net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6
   7    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License version 2 as
  11    published by the Free Software Foundation;
  12
  13    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  14    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  15    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  16    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  17    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  18    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21
  22    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  23    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  24    SOFTWARE IS DISCLAIMED.
  25 */
  26
  27 /* Bluetooth L2CAP sockets. */
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/l2cap.h>
  32 #include <net/bluetooth/smp.h>
  33
  34 static const struct proto_ops l2cap_sock_ops;
  35 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  36 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
  37
  38 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  39 {
  40         struct sock *sk = sock->sk;
  41         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  42         struct sockaddr_l2 la;
  43         int len, err = 0;
  44
  45         BT_DBG("sk %p", sk);
  46
  47         if (!addr || addr->sa_family != AF_BLUETOOTH)
  48                 return -EINVAL;
  49
  50         memset(&la, 0, sizeof(la));
  51         len = min_t(unsigned int, sizeof(la), alen);
  52         memcpy(&la, addr, len);
  53
  54         if (la.l2_cid && la.l2_psm)
  55                 return -EINVAL;
  56
  57         lock_sock(sk);
  58
  59         if (sk->sk_state != BT_OPEN) {
  60                 err = -EBADFD;
  61                 goto done;
  62         }
  63
  64         if (la.l2_psm) {
  65                 __u16 psm = __le16_to_cpu(la.l2_psm);
  66
  67                 /* PSM must be odd and lsb of upper byte must be 0 */
  68                 if ((psm & 0x0101) != 0x0001) {
  69                         err = -EINVAL;
  70                         goto done;
  71                 }
  72
  73                 /* Restrict usage of well-known PSMs */
  74                 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
  75                         err = -EACCES;
  76                         goto done;
  77                 }
  78         }
  79
  80         if (la.l2_cid)
  81                 err = l2cap_add_scid(chan, la.l2_cid);
  82         else
  83                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
  84
  85         if (err < 0)
  86                 goto done;
  87
  88         if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
  89                                 __le16_to_cpu(la.l2_psm) == 0x0003)
  90                 chan->sec_level = BT_SECURITY_SDP;
  91
  92         bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
  93
  94         chan->state = BT_BOUND;
  95         sk->sk_state = BT_BOUND;
  96
  97 done:
  98         release_sock(sk);
  99         return err;
 100 }
 101
 102 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 103 {
 104         struct sock *sk = sock->sk;
 105         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 106         struct sockaddr_l2 la;
 107         int len, err = 0;
 108
 109         BT_DBG("sk %p", sk);
 110
 111         if (!addr || alen < sizeof(addr->sa_family) ||
 112             addr->sa_family != AF_BLUETOOTH)
 113                 return -EINVAL;
 114
 115         memset(&la, 0, sizeof(la));
 116         len = min_t(unsigned int, sizeof(la), alen);
 117         memcpy(&la, addr, len);
 118
 119         if (la.l2_cid && la.l2_psm)
 120                 return -EINVAL;
 121
 122         lock_sock(sk);
 123
 124         if (chan->chan_type == L2CAP_CHAN_CONN_ORIENTED
 125                         && !(la.l2_psm || la.l2_cid)) {
 126                 err = -EINVAL;
 127                 goto done;
 128         }
 129
 130         switch (chan->mode) {
 131         case L2CAP_MODE_BASIC:
 132                 break;
 133         case L2CAP_MODE_ERTM:
 134         case L2CAP_MODE_STREAMING:
 135                 if (!disable_ertm)
 136                         break;
 137                 /* fall through */
 138         default:
 139                 err = -ENOTSUPP;
 140                 goto done;
 141         }
 142
 143         switch (sk->sk_state) {
 144         case BT_CONNECT:
 145         case BT_CONNECT2:
 146         case BT_CONFIG:
 147                 /* Already connecting */
 148                 goto wait;
 149
 150         case BT_CONNECTED:
 151                 /* Already connected */
 152                 err = -EISCONN;
 153                 goto done;
 154
 155         case BT_OPEN:
 156         case BT_BOUND:
 157                 /* Can connect */
 158                 break;
 159
 160         default:
 161                 err = -EBADFD;
 162                 goto done;
 163         }
 164
 165         /* PSM must be odd and lsb of upper byte must be 0 */
 166         if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 && !la.l2_cid &&
 167                                         chan->chan_type != L2CAP_CHAN_RAW) {
 168                 err = -EINVAL;
 169                 goto done;
 170         }
 171
 172         /* Set destination address and psm */
 173         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
 174         chan->psm = la.l2_psm;
 175         chan->dcid = la.l2_cid;
 176
 177         err = l2cap_chan_connect(l2cap_pi(sk)->chan);
 178         if (err)
 179                 goto done;
 180
 181 wait:
 182         err = bt_sock_wait_state(sk, BT_CONNECTED,
 183                         sock_sndtimeo(sk, flags & O_NONBLOCK));
 184 done:
 185         release_sock(sk);
 186         return err;
 187 }
 188
 189 static int l2cap_sock_listen(struct socket *sock, int backlog)
 190 {
 191         struct sock *sk = sock->sk;
 192         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 193         int err = 0;
 194
 195         BT_DBG("sk %p backlog %d", sk, backlog);
 196
 197         lock_sock(sk);
 198
 199         if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
 200                         || sk->sk_state != BT_BOUND) {
 201                 err = -EBADFD;
 202                 goto done;
 203         }
 204
 205         switch (chan->mode) {
 206         case L2CAP_MODE_BASIC:
 207                 break;
 208         case L2CAP_MODE_ERTM:
 209         case L2CAP_MODE_STREAMING:
 210                 if (!disable_ertm)
 211                         break;
 212                 /* fall through */
 213         default:
 214                 err = -ENOTSUPP;
 215                 goto done;
 216         }
 217
 218         sk->sk_max_ack_backlog = backlog;
 219         sk->sk_ack_backlog = 0;
 220
 221         chan->state = BT_LISTEN;
 222         sk->sk_state = BT_LISTEN;
 223
 224 done:
 225         release_sock(sk);
 226         return err;
 227 }
 228
 229 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 230 {
 231         DECLARE_WAITQUEUE(wait, current);
 232         struct sock *sk = sock->sk, *nsk;
 233         long timeo;
 234         int err = 0;
 235
 236         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 237
 238         if (sk->sk_state != BT_LISTEN) {
 239                 err = -EBADFD;
 240                 goto done;
 241         }
 242
 243         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 244
 245         BT_DBG("sk %p timeo %ld", sk, timeo);
 246
 247         /* Wait for an incoming connection. (wake-one). */
 248         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 249         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 250                 set_current_state(TASK_INTERRUPTIBLE);
 251                 if (!timeo) {
 252                         err = -EAGAIN;
 253                         break;
 254                 }
 255
 256                 release_sock(sk);
 257                 timeo = schedule_timeout(timeo);
 258                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 259
 260                 if (sk->sk_state != BT_LISTEN) {
 261                         err = -EBADFD;
 262                         break;
 263                 }
 264
 265                 if (signal_pending(current)) {
 266                         err = sock_intr_errno(timeo);
 267                         break;
 268                 }
 269         }
 270         set_current_state(TASK_RUNNING);
 271         remove_wait_queue(sk_sleep(sk), &wait);
 272
 273         if (err)
 274                 goto done;
 275
 276         newsock->state = SS_CONNECTED;
 277
 278         BT_DBG("new socket %p", nsk);
 279
 280 done:
 281         release_sock(sk);
 282         return err;
 283 }
 284
 285 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 286 {
 287         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 288         struct sock *sk = sock->sk;
 289         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 290
 291         BT_DBG("sock %p, sk %p", sock, sk);
 292
 293         addr->sa_family = AF_BLUETOOTH;
 294         *len = sizeof(struct sockaddr_l2);
 295
 296         if (peer) {
 297                 la->l2_psm = chan->psm;
 298                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
 299                 la->l2_cid = cpu_to_le16(chan->dcid);
 300         } else {
 301                 la->l2_psm = chan->sport;
 302                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
 303                 la->l2_cid = cpu_to_le16(chan->scid);
 304         }
 305
 306         return 0;
 307 }
 308
 309 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 310 {
 311         struct sock *sk = sock->sk;
 312         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 313         struct l2cap_options opts;
 314         struct l2cap_conninfo cinfo;
 315         int len, err = 0;
 316         u32 opt;
 317
 318         BT_DBG("sk %p", sk);
 319
 320         if (get_user(len, optlen))
 321                 return -EFAULT;
 322
 323         lock_sock(sk);
 324
 325         switch (optname) {
 326         case L2CAP_OPTIONS:
 327                 memset(&opts, 0, sizeof(opts));
 328                 opts.imtu     = chan->imtu;
 329                 opts.omtu     = chan->omtu;
 330                 opts.flush_to = chan->flush_to;
 331                 opts.mode     = chan->mode;
 332                 opts.fcs      = chan->fcs;
 333                 opts.max_tx   = chan->max_tx;
 334                 opts.txwin_size = (__u16)chan->tx_win;
 335
 336                 len = min_t(unsigned int, len, sizeof(opts));
 337                 if (copy_to_user(optval, (char *) &opts, len))
 338                         err = -EFAULT;
 339
 340                 break;
 341
 342         case L2CAP_LM:
 343                 switch (chan->sec_level) {
 344                 case BT_SECURITY_LOW:
 345                         opt = L2CAP_LM_AUTH;
 346                         break;
 347                 case BT_SECURITY_MEDIUM:
 348                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 349                         break;
 350                 case BT_SECURITY_HIGH:
 351                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 352                                                         L2CAP_LM_SECURE;
 353                         break;
 354                 default:
 355                         opt = 0;
 356                         break;
 357                 }
 358
 359                 if (chan->role_switch)
 360                         opt |= L2CAP_LM_MASTER;
 361
 362                 if (chan->force_reliable)
 363                         opt |= L2CAP_LM_RELIABLE;
 364
 365                 if (put_user(opt, (u32 __user *) optval))
 366                         err = -EFAULT;
 367                 break;
 368
 369         case L2CAP_CONNINFO:
 370                 if (sk->sk_state != BT_CONNECTED &&
 371                                         !(sk->sk_state == BT_CONNECT2 &&
 372                                                 bt_sk(sk)->defer_setup)) {
 373                         err = -ENOTCONN;
 374                         break;
 375                 }
 376
 377                 memset(&cinfo, 0, sizeof(cinfo));
 378                 cinfo.hci_handle = chan->conn->hcon->handle;
 379                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 380
 381                 len = min_t(unsigned int, len, sizeof(cinfo));
 382                 if (copy_to_user(optval, (char *) &cinfo, len))
 383                         err = -EFAULT;
 384
 385                 break;
 386
 387         default:
 388                 err = -ENOPROTOOPT;
 389                 break;
 390         }
 391
 392         release_sock(sk);
 393         return err;
 394 }
 395
 396 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 397 {
 398         struct sock *sk = sock->sk;
 399         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 400         struct bt_security sec;
 401         struct bt_power pwr;
 402         int len, err = 0;
 403
 404         BT_DBG("sk %p", sk);
 405
 406         if (level == SOL_L2CAP)
 407                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 408
 409         if (level != SOL_BLUETOOTH)
 410                 return -ENOPROTOOPT;
 411
 412         if (get_user(len, optlen))
 413                 return -EFAULT;
 414
 415         lock_sock(sk);
 416
 417         switch (optname) {
 418         case BT_SECURITY:
 419                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 420                                         chan->chan_type != L2CAP_CHAN_RAW) {
 421                         err = -EINVAL;
 422                         break;
 423                 }
 424
 425                 sec.level = chan->sec_level;
 426
 427                 len = min_t(unsigned int, len, sizeof(sec));
 428                 if (copy_to_user(optval, (char *) &sec, len))
 429                         err = -EFAULT;
 430
 431                 break;
 432
 433         case BT_DEFER_SETUP:
 434                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 435                         err = -EINVAL;
 436                         break;
 437                 }
 438
 439                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
 440                         err = -EFAULT;
 441
 442                 break;
 443
 444         case BT_FLUSHABLE:
 445                 if (put_user(chan->flushable, (u32 __user *) optval))
 446                         err = -EFAULT;
 447
 448                 break;
 449
 450         case BT_POWER:
 451                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 452                                 && sk->sk_type != SOCK_RAW) {
 453                         err = -EINVAL;
 454                         break;
 455                 }
 456
 457                 pwr.force_active = chan->force_active;
 458
 459                 len = min_t(unsigned int, len, sizeof(pwr));
 460                 if (copy_to_user(optval, (char *) &pwr, len))
 461                         err = -EFAULT;
 462
 463                 break;
 464
 465         default:
 466                 err = -ENOPROTOOPT;
 467                 break;
 468         }
 469
 470         release_sock(sk);
 471         return err;
 472 }
 473
 474 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 475 {
 476         struct sock *sk = sock->sk;
 477         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 478         struct l2cap_options opts;
 479         int len, err = 0;
 480         u32 opt;
 481
 482         BT_DBG("sk %p", sk);
 483
 484         lock_sock(sk);
 485
 486         switch (optname) {
 487         case L2CAP_OPTIONS:
 488                 if (sk->sk_state == BT_CONNECTED) {
 489                         err = -EINVAL;
 490                         break;
 491                 }
 492
 493                 opts.imtu     = chan->imtu;
 494                 opts.omtu     = chan->omtu;
 495                 opts.flush_to = chan->flush_to;
 496                 opts.mode     = chan->mode;
 497                 opts.fcs      = chan->fcs;
 498                 opts.max_tx   = chan->max_tx;
 499                 opts.txwin_size = (__u16)chan->tx_win;
 500
 501                 len = min_t(unsigned int, sizeof(opts), optlen);
 502                 if (copy_from_user((char *) &opts, optval, len)) {
 503                         err = -EFAULT;
 504                         break;
 505                 }
 506
 507                 if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
 508                         err = -EINVAL;
 509                         break;
 510                 }
 511
 512                 chan->mode = opts.mode;
 513                 switch (chan->mode) {
 514                 case L2CAP_MODE_BASIC:
 515                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 516                         break;
 517                 case L2CAP_MODE_ERTM:
 518                 case L2CAP_MODE_STREAMING:
 519                         if (!disable_ertm)
 520                                 break;
 521                         /* fall through */
 522                 default:
 523                         err = -EINVAL;
 524                         break;
 525                 }
 526
 527                 chan->imtu = opts.imtu;
 528                 chan->omtu = opts.omtu;
 529                 chan->fcs  = opts.fcs;
 530                 chan->max_tx = opts.max_tx;
 531                 chan->tx_win = (__u8)opts.txwin_size;
 532                 break;
 533
 534         case L2CAP_LM:
 535                 if (get_user(opt, (u32 __user *) optval)) {
 536                         err = -EFAULT;
 537                         break;
 538                 }
 539
 540                 if (opt & L2CAP_LM_AUTH)
 541                         chan->sec_level = BT_SECURITY_LOW;
 542                 if (opt & L2CAP_LM_ENCRYPT)
 543                         chan->sec_level = BT_SECURITY_MEDIUM;
 544                 if (opt & L2CAP_LM_SECURE)
 545                         chan->sec_level = BT_SECURITY_HIGH;
 546
 547                 chan->role_switch    = (opt & L2CAP_LM_MASTER);
 548                 chan->force_reliable = (opt & L2CAP_LM_RELIABLE);
 549                 break;
 550
 551         default:
 552                 err = -ENOPROTOOPT;
 553                 break;
 554         }
 555
 556         release_sock(sk);
 557         return err;
 558 }
 559
 560 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 561 {
 562         struct sock *sk = sock->sk;
 563         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 564         struct bt_security sec;
 565         struct bt_power pwr;
 566         struct l2cap_conn *conn;
 567         int len, err = 0;
 568         u32 opt;
 569
 570         BT_DBG("sk %p", sk);
 571
 572         if (level == SOL_L2CAP)
 573                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 574
 575         if (level != SOL_BLUETOOTH)
 576                 return -ENOPROTOOPT;
 577
 578         lock_sock(sk);
 579
 580         switch (optname) {
 581         case BT_SECURITY:
 582                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 583                                         chan->chan_type != L2CAP_CHAN_RAW) {
 584                         err = -EINVAL;
 585                         break;
 586                 }
 587
 588                 sec.level = BT_SECURITY_LOW;
 589
 590                 len = min_t(unsigned int, sizeof(sec), optlen);
 591                 if (copy_from_user((char *) &sec, optval, len)) {
 592                         err = -EFAULT;
 593                         break;
 594                 }
 595
 596                 if (sec.level < BT_SECURITY_LOW ||
 597                                         sec.level > BT_SECURITY_HIGH) {
 598                         err = -EINVAL;
 599                         break;
 600                 }
 601
 602                 chan->sec_level = sec.level;
 603
 604                 conn = chan->conn;
 605                 if (conn && chan->scid == L2CAP_CID_LE_DATA) {
 606                         if (!conn->hcon->out) {
 607                                 err = -EINVAL;
 608                                 break;
 609                         }
 610
 611                         if (smp_conn_security(conn, sec.level))
 612                                 break;
 613
 614                         err = 0;
 615                         sk->sk_state = BT_CONFIG;
 616                 }
 617                 break;
 618
 619         case BT_DEFER_SETUP:
 620                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 621                         err = -EINVAL;
 622                         break;
 623                 }
 624
 625                 if (get_user(opt, (u32 __user *) optval)) {
 626                         err = -EFAULT;
 627                         break;
 628                 }
 629
 630                 bt_sk(sk)->defer_setup = opt;
 631                 break;
 632
 633         case BT_FLUSHABLE:
 634                 if (get_user(opt, (u32 __user *) optval)) {
 635                         err = -EFAULT;
 636                         break;
 637                 }
 638
 639                 if (opt > BT_FLUSHABLE_ON) {
 640                         err = -EINVAL;
 641                         break;
 642                 }
 643
 644                 if (opt == BT_FLUSHABLE_OFF) {
 645                         struct l2cap_conn *conn = chan->conn;
 646                         /* proceed further only when we have l2cap_conn and
 647                            No Flush support in the LM */
 648                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 649                                 err = -EINVAL;
 650                                 break;
 651                         }
 652                 }
 653
 654                 chan->flushable = opt;
 655                 break;
 656
 657         case BT_POWER:
 658                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 659                                         chan->chan_type != L2CAP_CHAN_RAW) {
 660                         err = -EINVAL;
 661                         break;
 662                 }
 663
 664                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 665
 666                 len = min_t(unsigned int, sizeof(pwr), optlen);
 667                 if (copy_from_user((char *) &pwr, optval, len)) {
 668                         err = -EFAULT;
 669                         break;
 670                 }
 671                 chan->force_active = pwr.force_active;
 672                 break;
 673
 674         default:
 675                 err = -ENOPROTOOPT;
 676                 break;
 677         }
 678
 679         release_sock(sk);
 680         return err;
 681 }
 682
 683 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
 684 {
 685         struct sock *sk = sock->sk;
 686         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 687         int err;
 688
 689         BT_DBG("sock %p, sk %p", sock, sk);
 690
 691         err = sock_error(sk);
 692         if (err)
 693                 return err;
 694
 695         if (msg->msg_flags & MSG_OOB)
 696                 return -EOPNOTSUPP;
 697
 698         lock_sock(sk);
 699
 700         if (sk->sk_state != BT_CONNECTED) {
 701                 release_sock(sk);
 702                 return -ENOTCONN;
 703         }
 704
 705         err = l2cap_chan_send(chan, msg, len);
 706
 707         release_sock(sk);
 708         return err;
 709 }
 710
 711 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
 712 {
 713         struct sock *sk = sock->sk;
 714
 715         lock_sock(sk);
 716
 717         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
 718                 sk->sk_state = BT_CONFIG;
 719
 720                 __l2cap_connect_rsp_defer(l2cap_pi(sk)->chan);
 721                 release_sock(sk);
 722                 return 0;
 723         }
 724
 725         release_sock(sk);
 726
 727         if (sock->type == SOCK_STREAM)
 728                 return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
 729
 730         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 731 }
 732
 733 /* Kill socket (only if zapped and orphan)
 734  * Must be called on unlocked socket.
 735  */
 736 static void l2cap_sock_kill(struct sock *sk)
 737 {
 738         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 739                 return;
 740
 741         BT_DBG("sk %p state %d", sk, sk->sk_state);
 742
 743         /* Kill poor orphan */
 744
 745         l2cap_chan_destroy(l2cap_pi(sk)->chan);
 746         sock_set_flag(sk, SOCK_DEAD);
 747         sock_put(sk);
 748 }
 749
 750 static int l2cap_sock_shutdown(struct socket *sock, int how)
 751 {
 752         struct sock *sk = sock->sk;
 753         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 754         int err = 0;
 755
 756         BT_DBG("sock %p, sk %p", sock, sk);
 757
 758         if (!sk)
 759                 return 0;
 760
 761         lock_sock(sk);
 762         if (!sk->sk_shutdown) {
 763                 if (chan->mode == L2CAP_MODE_ERTM)
 764                         err = __l2cap_wait_ack(sk);
 765
 766                 sk->sk_shutdown = SHUTDOWN_MASK;
 767                 l2cap_chan_close(chan, 0);
 768
 769                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 770                         err = bt_sock_wait_state(sk, BT_CLOSED,
 771                                                         sk->sk_lingertime);
 772         }
 773
 774         if (!err && sk->sk_err)
 775                 err = -sk->sk_err;
 776
 777         release_sock(sk);
 778         return err;
 779 }
 780
 781 static int l2cap_sock_release(struct socket *sock)
 782 {
 783         struct sock *sk = sock->sk;
 784         int err;
 785
 786         BT_DBG("sock %p, sk %p", sock, sk);
 787
 788         if (!sk)
 789                 return 0;
 790
 791         err = l2cap_sock_shutdown(sock, 2);
 792
 793         sock_orphan(sk);
 794         l2cap_sock_kill(sk);
 795         return err;
 796 }
 797
 798 static struct l2cap_chan *l2cap_sock_new_connection_cb(void *data)
 799 {
 800         struct sock *sk, *parent = data;
 801
 802         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
 803                                                                 GFP_ATOMIC);
 804         if (!sk)
 805                 return NULL;
 806
 807         l2cap_sock_init(sk, parent);
 808
 809         return l2cap_pi(sk)->chan;
 810 }
 811
 812 static int l2cap_sock_recv_cb(void *data, struct sk_buff *skb)
 813 {
 814         struct sock *sk = data;
 815
 816         return sock_queue_rcv_skb(sk, skb);
 817 }
 818
 819 static void l2cap_sock_close_cb(void *data)
 820 {
 821         struct sock *sk = data;
 822
 823         l2cap_sock_kill(sk);
 824 }
 825
 826 static void l2cap_sock_state_change_cb(void *data, int state)
 827 {
 828         struct sock *sk = data;
 829
 830         sk->sk_state = state;
 831 }
 832
 833 static struct l2cap_ops l2cap_chan_ops = {
 834         .name           = "L2CAP Socket Interface",
 835         .new_connection = l2cap_sock_new_connection_cb,
 836         .recv           = l2cap_sock_recv_cb,
 837         .close          = l2cap_sock_close_cb,
 838         .state_change   = l2cap_sock_state_change_cb,
 839 };
 840
 841 static void l2cap_sock_destruct(struct sock *sk)
 842 {
 843         BT_DBG("sk %p", sk);
 844
 845         skb_queue_purge(&sk->sk_receive_queue);
 846         skb_queue_purge(&sk->sk_write_queue);
 847 }
 848
 849 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
 850 {
 851         struct l2cap_pinfo *pi = l2cap_pi(sk);
 852         struct l2cap_chan *chan = pi->chan;
 853
 854         BT_DBG("sk %p", sk);
 855
 856         if (parent) {
 857                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
 858
 859                 sk->sk_type = parent->sk_type;
 860                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 861
 862                 chan->chan_type = pchan->chan_type;
 863                 chan->imtu = pchan->imtu;
 864                 chan->omtu = pchan->omtu;
 865                 chan->conf_state = pchan->conf_state;
 866                 chan->mode = pchan->mode;
 867                 chan->fcs  = pchan->fcs;
 868                 chan->max_tx = pchan->max_tx;
 869                 chan->tx_win = pchan->tx_win;
 870                 chan->sec_level = pchan->sec_level;
 871                 chan->role_switch = pchan->role_switch;
 872                 chan->force_reliable = pchan->force_reliable;
 873                 chan->flushable = pchan->flushable;
 874                 chan->force_active = pchan->force_active;
 875         } else {
 876
 877                 switch (sk->sk_type) {
 878                 case SOCK_RAW:
 879                         chan->chan_type = L2CAP_CHAN_RAW;
 880                         break;
 881                 case SOCK_DGRAM:
 882                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
 883                         break;
 884                 case SOCK_SEQPACKET:
 885                 case SOCK_STREAM:
 886                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
 887                         break;
 888                 }
 889
 890                 chan->imtu = L2CAP_DEFAULT_MTU;
 891                 chan->omtu = 0;
 892                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
 893                         chan->mode = L2CAP_MODE_ERTM;
 894                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 895                 } else {
 896                         chan->mode = L2CAP_MODE_BASIC;
 897                 }
 898                 chan->max_tx = L2CAP_DEFAULT_MAX_TX;
 899                 chan->fcs  = L2CAP_FCS_CRC16;
 900                 chan->tx_win = L2CAP_DEFAULT_TX_WINDOW;
 901                 chan->sec_level = BT_SECURITY_LOW;
 902                 chan->role_switch = 0;
 903                 chan->force_reliable = 0;
 904                 chan->flushable = BT_FLUSHABLE_OFF;
 905                 chan->force_active = BT_POWER_FORCE_ACTIVE_ON;
 906
 907         }
 908
 909         /* Default config options */
 910         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 911
 912         chan->data = sk;
 913         chan->ops = &l2cap_chan_ops;
 914 }
 915
 916 static struct proto l2cap_proto = {
 917         .name           = "L2CAP",
 918         .owner          = THIS_MODULE,
 919         .obj_size       = sizeof(struct l2cap_pinfo)
 920 };
 921
 922 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 923 {
 924         struct sock *sk;
 925         struct l2cap_chan *chan;
 926
 927         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 928         if (!sk)
 929                 return NULL;
 930
 931         sock_init_data(sock, sk);
 932         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 933
 934         sk->sk_destruct = l2cap_sock_destruct;
 935         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 936
 937         sock_reset_flag(sk, SOCK_ZAPPED);
 938
 939         sk->sk_protocol = proto;
 940         sk->sk_state = BT_OPEN;
 941
 942         chan = l2cap_chan_create(sk);
 943         if (!chan) {
 944                 l2cap_sock_kill(sk);
 945                 return NULL;
 946         }
 947
 948         l2cap_pi(sk)->chan = chan;
 949
 950         return sk;
 951 }
 952
 953 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
 954                              int kern)
 955 {
 956         struct sock *sk;
 957
 958         BT_DBG("sock %p", sock);
 959
 960         sock->state = SS_UNCONNECTED;
 961
 962         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
 963                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 964                 return -ESOCKTNOSUPPORT;
 965
 966         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
 967                 return -EPERM;
 968
 969         sock->ops = &l2cap_sock_ops;
 970
 971         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 972         if (!sk)
 973                 return -ENOMEM;
 974
 975         l2cap_sock_init(sk, NULL);
 976         return 0;
 977 }
 978
 979 static const struct proto_ops l2cap_sock_ops = {
 980         .family         = PF_BLUETOOTH,
 981         .owner          = THIS_MODULE,
 982         .release        = l2cap_sock_release,
 983         .bind           = l2cap_sock_bind,
 984         .connect        = l2cap_sock_connect,
 985         .listen         = l2cap_sock_listen,
 986         .accept         = l2cap_sock_accept,
 987         .getname        = l2cap_sock_getname,
 988         .sendmsg        = l2cap_sock_sendmsg,
 989         .recvmsg        = l2cap_sock_recvmsg,
 990         .poll           = bt_sock_poll,
 991         .ioctl          = bt_sock_ioctl,
 992         .mmap           = sock_no_mmap,
 993         .socketpair     = sock_no_socketpair,
 994         .shutdown       = l2cap_sock_shutdown,
 995         .setsockopt     = l2cap_sock_setsockopt,
 996         .getsockopt     = l2cap_sock_getsockopt
 997 };
 998
 999 static const struct net_proto_family l2cap_sock_family_ops = {
1000         .family = PF_BLUETOOTH,
1001         .owner  = THIS_MODULE,
1002         .create = l2cap_sock_create,
1003 };
1004
1005 int __init l2cap_init_sockets(void)
1006 {
1007         int err;
1008
1009         err = proto_register(&l2cap_proto, 0);
1010         if (err < 0)
1011                 return err;
1012
1013         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1014         if (err < 0)
1015                 goto error;
1016
1017         BT_INFO("L2CAP socket layer initialized");
1018
1019         return 0;
1020
1021 error:
1022         BT_ERR("L2CAP socket registration failed");
1023         proto_unregister(&l2cap_proto);
1024         return err;
1025 }
1026
1027 void l2cap_cleanup_sockets(void)
1028 {
1029         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
1030                 BT_ERR("L2CAP socket unregistration failed");
1031
1032         proto_unregister(&l2cap_proto);
1033 }