net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/export.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/l2cap.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 static struct bt_sock_list l2cap_sk_list = {
  38         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  39 };
  40
  41 static const struct proto_ops l2cap_sock_ops;
  42 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  43 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  44                                      int proto, gfp_t prio);
  45
  46 bool l2cap_is_socket(struct socket *sock)
  47 {
  48         return sock && sock->ops == &l2cap_sock_ops;
  49 }
  50 EXPORT_SYMBOL(l2cap_is_socket);
  51
  52 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  53 {
  54         struct sock *sk = sock->sk;
  55         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  56         struct sockaddr_l2 la;
  57         int len, err = 0;
  58
  59         BT_DBG("sk %p", sk);
  60
  61         if (!addr || addr->sa_family != AF_BLUETOOTH)
  62                 return -EINVAL;
  63
  64         memset(&la, 0, sizeof(la));
  65         len = min_t(unsigned int, sizeof(la), alen);
  66         memcpy(&la, addr, len);
  67
  68         if (la.l2_cid && la.l2_psm)
  69                 return -EINVAL;
  70
  71         lock_sock(sk);
  72
  73         if (sk->sk_state != BT_OPEN) {
  74                 err = -EBADFD;
  75                 goto done;
  76         }
  77
  78         if (la.l2_psm) {
  79                 __u16 psm = __le16_to_cpu(la.l2_psm);
  80
  81                 /* PSM must be odd and lsb of upper byte must be 0 */
  82                 if ((psm & 0x0101) != 0x0001) {
  83                         err = -EINVAL;
  84                         goto done;
  85                 }
  86
  87                 /* Restrict usage of well-known PSMs */
  88                 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
  89                         err = -EACCES;
  90                         goto done;
  91                 }
  92         }
  93
  94         if (la.l2_cid)
  95                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
  96         else
  97                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
  98
  99         if (err < 0)
 100                 goto done;
 101
 102         if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 103             __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 104                 chan->sec_level = BT_SECURITY_SDP;
 105
 106         bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 107
 108         chan->state = BT_BOUND;
 109         sk->sk_state = BT_BOUND;
 110
 111 done:
 112         release_sock(sk);
 113         return err;
 114 }
 115
 116 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 117                               int alen, int flags)
 118 {
 119         struct sock *sk = sock->sk;
 120         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 121         struct sockaddr_l2 la;
 122         int len, err = 0;
 123
 124         BT_DBG("sk %p", sk);
 125
 126         if (!addr || alen < sizeof(addr->sa_family) ||
 127             addr->sa_family != AF_BLUETOOTH)
 128                 return -EINVAL;
 129
 130         memset(&la, 0, sizeof(la));
 131         len = min_t(unsigned int, sizeof(la), alen);
 132         memcpy(&la, addr, len);
 133
 134         if (la.l2_cid && la.l2_psm)
 135                 return -EINVAL;
 136
 137         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 138                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 139         if (err)
 140                 return err;
 141
 142         lock_sock(sk);
 143
 144         err = bt_sock_wait_state(sk, BT_CONNECTED,
 145                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 146
 147         release_sock(sk);
 148
 149         return err;
 150 }
 151
 152 static int l2cap_sock_listen(struct socket *sock, int backlog)
 153 {
 154         struct sock *sk = sock->sk;
 155         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 156         int err = 0;
 157
 158         BT_DBG("sk %p backlog %d", sk, backlog);
 159
 160         lock_sock(sk);
 161
 162         if (sk->sk_state != BT_BOUND) {
 163                 err = -EBADFD;
 164                 goto done;
 165         }
 166
 167         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 168                 err = -EINVAL;
 169                 goto done;
 170         }
 171
 172         switch (chan->mode) {
 173         case L2CAP_MODE_BASIC:
 174                 break;
 175         case L2CAP_MODE_ERTM:
 176         case L2CAP_MODE_STREAMING:
 177                 if (!disable_ertm)
 178                         break;
 179                 /* fall through */
 180         default:
 181                 err = -ENOTSUPP;
 182                 goto done;
 183         }
 184
 185         sk->sk_max_ack_backlog = backlog;
 186         sk->sk_ack_backlog = 0;
 187
 188         chan->state = BT_LISTEN;
 189         sk->sk_state = BT_LISTEN;
 190
 191 done:
 192         release_sock(sk);
 193         return err;
 194 }
 195
 196 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 197                              int flags)
 198 {
 199         DECLARE_WAITQUEUE(wait, current);
 200         struct sock *sk = sock->sk, *nsk;
 201         long timeo;
 202         int err = 0;
 203
 204         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 205
 206         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 207
 208         BT_DBG("sk %p timeo %ld", sk, timeo);
 209
 210         /* Wait for an incoming connection. (wake-one). */
 211         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 212         while (1) {
 213                 set_current_state(TASK_INTERRUPTIBLE);
 214
 215                 if (sk->sk_state != BT_LISTEN) {
 216                         err = -EBADFD;
 217                         break;
 218                 }
 219
 220                 nsk = bt_accept_dequeue(sk, newsock);
 221                 if (nsk)
 222                         break;
 223
 224                 if (!timeo) {
 225                         err = -EAGAIN;
 226                         break;
 227                 }
 228
 229                 if (signal_pending(current)) {
 230                         err = sock_intr_errno(timeo);
 231                         break;
 232                 }
 233
 234                 release_sock(sk);
 235                 timeo = schedule_timeout(timeo);
 236                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 237         }
 238         __set_current_state(TASK_RUNNING);
 239         remove_wait_queue(sk_sleep(sk), &wait);
 240
 241         if (err)
 242                 goto done;
 243
 244         newsock->state = SS_CONNECTED;
 245
 246         BT_DBG("new socket %p", nsk);
 247
 248 done:
 249         release_sock(sk);
 250         return err;
 251 }
 252
 253 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 254                               int *len, int peer)
 255 {
 256         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 257         struct sock *sk = sock->sk;
 258         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 259
 260         BT_DBG("sock %p, sk %p", sock, sk);
 261
 262         memset(la, 0, sizeof(struct sockaddr_l2));
 263         addr->sa_family = AF_BLUETOOTH;
 264         *len = sizeof(struct sockaddr_l2);
 265
 266         if (peer) {
 267                 la->l2_psm = chan->psm;
 268                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
 269                 la->l2_cid = cpu_to_le16(chan->dcid);
 270         } else {
 271                 la->l2_psm = chan->sport;
 272                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
 273                 la->l2_cid = cpu_to_le16(chan->scid);
 274         }
 275
 276         return 0;
 277 }
 278
 279 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 280                                      char __user *optval, int __user *optlen)
 281 {
 282         struct sock *sk = sock->sk;
 283         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 284         struct l2cap_options opts;
 285         struct l2cap_conninfo cinfo;
 286         int len, err = 0;
 287         u32 opt;
 288
 289         BT_DBG("sk %p", sk);
 290
 291         if (get_user(len, optlen))
 292                 return -EFAULT;
 293
 294         lock_sock(sk);
 295
 296         switch (optname) {
 297         case L2CAP_OPTIONS:
 298                 memset(&opts, 0, sizeof(opts));
 299                 opts.imtu     = chan->imtu;
 300                 opts.omtu     = chan->omtu;
 301                 opts.flush_to = chan->flush_to;
 302                 opts.mode     = chan->mode;
 303                 opts.fcs      = chan->fcs;
 304                 opts.max_tx   = chan->max_tx;
 305                 opts.txwin_size = chan->tx_win;
 306
 307                 len = min_t(unsigned int, len, sizeof(opts));
 308                 if (copy_to_user(optval, (char *) &opts, len))
 309                         err = -EFAULT;
 310
 311                 break;
 312
 313         case L2CAP_LM:
 314                 switch (chan->sec_level) {
 315                 case BT_SECURITY_LOW:
 316                         opt = L2CAP_LM_AUTH;
 317                         break;
 318                 case BT_SECURITY_MEDIUM:
 319                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 320                         break;
 321                 case BT_SECURITY_HIGH:
 322                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 323                               L2CAP_LM_SECURE;
 324                         break;
 325                 default:
 326                         opt = 0;
 327                         break;
 328                 }
 329
 330                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 331                         opt |= L2CAP_LM_MASTER;
 332
 333                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 334                         opt |= L2CAP_LM_RELIABLE;
 335
 336                 if (put_user(opt, (u32 __user *) optval))
 337                         err = -EFAULT;
 338                 break;
 339
 340         case L2CAP_CONNINFO:
 341                 if (sk->sk_state != BT_CONNECTED &&
 342                     !(sk->sk_state == BT_CONNECT2 &&
 343                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 344                         err = -ENOTCONN;
 345                         break;
 346                 }
 347
 348                 memset(&cinfo, 0, sizeof(cinfo));
 349                 cinfo.hci_handle = chan->conn->hcon->handle;
 350                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 351
 352                 len = min_t(unsigned int, len, sizeof(cinfo));
 353                 if (copy_to_user(optval, (char *) &cinfo, len))
 354                         err = -EFAULT;
 355
 356                 break;
 357
 358         default:
 359                 err = -ENOPROTOOPT;
 360                 break;
 361         }
 362
 363         release_sock(sk);
 364         return err;
 365 }
 366
 367 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 368                                  char __user *optval, int __user *optlen)
 369 {
 370         struct sock *sk = sock->sk;
 371         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 372         struct bt_security sec;
 373         struct bt_power pwr;
 374         int len, err = 0;
 375
 376         BT_DBG("sk %p", sk);
 377
 378         if (level == SOL_L2CAP)
 379                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 380
 381         if (level != SOL_BLUETOOTH)
 382                 return -ENOPROTOOPT;
 383
 384         if (get_user(len, optlen))
 385                 return -EFAULT;
 386
 387         lock_sock(sk);
 388
 389         switch (optname) {
 390         case BT_SECURITY:
 391                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 392                     chan->chan_type != L2CAP_CHAN_RAW) {
 393                         err = -EINVAL;
 394                         break;
 395                 }
 396
 397                 memset(&sec, 0, sizeof(sec));
 398                 if (chan->conn) {
 399                         sec.level = chan->conn->hcon->sec_level;
 400
 401                         if (sk->sk_state == BT_CONNECTED)
 402                                 sec.key_size = chan->conn->hcon->enc_key_size;
 403                 } else {
 404                         sec.level = chan->sec_level;
 405                 }
 406
 407                 len = min_t(unsigned int, len, sizeof(sec));
 408                 if (copy_to_user(optval, (char *) &sec, len))
 409                         err = -EFAULT;
 410
 411                 break;
 412
 413         case BT_DEFER_SETUP:
 414                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 415                         err = -EINVAL;
 416                         break;
 417                 }
 418
 419                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 420                              (u32 __user *) optval))
 421                         err = -EFAULT;
 422
 423                 break;
 424
 425         case BT_FLUSHABLE:
 426                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 427                              (u32 __user *) optval))
 428                         err = -EFAULT;
 429
 430                 break;
 431
 432         case BT_POWER:
 433                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 434                     && sk->sk_type != SOCK_RAW) {
 435                         err = -EINVAL;
 436                         break;
 437                 }
 438
 439                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 440
 441                 len = min_t(unsigned int, len, sizeof(pwr));
 442                 if (copy_to_user(optval, (char *) &pwr, len))
 443                         err = -EFAULT;
 444
 445                 break;
 446
 447         case BT_CHANNEL_POLICY:
 448                 if (!enable_hs) {
 449                         err = -ENOPROTOOPT;
 450                         break;
 451                 }
 452
 453                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 454                         err = -EFAULT;
 455                 break;
 456
 457         default:
 458                 err = -ENOPROTOOPT;
 459                 break;
 460         }
 461
 462         release_sock(sk);
 463         return err;
 464 }
 465
 466 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 467 {
 468         switch (chan->scid) {
 469         case L2CAP_CID_ATT:
 470                 if (mtu < L2CAP_LE_MIN_MTU)
 471                         return false;
 472                 break;
 473
 474         default:
 475                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 476                         return false;
 477         }
 478
 479         return true;
 480 }
 481
 482 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 483                                      char __user *optval, unsigned int optlen)
 484 {
 485         struct sock *sk = sock->sk;
 486         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 487         struct l2cap_options opts;
 488         int len, err = 0;
 489         u32 opt;
 490
 491         BT_DBG("sk %p", sk);
 492
 493         lock_sock(sk);
 494
 495         switch (optname) {
 496         case L2CAP_OPTIONS:
 497                 if (sk->sk_state == BT_CONNECTED) {
 498                         err = -EINVAL;
 499                         break;
 500                 }
 501
 502                 opts.imtu     = chan->imtu;
 503                 opts.omtu     = chan->omtu;
 504                 opts.flush_to = chan->flush_to;
 505                 opts.mode     = chan->mode;
 506                 opts.fcs      = chan->fcs;
 507                 opts.max_tx   = chan->max_tx;
 508                 opts.txwin_size = chan->tx_win;
 509
 510                 len = min_t(unsigned int, sizeof(opts), optlen);
 511                 if (copy_from_user((char *) &opts, optval, len)) {
 512                         err = -EFAULT;
 513                         break;
 514                 }
 515
 516                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 517                         err = -EINVAL;
 518                         break;
 519                 }
 520
 521                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 522                         err = -EINVAL;
 523                         break;
 524                 }
 525
 526                 chan->mode = opts.mode;
 527                 switch (chan->mode) {
 528                 case L2CAP_MODE_BASIC:
 529                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 530                         break;
 531                 case L2CAP_MODE_ERTM:
 532                 case L2CAP_MODE_STREAMING:
 533                         if (!disable_ertm)
 534                                 break;
 535                         /* fall through */
 536                 default:
 537                         err = -EINVAL;
 538                         break;
 539                 }
 540
 541                 chan->imtu = opts.imtu;
 542                 chan->omtu = opts.omtu;
 543                 chan->fcs  = opts.fcs;
 544                 chan->max_tx = opts.max_tx;
 545                 chan->tx_win = opts.txwin_size;
 546                 chan->flush_to = opts.flush_to;
 547                 break;
 548
 549         case L2CAP_LM:
 550                 if (get_user(opt, (u32 __user *) optval)) {
 551                         err = -EFAULT;
 552                         break;
 553                 }
 554
 555                 if (opt & L2CAP_LM_AUTH)
 556                         chan->sec_level = BT_SECURITY_LOW;
 557                 if (opt & L2CAP_LM_ENCRYPT)
 558                         chan->sec_level = BT_SECURITY_MEDIUM;
 559                 if (opt & L2CAP_LM_SECURE)
 560                         chan->sec_level = BT_SECURITY_HIGH;
 561
 562                 if (opt & L2CAP_LM_MASTER)
 563                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 564                 else
 565                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 566
 567                 if (opt & L2CAP_LM_RELIABLE)
 568                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 569                 else
 570                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 571                 break;
 572
 573         default:
 574                 err = -ENOPROTOOPT;
 575                 break;
 576         }
 577
 578         release_sock(sk);
 579         return err;
 580 }
 581
 582 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 583                                  char __user *optval, unsigned int optlen)
 584 {
 585         struct sock *sk = sock->sk;
 586         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 587         struct bt_security sec;
 588         struct bt_power pwr;
 589         struct l2cap_conn *conn;
 590         int len, err = 0;
 591         u32 opt;
 592
 593         BT_DBG("sk %p", sk);
 594
 595         if (level == SOL_L2CAP)
 596                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 597
 598         if (level != SOL_BLUETOOTH)
 599                 return -ENOPROTOOPT;
 600
 601         lock_sock(sk);
 602
 603         switch (optname) {
 604         case BT_SECURITY:
 605                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 606                     chan->chan_type != L2CAP_CHAN_RAW) {
 607                         err = -EINVAL;
 608                         break;
 609                 }
 610
 611                 sec.level = BT_SECURITY_LOW;
 612
 613                 len = min_t(unsigned int, sizeof(sec), optlen);
 614                 if (copy_from_user((char *) &sec, optval, len)) {
 615                         err = -EFAULT;
 616                         break;
 617                 }
 618
 619                 if (sec.level < BT_SECURITY_LOW ||
 620                     sec.level > BT_SECURITY_HIGH) {
 621                         err = -EINVAL;
 622                         break;
 623                 }
 624
 625                 chan->sec_level = sec.level;
 626
 627                 if (!chan->conn)
 628                         break;
 629
 630                 conn = chan->conn;
 631
 632                 /*change security for LE channels */
 633                 if (chan->scid == L2CAP_CID_ATT) {
 634                         if (!conn->hcon->out) {
 635                                 err = -EINVAL;
 636                                 break;
 637                         }
 638
 639                         if (smp_conn_security(conn->hcon, sec.level))
 640                                 break;
 641                         sk->sk_state = BT_CONFIG;
 642                         chan->state = BT_CONFIG;
 643
 644                 /* or for ACL link */
 645                 } else if ((sk->sk_state == BT_CONNECT2 &&
 646                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 647                            sk->sk_state == BT_CONNECTED) {
 648                         if (!l2cap_chan_check_security(chan))
 649                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 650                         else
 651                                 sk->sk_state_change(sk);
 652                 } else {
 653                         err = -EINVAL;
 654                 }
 655                 break;
 656
 657         case BT_DEFER_SETUP:
 658                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 659                         err = -EINVAL;
 660                         break;
 661                 }
 662
 663                 if (get_user(opt, (u32 __user *) optval)) {
 664                         err = -EFAULT;
 665                         break;
 666                 }
 667
 668                 if (opt)
 669                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 670                 else
 671                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 672                 break;
 673
 674         case BT_FLUSHABLE:
 675                 if (get_user(opt, (u32 __user *) optval)) {
 676                         err = -EFAULT;
 677                         break;
 678                 }
 679
 680                 if (opt > BT_FLUSHABLE_ON) {
 681                         err = -EINVAL;
 682                         break;
 683                 }
 684
 685                 if (opt == BT_FLUSHABLE_OFF) {
 686                         struct l2cap_conn *conn = chan->conn;
 687                         /* proceed further only when we have l2cap_conn and
 688                            No Flush support in the LM */
 689                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 690                                 err = -EINVAL;
 691                                 break;
 692                         }
 693                 }
 694
 695                 if (opt)
 696                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 697                 else
 698                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 699                 break;
 700
 701         case BT_POWER:
 702                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 703                     chan->chan_type != L2CAP_CHAN_RAW) {
 704                         err = -EINVAL;
 705                         break;
 706                 }
 707
 708                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 709
 710                 len = min_t(unsigned int, sizeof(pwr), optlen);
 711                 if (copy_from_user((char *) &pwr, optval, len)) {
 712                         err = -EFAULT;
 713                         break;
 714                 }
 715
 716                 if (pwr.force_active)
 717                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 718                 else
 719                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 720                 break;
 721
 722         case BT_CHANNEL_POLICY:
 723                 if (!enable_hs) {
 724                         err = -ENOPROTOOPT;
 725                         break;
 726                 }
 727
 728                 if (get_user(opt, (u32 __user *) optval)) {
 729                         err = -EFAULT;
 730                         break;
 731                 }
 732
 733                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 734                         err = -EINVAL;
 735                         break;
 736                 }
 737
 738                 if (chan->mode != L2CAP_MODE_ERTM &&
 739                     chan->mode != L2CAP_MODE_STREAMING) {
 740                         err = -EOPNOTSUPP;
 741                         break;
 742                 }
 743
 744                 chan->chan_policy = (u8) opt;
 745
 746                 if (sk->sk_state == BT_CONNECTED &&
 747                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 748                         l2cap_move_start(chan);
 749
 750                 break;
 751
 752         default:
 753                 err = -ENOPROTOOPT;
 754                 break;
 755         }
 756
 757         release_sock(sk);
 758         return err;
 759 }
 760
 761 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 762                               struct msghdr *msg, size_t len)
 763 {
 764         struct sock *sk = sock->sk;
 765         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 766         int err;
 767
 768         BT_DBG("sock %p, sk %p", sock, sk);
 769
 770         err = sock_error(sk);
 771         if (err)
 772                 return err;
 773
 774         if (msg->msg_flags & MSG_OOB)
 775                 return -EOPNOTSUPP;
 776
 777         if (sk->sk_state != BT_CONNECTED)
 778                 return -ENOTCONN;
 779
 780         lock_sock(sk);
 781         err = bt_sock_wait_ready(sk, msg->msg_flags);
 782         release_sock(sk);
 783         if (err)
 784                 return err;
 785
 786         l2cap_chan_lock(chan);
 787         err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
 788         l2cap_chan_unlock(chan);
 789
 790         return err;
 791 }
 792
 793 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 794                               struct msghdr *msg, size_t len, int flags)
 795 {
 796         struct sock *sk = sock->sk;
 797         struct l2cap_pinfo *pi = l2cap_pi(sk);
 798         int err;
 799
 800         lock_sock(sk);
 801
 802         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 803                                                     &bt_sk(sk)->flags)) {
 804                 sk->sk_state = BT_CONFIG;
 805                 pi->chan->state = BT_CONFIG;
 806
 807                 __l2cap_connect_rsp_defer(pi->chan);
 808                 release_sock(sk);
 809                 return 0;
 810         }
 811
 812         release_sock(sk);
 813
 814         if (sock->type == SOCK_STREAM)
 815                 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
 816         else
 817                 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
 818
 819         if (pi->chan->mode != L2CAP_MODE_ERTM)
 820                 return err;
 821
 822         /* Attempt to put pending rx data in the socket buffer */
 823
 824         lock_sock(sk);
 825
 826         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
 827                 goto done;
 828
 829         if (pi->rx_busy_skb) {
 830                 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
 831                         pi->rx_busy_skb = NULL;
 832                 else
 833                         goto done;
 834         }
 835
 836         /* Restore data flow when half of the receive buffer is
 837          * available.  This avoids resending large numbers of
 838          * frames.
 839          */
 840         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
 841                 l2cap_chan_busy(pi->chan, 0);
 842
 843 done:
 844         release_sock(sk);
 845         return err;
 846 }
 847
 848 /* Kill socket (only if zapped and orphan)
 849  * Must be called on unlocked socket.
 850  */
 851 static void l2cap_sock_kill(struct sock *sk)
 852 {
 853         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 854                 return;
 855
 856         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
 857
 858         /* Kill poor orphan */
 859
 860         l2cap_chan_put(l2cap_pi(sk)->chan);
 861         sock_set_flag(sk, SOCK_DEAD);
 862         sock_put(sk);
 863 }
 864
 865 static int l2cap_sock_shutdown(struct socket *sock, int how)
 866 {
 867         struct sock *sk = sock->sk;
 868         struct l2cap_chan *chan;
 869         struct l2cap_conn *conn;
 870         int err = 0;
 871
 872         BT_DBG("sock %p, sk %p", sock, sk);
 873
 874         if (!sk)
 875                 return 0;
 876
 877         chan = l2cap_pi(sk)->chan;
 878         conn = chan->conn;
 879
 880         if (conn)
 881                 mutex_lock(&conn->chan_lock);
 882
 883         l2cap_chan_lock(chan);
 884         lock_sock(sk);
 885
 886         if (!sk->sk_shutdown) {
 887                 if (chan->mode == L2CAP_MODE_ERTM)
 888                         err = __l2cap_wait_ack(sk);
 889
 890                 sk->sk_shutdown = SHUTDOWN_MASK;
 891
 892                 release_sock(sk);
 893                 l2cap_chan_close(chan, 0);
 894                 lock_sock(sk);
 895
 896                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 897                         err = bt_sock_wait_state(sk, BT_CLOSED,
 898                                                  sk->sk_lingertime);
 899         }
 900
 901         if (!err && sk->sk_err)
 902                 err = -sk->sk_err;
 903
 904         release_sock(sk);
 905         l2cap_chan_unlock(chan);
 906
 907         if (conn)
 908                 mutex_unlock(&conn->chan_lock);
 909
 910         return err;
 911 }
 912
 913 static int l2cap_sock_release(struct socket *sock)
 914 {
 915         struct sock *sk = sock->sk;
 916         int err;
 917
 918         BT_DBG("sock %p, sk %p", sock, sk);
 919
 920         if (!sk)
 921                 return 0;
 922
 923         bt_sock_unlink(&l2cap_sk_list, sk);
 924
 925         err = l2cap_sock_shutdown(sock, 2);
 926
 927         sock_orphan(sk);
 928         l2cap_sock_kill(sk);
 929         return err;
 930 }
 931
 932 static void l2cap_sock_cleanup_listen(struct sock *parent)
 933 {
 934         struct sock *sk;
 935
 936         BT_DBG("parent %p", parent);
 937
 938         /* Close not yet accepted channels */
 939         while ((sk = bt_accept_dequeue(parent, NULL))) {
 940                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 941
 942                 l2cap_chan_lock(chan);
 943                 __clear_chan_timer(chan);
 944                 l2cap_chan_close(chan, ECONNRESET);
 945                 l2cap_chan_unlock(chan);
 946
 947                 l2cap_sock_kill(sk);
 948         }
 949 }
 950
 951 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
 952 {
 953         struct sock *sk, *parent = chan->data;
 954
 955         /* Check for backlog size */
 956         if (sk_acceptq_is_full(parent)) {
 957                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 958                 return NULL;
 959         }
 960
 961         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
 962                               GFP_ATOMIC);
 963         if (!sk)
 964                 return NULL;
 965
 966         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
 967
 968         l2cap_sock_init(sk, parent);
 969
 970         bt_accept_enqueue(parent, sk);
 971
 972         return l2cap_pi(sk)->chan;
 973 }
 974
 975 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 976 {
 977         int err;
 978         struct sock *sk = chan->data;
 979         struct l2cap_pinfo *pi = l2cap_pi(sk);
 980
 981         lock_sock(sk);
 982
 983         if (pi->rx_busy_skb) {
 984                 err = -ENOMEM;
 985                 goto done;
 986         }
 987
 988         err = sock_queue_rcv_skb(sk, skb);
 989
 990         /* For ERTM, handle one skb that doesn't fit into the recv
 991          * buffer.  This is important to do because the data frames
 992          * have already been acked, so the skb cannot be discarded.
 993          *
 994          * Notify the l2cap core that the buffer is full, so the
 995          * LOCAL_BUSY state is entered and no more frames are
 996          * acked and reassembled until there is buffer space
 997          * available.
 998          */
 999         if (err < 0 && pi->chan->mode == L2CAP_MODE_ERTM) {
1000                 pi->rx_busy_skb = skb;
1001                 l2cap_chan_busy(pi->chan, 1);
1002                 err = 0;
1003         }
1004
1005 done:
1006         release_sock(sk);
1007
1008         return err;
1009 }
1010
1011 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1012 {
1013         struct sock *sk = chan->data;
1014
1015         l2cap_sock_kill(sk);
1016 }
1017
1018 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1019 {
1020         struct sock *sk = chan->data;
1021         struct sock *parent;
1022
1023         lock_sock(sk);
1024
1025         parent = bt_sk(sk)->parent;
1026
1027         sock_set_flag(sk, SOCK_ZAPPED);
1028
1029         switch (chan->state) {
1030         case BT_OPEN:
1031         case BT_BOUND:
1032         case BT_CLOSED:
1033                 break;
1034         case BT_LISTEN:
1035                 l2cap_sock_cleanup_listen(sk);
1036                 sk->sk_state = BT_CLOSED;
1037                 chan->state = BT_CLOSED;
1038
1039                 break;
1040         default:
1041                 sk->sk_state = BT_CLOSED;
1042                 chan->state = BT_CLOSED;
1043
1044                 sk->sk_err = err;
1045
1046                 if (parent) {
1047                         bt_accept_unlink(sk);
1048                         parent->sk_data_ready(parent, 0);
1049                 } else {
1050                         sk->sk_state_change(sk);
1051                 }
1052
1053                 break;
1054         }
1055
1056         release_sock(sk);
1057 }
1058
1059 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state)
1060 {
1061         struct sock *sk = chan->data;
1062
1063         sk->sk_state = state;
1064 }
1065
1066 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1067                                                unsigned long len, int nb)
1068 {
1069         struct sk_buff *skb;
1070         int err;
1071
1072         l2cap_chan_unlock(chan);
1073         skb = bt_skb_send_alloc(chan->sk, len, nb, &err);
1074         l2cap_chan_lock(chan);
1075
1076         if (!skb)
1077                 return ERR_PTR(err);
1078
1079         return skb;
1080 }
1081
1082 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1083 {
1084         struct sock *sk = chan->data;
1085         struct sock *parent;
1086
1087         lock_sock(sk);
1088
1089         parent = bt_sk(sk)->parent;
1090
1091         BT_DBG("sk %p, parent %p", sk, parent);
1092
1093         sk->sk_state = BT_CONNECTED;
1094         sk->sk_state_change(sk);
1095
1096         if (parent)
1097                 parent->sk_data_ready(parent, 0);
1098
1099         release_sock(sk);
1100 }
1101
1102 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1103 {
1104         struct sock *sk = chan->data;
1105         struct sock *parent = bt_sk(sk)->parent;
1106
1107         if (parent)
1108                 parent->sk_data_ready(parent, 0);
1109 }
1110
1111 static struct l2cap_ops l2cap_chan_ops = {
1112         .name           = "L2CAP Socket Interface",
1113         .new_connection = l2cap_sock_new_connection_cb,
1114         .recv           = l2cap_sock_recv_cb,
1115         .close          = l2cap_sock_close_cb,
1116         .teardown       = l2cap_sock_teardown_cb,
1117         .state_change   = l2cap_sock_state_change_cb,
1118         .ready          = l2cap_sock_ready_cb,
1119         .defer          = l2cap_sock_defer_cb,
1120         .alloc_skb      = l2cap_sock_alloc_skb_cb,
1121 };
1122
1123 static void l2cap_sock_destruct(struct sock *sk)
1124 {
1125         BT_DBG("sk %p", sk);
1126
1127         if (l2cap_pi(sk)->chan)
1128                 l2cap_chan_put(l2cap_pi(sk)->chan);
1129         if (l2cap_pi(sk)->rx_busy_skb) {
1130                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1131                 l2cap_pi(sk)->rx_busy_skb = NULL;
1132         }
1133
1134         skb_queue_purge(&sk->sk_receive_queue);
1135         skb_queue_purge(&sk->sk_write_queue);
1136 }
1137
1138 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1139 {
1140         struct l2cap_pinfo *pi = l2cap_pi(sk);
1141         struct l2cap_chan *chan = pi->chan;
1142
1143         BT_DBG("sk %p", sk);
1144
1145         if (parent) {
1146                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1147
1148                 sk->sk_type = parent->sk_type;
1149                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1150
1151                 chan->chan_type = pchan->chan_type;
1152                 chan->imtu = pchan->imtu;
1153                 chan->omtu = pchan->omtu;
1154                 chan->conf_state = pchan->conf_state;
1155                 chan->mode = pchan->mode;
1156                 chan->fcs  = pchan->fcs;
1157                 chan->max_tx = pchan->max_tx;
1158                 chan->tx_win = pchan->tx_win;
1159                 chan->tx_win_max = pchan->tx_win_max;
1160                 chan->sec_level = pchan->sec_level;
1161                 chan->flags = pchan->flags;
1162
1163                 security_sk_clone(parent, sk);
1164         } else {
1165
1166                 switch (sk->sk_type) {
1167                 case SOCK_RAW:
1168                         chan->chan_type = L2CAP_CHAN_RAW;
1169                         break;
1170                 case SOCK_DGRAM:
1171                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1172                         break;
1173                 case SOCK_SEQPACKET:
1174                 case SOCK_STREAM:
1175                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1176                         break;
1177                 }
1178
1179                 chan->imtu = L2CAP_DEFAULT_MTU;
1180                 chan->omtu = 0;
1181                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1182                         chan->mode = L2CAP_MODE_ERTM;
1183                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1184                 } else {
1185                         chan->mode = L2CAP_MODE_BASIC;
1186                 }
1187
1188                 l2cap_chan_set_defaults(chan);
1189         }
1190
1191         /* Default config options */
1192         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1193
1194         chan->data = sk;
1195         chan->ops = &l2cap_chan_ops;
1196 }
1197
1198 static struct proto l2cap_proto = {
1199         .name           = "L2CAP",
1200         .owner          = THIS_MODULE,
1201         .obj_size       = sizeof(struct l2cap_pinfo)
1202 };
1203
1204 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1205                                      int proto, gfp_t prio)
1206 {
1207         struct sock *sk;
1208         struct l2cap_chan *chan;
1209
1210         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1211         if (!sk)
1212                 return NULL;
1213
1214         sock_init_data(sock, sk);
1215         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1216
1217         sk->sk_destruct = l2cap_sock_destruct;
1218         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1219
1220         sock_reset_flag(sk, SOCK_ZAPPED);
1221
1222         sk->sk_protocol = proto;
1223         sk->sk_state = BT_OPEN;
1224
1225         chan = l2cap_chan_create();
1226         if (!chan) {
1227                 sk_free(sk);
1228                 return NULL;
1229         }
1230
1231         l2cap_chan_hold(chan);
1232
1233         chan->sk = sk;
1234
1235         l2cap_pi(sk)->chan = chan;
1236
1237         return sk;
1238 }
1239
1240 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1241                              int kern)
1242 {
1243         struct sock *sk;
1244
1245         BT_DBG("sock %p", sock);
1246
1247         sock->state = SS_UNCONNECTED;
1248
1249         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1250             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1251                 return -ESOCKTNOSUPPORT;
1252
1253         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1254                 return -EPERM;
1255
1256         sock->ops = &l2cap_sock_ops;
1257
1258         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1259         if (!sk)
1260                 return -ENOMEM;
1261
1262         l2cap_sock_init(sk, NULL);
1263         bt_sock_link(&l2cap_sk_list, sk);
1264         return 0;
1265 }
1266
1267 static const struct proto_ops l2cap_sock_ops = {
1268         .family         = PF_BLUETOOTH,
1269         .owner          = THIS_MODULE,
1270         .release        = l2cap_sock_release,
1271         .bind           = l2cap_sock_bind,
1272         .connect        = l2cap_sock_connect,
1273         .listen         = l2cap_sock_listen,
1274         .accept         = l2cap_sock_accept,
1275         .getname        = l2cap_sock_getname,
1276         .sendmsg        = l2cap_sock_sendmsg,
1277         .recvmsg        = l2cap_sock_recvmsg,
1278         .poll           = bt_sock_poll,
1279         .ioctl          = bt_sock_ioctl,
1280         .mmap           = sock_no_mmap,
1281         .socketpair     = sock_no_socketpair,
1282         .shutdown       = l2cap_sock_shutdown,
1283         .setsockopt     = l2cap_sock_setsockopt,
1284         .getsockopt     = l2cap_sock_getsockopt
1285 };
1286
1287 static const struct net_proto_family l2cap_sock_family_ops = {
1288         .family = PF_BLUETOOTH,
1289         .owner  = THIS_MODULE,
1290         .create = l2cap_sock_create,
1291 };
1292
1293 int __init l2cap_init_sockets(void)
1294 {
1295         int err;
1296
1297         err = proto_register(&l2cap_proto, 0);
1298         if (err < 0)
1299                 return err;
1300
1301         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1302         if (err < 0) {
1303                 BT_ERR("L2CAP socket registration failed");
1304                 goto error;
1305         }
1306
1307         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1308                              NULL);
1309         if (err < 0) {
1310                 BT_ERR("Failed to create L2CAP proc file");
1311                 bt_sock_unregister(BTPROTO_L2CAP);
1312                 goto error;
1313         }
1314
1315         BT_INFO("L2CAP socket layer initialized");
1316
1317         return 0;
1318
1319 error:
1320         proto_unregister(&l2cap_proto);
1321         return err;
1322 }
1323
1324 void l2cap_cleanup_sockets(void)
1325 {
1326         bt_procfs_cleanup(&init_net, "l2cap");
1327         bt_sock_unregister(BTPROTO_L2CAP);
1328         proto_unregister(&l2cap_proto);
1329 }