l2cap_sock.c 33.1 KB
Newer Older
1 2 3 4 5
/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
   Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   Copyright (C) 2010 Google Inc.
6
   Copyright (C) 2011 ProFUSION Embedded Systems
7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth L2CAP sockets. */

30
#include <linux/module.h>
31
#include <linux/export.h>
32

33
#include <net/bluetooth/bluetooth.h>
34
#include <net/bluetooth/hci_core.h>
35
#include <net/bluetooth/l2cap.h>
36 37

#include "smp.h"
38

39 40
bool enable_lecoc;

41 42 43 44
static struct bt_sock_list l2cap_sk_list = {
	.lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
};

45
static const struct proto_ops l2cap_sock_ops;
46
static void l2cap_sock_init(struct sock *sk, struct sock *parent);
47 48
static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
				     int proto, gfp_t prio);
49

50 51 52 53 54 55
bool l2cap_is_socket(struct socket *sock)
{
	return sock && sock->ops == &l2cap_sock_ops;
}
EXPORT_SYMBOL(l2cap_is_socket);

56 57 58
static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
{
	struct sock *sk = sock->sk;
59
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
60 61 62 63 64 65 66 67 68 69 70 71
	struct sockaddr_l2 la;
	int len, err = 0;

	BT_DBG("sk %p", sk);

	if (!addr || addr->sa_family != AF_BLUETOOTH)
		return -EINVAL;

	memset(&la, 0, sizeof(la));
	len = min_t(unsigned int, sizeof(la), alen);
	memcpy(&la, addr, len);

72
	if (la.l2_cid && la.l2_psm)
73 74
		return -EINVAL;

75 76 77
	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
		return -EINVAL;

78
	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
79
		if (!enable_lecoc && la.l2_psm)
80 81
			return -EINVAL;
		/* We only allow ATT user space socket */
82 83
		if (la.l2_cid &&
		    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
84 85 86
			return -EINVAL;
	}

87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109
	lock_sock(sk);

	if (sk->sk_state != BT_OPEN) {
		err = -EBADFD;
		goto done;
	}

	if (la.l2_psm) {
		__u16 psm = __le16_to_cpu(la.l2_psm);

		/* PSM must be odd and lsb of upper byte must be 0 */
		if ((psm & 0x0101) != 0x0001) {
			err = -EINVAL;
			goto done;
		}

		/* Restrict usage of well-known PSMs */
		if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
			err = -EACCES;
			goto done;
		}
	}

110
	if (la.l2_cid)
S
Santosh Nayak 已提交
111
		err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
112 113
	else
		err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
114

115 116
	if (err < 0)
		goto done;
117

118
	switch (chan->chan_type) {
119 120 121 122
	case L2CAP_CHAN_CONN_LESS:
		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
			chan->sec_level = BT_SECURITY_SDP;
		break;
123 124 125 126 127 128
	case L2CAP_CHAN_CONN_ORIENTED:
		if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
		    __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
			chan->sec_level = BT_SECURITY_SDP;
		break;
	}
129

130
	bacpy(&chan->src, &la.l2_bdaddr);
131
	chan->src_type = la.l2_bdaddr_type;
132

133 134 135
	if (chan->psm && bdaddr_type_is_le(chan->src_type))
		l2cap_le_flowctl_init(chan);

136
	chan->state = BT_BOUND;
137
	sk->sk_state = BT_BOUND;
138 139 140 141 142 143

done:
	release_sock(sk);
	return err;
}

144 145
static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
			      int alen, int flags)
146 147
{
	struct sock *sk = sock->sk;
148
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
149 150 151 152 153 154 155 156 157 158 159 160 161
	struct sockaddr_l2 la;
	int len, err = 0;

	BT_DBG("sk %p", sk);

	if (!addr || alen < sizeof(addr->sa_family) ||
	    addr->sa_family != AF_BLUETOOTH)
		return -EINVAL;

	memset(&la, 0, sizeof(la));
	len = min_t(unsigned int, sizeof(la), alen);
	memcpy(&la, addr, len);

162
	if (la.l2_cid && la.l2_psm)
163 164
		return -EINVAL;

165 166 167
	if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
		return -EINVAL;

168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192
	/* Check that the socket wasn't bound to something that
	 * conflicts with the address given to connect(). If chan->src
	 * is BDADDR_ANY it means bind() was never used, in which case
	 * chan->src_type and la.l2_bdaddr_type do not need to match.
	 */
	if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
	    bdaddr_type_is_le(la.l2_bdaddr_type)) {
		/* Old user space versions will try to incorrectly bind
		 * the ATT socket using BDADDR_BREDR. We need to accept
		 * this and fix up the source address type only when
		 * both the source CID and destination CID indicate
		 * ATT. Anything else is an invalid combination.
		 */
		if (chan->scid != L2CAP_CID_ATT ||
		    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
			return -EINVAL;

		/* We don't have the hdev available here to make a
		 * better decision on random vs public, but since all
		 * user space versions that exhibit this issue anyway do
		 * not support random local addresses assuming public
		 * here is good enough.
		 */
		chan->src_type = BDADDR_LE_PUBLIC;
	}
193 194 195 196

	if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
		return -EINVAL;

197
	if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
198
		if (!enable_lecoc && la.l2_psm)
199 200
			return -EINVAL;
		/* We only allow ATT user space socket */
201 202
		if (la.l2_cid &&
		    la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
203 204 205
			return -EINVAL;
	}

206 207 208
	if (chan->psm && bdaddr_type_is_le(chan->src_type))
		l2cap_le_flowctl_init(chan);

S
Santosh Nayak 已提交
209
	err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
210
				 &la.l2_bdaddr, la.l2_bdaddr_type);
211
	if (err)
212
		return err;
213

214 215
	lock_sock(sk);

216
	err = bt_sock_wait_state(sk, BT_CONNECTED,
217
				 sock_sndtimeo(sk, flags & O_NONBLOCK));
218 219 220

	release_sock(sk);

221 222 223
	return err;
}

224 225 226
static int l2cap_sock_listen(struct socket *sock, int backlog)
{
	struct sock *sk = sock->sk;
227
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
228 229 230 231 232 233
	int err = 0;

	BT_DBG("sk %p backlog %d", sk, backlog);

	lock_sock(sk);

234
	if (sk->sk_state != BT_BOUND) {
235 236 237 238
		err = -EBADFD;
		goto done;
	}

239 240 241 242 243
	if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
		err = -EINVAL;
		goto done;
	}

244
	switch (chan->mode) {
245
	case L2CAP_MODE_BASIC:
246
	case L2CAP_MODE_LE_FLOWCTL:
247 248 249 250 251 252 253 254 255 256 257 258 259
		break;
	case L2CAP_MODE_ERTM:
	case L2CAP_MODE_STREAMING:
		if (!disable_ertm)
			break;
		/* fall through */
	default:
		err = -ENOTSUPP;
		goto done;
	}

	sk->sk_max_ack_backlog = backlog;
	sk->sk_ack_backlog = 0;
260 261

	chan->state = BT_LISTEN;
262 263 264 265 266 267 268
	sk->sk_state = BT_LISTEN;

done:
	release_sock(sk);
	return err;
}

269 270
static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
			     int flags)
271 272 273 274 275 276 277 278 279 280 281 282 283 284
{
	DECLARE_WAITQUEUE(wait, current);
	struct sock *sk = sock->sk, *nsk;
	long timeo;
	int err = 0;

	lock_sock_nested(sk, SINGLE_DEPTH_NESTING);

	timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);

	BT_DBG("sk %p timeo %ld", sk, timeo);

	/* Wait for an incoming connection. (wake-one). */
	add_wait_queue_exclusive(sk_sleep(sk), &wait);
285
	while (1) {
286
		set_current_state(TASK_INTERRUPTIBLE);
287 288 289

		if (sk->sk_state != BT_LISTEN) {
			err = -EBADFD;
290 291 292
			break;
		}

293 294 295
		nsk = bt_accept_dequeue(sk, newsock);
		if (nsk)
			break;
296

297 298
		if (!timeo) {
			err = -EAGAIN;
299 300 301 302 303 304 305
			break;
		}

		if (signal_pending(current)) {
			err = sock_intr_errno(timeo);
			break;
		}
306 307 308 309

		release_sock(sk);
		timeo = schedule_timeout(timeo);
		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
310
	}
311
	__set_current_state(TASK_RUNNING);
312 313 314 315 316 317 318 319 320 321 322 323 324 325
	remove_wait_queue(sk_sleep(sk), &wait);

	if (err)
		goto done;

	newsock->state = SS_CONNECTED;

	BT_DBG("new socket %p", nsk);

done:
	release_sock(sk);
	return err;
}

326 327
static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
			      int *len, int peer)
328 329 330
{
	struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
	struct sock *sk = sock->sk;
331
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
332 333 334

	BT_DBG("sock %p, sk %p", sock, sk);

335
	memset(la, 0, sizeof(struct sockaddr_l2));
336 337 338 339
	addr->sa_family = AF_BLUETOOTH;
	*len = sizeof(struct sockaddr_l2);

	if (peer) {
340
		la->l2_psm = chan->psm;
341
		bacpy(&la->l2_bdaddr, &chan->dst);
342
		la->l2_cid = cpu_to_le16(chan->dcid);
343
		la->l2_bdaddr_type = chan->dst_type;
344
	} else {
345
		la->l2_psm = chan->sport;
346
		bacpy(&la->l2_bdaddr, &chan->src);
347
		la->l2_cid = cpu_to_le16(chan->scid);
348
		la->l2_bdaddr_type = chan->src_type;
349 350 351 352 353
	}

	return 0;
}

354 355
static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
				     char __user *optval, int __user *optlen)
356 357
{
	struct sock *sk = sock->sk;
358
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
359 360 361 362 363 364 365 366 367 368 369 370 371 372
	struct l2cap_options opts;
	struct l2cap_conninfo cinfo;
	int len, err = 0;
	u32 opt;

	BT_DBG("sk %p", sk);

	if (get_user(len, optlen))
		return -EFAULT;

	lock_sock(sk);

	switch (optname) {
	case L2CAP_OPTIONS:
373 374 375 376 377 378 379 380 381 382
		/* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
		 * legacy ATT code depends on getsockopt for
		 * L2CAP_OPTIONS we need to let this pass.
		 */
		if (bdaddr_type_is_le(chan->src_type) &&
		    chan->scid != L2CAP_CID_ATT) {
			err = -EINVAL;
			break;
		}

383
		memset(&opts, 0, sizeof(opts));
384 385 386 387
		opts.imtu     = chan->imtu;
		opts.omtu     = chan->omtu;
		opts.flush_to = chan->flush_to;
		opts.mode     = chan->mode;
388 389
		opts.fcs      = chan->fcs;
		opts.max_tx   = chan->max_tx;
390
		opts.txwin_size = chan->tx_win;
391 392 393 394 395 396 397 398

		len = min_t(unsigned int, len, sizeof(opts));
		if (copy_to_user(optval, (char *) &opts, len))
			err = -EFAULT;

		break;

	case L2CAP_LM:
399
		switch (chan->sec_level) {
400 401 402 403 404 405 406 407
		case BT_SECURITY_LOW:
			opt = L2CAP_LM_AUTH;
			break;
		case BT_SECURITY_MEDIUM:
			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
			break;
		case BT_SECURITY_HIGH:
			opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
408
			      L2CAP_LM_SECURE;
409 410 411 412 413 414
			break;
		default:
			opt = 0;
			break;
		}

415
		if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
416 417
			opt |= L2CAP_LM_MASTER;

418
		if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
419 420 421 422 423 424 425 426
			opt |= L2CAP_LM_RELIABLE;

		if (put_user(opt, (u32 __user *) optval))
			err = -EFAULT;
		break;

	case L2CAP_CONNINFO:
		if (sk->sk_state != BT_CONNECTED &&
427 428
		    !(sk->sk_state == BT_CONNECT2 &&
		      test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
429 430 431 432
			err = -ENOTCONN;
			break;
		}

433
		memset(&cinfo, 0, sizeof(cinfo));
434 435
		cinfo.hci_handle = chan->conn->hcon->handle;
		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451

		len = min_t(unsigned int, len, sizeof(cinfo));
		if (copy_to_user(optval, (char *) &cinfo, len))
			err = -EFAULT;

		break;

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

452 453
static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
				 char __user *optval, int __user *optlen)
454 455
{
	struct sock *sk = sock->sk;
456
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
457
	struct bt_security sec;
458
	struct bt_power pwr;
459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475
	int len, err = 0;

	BT_DBG("sk %p", sk);

	if (level == SOL_L2CAP)
		return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);

	if (level != SOL_BLUETOOTH)
		return -ENOPROTOOPT;

	if (get_user(len, optlen))
		return -EFAULT;

	lock_sock(sk);

	switch (optname) {
	case BT_SECURITY:
476
		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
477
		    chan->chan_type != L2CAP_CHAN_RAW) {
478 479 480 481
			err = -EINVAL;
			break;
		}

482
		memset(&sec, 0, sizeof(sec));
483
		if (chan->conn) {
484
			sec.level = chan->conn->hcon->sec_level;
485

486 487 488 489 490
			if (sk->sk_state == BT_CONNECTED)
				sec.key_size = chan->conn->hcon->enc_key_size;
		} else {
			sec.level = chan->sec_level;
		}
491

492 493 494 495 496 497 498 499 500 501 502 503
		len = min_t(unsigned int, len, sizeof(sec));
		if (copy_to_user(optval, (char *) &sec, len))
			err = -EFAULT;

		break;

	case BT_DEFER_SETUP:
		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
			err = -EINVAL;
			break;
		}

504 505
		if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
			     (u32 __user *) optval))
506 507 508 509 510
			err = -EFAULT;

		break;

	case BT_FLUSHABLE:
511
		if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
512
			     (u32 __user *) optval))
513 514 515 516
			err = -EFAULT;

		break;

517 518
	case BT_POWER:
		if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
519
		    && sk->sk_type != SOCK_RAW) {
520 521 522 523
			err = -EINVAL;
			break;
		}

524
		pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
525 526 527 528 529 530 531

		len = min_t(unsigned int, len, sizeof(pwr));
		if (copy_to_user(optval, (char *) &pwr, len))
			err = -EFAULT;

		break;

532 533 534 535 536
	case BT_CHANNEL_POLICY:
		if (put_user(chan->chan_policy, (u32 __user *) optval))
			err = -EFAULT;
		break;

537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571
	case BT_SNDMTU:
		if (!enable_lecoc) {
			err = -EPROTONOSUPPORT;
			break;
		}

		if (!bdaddr_type_is_le(chan->src_type)) {
			err = -EINVAL;
			break;
		}

		if (sk->sk_state != BT_CONNECTED) {
			err = -ENOTCONN;
			break;
		}

		if (put_user(chan->omtu, (u16 __user *) optval))
			err = -EFAULT;
		break;

	case BT_RCVMTU:
		if (!enable_lecoc) {
			err = -EPROTONOSUPPORT;
			break;
		}

		if (!bdaddr_type_is_le(chan->src_type)) {
			err = -EINVAL;
			break;
		}

		if (put_user(chan->imtu, (u16 __user *) optval))
			err = -EFAULT;
		break;

572 573 574 575 576 577 578 579 580
	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

581 582 583
static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
{
	switch (chan->scid) {
584
	case L2CAP_CID_ATT:
585
		if (mtu < L2CAP_LE_MIN_MTU)
586 587 588 589 590 591 592 593 594 595 596
			return false;
		break;

	default:
		if (mtu < L2CAP_DEFAULT_MIN_MTU)
			return false;
	}

	return true;
}

597 598
static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
				     char __user *optval, unsigned int optlen)
599 600
{
	struct sock *sk = sock->sk;
601
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
602 603 604 605 606 607 608 609 610 611
	struct l2cap_options opts;
	int len, err = 0;
	u32 opt;

	BT_DBG("sk %p", sk);

	lock_sock(sk);

	switch (optname) {
	case L2CAP_OPTIONS:
612 613 614 615 616
		if (bdaddr_type_is_le(chan->src_type)) {
			err = -EINVAL;
			break;
		}

617 618 619 620 621
		if (sk->sk_state == BT_CONNECTED) {
			err = -EINVAL;
			break;
		}

622 623 624 625
		opts.imtu     = chan->imtu;
		opts.omtu     = chan->omtu;
		opts.flush_to = chan->flush_to;
		opts.mode     = chan->mode;
626 627
		opts.fcs      = chan->fcs;
		opts.max_tx   = chan->max_tx;
628
		opts.txwin_size = chan->tx_win;
629 630 631 632 633 634 635

		len = min_t(unsigned int, sizeof(opts), optlen);
		if (copy_from_user((char *) &opts, optval, len)) {
			err = -EFAULT;
			break;
		}

636
		if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
637 638 639 640
			err = -EINVAL;
			break;
		}

641 642 643 644 645
		if (!l2cap_valid_mtu(chan, opts.imtu)) {
			err = -EINVAL;
			break;
		}

646 647
		chan->mode = opts.mode;
		switch (chan->mode) {
648 649
		case L2CAP_MODE_LE_FLOWCTL:
			break;
650
		case L2CAP_MODE_BASIC:
651
			clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
652 653 654 655 656 657 658 659 660 661 662
			break;
		case L2CAP_MODE_ERTM:
		case L2CAP_MODE_STREAMING:
			if (!disable_ertm)
				break;
			/* fall through */
		default:
			err = -EINVAL;
			break;
		}

663 664
		chan->imtu = opts.imtu;
		chan->omtu = opts.omtu;
665 666
		chan->fcs  = opts.fcs;
		chan->max_tx = opts.max_tx;
667
		chan->tx_win = opts.txwin_size;
668
		chan->flush_to = opts.flush_to;
669 670 671 672 673 674 675 676 677
		break;

	case L2CAP_LM:
		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		if (opt & L2CAP_LM_AUTH)
678
			chan->sec_level = BT_SECURITY_LOW;
679
		if (opt & L2CAP_LM_ENCRYPT)
680
			chan->sec_level = BT_SECURITY_MEDIUM;
681
		if (opt & L2CAP_LM_SECURE)
682
			chan->sec_level = BT_SECURITY_HIGH;
683

684 685 686 687
		if (opt & L2CAP_LM_MASTER)
			set_bit(FLAG_ROLE_SWITCH, &chan->flags);
		else
			clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
688 689 690 691 692

		if (opt & L2CAP_LM_RELIABLE)
			set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
		else
			clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
693 694 695 696 697 698 699 700 701 702 703
		break;

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

704 705
static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
				 char __user *optval, unsigned int optlen)
706 707
{
	struct sock *sk = sock->sk;
708
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
709
	struct bt_security sec;
710
	struct bt_power pwr;
711
	struct l2cap_conn *conn;
712 713 714 715 716 717 718 719 720 721 722 723 724 725 726
	int len, err = 0;
	u32 opt;

	BT_DBG("sk %p", sk);

	if (level == SOL_L2CAP)
		return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);

	if (level != SOL_BLUETOOTH)
		return -ENOPROTOOPT;

	lock_sock(sk);

	switch (optname) {
	case BT_SECURITY:
727
		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
728
		    chan->chan_type != L2CAP_CHAN_RAW) {
729 730 731 732 733 734 735 736 737 738 739 740 741
			err = -EINVAL;
			break;
		}

		sec.level = BT_SECURITY_LOW;

		len = min_t(unsigned int, sizeof(sec), optlen);
		if (copy_from_user((char *) &sec, optval, len)) {
			err = -EFAULT;
			break;
		}

		if (sec.level < BT_SECURITY_LOW ||
742
		    sec.level > BT_SECURITY_HIGH) {
743 744 745 746
			err = -EINVAL;
			break;
		}

747
		chan->sec_level = sec.level;
748

749 750 751
		if (!chan->conn)
			break;

752
		conn = chan->conn;
753 754

		/*change security for LE channels */
755
		if (chan->scid == L2CAP_CID_ATT) {
756 757 758 759 760
			if (!conn->hcon->out) {
				err = -EINVAL;
				break;
			}

761
			if (smp_conn_security(conn->hcon, sec.level))
762 763
				break;
			sk->sk_state = BT_CONFIG;
764
			chan->state = BT_CONFIG;
765

766 767
		/* or for ACL link */
		} else if ((sk->sk_state == BT_CONNECT2 &&
768
			    test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
769 770
			   sk->sk_state == BT_CONNECTED) {
			if (!l2cap_chan_check_security(chan))
771
				set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
772 773
			else
				sk->sk_state_change(sk);
774 775
		} else {
			err = -EINVAL;
776
		}
777 778 779 780 781 782 783 784 785 786 787 788 789
		break;

	case BT_DEFER_SETUP:
		if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
			err = -EINVAL;
			break;
		}

		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

790
		if (opt) {
791
			set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
792 793
			set_bit(FLAG_DEFER_SETUP, &chan->flags);
		} else {
794
			clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
795 796
			clear_bit(FLAG_DEFER_SETUP, &chan->flags);
		}
797 798 799 800 801 802 803 804 805 806 807 808 809 810
		break;

	case BT_FLUSHABLE:
		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		if (opt > BT_FLUSHABLE_ON) {
			err = -EINVAL;
			break;
		}

		if (opt == BT_FLUSHABLE_OFF) {
811
			conn = chan->conn;
L
Lucas De Marchi 已提交
812
			/* proceed further only when we have l2cap_conn and
813 814 815 816 817 818 819
			   No Flush support in the LM */
			if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
				err = -EINVAL;
				break;
			}
		}

820 821 822 823
		if (opt)
			set_bit(FLAG_FLUSHABLE, &chan->flags);
		else
			clear_bit(FLAG_FLUSHABLE, &chan->flags);
824 825
		break;

826 827
	case BT_POWER:
		if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
828
		    chan->chan_type != L2CAP_CHAN_RAW) {
829 830 831 832 833 834 835 836 837 838 839
			err = -EINVAL;
			break;
		}

		pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;

		len = min_t(unsigned int, sizeof(pwr), optlen);
		if (copy_from_user((char *) &pwr, optval, len)) {
			err = -EFAULT;
			break;
		}
840 841 842 843 844

		if (pwr.force_active)
			set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
		else
			clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
845 846
		break;

847 848 849 850 851 852 853 854 855 856 857 858
	case BT_CHANNEL_POLICY:
		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
			err = -EINVAL;
			break;
		}

		if (chan->mode != L2CAP_MODE_ERTM &&
859
		    chan->mode != L2CAP_MODE_STREAMING) {
860 861 862 863 864
			err = -EOPNOTSUPP;
			break;
		}

		chan->chan_policy = (u8) opt;
865 866 867 868 869

		if (sk->sk_state == BT_CONNECTED &&
		    chan->move_role == L2CAP_MOVE_ROLE_NONE)
			l2cap_move_start(chan);

870 871
		break;

872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912
	case BT_SNDMTU:
		if (!enable_lecoc) {
			err = -EPROTONOSUPPORT;
			break;
		}

		if (!bdaddr_type_is_le(chan->src_type)) {
			err = -EINVAL;
			break;
		}

		/* Setting is not supported as it's the remote side that
		 * decides this.
		 */
		err = -EPERM;
		break;

	case BT_RCVMTU:
		if (!enable_lecoc) {
			err = -EPROTONOSUPPORT;
			break;
		}

		if (!bdaddr_type_is_le(chan->src_type)) {
			err = -EINVAL;
			break;
		}

		if (sk->sk_state == BT_CONNECTED) {
			err = -EISCONN;
			break;
		}

		if (get_user(opt, (u32 __user *) optval)) {
			err = -EFAULT;
			break;
		}

		chan->imtu = opt;
		break;

913 914 915 916 917 918 919 920
	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}
921

922 923
static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
			      struct msghdr *msg, size_t len)
924 925
{
	struct sock *sk = sock->sk;
926
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
927 928 929 930 931 932 933 934 935 936 937
	int err;

	BT_DBG("sock %p, sk %p", sock, sk);

	err = sock_error(sk);
	if (err)
		return err;

	if (msg->msg_flags & MSG_OOB)
		return -EOPNOTSUPP;

938
	if (sk->sk_state != BT_CONNECTED)
939
		return -ENOTCONN;
940

941 942 943 944 945 946
	lock_sock(sk);
	err = bt_sock_wait_ready(sk, msg->msg_flags);
	release_sock(sk);
	if (err)
		return err;

947
	l2cap_chan_lock(chan);
948
	err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
949
	l2cap_chan_unlock(chan);
950 951 952

	return err;
}
953

954 955
static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
			      struct msghdr *msg, size_t len, int flags)
956 957
{
	struct sock *sk = sock->sk;
958 959
	struct l2cap_pinfo *pi = l2cap_pi(sk);
	int err;
960 961 962

	lock_sock(sk);

963 964
	if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
						    &bt_sk(sk)->flags)) {
965 966 967 968 969 970 971 972 973
		if (bdaddr_type_is_le(pi->chan->src_type)) {
			sk->sk_state = BT_CONNECTED;
			pi->chan->state = BT_CONNECTED;
			__l2cap_le_connect_rsp_defer(pi->chan);
		} else {
			sk->sk_state = BT_CONFIG;
			pi->chan->state = BT_CONFIG;
			__l2cap_connect_rsp_defer(pi->chan);
		}
974

975 976
		err = 0;
		goto done;
977 978 979 980 981
	}

	release_sock(sk);

	if (sock->type == SOCK_STREAM)
982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008
		err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
	else
		err = bt_sock_recvmsg(iocb, sock, msg, len, flags);

	if (pi->chan->mode != L2CAP_MODE_ERTM)
		return err;

	/* Attempt to put pending rx data in the socket buffer */

	lock_sock(sk);

	if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
		goto done;

	if (pi->rx_busy_skb) {
		if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
			pi->rx_busy_skb = NULL;
		else
			goto done;
	}

	/* Restore data flow when half of the receive buffer is
	 * available.  This avoids resending large numbers of
	 * frames.
	 */
	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
		l2cap_chan_busy(pi->chan, 0);
1009

1010 1011 1012
done:
	release_sock(sk);
	return err;
1013 1014
}

1015 1016 1017
/* Kill socket (only if zapped and orphan)
 * Must be called on unlocked socket.
 */
1018
static void l2cap_sock_kill(struct sock *sk)
1019 1020 1021 1022
{
	if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
		return;

1023
	BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1024 1025

	/* Kill poor orphan */
1026

1027
	l2cap_chan_put(l2cap_pi(sk)->chan);
1028 1029 1030 1031
	sock_set_flag(sk, SOCK_DEAD);
	sock_put(sk);
}

1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063
static int __l2cap_wait_ack(struct sock *sk)
{
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
	DECLARE_WAITQUEUE(wait, current);
	int err = 0;
	int timeo = HZ/5;

	add_wait_queue(sk_sleep(sk), &wait);
	set_current_state(TASK_INTERRUPTIBLE);
	while (chan->unacked_frames > 0 && chan->conn) {
		if (!timeo)
			timeo = HZ/5;

		if (signal_pending(current)) {
			err = sock_intr_errno(timeo);
			break;
		}

		release_sock(sk);
		timeo = schedule_timeout(timeo);
		lock_sock(sk);
		set_current_state(TASK_INTERRUPTIBLE);

		err = sock_error(sk);
		if (err)
			break;
	}
	set_current_state(TASK_RUNNING);
	remove_wait_queue(sk_sleep(sk), &wait);
	return err;
}

1064 1065 1066
static int l2cap_sock_shutdown(struct socket *sock, int how)
{
	struct sock *sk = sock->sk;
1067
	struct l2cap_chan *chan;
1068
	struct l2cap_conn *conn;
1069 1070 1071 1072 1073 1074 1075
	int err = 0;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (!sk)
		return 0;

1076
	chan = l2cap_pi(sk)->chan;
1077 1078 1079 1080
	conn = chan->conn;

	if (conn)
		mutex_lock(&conn->chan_lock);
1081

1082
	l2cap_chan_lock(chan);
1083
	lock_sock(sk);
1084

1085
	if (!sk->sk_shutdown) {
1086
		if (chan->mode == L2CAP_MODE_ERTM)
1087 1088 1089
			err = __l2cap_wait_ack(sk);

		sk->sk_shutdown = SHUTDOWN_MASK;
1090

1091
		release_sock(sk);
1092
		l2cap_chan_close(chan, 0);
1093
		lock_sock(sk);
1094 1095 1096

		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
			err = bt_sock_wait_state(sk, BT_CLOSED,
1097
						 sk->sk_lingertime);
1098 1099 1100 1101 1102 1103
	}

	if (!err && sk->sk_err)
		err = -sk->sk_err;

	release_sock(sk);
1104
	l2cap_chan_unlock(chan);
1105 1106 1107 1108

	if (conn)
		mutex_unlock(&conn->chan_lock);

1109 1110 1111
	return err;
}

1112 1113 1114 1115 1116 1117 1118 1119 1120 1121
static int l2cap_sock_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	int err;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (!sk)
		return 0;

1122 1123
	bt_sock_unlink(&l2cap_sk_list, sk);

1124 1125 1126 1127 1128 1129 1130
	err = l2cap_sock_shutdown(sock, 2);

	sock_orphan(sk);
	l2cap_sock_kill(sk);
	return err;
}

1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149
static void l2cap_sock_cleanup_listen(struct sock *parent)
{
	struct sock *sk;

	BT_DBG("parent %p", parent);

	/* Close not yet accepted channels */
	while ((sk = bt_accept_dequeue(parent, NULL))) {
		struct l2cap_chan *chan = l2cap_pi(sk)->chan;

		l2cap_chan_lock(chan);
		__clear_chan_timer(chan);
		l2cap_chan_close(chan, ECONNRESET);
		l2cap_chan_unlock(chan);

		l2cap_sock_kill(sk);
	}
}

1150
static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1151
{
1152
	struct sock *sk, *parent = chan->data;
1153

1154 1155
	lock_sock(parent);

1156 1157 1158 1159 1160 1161
	/* Check for backlog size */
	if (sk_acceptq_is_full(parent)) {
		BT_DBG("backlog full %d", parent->sk_ack_backlog);
		return NULL;
	}

1162
	sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1163
			      GFP_ATOMIC);
1164 1165 1166
	if (!sk)
		return NULL;

1167 1168
	bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);

1169 1170
	l2cap_sock_init(sk, parent);

1171 1172
	bt_accept_enqueue(parent, sk);

1173 1174
	release_sock(parent);

1175 1176 1177
	return l2cap_pi(sk)->chan;
}

1178
static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1179
{
1180
	struct sock *sk = chan->data;
1181
	int err;
1182

1183 1184
	lock_sock(sk);

1185
	if (l2cap_pi(sk)->rx_busy_skb) {
1186 1187 1188
		err = -ENOMEM;
		goto done;
	}
1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200

	err = sock_queue_rcv_skb(sk, skb);

	/* For ERTM, handle one skb that doesn't fit into the recv
	 * buffer.  This is important to do because the data frames
	 * have already been acked, so the skb cannot be discarded.
	 *
	 * Notify the l2cap core that the buffer is full, so the
	 * LOCAL_BUSY state is entered and no more frames are
	 * acked and reassembled until there is buffer space
	 * available.
	 */
1201 1202 1203
	if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
		l2cap_pi(sk)->rx_busy_skb = skb;
		l2cap_chan_busy(chan, 1);
1204 1205
		err = 0;
	}
1206

1207 1208 1209
done:
	release_sock(sk);

1210
	return err;
1211 1212
}

1213
static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1214
{
1215
	struct sock *sk = chan->data;
1216 1217 1218 1219

	l2cap_sock_kill(sk);
}

1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260
static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
{
	struct sock *sk = chan->data;
	struct sock *parent;

	lock_sock(sk);

	parent = bt_sk(sk)->parent;

	sock_set_flag(sk, SOCK_ZAPPED);

	switch (chan->state) {
	case BT_OPEN:
	case BT_BOUND:
	case BT_CLOSED:
		break;
	case BT_LISTEN:
		l2cap_sock_cleanup_listen(sk);
		sk->sk_state = BT_CLOSED;
		chan->state = BT_CLOSED;

		break;
	default:
		sk->sk_state = BT_CLOSED;
		chan->state = BT_CLOSED;

		sk->sk_err = err;

		if (parent) {
			bt_accept_unlink(sk);
			parent->sk_data_ready(parent, 0);
		} else {
			sk->sk_state_change(sk);
		}

		break;
	}

	release_sock(sk);
}

1261 1262
static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
				       int err)
1263
{
1264
	struct sock *sk = chan->data;
1265 1266

	sk->sk_state = state;
1267 1268 1269

	if (err)
		sk->sk_err = err;
1270 1271
}

1272
static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1273
					       unsigned long len, int nb)
1274
{
1275
	struct sock *sk = chan->data;
1276 1277 1278
	struct sk_buff *skb;
	int err;

1279
	l2cap_chan_unlock(chan);
1280
	skb = bt_skb_send_alloc(sk, len, nb, &err);
1281 1282
	l2cap_chan_lock(chan);

1283 1284
	if (!skb)
		return ERR_PTR(err);
1285

1286 1287
	bt_cb(skb)->chan = chan;

1288
	return skb;
1289 1290
}

1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310
static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
{
	struct sock *sk = chan->data;
	struct sock *parent;

	lock_sock(sk);

	parent = bt_sk(sk)->parent;

	BT_DBG("sk %p, parent %p", sk, parent);

	sk->sk_state = BT_CONNECTED;
	sk->sk_state_change(sk);

	if (parent)
		parent->sk_data_ready(parent, 0);

	release_sock(sk);
}

1311 1312
static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
{
1313 1314 1315
	struct sock *parent, *sk = chan->data;

	lock_sock(sk);
1316

1317
	parent = bt_sk(sk)->parent;
1318 1319
	if (parent)
		parent->sk_data_ready(parent, 0);
1320 1321

	release_sock(sk);
1322 1323
}

1324 1325 1326 1327 1328 1329 1330 1331
static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
{
	struct sock *sk = chan->data;

	clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
	sk->sk_state_change(sk);
}

1332 1333 1334 1335 1336 1337 1338 1339 1340
static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
{
	struct sock *sk = chan->data;

	lock_sock(sk);
	sk->sk_shutdown = SHUTDOWN_MASK;
	release_sock(sk);
}

1341 1342 1343 1344 1345 1346 1347
static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
{
	struct sock *sk = chan->data;

	return sk->sk_sndtimeo;
}

1348 1349 1350 1351 1352 1353 1354 1355
static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
{
	struct sock *sk = chan->data;

	set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
	sk->sk_state_change(sk);
}

1356 1357 1358
static struct l2cap_ops l2cap_chan_ops = {
	.name		= "L2CAP Socket Interface",
	.new_connection	= l2cap_sock_new_connection_cb,
1359
	.recv		= l2cap_sock_recv_cb,
1360
	.close		= l2cap_sock_close_cb,
1361
	.teardown	= l2cap_sock_teardown_cb,
1362
	.state_change	= l2cap_sock_state_change_cb,
1363
	.ready		= l2cap_sock_ready_cb,
1364
	.defer		= l2cap_sock_defer_cb,
1365
	.resume		= l2cap_sock_resume_cb,
1366
	.suspend	= l2cap_sock_suspend_cb,
1367
	.set_shutdown	= l2cap_sock_set_shutdown_cb,
1368
	.get_sndtimeo	= l2cap_sock_get_sndtimeo_cb,
1369
	.alloc_skb	= l2cap_sock_alloc_skb_cb,
1370 1371
};

1372 1373 1374 1375
static void l2cap_sock_destruct(struct sock *sk)
{
	BT_DBG("sk %p", sk);

1376 1377
	if (l2cap_pi(sk)->chan)
		l2cap_chan_put(l2cap_pi(sk)->chan);
1378

1379 1380 1381 1382 1383
	if (l2cap_pi(sk)->rx_busy_skb) {
		kfree_skb(l2cap_pi(sk)->rx_busy_skb);
		l2cap_pi(sk)->rx_busy_skb = NULL;
	}

1384 1385 1386 1387
	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);
}

1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400
static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
			       int *msg_namelen)
{
	struct sockaddr_l2 *la = (struct sockaddr_l2 *) msg_name;

	memset(la, 0, sizeof(struct sockaddr_l2));
	la->l2_family = AF_BLUETOOTH;
	la->l2_psm = bt_cb(skb)->psm;
	bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);

	*msg_namelen = sizeof(struct sockaddr_l2);
}

1401
static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1402
{
1403
	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1404 1405 1406 1407

	BT_DBG("sk %p", sk);

	if (parent) {
1408 1409
		struct l2cap_chan *pchan = l2cap_pi(parent)->chan;

1410
		sk->sk_type = parent->sk_type;
1411
		bt_sk(sk)->flags = bt_sk(parent)->flags;
1412

1413
		chan->chan_type = pchan->chan_type;
1414 1415
		chan->imtu = pchan->imtu;
		chan->omtu = pchan->omtu;
1416
		chan->conf_state = pchan->conf_state;
1417
		chan->mode = pchan->mode;
1418 1419 1420
		chan->fcs  = pchan->fcs;
		chan->max_tx = pchan->max_tx;
		chan->tx_win = pchan->tx_win;
1421
		chan->tx_win_max = pchan->tx_win_max;
1422
		chan->sec_level = pchan->sec_level;
1423
		chan->flags = pchan->flags;
1424 1425
		chan->tx_credits = pchan->tx_credits;
		chan->rx_credits = pchan->rx_credits;
1426 1427

		security_sk_clone(parent, sk);
1428
	} else {
1429 1430 1431 1432 1433 1434
		switch (sk->sk_type) {
		case SOCK_RAW:
			chan->chan_type = L2CAP_CHAN_RAW;
			break;
		case SOCK_DGRAM:
			chan->chan_type = L2CAP_CHAN_CONN_LESS;
1435
			bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1436 1437 1438 1439 1440 1441 1442
			break;
		case SOCK_SEQPACKET:
		case SOCK_STREAM:
			chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
			break;
		}

1443 1444
		chan->imtu = L2CAP_DEFAULT_MTU;
		chan->omtu = 0;
1445
		if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1446
			chan->mode = L2CAP_MODE_ERTM;
1447
			set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1448
		} else {
1449
			chan->mode = L2CAP_MODE_BASIC;
1450
		}
1451 1452

		l2cap_chan_set_defaults(chan);
1453 1454 1455
	}

	/* Default config options */
1456
	chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1457 1458 1459

	chan->data = sk;
	chan->ops = &l2cap_chan_ops;
1460 1461 1462 1463 1464 1465 1466 1467
}

static struct proto l2cap_proto = {
	.name		= "L2CAP",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct l2cap_pinfo)
};

1468 1469
static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
				     int proto, gfp_t prio)
1470 1471
{
	struct sock *sk;
1472
	struct l2cap_chan *chan;
1473 1474 1475 1476 1477 1478 1479 1480 1481

	sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
	if (!sk)
		return NULL;

	sock_init_data(sock, sk);
	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);

	sk->sk_destruct = l2cap_sock_destruct;
1482
	sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1483 1484 1485 1486 1487 1488

	sock_reset_flag(sk, SOCK_ZAPPED);

	sk->sk_protocol = proto;
	sk->sk_state = BT_OPEN;

1489
	chan = l2cap_chan_create();
1490
	if (!chan) {
1491
		sk_free(sk);
1492 1493 1494
		return NULL;
	}

1495 1496
	l2cap_chan_hold(chan);

1497 1498
	l2cap_pi(sk)->chan = chan;

1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511
	return sk;
}

static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
			     int kern)
{
	struct sock *sk;

	BT_DBG("sock %p", sock);

	sock->state = SS_UNCONNECTED;

	if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1512
	    sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524
		return -ESOCKTNOSUPPORT;

	if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
		return -EPERM;

	sock->ops = &l2cap_sock_ops;

	sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
	if (!sk)
		return -ENOMEM;

	l2cap_sock_init(sk, NULL);
1525
	bt_sock_link(&l2cap_sk_list, sk);
1526 1527 1528
	return 0;
}

1529
static const struct proto_ops l2cap_sock_ops = {
1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= l2cap_sock_release,
	.bind		= l2cap_sock_bind,
	.connect	= l2cap_sock_connect,
	.listen		= l2cap_sock_listen,
	.accept		= l2cap_sock_accept,
	.getname	= l2cap_sock_getname,
	.sendmsg	= l2cap_sock_sendmsg,
	.recvmsg	= l2cap_sock_recvmsg,
	.poll		= bt_sock_poll,
	.ioctl		= bt_sock_ioctl,
	.mmap		= sock_no_mmap,
	.socketpair	= sock_no_socketpair,
	.shutdown	= l2cap_sock_shutdown,
	.setsockopt	= l2cap_sock_setsockopt,
	.getsockopt	= l2cap_sock_getsockopt
};

1549 1550 1551 1552 1553 1554 1555 1556
static const struct net_proto_family l2cap_sock_family_ops = {
	.family	= PF_BLUETOOTH,
	.owner	= THIS_MODULE,
	.create	= l2cap_sock_create,
};

int __init l2cap_init_sockets(void)
{
1557
	int err;
1558

1559 1560 1561
	err = proto_register(&l2cap_proto, 0);
	if (err < 0)
		return err;
1562

1563
	err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1564 1565
	if (err < 0) {
		BT_ERR("L2CAP socket registration failed");
1566
		goto error;
1567 1568
	}

1569
	err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1570
			     NULL);
1571 1572 1573 1574 1575
	if (err < 0) {
		BT_ERR("Failed to create L2CAP proc file");
		bt_sock_unregister(BTPROTO_L2CAP);
		goto error;
	}
1576

1577
	BT_INFO("L2CAP socket layer initialized");
1578

1579
	return 0;
1580 1581

error:
1582 1583
	proto_unregister(&l2cap_proto);
	return err;
1584 1585 1586 1587
}

void l2cap_cleanup_sockets(void)
{
1588
	bt_procfs_cleanup(&init_net, "l2cap");
1589
	bt_sock_unregister(BTPROTO_L2CAP);
1590
	proto_unregister(&l2cap_proto);
1591
}
1592 1593 1594

module_param(enable_lecoc, bool, 0644);
MODULE_PARM_DESC(enable_lecoc, "Enable support for LE CoC");