net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  */
  27
  28 #include <linux/module.h>
  29
  30 #include <linux/types.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/interrupt.h>
  39 #include <linux/socket.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/list.h>
  42 #include <linux/device.h>
  43 #include <linux/debugfs.h>
  44 #include <linux/seq_file.h>
  45 #include <net/sock.h>
  46
  47 #include <asm/system.h>
  48 #include <linux/uaccess.h>
  49
  50 #include <net/bluetooth/bluetooth.h>
  51 #include <net/bluetooth/hci_core.h>
  52 #include <net/bluetooth/l2cap.h>
  53 #include <net/bluetooth/rfcomm.h>
  54
  55 static const struct proto_ops rfcomm_sock_ops;
  56
  57 static struct bt_sock_list rfcomm_sk_list = {
  58         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  59 };
  60
  61 static void rfcomm_sock_close(struct sock *sk);
  62 static void rfcomm_sock_kill(struct sock *sk);
  63
  64 /* ---- DLC callbacks ----
  65  *
  66  * called under rfcomm_dlc_lock()
  67  */
  68 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  69 {
  70         struct sock *sk = d->owner;
  71         if (!sk)
  72                 return;
  73
  74         atomic_add(skb->len, &sk->sk_rmem_alloc);
  75         skb_queue_tail(&sk->sk_receive_queue, skb);
  76         sk->sk_data_ready(sk, skb->len);
  77
  78         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  79                 rfcomm_dlc_throttle(d);
  80 }
  81
  82 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  83 {
  84         struct sock *sk = d->owner, *parent;
  85         unsigned long flags;
  86
  87         if (!sk)
  88                 return;
  89
  90         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  91
  92         local_irq_save(flags);
  93         bh_lock_sock(sk);
  94
  95         if (err)
  96                 sk->sk_err = err;
  97
  98         sk->sk_state = d->state;
  99
 100         parent = bt_sk(sk)->parent;
 101         if (parent) {
 102                 if (d->state == BT_CLOSED) {
 103                         sock_set_flag(sk, SOCK_ZAPPED);
 104                         bt_accept_unlink(sk);
 105                 }
 106                 parent->sk_data_ready(parent, 0);
 107         } else {
 108                 if (d->state == BT_CONNECTED)
 109                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
 110                 sk->sk_state_change(sk);
 111         }
 112
 113         bh_unlock_sock(sk);
 114         local_irq_restore(flags);
 115
 116         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
 117                 /* We have to drop DLC lock here, otherwise
 118                  * rfcomm_sock_destruct() will dead lock. */
 119                 rfcomm_dlc_unlock(d);
 120                 rfcomm_sock_kill(sk);
 121                 rfcomm_dlc_lock(d);
 122         }
 123 }
 124
 125 /* ---- Socket functions ---- */
 126 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 127 {
 128         struct sock *sk = NULL;
 129         struct hlist_node *node;
 130
 131         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 132                 if (rfcomm_pi(sk)->channel == channel &&
 133                                 !bacmp(&bt_sk(sk)->src, src))
 134                         break;
 135         }
 136
 137         return node ? sk : NULL;
 138 }
 139
 140 /* Find socket with channel and source bdaddr.
 141  * Returns closest match.
 142  */
 143 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 144 {
 145         struct sock *sk = NULL, *sk1 = NULL;
 146         struct hlist_node *node;
 147
 148         read_lock(&rfcomm_sk_list.lock);
 149
 150         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 151                 if (state && sk->sk_state != state)
 152                         continue;
 153
 154                 if (rfcomm_pi(sk)->channel == channel) {
 155                         /* Exact match. */
 156                         if (!bacmp(&bt_sk(sk)->src, src))
 157                                 break;
 158
 159                         /* Closest match */
 160                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 161                                 sk1 = sk;
 162                 }
 163         }
 164
 165         read_unlock(&rfcomm_sk_list.lock);
 166
 167         return node ? sk : sk1;
 168 }
 169
 170 static void rfcomm_sock_destruct(struct sock *sk)
 171 {
 172         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 173
 174         BT_DBG("sk %p dlc %p", sk, d);
 175
 176         skb_queue_purge(&sk->sk_receive_queue);
 177         skb_queue_purge(&sk->sk_write_queue);
 178
 179         rfcomm_dlc_lock(d);
 180         rfcomm_pi(sk)->dlc = NULL;
 181
 182         /* Detach DLC if it's owned by this socket */
 183         if (d->owner == sk)
 184                 d->owner = NULL;
 185         rfcomm_dlc_unlock(d);
 186
 187         rfcomm_dlc_put(d);
 188 }
 189
 190 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 191 {
 192         struct sock *sk;
 193
 194         BT_DBG("parent %p", parent);
 195
 196         /* Close not yet accepted dlcs */
 197         while ((sk = bt_accept_dequeue(parent, NULL))) {
 198                 rfcomm_sock_close(sk);
 199                 rfcomm_sock_kill(sk);
 200         }
 201
 202         parent->sk_state  = BT_CLOSED;
 203         sock_set_flag(parent, SOCK_ZAPPED);
 204 }
 205
 206 /* Kill socket (only if zapped and orphan)
 207  * Must be called on unlocked socket.
 208  */
 209 static void rfcomm_sock_kill(struct sock *sk)
 210 {
 211         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 212                 return;
 213
 214         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 215
 216         /* Kill poor orphan */
 217         bt_sock_unlink(&rfcomm_sk_list, sk);
 218         sock_set_flag(sk, SOCK_DEAD);
 219         sock_put(sk);
 220 }
 221
 222 static void __rfcomm_sock_close(struct sock *sk)
 223 {
 224         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 225
 226         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 227
 228         switch (sk->sk_state) {
 229         case BT_LISTEN:
 230                 rfcomm_sock_cleanup_listen(sk);
 231                 break;
 232
 233         case BT_CONNECT:
 234         case BT_CONNECT2:
 235         case BT_CONFIG:
 236         case BT_CONNECTED:
 237                 rfcomm_dlc_close(d, 0);
 238
 239         default:
 240                 sock_set_flag(sk, SOCK_ZAPPED);
 241                 break;
 242         }
 243 }
 244
 245 /* Close socket.
 246  * Must be called on unlocked socket.
 247  */
 248 static void rfcomm_sock_close(struct sock *sk)
 249 {
 250         lock_sock(sk);
 251         __rfcomm_sock_close(sk);
 252         release_sock(sk);
 253 }
 254
 255 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 256 {
 257         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 258
 259         BT_DBG("sk %p", sk);
 260
 261         if (parent) {
 262                 sk->sk_type = parent->sk_type;
 263                 pi->dlc->defer_setup = bt_sk(parent)->defer_setup;
 264
 265                 pi->sec_level = rfcomm_pi(parent)->sec_level;
 266                 pi->role_switch = rfcomm_pi(parent)->role_switch;
 267         } else {
 268                 pi->dlc->defer_setup = 0;
 269
 270                 pi->sec_level = BT_SECURITY_LOW;
 271                 pi->role_switch = 0;
 272         }
 273
 274         pi->dlc->sec_level = pi->sec_level;
 275         pi->dlc->role_switch = pi->role_switch;
 276 }
 277
 278 static struct proto rfcomm_proto = {
 279         .name           = "RFCOMM",
 280         .owner          = THIS_MODULE,
 281         .obj_size       = sizeof(struct rfcomm_pinfo)
 282 };
 283
 284 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 285 {
 286         struct rfcomm_dlc *d;
 287         struct sock *sk;
 288
 289         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 290         if (!sk)
 291                 return NULL;
 292
 293         sock_init_data(sock, sk);
 294         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 295
 296         d = rfcomm_dlc_alloc(prio);
 297         if (!d) {
 298                 sk_free(sk);
 299                 return NULL;
 300         }
 301
 302         d->data_ready   = rfcomm_sk_data_ready;
 303         d->state_change = rfcomm_sk_state_change;
 304
 305         rfcomm_pi(sk)->dlc = d;
 306         d->owner = sk;
 307
 308         sk->sk_destruct = rfcomm_sock_destruct;
 309         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 310
 311         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 312         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 313
 314         sock_reset_flag(sk, SOCK_ZAPPED);
 315
 316         sk->sk_protocol = proto;
 317         sk->sk_state    = BT_OPEN;
 318
 319         bt_sock_link(&rfcomm_sk_list, sk);
 320
 321         BT_DBG("sk %p", sk);
 322         return sk;
 323 }
 324
 325 static int rfcomm_sock_create(struct net *net, struct socket *sock,
 326                               int protocol, int kern)
 327 {
 328         struct sock *sk;
 329
 330         BT_DBG("sock %p", sock);
 331
 332         sock->state = SS_UNCONNECTED;
 333
 334         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 335                 return -ESOCKTNOSUPPORT;
 336
 337         sock->ops = &rfcomm_sock_ops;
 338
 339         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 340         if (!sk)
 341                 return -ENOMEM;
 342
 343         rfcomm_sock_init(sk, NULL);
 344         return 0;
 345 }
 346
 347 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 348 {
 349         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 350         struct sock *sk = sock->sk;
 351         int err = 0;
 352
 353         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
 354
 355         if (!addr || addr->sa_family != AF_BLUETOOTH)
 356                 return -EINVAL;
 357
 358         lock_sock(sk);
 359
 360         if (sk->sk_state != BT_OPEN) {
 361                 err = -EBADFD;
 362                 goto done;
 363         }
 364
 365         if (sk->sk_type != SOCK_STREAM) {
 366                 err = -EINVAL;
 367                 goto done;
 368         }
 369
 370         write_lock_bh(&rfcomm_sk_list.lock);
 371
 372         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 373                 err = -EADDRINUSE;
 374         } else {
 375                 /* Save source address */
 376                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 377                 rfcomm_pi(sk)->channel = sa->rc_channel;
 378                 sk->sk_state = BT_BOUND;
 379         }
 380
 381         write_unlock_bh(&rfcomm_sk_list.lock);
 382
 383 done:
 384         release_sock(sk);
 385         return err;
 386 }
 387
 388 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 389 {
 390         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 391         struct sock *sk = sock->sk;
 392         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 393         int err = 0;
 394
 395         BT_DBG("sk %p", sk);
 396
 397         if (alen < sizeof(struct sockaddr_rc) ||
 398             addr->sa_family != AF_BLUETOOTH)
 399                 return -EINVAL;
 400
 401         lock_sock(sk);
 402
 403         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 404                 err = -EBADFD;
 405                 goto done;
 406         }
 407
 408         if (sk->sk_type != SOCK_STREAM) {
 409                 err = -EINVAL;
 410                 goto done;
 411         }
 412
 413         sk->sk_state = BT_CONNECT;
 414         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 415         rfcomm_pi(sk)->channel = sa->rc_channel;
 416
 417         d->sec_level = rfcomm_pi(sk)->sec_level;
 418         d->role_switch = rfcomm_pi(sk)->role_switch;
 419
 420         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 421         if (!err)
 422                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 423                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 424
 425 done:
 426         release_sock(sk);
 427         return err;
 428 }
 429
 430 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 431 {
 432         struct sock *sk = sock->sk;
 433         int err = 0;
 434
 435         BT_DBG("sk %p backlog %d", sk, backlog);
 436
 437         lock_sock(sk);
 438
 439         if (sk->sk_state != BT_BOUND) {
 440                 err = -EBADFD;
 441                 goto done;
 442         }
 443
 444         if (sk->sk_type != SOCK_STREAM) {
 445                 err = -EINVAL;
 446                 goto done;
 447         }
 448
 449         if (!rfcomm_pi(sk)->channel) {
 450                 bdaddr_t *src = &bt_sk(sk)->src;
 451                 u8 channel;
 452
 453                 err = -EINVAL;
 454
 455                 write_lock_bh(&rfcomm_sk_list.lock);
 456
 457                 for (channel = 1; channel < 31; channel++)
 458                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 459                                 rfcomm_pi(sk)->channel = channel;
 460                                 err = 0;
 461                                 break;
 462                         }
 463
 464                 write_unlock_bh(&rfcomm_sk_list.lock);
 465
 466                 if (err < 0)
 467                         goto done;
 468         }
 469
 470         sk->sk_max_ack_backlog = backlog;
 471         sk->sk_ack_backlog = 0;
 472         sk->sk_state = BT_LISTEN;
 473
 474 done:
 475         release_sock(sk);
 476         return err;
 477 }
 478
 479 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 480 {
 481         DECLARE_WAITQUEUE(wait, current);
 482         struct sock *sk = sock->sk, *nsk;
 483         long timeo;
 484         int err = 0;
 485
 486         lock_sock(sk);
 487
 488         if (sk->sk_state != BT_LISTEN) {
 489                 err = -EBADFD;
 490                 goto done;
 491         }
 492
 493         if (sk->sk_type != SOCK_STREAM) {
 494                 err = -EINVAL;
 495                 goto done;
 496         }
 497
 498         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 499
 500         BT_DBG("sk %p timeo %ld", sk, timeo);
 501
 502         /* Wait for an incoming connection. (wake-one). */
 503         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 504         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 505                 set_current_state(TASK_INTERRUPTIBLE);
 506                 if (!timeo) {
 507                         err = -EAGAIN;
 508                         break;
 509                 }
 510
 511                 release_sock(sk);
 512                 timeo = schedule_timeout(timeo);
 513                 lock_sock(sk);
 514
 515                 if (sk->sk_state != BT_LISTEN) {
 516                         err = -EBADFD;
 517                         break;
 518                 }
 519
 520                 if (signal_pending(current)) {
 521                         err = sock_intr_errno(timeo);
 522                         break;
 523                 }
 524         }
 525         set_current_state(TASK_RUNNING);
 526         remove_wait_queue(sk_sleep(sk), &wait);
 527
 528         if (err)
 529                 goto done;
 530
 531         newsock->state = SS_CONNECTED;
 532
 533         BT_DBG("new socket %p", nsk);
 534
 535 done:
 536         release_sock(sk);
 537         return err;
 538 }
 539
 540 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 541 {
 542         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 543         struct sock *sk = sock->sk;
 544
 545         BT_DBG("sock %p, sk %p", sock, sk);
 546
 547         memset(sa, 0, sizeof(*sa));
 548         sa->rc_family  = AF_BLUETOOTH;
 549         sa->rc_channel = rfcomm_pi(sk)->channel;
 550         if (peer)
 551                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 552         else
 553                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 554
 555         *len = sizeof(struct sockaddr_rc);
 556         return 0;
 557 }
 558
 559 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 560                                struct msghdr *msg, size_t len)
 561 {
 562         struct sock *sk = sock->sk;
 563         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 564         struct sk_buff *skb;
 565         int sent = 0;
 566
 567         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
 568                 return -ENOTCONN;
 569
 570         if (msg->msg_flags & MSG_OOB)
 571                 return -EOPNOTSUPP;
 572
 573         if (sk->sk_shutdown & SEND_SHUTDOWN)
 574                 return -EPIPE;
 575
 576         BT_DBG("sock %p, sk %p", sock, sk);
 577
 578         lock_sock(sk);
 579
 580         while (len) {
 581                 size_t size = min_t(size_t, len, d->mtu);
 582                 int err;
 583
 584                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 585                                 msg->msg_flags & MSG_DONTWAIT, &err);
 586                 if (!skb) {
 587                         if (sent == 0)
 588                                 sent = err;
 589                         break;
 590                 }
 591                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 592
 593                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 594                 if (err) {
 595                         kfree_skb(skb);
 596                         if (sent == 0)
 597                                 sent = err;
 598                         break;
 599                 }
 600
 601                 err = rfcomm_dlc_send(d, skb);
 602                 if (err < 0) {
 603                         kfree_skb(skb);
 604                         if (sent == 0)
 605                                 sent = err;
 606                         break;
 607                 }
 608
 609                 sent += size;
 610                 len  -= size;
 611         }
 612
 613         release_sock(sk);
 614
 615         return sent;
 616 }
 617
 618 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 619                                struct msghdr *msg, size_t size, int flags)
 620 {
 621         struct sock *sk = sock->sk;
 622         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 623         int len;
 624
 625         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
 626                 rfcomm_dlc_accept(d);
 627                 return 0;
 628         }
 629
 630         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
 631
 632         lock_sock(sk);
 633         if (!(flags & MSG_PEEK) && len > 0)
 634                 atomic_sub(len, &sk->sk_rmem_alloc);
 635
 636         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 637                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 638         release_sock(sk);
 639
 640         return len;
 641 }
 642
 643 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
 644 {
 645         struct sock *sk = sock->sk;
 646         int err = 0;
 647         u32 opt;
 648
 649         BT_DBG("sk %p", sk);
 650
 651         lock_sock(sk);
 652
 653         switch (optname) {
 654         case RFCOMM_LM:
 655                 if (get_user(opt, (u32 __user *) optval)) {
 656                         err = -EFAULT;
 657                         break;
 658                 }
 659
 660                 if (opt & RFCOMM_LM_AUTH)
 661                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
 662                 if (opt & RFCOMM_LM_ENCRYPT)
 663                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
 664                 if (opt & RFCOMM_LM_SECURE)
 665                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
 666
 667                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
 668                 break;
 669
 670         default:
 671                 err = -ENOPROTOOPT;
 672                 break;
 673         }
 674
 675         release_sock(sk);
 676         return err;
 677 }
 678
 679 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
 680 {
 681         struct sock *sk = sock->sk;
 682         struct bt_security sec;
 683         int len, err = 0;
 684         u32 opt;
 685
 686         BT_DBG("sk %p", sk);
 687
 688         if (level == SOL_RFCOMM)
 689                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
 690
 691         if (level != SOL_BLUETOOTH)
 692                 return -ENOPROTOOPT;
 693
 694         lock_sock(sk);
 695
 696         switch (optname) {
 697         case BT_SECURITY:
 698                 if (sk->sk_type != SOCK_STREAM) {
 699                         err = -EINVAL;
 700                         break;
 701                 }
 702
 703                 sec.level = BT_SECURITY_LOW;
 704
 705                 len = min_t(unsigned int, sizeof(sec), optlen);
 706                 if (copy_from_user((char *) &sec, optval, len)) {
 707                         err = -EFAULT;
 708                         break;
 709                 }
 710
 711                 if (sec.level > BT_SECURITY_HIGH) {
 712                         err = -EINVAL;
 713                         break;
 714                 }
 715
 716                 rfcomm_pi(sk)->sec_level = sec.level;
 717                 break;
 718
 719         case BT_DEFER_SETUP:
 720                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 721                         err = -EINVAL;
 722                         break;
 723                 }
 724
 725                 if (get_user(opt, (u32 __user *) optval)) {
 726                         err = -EFAULT;
 727                         break;
 728                 }
 729
 730                 bt_sk(sk)->defer_setup = opt;
 731                 break;
 732
 733         default:
 734                 err = -ENOPROTOOPT;
 735                 break;
 736         }
 737
 738         release_sock(sk);
 739         return err;
 740 }
 741
 742 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
 743 {
 744         struct sock *sk = sock->sk;
 745         struct sock *l2cap_sk;
 746         struct rfcomm_conninfo cinfo;
 747         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
 748         int len, err = 0;
 749         u32 opt;
 750
 751         BT_DBG("sk %p", sk);
 752
 753         if (get_user(len, optlen))
 754                 return -EFAULT;
 755
 756         lock_sock(sk);
 757
 758         switch (optname) {
 759         case RFCOMM_LM:
 760                 switch (rfcomm_pi(sk)->sec_level) {
 761                 case BT_SECURITY_LOW:
 762                         opt = RFCOMM_LM_AUTH;
 763                         break;
 764                 case BT_SECURITY_MEDIUM:
 765                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
 766                         break;
 767                 case BT_SECURITY_HIGH:
 768                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
 769                                                         RFCOMM_LM_SECURE;
 770                         break;
 771                 default:
 772                         opt = 0;
 773                         break;
 774                 }
 775
 776                 if (rfcomm_pi(sk)->role_switch)
 777                         opt |= RFCOMM_LM_MASTER;
 778
 779                 if (put_user(opt, (u32 __user *) optval))
 780                         err = -EFAULT;
 781                 break;
 782
 783         case RFCOMM_CONNINFO:
 784                 if (sk->sk_state != BT_CONNECTED &&
 785                                         !rfcomm_pi(sk)->dlc->defer_setup) {
 786                         err = -ENOTCONN;
 787                         break;
 788                 }
 789
 790                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 791
 792                 memset(&cinfo, 0, sizeof(cinfo));
 793                 cinfo.hci_handle = conn->hcon->handle;
 794                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
 795
 796                 len = min_t(unsigned int, len, sizeof(cinfo));
 797                 if (copy_to_user(optval, (char *) &cinfo, len))
 798                         err = -EFAULT;
 799
 800                 break;
 801
 802         default:
 803                 err = -ENOPROTOOPT;
 804                 break;
 805         }
 806
 807         release_sock(sk);
 808         return err;
 809 }
 810
 811 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 812 {
 813         struct sock *sk = sock->sk;
 814         struct bt_security sec;
 815         int len, err = 0;
 816
 817         BT_DBG("sk %p", sk);
 818
 819         if (level == SOL_RFCOMM)
 820                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
 821
 822         if (level != SOL_BLUETOOTH)
 823                 return -ENOPROTOOPT;
 824
 825         if (get_user(len, optlen))
 826                 return -EFAULT;
 827
 828         lock_sock(sk);
 829
 830         switch (optname) {
 831         case BT_SECURITY:
 832                 if (sk->sk_type != SOCK_STREAM) {
 833                         err = -EINVAL;
 834                         break;
 835                 }
 836
 837                 sec.level = rfcomm_pi(sk)->sec_level;
 838
 839                 len = min_t(unsigned int, len, sizeof(sec));
 840                 if (copy_to_user(optval, (char *) &sec, len))
 841                         err = -EFAULT;
 842
 843                 break;
 844
 845         case BT_DEFER_SETUP:
 846                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 847                         err = -EINVAL;
 848                         break;
 849                 }
 850
 851                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
 852                         err = -EFAULT;
 853
 854                 break;
 855
 856         default:
 857                 err = -ENOPROTOOPT;
 858                 break;
 859         }
 860
 861         release_sock(sk);
 862         return err;
 863 }
 864
 865 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 866 {
 867         struct sock *sk __maybe_unused = sock->sk;
 868         int err;
 869
 870         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 871
 872         err = bt_sock_ioctl(sock, cmd, arg);
 873
 874         if (err == -ENOIOCTLCMD) {
 875 #ifdef CONFIG_BT_RFCOMM_TTY
 876                 lock_sock(sk);
 877                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 878                 release_sock(sk);
 879 #else
 880                 err = -EOPNOTSUPP;
 881 #endif
 882         }
 883
 884         return err;
 885 }
 886
 887 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 888 {
 889         struct sock *sk = sock->sk;
 890         int err = 0;
 891
 892         BT_DBG("sock %p, sk %p", sock, sk);
 893
 894         if (!sk)
 895                 return 0;
 896
 897         lock_sock(sk);
 898         if (!sk->sk_shutdown) {
 899                 sk->sk_shutdown = SHUTDOWN_MASK;
 900                 __rfcomm_sock_close(sk);
 901
 902                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 903                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 904         }
 905         release_sock(sk);
 906         return err;
 907 }
 908
 909 static int rfcomm_sock_release(struct socket *sock)
 910 {
 911         struct sock *sk = sock->sk;
 912         int err;
 913
 914         BT_DBG("sock %p, sk %p", sock, sk);
 915
 916         if (!sk)
 917                 return 0;
 918
 919         err = rfcomm_sock_shutdown(sock, 2);
 920
 921         sock_orphan(sk);
 922         rfcomm_sock_kill(sk);
 923         return err;
 924 }
 925
 926 /* ---- RFCOMM core layer callbacks ----
 927  *
 928  * called under rfcomm_lock()
 929  */
 930 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 931 {
 932         struct sock *sk, *parent;
 933         bdaddr_t src, dst;
 934         int result = 0;
 935
 936         BT_DBG("session %p channel %d", s, channel);
 937
 938         rfcomm_session_getaddr(s, &src, &dst);
 939
 940         /* Check if we have socket listening on channel */
 941         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 942         if (!parent)
 943                 return 0;
 944
 945         bh_lock_sock(parent);
 946
 947         /* Check for backlog size */
 948         if (sk_acceptq_is_full(parent)) {
 949                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 950                 goto done;
 951         }
 952
 953         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 954         if (!sk)
 955                 goto done;
 956
 957         rfcomm_sock_init(sk, parent);
 958         bacpy(&bt_sk(sk)->src, &src);
 959         bacpy(&bt_sk(sk)->dst, &dst);
 960         rfcomm_pi(sk)->channel = channel;
 961
 962         sk->sk_state = BT_CONFIG;
 963         bt_accept_enqueue(parent, sk);
 964
 965         /* Accept connection and return socket DLC */
 966         *d = rfcomm_pi(sk)->dlc;
 967         result = 1;
 968
 969 done:
 970         bh_unlock_sock(parent);
 971
 972         if (bt_sk(parent)->defer_setup)
 973                 parent->sk_state_change(parent);
 974
 975         return result;
 976 }
 977
 978 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
 979 {
 980         struct sock *sk;
 981         struct hlist_node *node;
 982
 983         read_lock_bh(&rfcomm_sk_list.lock);
 984
 985         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 986                 seq_printf(f, "%s %s %d %d\n",
 987                                 batostr(&bt_sk(sk)->src),
 988                                 batostr(&bt_sk(sk)->dst),
 989                                 sk->sk_state, rfcomm_pi(sk)->channel);
 990         }
 991
 992         read_unlock_bh(&rfcomm_sk_list.lock);
 993
 994         return 0;
 995 }
 996
 997 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
 998 {
 999         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1000 }
1001
1002 static const struct file_operations rfcomm_sock_debugfs_fops = {
1003         .open           = rfcomm_sock_debugfs_open,
1004         .read           = seq_read,
1005         .llseek         = seq_lseek,
1006         .release        = single_release,
1007 };
1008
1009 static struct dentry *rfcomm_sock_debugfs;
1010
1011 static const struct proto_ops rfcomm_sock_ops = {
1012         .family         = PF_BLUETOOTH,
1013         .owner          = THIS_MODULE,
1014         .release        = rfcomm_sock_release,
1015         .bind           = rfcomm_sock_bind,
1016         .connect        = rfcomm_sock_connect,
1017         .listen         = rfcomm_sock_listen,
1018         .accept         = rfcomm_sock_accept,
1019         .getname        = rfcomm_sock_getname,
1020         .sendmsg        = rfcomm_sock_sendmsg,
1021         .recvmsg        = rfcomm_sock_recvmsg,
1022         .shutdown       = rfcomm_sock_shutdown,
1023         .setsockopt     = rfcomm_sock_setsockopt,
1024         .getsockopt     = rfcomm_sock_getsockopt,
1025         .ioctl          = rfcomm_sock_ioctl,
1026         .poll           = bt_sock_poll,
1027         .socketpair     = sock_no_socketpair,
1028         .mmap           = sock_no_mmap
1029 };
1030
1031 static const struct net_proto_family rfcomm_sock_family_ops = {
1032         .family         = PF_BLUETOOTH,
1033         .owner          = THIS_MODULE,
1034         .create         = rfcomm_sock_create
1035 };
1036
1037 int __init rfcomm_init_sockets(void)
1038 {
1039         int err;
1040
1041         err = proto_register(&rfcomm_proto, 0);
1042         if (err < 0)
1043                 return err;
1044
1045         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1046         if (err < 0)
1047                 goto error;
1048
1049         if (bt_debugfs) {
1050                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1051                                 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
1052                 if (!rfcomm_sock_debugfs)
1053                         BT_ERR("Failed to create RFCOMM debug file");
1054         }
1055
1056         BT_INFO("RFCOMM socket layer initialized");
1057
1058         return 0;
1059
1060 error:
1061         BT_ERR("RFCOMM socket layer registration failed");
1062         proto_unregister(&rfcomm_proto);
1063         return err;
1064 }
1065
1066 void __exit rfcomm_cleanup_sockets(void)
1067 {
1068         debugfs_remove(rfcomm_sock_debugfs);
1069
1070         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
1071                 BT_ERR("RFCOMM socket layer unregistration failed");
1072
1073         proto_unregister(&rfcomm_proto);
1074 }