7ee4eaded5d68f7c315f1f216073d1820b797cca
[pandora-kernel.git] / net / bluetooth / rfcomm / sock.c
1 /*
2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License version 2 as
8    published by the Free Software Foundation;
9
10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21    SOFTWARE IS DISCLAIMED.
22 */
23
24 /*
25  * RFCOMM sockets.
26  */
27
28 #include <linux/module.h>
29
30 #include <linux/types.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/sched.h>
34 #include <linux/slab.h>
35 #include <linux/poll.h>
36 #include <linux/fcntl.h>
37 #include <linux/init.h>
38 #include <linux/interrupt.h>
39 #include <linux/socket.h>
40 #include <linux/skbuff.h>
41 #include <linux/list.h>
42 #include <linux/device.h>
43 #include <linux/debugfs.h>
44 #include <linux/seq_file.h>
45 #include <linux/security.h>
46 #include <net/sock.h>
47
48 #include <asm/system.h>
49 #include <linux/uaccess.h>
50
51 #include <net/bluetooth/bluetooth.h>
52 #include <net/bluetooth/hci_core.h>
53 #include <net/bluetooth/l2cap.h>
54 #include <net/bluetooth/rfcomm.h>
55
56 static const struct proto_ops rfcomm_sock_ops;
57
58 static struct bt_sock_list rfcomm_sk_list = {
59         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
60 };
61
62 static void rfcomm_sock_close(struct sock *sk);
63 static void rfcomm_sock_kill(struct sock *sk);
64
65 /* ---- DLC callbacks ----
66  *
67  * called under rfcomm_dlc_lock()
68  */
69 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
70 {
71         struct sock *sk = d->owner;
72         if (!sk)
73                 return;
74
75         atomic_add(skb->len, &sk->sk_rmem_alloc);
76         skb_queue_tail(&sk->sk_receive_queue, skb);
77         sk->sk_data_ready(sk, skb->len);
78
79         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
80                 rfcomm_dlc_throttle(d);
81 }
82
83 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
84 {
85         struct sock *sk = d->owner, *parent;
86         unsigned long flags;
87
88         if (!sk)
89                 return;
90
91         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
92
93         local_irq_save(flags);
94         bh_lock_sock(sk);
95
96         if (err)
97                 sk->sk_err = err;
98
99         sk->sk_state = d->state;
100
101         parent = bt_sk(sk)->parent;
102         if (parent) {
103                 if (d->state == BT_CLOSED) {
104                         sock_set_flag(sk, SOCK_ZAPPED);
105                         bt_accept_unlink(sk);
106                 }
107                 parent->sk_data_ready(parent, 0);
108         } else {
109                 if (d->state == BT_CONNECTED)
110                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
111                 sk->sk_state_change(sk);
112         }
113
114         bh_unlock_sock(sk);
115         local_irq_restore(flags);
116
117         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
118                 /* We have to drop DLC lock here, otherwise
119                  * rfcomm_sock_destruct() will dead lock. */
120                 rfcomm_dlc_unlock(d);
121                 rfcomm_sock_kill(sk);
122                 rfcomm_dlc_lock(d);
123         }
124 }
125
126 /* ---- Socket functions ---- */
127 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
128 {
129         struct sock *sk = NULL;
130         struct hlist_node *node;
131
132         sk_for_each(sk, node, &rfcomm_sk_list.head) {
133                 if (rfcomm_pi(sk)->channel == channel &&
134                                 !bacmp(&bt_sk(sk)->src, src))
135                         break;
136         }
137
138         return node ? sk : NULL;
139 }
140
141 /* Find socket with channel and source bdaddr.
142  * Returns closest match.
143  */
144 static struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
145 {
146         struct sock *sk = NULL, *sk1 = NULL;
147         struct hlist_node *node;
148
149         read_lock(&rfcomm_sk_list.lock);
150
151         sk_for_each(sk, node, &rfcomm_sk_list.head) {
152                 if (state && sk->sk_state != state)
153                         continue;
154
155                 if (rfcomm_pi(sk)->channel == channel) {
156                         /* Exact match. */
157                         if (!bacmp(&bt_sk(sk)->src, src))
158                                 break;
159
160                         /* Closest match */
161                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
162                                 sk1 = sk;
163                 }
164         }
165
166         read_unlock(&rfcomm_sk_list.lock);
167
168         return node ? sk : sk1;
169 }
170
171 static void rfcomm_sock_destruct(struct sock *sk)
172 {
173         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
174
175         BT_DBG("sk %p dlc %p", sk, d);
176
177         skb_queue_purge(&sk->sk_receive_queue);
178         skb_queue_purge(&sk->sk_write_queue);
179
180         rfcomm_dlc_lock(d);
181         rfcomm_pi(sk)->dlc = NULL;
182
183         /* Detach DLC if it's owned by this socket */
184         if (d->owner == sk)
185                 d->owner = NULL;
186         rfcomm_dlc_unlock(d);
187
188         rfcomm_dlc_put(d);
189 }
190
191 static void rfcomm_sock_cleanup_listen(struct sock *parent)
192 {
193         struct sock *sk;
194
195         BT_DBG("parent %p", parent);
196
197         /* Close not yet accepted dlcs */
198         while ((sk = bt_accept_dequeue(parent, NULL))) {
199                 rfcomm_sock_close(sk);
200                 rfcomm_sock_kill(sk);
201         }
202
203         parent->sk_state  = BT_CLOSED;
204         sock_set_flag(parent, SOCK_ZAPPED);
205 }
206
207 /* Kill socket (only if zapped and orphan)
208  * Must be called on unlocked socket.
209  */
210 static void rfcomm_sock_kill(struct sock *sk)
211 {
212         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
213                 return;
214
215         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
216
217         /* Kill poor orphan */
218         bt_sock_unlink(&rfcomm_sk_list, sk);
219         sock_set_flag(sk, SOCK_DEAD);
220         sock_put(sk);
221 }
222
223 static void __rfcomm_sock_close(struct sock *sk)
224 {
225         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
226
227         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
228
229         switch (sk->sk_state) {
230         case BT_LISTEN:
231                 rfcomm_sock_cleanup_listen(sk);
232                 break;
233
234         case BT_CONNECT:
235         case BT_CONNECT2:
236         case BT_CONFIG:
237         case BT_CONNECTED:
238                 rfcomm_dlc_close(d, 0);
239
240         default:
241                 sock_set_flag(sk, SOCK_ZAPPED);
242                 break;
243         }
244 }
245
246 /* Close socket.
247  * Must be called on unlocked socket.
248  */
249 static void rfcomm_sock_close(struct sock *sk)
250 {
251         lock_sock(sk);
252         __rfcomm_sock_close(sk);
253         release_sock(sk);
254 }
255
256 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
257 {
258         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
259
260         BT_DBG("sk %p", sk);
261
262         if (parent) {
263                 sk->sk_type = parent->sk_type;
264                 pi->dlc->defer_setup = bt_sk(parent)->defer_setup;
265
266                 pi->sec_level = rfcomm_pi(parent)->sec_level;
267                 pi->role_switch = rfcomm_pi(parent)->role_switch;
268
269                 security_sk_clone(parent, sk);
270         } else {
271                 pi->dlc->defer_setup = 0;
272
273                 pi->sec_level = BT_SECURITY_LOW;
274                 pi->role_switch = 0;
275         }
276
277         pi->dlc->sec_level = pi->sec_level;
278         pi->dlc->role_switch = pi->role_switch;
279 }
280
281 static struct proto rfcomm_proto = {
282         .name           = "RFCOMM",
283         .owner          = THIS_MODULE,
284         .obj_size       = sizeof(struct rfcomm_pinfo)
285 };
286
287 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
288 {
289         struct rfcomm_dlc *d;
290         struct sock *sk;
291
292         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
293         if (!sk)
294                 return NULL;
295
296         sock_init_data(sock, sk);
297         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
298
299         d = rfcomm_dlc_alloc(prio);
300         if (!d) {
301                 sk_free(sk);
302                 return NULL;
303         }
304
305         d->data_ready   = rfcomm_sk_data_ready;
306         d->state_change = rfcomm_sk_state_change;
307
308         rfcomm_pi(sk)->dlc = d;
309         d->owner = sk;
310
311         sk->sk_destruct = rfcomm_sock_destruct;
312         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
313
314         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
315         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
316
317         sock_reset_flag(sk, SOCK_ZAPPED);
318
319         sk->sk_protocol = proto;
320         sk->sk_state    = BT_OPEN;
321
322         bt_sock_link(&rfcomm_sk_list, sk);
323
324         BT_DBG("sk %p", sk);
325         return sk;
326 }
327
328 static int rfcomm_sock_create(struct net *net, struct socket *sock,
329                               int protocol, int kern)
330 {
331         struct sock *sk;
332
333         BT_DBG("sock %p", sock);
334
335         sock->state = SS_UNCONNECTED;
336
337         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
338                 return -ESOCKTNOSUPPORT;
339
340         sock->ops = &rfcomm_sock_ops;
341
342         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
343         if (!sk)
344                 return -ENOMEM;
345
346         rfcomm_sock_init(sk, NULL);
347         return 0;
348 }
349
350 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
351 {
352         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
353         struct sock *sk = sock->sk;
354         int err = 0;
355
356         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
357
358         if (!addr || addr->sa_family != AF_BLUETOOTH)
359                 return -EINVAL;
360
361         lock_sock(sk);
362
363         if (sk->sk_state != BT_OPEN) {
364                 err = -EBADFD;
365                 goto done;
366         }
367
368         if (sk->sk_type != SOCK_STREAM) {
369                 err = -EINVAL;
370                 goto done;
371         }
372
373         write_lock_bh(&rfcomm_sk_list.lock);
374
375         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
376                 err = -EADDRINUSE;
377         } else {
378                 /* Save source address */
379                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
380                 rfcomm_pi(sk)->channel = sa->rc_channel;
381                 sk->sk_state = BT_BOUND;
382         }
383
384         write_unlock_bh(&rfcomm_sk_list.lock);
385
386 done:
387         release_sock(sk);
388         return err;
389 }
390
391 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
392 {
393         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
394         struct sock *sk = sock->sk;
395         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
396         int err = 0;
397
398         BT_DBG("sk %p", sk);
399
400         if (alen < sizeof(struct sockaddr_rc) ||
401             addr->sa_family != AF_BLUETOOTH)
402                 return -EINVAL;
403
404         lock_sock(sk);
405
406         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
407                 err = -EBADFD;
408                 goto done;
409         }
410
411         if (sk->sk_type != SOCK_STREAM) {
412                 err = -EINVAL;
413                 goto done;
414         }
415
416         sk->sk_state = BT_CONNECT;
417         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
418         rfcomm_pi(sk)->channel = sa->rc_channel;
419
420         d->sec_level = rfcomm_pi(sk)->sec_level;
421         d->role_switch = rfcomm_pi(sk)->role_switch;
422
423         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
424         if (!err)
425                 err = bt_sock_wait_state(sk, BT_CONNECTED,
426                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
427
428 done:
429         release_sock(sk);
430         return err;
431 }
432
433 static int rfcomm_sock_listen(struct socket *sock, int backlog)
434 {
435         struct sock *sk = sock->sk;
436         int err = 0;
437
438         BT_DBG("sk %p backlog %d", sk, backlog);
439
440         lock_sock(sk);
441
442         if (sk->sk_state != BT_BOUND) {
443                 err = -EBADFD;
444                 goto done;
445         }
446
447         if (sk->sk_type != SOCK_STREAM) {
448                 err = -EINVAL;
449                 goto done;
450         }
451
452         if (!rfcomm_pi(sk)->channel) {
453                 bdaddr_t *src = &bt_sk(sk)->src;
454                 u8 channel;
455
456                 err = -EINVAL;
457
458                 write_lock_bh(&rfcomm_sk_list.lock);
459
460                 for (channel = 1; channel < 31; channel++)
461                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
462                                 rfcomm_pi(sk)->channel = channel;
463                                 err = 0;
464                                 break;
465                         }
466
467                 write_unlock_bh(&rfcomm_sk_list.lock);
468
469                 if (err < 0)
470                         goto done;
471         }
472
473         sk->sk_max_ack_backlog = backlog;
474         sk->sk_ack_backlog = 0;
475         sk->sk_state = BT_LISTEN;
476
477 done:
478         release_sock(sk);
479         return err;
480 }
481
482 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
483 {
484         DECLARE_WAITQUEUE(wait, current);
485         struct sock *sk = sock->sk, *nsk;
486         long timeo;
487         int err = 0;
488
489         lock_sock(sk);
490
491         if (sk->sk_type != SOCK_STREAM) {
492                 err = -EINVAL;
493                 goto done;
494         }
495
496         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
497
498         BT_DBG("sk %p timeo %ld", sk, timeo);
499
500         /* Wait for an incoming connection. (wake-one). */
501         add_wait_queue_exclusive(sk_sleep(sk), &wait);
502         while (1) {
503                 set_current_state(TASK_INTERRUPTIBLE);
504
505                 if (sk->sk_state != BT_LISTEN) {
506                         err = -EBADFD;
507                         break;
508                 }
509
510                 nsk = bt_accept_dequeue(sk, newsock);
511                 if (nsk)
512                         break;
513
514                 if (!timeo) {
515                         err = -EAGAIN;
516                         break;
517                 }
518
519                 if (signal_pending(current)) {
520                         err = sock_intr_errno(timeo);
521                         break;
522                 }
523
524                 release_sock(sk);
525                 timeo = schedule_timeout(timeo);
526                 lock_sock(sk);
527         }
528         __set_current_state(TASK_RUNNING);
529         remove_wait_queue(sk_sleep(sk), &wait);
530
531         if (err)
532                 goto done;
533
534         newsock->state = SS_CONNECTED;
535
536         BT_DBG("new socket %p", nsk);
537
538 done:
539         release_sock(sk);
540         return err;
541 }
542
543 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
544 {
545         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
546         struct sock *sk = sock->sk;
547
548         BT_DBG("sock %p, sk %p", sock, sk);
549
550         memset(sa, 0, sizeof(*sa));
551         sa->rc_family  = AF_BLUETOOTH;
552         sa->rc_channel = rfcomm_pi(sk)->channel;
553         if (peer)
554                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
555         else
556                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
557
558         *len = sizeof(struct sockaddr_rc);
559         return 0;
560 }
561
562 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
563                                struct msghdr *msg, size_t len)
564 {
565         struct sock *sk = sock->sk;
566         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
567         struct sk_buff *skb;
568         int sent = 0;
569
570         if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
571                 return -ENOTCONN;
572
573         if (msg->msg_flags & MSG_OOB)
574                 return -EOPNOTSUPP;
575
576         if (sk->sk_shutdown & SEND_SHUTDOWN)
577                 return -EPIPE;
578
579         BT_DBG("sock %p, sk %p", sock, sk);
580
581         lock_sock(sk);
582
583         while (len) {
584                 size_t size = min_t(size_t, len, d->mtu);
585                 int err;
586
587                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
588                                 msg->msg_flags & MSG_DONTWAIT, &err);
589                 if (!skb) {
590                         if (sent == 0)
591                                 sent = err;
592                         break;
593                 }
594                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
595
596                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
597                 if (err) {
598                         kfree_skb(skb);
599                         if (sent == 0)
600                                 sent = err;
601                         break;
602                 }
603
604                 err = rfcomm_dlc_send(d, skb);
605                 if (err < 0) {
606                         kfree_skb(skb);
607                         if (sent == 0)
608                                 sent = err;
609                         break;
610                 }
611
612                 sent += size;
613                 len  -= size;
614         }
615
616         release_sock(sk);
617
618         return sent;
619 }
620
621 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
622                                struct msghdr *msg, size_t size, int flags)
623 {
624         struct sock *sk = sock->sk;
625         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
626         int len;
627
628         if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
629                 rfcomm_dlc_accept(d);
630                 return 0;
631         }
632
633         len = bt_sock_stream_recvmsg(iocb, sock, msg, size, flags);
634
635         lock_sock(sk);
636         if (!(flags & MSG_PEEK) && len > 0)
637                 atomic_sub(len, &sk->sk_rmem_alloc);
638
639         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
640                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
641         release_sock(sk);
642
643         return len;
644 }
645
646 static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, unsigned int optlen)
647 {
648         struct sock *sk = sock->sk;
649         int err = 0;
650         u32 opt;
651
652         BT_DBG("sk %p", sk);
653
654         lock_sock(sk);
655
656         switch (optname) {
657         case RFCOMM_LM:
658                 if (get_user(opt, (u32 __user *) optval)) {
659                         err = -EFAULT;
660                         break;
661                 }
662
663                 if (opt & RFCOMM_LM_AUTH)
664                         rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
665                 if (opt & RFCOMM_LM_ENCRYPT)
666                         rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
667                 if (opt & RFCOMM_LM_SECURE)
668                         rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
669
670                 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
671                 break;
672
673         default:
674                 err = -ENOPROTOOPT;
675                 break;
676         }
677
678         release_sock(sk);
679         return err;
680 }
681
682 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int optlen)
683 {
684         struct sock *sk = sock->sk;
685         struct bt_security sec;
686         int err = 0;
687         size_t len;
688         u32 opt;
689
690         BT_DBG("sk %p", sk);
691
692         if (level == SOL_RFCOMM)
693                 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
694
695         if (level != SOL_BLUETOOTH)
696                 return -ENOPROTOOPT;
697
698         lock_sock(sk);
699
700         switch (optname) {
701         case BT_SECURITY:
702                 if (sk->sk_type != SOCK_STREAM) {
703                         err = -EINVAL;
704                         break;
705                 }
706
707                 sec.level = BT_SECURITY_LOW;
708
709                 len = min_t(unsigned int, sizeof(sec), optlen);
710                 if (copy_from_user((char *) &sec, optval, len)) {
711                         err = -EFAULT;
712                         break;
713                 }
714
715                 if (sec.level > BT_SECURITY_HIGH) {
716                         err = -EINVAL;
717                         break;
718                 }
719
720                 rfcomm_pi(sk)->sec_level = sec.level;
721                 break;
722
723         case BT_DEFER_SETUP:
724                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
725                         err = -EINVAL;
726                         break;
727                 }
728
729                 if (get_user(opt, (u32 __user *) optval)) {
730                         err = -EFAULT;
731                         break;
732                 }
733
734                 bt_sk(sk)->defer_setup = opt;
735                 break;
736
737         default:
738                 err = -ENOPROTOOPT;
739                 break;
740         }
741
742         release_sock(sk);
743         return err;
744 }
745
746 static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
747 {
748         struct sock *sk = sock->sk;
749         struct rfcomm_conninfo cinfo;
750         struct l2cap_conn *conn = l2cap_pi(sk)->chan->conn;
751         int len, err = 0;
752         u32 opt;
753
754         BT_DBG("sk %p", sk);
755
756         if (get_user(len, optlen))
757                 return -EFAULT;
758
759         lock_sock(sk);
760
761         switch (optname) {
762         case RFCOMM_LM:
763                 switch (rfcomm_pi(sk)->sec_level) {
764                 case BT_SECURITY_LOW:
765                         opt = RFCOMM_LM_AUTH;
766                         break;
767                 case BT_SECURITY_MEDIUM:
768                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
769                         break;
770                 case BT_SECURITY_HIGH:
771                         opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
772                                                         RFCOMM_LM_SECURE;
773                         break;
774                 default:
775                         opt = 0;
776                         break;
777                 }
778
779                 if (rfcomm_pi(sk)->role_switch)
780                         opt |= RFCOMM_LM_MASTER;
781
782                 if (put_user(opt, (u32 __user *) optval))
783                         err = -EFAULT;
784                 break;
785
786         case RFCOMM_CONNINFO:
787                 if (sk->sk_state != BT_CONNECTED &&
788                                         !rfcomm_pi(sk)->dlc->defer_setup) {
789                         err = -ENOTCONN;
790                         break;
791                 }
792
793                 memset(&cinfo, 0, sizeof(cinfo));
794                 cinfo.hci_handle = conn->hcon->handle;
795                 memcpy(cinfo.dev_class, conn->hcon->dev_class, 3);
796
797                 len = min_t(unsigned int, len, sizeof(cinfo));
798                 if (copy_to_user(optval, (char *) &cinfo, len))
799                         err = -EFAULT;
800
801                 break;
802
803         default:
804                 err = -ENOPROTOOPT;
805                 break;
806         }
807
808         release_sock(sk);
809         return err;
810 }
811
812 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
813 {
814         struct sock *sk = sock->sk;
815         struct bt_security sec;
816         int len, err = 0;
817
818         BT_DBG("sk %p", sk);
819
820         if (level == SOL_RFCOMM)
821                 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
822
823         if (level != SOL_BLUETOOTH)
824                 return -ENOPROTOOPT;
825
826         if (get_user(len, optlen))
827                 return -EFAULT;
828
829         lock_sock(sk);
830
831         switch (optname) {
832         case BT_SECURITY:
833                 if (sk->sk_type != SOCK_STREAM) {
834                         err = -EINVAL;
835                         break;
836                 }
837
838                 sec.level = rfcomm_pi(sk)->sec_level;
839                 sec.key_size = 0;
840
841                 len = min_t(unsigned int, len, sizeof(sec));
842                 if (copy_to_user(optval, (char *) &sec, len))
843                         err = -EFAULT;
844
845                 break;
846
847         case BT_DEFER_SETUP:
848                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
849                         err = -EINVAL;
850                         break;
851                 }
852
853                 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
854                         err = -EFAULT;
855
856                 break;
857
858         default:
859                 err = -ENOPROTOOPT;
860                 break;
861         }
862
863         release_sock(sk);
864         return err;
865 }
866
867 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
868 {
869         struct sock *sk __maybe_unused = sock->sk;
870         int err;
871
872         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
873
874         err = bt_sock_ioctl(sock, cmd, arg);
875
876         if (err == -ENOIOCTLCMD) {
877 #ifdef CONFIG_BT_RFCOMM_TTY
878                 lock_sock(sk);
879                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
880                 release_sock(sk);
881 #else
882                 err = -EOPNOTSUPP;
883 #endif
884         }
885
886         return err;
887 }
888
889 static int rfcomm_sock_shutdown(struct socket *sock, int how)
890 {
891         struct sock *sk = sock->sk;
892         int err = 0;
893
894         BT_DBG("sock %p, sk %p", sock, sk);
895
896         if (!sk)
897                 return 0;
898
899         lock_sock(sk);
900         if (!sk->sk_shutdown) {
901                 sk->sk_shutdown = SHUTDOWN_MASK;
902                 __rfcomm_sock_close(sk);
903
904                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
905                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
906         }
907         release_sock(sk);
908         return err;
909 }
910
911 static int rfcomm_sock_release(struct socket *sock)
912 {
913         struct sock *sk = sock->sk;
914         int err;
915
916         BT_DBG("sock %p, sk %p", sock, sk);
917
918         if (!sk)
919                 return 0;
920
921         err = rfcomm_sock_shutdown(sock, 2);
922
923         sock_orphan(sk);
924         rfcomm_sock_kill(sk);
925         return err;
926 }
927
928 /* ---- RFCOMM core layer callbacks ----
929  *
930  * called under rfcomm_lock()
931  */
932 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
933 {
934         struct sock *sk, *parent;
935         bdaddr_t src, dst;
936         int result = 0;
937
938         BT_DBG("session %p channel %d", s, channel);
939
940         rfcomm_session_getaddr(s, &src, &dst);
941
942         /* Check if we have socket listening on channel */
943         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
944         if (!parent)
945                 return 0;
946
947         bh_lock_sock(parent);
948
949         /* Check for backlog size */
950         if (sk_acceptq_is_full(parent)) {
951                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
952                 goto done;
953         }
954
955         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
956         if (!sk)
957                 goto done;
958
959         rfcomm_sock_init(sk, parent);
960         bacpy(&bt_sk(sk)->src, &src);
961         bacpy(&bt_sk(sk)->dst, &dst);
962         rfcomm_pi(sk)->channel = channel;
963
964         sk->sk_state = BT_CONFIG;
965         bt_accept_enqueue(parent, sk);
966
967         /* Accept connection and return socket DLC */
968         *d = rfcomm_pi(sk)->dlc;
969         result = 1;
970
971 done:
972         bh_unlock_sock(parent);
973
974         if (bt_sk(parent)->defer_setup)
975                 parent->sk_state_change(parent);
976
977         return result;
978 }
979
980 static int rfcomm_sock_debugfs_show(struct seq_file *f, void *p)
981 {
982         struct sock *sk;
983         struct hlist_node *node;
984
985         read_lock_bh(&rfcomm_sk_list.lock);
986
987         sk_for_each(sk, node, &rfcomm_sk_list.head) {
988                 seq_printf(f, "%s %s %d %d\n",
989                                 batostr(&bt_sk(sk)->src),
990                                 batostr(&bt_sk(sk)->dst),
991                                 sk->sk_state, rfcomm_pi(sk)->channel);
992         }
993
994         read_unlock_bh(&rfcomm_sk_list.lock);
995
996         return 0;
997 }
998
999 static int rfcomm_sock_debugfs_open(struct inode *inode, struct file *file)
1000 {
1001         return single_open(file, rfcomm_sock_debugfs_show, inode->i_private);
1002 }
1003
1004 static const struct file_operations rfcomm_sock_debugfs_fops = {
1005         .open           = rfcomm_sock_debugfs_open,
1006         .read           = seq_read,
1007         .llseek         = seq_lseek,
1008         .release        = single_release,
1009 };
1010
1011 static struct dentry *rfcomm_sock_debugfs;
1012
1013 static const struct proto_ops rfcomm_sock_ops = {
1014         .family         = PF_BLUETOOTH,
1015         .owner          = THIS_MODULE,
1016         .release        = rfcomm_sock_release,
1017         .bind           = rfcomm_sock_bind,
1018         .connect        = rfcomm_sock_connect,
1019         .listen         = rfcomm_sock_listen,
1020         .accept         = rfcomm_sock_accept,
1021         .getname        = rfcomm_sock_getname,
1022         .sendmsg        = rfcomm_sock_sendmsg,
1023         .recvmsg        = rfcomm_sock_recvmsg,
1024         .shutdown       = rfcomm_sock_shutdown,
1025         .setsockopt     = rfcomm_sock_setsockopt,
1026         .getsockopt     = rfcomm_sock_getsockopt,
1027         .ioctl          = rfcomm_sock_ioctl,
1028         .poll           = bt_sock_poll,
1029         .socketpair     = sock_no_socketpair,
1030         .mmap           = sock_no_mmap
1031 };
1032
1033 static const struct net_proto_family rfcomm_sock_family_ops = {
1034         .family         = PF_BLUETOOTH,
1035         .owner          = THIS_MODULE,
1036         .create         = rfcomm_sock_create
1037 };
1038
1039 int __init rfcomm_init_sockets(void)
1040 {
1041         int err;
1042
1043         err = proto_register(&rfcomm_proto, 0);
1044         if (err < 0)
1045                 return err;
1046
1047         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1048         if (err < 0)
1049                 goto error;
1050
1051         if (bt_debugfs) {
1052                 rfcomm_sock_debugfs = debugfs_create_file("rfcomm", 0444,
1053                                 bt_debugfs, NULL, &rfcomm_sock_debugfs_fops);
1054                 if (!rfcomm_sock_debugfs)
1055                         BT_ERR("Failed to create RFCOMM debug file");
1056         }
1057
1058         BT_INFO("RFCOMM socket layer initialized");
1059
1060         return 0;
1061
1062 error:
1063         BT_ERR("RFCOMM socket layer registration failed");
1064         proto_unregister(&rfcomm_proto);
1065         return err;
1066 }
1067
1068 void __exit rfcomm_cleanup_sockets(void)
1069 {
1070         debugfs_remove(rfcomm_sock_debugfs);
1071
1072         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
1073                 BT_ERR("RFCOMM socket layer unregistration failed");
1074
1075         proto_unregister(&rfcomm_proto);
1076 }