net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6
   7    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License version 2 as
  11    published by the Free Software Foundation;
  12
  13    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  14    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  15    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  16    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  17    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  18    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  19    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  20    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  21
  22    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  23    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  24    SOFTWARE IS DISCLAIMED.
  25 */
  26
  27 /* Bluetooth L2CAP sockets. */
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/l2cap.h>
  32
  33 static void l2cap_sock_timeout(unsigned long arg)
  34 {
  35         struct sock *sk = (struct sock *) arg;
  36         int reason;
  37
  38         BT_DBG("sock %p state %d", sk, sk->sk_state);
  39
  40         bh_lock_sock(sk);
  41
  42         if (sock_owned_by_user(sk)) {
  43                 /* sk is owned by user. Try again later */
  44                 l2cap_sock_set_timer(sk, HZ / 5);
  45                 bh_unlock_sock(sk);
  46                 sock_put(sk);
  47                 return;
  48         }
  49
  50         if (sk->sk_state == BT_CONNECTED || sk->sk_state == BT_CONFIG)
  51                 reason = ECONNREFUSED;
  52         else if (sk->sk_state == BT_CONNECT &&
  53                                 l2cap_pi(sk)->sec_level != BT_SECURITY_SDP)
  54                 reason = ECONNREFUSED;
  55         else
  56                 reason = ETIMEDOUT;
  57
  58         __l2cap_sock_close(sk, reason);
  59
  60         bh_unlock_sock(sk);
  61
  62         l2cap_sock_kill(sk);
  63         sock_put(sk);
  64 }
  65
  66 static struct sock *__l2cap_get_sock_by_addr(__le16 psm, bdaddr_t *src)
  67 {
  68         struct sock *sk;
  69         struct hlist_node *node;
  70         sk_for_each(sk, node, &l2cap_sk_list.head)
  71                 if (l2cap_pi(sk)->sport == psm && !bacmp(&bt_sk(sk)->src, src))
  72                         goto found;
  73         sk = NULL;
  74 found:
  75         return sk;
  76 }
  77
  78 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  79 {
  80         struct sock *sk = sock->sk;
  81         struct sockaddr_l2 la;
  82         int len, err = 0;
  83
  84         BT_DBG("sk %p", sk);
  85
  86         if (!addr || addr->sa_family != AF_BLUETOOTH)
  87                 return -EINVAL;
  88
  89         memset(&la, 0, sizeof(la));
  90         len = min_t(unsigned int, sizeof(la), alen);
  91         memcpy(&la, addr, len);
  92
  93         if (la.l2_cid)
  94                 return -EINVAL;
  95
  96         lock_sock(sk);
  97
  98         if (sk->sk_state != BT_OPEN) {
  99                 err = -EBADFD;
 100                 goto done;
 101         }
 102
 103         if (la.l2_psm) {
 104                 __u16 psm = __le16_to_cpu(la.l2_psm);
 105
 106                 /* PSM must be odd and lsb of upper byte must be 0 */
 107                 if ((psm & 0x0101) != 0x0001) {
 108                         err = -EINVAL;
 109                         goto done;
 110                 }
 111
 112                 /* Restrict usage of well-known PSMs */
 113                 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE)) {
 114                         err = -EACCES;
 115                         goto done;
 116                 }
 117         }
 118
 119         write_lock_bh(&l2cap_sk_list.lock);
 120
 121         if (la.l2_psm && __l2cap_get_sock_by_addr(la.l2_psm, &la.l2_bdaddr)) {
 122                 err = -EADDRINUSE;
 123         } else {
 124                 /* Save source address */
 125                 bacpy(&bt_sk(sk)->src, &la.l2_bdaddr);
 126                 l2cap_pi(sk)->psm   = la.l2_psm;
 127                 l2cap_pi(sk)->sport = la.l2_psm;
 128                 sk->sk_state = BT_BOUND;
 129
 130                 if (__le16_to_cpu(la.l2_psm) == 0x0001 ||
 131                                         __le16_to_cpu(la.l2_psm) == 0x0003)
 132                         l2cap_pi(sk)->sec_level = BT_SECURITY_SDP;
 133         }
 134
 135         write_unlock_bh(&l2cap_sk_list.lock);
 136
 137 done:
 138         release_sock(sk);
 139         return err;
 140 }
 141
 142 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 143 {
 144         struct sock *sk = sock->sk;
 145         struct sockaddr_l2 la;
 146         int len, err = 0;
 147
 148         BT_DBG("sk %p", sk);
 149
 150         if (!addr || alen < sizeof(addr->sa_family) ||
 151             addr->sa_family != AF_BLUETOOTH)
 152                 return -EINVAL;
 153
 154         memset(&la, 0, sizeof(la));
 155         len = min_t(unsigned int, sizeof(la), alen);
 156         memcpy(&la, addr, len);
 157
 158         if (la.l2_cid)
 159                 return -EINVAL;
 160
 161         lock_sock(sk);
 162
 163         if ((sk->sk_type == SOCK_SEQPACKET || sk->sk_type == SOCK_STREAM)
 164                         && !la.l2_psm) {
 165                 err = -EINVAL;
 166                 goto done;
 167         }
 168
 169         switch (l2cap_pi(sk)->mode) {
 170         case L2CAP_MODE_BASIC:
 171                 break;
 172         case L2CAP_MODE_ERTM:
 173         case L2CAP_MODE_STREAMING:
 174                 if (!disable_ertm)
 175                         break;
 176                 /* fall through */
 177         default:
 178                 err = -ENOTSUPP;
 179                 goto done;
 180         }
 181
 182         switch (sk->sk_state) {
 183         case BT_CONNECT:
 184         case BT_CONNECT2:
 185         case BT_CONFIG:
 186                 /* Already connecting */
 187                 goto wait;
 188
 189         case BT_CONNECTED:
 190                 /* Already connected */
 191                 err = -EISCONN;
 192                 goto done;
 193
 194         case BT_OPEN:
 195         case BT_BOUND:
 196                 /* Can connect */
 197                 break;
 198
 199         default:
 200                 err = -EBADFD;
 201                 goto done;
 202         }
 203
 204         /* PSM must be odd and lsb of upper byte must be 0 */
 205         if ((__le16_to_cpu(la.l2_psm) & 0x0101) != 0x0001 &&
 206                 sk->sk_type != SOCK_RAW) {
 207                 err = -EINVAL;
 208                 goto done;
 209         }
 210
 211         /* Set destination address and psm */
 212         bacpy(&bt_sk(sk)->dst, &la.l2_bdaddr);
 213         l2cap_pi(sk)->psm = la.l2_psm;
 214
 215         err = l2cap_do_connect(sk);
 216         if (err)
 217                 goto done;
 218
 219 wait:
 220         err = bt_sock_wait_state(sk, BT_CONNECTED,
 221                         sock_sndtimeo(sk, flags & O_NONBLOCK));
 222 done:
 223         release_sock(sk);
 224         return err;
 225 }
 226
 227 static int l2cap_sock_listen(struct socket *sock, int backlog)
 228 {
 229         struct sock *sk = sock->sk;
 230         int err = 0;
 231
 232         BT_DBG("sk %p backlog %d", sk, backlog);
 233
 234         lock_sock(sk);
 235
 236         if ((sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
 237                         || sk->sk_state != BT_BOUND) {
 238                 err = -EBADFD;
 239                 goto done;
 240         }
 241
 242         switch (l2cap_pi(sk)->mode) {
 243         case L2CAP_MODE_BASIC:
 244                 break;
 245         case L2CAP_MODE_ERTM:
 246         case L2CAP_MODE_STREAMING:
 247                 if (!disable_ertm)
 248                         break;
 249                 /* fall through */
 250         default:
 251                 err = -ENOTSUPP;
 252                 goto done;
 253         }
 254
 255         if (!l2cap_pi(sk)->psm) {
 256                 bdaddr_t *src = &bt_sk(sk)->src;
 257                 u16 psm;
 258
 259                 err = -EINVAL;
 260
 261                 write_lock_bh(&l2cap_sk_list.lock);
 262
 263                 for (psm = 0x1001; psm < 0x1100; psm += 2)
 264                         if (!__l2cap_get_sock_by_addr(cpu_to_le16(psm), src)) {
 265                                 l2cap_pi(sk)->psm   = cpu_to_le16(psm);
 266                                 l2cap_pi(sk)->sport = cpu_to_le16(psm);
 267                                 err = 0;
 268                                 break;
 269                         }
 270
 271                 write_unlock_bh(&l2cap_sk_list.lock);
 272
 273                 if (err < 0)
 274                         goto done;
 275         }
 276
 277         sk->sk_max_ack_backlog = backlog;
 278         sk->sk_ack_backlog = 0;
 279         sk->sk_state = BT_LISTEN;
 280
 281 done:
 282         release_sock(sk);
 283         return err;
 284 }
 285
 286 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 287 {
 288         DECLARE_WAITQUEUE(wait, current);
 289         struct sock *sk = sock->sk, *nsk;
 290         long timeo;
 291         int err = 0;
 292
 293         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 294
 295         if (sk->sk_state != BT_LISTEN) {
 296                 err = -EBADFD;
 297                 goto done;
 298         }
 299
 300         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 301
 302         BT_DBG("sk %p timeo %ld", sk, timeo);
 303
 304         /* Wait for an incoming connection. (wake-one). */
 305         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 306         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 307                 set_current_state(TASK_INTERRUPTIBLE);
 308                 if (!timeo) {
 309                         err = -EAGAIN;
 310                         break;
 311                 }
 312
 313                 release_sock(sk);
 314                 timeo = schedule_timeout(timeo);
 315                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 316
 317                 if (sk->sk_state != BT_LISTEN) {
 318                         err = -EBADFD;
 319                         break;
 320                 }
 321
 322                 if (signal_pending(current)) {
 323                         err = sock_intr_errno(timeo);
 324                         break;
 325                 }
 326         }
 327         set_current_state(TASK_RUNNING);
 328         remove_wait_queue(sk_sleep(sk), &wait);
 329
 330         if (err)
 331                 goto done;
 332
 333         newsock->state = SS_CONNECTED;
 334
 335         BT_DBG("new socket %p", nsk);
 336
 337 done:
 338         release_sock(sk);
 339         return err;
 340 }
 341
 342 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 343 {
 344         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 345         struct sock *sk = sock->sk;
 346
 347         BT_DBG("sock %p, sk %p", sock, sk);
 348
 349         addr->sa_family = AF_BLUETOOTH;
 350         *len = sizeof(struct sockaddr_l2);
 351
 352         if (peer) {
 353                 la->l2_psm = l2cap_pi(sk)->psm;
 354                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->dst);
 355                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->dcid);
 356         } else {
 357                 la->l2_psm = l2cap_pi(sk)->sport;
 358                 bacpy(&la->l2_bdaddr, &bt_sk(sk)->src);
 359                 la->l2_cid = cpu_to_le16(l2cap_pi(sk)->scid);
 360         }
 361
 362         return 0;
 363 }
 364
 365 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 366 {
 367         struct sock *sk = sock->sk;
 368         struct l2cap_options opts;
 369         struct l2cap_conninfo cinfo;
 370         int len, err = 0;
 371         u32 opt;
 372
 373         BT_DBG("sk %p", sk);
 374
 375         if (get_user(len, optlen))
 376                 return -EFAULT;
 377
 378         lock_sock(sk);
 379
 380         switch (optname) {
 381         case L2CAP_OPTIONS:
 382                 opts.imtu     = l2cap_pi(sk)->imtu;
 383                 opts.omtu     = l2cap_pi(sk)->omtu;
 384                 opts.flush_to = l2cap_pi(sk)->flush_to;
 385                 opts.mode     = l2cap_pi(sk)->mode;
 386                 opts.fcs      = l2cap_pi(sk)->fcs;
 387                 opts.max_tx   = l2cap_pi(sk)->max_tx;
 388                 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
 389
 390                 len = min_t(unsigned int, len, sizeof(opts));
 391                 if (copy_to_user(optval, (char *) &opts, len))
 392                         err = -EFAULT;
 393
 394                 break;
 395
 396         case L2CAP_LM:
 397                 switch (l2cap_pi(sk)->sec_level) {
 398                 case BT_SECURITY_LOW:
 399                         opt = L2CAP_LM_AUTH;
 400                         break;
 401                 case BT_SECURITY_MEDIUM:
 402                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 403                         break;
 404                 case BT_SECURITY_HIGH:
 405                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 406                                                         L2CAP_LM_SECURE;
 407                         break;
 408                 default:
 409                         opt = 0;
 410                         break;
 411                 }
 412
 413                 if (l2cap_pi(sk)->role_switch)
 414                         opt |= L2CAP_LM_MASTER;
 415
 416                 if (l2cap_pi(sk)->force_reliable)
 417                         opt |= L2CAP_LM_RELIABLE;
 418
 419                 if (put_user(opt, (u32 __user *) optval))
 420                         err = -EFAULT;
 421                 break;
 422
 423         case L2CAP_CONNINFO:
 424                 if (sk->sk_state != BT_CONNECTED &&
 425                                         !(sk->sk_state == BT_CONNECT2 &&
 426                                                 bt_sk(sk)->defer_setup)) {
 427                         err = -ENOTCONN;
 428                         break;
 429                 }
 430
 431                 cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
 432                 memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
 433
 434                 len = min_t(unsigned int, len, sizeof(cinfo));
 435                 if (copy_to_user(optval, (char *) &cinfo, len))
 436                         err = -EFAULT;
 437
 438                 break;
 439
 440         default:
 441                 err = -ENOPROTOOPT;
 442                 break;
 443         }
 444
 445         release_sock(sk);
 446         return err;
 447 }
 448
 449 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 450 {
 451         struct sock *sk = sock->sk;
 452         struct bt_security sec;
 453         int len, err = 0;
 454
 455         BT_DBG("sk %p", sk);
 456
 457         if (level == SOL_L2CAP)
 458                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 459
 460         if (level != SOL_BLUETOOTH)
 461                 return -ENOPROTOOPT;
 462
 463         if (get_user(len, optlen))
 464                 return -EFAULT;
 465
 466         lock_sock(sk);
 467
 468         switch (optname) {
 469         case BT_SECURITY:
 470                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 471                                 && sk->sk_type != SOCK_RAW) {
 472                         err = -EINVAL;
 473                         break;
 474                 }
 475
 476                 sec.level = l2cap_pi(sk)->sec_level;
 477
 478                 len = min_t(unsigned int, len, sizeof(sec));
 479                 if (copy_to_user(optval, (char *) &sec, len))
 480                         err = -EFAULT;
 481
 482                 break;
 483
 484         case BT_DEFER_SETUP:
 485                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 486                         err = -EINVAL;
 487                         break;
 488                 }
 489
 490                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
 491                         err = -EFAULT;
 492
 493                 break;
 494
 495         case BT_FLUSHABLE:
 496                 if (put_user(l2cap_pi(sk)->flushable, (u32 __user *) optval))
 497                         err = -EFAULT;
 498
 499                 break;
 500
 501         default:
 502                 err = -ENOPROTOOPT;
 503                 break;
 504         }
 505
 506         release_sock(sk);
 507         return err;
 508 }
 509
 510 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 511 {
 512         struct sock *sk = sock->sk;
 513         struct l2cap_options opts;
 514         int len, err = 0;
 515         u32 opt;
 516
 517         BT_DBG("sk %p", sk);
 518
 519         lock_sock(sk);
 520
 521         switch (optname) {
 522         case L2CAP_OPTIONS:
 523                 if (sk->sk_state == BT_CONNECTED) {
 524                         err = -EINVAL;
 525                         break;
 526                 }
 527
 528                 opts.imtu     = l2cap_pi(sk)->imtu;
 529                 opts.omtu     = l2cap_pi(sk)->omtu;
 530                 opts.flush_to = l2cap_pi(sk)->flush_to;
 531                 opts.mode     = l2cap_pi(sk)->mode;
 532                 opts.fcs      = l2cap_pi(sk)->fcs;
 533                 opts.max_tx   = l2cap_pi(sk)->max_tx;
 534                 opts.txwin_size = (__u16)l2cap_pi(sk)->tx_win;
 535
 536                 len = min_t(unsigned int, sizeof(opts), optlen);
 537                 if (copy_from_user((char *) &opts, optval, len)) {
 538                         err = -EFAULT;
 539                         break;
 540                 }
 541
 542                 if (opts.txwin_size > L2CAP_DEFAULT_TX_WINDOW) {
 543                         err = -EINVAL;
 544                         break;
 545                 }
 546
 547                 l2cap_pi(sk)->mode = opts.mode;
 548                 switch (l2cap_pi(sk)->mode) {
 549                 case L2CAP_MODE_BASIC:
 550                         l2cap_pi(sk)->conf_state &= ~L2CAP_CONF_STATE2_DEVICE;
 551                         break;
 552                 case L2CAP_MODE_ERTM:
 553                 case L2CAP_MODE_STREAMING:
 554                         if (!disable_ertm)
 555                                 break;
 556                         /* fall through */
 557                 default:
 558                         err = -EINVAL;
 559                         break;
 560                 }
 561
 562                 l2cap_pi(sk)->imtu = opts.imtu;
 563                 l2cap_pi(sk)->omtu = opts.omtu;
 564                 l2cap_pi(sk)->fcs  = opts.fcs;
 565                 l2cap_pi(sk)->max_tx = opts.max_tx;
 566                 l2cap_pi(sk)->tx_win = (__u8)opts.txwin_size;
 567                 break;
 568
 569         case L2CAP_LM:
 570                 if (get_user(opt, (u32 __user *) optval)) {
 571                         err = -EFAULT;
 572                         break;
 573                 }
 574
 575                 if (opt & L2CAP_LM_AUTH)
 576                         l2cap_pi(sk)->sec_level = BT_SECURITY_LOW;
 577                 if (opt & L2CAP_LM_ENCRYPT)
 578                         l2cap_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 579                 if (opt & L2CAP_LM_SECURE)
 580                         l2cap_pi(sk)->sec_level = BT_SECURITY_HIGH;
 581
 582                 l2cap_pi(sk)->role_switch    = (opt & L2CAP_LM_MASTER);
 583                 l2cap_pi(sk)->force_reliable = (opt & L2CAP_LM_RELIABLE);
 584                 break;
 585
 586         default:
 587                 err = -ENOPROTOOPT;
 588                 break;
 589         }
 590
 591         release_sock(sk);
 592         return err;
 593 }
 594
 595 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 596 {
 597         struct sock *sk = sock->sk;
 598         struct bt_security sec;
 599         int len, err = 0;
 600         u32 opt;
 601
 602         BT_DBG("sk %p", sk);
 603
 604         if (level == SOL_L2CAP)
 605                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 606
 607         if (level != SOL_BLUETOOTH)
 608                 return -ENOPROTOOPT;
 609
 610         lock_sock(sk);
 611
 612         switch (optname) {
 613         case BT_SECURITY:
 614                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 615                                 && sk->sk_type != SOCK_RAW) {
 616                         err = -EINVAL;
 617                         break;
 618                 }
 619
 620                 sec.level = BT_SECURITY_LOW;
 621
 622                 len = min_t(unsigned int, sizeof(sec), optlen);
 623                 if (copy_from_user((char *) &sec, optval, len)) {
 624                         err = -EFAULT;
 625                         break;
 626                 }
 627
 628                 if (sec.level < BT_SECURITY_LOW ||
 629                                         sec.level > BT_SECURITY_HIGH) {
 630                         err = -EINVAL;
 631                         break;
 632                 }
 633
 634                 l2cap_pi(sk)->sec_level = sec.level;
 635                 break;
 636
 637         case BT_DEFER_SETUP:
 638                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 639                         err = -EINVAL;
 640                         break;
 641                 }
 642
 643                 if (get_user(opt, (u32 __user *) optval)) {
 644                         err = -EFAULT;
 645                         break;
 646                 }
 647
 648                 bt_sk(sk)->defer_setup = opt;
 649                 break;
 650
 651         case BT_FLUSHABLE:
 652                 if (get_user(opt, (u32 __user *) optval)) {
 653                         err = -EFAULT;
 654                         break;
 655                 }
 656
 657                 if (opt > BT_FLUSHABLE_ON) {
 658                         err = -EINVAL;
 659                         break;
 660                 }
 661
 662                 if (opt == BT_FLUSHABLE_OFF) {
 663                         struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 664                         /* proceed futher only when we have l2cap_conn and
 665                            No Flush support in the LM */
 666                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 667                                 err = -EINVAL;
 668                                 break;
 669                         }
 670                 }
 671
 672                 l2cap_pi(sk)->flushable = opt;
 673                 break;
 674
 675         default:
 676                 err = -ENOPROTOOPT;
 677                 break;
 678         }
 679
 680         release_sock(sk);
 681         return err;
 682 }
 683
 684 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len, int flags)
 685 {
 686         struct sock *sk = sock->sk;
 687
 688         lock_sock(sk);
 689
 690         if (sk->sk_state == BT_CONNECT2 && bt_sk(sk)->defer_setup) {
 691                 struct l2cap_conn_rsp rsp;
 692                 struct l2cap_conn *conn = l2cap_pi(sk)->conn;
 693                 u8 buf[128];
 694
 695                 sk->sk_state = BT_CONFIG;
 696
 697                 rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
 698                 rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
 699                 rsp.result = cpu_to_le16(L2CAP_CR_SUCCESS);
 700                 rsp.status = cpu_to_le16(L2CAP_CS_NO_INFO);
 701                 l2cap_send_cmd(l2cap_pi(sk)->conn, l2cap_pi(sk)->ident,
 702                                         L2CAP_CONN_RSP, sizeof(rsp), &rsp);
 703
 704                 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_REQ_SENT) {
 705                         release_sock(sk);
 706                         return 0;
 707                 }
 708
 709                 l2cap_pi(sk)->conf_state |= L2CAP_CONF_REQ_SENT;
 710                 l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ,
 711                                 l2cap_build_conf_req(sk, buf), buf);
 712                 l2cap_pi(sk)->num_conf_req++;
 713
 714                 release_sock(sk);
 715                 return 0;
 716         }
 717
 718         release_sock(sk);
 719
 720         if (sock->type == SOCK_STREAM)
 721                 return bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
 722
 723         return bt_sock_recvmsg(iocb, sock, msg, len, flags);
 724 }
 725
 726 static int l2cap_sock_release(struct socket *sock)
 727 {
 728         struct sock *sk = sock->sk;
 729         int err;
 730
 731         BT_DBG("sock %p, sk %p", sock, sk);
 732
 733         if (!sk)
 734                 return 0;
 735
 736         err = l2cap_sock_shutdown(sock, 2);
 737
 738         sock_orphan(sk);
 739         l2cap_sock_kill(sk);
 740         return err;
 741 }
 742
 743 static void l2cap_sock_destruct(struct sock *sk)
 744 {
 745         BT_DBG("sk %p", sk);
 746
 747         skb_queue_purge(&sk->sk_receive_queue);
 748         skb_queue_purge(&sk->sk_write_queue);
 749 }
 750
 751 void l2cap_sock_init(struct sock *sk, struct sock *parent)
 752 {
 753         struct l2cap_pinfo *pi = l2cap_pi(sk);
 754
 755         BT_DBG("sk %p", sk);
 756
 757         if (parent) {
 758                 sk->sk_type = parent->sk_type;
 759                 bt_sk(sk)->defer_setup = bt_sk(parent)->defer_setup;
 760
 761                 pi->imtu = l2cap_pi(parent)->imtu;
 762                 pi->omtu = l2cap_pi(parent)->omtu;
 763                 pi->conf_state = l2cap_pi(parent)->conf_state;
 764                 pi->mode = l2cap_pi(parent)->mode;
 765                 pi->fcs  = l2cap_pi(parent)->fcs;
 766                 pi->max_tx = l2cap_pi(parent)->max_tx;
 767                 pi->tx_win = l2cap_pi(parent)->tx_win;
 768                 pi->sec_level = l2cap_pi(parent)->sec_level;
 769                 pi->role_switch = l2cap_pi(parent)->role_switch;
 770                 pi->force_reliable = l2cap_pi(parent)->force_reliable;
 771                 pi->flushable = l2cap_pi(parent)->flushable;
 772         } else {
 773                 pi->imtu = L2CAP_DEFAULT_MTU;
 774                 pi->omtu = 0;
 775                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
 776                         pi->mode = L2CAP_MODE_ERTM;
 777                         pi->conf_state |= L2CAP_CONF_STATE2_DEVICE;
 778                 } else {
 779                         pi->mode = L2CAP_MODE_BASIC;
 780                 }
 781                 pi->max_tx = L2CAP_DEFAULT_MAX_TX;
 782                 pi->fcs  = L2CAP_FCS_CRC16;
 783                 pi->tx_win = L2CAP_DEFAULT_TX_WINDOW;
 784                 pi->sec_level = BT_SECURITY_LOW;
 785                 pi->role_switch = 0;
 786                 pi->force_reliable = 0;
 787                 pi->flushable = BT_FLUSHABLE_OFF;
 788         }
 789
 790         /* Default config options */
 791         pi->conf_len = 0;
 792         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
 793         skb_queue_head_init(TX_QUEUE(sk));
 794         skb_queue_head_init(SREJ_QUEUE(sk));
 795         skb_queue_head_init(BUSY_QUEUE(sk));
 796         INIT_LIST_HEAD(SREJ_LIST(sk));
 797 }
 798
 799 static struct proto l2cap_proto = {
 800         .name           = "L2CAP",
 801         .owner          = THIS_MODULE,
 802         .obj_size       = sizeof(struct l2cap_pinfo)
 803 };
 804
 805 struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 806 {
 807         struct sock *sk;
 808
 809         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
 810         if (!sk)
 811                 return NULL;
 812
 813         sock_init_data(sock, sk);
 814         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 815
 816         sk->sk_destruct = l2cap_sock_destruct;
 817         sk->sk_sndtimeo = msecs_to_jiffies(L2CAP_CONN_TIMEOUT);
 818
 819         sock_reset_flag(sk, SOCK_ZAPPED);
 820
 821         sk->sk_protocol = proto;
 822         sk->sk_state = BT_OPEN;
 823
 824         setup_timer(&sk->sk_timer, l2cap_sock_timeout, (unsigned long) sk);
 825
 826         bt_sock_link(&l2cap_sk_list, sk);
 827         return sk;
 828 }
 829
 830 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
 831                              int kern)
 832 {
 833         struct sock *sk;
 834
 835         BT_DBG("sock %p", sock);
 836
 837         sock->state = SS_UNCONNECTED;
 838
 839         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
 840                         sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
 841                 return -ESOCKTNOSUPPORT;
 842
 843         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
 844                 return -EPERM;
 845
 846         sock->ops = &l2cap_sock_ops;
 847
 848         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 849         if (!sk)
 850                 return -ENOMEM;
 851
 852         l2cap_sock_init(sk, NULL);
 853         return 0;
 854 }
 855
 856 const struct proto_ops l2cap_sock_ops = {
 857         .family         = PF_BLUETOOTH,
 858         .owner          = THIS_MODULE,
 859         .release        = l2cap_sock_release,
 860         .bind           = l2cap_sock_bind,
 861         .connect        = l2cap_sock_connect,
 862         .listen         = l2cap_sock_listen,
 863         .accept         = l2cap_sock_accept,
 864         .getname        = l2cap_sock_getname,
 865         .sendmsg        = l2cap_sock_sendmsg,
 866         .recvmsg        = l2cap_sock_recvmsg,
 867         .poll           = bt_sock_poll,
 868         .ioctl          = bt_sock_ioctl,
 869         .mmap           = sock_no_mmap,
 870         .socketpair     = sock_no_socketpair,
 871         .shutdown       = l2cap_sock_shutdown,
 872         .setsockopt     = l2cap_sock_setsockopt,
 873         .getsockopt     = l2cap_sock_getsockopt
 874 };
 875
 876 static const struct net_proto_family l2cap_sock_family_ops = {
 877         .family = PF_BLUETOOTH,
 878         .owner  = THIS_MODULE,
 879         .create = l2cap_sock_create,
 880 };
 881
 882 int __init l2cap_init_sockets(void)
 883 {
 884        int err;
 885
 886        err = proto_register(&l2cap_proto, 0);
 887        if (err < 0)
 888                return err;
 889
 890        err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
 891        if (err < 0)
 892                goto error;
 893
 894        BT_INFO("L2CAP socket layer initialized");
 895
 896        return 0;
 897
 898 error:
 899        BT_ERR("L2CAP socket registration failed");
 900        proto_unregister(&l2cap_proto);
 901        return err;
 902 }
 903
 904 void l2cap_cleanup_sockets(void)
 905 {
 906        if (bt_sock_unregister(BTPROTO_L2CAP) < 0)
 907                BT_ERR("L2CAP socket unregistration failed");
 908
 909        proto_unregister(&l2cap_proto);
 910 }