net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/export.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/l2cap.h>
  35 #include <net/bluetooth/smp.h>
  36
  37 static struct bt_sock_list l2cap_sk_list = {
  38         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  39 };
  40
  41 static const struct proto_ops l2cap_sock_ops;
  42 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  43 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  44                                      int proto, gfp_t prio);
  45
  46 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  47 {
  48         struct sock *sk = sock->sk;
  49         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  50         struct sockaddr_l2 la;
  51         int len, err = 0;
  52
  53         BT_DBG("sk %p", sk);
  54
  55         if (!addr || addr->sa_family != AF_BLUETOOTH)
  56                 return -EINVAL;
  57
  58         memset(&la, 0, sizeof(la));
  59         len = min_t(unsigned int, sizeof(la), alen);
  60         memcpy(&la, addr, len);
  61
  62         if (la.l2_cid && la.l2_psm)
  63                 return -EINVAL;
  64
  65         lock_sock(sk);
  66
  67         if (sk->sk_state != BT_OPEN) {
  68                 err = -EBADFD;
  69                 goto done;
  70         }
  71
  72         if (la.l2_psm) {
  73                 __u16 psm = __le16_to_cpu(la.l2_psm);
  74
  75                 /* PSM must be odd and lsb of upper byte must be 0 */
  76                 if ((psm & 0x0101) != 0x0001) {
  77                         err = -EINVAL;
  78                         goto done;
  79                 }
  80
  81                 /* Restrict usage of well-known PSMs */
  82                 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
  83                         err = -EACCES;
  84                         goto done;
  85                 }
  86         }
  87
  88         if (la.l2_cid)
  89                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
  90         else
  91                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
  92
  93         if (err < 0)
  94                 goto done;
  95
  96         if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
  97             __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
  98                 chan->sec_level = BT_SECURITY_SDP;
  99
 100         bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 101
 102         chan->state = BT_BOUND;
 103         sk->sk_state = BT_BOUND;
 104
 105 done:
 106         release_sock(sk);
 107         return err;
 108 }
 109
 110 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 111                               int alen, int flags)
 112 {
 113         struct sock *sk = sock->sk;
 114         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 115         struct sockaddr_l2 la;
 116         int len, err = 0;
 117
 118         BT_DBG("sk %p", sk);
 119
 120         if (!addr || alen < sizeof(addr->sa_family) ||
 121             addr->sa_family != AF_BLUETOOTH)
 122                 return -EINVAL;
 123
 124         memset(&la, 0, sizeof(la));
 125         len = min_t(unsigned int, sizeof(la), alen);
 126         memcpy(&la, addr, len);
 127
 128         if (la.l2_cid && la.l2_psm)
 129                 return -EINVAL;
 130
 131         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 132                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 133         if (err)
 134                 return err;
 135
 136         lock_sock(sk);
 137
 138         err = bt_sock_wait_state(sk, BT_CONNECTED,
 139                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 140
 141         release_sock(sk);
 142
 143         return err;
 144 }
 145
 146 static int l2cap_sock_listen(struct socket *sock, int backlog)
 147 {
 148         struct sock *sk = sock->sk;
 149         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 150         int err = 0;
 151
 152         BT_DBG("sk %p backlog %d", sk, backlog);
 153
 154         lock_sock(sk);
 155
 156         if (sk->sk_state != BT_BOUND) {
 157                 err = -EBADFD;
 158                 goto done;
 159         }
 160
 161         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 162                 err = -EINVAL;
 163                 goto done;
 164         }
 165
 166         switch (chan->mode) {
 167         case L2CAP_MODE_BASIC:
 168                 break;
 169         case L2CAP_MODE_ERTM:
 170         case L2CAP_MODE_STREAMING:
 171                 if (!disable_ertm)
 172                         break;
 173                 /* fall through */
 174         default:
 175                 err = -ENOTSUPP;
 176                 goto done;
 177         }
 178
 179         sk->sk_max_ack_backlog = backlog;
 180         sk->sk_ack_backlog = 0;
 181
 182         chan->state = BT_LISTEN;
 183         sk->sk_state = BT_LISTEN;
 184
 185 done:
 186         release_sock(sk);
 187         return err;
 188 }
 189
 190 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 191                              int flags)
 192 {
 193         DECLARE_WAITQUEUE(wait, current);
 194         struct sock *sk = sock->sk, *nsk;
 195         long timeo;
 196         int err = 0;
 197
 198         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 199
 200         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 201
 202         BT_DBG("sk %p timeo %ld", sk, timeo);
 203
 204         /* Wait for an incoming connection. (wake-one). */
 205         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 206         while (1) {
 207                 set_current_state(TASK_INTERRUPTIBLE);
 208
 209                 if (sk->sk_state != BT_LISTEN) {
 210                         err = -EBADFD;
 211                         break;
 212                 }
 213
 214                 nsk = bt_accept_dequeue(sk, newsock);
 215                 if (nsk)
 216                         break;
 217
 218                 if (!timeo) {
 219                         err = -EAGAIN;
 220                         break;
 221                 }
 222
 223                 if (signal_pending(current)) {
 224                         err = sock_intr_errno(timeo);
 225                         break;
 226                 }
 227
 228                 release_sock(sk);
 229                 timeo = schedule_timeout(timeo);
 230                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 231         }
 232         __set_current_state(TASK_RUNNING);
 233         remove_wait_queue(sk_sleep(sk), &wait);
 234
 235         if (err)
 236                 goto done;
 237
 238         newsock->state = SS_CONNECTED;
 239
 240         BT_DBG("new socket %p", nsk);
 241
 242 done:
 243         release_sock(sk);
 244         return err;
 245 }
 246
 247 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 248                               int *len, int peer)
 249 {
 250         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 251         struct sock *sk = sock->sk;
 252         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 253
 254         BT_DBG("sock %p, sk %p", sock, sk);
 255
 256         memset(la, 0, sizeof(struct sockaddr_l2));
 257         addr->sa_family = AF_BLUETOOTH;
 258         *len = sizeof(struct sockaddr_l2);
 259
 260         if (peer) {
 261                 la->l2_psm = chan->psm;
 262                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
 263                 la->l2_cid = cpu_to_le16(chan->dcid);
 264         } else {
 265                 la->l2_psm = chan->sport;
 266                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
 267                 la->l2_cid = cpu_to_le16(chan->scid);
 268         }
 269
 270         return 0;
 271 }
 272
 273 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 274                                      char __user *optval, int __user *optlen)
 275 {
 276         struct sock *sk = sock->sk;
 277         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 278         struct l2cap_options opts;
 279         struct l2cap_conninfo cinfo;
 280         int len, err = 0;
 281         u32 opt;
 282
 283         BT_DBG("sk %p", sk);
 284
 285         if (get_user(len, optlen))
 286                 return -EFAULT;
 287
 288         lock_sock(sk);
 289
 290         switch (optname) {
 291         case L2CAP_OPTIONS:
 292                 memset(&opts, 0, sizeof(opts));
 293                 opts.imtu     = chan->imtu;
 294                 opts.omtu     = chan->omtu;
 295                 opts.flush_to = chan->flush_to;
 296                 opts.mode     = chan->mode;
 297                 opts.fcs      = chan->fcs;
 298                 opts.max_tx   = chan->max_tx;
 299                 opts.txwin_size = chan->tx_win;
 300
 301                 len = min_t(unsigned int, len, sizeof(opts));
 302                 if (copy_to_user(optval, (char *) &opts, len))
 303                         err = -EFAULT;
 304
 305                 break;
 306
 307         case L2CAP_LM:
 308                 switch (chan->sec_level) {
 309                 case BT_SECURITY_LOW:
 310                         opt = L2CAP_LM_AUTH;
 311                         break;
 312                 case BT_SECURITY_MEDIUM:
 313                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 314                         break;
 315                 case BT_SECURITY_HIGH:
 316                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 317                               L2CAP_LM_SECURE;
 318                         break;
 319                 default:
 320                         opt = 0;
 321                         break;
 322                 }
 323
 324                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 325                         opt |= L2CAP_LM_MASTER;
 326
 327                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 328                         opt |= L2CAP_LM_RELIABLE;
 329
 330                 if (put_user(opt, (u32 __user *) optval))
 331                         err = -EFAULT;
 332                 break;
 333
 334         case L2CAP_CONNINFO:
 335                 if (sk->sk_state != BT_CONNECTED &&
 336                     !(sk->sk_state == BT_CONNECT2 &&
 337                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 338                         err = -ENOTCONN;
 339                         break;
 340                 }
 341
 342                 memset(&cinfo, 0, sizeof(cinfo));
 343                 cinfo.hci_handle = chan->conn->hcon->handle;
 344                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 345
 346                 len = min_t(unsigned int, len, sizeof(cinfo));
 347                 if (copy_to_user(optval, (char *) &cinfo, len))
 348                         err = -EFAULT;
 349
 350                 break;
 351
 352         default:
 353                 err = -ENOPROTOOPT;
 354                 break;
 355         }
 356
 357         release_sock(sk);
 358         return err;
 359 }
 360
 361 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 362                                  char __user *optval, int __user *optlen)
 363 {
 364         struct sock *sk = sock->sk;
 365         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 366         struct bt_security sec;
 367         struct bt_power pwr;
 368         int len, err = 0;
 369
 370         BT_DBG("sk %p", sk);
 371
 372         if (level == SOL_L2CAP)
 373                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 374
 375         if (level != SOL_BLUETOOTH)
 376                 return -ENOPROTOOPT;
 377
 378         if (get_user(len, optlen))
 379                 return -EFAULT;
 380
 381         lock_sock(sk);
 382
 383         switch (optname) {
 384         case BT_SECURITY:
 385                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 386                     chan->chan_type != L2CAP_CHAN_RAW) {
 387                         err = -EINVAL;
 388                         break;
 389                 }
 390
 391                 memset(&sec, 0, sizeof(sec));
 392                 if (chan->conn) {
 393                         sec.level = chan->conn->hcon->sec_level;
 394
 395                         if (sk->sk_state == BT_CONNECTED)
 396                                 sec.key_size = chan->conn->hcon->enc_key_size;
 397                 } else {
 398                         sec.level = chan->sec_level;
 399                 }
 400
 401                 len = min_t(unsigned int, len, sizeof(sec));
 402                 if (copy_to_user(optval, (char *) &sec, len))
 403                         err = -EFAULT;
 404
 405                 break;
 406
 407         case BT_DEFER_SETUP:
 408                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 409                         err = -EINVAL;
 410                         break;
 411                 }
 412
 413                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 414                              (u32 __user *) optval))
 415                         err = -EFAULT;
 416
 417                 break;
 418
 419         case BT_FLUSHABLE:
 420                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 421                              (u32 __user *) optval))
 422                         err = -EFAULT;
 423
 424                 break;
 425
 426         case BT_POWER:
 427                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 428                     && sk->sk_type != SOCK_RAW) {
 429                         err = -EINVAL;
 430                         break;
 431                 }
 432
 433                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 434
 435                 len = min_t(unsigned int, len, sizeof(pwr));
 436                 if (copy_to_user(optval, (char *) &pwr, len))
 437                         err = -EFAULT;
 438
 439                 break;
 440
 441         case BT_CHANNEL_POLICY:
 442                 if (!enable_hs) {
 443                         err = -ENOPROTOOPT;
 444                         break;
 445                 }
 446
 447                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 448                         err = -EFAULT;
 449                 break;
 450
 451         default:
 452                 err = -ENOPROTOOPT;
 453                 break;
 454         }
 455
 456         release_sock(sk);
 457         return err;
 458 }
 459
 460 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 461 {
 462         switch (chan->scid) {
 463         case L2CAP_CID_LE_DATA:
 464                 if (mtu < L2CAP_LE_MIN_MTU)
 465                         return false;
 466                 break;
 467
 468         default:
 469                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 470                         return false;
 471         }
 472
 473         return true;
 474 }
 475
 476 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 477                                      char __user *optval, unsigned int optlen)
 478 {
 479         struct sock *sk = sock->sk;
 480         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 481         struct l2cap_options opts;
 482         int len, err = 0;
 483         u32 opt;
 484
 485         BT_DBG("sk %p", sk);
 486
 487         lock_sock(sk);
 488
 489         switch (optname) {
 490         case L2CAP_OPTIONS:
 491                 if (sk->sk_state == BT_CONNECTED) {
 492                         err = -EINVAL;
 493                         break;
 494                 }
 495
 496                 opts.imtu     = chan->imtu;
 497                 opts.omtu     = chan->omtu;
 498                 opts.flush_to = chan->flush_to;
 499                 opts.mode     = chan->mode;
 500                 opts.fcs      = chan->fcs;
 501                 opts.max_tx   = chan->max_tx;
 502                 opts.txwin_size = chan->tx_win;
 503
 504                 len = min_t(unsigned int, sizeof(opts), optlen);
 505                 if (copy_from_user((char *) &opts, optval, len)) {
 506                         err = -EFAULT;
 507                         break;
 508                 }
 509
 510                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 511                         err = -EINVAL;
 512                         break;
 513                 }
 514
 515                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 516                         err = -EINVAL;
 517                         break;
 518                 }
 519
 520                 chan->mode = opts.mode;
 521                 switch (chan->mode) {
 522                 case L2CAP_MODE_BASIC:
 523                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 524                         break;
 525                 case L2CAP_MODE_ERTM:
 526                 case L2CAP_MODE_STREAMING:
 527                         if (!disable_ertm)
 528                                 break;
 529                         /* fall through */
 530                 default:
 531                         err = -EINVAL;
 532                         break;
 533                 }
 534
 535                 chan->imtu = opts.imtu;
 536                 chan->omtu = opts.omtu;
 537                 chan->fcs  = opts.fcs;
 538                 chan->max_tx = opts.max_tx;
 539                 chan->tx_win = opts.txwin_size;
 540                 chan->flush_to = opts.flush_to;
 541                 break;
 542
 543         case L2CAP_LM:
 544                 if (get_user(opt, (u32 __user *) optval)) {
 545                         err = -EFAULT;
 546                         break;
 547                 }
 548
 549                 if (opt & L2CAP_LM_AUTH)
 550                         chan->sec_level = BT_SECURITY_LOW;
 551                 if (opt & L2CAP_LM_ENCRYPT)
 552                         chan->sec_level = BT_SECURITY_MEDIUM;
 553                 if (opt & L2CAP_LM_SECURE)
 554                         chan->sec_level = BT_SECURITY_HIGH;
 555
 556                 if (opt & L2CAP_LM_MASTER)
 557                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 558                 else
 559                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 560
 561                 if (opt & L2CAP_LM_RELIABLE)
 562                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 563                 else
 564                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 565                 break;
 566
 567         default:
 568                 err = -ENOPROTOOPT;
 569                 break;
 570         }
 571
 572         release_sock(sk);
 573         return err;
 574 }
 575
 576 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 577                                  char __user *optval, unsigned int optlen)
 578 {
 579         struct sock *sk = sock->sk;
 580         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 581         struct bt_security sec;
 582         struct bt_power pwr;
 583         struct l2cap_conn *conn;
 584         int len, err = 0;
 585         u32 opt;
 586
 587         BT_DBG("sk %p", sk);
 588
 589         if (level == SOL_L2CAP)
 590                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 591
 592         if (level != SOL_BLUETOOTH)
 593                 return -ENOPROTOOPT;
 594
 595         lock_sock(sk);
 596
 597         switch (optname) {
 598         case BT_SECURITY:
 599                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 600                     chan->chan_type != L2CAP_CHAN_RAW) {
 601                         err = -EINVAL;
 602                         break;
 603                 }
 604
 605                 sec.level = BT_SECURITY_LOW;
 606
 607                 len = min_t(unsigned int, sizeof(sec), optlen);
 608                 if (copy_from_user((char *) &sec, optval, len)) {
 609                         err = -EFAULT;
 610                         break;
 611                 }
 612
 613                 if (sec.level < BT_SECURITY_LOW ||
 614                     sec.level > BT_SECURITY_HIGH) {
 615                         err = -EINVAL;
 616                         break;
 617                 }
 618
 619                 chan->sec_level = sec.level;
 620
 621                 if (!chan->conn)
 622                         break;
 623
 624                 conn = chan->conn;
 625
 626                 /*change security for LE channels */
 627                 if (chan->scid == L2CAP_CID_LE_DATA) {
 628                         if (!conn->hcon->out) {
 629                                 err = -EINVAL;
 630                                 break;
 631                         }
 632
 633                         if (smp_conn_security(conn->hcon, sec.level))
 634                                 break;
 635                         sk->sk_state = BT_CONFIG;
 636                         chan->state = BT_CONFIG;
 637
 638                 /* or for ACL link */
 639                 } else if ((sk->sk_state == BT_CONNECT2 &&
 640                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 641                            sk->sk_state == BT_CONNECTED) {
 642                         if (!l2cap_chan_check_security(chan))
 643                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 644                         else
 645                                 sk->sk_state_change(sk);
 646                 } else {
 647                         err = -EINVAL;
 648                 }
 649                 break;
 650
 651         case BT_DEFER_SETUP:
 652                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 653                         err = -EINVAL;
 654                         break;
 655                 }
 656
 657                 if (get_user(opt, (u32 __user *) optval)) {
 658                         err = -EFAULT;
 659                         break;
 660                 }
 661
 662                 if (opt)
 663                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 664                 else
 665                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 666                 break;
 667
 668         case BT_FLUSHABLE:
 669                 if (get_user(opt, (u32 __user *) optval)) {
 670                         err = -EFAULT;
 671                         break;
 672                 }
 673
 674                 if (opt > BT_FLUSHABLE_ON) {
 675                         err = -EINVAL;
 676                         break;
 677                 }
 678
 679                 if (opt == BT_FLUSHABLE_OFF) {
 680                         struct l2cap_conn *conn = chan->conn;
 681                         /* proceed further only when we have l2cap_conn and
 682                            No Flush support in the LM */
 683                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 684                                 err = -EINVAL;
 685                                 break;
 686                         }
 687                 }
 688
 689                 if (opt)
 690                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 691                 else
 692                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 693                 break;
 694
 695         case BT_POWER:
 696                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 697                     chan->chan_type != L2CAP_CHAN_RAW) {
 698                         err = -EINVAL;
 699                         break;
 700                 }
 701
 702                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 703
 704                 len = min_t(unsigned int, sizeof(pwr), optlen);
 705                 if (copy_from_user((char *) &pwr, optval, len)) {
 706                         err = -EFAULT;
 707                         break;
 708                 }
 709
 710                 if (pwr.force_active)
 711                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 712                 else
 713                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 714                 break;
 715
 716         case BT_CHANNEL_POLICY:
 717                 if (!enable_hs) {
 718                         err = -ENOPROTOOPT;
 719                         break;
 720                 }
 721
 722                 if (get_user(opt, (u32 __user *) optval)) {
 723                         err = -EFAULT;
 724                         break;
 725                 }
 726
 727                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 728                         err = -EINVAL;
 729                         break;
 730                 }
 731
 732                 if (chan->mode != L2CAP_MODE_ERTM &&
 733                     chan->mode != L2CAP_MODE_STREAMING) {
 734                         err = -EOPNOTSUPP;
 735                         break;
 736                 }
 737
 738                 chan->chan_policy = (u8) opt;
 739                 break;
 740
 741         default:
 742                 err = -ENOPROTOOPT;
 743                 break;
 744         }
 745
 746         release_sock(sk);
 747         return err;
 748 }
 749
 750 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 751                               struct msghdr *msg, size_t len)
 752 {
 753         struct sock *sk = sock->sk;
 754         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 755         int err;
 756
 757         BT_DBG("sock %p, sk %p", sock, sk);
 758
 759         err = sock_error(sk);
 760         if (err)
 761                 return err;
 762
 763         if (msg->msg_flags & MSG_OOB)
 764                 return -EOPNOTSUPP;
 765
 766         if (sk->sk_state != BT_CONNECTED)
 767                 return -ENOTCONN;
 768
 769         l2cap_chan_lock(chan);
 770         err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
 771         l2cap_chan_unlock(chan);
 772
 773         return err;
 774 }
 775
 776 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 777                               struct msghdr *msg, size_t len, int flags)
 778 {
 779         struct sock *sk = sock->sk;
 780         struct l2cap_pinfo *pi = l2cap_pi(sk);
 781         int err;
 782
 783         lock_sock(sk);
 784
 785         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 786                                                     &bt_sk(sk)->flags)) {
 787                 sk->sk_state = BT_CONFIG;
 788                 pi->chan->state = BT_CONFIG;
 789
 790                 __l2cap_connect_rsp_defer(pi->chan);
 791                 release_sock(sk);
 792                 return 0;
 793         }
 794
 795         release_sock(sk);
 796
 797         if (sock->type == SOCK_STREAM)
 798                 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
 799         else
 800                 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
 801
 802         if (pi->chan->mode != L2CAP_MODE_ERTM)
 803                 return err;
 804
 805         /* Attempt to put pending rx data in the socket buffer */
 806
 807         lock_sock(sk);
 808
 809         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
 810                 goto done;
 811
 812         if (pi->rx_busy_skb) {
 813                 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
 814                         pi->rx_busy_skb = NULL;
 815                 else
 816                         goto done;
 817         }
 818
 819         /* Restore data flow when half of the receive buffer is
 820          * available.  This avoids resending large numbers of
 821          * frames.
 822          */
 823         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
 824                 l2cap_chan_busy(pi->chan, 0);
 825
 826 done:
 827         release_sock(sk);
 828         return err;
 829 }
 830
 831 /* Kill socket (only if zapped and orphan)
 832  * Must be called on unlocked socket.
 833  */
 834 static void l2cap_sock_kill(struct sock *sk)
 835 {
 836         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 837                 return;
 838
 839         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
 840
 841         /* Kill poor orphan */
 842
 843         l2cap_chan_put(l2cap_pi(sk)->chan);
 844         sock_set_flag(sk, SOCK_DEAD);
 845         sock_put(sk);
 846 }
 847
 848 static int l2cap_sock_shutdown(struct socket *sock, int how)
 849 {
 850         struct sock *sk = sock->sk;
 851         struct l2cap_chan *chan;
 852         struct l2cap_conn *conn;
 853         int err = 0;
 854
 855         BT_DBG("sock %p, sk %p", sock, sk);
 856
 857         if (!sk)
 858                 return 0;
 859
 860         chan = l2cap_pi(sk)->chan;
 861         conn = chan->conn;
 862
 863         if (conn)
 864                 mutex_lock(&conn->chan_lock);
 865
 866         l2cap_chan_lock(chan);
 867         lock_sock(sk);
 868
 869         if (!sk->sk_shutdown) {
 870                 if (chan->mode == L2CAP_MODE_ERTM)
 871                         err = __l2cap_wait_ack(sk);
 872
 873                 sk->sk_shutdown = SHUTDOWN_MASK;
 874
 875                 release_sock(sk);
 876                 l2cap_chan_close(chan, 0);
 877                 lock_sock(sk);
 878
 879                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 880                         err = bt_sock_wait_state(sk, BT_CLOSED,
 881                                                  sk->sk_lingertime);
 882         }
 883
 884         if (!err && sk->sk_err)
 885                 err = -sk->sk_err;
 886
 887         release_sock(sk);
 888         l2cap_chan_unlock(chan);
 889
 890         if (conn)
 891                 mutex_unlock(&conn->chan_lock);
 892
 893         return err;
 894 }
 895
 896 static int l2cap_sock_release(struct socket *sock)
 897 {
 898         struct sock *sk = sock->sk;
 899         int err;
 900
 901         BT_DBG("sock %p, sk %p", sock, sk);
 902
 903         if (!sk)
 904                 return 0;
 905
 906         bt_sock_unlink(&l2cap_sk_list, sk);
 907
 908         err = l2cap_sock_shutdown(sock, 2);
 909
 910         sock_orphan(sk);
 911         l2cap_sock_kill(sk);
 912         return err;
 913 }
 914
 915 static void l2cap_sock_cleanup_listen(struct sock *parent)
 916 {
 917         struct sock *sk;
 918
 919         BT_DBG("parent %p", parent);
 920
 921         /* Close not yet accepted channels */
 922         while ((sk = bt_accept_dequeue(parent, NULL))) {
 923                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 924
 925                 l2cap_chan_lock(chan);
 926                 __clear_chan_timer(chan);
 927                 l2cap_chan_close(chan, ECONNRESET);
 928                 l2cap_chan_unlock(chan);
 929
 930                 l2cap_sock_kill(sk);
 931         }
 932 }
 933
 934 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
 935 {
 936         struct sock *sk, *parent = chan->data;
 937
 938         /* Check for backlog size */
 939         if (sk_acceptq_is_full(parent)) {
 940                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 941                 return NULL;
 942         }
 943
 944         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
 945                               GFP_ATOMIC);
 946         if (!sk)
 947                 return NULL;
 948
 949         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
 950
 951         l2cap_sock_init(sk, parent);
 952
 953         bt_accept_enqueue(parent, sk);
 954
 955         return l2cap_pi(sk)->chan;
 956 }
 957
 958 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
 959 {
 960         int err;
 961         struct sock *sk = chan->data;
 962         struct l2cap_pinfo *pi = l2cap_pi(sk);
 963
 964         lock_sock(sk);
 965
 966         if (pi->rx_busy_skb) {
 967                 err = -ENOMEM;
 968                 goto done;
 969         }
 970
 971         err = sock_queue_rcv_skb(sk, skb);
 972
 973         /* For ERTM, handle one skb that doesn't fit into the recv
 974          * buffer.  This is important to do because the data frames
 975          * have already been acked, so the skb cannot be discarded.
 976          *
 977          * Notify the l2cap core that the buffer is full, so the
 978          * LOCAL_BUSY state is entered and no more frames are
 979          * acked and reassembled until there is buffer space
 980          * available.
 981          */
 982         if (err < 0 && pi->chan->mode == L2CAP_MODE_ERTM) {
 983                 pi->rx_busy_skb = skb;
 984                 l2cap_chan_busy(pi->chan, 1);
 985                 err = 0;
 986         }
 987
 988 done:
 989         release_sock(sk);
 990
 991         return err;
 992 }
 993
 994 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
 995 {
 996         struct sock *sk = chan->data;
 997
 998         l2cap_sock_kill(sk);
 999 }
1000
1001 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1002 {
1003         struct sock *sk = chan->data;
1004         struct sock *parent;
1005
1006         lock_sock(sk);
1007
1008         parent = bt_sk(sk)->parent;
1009
1010         sock_set_flag(sk, SOCK_ZAPPED);
1011
1012         switch (chan->state) {
1013         case BT_OPEN:
1014         case BT_BOUND:
1015         case BT_CLOSED:
1016                 break;
1017         case BT_LISTEN:
1018                 l2cap_sock_cleanup_listen(sk);
1019                 sk->sk_state = BT_CLOSED;
1020                 chan->state = BT_CLOSED;
1021
1022                 break;
1023         default:
1024                 sk->sk_state = BT_CLOSED;
1025                 chan->state = BT_CLOSED;
1026
1027                 sk->sk_err = err;
1028
1029                 if (parent) {
1030                         bt_accept_unlink(sk);
1031                         parent->sk_data_ready(parent, 0);
1032                 } else {
1033                         sk->sk_state_change(sk);
1034                 }
1035
1036                 break;
1037         }
1038
1039         release_sock(sk);
1040 }
1041
1042 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state)
1043 {
1044         struct sock *sk = chan->data;
1045
1046         sk->sk_state = state;
1047 }
1048
1049 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1050                                                unsigned long len, int nb)
1051 {
1052         struct sk_buff *skb;
1053         int err;
1054
1055         l2cap_chan_unlock(chan);
1056         skb = bt_skb_send_alloc(chan->sk, len, nb, &err);
1057         l2cap_chan_lock(chan);
1058
1059         if (!skb)
1060                 return ERR_PTR(err);
1061
1062         return skb;
1063 }
1064
1065 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1066 {
1067         struct sock *sk = chan->data;
1068         struct sock *parent;
1069
1070         lock_sock(sk);
1071
1072         parent = bt_sk(sk)->parent;
1073
1074         BT_DBG("sk %p, parent %p", sk, parent);
1075
1076         sk->sk_state = BT_CONNECTED;
1077         sk->sk_state_change(sk);
1078
1079         if (parent)
1080                 parent->sk_data_ready(parent, 0);
1081
1082         release_sock(sk);
1083 }
1084
1085 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1086 {
1087         struct sock *sk = chan->data;
1088         struct sock *parent = bt_sk(sk)->parent;
1089
1090         if (parent)
1091                 parent->sk_data_ready(parent, 0);
1092 }
1093
1094 static struct l2cap_ops l2cap_chan_ops = {
1095         .name           = "L2CAP Socket Interface",
1096         .new_connection = l2cap_sock_new_connection_cb,
1097         .recv           = l2cap_sock_recv_cb,
1098         .close          = l2cap_sock_close_cb,
1099         .teardown       = l2cap_sock_teardown_cb,
1100         .state_change   = l2cap_sock_state_change_cb,
1101         .ready          = l2cap_sock_ready_cb,
1102         .defer          = l2cap_sock_defer_cb,
1103         .alloc_skb      = l2cap_sock_alloc_skb_cb,
1104 };
1105
1106 static void l2cap_sock_destruct(struct sock *sk)
1107 {
1108         BT_DBG("sk %p", sk);
1109
1110         if (l2cap_pi(sk)->chan)
1111                 l2cap_chan_put(l2cap_pi(sk)->chan);
1112         if (l2cap_pi(sk)->rx_busy_skb) {
1113                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1114                 l2cap_pi(sk)->rx_busy_skb = NULL;
1115         }
1116
1117         skb_queue_purge(&sk->sk_receive_queue);
1118         skb_queue_purge(&sk->sk_write_queue);
1119 }
1120
1121 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1122 {
1123         struct l2cap_pinfo *pi = l2cap_pi(sk);
1124         struct l2cap_chan *chan = pi->chan;
1125
1126         BT_DBG("sk %p", sk);
1127
1128         if (parent) {
1129                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1130
1131                 sk->sk_type = parent->sk_type;
1132                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1133
1134                 chan->chan_type = pchan->chan_type;
1135                 chan->imtu = pchan->imtu;
1136                 chan->omtu = pchan->omtu;
1137                 chan->conf_state = pchan->conf_state;
1138                 chan->mode = pchan->mode;
1139                 chan->fcs  = pchan->fcs;
1140                 chan->max_tx = pchan->max_tx;
1141                 chan->tx_win = pchan->tx_win;
1142                 chan->tx_win_max = pchan->tx_win_max;
1143                 chan->sec_level = pchan->sec_level;
1144                 chan->flags = pchan->flags;
1145
1146                 security_sk_clone(parent, sk);
1147         } else {
1148
1149                 switch (sk->sk_type) {
1150                 case SOCK_RAW:
1151                         chan->chan_type = L2CAP_CHAN_RAW;
1152                         break;
1153                 case SOCK_DGRAM:
1154                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1155                         break;
1156                 case SOCK_SEQPACKET:
1157                 case SOCK_STREAM:
1158                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1159                         break;
1160                 }
1161
1162                 chan->imtu = L2CAP_DEFAULT_MTU;
1163                 chan->omtu = 0;
1164                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1165                         chan->mode = L2CAP_MODE_ERTM;
1166                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1167                 } else {
1168                         chan->mode = L2CAP_MODE_BASIC;
1169                 }
1170
1171                 l2cap_chan_set_defaults(chan);
1172         }
1173
1174         /* Default config options */
1175         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1176
1177         chan->data = sk;
1178         chan->ops = &l2cap_chan_ops;
1179 }
1180
1181 static struct proto l2cap_proto = {
1182         .name           = "L2CAP",
1183         .owner          = THIS_MODULE,
1184         .obj_size       = sizeof(struct l2cap_pinfo)
1185 };
1186
1187 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1188                                      int proto, gfp_t prio)
1189 {
1190         struct sock *sk;
1191         struct l2cap_chan *chan;
1192
1193         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1194         if (!sk)
1195                 return NULL;
1196
1197         sock_init_data(sock, sk);
1198         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1199
1200         sk->sk_destruct = l2cap_sock_destruct;
1201         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1202
1203         sock_reset_flag(sk, SOCK_ZAPPED);
1204
1205         sk->sk_protocol = proto;
1206         sk->sk_state = BT_OPEN;
1207
1208         chan = l2cap_chan_create();
1209         if (!chan) {
1210                 sk_free(sk);
1211                 return NULL;
1212         }
1213
1214         l2cap_chan_hold(chan);
1215
1216         chan->sk = sk;
1217
1218         l2cap_pi(sk)->chan = chan;
1219
1220         return sk;
1221 }
1222
1223 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1224                              int kern)
1225 {
1226         struct sock *sk;
1227
1228         BT_DBG("sock %p", sock);
1229
1230         sock->state = SS_UNCONNECTED;
1231
1232         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1233             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1234                 return -ESOCKTNOSUPPORT;
1235
1236         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1237                 return -EPERM;
1238
1239         sock->ops = &l2cap_sock_ops;
1240
1241         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1242         if (!sk)
1243                 return -ENOMEM;
1244
1245         l2cap_sock_init(sk, NULL);
1246         bt_sock_link(&l2cap_sk_list, sk);
1247         return 0;
1248 }
1249
1250 static const struct proto_ops l2cap_sock_ops = {
1251         .family         = PF_BLUETOOTH,
1252         .owner          = THIS_MODULE,
1253         .release        = l2cap_sock_release,
1254         .bind           = l2cap_sock_bind,
1255         .connect        = l2cap_sock_connect,
1256         .listen         = l2cap_sock_listen,
1257         .accept         = l2cap_sock_accept,
1258         .getname        = l2cap_sock_getname,
1259         .sendmsg        = l2cap_sock_sendmsg,
1260         .recvmsg        = l2cap_sock_recvmsg,
1261         .poll           = bt_sock_poll,
1262         .ioctl          = bt_sock_ioctl,
1263         .mmap           = sock_no_mmap,
1264         .socketpair     = sock_no_socketpair,
1265         .shutdown       = l2cap_sock_shutdown,
1266         .setsockopt     = l2cap_sock_setsockopt,
1267         .getsockopt     = l2cap_sock_getsockopt
1268 };
1269
1270 static const struct net_proto_family l2cap_sock_family_ops = {
1271         .family = PF_BLUETOOTH,
1272         .owner  = THIS_MODULE,
1273         .create = l2cap_sock_create,
1274 };
1275
1276 int __init l2cap_init_sockets(void)
1277 {
1278         int err;
1279
1280         err = proto_register(&l2cap_proto, 0);
1281         if (err < 0)
1282                 return err;
1283
1284         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1285         if (err < 0) {
1286                 BT_ERR("L2CAP socket registration failed");
1287                 goto error;
1288         }
1289
1290         err = bt_procfs_init(THIS_MODULE, &init_net, "l2cap", &l2cap_sk_list,
1291                              NULL);
1292         if (err < 0) {
1293                 BT_ERR("Failed to create L2CAP proc file");
1294                 bt_sock_unregister(BTPROTO_L2CAP);
1295                 goto error;
1296         }
1297
1298         BT_INFO("L2CAP socket layer initialized");
1299
1300         return 0;
1301
1302 error:
1303         proto_unregister(&l2cap_proto);
1304         return err;
1305 }
1306
1307 void l2cap_cleanup_sockets(void)
1308 {
1309         bt_procfs_cleanup(&init_net, "l2cap");
1310         if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
1311                 BT_ERR("L2CAP socket unregistration failed");
1312
1313         proto_unregister(&l2cap_proto);
1314 }