net/bluetooth/l2cap_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
   5    Copyright (C) 2010 Google Inc.
   6    Copyright (C) 2011 ProFUSION Embedded Systems
   7
   8    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License version 2 as
  12    published by the Free Software Foundation;
  13
  14    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  15    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  16    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  17    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  18    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  19    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  20    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  21    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  22
  23    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  24    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  25    SOFTWARE IS DISCLAIMED.
  26 */
  27
  28 /* Bluetooth L2CAP sockets. */
  29
  30 #include <linux/module.h>
  31 #include <linux/export.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35 #include <net/bluetooth/l2cap.h>
  36
  37 #include "smp.h"
  38
  39 static struct bt_sock_list l2cap_sk_list = {
  40         .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
  41 };
  42
  43 static const struct proto_ops l2cap_sock_ops;
  44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
  45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
  46                                      int proto, gfp_t prio);
  47
  48 bool l2cap_is_socket(struct socket *sock)
  49 {
  50         return sock && sock->ops == &l2cap_sock_ops;
  51 }
  52 EXPORT_SYMBOL(l2cap_is_socket);
  53
  54 static int l2cap_validate_bredr_psm(u16 psm)
  55 {
  56         /* PSM must be odd and lsb of upper byte must be 0 */
  57         if ((psm & 0x0101) != 0x0001)
  58                 return -EINVAL;
  59
  60         /* Restrict usage of well-known PSMs */
  61         if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
  62                 return -EACCES;
  63
  64         return 0;
  65 }
  66
  67 static int l2cap_validate_le_psm(u16 psm)
  68 {
  69         /* Valid LE_PSM ranges are defined only until 0x00ff */
  70         if (psm > 0x00ff)
  71                 return -EINVAL;
  72
  73         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
  74         if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
  75                 return -EACCES;
  76
  77         return 0;
  78 }
  79
  80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
  81 {
  82         struct sock *sk = sock->sk;
  83         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
  84         struct sockaddr_l2 la;
  85         int len, err = 0;
  86
  87         BT_DBG("sk %p", sk);
  88
  89         if (!addr || addr->sa_family != AF_BLUETOOTH)
  90                 return -EINVAL;
  91
  92         memset(&la, 0, sizeof(la));
  93         len = min_t(unsigned int, sizeof(la), alen);
  94         memcpy(&la, addr, len);
  95
  96         if (la.l2_cid && la.l2_psm)
  97                 return -EINVAL;
  98
  99         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 100                 return -EINVAL;
 101
 102         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 103                 /* We only allow ATT user space socket */
 104                 if (la.l2_cid &&
 105                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 106                         return -EINVAL;
 107         }
 108
 109         lock_sock(sk);
 110
 111         if (sk->sk_state != BT_OPEN) {
 112                 err = -EBADFD;
 113                 goto done;
 114         }
 115
 116         if (la.l2_psm) {
 117                 __u16 psm = __le16_to_cpu(la.l2_psm);
 118
 119                 if (la.l2_bdaddr_type == BDADDR_BREDR)
 120                         err = l2cap_validate_bredr_psm(psm);
 121                 else
 122                         err = l2cap_validate_le_psm(psm);
 123
 124                 if (err)
 125                         goto done;
 126         }
 127
 128         if (la.l2_cid)
 129                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
 130         else
 131                 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
 132
 133         if (err < 0)
 134                 goto done;
 135
 136         switch (chan->chan_type) {
 137         case L2CAP_CHAN_CONN_LESS:
 138                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
 139                         chan->sec_level = BT_SECURITY_SDP;
 140                 break;
 141         case L2CAP_CHAN_CONN_ORIENTED:
 142                 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
 143                     __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
 144                         chan->sec_level = BT_SECURITY_SDP;
 145                 break;
 146         case L2CAP_CHAN_RAW:
 147                 chan->sec_level = BT_SECURITY_SDP;
 148                 break;
 149         case L2CAP_CHAN_FIXED:
 150                 /* Fixed channels default to the L2CAP core not holding a
 151                  * hci_conn reference for them. For fixed channels mapping to
 152                  * L2CAP sockets we do want to hold a reference so set the
 153                  * appropriate flag to request it.
 154                  */
 155                 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
 156                 break;
 157         }
 158
 159         bacpy(&chan->src, &la.l2_bdaddr);
 160         chan->src_type = la.l2_bdaddr_type;
 161
 162         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 163                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 164
 165         chan->state = BT_BOUND;
 166         sk->sk_state = BT_BOUND;
 167
 168 done:
 169         release_sock(sk);
 170         return err;
 171 }
 172
 173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
 174                               int alen, int flags)
 175 {
 176         struct sock *sk = sock->sk;
 177         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 178         struct sockaddr_l2 la;
 179         int len, err = 0;
 180
 181         BT_DBG("sk %p", sk);
 182
 183         if (!addr || alen < sizeof(addr->sa_family) ||
 184             addr->sa_family != AF_BLUETOOTH)
 185                 return -EINVAL;
 186
 187         memset(&la, 0, sizeof(la));
 188         len = min_t(unsigned int, sizeof(la), alen);
 189         memcpy(&la, addr, len);
 190
 191         if (la.l2_cid && la.l2_psm)
 192                 return -EINVAL;
 193
 194         if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
 195                 return -EINVAL;
 196
 197         /* Check that the socket wasn't bound to something that
 198          * conflicts with the address given to connect(). If chan->src
 199          * is BDADDR_ANY it means bind() was never used, in which case
 200          * chan->src_type and la.l2_bdaddr_type do not need to match.
 201          */
 202         if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
 203             bdaddr_type_is_le(la.l2_bdaddr_type)) {
 204                 /* Old user space versions will try to incorrectly bind
 205                  * the ATT socket using BDADDR_BREDR. We need to accept
 206                  * this and fix up the source address type only when
 207                  * both the source CID and destination CID indicate
 208                  * ATT. Anything else is an invalid combination.
 209                  */
 210                 if (chan->scid != L2CAP_CID_ATT ||
 211                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 212                         return -EINVAL;
 213
 214                 /* We don't have the hdev available here to make a
 215                  * better decision on random vs public, but since all
 216                  * user space versions that exhibit this issue anyway do
 217                  * not support random local addresses assuming public
 218                  * here is good enough.
 219                  */
 220                 chan->src_type = BDADDR_LE_PUBLIC;
 221         }
 222
 223         if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
 224                 return -EINVAL;
 225
 226         if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
 227                 /* We only allow ATT user space socket */
 228                 if (la.l2_cid &&
 229                     la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
 230                         return -EINVAL;
 231         }
 232
 233         if (chan->psm && bdaddr_type_is_le(chan->src_type))
 234                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 235
 236         err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
 237                                  &la.l2_bdaddr, la.l2_bdaddr_type);
 238         if (err)
 239                 return err;
 240
 241         lock_sock(sk);
 242
 243         err = bt_sock_wait_state(sk, BT_CONNECTED,
 244                                  sock_sndtimeo(sk, flags & O_NONBLOCK));
 245
 246         release_sock(sk);
 247
 248         return err;
 249 }
 250
 251 static int l2cap_sock_listen(struct socket *sock, int backlog)
 252 {
 253         struct sock *sk = sock->sk;
 254         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 255         int err = 0;
 256
 257         BT_DBG("sk %p backlog %d", sk, backlog);
 258
 259         lock_sock(sk);
 260
 261         if (sk->sk_state != BT_BOUND) {
 262                 err = -EBADFD;
 263                 goto done;
 264         }
 265
 266         if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
 267                 err = -EINVAL;
 268                 goto done;
 269         }
 270
 271         switch (chan->mode) {
 272         case L2CAP_MODE_BASIC:
 273         case L2CAP_MODE_LE_FLOWCTL:
 274                 break;
 275         case L2CAP_MODE_ERTM:
 276         case L2CAP_MODE_STREAMING:
 277                 if (!disable_ertm)
 278                         break;
 279                 /* fall through */
 280         default:
 281                 err = -EOPNOTSUPP;
 282                 goto done;
 283         }
 284
 285         sk->sk_max_ack_backlog = backlog;
 286         sk->sk_ack_backlog = 0;
 287
 288         /* Listening channels need to use nested locking in order not to
 289          * cause lockdep warnings when the created child channels end up
 290          * being locked in the same thread as the parent channel.
 291          */
 292         atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
 293
 294         chan->state = BT_LISTEN;
 295         sk->sk_state = BT_LISTEN;
 296
 297 done:
 298         release_sock(sk);
 299         return err;
 300 }
 301
 302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
 303                              int flags)
 304 {
 305 #ifdef CONFIG_TIZEN_WIP
 306         DECLARE_WAITQUEUE(wait, current);
 307 #else
 308         DEFINE_WAIT_FUNC(wait, woken_wake_function);
 309 #endif
 310         struct sock *sk = sock->sk, *nsk;
 311         long timeo;
 312         int err = 0;
 313
 314         lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 315
 316         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 317
 318         BT_DBG("sk %p timeo %ld", sk, timeo);
 319
 320         /* Wait for an incoming connection. (wake-one). */
 321         add_wait_queue_exclusive(sk_sleep(sk), &wait);
 322         while (1) {
 323 #ifdef CONFIG_TIZEN_WIP
 324                 set_current_state(TASK_INTERRUPTIBLE);
 325 #endif
 326                 if (sk->sk_state != BT_LISTEN) {
 327                         err = -EBADFD;
 328                         break;
 329                 }
 330
 331                 nsk = bt_accept_dequeue(sk, newsock);
 332                 if (nsk)
 333                         break;
 334
 335                 if (!timeo) {
 336                         err = -EAGAIN;
 337                         break;
 338                 }
 339
 340                 if (signal_pending(current)) {
 341                         err = sock_intr_errno(timeo);
 342                         break;
 343                 }
 344
 345                 release_sock(sk);
 346 #ifdef CONFIG_TIZEN_WIP
 347                 timeo = schedule_timeout(timeo);
 348 #else
 349                 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
 350 #endif
 351
 352                 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
 353         }
 354 #ifdef CONFIG_TIZEN_WIP
 355         __set_current_state(TASK_RUNNING);
 356 #endif
 357         remove_wait_queue(sk_sleep(sk), &wait);
 358
 359         if (err)
 360                 goto done;
 361
 362         newsock->state = SS_CONNECTED;
 363
 364         BT_DBG("new socket %p", nsk);
 365
 366 done:
 367         release_sock(sk);
 368         return err;
 369 }
 370
 371 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
 372                               int *len, int peer)
 373 {
 374         struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
 375         struct sock *sk = sock->sk;
 376         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 377
 378         BT_DBG("sock %p, sk %p", sock, sk);
 379
 380         if (peer && sk->sk_state != BT_CONNECTED &&
 381             sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
 382             sk->sk_state != BT_CONFIG)
 383                 return -ENOTCONN;
 384
 385         memset(la, 0, sizeof(struct sockaddr_l2));
 386         addr->sa_family = AF_BLUETOOTH;
 387         *len = sizeof(struct sockaddr_l2);
 388
 389         la->l2_psm = chan->psm;
 390
 391         if (peer) {
 392                 bacpy(&la->l2_bdaddr, &chan->dst);
 393                 la->l2_cid = cpu_to_le16(chan->dcid);
 394                 la->l2_bdaddr_type = chan->dst_type;
 395         } else {
 396                 bacpy(&la->l2_bdaddr, &chan->src);
 397                 la->l2_cid = cpu_to_le16(chan->scid);
 398                 la->l2_bdaddr_type = chan->src_type;
 399         }
 400
 401         return 0;
 402 }
 403
 404 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
 405                                      char __user *optval, int __user *optlen)
 406 {
 407         struct sock *sk = sock->sk;
 408         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 409         struct l2cap_options opts;
 410         struct l2cap_conninfo cinfo;
 411         int len, err = 0;
 412         u32 opt;
 413
 414         BT_DBG("sk %p", sk);
 415
 416         if (get_user(len, optlen))
 417                 return -EFAULT;
 418
 419         lock_sock(sk);
 420
 421         switch (optname) {
 422         case L2CAP_OPTIONS:
 423                 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
 424                  * legacy ATT code depends on getsockopt for
 425                  * L2CAP_OPTIONS we need to let this pass.
 426                  */
 427                 if (bdaddr_type_is_le(chan->src_type) &&
 428                     chan->scid != L2CAP_CID_ATT) {
 429                         err = -EINVAL;
 430                         break;
 431                 }
 432
 433                 memset(&opts, 0, sizeof(opts));
 434                 opts.imtu     = chan->imtu;
 435                 opts.omtu     = chan->omtu;
 436                 opts.flush_to = chan->flush_to;
 437                 opts.mode     = chan->mode;
 438                 opts.fcs      = chan->fcs;
 439                 opts.max_tx   = chan->max_tx;
 440                 opts.txwin_size = chan->tx_win;
 441
 442                 len = min_t(unsigned int, len, sizeof(opts));
 443                 if (copy_to_user(optval, (char *) &opts, len))
 444                         err = -EFAULT;
 445
 446                 break;
 447
 448         case L2CAP_LM:
 449                 switch (chan->sec_level) {
 450                 case BT_SECURITY_LOW:
 451                         opt = L2CAP_LM_AUTH;
 452                         break;
 453                 case BT_SECURITY_MEDIUM:
 454                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
 455                         break;
 456                 case BT_SECURITY_HIGH:
 457                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 458                               L2CAP_LM_SECURE;
 459                         break;
 460                 case BT_SECURITY_FIPS:
 461                         opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
 462                               L2CAP_LM_SECURE | L2CAP_LM_FIPS;
 463                         break;
 464                 default:
 465                         opt = 0;
 466                         break;
 467                 }
 468
 469                 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
 470                         opt |= L2CAP_LM_MASTER;
 471
 472                 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
 473                         opt |= L2CAP_LM_RELIABLE;
 474
 475                 if (put_user(opt, (u32 __user *) optval))
 476                         err = -EFAULT;
 477
 478                 break;
 479
 480         case L2CAP_CONNINFO:
 481                 if (sk->sk_state != BT_CONNECTED &&
 482                     !(sk->sk_state == BT_CONNECT2 &&
 483                       test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
 484                         err = -ENOTCONN;
 485                         break;
 486                 }
 487
 488                 memset(&cinfo, 0, sizeof(cinfo));
 489                 cinfo.hci_handle = chan->conn->hcon->handle;
 490                 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 491
 492                 len = min_t(unsigned int, len, sizeof(cinfo));
 493                 if (copy_to_user(optval, (char *) &cinfo, len))
 494                         err = -EFAULT;
 495
 496                 break;
 497
 498         default:
 499                 err = -ENOPROTOOPT;
 500                 break;
 501         }
 502
 503         release_sock(sk);
 504         return err;
 505 }
 506
 507 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
 508                                  char __user *optval, int __user *optlen)
 509 {
 510         struct sock *sk = sock->sk;
 511         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 512         struct bt_security sec;
 513         struct bt_power pwr;
 514         int len, err = 0;
 515
 516         BT_DBG("sk %p", sk);
 517
 518         if (level == SOL_L2CAP)
 519                 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
 520
 521         if (level != SOL_BLUETOOTH)
 522                 return -ENOPROTOOPT;
 523
 524         if (get_user(len, optlen))
 525                 return -EFAULT;
 526
 527         lock_sock(sk);
 528
 529         switch (optname) {
 530         case BT_SECURITY:
 531                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 532                     chan->chan_type != L2CAP_CHAN_FIXED &&
 533                     chan->chan_type != L2CAP_CHAN_RAW) {
 534                         err = -EINVAL;
 535                         break;
 536                 }
 537
 538                 memset(&sec, 0, sizeof(sec));
 539                 if (chan->conn) {
 540                         sec.level = chan->conn->hcon->sec_level;
 541
 542                         if (sk->sk_state == BT_CONNECTED)
 543                                 sec.key_size = chan->conn->hcon->enc_key_size;
 544                 } else {
 545                         sec.level = chan->sec_level;
 546                 }
 547
 548                 len = min_t(unsigned int, len, sizeof(sec));
 549                 if (copy_to_user(optval, (char *) &sec, len))
 550                         err = -EFAULT;
 551
 552                 break;
 553
 554         case BT_DEFER_SETUP:
 555                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 556                         err = -EINVAL;
 557                         break;
 558                 }
 559
 560                 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
 561                              (u32 __user *) optval))
 562                         err = -EFAULT;
 563
 564                 break;
 565
 566         case BT_FLUSHABLE:
 567                 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
 568                              (u32 __user *) optval))
 569                         err = -EFAULT;
 570
 571                 break;
 572
 573         case BT_POWER:
 574                 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
 575                     && sk->sk_type != SOCK_RAW) {
 576                         err = -EINVAL;
 577                         break;
 578                 }
 579
 580                 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 581
 582                 len = min_t(unsigned int, len, sizeof(pwr));
 583                 if (copy_to_user(optval, (char *) &pwr, len))
 584                         err = -EFAULT;
 585
 586                 break;
 587
 588         case BT_CHANNEL_POLICY:
 589                 if (put_user(chan->chan_policy, (u32 __user *) optval))
 590                         err = -EFAULT;
 591                 break;
 592
 593         case BT_SNDMTU:
 594                 if (!bdaddr_type_is_le(chan->src_type)) {
 595                         err = -EINVAL;
 596                         break;
 597                 }
 598
 599                 if (sk->sk_state != BT_CONNECTED) {
 600                         err = -ENOTCONN;
 601                         break;
 602                 }
 603
 604                 if (put_user(chan->omtu, (u16 __user *) optval))
 605                         err = -EFAULT;
 606                 break;
 607
 608         case BT_RCVMTU:
 609                 if (!bdaddr_type_is_le(chan->src_type)) {
 610                         err = -EINVAL;
 611                         break;
 612                 }
 613
 614                 if (put_user(chan->imtu, (u16 __user *) optval))
 615                         err = -EFAULT;
 616                 break;
 617
 618         default:
 619                 err = -ENOPROTOOPT;
 620                 break;
 621         }
 622
 623         release_sock(sk);
 624         return err;
 625 }
 626
 627 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
 628 {
 629         switch (chan->scid) {
 630         case L2CAP_CID_ATT:
 631                 if (mtu < L2CAP_LE_MIN_MTU)
 632                         return false;
 633                 break;
 634
 635         default:
 636                 if (mtu < L2CAP_DEFAULT_MIN_MTU)
 637                         return false;
 638         }
 639
 640         return true;
 641 }
 642
 643 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
 644                                      char __user *optval, unsigned int optlen)
 645 {
 646         struct sock *sk = sock->sk;
 647         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 648         struct l2cap_options opts;
 649         int len, err = 0;
 650         u32 opt;
 651
 652         BT_DBG("sk %p", sk);
 653
 654         lock_sock(sk);
 655
 656         switch (optname) {
 657         case L2CAP_OPTIONS:
 658                 if (bdaddr_type_is_le(chan->src_type)) {
 659                         err = -EINVAL;
 660                         break;
 661                 }
 662
 663                 if (sk->sk_state == BT_CONNECTED) {
 664                         err = -EINVAL;
 665                         break;
 666                 }
 667
 668                 opts.imtu     = chan->imtu;
 669                 opts.omtu     = chan->omtu;
 670                 opts.flush_to = chan->flush_to;
 671                 opts.mode     = chan->mode;
 672                 opts.fcs      = chan->fcs;
 673                 opts.max_tx   = chan->max_tx;
 674                 opts.txwin_size = chan->tx_win;
 675
 676                 len = min_t(unsigned int, sizeof(opts), optlen);
 677                 if (copy_from_user((char *) &opts, optval, len)) {
 678                         err = -EFAULT;
 679                         break;
 680                 }
 681
 682                 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
 683                         err = -EINVAL;
 684                         break;
 685                 }
 686
 687                 if (!l2cap_valid_mtu(chan, opts.imtu)) {
 688                         err = -EINVAL;
 689                         break;
 690                 }
 691
 692                 chan->mode = opts.mode;
 693                 switch (chan->mode) {
 694                 case L2CAP_MODE_LE_FLOWCTL:
 695                         break;
 696                 case L2CAP_MODE_BASIC:
 697                         clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
 698                         break;
 699                 case L2CAP_MODE_ERTM:
 700                 case L2CAP_MODE_STREAMING:
 701                         if (!disable_ertm)
 702                                 break;
 703                         /* fall through */
 704                 default:
 705                         err = -EINVAL;
 706                         break;
 707                 }
 708
 709                 chan->imtu = opts.imtu;
 710                 chan->omtu = opts.omtu;
 711                 chan->fcs  = opts.fcs;
 712                 chan->max_tx = opts.max_tx;
 713                 chan->tx_win = opts.txwin_size;
 714                 chan->flush_to = opts.flush_to;
 715                 break;
 716
 717         case L2CAP_LM:
 718                 if (get_user(opt, (u32 __user *) optval)) {
 719                         err = -EFAULT;
 720                         break;
 721                 }
 722
 723                 if (opt & L2CAP_LM_FIPS) {
 724                         err = -EINVAL;
 725                         break;
 726                 }
 727
 728                 if (opt & L2CAP_LM_AUTH)
 729                         chan->sec_level = BT_SECURITY_LOW;
 730                 if (opt & L2CAP_LM_ENCRYPT)
 731                         chan->sec_level = BT_SECURITY_MEDIUM;
 732                 if (opt & L2CAP_LM_SECURE)
 733                         chan->sec_level = BT_SECURITY_HIGH;
 734
 735                 if (opt & L2CAP_LM_MASTER)
 736                         set_bit(FLAG_ROLE_SWITCH, &chan->flags);
 737                 else
 738                         clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
 739
 740                 if (opt & L2CAP_LM_RELIABLE)
 741                         set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 742                 else
 743                         clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
 744                 break;
 745
 746         default:
 747                 err = -ENOPROTOOPT;
 748                 break;
 749         }
 750
 751         release_sock(sk);
 752         return err;
 753 }
 754
 755 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
 756                                  char __user *optval, unsigned int optlen)
 757 {
 758         struct sock *sk = sock->sk;
 759         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 760         struct bt_security sec;
 761         struct bt_power pwr;
 762         struct l2cap_conn *conn;
 763         int len, err = 0;
 764         u32 opt;
 765
 766         BT_DBG("sk %p", sk);
 767
 768         if (level == SOL_L2CAP)
 769                 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
 770
 771         if (level != SOL_BLUETOOTH)
 772                 return -ENOPROTOOPT;
 773
 774         lock_sock(sk);
 775
 776         switch (optname) {
 777         case BT_SECURITY:
 778                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 779                     chan->chan_type != L2CAP_CHAN_FIXED &&
 780                     chan->chan_type != L2CAP_CHAN_RAW) {
 781                         err = -EINVAL;
 782                         break;
 783                 }
 784
 785                 sec.level = BT_SECURITY_LOW;
 786
 787                 len = min_t(unsigned int, sizeof(sec), optlen);
 788                 if (copy_from_user((char *) &sec, optval, len)) {
 789                         err = -EFAULT;
 790                         break;
 791                 }
 792
 793                 if (sec.level < BT_SECURITY_LOW ||
 794                     sec.level > BT_SECURITY_HIGH) {
 795                         err = -EINVAL;
 796                         break;
 797                 }
 798
 799                 chan->sec_level = sec.level;
 800
 801                 if (!chan->conn)
 802                         break;
 803
 804                 conn = chan->conn;
 805
 806                 /*change security for LE channels */
 807                 if (chan->scid == L2CAP_CID_ATT) {
 808                         if (smp_conn_security(conn->hcon, sec.level))
 809                                 break;
 810                         set_bit(FLAG_PENDING_SECURITY, &chan->flags);
 811                         sk->sk_state = BT_CONFIG;
 812                         chan->state = BT_CONFIG;
 813
 814                 /* or for ACL link */
 815                 } else if ((sk->sk_state == BT_CONNECT2 &&
 816                             test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
 817                            sk->sk_state == BT_CONNECTED) {
 818                         if (!l2cap_chan_check_security(chan, true))
 819                                 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
 820                         else
 821                                 sk->sk_state_change(sk);
 822                 } else {
 823                         err = -EINVAL;
 824                 }
 825                 break;
 826
 827         case BT_DEFER_SETUP:
 828                 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
 829                         err = -EINVAL;
 830                         break;
 831                 }
 832
 833                 if (get_user(opt, (u32 __user *) optval)) {
 834                         err = -EFAULT;
 835                         break;
 836                 }
 837
 838                 if (opt) {
 839                         set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 840                         set_bit(FLAG_DEFER_SETUP, &chan->flags);
 841                 } else {
 842                         clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
 843                         clear_bit(FLAG_DEFER_SETUP, &chan->flags);
 844                 }
 845                 break;
 846
 847         case BT_FLUSHABLE:
 848                 if (get_user(opt, (u32 __user *) optval)) {
 849                         err = -EFAULT;
 850                         break;
 851                 }
 852
 853                 if (opt > BT_FLUSHABLE_ON) {
 854                         err = -EINVAL;
 855                         break;
 856                 }
 857
 858                 if (opt == BT_FLUSHABLE_OFF) {
 859                         conn = chan->conn;
 860                         /* proceed further only when we have l2cap_conn and
 861                            No Flush support in the LM */
 862                         if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
 863                                 err = -EINVAL;
 864                                 break;
 865                         }
 866                 }
 867
 868                 if (opt)
 869                         set_bit(FLAG_FLUSHABLE, &chan->flags);
 870                 else
 871                         clear_bit(FLAG_FLUSHABLE, &chan->flags);
 872                 break;
 873
 874         case BT_POWER:
 875                 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
 876                     chan->chan_type != L2CAP_CHAN_RAW) {
 877                         err = -EINVAL;
 878                         break;
 879                 }
 880
 881                 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
 882
 883                 len = min_t(unsigned int, sizeof(pwr), optlen);
 884                 if (copy_from_user((char *) &pwr, optval, len)) {
 885                         err = -EFAULT;
 886                         break;
 887                 }
 888
 889                 if (pwr.force_active)
 890                         set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 891                 else
 892                         clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
 893                 break;
 894
 895         case BT_CHANNEL_POLICY:
 896                 if (get_user(opt, (u32 __user *) optval)) {
 897                         err = -EFAULT;
 898                         break;
 899                 }
 900
 901                 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
 902                         err = -EINVAL;
 903                         break;
 904                 }
 905
 906                 if (chan->mode != L2CAP_MODE_ERTM &&
 907                     chan->mode != L2CAP_MODE_STREAMING) {
 908                         err = -EOPNOTSUPP;
 909                         break;
 910                 }
 911
 912                 chan->chan_policy = (u8) opt;
 913
 914                 if (sk->sk_state == BT_CONNECTED &&
 915                     chan->move_role == L2CAP_MOVE_ROLE_NONE)
 916                         l2cap_move_start(chan);
 917
 918                 break;
 919
 920         case BT_SNDMTU:
 921                 if (!bdaddr_type_is_le(chan->src_type)) {
 922                         err = -EINVAL;
 923                         break;
 924                 }
 925
 926                 /* Setting is not supported as it's the remote side that
 927                  * decides this.
 928                  */
 929                 err = -EPERM;
 930                 break;
 931
 932         case BT_RCVMTU:
 933                 if (!bdaddr_type_is_le(chan->src_type)) {
 934                         err = -EINVAL;
 935                         break;
 936                 }
 937
 938                 if (sk->sk_state == BT_CONNECTED) {
 939                         err = -EISCONN;
 940                         break;
 941                 }
 942
 943                 if (get_user(opt, (u32 __user *) optval)) {
 944                         err = -EFAULT;
 945                         break;
 946                 }
 947
 948                 chan->imtu = opt;
 949                 break;
 950
 951 #ifdef CONFIG_TIZEN_WIP
 952         case BT_LE_CONN_PARAM: {
 953                 struct hci_dev *hdev;
 954                 struct le_conn_param param;
 955                 int err;
 956
 957                 len = min_t(unsigned int, sizeof(param), optlen);
 958                 if (copy_from_user((char *) &param, optval, len)) {
 959                         err = -EFAULT;
 960                         break;
 961                 }
 962
 963                 err = hci_check_conn_params(param.min, param.max,
 964                                 param.latency, param.to_multiplier);
 965                 if (err < 0)
 966                         break;
 967
 968                 conn = chan->conn;
 969                 hdev = conn->hcon->hdev;
 970                 if (conn->hcon->out ||
 971                     (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC &&
 972                      conn->hcon->features[0][0] & HCI_LE_CONN_PARAM_REQ_PROC)) {
 973                         BT_DBG("use hci_le_conn_update");
 974                         err = hci_le_conn_update(conn->hcon, param.min,
 975                                                  param.max, param.latency,
 976                                                  param.to_multiplier);
 977                         break;
 978                 }
 979
 980                 BT_DBG("use l2cap conn_update");
 981                 err = l2cap_update_connection_param(conn, param.min,
 982                                 param.max, param.latency, param.to_multiplier);
 983                 break;
 984         }
 985 #endif
 986
 987         default:
 988                 err = -ENOPROTOOPT;
 989                 break;
 990         }
 991
 992         release_sock(sk);
 993         return err;
 994 }
 995
 996 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 997                               struct msghdr *msg, size_t len)
 998 {
 999         struct sock *sk = sock->sk;
1000         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1001         int err;
1002
1003         BT_DBG("sock %p, sk %p", sock, sk);
1004
1005         err = sock_error(sk);
1006         if (err)
1007                 return err;
1008
1009         if (msg->msg_flags & MSG_OOB)
1010                 return -EOPNOTSUPP;
1011
1012         if (sk->sk_state != BT_CONNECTED)
1013                 return -ENOTCONN;
1014
1015         lock_sock(sk);
1016         err = bt_sock_wait_ready(sk, msg->msg_flags);
1017         release_sock(sk);
1018         if (err)
1019                 return err;
1020
1021         l2cap_chan_lock(chan);
1022         err = l2cap_chan_send(chan, msg, len);
1023         l2cap_chan_unlock(chan);
1024
1025         return err;
1026 }
1027
1028 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
1029                               struct msghdr *msg, size_t len, int flags)
1030 {
1031         struct sock *sk = sock->sk;
1032         struct l2cap_pinfo *pi = l2cap_pi(sk);
1033         int err;
1034
1035         lock_sock(sk);
1036
1037         if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
1038                                                     &bt_sk(sk)->flags)) {
1039                 if (bdaddr_type_is_le(pi->chan->src_type)) {
1040                         sk->sk_state = BT_CONNECTED;
1041                         pi->chan->state = BT_CONNECTED;
1042                         __l2cap_le_connect_rsp_defer(pi->chan);
1043                 } else {
1044                         sk->sk_state = BT_CONFIG;
1045                         pi->chan->state = BT_CONFIG;
1046                         __l2cap_connect_rsp_defer(pi->chan);
1047                 }
1048
1049                 err = 0;
1050                 goto done;
1051         }
1052
1053         release_sock(sk);
1054
1055         if (sock->type == SOCK_STREAM)
1056                 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1057         else
1058                 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1059
1060         if (pi->chan->mode != L2CAP_MODE_ERTM)
1061                 return err;
1062
1063         /* Attempt to put pending rx data in the socket buffer */
1064
1065         lock_sock(sk);
1066
1067         if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1068                 goto done;
1069
1070         if (pi->rx_busy_skb) {
1071                 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1072                         pi->rx_busy_skb = NULL;
1073                 else
1074                         goto done;
1075         }
1076
1077         /* Restore data flow when half of the receive buffer is
1078          * available.  This avoids resending large numbers of
1079          * frames.
1080          */
1081         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1082                 l2cap_chan_busy(pi->chan, 0);
1083
1084 done:
1085         release_sock(sk);
1086         return err;
1087 }
1088
1089 /* Kill socket (only if zapped and orphan)
1090  * Must be called on unlocked socket.
1091  */
1092 static void l2cap_sock_kill(struct sock *sk)
1093 {
1094         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1095                 return;
1096
1097         BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1098
1099         /* Kill poor orphan */
1100
1101         l2cap_chan_put(l2cap_pi(sk)->chan);
1102         sock_set_flag(sk, SOCK_DEAD);
1103         sock_put(sk);
1104 }
1105
1106 static int __l2cap_wait_ack(struct sock *sk)
1107 {
1108         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1109         DECLARE_WAITQUEUE(wait, current);
1110         int err = 0;
1111         int timeo = HZ/5;
1112
1113         add_wait_queue(sk_sleep(sk), &wait);
1114         set_current_state(TASK_INTERRUPTIBLE);
1115         while (chan->unacked_frames > 0 && chan->conn) {
1116                 if (!timeo)
1117                         timeo = HZ/5;
1118
1119                 if (signal_pending(current)) {
1120                         err = sock_intr_errno(timeo);
1121                         break;
1122                 }
1123
1124                 release_sock(sk);
1125                 timeo = schedule_timeout(timeo);
1126                 lock_sock(sk);
1127                 set_current_state(TASK_INTERRUPTIBLE);
1128
1129                 err = sock_error(sk);
1130                 if (err)
1131                         break;
1132         }
1133         set_current_state(TASK_RUNNING);
1134         remove_wait_queue(sk_sleep(sk), &wait);
1135         return err;
1136 }
1137
1138 static int l2cap_sock_shutdown(struct socket *sock, int how)
1139 {
1140         struct sock *sk = sock->sk;
1141         struct l2cap_chan *chan;
1142         struct l2cap_conn *conn;
1143         int err = 0;
1144
1145         BT_DBG("sock %p, sk %p", sock, sk);
1146
1147         if (!sk)
1148                 return 0;
1149
1150         chan = l2cap_pi(sk)->chan;
1151         conn = chan->conn;
1152
1153         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1154
1155         if (conn)
1156                 mutex_lock(&conn->chan_lock);
1157
1158         l2cap_chan_lock(chan);
1159         lock_sock(sk);
1160
1161         if (!sk->sk_shutdown) {
1162                 if (chan->mode == L2CAP_MODE_ERTM)
1163                         err = __l2cap_wait_ack(sk);
1164
1165                 sk->sk_shutdown = SHUTDOWN_MASK;
1166
1167                 release_sock(sk);
1168                 l2cap_chan_close(chan, 0);
1169                 lock_sock(sk);
1170
1171                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1172                     !(current->flags & PF_EXITING))
1173                         err = bt_sock_wait_state(sk, BT_CLOSED,
1174                                                  sk->sk_lingertime);
1175         }
1176
1177         if (!err && sk->sk_err)
1178                 err = -sk->sk_err;
1179
1180         release_sock(sk);
1181         l2cap_chan_unlock(chan);
1182
1183         if (conn)
1184                 mutex_unlock(&conn->chan_lock);
1185
1186         return err;
1187 }
1188
1189 static int l2cap_sock_release(struct socket *sock)
1190 {
1191         struct sock *sk = sock->sk;
1192         int err;
1193
1194         BT_DBG("sock %p, sk %p", sock, sk);
1195
1196         if (!sk)
1197                 return 0;
1198
1199         bt_sock_unlink(&l2cap_sk_list, sk);
1200
1201         err = l2cap_sock_shutdown(sock, 2);
1202
1203         sock_orphan(sk);
1204         l2cap_sock_kill(sk);
1205         return err;
1206 }
1207
1208 static void l2cap_sock_cleanup_listen(struct sock *parent)
1209 {
1210         struct sock *sk;
1211
1212         BT_DBG("parent %p state %s", parent,
1213                state_to_string(parent->sk_state));
1214
1215         /* Close not yet accepted channels */
1216         while ((sk = bt_accept_dequeue(parent, NULL))) {
1217                 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1218
1219                 BT_DBG("child chan %p state %s", chan,
1220                        state_to_string(chan->state));
1221
1222                 l2cap_chan_lock(chan);
1223                 __clear_chan_timer(chan);
1224                 l2cap_chan_close(chan, ECONNRESET);
1225                 l2cap_chan_unlock(chan);
1226
1227                 l2cap_sock_kill(sk);
1228         }
1229 }
1230
1231 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1232 {
1233         struct sock *sk, *parent = chan->data;
1234
1235         lock_sock(parent);
1236
1237         /* Check for backlog size */
1238         if (sk_acceptq_is_full(parent)) {
1239                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1240                 release_sock(parent);
1241                 return NULL;
1242         }
1243
1244         sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1245                               GFP_ATOMIC);
1246         if (!sk) {
1247                 release_sock(parent);
1248                 return NULL;
1249         }
1250
1251         bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1252
1253         l2cap_sock_init(sk, parent);
1254
1255         bt_accept_enqueue(parent, sk);
1256
1257         release_sock(parent);
1258
1259         return l2cap_pi(sk)->chan;
1260 }
1261
1262 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1263 {
1264         struct sock *sk = chan->data;
1265         int err;
1266
1267         lock_sock(sk);
1268
1269         if (l2cap_pi(sk)->rx_busy_skb) {
1270                 err = -ENOMEM;
1271                 goto done;
1272         }
1273
1274         err = sock_queue_rcv_skb(sk, skb);
1275
1276         /* For ERTM, handle one skb that doesn't fit into the recv
1277          * buffer.  This is important to do because the data frames
1278          * have already been acked, so the skb cannot be discarded.
1279          *
1280          * Notify the l2cap core that the buffer is full, so the
1281          * LOCAL_BUSY state is entered and no more frames are
1282          * acked and reassembled until there is buffer space
1283          * available.
1284          */
1285         if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1286                 l2cap_pi(sk)->rx_busy_skb = skb;
1287                 l2cap_chan_busy(chan, 1);
1288                 err = 0;
1289         }
1290
1291 done:
1292         release_sock(sk);
1293
1294         return err;
1295 }
1296
1297 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1298 {
1299         struct sock *sk = chan->data;
1300
1301         l2cap_sock_kill(sk);
1302 }
1303
1304 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1305 {
1306         struct sock *sk = chan->data;
1307         struct sock *parent;
1308
1309         BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1310
1311         /* This callback can be called both for server (BT_LISTEN)
1312          * sockets as well as "normal" ones. To avoid lockdep warnings
1313          * with child socket locking (through l2cap_sock_cleanup_listen)
1314          * we need separation into separate nesting levels. The simplest
1315          * way to accomplish this is to inherit the nesting level used
1316          * for the channel.
1317          */
1318         lock_sock_nested(sk, atomic_read(&chan->nesting));
1319
1320         parent = bt_sk(sk)->parent;
1321
1322         sock_set_flag(sk, SOCK_ZAPPED);
1323
1324         switch (chan->state) {
1325         case BT_OPEN:
1326         case BT_BOUND:
1327         case BT_CLOSED:
1328                 break;
1329         case BT_LISTEN:
1330                 l2cap_sock_cleanup_listen(sk);
1331                 sk->sk_state = BT_CLOSED;
1332                 chan->state = BT_CLOSED;
1333
1334                 break;
1335         default:
1336                 sk->sk_state = BT_CLOSED;
1337                 chan->state = BT_CLOSED;
1338
1339                 sk->sk_err = err;
1340
1341                 if (parent) {
1342                         bt_accept_unlink(sk);
1343 #ifdef CONFIG_TIZEN_WIP
1344                         parent->sk_data_ready(parent, 0);
1345 #else
1346                         parent->sk_data_ready(parent);
1347 #endif
1348                 } else {
1349                         sk->sk_state_change(sk);
1350                 }
1351
1352                 break;
1353         }
1354
1355         release_sock(sk);
1356 }
1357
1358 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1359                                        int err)
1360 {
1361         struct sock *sk = chan->data;
1362
1363         sk->sk_state = state;
1364
1365         if (err)
1366                 sk->sk_err = err;
1367 }
1368
1369 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1370                                                unsigned long hdr_len,
1371                                                unsigned long len, int nb)
1372 {
1373         struct sock *sk = chan->data;
1374         struct sk_buff *skb;
1375         int err;
1376
1377         l2cap_chan_unlock(chan);
1378         skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1379         l2cap_chan_lock(chan);
1380
1381         if (!skb)
1382                 return ERR_PTR(err);
1383
1384         skb->priority = sk->sk_priority;
1385
1386         bt_cb(skb)->chan = chan;
1387
1388         return skb;
1389 }
1390 #ifdef CONFIG_TIZEN_WIP
1391 static int l2cap_sock_memcpy_fromiovec_cb(struct l2cap_chan *chan,
1392                                           unsigned char *kdata,
1393                                           struct iovec *iov, int len)
1394 {
1395         return memcpy_fromiovec(kdata, iov, len);
1396 }
1397 #endif
1398 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1399 {
1400         struct sock *sk = chan->data;
1401         struct sock *parent;
1402
1403         lock_sock(sk);
1404
1405         parent = bt_sk(sk)->parent;
1406
1407         BT_DBG("sk %p, parent %p", sk, parent);
1408
1409         sk->sk_state = BT_CONNECTED;
1410         sk->sk_state_change(sk);
1411
1412         if (parent)
1413 #ifdef CONFIG_TIZEN_WIP
1414                 parent->sk_data_ready(parent, 0);
1415 #else
1416                 parent->sk_data_ready(parent);
1417 #endif
1418         release_sock(sk);
1419 }
1420
1421 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1422 {
1423         struct sock *parent, *sk = chan->data;
1424
1425         lock_sock(sk);
1426
1427         parent = bt_sk(sk)->parent;
1428         if (parent)
1429 #ifdef CONFIG_TIZEN_WIP
1430                 parent->sk_data_ready(parent, 0);
1431 #else
1432                 parent->sk_data_ready(parent);
1433 #endif
1434         release_sock(sk);
1435 }
1436
1437 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1438 {
1439         struct sock *sk = chan->data;
1440
1441         if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1442                 sk->sk_state = BT_CONNECTED;
1443                 chan->state = BT_CONNECTED;
1444         }
1445
1446         clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1447         sk->sk_state_change(sk);
1448 }
1449
1450 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1451 {
1452         struct sock *sk = chan->data;
1453
1454         lock_sock(sk);
1455         sk->sk_shutdown = SHUTDOWN_MASK;
1456         release_sock(sk);
1457 }
1458
1459 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1460 {
1461         struct sock *sk = chan->data;
1462
1463         return sk->sk_sndtimeo;
1464 }
1465
1466 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1467 {
1468         struct sock *sk = chan->data;
1469
1470         set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1471         sk->sk_state_change(sk);
1472 }
1473
1474 static const struct l2cap_ops l2cap_chan_ops = {
1475         .name                   = "L2CAP Socket Interface",
1476         .new_connection         = l2cap_sock_new_connection_cb,
1477         .recv                   = l2cap_sock_recv_cb,
1478         .close                  = l2cap_sock_close_cb,
1479         .teardown               = l2cap_sock_teardown_cb,
1480         .state_change           = l2cap_sock_state_change_cb,
1481         .ready                  = l2cap_sock_ready_cb,
1482         .defer                  = l2cap_sock_defer_cb,
1483         .resume                 = l2cap_sock_resume_cb,
1484         .suspend                = l2cap_sock_suspend_cb,
1485         .set_shutdown           = l2cap_sock_set_shutdown_cb,
1486         .get_sndtimeo           = l2cap_sock_get_sndtimeo_cb,
1487         .alloc_skb              = l2cap_sock_alloc_skb_cb,
1488 #ifdef CONFIG_TIZEN_WIP
1489         .memcpy_fromiovec       = l2cap_sock_memcpy_fromiovec_cb,
1490 #endif
1491 };
1492
1493 static void l2cap_sock_destruct(struct sock *sk)
1494 {
1495         BT_DBG("sk %p", sk);
1496
1497         if (l2cap_pi(sk)->chan)
1498                 l2cap_chan_put(l2cap_pi(sk)->chan);
1499
1500         if (l2cap_pi(sk)->rx_busy_skb) {
1501                 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1502                 l2cap_pi(sk)->rx_busy_skb = NULL;
1503         }
1504
1505         skb_queue_purge(&sk->sk_receive_queue);
1506         skb_queue_purge(&sk->sk_write_queue);
1507 }
1508
1509 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1510                                int *msg_namelen)
1511 {
1512         DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1513
1514         memset(la, 0, sizeof(struct sockaddr_l2));
1515         la->l2_family = AF_BLUETOOTH;
1516         la->l2_psm = bt_cb(skb)->psm;
1517         bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1518
1519         *msg_namelen = sizeof(struct sockaddr_l2);
1520 }
1521
1522 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1523 {
1524         struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1525
1526         BT_DBG("sk %p", sk);
1527
1528         if (parent) {
1529                 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1530
1531                 sk->sk_type = parent->sk_type;
1532                 bt_sk(sk)->flags = bt_sk(parent)->flags;
1533
1534                 chan->chan_type = pchan->chan_type;
1535                 chan->imtu = pchan->imtu;
1536                 chan->omtu = pchan->omtu;
1537                 chan->conf_state = pchan->conf_state;
1538                 chan->mode = pchan->mode;
1539                 chan->fcs  = pchan->fcs;
1540                 chan->max_tx = pchan->max_tx;
1541                 chan->tx_win = pchan->tx_win;
1542                 chan->tx_win_max = pchan->tx_win_max;
1543                 chan->sec_level = pchan->sec_level;
1544                 chan->flags = pchan->flags;
1545                 chan->tx_credits = pchan->tx_credits;
1546                 chan->rx_credits = pchan->rx_credits;
1547
1548                 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1549                         chan->scid = pchan->scid;
1550                         chan->dcid = pchan->scid;
1551                 }
1552
1553                 security_sk_clone(parent, sk);
1554         } else {
1555                 switch (sk->sk_type) {
1556                 case SOCK_RAW:
1557                         chan->chan_type = L2CAP_CHAN_RAW;
1558                         break;
1559                 case SOCK_DGRAM:
1560                         chan->chan_type = L2CAP_CHAN_CONN_LESS;
1561                         bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1562                         break;
1563                 case SOCK_SEQPACKET:
1564                 case SOCK_STREAM:
1565                         chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1566                         break;
1567                 }
1568
1569                 chan->imtu = L2CAP_DEFAULT_MTU;
1570                 chan->omtu = 0;
1571                 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1572                         chan->mode = L2CAP_MODE_ERTM;
1573                         set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1574                 } else {
1575                         chan->mode = L2CAP_MODE_BASIC;
1576                 }
1577
1578                 l2cap_chan_set_defaults(chan);
1579         }
1580
1581         /* Default config options */
1582         chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1583
1584         chan->data = sk;
1585         chan->ops = &l2cap_chan_ops;
1586 }
1587
1588 static struct proto l2cap_proto = {
1589         .name           = "L2CAP",
1590         .owner          = THIS_MODULE,
1591         .obj_size       = sizeof(struct l2cap_pinfo)
1592 };
1593
1594 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1595                                      int proto, gfp_t prio)
1596 {
1597         struct sock *sk;
1598         struct l2cap_chan *chan;
1599
1600         sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1601         if (!sk)
1602                 return NULL;
1603
1604         sock_init_data(sock, sk);
1605         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1606
1607         sk->sk_destruct = l2cap_sock_destruct;
1608         sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1609
1610         sock_reset_flag(sk, SOCK_ZAPPED);
1611
1612         sk->sk_protocol = proto;
1613         sk->sk_state = BT_OPEN;
1614
1615         chan = l2cap_chan_create();
1616         if (!chan) {
1617                 sk_free(sk);
1618                 return NULL;
1619         }
1620
1621         l2cap_chan_hold(chan);
1622
1623         l2cap_pi(sk)->chan = chan;
1624
1625         return sk;
1626 }
1627
1628 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1629                              int kern)
1630 {
1631         struct sock *sk;
1632
1633         BT_DBG("sock %p", sock);
1634
1635         sock->state = SS_UNCONNECTED;
1636
1637         if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1638             sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1639                 return -ESOCKTNOSUPPORT;
1640
1641         if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1642                 return -EPERM;
1643
1644         sock->ops = &l2cap_sock_ops;
1645
1646         sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1647         if (!sk)
1648                 return -ENOMEM;
1649
1650         l2cap_sock_init(sk, NULL);
1651         bt_sock_link(&l2cap_sk_list, sk);
1652         return 0;
1653 }
1654
1655 static const struct proto_ops l2cap_sock_ops = {
1656         .family         = PF_BLUETOOTH,
1657         .owner          = THIS_MODULE,
1658         .release        = l2cap_sock_release,
1659         .bind           = l2cap_sock_bind,
1660         .connect        = l2cap_sock_connect,
1661         .listen         = l2cap_sock_listen,
1662         .accept         = l2cap_sock_accept,
1663         .getname        = l2cap_sock_getname,
1664         .sendmsg        = l2cap_sock_sendmsg,
1665         .recvmsg        = l2cap_sock_recvmsg,
1666         .poll           = bt_sock_poll,
1667         .ioctl          = bt_sock_ioctl,
1668         .mmap           = sock_no_mmap,
1669         .socketpair     = sock_no_socketpair,
1670         .shutdown       = l2cap_sock_shutdown,
1671         .setsockopt     = l2cap_sock_setsockopt,
1672         .getsockopt     = l2cap_sock_getsockopt
1673 };
1674
1675 static const struct net_proto_family l2cap_sock_family_ops = {
1676         .family = PF_BLUETOOTH,
1677         .owner  = THIS_MODULE,
1678         .create = l2cap_sock_create,
1679 };
1680
1681 int __init l2cap_init_sockets(void)
1682 {
1683         int err;
1684
1685         BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1686
1687         err = proto_register(&l2cap_proto, 0);
1688         if (err < 0)
1689                 return err;
1690
1691         err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1692         if (err < 0) {
1693                 BT_ERR("L2CAP socket registration failed");
1694                 goto error;
1695         }
1696
1697         err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1698                              NULL);
1699         if (err < 0) {
1700                 BT_ERR("Failed to create L2CAP proc file");
1701                 bt_sock_unregister(BTPROTO_L2CAP);
1702                 goto error;
1703         }
1704
1705         BT_INFO("L2CAP socket layer initialized");
1706
1707         return 0;
1708
1709 error:
1710         proto_unregister(&l2cap_proto);
1711         return err;
1712 }
1713
1714 void l2cap_cleanup_sockets(void)
1715 {
1716         bt_procfs_cleanup(&init_net, "l2cap");
1717         bt_sock_unregister(BTPROTO_L2CAP);
1718         proto_unregister(&l2cap_proto);
1719 }