net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36
  37 #include "smp.h"
  38
  39 static struct bt_sock_list l2cap_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  41 };
  42
  43 static const struct proto_ops l2cap_sock_ops;
  44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  46                                      int proto, gfp_t prio);
  47
  48 bool l2cap_is_socket(struct socket *sock)
  49 {
  50         return sock && sock->ops == &l2cap_sock_ops;
  51 }
  52 EXPORT_SYMBOL(l2cap_is_socket);
  53
  54 static int l2cap_validate_bredr_psm(u16 psm)
  55 {
  56         /* PSM must be odd and lsb of upper byte must be 0 */
  57         if ((psm & 0x0101) != 0x0001)
  58                 return -EINVAL;
  59
  60         /* Restrict usage of well-known PSMs */
  61         if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
  62                 return -EACCES;
  63
  64         return 0;
  65 }
  66
  67 static int l2cap_validate_le_psm(u16 psm)
  68 {
  69         /* Valid LE_PSM ranges are defined only until 0x00ff */
  70         if (psm > 0x00ff)
  71                 return -EINVAL;
  72
  73         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  74         if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
  75                 return -EACCES;
  76
  77         return 0;
  78 }
  79
  80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  81 {
  82         struct sock *sk = sock->sk;
  83         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  84         struct sockaddr_l2 la;
  85         int len, err = 0;
  86
  87         BT_DBG("sk %p", sk);
  88
  89         if (!addr || addr->sa_family != AF_BLUETOOTH)
  90                 return -EINVAL;
  91
  92         memset(&la, 0, sizeof(la));
  93         len = min_t(unsigned int, sizeof(la), alen);
  94         memcpy(&la, addr, len);
  95
  96         if (la.l2_cid && la.l2_psm)
  97                 return -EINVAL;
  98
  99         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 100                 return -EINVAL;
 101
 102         if (la.l2_cid) {
 103                 /* When the socket gets created it defaults to
 104                  * CHAN_CONN_ORIENTED, so we need to overwrite the
 105                  * default here.
 106                  */
 107                 chan->chan_type = L2CAP_CHAN_FIXED;
 108                 chan->omtu = L2CAP_DEFAULT_MTU;
 109         }
 110
 111         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 112                 /* We only allow ATT user space socket */
 113                 if (la.l2_cid &&
 114                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 115                         return -EINVAL;
 116         }
 117
 118         lock_sock(sk);
 119
 120         if (sk->sk_state != BT_OPEN) {
 121                 err = -EBADFD;
 122                 goto done;
 123         }
 124
 125         if (la.l2_psm) {
 126                 __u16 psm = __le16_to_cpu(la.l2_psm);
 127
 128                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 129                         err = l2cap_validate_bredr_psm(psm);
 130                 else
 131                         err = l2cap_validate_le_psm(psm);
 132
 133                 if (err)
 134                         goto done;
 135         }
 136
 137         if (la.l2_cid)
 138                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 139         else
 140                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 141
 142         if (err < 0)
 143                 goto done;
 144
 145         switch (chan->chan_type) {
 146         case L2CAP_CHAN_CONN_LESS:
 147                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 148                         chan->sec_level = BT_SECURITY_SDP;
 149                 break;
 150         case L2CAP_CHAN_CONN_ORIENTED:
 151                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 152                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 153                         chan->sec_level = BT_SECURITY_SDP;
 154                 break;
 155         case L2CAP_CHAN_RAW:
 156                 chan->sec_level = BT_SECURITY_SDP;
 157                 break;
 158         }
 159
 160         bacpy(&chan->src, &la.l2_bdaddr);
 161         chan->src_type = la.l2_bdaddr_type;
 162
 163         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 164                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 165
 166         chan->state = BT_BOUND;
 167         sk->sk_state = BT_BOUND;
 168
 169 done:
 170         release_sock(sk);
 171         return err;
 172 }
 173
 174 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 175                               int alen, int flags)
 176 {
 177         struct sock *sk = sock->sk;
 178         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 179         struct sockaddr_l2 la;
 180         int len, err = 0;
 181
 182         BT_DBG("sk %p", sk);
 183
 184         if (!addr || alen < sizeof(addr->sa_family) ||
 185             addr->sa_family != AF_BLUETOOTH)
 186                 return -EINVAL;
 187
 188         memset(&la, 0, sizeof(la));
 189         len = min_t(unsigned int, sizeof(la), alen);
 190         memcpy(&la, addr, len);
 191
 192         if (la.l2_cid && la.l2_psm)
 193                 return -EINVAL;
 194
 195         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 196                 return -EINVAL;
 197
 198         /* Check that the socket wasn't bound to something that
 199          * conflicts with the address given to connect(). If chan->src
 200          * is BDADDR_ANY it means bind() was never used, in which case
 201          * chan->src_type and la.l2_bdaddr_type do not need to match.
 202          */
 203         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 204             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 205                 /* Old user space versions will try to incorrectly bind
 206                  * the ATT socket using BDADDR_BREDR. We need to accept
 207                  * this and fix up the source address type only when
 208                  * both the source CID and destination CID indicate
 209                  * ATT. Anything else is an invalid combination.
 210                  */
 211                 if (chan->scid != L2CAP_CID_ATT ||
 212                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 213                         return -EINVAL;
 214
 215                 /* We don't have the hdev available here to make a
 216                  * better decision on random vs public, but since all
 217                  * user space versions that exhibit this issue anyway do
 218                  * not support random local addresses assuming public
 219                  * here is good enough.
 220                  */
 221                 chan->src_type = BDADDR_LE_PUBLIC;
 222         }
 223
 224         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 225                 return -EINVAL;
 226
 227         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 228                 /* We only allow ATT user space socket */
 229                 if (la.l2_cid &&
 230                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 231                         return -EINVAL;
 232         }
 233
 234         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 235                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 236
 237         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 238                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 239         if (err)
 240                 return err;
 241
 242         lock_sock(sk);
 243
 244         err = bt_sock_wait_state(sk, BT_CONNECTED,
 245                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 246
 247         release_sock(sk);
 248
 249         return err;
 250 }
 251
 252 static int l2cap_sock_listen(struct socket *sock, int backlog)
 253 {
 254         struct sock *sk = sock->sk;
 255         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 256         int err = 0;
 257
 258         BT_DBG("sk %p backlog %d", sk, backlog);
 259
 260         lock_sock(sk);
 261
 262         if (sk->sk_state != BT_BOUND) {
 263                 err = -EBADFD;
 264                 goto done;
 265         }
 266
 267         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 268                 err = -EINVAL;
 269                 goto done;
 270         }
 271
 272         switch (chan->mode) {
 273         case L2CAP_MODE_BASIC:
 274         case L2CAP_MODE_LE_FLOWCTL:
 275                 break;
 276         case L2CAP_MODE_ERTM:
 277         case L2CAP_MODE_STREAMING:
 278                 if (!disable_ertm)
 279                         break;
 280                 /* fall through */
 281         default:
 282                 err = -ENOTSUPP;
 283                 goto done;
 284         }
 285
 286         sk->sk_max_ack_backlog = backlog;
 287         sk->sk_ack_backlog = 0;
 288
 289         chan->state = BT_LISTEN;
 290         sk->sk_state = BT_LISTEN;
 291
 292 done:
 293         release_sock(sk);
 294         return err;
 295 }
 296
 297 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 298                              int flags)
 299 {
 300         DECLARE_WAITQUEUE(wait, current);
 301         struct sock *sk = sock->sk, *nsk;
 302         long timeo;
 303         int err = 0;
 304
 305         lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 306
 307         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 308
 309         BT_DBG("sk %p timeo %ld", sk, timeo);
 310
 311         /* Wait for an incoming connection. (wake-one). */
 312         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 313         while (1) {
 314                 set_current_state(TASK_INTERRUPTIBLE);
 315
 316                 if (sk->sk_state != BT_LISTEN) {
 317                         err = -EBADFD;
 318                         break;
 319                 }
 320
 321                 nsk = bt_accept_dequeue(sk, newsock);
 322                 if (nsk)
 323                         break;
 324
 325                 if (!timeo) {
 326                         err = -EAGAIN;
 327                         break;
 328                 }
 329
 330                 if (signal_pending(current)) {
 331                         err = sock_intr_errno(timeo);
 332                         break;
 333                 }
 334
 335                 release_sock(sk);
 336                 timeo = schedule_timeout(timeo);
 337                 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
 338         }
 339         __set_current_state(TASK_RUNNING);
 340         remove_wait_queue(sk_sleep(sk), &wait);
 341
 342         if (err)
 343                 goto done;
 344
 345         newsock->state = SS_CONNECTED;
 346
 347         BT_DBG("new socket %p", nsk);
 348
 349 done:
 350         release_sock(sk);
 351         return err;
 352 }
 353
 354 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 355                               int *len, int peer)
 356 {
 357         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 358         struct sock *sk = sock->sk;
 359         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 360
 361         BT_DBG("sock %p, sk %p", sock, sk);
 362
 363         if (peer && sk->sk_state != BT_CONNECTED &&
 364             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2)
 365                 return -ENOTCONN;
 366
 367         memset(la, 0, sizeof(struct sockaddr_l2));
 368         addr->sa_family = AF_BLUETOOTH;
 369         *len = sizeof(struct sockaddr_l2);
 370
 371         la->l2_psm = chan->psm;
 372
 373         if (peer) {
 374                 bacpy(&la->l2_bdaddr, &chan->dst);
 375                 la->l2_cid = cpu_to_le16(chan->dcid);
 376                 la->l2_bdaddr_type = chan->dst_type;
 377         } else {
 378                 bacpy(&la->l2_bdaddr, &chan->src);
 379                 la->l2_cid = cpu_to_le16(chan->scid);
 380                 la->l2_bdaddr_type = chan->src_type;
 381         }
 382
 383         return 0;
 384 }
 385
 386 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 387                                      char __user *optval, int __user *optlen)
 388 {
 389         struct sock *sk = sock->sk;
 390         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 391         struct l2cap_options opts;
 392         struct l2cap_conninfo cinfo;
 393         int len, err = 0;
 394         u32 opt;
 395
 396         BT_DBG("sk %p", sk);
 397
 398         if (get_user(len, optlen))
 399                 return -EFAULT;
 400
 401         lock_sock(sk);
 402
 403         switch (optname) {
 404         case L2CAP_OPTIONS:
 405                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 406                  * legacy ATT code depends on getsockopt for
 407                  * L2CAP_OPTIONS we need to let this pass.
 408                  */
 409                 if (bdaddr_type_is_le(chan->src_type) &&
 410                     chan->scid != L2CAP_CID_ATT) {
 411                         err = -EINVAL;
 412                         break;
 413                 }
 414
 415                 memset(&opts, 0, sizeof(opts));
 416                 opts.imtu     = chan->imtu;
 417                 opts.omtu     = chan->omtu;
 418                 opts.flush_to = chan->flush_to;
 419                 opts.mode     = chan->mode;
 420                 opts.fcs      = chan->fcs;
 421                 opts.max_tx   = chan->max_tx;
 422                 opts.txwin_size = chan->tx_win;
 423
 424                 len = min_t(unsigned int, len, sizeof(opts));
 425                 if (copy_to_user(optval, (char *) &opts, len))
 426                         err = -EFAULT;
 427
 428                 break;
 429
 430         case L2CAP_LM:
 431                 switch (chan->sec_level) {
 432                 case BT_SECURITY_LOW:
 433                         opt = L2CAP_LM_AUTH;
 434                         break;
 435                 case BT_SECURITY_MEDIUM:
 436                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 437                         break;
 438                 case BT_SECURITY_HIGH:
 439                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 440                               L2CAP_LM_SECURE;
 441                         break;
 442                 case BT_SECURITY_FIPS:
 443                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 444                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 445                         break;
 446                 default:
 447                         opt = 0;
 448                         break;
 449                 }
 450
 451                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 452                         opt |= L2CAP_LM_MASTER;
 453
 454                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 455                         opt |= L2CAP_LM_RELIABLE;
 456
 457                 if (put_user(opt, (u32 __user *) optval))
 458                         err = -EFAULT;
 459
 460                 break;
 461
 462         case L2CAP_CONNINFO:
 463                 if (sk->sk_state != BT_CONNECTED &&
 464                     !(sk->sk_state == BT_CONNECT2 &&
 465                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 466                         err = -ENOTCONN;
 467                         break;
 468                 }
 469
 470                 memset(&cinfo, 0, sizeof(cinfo));
 471                 cinfo.hci_handle = chan->conn->hcon->handle;
 472                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 473
 474                 len = min_t(unsigned int, len, sizeof(cinfo));
 475                 if (copy_to_user(optval, (char *) &cinfo, len))
 476                         err = -EFAULT;
 477
 478                 break;
 479
 480         default:
 481                 err = -ENOPROTOOPT;
 482                 break;
 483         }
 484
 485         release_sock(sk);
 486         return err;
 487 }
 488
 489 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 490                                  char __user *optval, int __user *optlen)
 491 {
 492         struct sock *sk = sock->sk;
 493         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 494         struct bt_security sec;
 495         struct bt_power pwr;
 496         int len, err = 0;
 497
 498         BT_DBG("sk %p", sk);
 499
 500         if (level == SOL_L2CAP)
 501                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 502
 503         if (level != SOL_BLUETOOTH)
 504                 return -ENOPROTOOPT;
 505
 506         if (get_user(len, optlen))
 507                 return -EFAULT;
 508
 509         lock_sock(sk);
 510
 511         switch (optname) {
 512         case BT_SECURITY:
 513                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 514                     chan->chan_type != L2CAP_CHAN_FIXED &&
 515                     chan->chan_type != L2CAP_CHAN_RAW) {
 516                         err = -EINVAL;
 517                         break;
 518                 }
 519
 520                 memset(&sec, 0, sizeof(sec));
 521                 if (chan->conn) {
 522                         sec.level = chan->conn->hcon->sec_level;
 523
 524                         if (sk->sk_state == BT_CONNECTED)
 525                                 sec.key_size = chan->conn->hcon->enc_key_size;
 526                 } else {
 527                         sec.level = chan->sec_level;
 528                 }
 529
 530                 len = min_t(unsigned int, len, sizeof(sec));
 531                 if (copy_to_user(optval, (char *) &sec, len))
 532                         err = -EFAULT;
 533
 534                 break;
 535
 536         case BT_DEFER_SETUP:
 537                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 538                         err = -EINVAL;
 539                         break;
 540                 }
 541
 542                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 543                              (u32 __user *) optval))
 544                         err = -EFAULT;
 545
 546                 break;
 547
 548         case BT_FLUSHABLE:
 549                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 550                              (u32 __user *) optval))
 551                         err = -EFAULT;
 552
 553                 break;
 554
 555         case BT_POWER:
 556                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 557                     && sk->sk_type != SOCK_RAW) {
 558                         err = -EINVAL;
 559                         break;
 560                 }
 561
 562                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 563
 564                 len = min_t(unsigned int, len, sizeof(pwr));
 565                 if (copy_to_user(optval, (char *) &pwr, len))
 566                         err = -EFAULT;
 567
 568                 break;
 569
 570         case BT_CHANNEL_POLICY:
 571                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 572                         err = -EFAULT;
 573                 break;
 574
 575         case BT_SNDMTU:
 576                 if (!bdaddr_type_is_le(chan->src_type)) {
 577                         err = -EINVAL;
 578                         break;
 579                 }
 580
 581                 if (sk->sk_state != BT_CONNECTED) {
 582                         err = -ENOTCONN;
 583                         break;
 584                 }
 585
 586                 if (put_user(chan->omtu, (u16 __user *) optval))
 587                         err = -EFAULT;
 588                 break;
 589
 590         case BT_RCVMTU:
 591                 if (!bdaddr_type_is_le(chan->src_type)) {
 592                         err = -EINVAL;
 593                         break;
 594                 }
 595
 596                 if (put_user(chan->imtu, (u16 __user *) optval))
 597                         err = -EFAULT;
 598                 break;
 599
 600         default:
 601                 err = -ENOPROTOOPT;
 602                 break;
 603         }
 604
 605         release_sock(sk);
 606         return err;
 607 }
 608
 609 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 610 {
 611         switch (chan->scid) {
 612         case L2CAP_CID_ATT:
 613                 if (mtu < L2CAP_LE_MIN_MTU)
 614                         return false;
 615                 break;
 616
 617         default:
 618                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 619                         return false;
 620         }
 621
 622         return true;
 623 }
 624
 625 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 626                                      char __user *optval, unsigned int optlen)
 627 {
 628         struct sock *sk = sock->sk;
 629         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 630         struct l2cap_options opts;
 631         int len, err = 0;
 632         u32 opt;
 633
 634         BT_DBG("sk %p", sk);
 635
 636         lock_sock(sk);
 637
 638         switch (optname) {
 639         case L2CAP_OPTIONS:
 640                 if (bdaddr_type_is_le(chan->src_type)) {
 641                         err = -EINVAL;
 642                         break;
 643                 }
 644
 645                 if (sk->sk_state == BT_CONNECTED) {
 646                         err = -EINVAL;
 647                         break;
 648                 }
 649
 650                 opts.imtu     = chan->imtu;
 651                 opts.omtu     = chan->omtu;
 652                 opts.flush_to = chan->flush_to;
 653                 opts.mode     = chan->mode;
 654                 opts.fcs      = chan->fcs;
 655                 opts.max_tx   = chan->max_tx;
 656                 opts.txwin_size = chan->tx_win;
 657
 658                 len = min_t(unsigned int, sizeof(opts), optlen);
 659                 if (copy_from_user((char *) &opts, optval, len)) {
 660                         err = -EFAULT;
 661                         break;
 662                 }
 663
 664                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 665                         err = -EINVAL;
 666                         break;
 667                 }
 668
 669                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 670                         err = -EINVAL;
 671                         break;
 672                 }
 673
 674                 chan->mode = opts.mode;
 675                 switch (chan->mode) {
 676                 case L2CAP_MODE_LE_FLOWCTL:
 677                         break;
 678                 case L2CAP_MODE_BASIC:
 679                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 680                         break;
 681                 case L2CAP_MODE_ERTM:
 682                 case L2CAP_MODE_STREAMING:
 683                         if (!disable_ertm)
 684                                 break;
 685                         /* fall through */
 686                 default:
 687                         err = -EINVAL;
 688                         break;
 689                 }
 690
 691                 chan->imtu = opts.imtu;
 692                 chan->omtu = opts.omtu;
 693                 chan->fcs  = opts.fcs;
 694                 chan->max_tx = opts.max_tx;
 695                 chan->tx_win = opts.txwin_size;
 696                 chan->flush_to = opts.flush_to;
 697                 break;
 698
 699         case L2CAP_LM:
 700                 if (get_user(opt, (u32 __user *) optval)) {
 701                         err = -EFAULT;
 702                         break;
 703                 }
 704
 705                 if (opt & L2CAP_LM_FIPS) {
 706                         err = -EINVAL;
 707                         break;
 708                 }
 709
 710                 if (opt & L2CAP_LM_AUTH)
 711                         chan->sec_level = BT_SECURITY_LOW;
 712                 if (opt & L2CAP_LM_ENCRYPT)
 713                         chan->sec_level = BT_SECURITY_MEDIUM;
 714                 if (opt & L2CAP_LM_SECURE)
 715                         chan->sec_level = BT_SECURITY_HIGH;
 716
 717                 if (opt & L2CAP_LM_MASTER)
 718                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 719                 else
 720                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 721
 722                 if (opt & L2CAP_LM_RELIABLE)
 723                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 724                 else
 725                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 726                 break;
 727
 728         default:
 729                 err = -ENOPROTOOPT;
 730                 break;
 731         }
 732
 733         release_sock(sk);
 734         return err;
 735 }
 736
 737 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 738                                  char __user *optval, unsigned int optlen)
 739 {
 740         struct sock *sk = sock->sk;
 741         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 742         struct bt_security sec;
 743         struct bt_power pwr;
 744         struct l2cap_conn *conn;
 745         int len, err = 0;
 746         u32 opt;
 747
 748         BT_DBG("sk %p", sk);
 749
 750         if (level == SOL_L2CAP)
 751                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 752
 753         if (level != SOL_BLUETOOTH)
 754                 return -ENOPROTOOPT;
 755
 756         lock_sock(sk);
 757
 758         switch (optname) {
 759         case BT_SECURITY:
 760                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 761                     chan->chan_type != L2CAP_CHAN_FIXED &&
 762                     chan->chan_type != L2CAP_CHAN_RAW) {
 763                         err = -EINVAL;
 764                         break;
 765                 }
 766
 767                 sec.level = BT_SECURITY_LOW;
 768
 769                 len = min_t(unsigned int, sizeof(sec), optlen);
 770                 if (copy_from_user((char *) &sec, optval, len)) {
 771                         err = -EFAULT;
 772                         break;
 773                 }
 774
 775                 if (sec.level < BT_SECURITY_LOW ||
 776                     sec.level > BT_SECURITY_HIGH) {
 777                         err = -EINVAL;
 778                         break;
 779                 }
 780
 781                 chan->sec_level = sec.level;
 782
 783                 if (!chan->conn)
 784                         break;
 785
 786                 conn = chan->conn;
 787
 788                 /*change security for LE channels */
 789                 if (chan->scid == L2CAP_CID_ATT) {
 790                         if (!conn->hcon->out) {
 791                                 err = -EINVAL;
 792                                 break;
 793                         }
 794
 795                         if (smp_conn_security(conn->hcon, sec.level))
 796                                 break;
 797                         sk->sk_state = BT_CONFIG;
 798                         chan->state = BT_CONFIG;
 799
 800                 /* or for ACL link */
 801                 } else if ((sk->sk_state == BT_CONNECT2 &&
 802                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 803                            sk->sk_state == BT_CONNECTED) {
 804                         if (!l2cap_chan_check_security(chan))
 805                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 806                         else
 807                                 sk->sk_state_change(sk);
 808                 } else {
 809                         err = -EINVAL;
 810                 }
 811                 break;
 812
 813         case BT_DEFER_SETUP:
 814                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 815                         err = -EINVAL;
 816                         break;
 817                 }
 818
 819                 if (get_user(opt, (u32 __user *) optval)) {
 820                         err = -EFAULT;
 821                         break;
 822                 }
 823
 824                 if (opt) {
 825                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 826                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 827                 } else {
 828                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 829                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 830                 }
 831                 break;
 832
 833         case BT_FLUSHABLE:
 834                 if (get_user(opt, (u32 __user *) optval)) {
 835                         err = -EFAULT;
 836                         break;
 837                 }
 838
 839                 if (opt > BT_FLUSHABLE_ON) {
 840                         err = -EINVAL;
 841                         break;
 842                 }
 843
 844                 if (opt == BT_FLUSHABLE_OFF) {
 845                         conn = chan->conn;
 846                         /* proceed further only when we have l2cap_conn and
 847                            No Flush support in the LM */
 848                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 849                                 err = -EINVAL;
 850                                 break;
 851                         }
 852                 }
 853
 854                 if (opt)
 855                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 856                 else
 857                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 858                 break;
 859
 860         case BT_POWER:
 861                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 862                     chan->chan_type != L2CAP_CHAN_RAW) {
 863                         err = -EINVAL;
 864                         break;
 865                 }
 866
 867                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 868
 869                 len = min_t(unsigned int, sizeof(pwr), optlen);
 870                 if (copy_from_user((char *) &pwr, optval, len)) {
 871                         err = -EFAULT;
 872                         break;
 873                 }
 874
 875                 if (pwr.force_active)
 876                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 877                 else
 878                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 879                 break;
 880
 881         case BT_CHANNEL_POLICY:
 882                 if (get_user(opt, (u32 __user *) optval)) {
 883                         err = -EFAULT;
 884                         break;
 885                 }
 886
 887                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 888                         err = -EINVAL;
 889                         break;
 890                 }
 891
 892                 if (chan->mode != L2CAP_MODE_ERTM &&
 893                     chan->mode != L2CAP_MODE_STREAMING) {
 894                         err = -EOPNOTSUPP;
 895                         break;
 896                 }
 897
 898                 chan->chan_policy = (u8) opt;
 899
 900                 if (sk->sk_state == BT_CONNECTED &&
 901                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 902                         l2cap_move_start(chan);
 903
 904                 break;
 905
 906         case BT_SNDMTU:
 907                 if (!bdaddr_type_is_le(chan->src_type)) {
 908                         err = -EINVAL;
 909                         break;
 910                 }
 911
 912                 /* Setting is not supported as it's the remote side that
 913                  * decides this.
 914                  */
 915                 err = -EPERM;
 916                 break;
 917
 918         case BT_RCVMTU:
 919                 if (!bdaddr_type_is_le(chan->src_type)) {
 920                         err = -EINVAL;
 921                         break;
 922                 }
 923
 924                 if (sk->sk_state == BT_CONNECTED) {
 925                         err = -EISCONN;
 926                         break;
 927                 }
 928
 929                 if (get_user(opt, (u32 __user *) optval)) {
 930                         err = -EFAULT;
 931                         break;
 932                 }
 933
 934                 chan->imtu = opt;
 935                 break;
 936
 937         default:
 938                 err = -ENOPROTOOPT;
 939                 break;
 940         }
 941
 942         release_sock(sk);
 943         return err;
 944 }
 945
 946 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 947                               struct msghdr *msg, size_t len)
 948 {
 949         struct sock *sk = sock->sk;
 950         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 951         int err;
 952
 953         BT_DBG("sock %p, sk %p", sock, sk);
 954
 955         err = sock_error(sk);
 956         if (err)
 957                 return err;
 958
 959         if (msg->msg_flags & MSG_OOB)
 960                 return -EOPNOTSUPP;
 961
 962         if (sk->sk_state != BT_CONNECTED)
 963                 return -ENOTCONN;
 964
 965         lock_sock(sk);
 966         err = bt_sock_wait_ready(sk, msg->msg_flags);
 967         release_sock(sk);
 968         if (err)
 969                 return err;
 970
 971         l2cap_chan_lock(chan);
 972         err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
 973         l2cap_chan_unlock(chan);
 974
 975         return err;
 976 }
 977
 978 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 979                               struct msghdr *msg, size_t len, int flags)
 980 {
 981         struct sock *sk = sock->sk;
 982         struct l2cap_pinfo *pi = l2cap_pi(sk);
 983         int err;
 984
 985         lock_sock(sk);
 986
 987         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
 988                                                     &bt_sk(sk)->flags)) {
 989                 if (bdaddr_type_is_le(pi->chan->src_type)) {
 990                         sk->sk_state = BT_CONNECTED;
 991                         pi->chan->state = BT_CONNECTED;
 992                         __l2cap_le_connect_rsp_defer(pi->chan);
 993                 } else {
 994                         sk->sk_state = BT_CONFIG;
 995                         pi->chan->state = BT_CONFIG;
 996                         __l2cap_connect_rsp_defer(pi->chan);
 997                 }
 998
 999                 err = 0;
1000                 goto done;
1001         }
1002
1003         release_sock(sk);
1004
1005         if (sock->type == SOCK_STREAM)
1006                 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1007         else
1008                 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1009
1010         if (pi->chan->mode != L2CAP_MODE_ERTM)
1011                 return err;
1012
1013         /* Attempt to put pending rx data in the socket buffer */
1014
1015         lock_sock(sk);
1016
1017         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1018                 goto done;
1019
1020         if (pi->rx_busy_skb) {
1021                 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1022                         pi->rx_busy_skb = NULL;
1023                 else
1024                         goto done;
1025         }
1026
1027         /* Restore data flow when half of the receive buffer is
1028          * available.  This avoids resending large numbers of
1029          * frames.
1030          */
1031         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1032                 l2cap_chan_busy(pi->chan, 0);
1033
1034 done:
1035         release_sock(sk);
1036         return err;
1037 }
1038
1039 /* Kill socket (only if zapped and orphan)
1040  * Must be called on unlocked socket.
1041  */
1042 static void l2cap_sock_kill(struct sock *sk)
1043 {
1044         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1045                 return;
1046
1047         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1048
1049         /* Kill poor orphan */
1050
1051         l2cap_chan_put(l2cap_pi(sk)->chan);
1052         sock_set_flag(sk, SOCK_DEAD);
1053         sock_put(sk);
1054 }
1055
1056 static int __l2cap_wait_ack(struct sock *sk)
1057 {
1058         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1059         DECLARE_WAITQUEUE(wait, current);
1060         int err = 0;
1061         int timeo = HZ/5;
1062
1063         add_wait_queue(sk_sleep(sk), &wait);
1064         set_current_state(TASK_INTERRUPTIBLE);
1065         while (chan->unacked_frames > 0 && chan->conn) {
1066                 if (!timeo)
1067                         timeo = HZ/5;
1068
1069                 if (signal_pending(current)) {
1070                         err = sock_intr_errno(timeo);
1071                         break;
1072                 }
1073
1074                 release_sock(sk);
1075                 timeo = schedule_timeout(timeo);
1076                 lock_sock(sk);
1077                 set_current_state(TASK_INTERRUPTIBLE);
1078
1079                 err = sock_error(sk);
1080                 if (err)
1081                         break;
1082         }
1083         set_current_state(TASK_RUNNING);
1084         remove_wait_queue(sk_sleep(sk), &wait);
1085         return err;
1086 }
1087
1088 static int l2cap_sock_shutdown(struct socket *sock, int how)
1089 {
1090         struct sock *sk = sock->sk;
1091         struct l2cap_chan *chan;
1092         struct l2cap_conn *conn;
1093         int err = 0;
1094
1095         BT_DBG("sock %p, sk %p", sock, sk);
1096
1097         if (!sk)
1098                 return 0;
1099
1100         chan = l2cap_pi(sk)->chan;
1101         conn = chan->conn;
1102
1103         if (conn)
1104                 mutex_lock(&conn->chan_lock);
1105
1106         l2cap_chan_lock(chan);
1107         lock_sock(sk);
1108
1109         if (!sk->sk_shutdown) {
1110                 if (chan->mode == L2CAP_MODE_ERTM)
1111                         err = __l2cap_wait_ack(sk);
1112
1113                 sk->sk_shutdown = SHUTDOWN_MASK;
1114
1115                 release_sock(sk);
1116                 l2cap_chan_close(chan, 0);
1117                 lock_sock(sk);
1118
1119                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1120                         err = bt_sock_wait_state(sk, BT_CLOSED,
1121                                                  sk->sk_lingertime);
1122         }
1123
1124         if (!err && sk->sk_err)
1125                 err = -sk->sk_err;
1126
1127         release_sock(sk);
1128         l2cap_chan_unlock(chan);
1129
1130         if (conn)
1131                 mutex_unlock(&conn->chan_lock);
1132
1133         return err;
1134 }
1135
1136 static int l2cap_sock_release(struct socket *sock)
1137 {
1138         struct sock *sk = sock->sk;
1139         int err;
1140
1141         BT_DBG("sock %p, sk %p", sock, sk);
1142
1143         if (!sk)
1144                 return 0;
1145
1146         bt_sock_unlink(&l2cap_sk_list, sk);
1147
1148         err = l2cap_sock_shutdown(sock, 2);
1149
1150         sock_orphan(sk);
1151         l2cap_sock_kill(sk);
1152         return err;
1153 }
1154
1155 static void l2cap_sock_cleanup_listen(struct sock *parent)
1156 {
1157         struct sock *sk;
1158
1159         BT_DBG("parent %p", parent);
1160
1161         /* Close not yet accepted channels */
1162         while ((sk = bt_accept_dequeue(parent, NULL))) {
1163                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1164
1165                 l2cap_chan_lock(chan);
1166                 __clear_chan_timer(chan);
1167                 l2cap_chan_close(chan, ECONNRESET);
1168                 l2cap_chan_unlock(chan);
1169
1170                 l2cap_sock_kill(sk);
1171         }
1172 }
1173
1174 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1175 {
1176         struct sock *sk, *parent = chan->data;
1177
1178         lock_sock(parent);
1179
1180         /* Check for backlog size */
1181         if (sk_acceptq_is_full(parent)) {
1182                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1183                 release_sock(parent);
1184                 return NULL;
1185         }
1186
1187         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1188                               GFP_ATOMIC);
1189         if (!sk) {
1190                 release_sock(parent);
1191                 return NULL;
1192         }
1193
1194         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1195
1196         l2cap_sock_init(sk, parent);
1197
1198         bt_accept_enqueue(parent, sk);
1199
1200         release_sock(parent);
1201
1202         return l2cap_pi(sk)->chan;
1203 }
1204
1205 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1206 {
1207         struct sock *sk = chan->data;
1208         int err;
1209
1210         lock_sock(sk);
1211
1212         if (l2cap_pi(sk)->rx_busy_skb) {
1213                 err = -ENOMEM;
1214                 goto done;
1215         }
1216
1217         err = sock_queue_rcv_skb(sk, skb);
1218
1219         /* For ERTM, handle one skb that doesn't fit into the recv
1220          * buffer.  This is important to do because the data frames
1221          * have already been acked, so the skb cannot be discarded.
1222          *
1223          * Notify the l2cap core that the buffer is full, so the
1224          * LOCAL_BUSY state is entered and no more frames are
1225          * acked and reassembled until there is buffer space
1226          * available.
1227          */
1228         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1229                 l2cap_pi(sk)->rx_busy_skb = skb;
1230                 l2cap_chan_busy(chan, 1);
1231                 err = 0;
1232         }
1233
1234 done:
1235         release_sock(sk);
1236
1237         return err;
1238 }
1239
1240 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1241 {
1242         struct sock *sk = chan->data;
1243
1244         l2cap_sock_kill(sk);
1245 }
1246
1247 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1248 {
1249         struct sock *sk = chan->data;
1250         struct sock *parent;
1251
1252         lock_sock(sk);
1253
1254         parent = bt_sk(sk)->parent;
1255
1256         sock_set_flag(sk, SOCK_ZAPPED);
1257
1258         switch (chan->state) {
1259         case BT_OPEN:
1260         case BT_BOUND:
1261         case BT_CLOSED:
1262                 break;
1263         case BT_LISTEN:
1264                 l2cap_sock_cleanup_listen(sk);
1265                 sk->sk_state = BT_CLOSED;
1266                 chan->state = BT_CLOSED;
1267
1268                 break;
1269         default:
1270                 sk->sk_state = BT_CLOSED;
1271                 chan->state = BT_CLOSED;
1272
1273                 sk->sk_err = err;
1274
1275                 if (parent) {
1276                         bt_accept_unlink(sk);
1277                         parent->sk_data_ready(parent);
1278                 } else {
1279                         sk->sk_state_change(sk);
1280                 }
1281
1282                 break;
1283         }
1284
1285         release_sock(sk);
1286 }
1287
1288 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1289                                        int err)
1290 {
1291         struct sock *sk = chan->data;
1292
1293         sk->sk_state = state;
1294
1295         if (err)
1296                 sk->sk_err = err;
1297 }
1298
1299 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1300                                                unsigned long len, int nb)
1301 {
1302         struct sock *sk = chan->data;
1303         struct sk_buff *skb;
1304         int err;
1305
1306         l2cap_chan_unlock(chan);
1307         skb = bt_skb_send_alloc(sk, len, nb, &err);
1308         l2cap_chan_lock(chan);
1309
1310         if (!skb)
1311                 return ERR_PTR(err);
1312
1313         bt_cb(skb)->chan = chan;
1314
1315         return skb;
1316 }
1317
1318 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1319 {
1320         struct sock *sk = chan->data;
1321         struct sock *parent;
1322
1323         lock_sock(sk);
1324
1325         parent = bt_sk(sk)->parent;
1326
1327         BT_DBG("sk %p, parent %p", sk, parent);
1328
1329         sk->sk_state = BT_CONNECTED;
1330         sk->sk_state_change(sk);
1331
1332         if (parent)
1333                 parent->sk_data_ready(parent);
1334
1335         release_sock(sk);
1336 }
1337
1338 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1339 {
1340         struct sock *parent, *sk = chan->data;
1341
1342         lock_sock(sk);
1343
1344         parent = bt_sk(sk)->parent;
1345         if (parent)
1346                 parent->sk_data_ready(parent);
1347
1348         release_sock(sk);
1349 }
1350
1351 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1352 {
1353         struct sock *sk = chan->data;
1354
1355         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1356         sk->sk_state_change(sk);
1357 }
1358
1359 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1360 {
1361         struct sock *sk = chan->data;
1362
1363         lock_sock(sk);
1364         sk->sk_shutdown = SHUTDOWN_MASK;
1365         release_sock(sk);
1366 }
1367
1368 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1369 {
1370         struct sock *sk = chan->data;
1371
1372         return sk->sk_sndtimeo;
1373 }
1374
1375 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1376 {
1377         struct sock *sk = chan->data;
1378
1379         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1380         sk->sk_state_change(sk);
1381 }
1382
1383 static struct l2cap_ops l2cap_chan_ops = {
1384         .name           = "L2CAP Socket Interface",
1385         .new_connection = l2cap_sock_new_connection_cb,
1386         .recv           = l2cap_sock_recv_cb,
1387         .close          = l2cap_sock_close_cb,
1388         .teardown       = l2cap_sock_teardown_cb,
1389         .state_change   = l2cap_sock_state_change_cb,
1390         .ready          = l2cap_sock_ready_cb,
1391         .defer          = l2cap_sock_defer_cb,
1392         .resume         = l2cap_sock_resume_cb,
1393         .suspend        = l2cap_sock_suspend_cb,
1394         .set_shutdown   = l2cap_sock_set_shutdown_cb,
1395         .get_sndtimeo   = l2cap_sock_get_sndtimeo_cb,
1396         .alloc_skb      = l2cap_sock_alloc_skb_cb,
1397 };
1398
1399 static void l2cap_sock_destruct(struct sock *sk)
1400 {
1401         BT_DBG("sk %p", sk);
1402
1403         if (l2cap_pi(sk)->chan)
1404                 l2cap_chan_put(l2cap_pi(sk)->chan);
1405
1406         if (l2cap_pi(sk)->rx_busy_skb) {
1407                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1408                 l2cap_pi(sk)->rx_busy_skb = NULL;
1409         }
1410
1411         skb_queue_purge(&sk->sk_receive_queue);
1412         skb_queue_purge(&sk->sk_write_queue);
1413 }
1414
1415 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1416                                int *msg_namelen)
1417 {
1418         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1419
1420         memset(la, 0, sizeof(struct sockaddr_l2));
1421         la->l2_family = AF_BLUETOOTH;
1422         la->l2_psm = bt_cb(skb)->psm;
1423         bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1424
1425         *msg_namelen = sizeof(struct sockaddr_l2);
1426 }
1427
1428 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1429 {
1430         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1431
1432         BT_DBG("sk %p", sk);
1433
1434         if (parent) {
1435                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1436
1437                 sk->sk_type = parent->sk_type;
1438                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1439
1440                 chan->chan_type = pchan->chan_type;
1441                 chan->imtu = pchan->imtu;
1442                 chan->omtu = pchan->omtu;
1443                 chan->conf_state = pchan->conf_state;
1444                 chan->mode = pchan->mode;
1445                 chan->fcs  = pchan->fcs;
1446                 chan->max_tx = pchan->max_tx;
1447                 chan->tx_win = pchan->tx_win;
1448                 chan->tx_win_max = pchan->tx_win_max;
1449                 chan->sec_level = pchan->sec_level;
1450                 chan->flags = pchan->flags;
1451                 chan->tx_credits = pchan->tx_credits;
1452                 chan->rx_credits = pchan->rx_credits;
1453
1454                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1455                         chan->scid = pchan->scid;
1456                         chan->dcid = pchan->scid;
1457                 }
1458
1459                 security_sk_clone(parent, sk);
1460         } else {
1461                 switch (sk->sk_type) {
1462                 case SOCK_RAW:
1463                         chan->chan_type = L2CAP_CHAN_RAW;
1464                         break;
1465                 case SOCK_DGRAM:
1466                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1467                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1468                         break;
1469                 case SOCK_SEQPACKET:
1470                 case SOCK_STREAM:
1471                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1472                         break;
1473                 }
1474
1475                 chan->imtu = L2CAP_DEFAULT_MTU;
1476                 chan->omtu = 0;
1477                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1478                         chan->mode = L2CAP_MODE_ERTM;
1479                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1480                 } else {
1481                         chan->mode = L2CAP_MODE_BASIC;
1482                 }
1483
1484                 l2cap_chan_set_defaults(chan);
1485         }
1486
1487         /* Default config options */
1488         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1489
1490         chan->data = sk;
1491         chan->ops = &l2cap_chan_ops;
1492 }
1493
1494 static struct proto l2cap_proto = {
1495         .name           = "L2CAP",
1496         .owner          = THIS_MODULE,
1497         .obj_size       = sizeof(struct l2cap_pinfo)
1498 };
1499
1500 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1501                                      int proto, gfp_t prio)
1502 {
1503         struct sock *sk;
1504         struct l2cap_chan *chan;
1505
1506         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1507         if (!sk)
1508                 return NULL;
1509
1510         sock_init_data(sock, sk);
1511         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1512
1513         sk->sk_destruct = l2cap_sock_destruct;
1514         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1515
1516         sock_reset_flag(sk, SOCK_ZAPPED);
1517
1518         sk->sk_protocol = proto;
1519         sk->sk_state = BT_OPEN;
1520
1521         chan = l2cap_chan_create();
1522         if (!chan) {
1523                 sk_free(sk);
1524                 return NULL;
1525         }
1526
1527         l2cap_chan_hold(chan);
1528
1529         l2cap_pi(sk)->chan = chan;
1530
1531         return sk;
1532 }
1533
1534 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1535                              int kern)
1536 {
1537         struct sock *sk;
1538
1539         BT_DBG("sock %p", sock);
1540
1541         sock->state = SS_UNCONNECTED;
1542
1543         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1544             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1545                 return -ESOCKTNOSUPPORT;
1546
1547         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1548                 return -EPERM;
1549
1550         sock->ops = &l2cap_sock_ops;
1551
1552         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1553         if (!sk)
1554                 return -ENOMEM;
1555
1556         l2cap_sock_init(sk, NULL);
1557         bt_sock_link(&l2cap_sk_list, sk);
1558         return 0;
1559 }
1560
1561 static const struct proto_ops l2cap_sock_ops = {
1562         .family         = PF_BLUETOOTH,
1563         .owner          = THIS_MODULE,
1564         .release        = l2cap_sock_release,
1565         .bind           = l2cap_sock_bind,
1566         .connect        = l2cap_sock_connect,
1567         .listen         = l2cap_sock_listen,
1568         .accept         = l2cap_sock_accept,
1569         .getname        = l2cap_sock_getname,
1570         .sendmsg        = l2cap_sock_sendmsg,
1571         .recvmsg        = l2cap_sock_recvmsg,
1572         .poll           = bt_sock_poll,
1573         .ioctl          = bt_sock_ioctl,
1574         .mmap           = sock_no_mmap,
1575         .socketpair     = sock_no_socketpair,
1576         .shutdown       = l2cap_sock_shutdown,
1577         .setsockopt     = l2cap_sock_setsockopt,
1578         .getsockopt     = l2cap_sock_getsockopt
1579 };
1580
1581 static const struct net_proto_family l2cap_sock_family_ops = {
1582         .family = PF_BLUETOOTH,
1583         .owner  = THIS_MODULE,
1584         .create = l2cap_sock_create,
1585 };
1586
1587 int __init l2cap_init_sockets(void)
1588 {
1589         int err;
1590
1591         err = proto_register(&l2cap_proto, 0);
1592         if (err < 0)
1593                 return err;
1594
1595         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1596         if (err < 0) {
1597                 BT_ERR("L2CAP socket registration failed");
1598                 goto error;
1599         }
1600
1601         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1602                              NULL);
1603         if (err < 0) {
1604                 BT_ERR("Failed to create L2CAP proc file");
1605                 bt_sock_unregister(BTPROTO_L2CAP);
1606                 goto error;
1607         }
1608
1609         BT_INFO("L2CAP socket layer initialized");
1610
1611         return 0;
1612
1613 error:
1614         proto_unregister(&l2cap_proto);
1615         return err;
1616 }
1617
1618 void l2cap_cleanup_sockets(void)
1619 {
1620         bt_procfs_cleanup(&init_net, "l2cap");
1621         bt_sock_unregister(BTPROTO_L2CAP);
1622         proto_unregister(&l2cap_proto);
1623 }