l2cap_sock.c 26.5 KB
Newer Older
1 2 3 4 5
/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   Copyright (C) 2010 Google Inc.
6
   Copyright (C) 2011 ProFUSION Embedded Systems
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth L2CAP sockets. */

30
#include <linux/export.h>
31

32
#include <net/bluetooth/bluetooth.h>
33
#include <net/bluetooth/hci_core.h>
34
#include <net/bluetooth/l2cap.h>
35
#include <net/bluetooth/smp.h>
36

37 38 39 40
static struct bt_sock_list l2cap_sk_list = {
	.lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
};

41
static const struct proto_ops l2cap_sock_ops;
42 43
static void l2cap_sock_init(struct sock *sk, struct sock *parent);
static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
44

45 46 47
static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
{
	struct sock *sk = sock->sk;
48
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
49 50 51 52 53 54 55 56 57 58 59 60
	struct sockaddr_l2 la;
	int len, err = 0;

	BT_DBG("sk %p", sk);

	if (!addr || addr->sa_family != AF_BLUETOOTH)
		return -EINVAL;

	memset(&la, 0, sizeof(la));
	len = min_t(unsigned int, sizeof(la), alen);
	memcpy(&la, addr, len);

61
	if (la.l2_cid && la.l2_psm)
62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86
		return -EINVAL;

	lock_sock(sk);

	if (sk->sk_state != BT_OPEN) {
		err = -EBADFD;
		goto done;
	}

	if (la.l2_psm) {
		__u16 psm = __le16_to_cpu(la.l2_psm);

		/* PSM must be odd and lsb of upper byte must be 0 */
		if ((psm & 0x0101) != 0x0001) {
			err = -EINVAL;
			goto done;
		}

		/* Restrict usage of well-known PSMs */
		if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
			err = -EACCES;
			goto done;
		}
	}

87
	if (la.l2_cid)
S
Santosh Nayak 已提交
88
		err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
89 90
	else
		err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
91

92 93
	if (err < 0)
		goto done;
94

95 96
	if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
	    __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
97
		chan->sec_level = BT_SECURITY_SDP;
98

99
	bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
100 101

	chan->state = BT_BOUND;
102
	sk->sk_state = BT_BOUND;
103 104 105 106 107 108

done:
	release_sock(sk);
	return err;
}

109 110 111
static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
{
	struct sock *sk = sock->sk;
112
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
113 114 115 116 117 118 119 120 121 122 123 124 125
	struct sockaddr_l2 la;
	int len, err = 0;

	BT_DBG("sk %p", sk);

	if (!addr || alen < sizeof(addr->sa_family) ||
	    addr->sa_family != AF_BLUETOOTH)
		return -EINVAL;

	memset(&la, 0, sizeof(la));
	len = min_t(unsigned int, sizeof(la), alen);
	memcpy(&la, addr, len);

126
	if (la.l2_cid && la.l2_psm)
127 128
		return -EINVAL;

S
Santosh Nayak 已提交
129
	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
130
				 &la.l2_bdaddr, la.l2_bdaddr_type);
131
	if (err)
132
		return err;
133

134 135
	lock_sock(sk);

136 137
	err = bt_sock_wait_state(sk, BT_CONNECTED,
			sock_sndtimeo(sk, flags & O_NONBLOCK));
138 139 140

	release_sock(sk);

141 142 143
	return err;
}

144 145 146
static int l2cap_sock_listen(struct socket *sock, int backlog)
{
	struct sock *sk = sock->sk;
147
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
148 149 150 151 152 153
	int err = 0;

	BT_DBG("sk %p backlog %d", sk, backlog);

	lock_sock(sk);

154
	if (sk->sk_state != BT_BOUND) {
155 156 157 158
		err = -EBADFD;
		goto done;
	}

159 160 161 162 163
	if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
		err = -EINVAL;
		goto done;
	}

164
	switch (chan->mode) {
165 166 167 168 169 170 171 172 173 174 175 176 177 178
	case L2CAP_MODE_BASIC:
		break;
	case L2CAP_MODE_ERTM:
	case L2CAP_MODE_STREAMING:
		if (!disable_ertm)
			break;
		/* fall through */
	default:
		err = -ENOTSUPP;
		goto done;
	}

	sk->sk_max_ack_backlog = backlog;
	sk->sk_ack_backlog = 0;
179 180

	chan->state = BT_LISTEN;
181 182 183 184 185 186 187
	sk->sk_state = BT_LISTEN;

done:
	release_sock(sk);
	return err;
}

188 189 190 191 192 193 194 195 196 197 198 199 200 201 202
static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
{
	DECLARE_WAITQUEUE(wait, current);
	struct sock *sk = sock->sk, *nsk;
	long timeo;
	int err = 0;

	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);

	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);

	BT_DBG("sk %p timeo %ld", sk, timeo);

	/* Wait for an incoming connection. (wake-one). */
	add_wait_queue_exclusive(sk_sleep(sk), &wait);
203
	while (1) {
204
		set_current_state(TASK_INTERRUPTIBLE);
205 206 207

		if (sk->sk_state != BT_LISTEN) {
			err = -EBADFD;
208 209 210
			break;
		}

211 212 213
		nsk = bt_accept_dequeue(sk, newsock);
		if (nsk)
			break;
214

215 216
		if (!timeo) {
			err = -EAGAIN;
217 218 219 220 221 222 223
			break;
		}

		if (signal_pending(current)) {
			err = sock_intr_errno(timeo);
			break;
		}
224 225 226 227

		release_sock(sk);
		timeo = schedule_timeout(timeo);
		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
228
	}
229
	__set_current_state(TASK_RUNNING);
230 231 232 233 234 235 236 237 238 239 240 241 242 243
	remove_wait_queue(sk_sleep(sk), &wait);

	if (err)
		goto done;

	newsock->state = SS_CONNECTED;

	BT_DBG("new socket %p", nsk);

done:
	release_sock(sk);
	return err;
}

244 245 246 247
static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
{
	struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
	struct sock *sk = sock->sk;
248
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
249 250 251 252 253 254 255

	BT_DBG("sock %p, sk %p", sock, sk);

	addr->sa_family = AF_BLUETOOTH;
	*len = sizeof(struct sockaddr_l2);

	if (peer) {
256
		la->l2_psm = chan->psm;
257
		bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
258
		la->l2_cid = cpu_to_le16(chan->dcid);
259
	} else {
260
		la->l2_psm = chan->sport;
261
		bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
262
		la->l2_cid = cpu_to_le16(chan->scid);
263 264 265 266 267
	}

	return 0;
}

268 269 270
static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
{
	struct sock *sk = sock->sk;
271
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
272 273 274 275 276 277 278 279 280 281 282 283 284 285
	struct l2cap_options opts;
	struct l2cap_conninfo cinfo;
	int len, err = 0;
	u32 opt;

	BT_DBG("sk %p", sk);

	if (get_user(len, optlen))
		return -EFAULT;

	lock_sock(sk);

	switch (optname) {
	case L2CAP_OPTIONS:
286
		memset(&opts, 0, sizeof(opts));
287 288 289 290
		opts.imtu     = chan->imtu;
		opts.omtu     = chan->omtu;
		opts.flush_to = chan->flush_to;
		opts.mode     = chan->mode;
291 292
		opts.fcs      = chan->fcs;
		opts.max_tx   = chan->max_tx;
293
		opts.txwin_size = chan->tx_win;
294 295 296 297 298 299 300 301

		len = min_t(unsigned int, len, sizeof(opts));
		if (copy_to_user(optval, (char *) &opts, len))
			err = -EFAULT;

		break;

	case L2CAP_LM:
302
		switch (chan->sec_level) {
303 304 305 306 307 308 309 310 311 312 313 314 315 316 317
		case BT_SECURITY_LOW:
			opt = L2CAP_LM_AUTH;
			break;
		case BT_SECURITY_MEDIUM:
			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
			break;
		case BT_SECURITY_HIGH:
			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
							L2CAP_LM_SECURE;
			break;
		default:
			opt = 0;
			break;
		}

318
		if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
319 320
			opt |= L2CAP_LM_MASTER;

321
		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
322 323 324 325 326 327 328 329
			opt |= L2CAP_LM_RELIABLE;

		if (put_user(opt, (u32 __user *) optval))
			err = -EFAULT;
		break;

	case L2CAP_CONNINFO:
		if (sk->sk_state != BT_CONNECTED &&
330 331
		    !(sk->sk_state == BT_CONNECT2 &&
		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
332 333 334 335
			err = -ENOTCONN;
			break;
		}

336
		memset(&cinfo, 0, sizeof(cinfo));
337 338
		cinfo.hci_handle = chan->conn->hcon->handle;
		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357

		len = min_t(unsigned int, len, sizeof(cinfo));
		if (copy_to_user(optval, (char *) &cinfo, len))
			err = -EFAULT;

		break;

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
{
	struct sock *sk = sock->sk;
358
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
359
	struct bt_security sec;
360
	struct bt_power pwr;
361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377
	int len, err = 0;

	BT_DBG("sk %p", sk);

	if (level == SOL_L2CAP)
		return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);

	if (level != SOL_BLUETOOTH)
		return -ENOPROTOOPT;

	if (get_user(len, optlen))
		return -EFAULT;

	lock_sock(sk);

	switch (optname) {
	case BT_SECURITY:
378 379
		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
					chan->chan_type != L2CAP_CHAN_RAW) {
380 381 382 383
			err = -EINVAL;
			break;
		}

384
		memset(&sec, 0, sizeof(sec));
385
		if (chan->conn) {
386
			sec.level = chan->conn->hcon->sec_level;
387

388 389 390 391 392
			if (sk->sk_state == BT_CONNECTED)
				sec.key_size = chan->conn->hcon->enc_key_size;
		} else {
			sec.level = chan->sec_level;
		}
393

394 395 396 397 398 399 400 401 402 403 404 405
		len = min_t(unsigned int, len, sizeof(sec));
		if (copy_to_user(optval, (char *) &sec, len))
			err = -EFAULT;

		break;

	case BT_DEFER_SETUP:
		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
			err = -EINVAL;
			break;
		}

406 407
		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
			     (u32 __user *) optval))
408 409 410 411 412
			err = -EFAULT;

		break;

	case BT_FLUSHABLE:
413 414
		if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
						(u32 __user *) optval))
415 416 417 418
			err = -EFAULT;

		break;

419 420 421 422 423 424 425
	case BT_POWER:
		if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
				&& sk->sk_type != SOCK_RAW) {
			err = -EINVAL;
			break;
		}

426
		pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
427 428 429 430 431 432 433

		len = min_t(unsigned int, len, sizeof(pwr));
		if (copy_to_user(optval, (char *) &pwr, len))
			err = -EFAULT;

		break;

434 435 436 437 438 439 440 441 442 443
	case BT_CHANNEL_POLICY:
		if (!enable_hs) {
			err = -ENOPROTOOPT;
			break;
		}

		if (put_user(chan->chan_policy, (u32 __user *) optval))
			err = -EFAULT;
		break;

444 445 446 447 448 449 450 451 452
	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

453 454 455 456
static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
{
	switch (chan->scid) {
	case L2CAP_CID_LE_DATA:
457
		if (mtu < L2CAP_LE_MIN_MTU)
458 459 460 461 462 463 464 465 466 467 468
			return false;
		break;

	default:
		if (mtu < L2CAP_DEFAULT_MIN_MTU)
			return false;
	}

	return true;
}

469 470 471
static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
{
	struct sock *sk = sock->sk;
472
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
473 474 475 476 477 478 479 480 481 482 483 484 485 486 487
	struct l2cap_options opts;
	int len, err = 0;
	u32 opt;

	BT_DBG("sk %p", sk);

	lock_sock(sk);

	switch (optname) {
	case L2CAP_OPTIONS:
		if (sk->sk_state == BT_CONNECTED) {
			err = -EINVAL;
			break;
		}

488 489 490 491
		opts.imtu     = chan->imtu;
		opts.omtu     = chan->omtu;
		opts.flush_to = chan->flush_to;
		opts.mode     = chan->mode;
492 493
		opts.fcs      = chan->fcs;
		opts.max_tx   = chan->max_tx;
494
		opts.txwin_size = chan->tx_win;
495 496 497 498 499 500 501

		len = min_t(unsigned int, sizeof(opts), optlen);
		if (copy_from_user((char *) &opts, optval, len)) {
			err = -EFAULT;
			break;
		}

502
		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
503 504 505 506
			err = -EINVAL;
			break;
		}

507 508 509 510 511
		if (!l2cap_valid_mtu(chan, opts.imtu)) {
			err = -EINVAL;
			break;
		}

512 513
		chan->mode = opts.mode;
		switch (chan->mode) {
514
		case L2CAP_MODE_BASIC:
515
			clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
516 517 518 519 520 521 522 523 524 525 526
			break;
		case L2CAP_MODE_ERTM:
		case L2CAP_MODE_STREAMING:
			if (!disable_ertm)
				break;
			/* fall through */
		default:
			err = -EINVAL;
			break;
		}

527 528
		chan->imtu = opts.imtu;
		chan->omtu = opts.omtu;
529 530
		chan->fcs  = opts.fcs;
		chan->max_tx = opts.max_tx;
531
		chan->tx_win = opts.txwin_size;
532
		chan->flush_to = opts.flush_to;
533 534 535 536 537 538 539 540 541
		break;

	case L2CAP_LM:
		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		if (opt & L2CAP_LM_AUTH)
542
			chan->sec_level = BT_SECURITY_LOW;
543
		if (opt & L2CAP_LM_ENCRYPT)
544
			chan->sec_level = BT_SECURITY_MEDIUM;
545
		if (opt & L2CAP_LM_SECURE)
546
			chan->sec_level = BT_SECURITY_HIGH;
547

548 549 550 551
		if (opt & L2CAP_LM_MASTER)
			set_bit(FLAG_ROLE_SWITCH, &chan->flags);
		else
			clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
552 553 554 555 556

		if (opt & L2CAP_LM_RELIABLE)
			set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
		else
			clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
557 558 559 560 561 562 563 564 565 566 567 568 569 570
		break;

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
{
	struct sock *sk = sock->sk;
571
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
572
	struct bt_security sec;
573
	struct bt_power pwr;
574
	struct l2cap_conn *conn;
575 576 577 578 579 580 581 582 583 584 585 586 587 588 589
	int len, err = 0;
	u32 opt;

	BT_DBG("sk %p", sk);

	if (level == SOL_L2CAP)
		return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);

	if (level != SOL_BLUETOOTH)
		return -ENOPROTOOPT;

	lock_sock(sk);

	switch (optname) {
	case BT_SECURITY:
590 591
		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
					chan->chan_type != L2CAP_CHAN_RAW) {
592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609
			err = -EINVAL;
			break;
		}

		sec.level = BT_SECURITY_LOW;

		len = min_t(unsigned int, sizeof(sec), optlen);
		if (copy_from_user((char *) &sec, optval, len)) {
			err = -EFAULT;
			break;
		}

		if (sec.level < BT_SECURITY_LOW ||
					sec.level > BT_SECURITY_HIGH) {
			err = -EINVAL;
			break;
		}

610
		chan->sec_level = sec.level;
611

612 613 614
		if (!chan->conn)
			break;

615
		conn = chan->conn;
616 617 618

		/*change security for LE channels */
		if (chan->scid == L2CAP_CID_LE_DATA) {
619 620 621 622 623
			if (!conn->hcon->out) {
				err = -EINVAL;
				break;
			}

624
			if (smp_conn_security(conn->hcon, sec.level))
625 626
				break;
			sk->sk_state = BT_CONFIG;
627
			chan->state = BT_CONFIG;
628

629 630
		/* or for ACL link */
		} else if ((sk->sk_state == BT_CONNECT2 &&
631
			   test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
632 633
			   sk->sk_state == BT_CONNECTED) {
			if (!l2cap_chan_check_security(chan))
634
				set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
635 636
			else
				sk->sk_state_change(sk);
637 638
		} else {
			err = -EINVAL;
639
		}
640 641 642 643 644 645 646 647 648 649 650 651 652
		break;

	case BT_DEFER_SETUP:
		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
			err = -EINVAL;
			break;
		}

		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

653 654 655 656
		if (opt)
			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
		else
			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
657 658 659 660 661 662 663 664 665 666 667 668 669 670
		break;

	case BT_FLUSHABLE:
		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		if (opt > BT_FLUSHABLE_ON) {
			err = -EINVAL;
			break;
		}

		if (opt == BT_FLUSHABLE_OFF) {
671
			struct l2cap_conn *conn = chan->conn;
L
Lucas De Marchi 已提交
672
			/* proceed further only when we have l2cap_conn and
673 674 675 676 677 678 679
			   No Flush support in the LM */
			if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
				err = -EINVAL;
				break;
			}
		}

680 681 682 683
		if (opt)
			set_bit(FLAG_FLUSHABLE, &chan->flags);
		else
			clear_bit(FLAG_FLUSHABLE, &chan->flags);
684 685
		break;

686 687 688 689 690 691 692 693 694 695 696 697 698 699
	case BT_POWER:
		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
					chan->chan_type != L2CAP_CHAN_RAW) {
			err = -EINVAL;
			break;
		}

		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;

		len = min_t(unsigned int, sizeof(pwr), optlen);
		if (copy_from_user((char *) &pwr, optval, len)) {
			err = -EFAULT;
			break;
		}
700 701 702 703 704

		if (pwr.force_active)
			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
		else
			clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
705 706
		break;

707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729
	case BT_CHANNEL_POLICY:
		if (!enable_hs) {
			err = -ENOPROTOOPT;
			break;
		}

		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
			err = -EINVAL;
			break;
		}

		if (chan->mode != L2CAP_MODE_ERTM &&
				chan->mode != L2CAP_MODE_STREAMING) {
			err = -EOPNOTSUPP;
			break;
		}

		chan->chan_policy = (u8) opt;
730 731
		break;

732 733 734 735 736 737 738 739
	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}
740 741 742 743

static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len)
{
	struct sock *sk = sock->sk;
744
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
745 746 747 748 749 750 751 752 753 754 755
	int err;

	BT_DBG("sock %p, sk %p", sock, sk);

	err = sock_error(sk);
	if (err)
		return err;

	if (msg->msg_flags & MSG_OOB)
		return -EOPNOTSUPP;

756
	if (sk->sk_state != BT_CONNECTED)
757
		return -ENOTCONN;
758

759
	l2cap_chan_lock(chan);
760
	err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
761
	l2cap_chan_unlock(chan);
762 763 764

	return err;
}
765

766 767 768
static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
{
	struct sock *sk = sock->sk;
769 770
	struct l2cap_pinfo *pi = l2cap_pi(sk);
	int err;
771 772 773

	lock_sock(sk);

774 775
	if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
						    &bt_sk(sk)->flags)) {
776
		sk->sk_state = BT_CONFIG;
777
		pi->chan->state = BT_CONFIG;
778

779
		__l2cap_connect_rsp_defer(pi->chan);
780 781 782 783 784 785 786
		release_sock(sk);
		return 0;
	}

	release_sock(sk);

	if (sock->type == SOCK_STREAM)
787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813
		err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
	else
		err = bt_sock_recvmsg(iocb, sock, msg, len, flags);

	if (pi->chan->mode != L2CAP_MODE_ERTM)
		return err;

	/* Attempt to put pending rx data in the socket buffer */

	lock_sock(sk);

	if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
		goto done;

	if (pi->rx_busy_skb) {
		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
			pi->rx_busy_skb = NULL;
		else
			goto done;
	}

	/* Restore data flow when half of the receive buffer is
	 * available.  This avoids resending large numbers of
	 * frames.
	 */
	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
		l2cap_chan_busy(pi->chan, 0);
814

815 816 817
done:
	release_sock(sk);
	return err;
818 819
}

820 821 822
/* Kill socket (only if zapped and orphan)
 * Must be called on unlocked socket.
 */
823
static void l2cap_sock_kill(struct sock *sk)
824 825 826 827
{
	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
		return;

828
	BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
829 830

	/* Kill poor orphan */
831

832
	l2cap_chan_put(l2cap_pi(sk)->chan);
833 834 835 836
	sock_set_flag(sk, SOCK_DEAD);
	sock_put(sk);
}

837 838 839
static int l2cap_sock_shutdown(struct socket *sock, int how)
{
	struct sock *sk = sock->sk;
840
	struct l2cap_chan *chan;
841
	struct l2cap_conn *conn;
842 843 844 845 846 847 848
	int err = 0;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (!sk)
		return 0;

849
	chan = l2cap_pi(sk)->chan;
850 851 852 853
	conn = chan->conn;

	if (conn)
		mutex_lock(&conn->chan_lock);
854

855
	l2cap_chan_lock(chan);
856
	lock_sock(sk);
857

858
	if (!sk->sk_shutdown) {
859
		if (chan->mode == L2CAP_MODE_ERTM)
860 861 862
			err = __l2cap_wait_ack(sk);

		sk->sk_shutdown = SHUTDOWN_MASK;
863

864
		release_sock(sk);
865
		l2cap_chan_close(chan, 0);
866
		lock_sock(sk);
867 868 869 870 871 872 873 874 875 876

		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
			err = bt_sock_wait_state(sk, BT_CLOSED,
							sk->sk_lingertime);
	}

	if (!err && sk->sk_err)
		err = -sk->sk_err;

	release_sock(sk);
877
	l2cap_chan_unlock(chan);
878 879 880 881

	if (conn)
		mutex_unlock(&conn->chan_lock);

882 883 884
	return err;
}

885 886 887 888 889 890 891 892 893 894
static int l2cap_sock_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	int err;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (!sk)
		return 0;

895 896
	bt_sock_unlink(&l2cap_sk_list, sk);

897 898 899 900 901 902 903
	err = l2cap_sock_shutdown(sock, 2);

	sock_orphan(sk);
	l2cap_sock_kill(sk);
	return err;
}

904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922
static void l2cap_sock_cleanup_listen(struct sock *parent)
{
	struct sock *sk;

	BT_DBG("parent %p", parent);

	/* Close not yet accepted channels */
	while ((sk = bt_accept_dequeue(parent, NULL))) {
		struct l2cap_chan *chan = l2cap_pi(sk)->chan;

		l2cap_chan_lock(chan);
		__clear_chan_timer(chan);
		l2cap_chan_close(chan, ECONNRESET);
		l2cap_chan_unlock(chan);

		l2cap_sock_kill(sk);
	}
}

923
static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
924
{
925
	struct sock *sk, *parent = chan->data;
926

927 928 929 930 931 932
	/* Check for backlog size */
	if (sk_acceptq_is_full(parent)) {
		BT_DBG("backlog full %d", parent->sk_ack_backlog);
		return NULL;
	}

933 934 935 936 937
	sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
								GFP_ATOMIC);
	if (!sk)
		return NULL;

938 939
	bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);

940 941 942 943 944
	l2cap_sock_init(sk, parent);

	return l2cap_pi(sk)->chan;
}

945
static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
946
{
947
	int err;
948
	struct sock *sk = chan->data;
949 950
	struct l2cap_pinfo *pi = l2cap_pi(sk);

951 952 953 954 955 956
	lock_sock(sk);

	if (pi->rx_busy_skb) {
		err = -ENOMEM;
		goto done;
	}
957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973

	err = sock_queue_rcv_skb(sk, skb);

	/* For ERTM, handle one skb that doesn't fit into the recv
	 * buffer.  This is important to do because the data frames
	 * have already been acked, so the skb cannot be discarded.
	 *
	 * Notify the l2cap core that the buffer is full, so the
	 * LOCAL_BUSY state is entered and no more frames are
	 * acked and reassembled until there is buffer space
	 * available.
	 */
	if (err < 0 && pi->chan->mode == L2CAP_MODE_ERTM) {
		pi->rx_busy_skb = skb;
		l2cap_chan_busy(pi->chan, 1);
		err = 0;
	}
974

975 976 977
done:
	release_sock(sk);

978
	return err;
979 980
}

981
static void l2cap_sock_close_cb(struct l2cap_chan *chan)
982
{
983
	struct sock *sk = chan->data;
984 985 986 987

	l2cap_sock_kill(sk);
}

988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028
static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
{
	struct sock *sk = chan->data;
	struct sock *parent;

	lock_sock(sk);

	parent = bt_sk(sk)->parent;

	sock_set_flag(sk, SOCK_ZAPPED);

	switch (chan->state) {
	case BT_OPEN:
	case BT_BOUND:
	case BT_CLOSED:
		break;
	case BT_LISTEN:
		l2cap_sock_cleanup_listen(sk);
		sk->sk_state = BT_CLOSED;
		chan->state = BT_CLOSED;

		break;
	default:
		sk->sk_state = BT_CLOSED;
		chan->state = BT_CLOSED;

		sk->sk_err = err;

		if (parent) {
			bt_accept_unlink(sk);
			parent->sk_data_ready(parent, 0);
		} else {
			sk->sk_state_change(sk);
		}

		break;
	}

	release_sock(sk);
}

1029
static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state)
1030
{
1031
	struct sock *sk = chan->data;
1032 1033 1034 1035

	sk->sk_state = state;
}

1036
static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1037
					       unsigned long len, int nb)
1038
{
1039 1040 1041
	struct sk_buff *skb;
	int err;

1042
	l2cap_chan_unlock(chan);
1043
	skb = bt_skb_send_alloc(chan->sk, len, nb, &err);
1044 1045
	l2cap_chan_lock(chan);

1046 1047
	if (!skb)
		return ERR_PTR(err);
1048

1049
	return skb;
1050 1051
}

1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071
static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
{
	struct sock *sk = chan->data;
	struct sock *parent;

	lock_sock(sk);

	parent = bt_sk(sk)->parent;

	BT_DBG("sk %p, parent %p", sk, parent);

	sk->sk_state = BT_CONNECTED;
	sk->sk_state_change(sk);

	if (parent)
		parent->sk_data_ready(parent, 0);

	release_sock(sk);
}

1072 1073 1074
static struct l2cap_ops l2cap_chan_ops = {
	.name		= "L2CAP Socket Interface",
	.new_connection	= l2cap_sock_new_connection_cb,
1075
	.recv		= l2cap_sock_recv_cb,
1076
	.close		= l2cap_sock_close_cb,
1077
	.teardown	= l2cap_sock_teardown_cb,
1078
	.state_change	= l2cap_sock_state_change_cb,
1079
	.ready		= l2cap_sock_ready_cb,
1080
	.alloc_skb	= l2cap_sock_alloc_skb_cb,
1081 1082
};

1083 1084 1085 1086
static void l2cap_sock_destruct(struct sock *sk)
{
	BT_DBG("sk %p", sk);

1087 1088
	if (l2cap_pi(sk)->chan)
		l2cap_chan_put(l2cap_pi(sk)->chan);
1089 1090 1091 1092 1093
	if (l2cap_pi(sk)->rx_busy_skb) {
		kfree_skb(l2cap_pi(sk)->rx_busy_skb);
		l2cap_pi(sk)->rx_busy_skb = NULL;
	}

1094 1095 1096 1097
	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);
}

1098
static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1099 1100
{
	struct l2cap_pinfo *pi = l2cap_pi(sk);
1101
	struct l2cap_chan *chan = pi->chan;
1102 1103 1104 1105

	BT_DBG("sk %p", sk);

	if (parent) {
1106 1107
		struct l2cap_chan *pchan = l2cap_pi(parent)->chan;

1108
		sk->sk_type = parent->sk_type;
1109
		bt_sk(sk)->flags = bt_sk(parent)->flags;
1110

1111
		chan->chan_type = pchan->chan_type;
1112 1113
		chan->imtu = pchan->imtu;
		chan->omtu = pchan->omtu;
1114
		chan->conf_state = pchan->conf_state;
1115
		chan->mode = pchan->mode;
1116 1117 1118
		chan->fcs  = pchan->fcs;
		chan->max_tx = pchan->max_tx;
		chan->tx_win = pchan->tx_win;
1119
		chan->tx_win_max = pchan->tx_win_max;
1120
		chan->sec_level = pchan->sec_level;
1121
		chan->flags = pchan->flags;
1122 1123

		security_sk_clone(parent, sk);
1124
	} else {
1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138

		switch (sk->sk_type) {
		case SOCK_RAW:
			chan->chan_type = L2CAP_CHAN_RAW;
			break;
		case SOCK_DGRAM:
			chan->chan_type = L2CAP_CHAN_CONN_LESS;
			break;
		case SOCK_SEQPACKET:
		case SOCK_STREAM:
			chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
			break;
		}

1139 1140
		chan->imtu = L2CAP_DEFAULT_MTU;
		chan->omtu = 0;
1141
		if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1142
			chan->mode = L2CAP_MODE_ERTM;
1143
			set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1144
		} else {
1145
			chan->mode = L2CAP_MODE_BASIC;
1146
		}
1147 1148

		l2cap_chan_set_defaults(chan);
1149 1150 1151
	}

	/* Default config options */
1152
	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1153 1154 1155

	chan->data = sk;
	chan->ops = &l2cap_chan_ops;
1156 1157 1158 1159 1160 1161 1162 1163
}

static struct proto l2cap_proto = {
	.name		= "L2CAP",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct l2cap_pinfo)
};

1164
static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
1165 1166
{
	struct sock *sk;
1167
	struct l2cap_chan *chan;
1168 1169 1170 1171 1172 1173 1174 1175 1176

	sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
	if (!sk)
		return NULL;

	sock_init_data(sock, sk);
	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);

	sk->sk_destruct = l2cap_sock_destruct;
1177
	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1178 1179 1180 1181 1182 1183

	sock_reset_flag(sk, SOCK_ZAPPED);

	sk->sk_protocol = proto;
	sk->sk_state = BT_OPEN;

1184
	chan = l2cap_chan_create();
1185
	if (!chan) {
1186
		sk_free(sk);
1187 1188 1189
		return NULL;
	}

1190 1191
	l2cap_chan_hold(chan);

1192 1193
	chan->sk = sk;

1194 1195
	l2cap_pi(sk)->chan = chan;

1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221
	return sk;
}

static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
			     int kern)
{
	struct sock *sk;

	BT_DBG("sock %p", sock);

	sock->state = SS_UNCONNECTED;

	if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
			sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
		return -ESOCKTNOSUPPORT;

	if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
		return -EPERM;

	sock->ops = &l2cap_sock_ops;

	sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
	if (!sk)
		return -ENOMEM;

	l2cap_sock_init(sk, NULL);
1222
	bt_sock_link(&l2cap_sk_list, sk);
1223 1224 1225
	return 0;
}

1226
static const struct proto_ops l2cap_sock_ops = {
1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= l2cap_sock_release,
	.bind		= l2cap_sock_bind,
	.connect	= l2cap_sock_connect,
	.listen		= l2cap_sock_listen,
	.accept		= l2cap_sock_accept,
	.getname	= l2cap_sock_getname,
	.sendmsg	= l2cap_sock_sendmsg,
	.recvmsg	= l2cap_sock_recvmsg,
	.poll		= bt_sock_poll,
	.ioctl		= bt_sock_ioctl,
	.mmap		= sock_no_mmap,
	.socketpair	= sock_no_socketpair,
	.shutdown	= l2cap_sock_shutdown,
	.setsockopt	= l2cap_sock_setsockopt,
	.getsockopt	= l2cap_sock_getsockopt
};

1246 1247 1248 1249 1250 1251 1252 1253
static const struct net_proto_family l2cap_sock_family_ops = {
	.family	= PF_BLUETOOTH,
	.owner	= THIS_MODULE,
	.create	= l2cap_sock_create,
};

int __init l2cap_init_sockets(void)
{
1254
	int err;
1255

1256 1257 1258
	err = proto_register(&l2cap_proto, 0);
	if (err < 0)
		return err;
1259

1260
	err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1261 1262
	if (err < 0) {
		BT_ERR("L2CAP socket registration failed");
1263
		goto error;
1264 1265 1266 1267 1268 1269 1270 1271
	}

	err = bt_procfs_init(THIS_MODULE, &init_net, "l2cap", &l2cap_sk_list, NULL);
	if (err < 0) {
		BT_ERR("Failed to create L2CAP proc file");
		bt_sock_unregister(BTPROTO_L2CAP);
		goto error;
	}
1272

1273
	BT_INFO("L2CAP socket layer initialized");
1274

1275
	return 0;
1276 1277

error:
1278 1279
	proto_unregister(&l2cap_proto);
	return err;
1280 1281 1282 1283
}

void l2cap_cleanup_sockets(void)
{
1284
	bt_procfs_cleanup(&init_net, "l2cap");
1285 1286
	if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
		BT_ERR("L2CAP socket unregistration failed");
1287

1288
	proto_unregister(&l2cap_proto);
1289
}