projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Disconnect L2CAP connections without encryption
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / rfcomm / sock.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 RFCOMM implementation for Linux Bluetooth stack (BlueZ).
3 Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
4 Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
8e87d142
YH		 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 21 SOFTWARE IS DISCLAIMED.
22*/
23
24/*
25 * RFCOMM sockets.
1da177e4
LT		 26 */
27
1da177e4
LT		 28#include <linux/module.h>
29
30#include <linux/types.h>
31#include <linux/errno.h>
32#include <linux/kernel.h>
1da177e4
LT		 33#include <linux/sched.h>
34#include <linux/slab.h>
35#include <linux/poll.h>
36#include <linux/fcntl.h>
37#include <linux/init.h>
38#include <linux/interrupt.h>
39#include <linux/socket.h>
40#include <linux/skbuff.h>
41#include <linux/list.h>
be9d1227 42#include <linux/device.h>
1da177e4
LT		 43#include <net/sock.h>
44
45#include <asm/system.h>
46#include <asm/uaccess.h>
47
48#include <net/bluetooth/bluetooth.h>
49#include <net/bluetooth/hci_core.h>
50#include <net/bluetooth/l2cap.h>
51#include <net/bluetooth/rfcomm.h>
52
90ddc4f0 53static const struct proto_ops rfcomm_sock_ops;
1da177e4
LT		 54
55static struct bt_sock_list rfcomm_sk_list = {
d5fb2962 56 .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
1da177e4
LT		 57};
58
59static void rfcomm_sock_close(struct sock *sk);
60static void rfcomm_sock_kill(struct sock *sk);
61
62/* ---- DLC callbacks ----
63 *
64 * called under rfcomm_dlc_lock()
65 */
66static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
67{
68 struct sock *sk = d->owner;
69 if (!sk)
70 return;
71
72 atomic_add(skb->len, &sk->sk_rmem_alloc);
73 skb_queue_tail(&sk->sk_receive_queue, skb);
74 sk->sk_data_ready(sk, skb->len);
75
76 if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
77 rfcomm_dlc_throttle(d);
78}
79
80static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
81{
82 struct sock *sk = d->owner, *parent;
83 if (!sk)
84 return;
85
86 BT_DBG("dlc %p state %ld err %d", d, d->state, err);
87
88 bh_lock_sock(sk);
89
90 if (err)
91 sk->sk_err = err;
92
93 sk->sk_state = d->state;
94
95 parent = bt_sk(sk)->parent;
96 if (parent) {
97 if (d->state == BT_CLOSED) {
98 sock_set_flag(sk, SOCK_ZAPPED);
99 bt_accept_unlink(sk);
100 }
101 parent->sk_data_ready(parent, 0);
102 } else {
103 if (d->state == BT_CONNECTED)
104 rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
105 sk->sk_state_change(sk);
106 }
107
108 bh_unlock_sock(sk);
109
110 if (parent && sock_flag(sk, SOCK_ZAPPED)) {
111 /* We have to drop DLC lock here, otherwise
112 * rfcomm_sock_destruct() will dead lock. */
113 rfcomm_dlc_unlock(d);
114 rfcomm_sock_kill(sk);
115 rfcomm_dlc_lock(d);
116 }
117}
118
119/* ---- Socket functions ---- */
120static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
121{
122 struct sock *sk = NULL;
123 struct hlist_node *node;
124
125 sk_for_each(sk, node, &rfcomm_sk_list.head) {
8e87d142 126 if (rfcomm_pi(sk)->channel == channel &&
1da177e4
LT		 127 !bacmp(&bt_sk(sk)->src, src))
128 break;
129 }
130
131 return node ? sk : NULL;
132}
133
134/* Find socket with channel and source bdaddr.
135 * Returns closest match.
136 */
137static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
138{
139 struct sock *sk = NULL, *sk1 = NULL;
140 struct hlist_node *node;
141
142 sk_for_each(sk, node, &rfcomm_sk_list.head) {
143 if (state && sk->sk_state != state)
144 continue;
145
146 if (rfcomm_pi(sk)->channel == channel) {
147 /* Exact match. */
148 if (!bacmp(&bt_sk(sk)->src, src))
149 break;
150
151 /* Closest match */
152 if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
153 sk1 = sk;
154 }
155 }
156 return node ? sk : sk1;
157}
158
159/* Find socket with given address (channel, src).
160 * Returns locked socket */
161static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
162{
163 struct sock *s;
164 read_lock(&rfcomm_sk_list.lock);
165 s = __rfcomm_get_sock_by_channel(state, channel, src);
166 if (s) bh_lock_sock(s);
167 read_unlock(&rfcomm_sk_list.lock);
168 return s;
169}
170
171static void rfcomm_sock_destruct(struct sock *sk)
172{
173 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
174
175 BT_DBG("sk %p dlc %p", sk, d);
176
177 skb_queue_purge(&sk->sk_receive_queue);
178 skb_queue_purge(&sk->sk_write_queue);
179
180 rfcomm_dlc_lock(d);
181 rfcomm_pi(sk)->dlc = NULL;
182
183 /* Detach DLC if it's owned by this socket */
184 if (d->owner == sk)
185 d->owner = NULL;
186 rfcomm_dlc_unlock(d);
187
188 rfcomm_dlc_put(d);
189}
190
191static void rfcomm_sock_cleanup_listen(struct sock *parent)
192{
193 struct sock *sk;
194
195 BT_DBG("parent %p", parent);
196
197 /* Close not yet accepted dlcs */
198 while ((sk = bt_accept_dequeue(parent, NULL))) {
199 rfcomm_sock_close(sk);
200 rfcomm_sock_kill(sk);
201 }
202
203 parent->sk_state = BT_CLOSED;
204 sock_set_flag(parent, SOCK_ZAPPED);
205}
206
207/* Kill socket (only if zapped and orphan)
208 * Must be called on unlocked socket.
209 */
210static void rfcomm_sock_kill(struct sock *sk)
211{
212 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
213 return;
214
215 BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
216
217 /* Kill poor orphan */
218 bt_sock_unlink(&rfcomm_sk_list, sk);
219 sock_set_flag(sk, SOCK_DEAD);
220 sock_put(sk);
221}
222
223static void __rfcomm_sock_close(struct sock *sk)
224{
225 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
226
227 BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
228
229 switch (sk->sk_state) {
230 case BT_LISTEN:
231 rfcomm_sock_cleanup_listen(sk);
232 break;
233
234 case BT_CONNECT:
235 case BT_CONNECT2:
236 case BT_CONFIG:
237 case BT_CONNECTED:
238 rfcomm_dlc_close(d, 0);
239
240 default:
241 sock_set_flag(sk, SOCK_ZAPPED);
242 break;
243 }
244}
245
246/* Close socket.
247 * Must be called on unlocked socket.
248 */
249static void rfcomm_sock_close(struct sock *sk)
250{
251 lock_sock(sk);
252 __rfcomm_sock_close(sk);
253 release_sock(sk);
254}
255
256static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
257{
258 struct rfcomm_pinfo *pi = rfcomm_pi(sk);
259
260 BT_DBG("sk %p", sk);
261
262 if (parent) {
263 sk->sk_type = parent->sk_type;
bb23c0ab 264 pi->dlc->defer_setup = bt_sk(parent)->defer_setup;
9f2c8a03
MH		 265
266 pi->sec_level = rfcomm_pi(parent)->sec_level;
267 pi->role_switch = rfcomm_pi(parent)->role_switch;
1da177e4 268 } else {
bb23c0ab 269 pi->dlc->defer_setup = 0;
9f2c8a03
MH		 270
271 pi->sec_level = BT_SECURITY_LOW;
272 pi->role_switch = 0;
1da177e4
LT		 273 }
274
9f2c8a03
MH		 275 pi->dlc->sec_level = pi->sec_level;
276 pi->dlc->role_switch = pi->role_switch;
1da177e4
LT		 277}
278
279static struct proto rfcomm_proto = {
280 .name = "RFCOMM",
281 .owner = THIS_MODULE,
282 .obj_size = sizeof(struct rfcomm_pinfo)
283};
284
1b8d7ae4 285static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
1da177e4
LT		 286{
287 struct rfcomm_dlc *d;
288 struct sock *sk;
289
6257ff21 290 sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
1da177e4
LT		 291 if (!sk)
292 return NULL;
293
294 sock_init_data(sock, sk);
295 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
296
297 d = rfcomm_dlc_alloc(prio);
298 if (!d) {
299 sk_free(sk);
300 return NULL;
301 }
302
303 d->data_ready = rfcomm_sk_data_ready;
304 d->state_change = rfcomm_sk_state_change;
305
306 rfcomm_pi(sk)->dlc = d;
307 d->owner = sk;
308
309 sk->sk_destruct = rfcomm_sock_destruct;
310 sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
311
77db1980
MH		 312 sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
313 sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
1da177e4
LT		 314
315 sock_reset_flag(sk, SOCK_ZAPPED);
316
317 sk->sk_protocol = proto;
77db1980 318 sk->sk_state = BT_OPEN;
1da177e4
LT		 319
320 bt_sock_link(&rfcomm_sk_list, sk);
321
322 BT_DBG("sk %p", sk);
323 return sk;
324}
325
1b8d7ae4 326static int rfcomm_sock_create(struct net *net, struct socket *sock, int protocol)
1da177e4
LT		 327{
328 struct sock *sk;
329
330 BT_DBG("sock %p", sock);
331
332 sock->state = SS_UNCONNECTED;
333
334 if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
335 return -ESOCKTNOSUPPORT;
336
337 sock->ops = &rfcomm_sock_ops;
338
1b8d7ae4 339 sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
74da626a 340 if (!sk)
1da177e4
LT		 341 return -ENOMEM;
342
343 rfcomm_sock_init(sk, NULL);
344 return 0;
345}
346
347static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
348{
349 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
350 struct sock *sk = sock->sk;
351 int err = 0;
352
353 BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
354
355 if (!addr || addr->sa_family != AF_BLUETOOTH)
356 return -EINVAL;
357
358 lock_sock(sk);
359
360 if (sk->sk_state != BT_OPEN) {
361 err = -EBADFD;
362 goto done;
363 }
364
354d28d5
MH		 365 if (sk->sk_type != SOCK_STREAM) {
366 err = -EINVAL;
367 goto done;
368 }
369
1da177e4
LT		 370 write_lock_bh(&rfcomm_sk_list.lock);
371
372 if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
373 err = -EADDRINUSE;
374 } else {
375 /* Save source address */
376 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
377 rfcomm_pi(sk)->channel = sa->rc_channel;
378 sk->sk_state = BT_BOUND;
379 }
380
381 write_unlock_bh(&rfcomm_sk_list.lock);
382
383done:
384 release_sock(sk);
385 return err;
386}
387
388static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
389{
390 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
391 struct sock *sk = sock->sk;
392 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
393 int err = 0;
394
395 BT_DBG("sk %p", sk);
396
397 if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
398 return -EINVAL;
399
354d28d5 400 lock_sock(sk);
1da177e4 401
354d28d5
MH		 402 if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
403 err = -EBADFD;
404 goto done;
405 }
1da177e4 406
354d28d5
MH		 407 if (sk->sk_type != SOCK_STREAM) {
408 err = -EINVAL;
409 goto done;
410 }
1da177e4
LT		 411
412 sk->sk_state = BT_CONNECT;
413 bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
414 rfcomm_pi(sk)->channel = sa->rc_channel;
415
9f2c8a03
MH		 416 d->sec_level = rfcomm_pi(sk)->sec_level;
417 d->role_switch = rfcomm_pi(sk)->role_switch;
77db1980 418
1da177e4
LT		 419 err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
420 if (!err)
421 err = bt_sock_wait_state(sk, BT_CONNECTED,
422 sock_sndtimeo(sk, flags & O_NONBLOCK));
423
354d28d5 424done:
1da177e4
LT		 425 release_sock(sk);
426 return err;
427}
428
429static int rfcomm_sock_listen(struct socket *sock, int backlog)
430{
431 struct sock *sk = sock->sk;
432 int err = 0;
433
434 BT_DBG("sk %p backlog %d", sk, backlog);
435
436 lock_sock(sk);
437
438 if (sk->sk_state != BT_BOUND) {
439 err = -EBADFD;
440 goto done;
441 }
442
354d28d5
MH		 443 if (sk->sk_type != SOCK_STREAM) {
444 err = -EINVAL;
445 goto done;
446 }
447
1da177e4
LT		 448 if (!rfcomm_pi(sk)->channel) {
449 bdaddr_t *src = &bt_sk(sk)->src;
450 u8 channel;
451
452 err = -EINVAL;
453
454 write_lock_bh(&rfcomm_sk_list.lock);
455
456 for (channel = 1; channel < 31; channel++)
457 if (!__rfcomm_get_sock_by_addr(channel, src)) {
458 rfcomm_pi(sk)->channel = channel;
459 err = 0;
460 break;
461 }
462
463 write_unlock_bh(&rfcomm_sk_list.lock);
464
465 if (err < 0)
466 goto done;
467 }
468
469 sk->sk_max_ack_backlog = backlog;
470 sk->sk_ack_backlog = 0;
471 sk->sk_state = BT_LISTEN;
472
473done:
474 release_sock(sk);
475 return err;
476}
477
478static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
479{
480 DECLARE_WAITQUEUE(wait, current);
481 struct sock *sk = sock->sk, *nsk;
482 long timeo;
483 int err = 0;
484
485 lock_sock(sk);
486
487 if (sk->sk_state != BT_LISTEN) {
488 err = -EBADFD;
489 goto done;
490 }
491
354d28d5
MH		 492 if (sk->sk_type != SOCK_STREAM) {
493 err = -EINVAL;
494 goto done;
495 }
496
1da177e4
LT		 497 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
498
499 BT_DBG("sk %p timeo %ld", sk, timeo);
500
501 /* Wait for an incoming connection. (wake-one). */
502 add_wait_queue_exclusive(sk->sk_sleep, &wait);
503 while (!(nsk = bt_accept_dequeue(sk, newsock))) {
504 set_current_state(TASK_INTERRUPTIBLE);
505 if (!timeo) {
506 err = -EAGAIN;
507 break;
508 }
509
510 release_sock(sk);
511 timeo = schedule_timeout(timeo);
512 lock_sock(sk);
513
514 if (sk->sk_state != BT_LISTEN) {
515 err = -EBADFD;
516 break;
517 }
518
519 if (signal_pending(current)) {
520 err = sock_intr_errno(timeo);
521 break;
522 }
523 }
524 set_current_state(TASK_RUNNING);
525 remove_wait_queue(sk->sk_sleep, &wait);
526
527 if (err)
528 goto done;
529
530 newsock->state = SS_CONNECTED;
531
532 BT_DBG("new socket %p", nsk);
533
534done:
535 release_sock(sk);
536 return err;
537}
538
539static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
540{
541 struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
542 struct sock *sk = sock->sk;
543
544 BT_DBG("sock %p, sk %p", sock, sk);
545
546 sa->rc_family = AF_BLUETOOTH;
547 sa->rc_channel = rfcomm_pi(sk)->channel;
548 if (peer)
549 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
550 else
551 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
552
553 *len = sizeof(struct sockaddr_rc);
554 return 0;
555}
556
557static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
558 struct msghdr *msg, size_t len)
559{
560 struct sock *sk = sock->sk;
561 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
562 struct sk_buff *skb;
1da177e4
LT		 563 int sent = 0;
564
bb23c0ab
MH		 565 if (test_bit(RFCOMM_DEFER_SETUP, &d->flags))
566 return -ENOTCONN;
567
1da177e4
LT		 568 if (msg->msg_flags & MSG_OOB)
569 return -EOPNOTSUPP;
570
571 if (sk->sk_shutdown & SEND_SHUTDOWN)
572 return -EPIPE;
573
574 BT_DBG("sock %p, sk %p", sock, sk);
575
576 lock_sock(sk);
577
578 while (len) {
579 size_t size = min_t(size_t, len, d->mtu);
4d6a2188 580 int err;
8e87d142 581
1da177e4
LT		 582 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
583 msg->msg_flags & MSG_DONTWAIT, &err);
91aa35a5
VS		 584 if (!skb) {
585 if (sent == 0)
586 sent = err;
1da177e4 587 break;
91aa35a5 588 }
1da177e4
LT		 589 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
590
591 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
592 if (err) {
593 kfree_skb(skb);
4d6a2188
MH		 594 if (sent == 0)
595 sent = err;
1da177e4
LT		 596 break;
597 }
598
599 err = rfcomm_dlc_send(d, skb);
600 if (err < 0) {
601 kfree_skb(skb);
4d6a2188
MH		 602 if (sent == 0)
603 sent = err;
1da177e4
LT		 604 break;
605 }
606
607 sent += size;
608 len -= size;
609 }
610
611 release_sock(sk);
612
4d6a2188 613 return sent;
1da177e4
LT		 614}
615
616static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
617{
618 DECLARE_WAITQUEUE(wait, current);
619
620 add_wait_queue(sk->sk_sleep, &wait);
621 for (;;) {
622 set_current_state(TASK_INTERRUPTIBLE);
623
b03efcfb
DM		 624 if (!skb_queue_empty(&sk->sk_receive_queue) ||
625 sk->sk_err ||
626 (sk->sk_shutdown & RCV_SHUTDOWN) ||
627 signal_pending(current) ||
628 !timeo)
1da177e4
LT		 629 break;
630
631 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
632 release_sock(sk);
633 timeo = schedule_timeout(timeo);
634 lock_sock(sk);
635 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
636 }
637
638 __set_current_state(TASK_RUNNING);
639 remove_wait_queue(sk->sk_sleep, &wait);
640 return timeo;
641}
642
643static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
644 struct msghdr *msg, size_t size, int flags)
645{
646 struct sock *sk = sock->sk;
bb23c0ab 647 struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
1da177e4
LT		 648 int err = 0;
649 size_t target, copied = 0;
650 long timeo;
651
bb23c0ab
MH		 652 if (test_and_clear_bit(RFCOMM_DEFER_SETUP, &d->flags)) {
653 rfcomm_dlc_accept(d);
654 return 0;
655 }
656
1da177e4
LT		 657 if (flags & MSG_OOB)
658 return -EOPNOTSUPP;
659
660 msg->msg_namelen = 0;
661
a418b893 662 BT_DBG("sk %p size %zu", sk, size);
1da177e4
LT		 663
664 lock_sock(sk);
665
666 target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
667 timeo = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
668
669 do {
670 struct sk_buff *skb;
671 int chunk;
672
673 skb = skb_dequeue(&sk->sk_receive_queue);
674 if (!skb) {
675 if (copied >= target)
676 break;
677
678 if ((err = sock_error(sk)) != 0)
679 break;
680 if (sk->sk_shutdown & RCV_SHUTDOWN)
681 break;
682
683 err = -EAGAIN;
684 if (!timeo)
685 break;
686
687 timeo = rfcomm_sock_data_wait(sk, timeo);
688
689 if (signal_pending(current)) {
690 err = sock_intr_errno(timeo);
691 goto out;
692 }
693 continue;
694 }
695
696 chunk = min_t(unsigned int, skb->len, size);
697 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
698 skb_queue_head(&sk->sk_receive_queue, skb);
699 if (!copied)
700 copied = -EFAULT;
701 break;
702 }
703 copied += chunk;
704 size -= chunk;
705
3241ad82
MH		 706 sock_recv_timestamp(msg, sk, skb);
707
1da177e4
LT		 708 if (!(flags & MSG_PEEK)) {
709 atomic_sub(chunk, &sk->sk_rmem_alloc);
710
711 skb_pull(skb, chunk);
712 if (skb->len) {
713 skb_queue_head(&sk->sk_receive_queue, skb);
714 break;
715 }
716 kfree_skb(skb);
717
718 } else {
719 /* put message back and return */
720 skb_queue_head(&sk->sk_receive_queue, skb);
721 break;
722 }
723 } while (size);
724
725out:
726 if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
727 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
728
729 release_sock(sk);
730 return copied ? : err;
731}
732
d58daf42 733static int rfcomm_sock_setsockopt_old(struct socket *sock, int optname, char __user *optval, int optlen)
1da177e4
LT		 734{
735 struct sock *sk = sock->sk;
736 int err = 0;
737 u32 opt;
738
739 BT_DBG("sk %p", sk);
740
741 lock_sock(sk);
742
743 switch (optname) {
744 case RFCOMM_LM:
745 if (get_user(opt, (u32 __user *) optval)) {
746 err = -EFAULT;
747 break;
748 }
749
9f2c8a03
MH		 750 if (opt & RFCOMM_LM_AUTH)
751 rfcomm_pi(sk)->sec_level = BT_SECURITY_LOW;
752 if (opt & RFCOMM_LM_ENCRYPT)
753 rfcomm_pi(sk)->sec_level = BT_SECURITY_MEDIUM;
754 if (opt & RFCOMM_LM_SECURE)
755 rfcomm_pi(sk)->sec_level = BT_SECURITY_HIGH;
756
757 rfcomm_pi(sk)->role_switch = (opt & RFCOMM_LM_MASTER);
1da177e4
LT		 758 break;
759
760 default:
761 err = -ENOPROTOOPT;
762 break;
763 }
764
765 release_sock(sk);
766 return err;
767}
768
d58daf42
MH		 769static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
770{
771 struct sock *sk = sock->sk;
9f2c8a03
MH		 772 struct bt_security sec;
773 int len, err = 0;
bb23c0ab 774 u32 opt;
d58daf42
MH		 775
776 BT_DBG("sk %p", sk);
777
778 if (level == SOL_RFCOMM)
779 return rfcomm_sock_setsockopt_old(sock, optname, optval, optlen);
780
781 lock_sock(sk);
782
783 switch (optname) {
9f2c8a03
MH		 784 case BT_SECURITY:
785 sec.level = BT_SECURITY_LOW;
786
787 len = min_t(unsigned int, sizeof(sec), optlen);
788 if (copy_from_user((char *) &sec, optval, len)) {
789 err = -EFAULT;
790 break;
791 }
792
793 if (sec.level > BT_SECURITY_HIGH) {
794 err = -EINVAL;
795 break;
796 }
797
798 rfcomm_pi(sk)->sec_level = sec.level;
799 break;
800
bb23c0ab
MH		 801 case BT_DEFER_SETUP:
802 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
803 err = -EINVAL;
804 break;
805 }
806
807 if (get_user(opt, (u32 __user *) optval)) {
808 err = -EFAULT;
809 break;
810 }
811
812 bt_sk(sk)->defer_setup = opt;
813 break;
814
d58daf42
MH		 815 default:
816 err = -ENOPROTOOPT;
817 break;
818 }
819
820 release_sock(sk);
821 return err;
822}
823
824static int rfcomm_sock_getsockopt_old(struct socket *sock, int optname, char __user *optval, int __user *optlen)
1da177e4
LT		 825{
826 struct sock *sk = sock->sk;
827 struct sock *l2cap_sk;
828 struct rfcomm_conninfo cinfo;
829 int len, err = 0;
9f2c8a03 830 u32 opt;
1da177e4
LT		 831
832 BT_DBG("sk %p", sk);
833
834 if (get_user(len, optlen))
835 return -EFAULT;
836
837 lock_sock(sk);
838
839 switch (optname) {
840 case RFCOMM_LM:
9f2c8a03
MH		 841 switch (rfcomm_pi(sk)->sec_level) {
842 case BT_SECURITY_LOW:
843 opt = RFCOMM_LM_AUTH;
844 break;
845 case BT_SECURITY_MEDIUM:
846 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT;
847 break;
848 case BT_SECURITY_HIGH:
849 opt = RFCOMM_LM_AUTH | RFCOMM_LM_ENCRYPT |
850 RFCOMM_LM_SECURE;
851 break;
852 default:
853 opt = 0;
854 break;
855 }
856
857 if (rfcomm_pi(sk)->role_switch)
858 opt |= RFCOMM_LM_MASTER;
859
860 if (put_user(opt, (u32 __user *) optval))
1da177e4
LT		 861 err = -EFAULT;
862 break;
863
864 case RFCOMM_CONNINFO:
bb23c0ab
MH		 865 if (sk->sk_state != BT_CONNECTED &&
866 !rfcomm_pi(sk)->dlc->defer_setup) {
1da177e4
LT		 867 err = -ENOTCONN;
868 break;
869 }
870
871 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
872
873 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
874 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
875
876 len = min_t(unsigned int, len, sizeof(cinfo));
877 if (copy_to_user(optval, (char *) &cinfo, len))
878 err = -EFAULT;
879
880 break;
881
882 default:
883 err = -ENOPROTOOPT;
884 break;
885 }
886
887 release_sock(sk);
d58daf42
MH		 888 return err;
889}
890
891static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
892{
893 struct sock *sk = sock->sk;
9f2c8a03 894 struct bt_security sec;
d58daf42
MH		 895 int len, err = 0;
896
897 BT_DBG("sk %p", sk);
898
899 if (level == SOL_RFCOMM)
900 return rfcomm_sock_getsockopt_old(sock, optname, optval, optlen);
901
902 if (get_user(len, optlen))
903 return -EFAULT;
904
905 lock_sock(sk);
906
907 switch (optname) {
9f2c8a03
MH		 908 case BT_SECURITY:
909 sec.level = rfcomm_pi(sk)->sec_level;
910
911 len = min_t(unsigned int, len, sizeof(sec));
912 if (copy_to_user(optval, (char *) &sec, len))
913 err = -EFAULT;
914
915 break;
916
bb23c0ab
MH		 917 case BT_DEFER_SETUP:
918 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
919 err = -EINVAL;
920 break;
921 }
922
923 if (put_user(bt_sk(sk)->defer_setup, (u32 __user *) optval))
924 err = -EFAULT;
925
926 break;
927
d58daf42
MH		 928 default:
929 err = -ENOPROTOOPT;
930 break;
931 }
932
933 release_sock(sk);
1da177e4
LT		 934 return err;
935}
936
937static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
938{
e19caae7 939 struct sock *sk __maybe_unused = sock->sk;
1da177e4
LT		 940 int err;
941
e19caae7 942 BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
1da177e4 943
3241ad82 944 err = bt_sock_ioctl(sock, cmd, arg);
1da177e4 945
3241ad82 946 if (err == -ENOIOCTLCMD) {
1da177e4 947#ifdef CONFIG_BT_RFCOMM_TTY
3241ad82
MH		 948 lock_sock(sk);
949 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
950 release_sock(sk);
1da177e4 951#else
3241ad82 952 err = -EOPNOTSUPP;
1da177e4 953#endif
3241ad82 954 }
1da177e4 955
1da177e4
LT		 956 return err;
957}
958
959static int rfcomm_sock_shutdown(struct socket *sock, int how)
960{
961 struct sock *sk = sock->sk;
962 int err = 0;
963
964 BT_DBG("sock %p, sk %p", sock, sk);
965
966 if (!sk) return 0;
967
968 lock_sock(sk);
969 if (!sk->sk_shutdown) {
970 sk->sk_shutdown = SHUTDOWN_MASK;
971 __rfcomm_sock_close(sk);
972
973 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
974 err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
975 }
976 release_sock(sk);
977 return err;
978}
979
980static int rfcomm_sock_release(struct socket *sock)
981{
982 struct sock *sk = sock->sk;
983 int err;
984
985 BT_DBG("sock %p, sk %p", sock, sk);
986
987 if (!sk)
988 return 0;
989
990 err = rfcomm_sock_shutdown(sock, 2);
991
992 sock_orphan(sk);
993 rfcomm_sock_kill(sk);
994 return err;
995}
996
8e87d142 997/* ---- RFCOMM core layer callbacks ----
1da177e4
LT		 998 *
999 * called under rfcomm_lock()
1000 */
1001int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
1002{
1003 struct sock *sk, *parent;
1004 bdaddr_t src, dst;
1005 int result = 0;
1006
1007 BT_DBG("session %p channel %d", s, channel);
1008
1009 rfcomm_session_getaddr(s, &src, &dst);
1010
1011 /* Check if we have socket listening on channel */
1012 parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
1013 if (!parent)
1014 return 0;
1015
1016 /* Check for backlog size */
1017 if (sk_acceptq_is_full(parent)) {
8e87d142 1018 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1da177e4
LT		 1019 goto done;
1020 }
1021
3b1e0a65 1022 sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
1da177e4
LT		 1023 if (!sk)
1024 goto done;
1025
1026 rfcomm_sock_init(sk, parent);
1027 bacpy(&bt_sk(sk)->src, &src);
1028 bacpy(&bt_sk(sk)->dst, &dst);
1029 rfcomm_pi(sk)->channel = channel;
1030
1031 sk->sk_state = BT_CONFIG;
1032 bt_accept_enqueue(parent, sk);
1033
1034 /* Accept connection and return socket DLC */
1035 *d = rfcomm_pi(sk)->dlc;
1036 result = 1;
1037
1038done:
1039 bh_unlock_sock(parent);
bb23c0ab
MH		 1040
1041 if (bt_sk(parent)->defer_setup)
1042 parent->sk_state_change(parent);
1043
1da177e4
LT		 1044 return result;
1045}
1046
be9d1227 1047static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
1da177e4
LT		 1048{
1049 struct sock *sk;
1050 struct hlist_node *node;
be9d1227 1051 char *str = buf;
1da177e4
LT		 1052
1053 read_lock_bh(&rfcomm_sk_list.lock);
1054
be9d1227
MH		 1055 sk_for_each(sk, node, &rfcomm_sk_list.head) {
1056 str += sprintf(str, "%s %s %d %d\n",
1057 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
1058 sk->sk_state, rfcomm_pi(sk)->channel);
1059 }
1da177e4 1060
1da177e4 1061 read_unlock_bh(&rfcomm_sk_list.lock);
1da177e4 1062
be9d1227 1063 return (str - buf);
1da177e4
LT		 1064}
1065
be9d1227 1066static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
1da177e4 1067
90ddc4f0 1068static const struct proto_ops rfcomm_sock_ops = {
1da177e4
LT		 1069 .family = PF_BLUETOOTH,
1070 .owner = THIS_MODULE,
1071 .release = rfcomm_sock_release,
1072 .bind = rfcomm_sock_bind,
1073 .connect = rfcomm_sock_connect,
1074 .listen = rfcomm_sock_listen,
1075 .accept = rfcomm_sock_accept,
1076 .getname = rfcomm_sock_getname,
1077 .sendmsg = rfcomm_sock_sendmsg,
1078 .recvmsg = rfcomm_sock_recvmsg,
1079 .shutdown = rfcomm_sock_shutdown,
1080 .setsockopt = rfcomm_sock_setsockopt,
1081 .getsockopt = rfcomm_sock_getsockopt,
1082 .ioctl = rfcomm_sock_ioctl,
1083 .poll = bt_sock_poll,
1084 .socketpair = sock_no_socketpair,
1085 .mmap = sock_no_mmap
1086};
1087
1088static struct net_proto_family rfcomm_sock_family_ops = {
1089 .family = PF_BLUETOOTH,
1090 .owner = THIS_MODULE,
1091 .create = rfcomm_sock_create
1092};
1093
be9d1227 1094int __init rfcomm_init_sockets(void)
1da177e4
LT		 1095{
1096 int err;
1097
1098 err = proto_register(&rfcomm_proto, 0);
1099 if (err < 0)
1100 return err;
1101
1102 err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
1103 if (err < 0)
1104 goto error;
1105
df5c37ea
MH		 1106 if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
1107 BT_ERR("Failed to create RFCOMM info file");
1da177e4
LT		 1108
1109 BT_INFO("RFCOMM socket layer initialized");
1110
1111 return 0;
1112
1113error:
1114 BT_ERR("RFCOMM socket layer registration failed");
1115 proto_unregister(&rfcomm_proto);
1116 return err;
1117}
1118
1119void __exit rfcomm_cleanup_sockets(void)
1120{
a91f2e39 1121 class_remove_file(bt_class, &class_attr_rfcomm);
1da177e4
LT		 1122
1123 if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
1124 BT_ERR("RFCOMM socket layer unregistration failed");
1125
1126 proto_unregister(&rfcomm_proto);
1127}
kernel source for telekom puls (alcatel/mediatek)