = __le16_to_cpu(hdr->len) + L2CAP_HDR_SIZE;
2657
2658                 if (len == skb->len) {
2659                         /* Complete frame received */
2660                         l2cap_recv_frame(conn, skb);
2661                         return 0;
2662                 }
2663
2664                 BT_DBG("Start: total len %d, frag len %d", len, skb->len);
2665
2666                 if (skb->len > len) {
2667                         BT_ERR("Frame is too long (len %d, expected len %d)",
2668                                 skb->len, len);
2669                         l2cap_conn_unreliable(conn, ECOMM);
2670                         goto drop;
2671                 }
2672
2673                 /* Allocate skb for the complete frame (with header) */
2674                 conn->rx_skb = bt_skb_alloc(len, GFP_ATOMIC);
2675                 if (!conn->rx_skb)
2676                         goto drop;
2677
2678                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2679                                                                 skb->len);
2680                 conn->rx_len = len - skb->len;
2681         } else {
2682                 BT_DBG("Cont: frag len %d (expecting %d)", skb->len, conn->rx_len);
2683
2684                 if (!conn->rx_len) {
2685                         BT_ERR("Unexpected continuation frame (len %d)", skb->len);
2686                         l2cap_conn_unreliable(conn, ECOMM);
2687                         goto drop;
2688                 }
2689
2690                 if (skb->len > conn->rx_len) {
2691                         BT_ERR("Fragment is too long (len %d, expected %d)",
2692                                         skb->len, conn->rx_len);
2693                         kfree_skb(conn->rx_skb);
2694                         conn->rx_skb = NULL;
2695                         conn->rx_len = 0;
2696                         l2cap_conn_unreliable(conn, ECOMM);
2697                         goto drop;
2698                 }
2699
2700                 skb_copy_from_linear_data(skb, skb_put(conn->rx_skb, skb->len),
2701                                                                 skb->len);
2702                 conn->rx_len -= skb->len;
2703
2704                 if (!conn->rx_len) {
2705                         /* Complete frame received */
2706                         l2cap_recv_frame(conn, conn->rx_skb);
2707                         conn->rx_skb = NULL;
2708                 }
2709         }
2710
2711 drop:
2712         kfree_skb(skb);
2713         return 0;
2714 }
2715
2716 static ssize_t l2cap_sysfs_show(struct class *dev, char *buf)
2717 {
2718         struct sock *sk;
2719         struct hlist_node *node;
2720         char *str = buf;
2721
2722         read_lock_bh(&l2cap_sk_list.lock);
2723
2724         sk_for_each(sk, node, &l2cap_sk_list.head) {
2725                 struct l2cap_pinfo *pi = l2cap_pi(sk);
2726
2727                 str += sprintf(str, "%s %s %d %d 0x%4.4x 0x%4.4x %d %d %d\n",
2728                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
2729                                 sk->sk_state, __le16_to_cpu(pi->psm), pi->scid,
2730                                 pi->dcid, pi->imtu, pi->omtu, pi->sec_level);
2731         }
2732
2733         read_unlock_bh(&l2cap_sk_list.lock);
2734
2735         return str - buf;
2736 }
2737
2738 static CLASS_ATTR(l2cap, S_IRUGO, l2cap_sysfs_show, NULL);
2739
2740 static const struct proto_ops l2cap_sock_ops = {
2741         .family         = PF_BLUETOOTH,
2742         .owner          = THIS_MODULE,
2743         .release        = l2cap_sock_release,
2744         .bind           = l2cap_sock_bind,
2745         .connect        = l2cap_sock_connect,
2746         .listen         = l2cap_sock_listen,
2747         .accept         = l2cap_sock_accept,
2748         .getname        = l2cap_sock_getname,
2749         .sendmsg        = l2cap_sock_sendmsg,
2750         .recvmsg        = l2cap_sock_recvmsg,
2751         .poll           = bt_sock_poll,
2752         .ioctl          = bt_sock_ioctl,
2753         .mmap           = sock_no_mmap,
2754         .socketpair     = sock_no_socketpair,
2755         .shutdown       = l2cap_sock_shutdown,
2756         .setsockopt     = l2cap_sock_setsockopt,
2757         .getsockopt     = l2cap_sock_getsockopt
2758 };
2759
2760 static struct net_proto_family l2cap_sock_family_ops = {
2761         .family = PF_BLUETOOTH,
2762         .owner  = THIS_MODULE,
2763         .create = l2cap_sock_create,
2764 };
2765
2766 static struct hci_proto l2cap_hci_proto = {
2767         .name           = "L2CAP",
2768         .id             = HCI_PROTO_L2CAP,
2769         .connect_ind    = l2cap_connect_ind,
2770         .connect_cfm    = l2cap_connect_cfm,
2771         .disconn_ind    = l2cap_disconn_ind,
2772         .disconn_cfm    = l2cap_disconn_cfm,
2773         .security_cfm   = l2cap_security_cfm,
2774         .recv_acldata   = l2cap_recv_acldata
2775 };
2776
2777 static int __init l2cap_init(void)
2778 {
2779         int err;
2780
2781         err = proto_register(&l2cap_proto, 0);
2782         if (err < 0)
2783                 return err;
2784
2785         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
2786         if (err < 0) {
2787                 BT_ERR("L2CAP socket registration failed");
2788                 goto error;
2789         }
2790
2791         err = hci_register_proto(&l2cap_hci_proto);
2792         if (err < 0) {
2793                 BT_ERR("L2CAP protocol registration failed");
2794                 bt_sock_unregister(BTPROTO_L2CAP);
2795                 goto error;
2796         }
2797
2798         if (class_create_file(bt_class, &class_attr_l2cap) < 0)
2799                 BT_ERR("Failed to create L2CAP info file");
2800
2801         BT_INFO("L2CAP ver %s", VERSION);
2802         BT_INFO("L2CAP socket layer initialized");
2803
2804         return 0;
2805
2806 error:
2807         proto_unregister(&l2cap_proto);
2808         return err;
2809 }
2810
2811 static void __exit l2cap_exit(void)
2812 {
2813         class_remove_file(bt_class, &class_attr_l2cap);
2814
2815         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
2816                 BT_ERR("L2CAP socket unregistration failed");
2817
2818         if (hci_unregister_proto(&l2cap_hci_proto) < 0)
2819                 BT_ERR("L2CAP protocol unregistration failed");
2820
2821         proto_unregister(&l2cap_proto);
2822 }
2823
2824 void l2cap_load(void)
2825 {
2826         /* Dummy function to trigger automatic L2CAP module loading by
2827          * other modules that use L2CAP sockets but don't use any other
2828          * symbols from it. */
2829         return;
2830 }
2831 EXPORT_SYMBOL(l2cap_load);
2832
2833 module_init(l2cap_init);
2834 module_exit(l2cap_exit);
2835
2836 module_param(enable_ertm, bool, 0644);
2837 MODULE_PARM_DESC(enable_ertm, "Enable enhanced retransmission mode");
2838
2839 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2840 MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2841 MODULE_VERSION(VERSION);
2842 MODULE_LICENSE("GPL");
2843 MODULE_ALIAS("bt-proto-0");