net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  *
  27  * $Id: sock.c,v 1.24 2002/10/03 01:00:34 maxk Exp $
  28  */
  29
  30 #include <linux/module.h>
  31
  32 #include <linux/types.h>
  33 #include <linux/errno.h>
  34 #include <linux/kernel.h>
  35 #include <linux/sched.h>
  36 #include <linux/slab.h>
  37 #include <linux/poll.h>
  38 #include <linux/fcntl.h>
  39 #include <linux/init.h>
  40 #include <linux/interrupt.h>
  41 #include <linux/socket.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/list.h>
  44 #include <linux/device.h>
  45 #include <net/sock.h>
  46
  47 #include <asm/system.h>
  48 #include <asm/uaccess.h>
  49
  50 #include <net/bluetooth/bluetooth.h>
  51 #include <net/bluetooth/hci_core.h>
  52 #include <net/bluetooth/l2cap.h>
  53 #include <net/bluetooth/rfcomm.h>
  54
  55 #ifndef CONFIG_BT_RFCOMM_DEBUG
  56 #undef  BT_DBG
  57 #define BT_DBG(D...)
  58 #endif
  59
  60 static const struct proto_ops rfcomm_sock_ops;
  61
  62 static struct bt_sock_list rfcomm_sk_list = {
  63         .lock = __RW_LOCK_UNLOCKED(rfcomm_sk_list.lock)
  64 };
  65
  66 static void rfcomm_sock_close(struct sock *sk);
  67 static void rfcomm_sock_kill(struct sock *sk);
  68
  69 /* ---- DLC callbacks ----
  70  *
  71  * called under rfcomm_dlc_lock()
  72  */
  73 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  74 {
  75         struct sock *sk = d->owner;
  76         if (!sk)
  77                 return;
  78
  79         atomic_add(skb->len, &sk->sk_rmem_alloc);
  80         skb_queue_tail(&sk->sk_receive_queue, skb);
  81         sk->sk_data_ready(sk, skb->len);
  82
  83         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  84                 rfcomm_dlc_throttle(d);
  85 }
  86
  87 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  88 {
  89         struct sock *sk = d->owner, *parent;
  90         if (!sk)
  91                 return;
  92
  93         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  94
  95         bh_lock_sock(sk);
  96
  97         if (err)
  98                 sk->sk_err = err;
  99
 100         sk->sk_state = d->state;
 101
 102         parent = bt_sk(sk)->parent;
 103         if (parent) {
 104                 if (d->state == BT_CLOSED) {
 105                         sock_set_flag(sk, SOCK_ZAPPED);
 106                         bt_accept_unlink(sk);
 107                 }
 108                 parent->sk_data_ready(parent, 0);
 109         } else {
 110                 if (d->state == BT_CONNECTED)
 111                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
 112                 sk->sk_state_change(sk);
 113         }
 114
 115         bh_unlock_sock(sk);
 116
 117         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
 118                 /* We have to drop DLC lock here, otherwise
 119                  * rfcomm_sock_destruct() will dead lock. */
 120                 rfcomm_dlc_unlock(d);
 121                 rfcomm_sock_kill(sk);
 122                 rfcomm_dlc_lock(d);
 123         }
 124 }
 125
 126 /* ---- Socket functions ---- */
 127 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 128 {
 129         struct sock *sk = NULL;
 130         struct hlist_node *node;
 131
 132         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 133                 if (rfcomm_pi(sk)->channel == channel &&
 134                                 !bacmp(&bt_sk(sk)->src, src))
 135                         break;
 136         }
 137
 138         return node ? sk : NULL;
 139 }
 140
 141 /* Find socket with channel and source bdaddr.
 142  * Returns closest match.
 143  */
 144 static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 145 {
 146         struct sock *sk = NULL, *sk1 = NULL;
 147         struct hlist_node *node;
 148
 149         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 150                 if (state && sk->sk_state != state)
 151                         continue;
 152
 153                 if (rfcomm_pi(sk)->channel == channel) {
 154                         /* Exact match. */
 155                         if (!bacmp(&bt_sk(sk)->src, src))
 156                                 break;
 157
 158                         /* Closest match */
 159                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 160                                 sk1 = sk;
 161                 }
 162         }
 163         return node ? sk : sk1;
 164 }
 165
 166 /* Find socket with given address (channel, src).
 167  * Returns locked socket */
 168 static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 169 {
 170         struct sock *s;
 171         read_lock(&rfcomm_sk_list.lock);
 172         s = __rfcomm_get_sock_by_channel(state, channel, src);
 173         if (s) bh_lock_sock(s);
 174         read_unlock(&rfcomm_sk_list.lock);
 175         return s;
 176 }
 177
 178 static void rfcomm_sock_destruct(struct sock *sk)
 179 {
 180         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 181
 182         BT_DBG("sk %p dlc %p", sk, d);
 183
 184         skb_queue_purge(&sk->sk_receive_queue);
 185         skb_queue_purge(&sk->sk_write_queue);
 186
 187         rfcomm_dlc_lock(d);
 188         rfcomm_pi(sk)->dlc = NULL;
 189
 190         /* Detach DLC if it's owned by this socket */
 191         if (d->owner == sk)
 192                 d->owner = NULL;
 193         rfcomm_dlc_unlock(d);
 194
 195         rfcomm_dlc_put(d);
 196 }
 197
 198 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 199 {
 200         struct sock *sk;
 201
 202         BT_DBG("parent %p", parent);
 203
 204         /* Close not yet accepted dlcs */
 205         while ((sk = bt_accept_dequeue(parent, NULL))) {
 206                 rfcomm_sock_close(sk);
 207                 rfcomm_sock_kill(sk);
 208         }
 209
 210         parent->sk_state  = BT_CLOSED;
 211         sock_set_flag(parent, SOCK_ZAPPED);
 212 }
 213
 214 /* Kill socket (only if zapped and orphan)
 215  * Must be called on unlocked socket.
 216  */
 217 static void rfcomm_sock_kill(struct sock *sk)
 218 {
 219         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 220                 return;
 221
 222         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 223
 224         /* Kill poor orphan */
 225         bt_sock_unlink(&rfcomm_sk_list, sk);
 226         sock_set_flag(sk, SOCK_DEAD);
 227         sock_put(sk);
 228 }
 229
 230 static void __rfcomm_sock_close(struct sock *sk)
 231 {
 232         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 233
 234         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 235
 236         switch (sk->sk_state) {
 237         case BT_LISTEN:
 238                 rfcomm_sock_cleanup_listen(sk);
 239                 break;
 240
 241         case BT_CONNECT:
 242         case BT_CONNECT2:
 243         case BT_CONFIG:
 244         case BT_CONNECTED:
 245                 rfcomm_dlc_close(d, 0);
 246
 247         default:
 248                 sock_set_flag(sk, SOCK_ZAPPED);
 249                 break;
 250         }
 251 }
 252
 253 /* Close socket.
 254  * Must be called on unlocked socket.
 255  */
 256 static void rfcomm_sock_close(struct sock *sk)
 257 {
 258         lock_sock(sk);
 259         __rfcomm_sock_close(sk);
 260         release_sock(sk);
 261 }
 262
 263 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 264 {
 265         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 266
 267         BT_DBG("sk %p", sk);
 268
 269         if (parent) {
 270                 sk->sk_type = parent->sk_type;
 271                 pi->link_mode = rfcomm_pi(parent)->link_mode;
 272         } else {
 273                 pi->link_mode = 0;
 274         }
 275
 276         pi->dlc->link_mode = pi->link_mode;
 277 }
 278
 279 static struct proto rfcomm_proto = {
 280         .name           = "RFCOMM",
 281         .owner          = THIS_MODULE,
 282         .obj_size       = sizeof(struct rfcomm_pinfo)
 283 };
 284
 285 static struct sock *rfcomm_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio)
 286 {
 287         struct rfcomm_dlc *d;
 288         struct sock *sk;
 289
 290         sk = sk_alloc(net, PF_BLUETOOTH, prio, &rfcomm_proto);
 291         if (!sk)
 292                 return NULL;
 293
 294         sock_init_data(sock, sk);
 295         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 296
 297         d = rfcomm_dlc_alloc(prio);
 298         if (!d) {
 299                 sk_free(sk);
 300                 return NULL;
 301         }
 302
 303         d->data_ready   = rfcomm_sk_data_ready;
 304         d->state_change = rfcomm_sk_state_change;
 305
 306         rfcomm_pi(sk)->dlc = d;
 307         d->owner = sk;
 308
 309         sk->sk_destruct = rfcomm_sock_destruct;
 310         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 311
 312         sk->sk_sndbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 313         sk->sk_rcvbuf = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 314
 315         sock_reset_flag(sk, SOCK_ZAPPED);
 316
 317         sk->sk_protocol = proto;
 318         sk->sk_state    = BT_OPEN;
 319
 320         bt_sock_link(&rfcomm_sk_list, sk);
 321
 322         BT_DBG("sk %p", sk);
 323         return sk;
 324 }
 325
 326 static int rfcomm_sock_create(struct net *net, struct socket *sock, int protocol)
 327 {
 328         struct sock *sk;
 329
 330         BT_DBG("sock %p", sock);
 331
 332         sock->state = SS_UNCONNECTED;
 333
 334         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 335                 return -ESOCKTNOSUPPORT;
 336
 337         sock->ops = &rfcomm_sock_ops;
 338
 339         sk = rfcomm_sock_alloc(net, sock, protocol, GFP_ATOMIC);
 340         if (!sk)
 341                 return -ENOMEM;
 342
 343         rfcomm_sock_init(sk, NULL);
 344         return 0;
 345 }
 346
 347 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 348 {
 349         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 350         struct sock *sk = sock->sk;
 351         int err = 0;
 352
 353         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
 354
 355         if (!addr || addr->sa_family != AF_BLUETOOTH)
 356                 return -EINVAL;
 357
 358         lock_sock(sk);
 359
 360         if (sk->sk_state != BT_OPEN) {
 361                 err = -EBADFD;
 362                 goto done;
 363         }
 364
 365         if (sk->sk_type != SOCK_STREAM) {
 366                 err = -EINVAL;
 367                 goto done;
 368         }
 369
 370         write_lock_bh(&rfcomm_sk_list.lock);
 371
 372         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 373                 err = -EADDRINUSE;
 374         } else {
 375                 /* Save source address */
 376                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 377                 rfcomm_pi(sk)->channel = sa->rc_channel;
 378                 sk->sk_state = BT_BOUND;
 379         }
 380
 381         write_unlock_bh(&rfcomm_sk_list.lock);
 382
 383 done:
 384         release_sock(sk);
 385         return err;
 386 }
 387
 388 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 389 {
 390         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 391         struct sock *sk = sock->sk;
 392         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 393         int err = 0;
 394
 395         BT_DBG("sk %p", sk);
 396
 397         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
 398                 return -EINVAL;
 399
 400         lock_sock(sk);
 401
 402         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 403                 err = -EBADFD;
 404                 goto done;
 405         }
 406
 407         if (sk->sk_type != SOCK_STREAM) {
 408                 err = -EINVAL;
 409                 goto done;
 410         }
 411
 412         sk->sk_state = BT_CONNECT;
 413         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 414         rfcomm_pi(sk)->channel = sa->rc_channel;
 415
 416         d->link_mode = rfcomm_pi(sk)->link_mode;
 417
 418         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 419         if (!err)
 420                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 421                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 422
 423 done:
 424         release_sock(sk);
 425         return err;
 426 }
 427
 428 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 429 {
 430         struct sock *sk = sock->sk;
 431         int err = 0;
 432
 433         BT_DBG("sk %p backlog %d", sk, backlog);
 434
 435         lock_sock(sk);
 436
 437         if (sk->sk_state != BT_BOUND) {
 438                 err = -EBADFD;
 439                 goto done;
 440         }
 441
 442         if (sk->sk_type != SOCK_STREAM) {
 443                 err = -EINVAL;
 444                 goto done;
 445         }
 446
 447         if (!rfcomm_pi(sk)->channel) {
 448                 bdaddr_t *src = &bt_sk(sk)->src;
 449                 u8 channel;
 450
 451                 err = -EINVAL;
 452
 453                 write_lock_bh(&rfcomm_sk_list.lock);
 454
 455                 for (channel = 1; channel < 31; channel++)
 456                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 457                                 rfcomm_pi(sk)->channel = channel;
 458                                 err = 0;
 459                                 break;
 460                         }
 461
 462                 write_unlock_bh(&rfcomm_sk_list.lock);
 463
 464                 if (err < 0)
 465                         goto done;
 466         }
 467
 468         sk->sk_max_ack_backlog = backlog;
 469         sk->sk_ack_backlog = 0;
 470         sk->sk_state = BT_LISTEN;
 471
 472 done:
 473         release_sock(sk);
 474         return err;
 475 }
 476
 477 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 478 {
 479         DECLARE_WAITQUEUE(wait, current);
 480         struct sock *sk = sock->sk, *nsk;
 481         long timeo;
 482         int err = 0;
 483
 484         lock_sock(sk);
 485
 486         if (sk->sk_state != BT_LISTEN) {
 487                 err = -EBADFD;
 488                 goto done;
 489         }
 490
 491         if (sk->sk_type != SOCK_STREAM) {
 492                 err = -EINVAL;
 493                 goto done;
 494         }
 495
 496         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 497
 498         BT_DBG("sk %p timeo %ld", sk, timeo);
 499
 500         /* Wait for an incoming connection. (wake-one). */
 501         add_wait_queue_exclusive(sk->sk_sleep, &wait);
 502         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 503                 set_current_state(TASK_INTERRUPTIBLE);
 504                 if (!timeo) {
 505                         err = -EAGAIN;
 506                         break;
 507                 }
 508
 509                 release_sock(sk);
 510                 timeo = schedule_timeout(timeo);
 511                 lock_sock(sk);
 512
 513                 if (sk->sk_state != BT_LISTEN) {
 514                         err = -EBADFD;
 515                         break;
 516                 }
 517
 518                 if (signal_pending(current)) {
 519                         err = sock_intr_errno(timeo);
 520                         break;
 521                 }
 522         }
 523         set_current_state(TASK_RUNNING);
 524         remove_wait_queue(sk->sk_sleep, &wait);
 525
 526         if (err)
 527                 goto done;
 528
 529         newsock->state = SS_CONNECTED;
 530
 531         BT_DBG("new socket %p", nsk);
 532
 533 done:
 534         release_sock(sk);
 535         return err;
 536 }
 537
 538 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 539 {
 540         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 541         struct sock *sk = sock->sk;
 542
 543         BT_DBG("sock %p, sk %p", sock, sk);
 544
 545         sa->rc_family  = AF_BLUETOOTH;
 546         sa->rc_channel = rfcomm_pi(sk)->channel;
 547         if (peer)
 548                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 549         else
 550                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 551
 552         *len = sizeof(struct sockaddr_rc);
 553         return 0;
 554 }
 555
 556 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 557                                struct msghdr *msg, size_t len)
 558 {
 559         struct sock *sk = sock->sk;
 560         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 561         struct sk_buff *skb;
 562         int sent = 0;
 563
 564         if (msg->msg_flags & MSG_OOB)
 565                 return -EOPNOTSUPP;
 566
 567         if (sk->sk_shutdown & SEND_SHUTDOWN)
 568                 return -EPIPE;
 569
 570         BT_DBG("sock %p, sk %p", sock, sk);
 571
 572         lock_sock(sk);
 573
 574         while (len) {
 575                 size_t size = min_t(size_t, len, d->mtu);
 576                 int err;
 577
 578                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 579                                 msg->msg_flags & MSG_DONTWAIT, &err);
 580                 if (!skb)
 581                         break;
 582                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 583
 584                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 585                 if (err) {
 586                         kfree_skb(skb);
 587                         if (sent == 0)
 588                                 sent = err;
 589                         break;
 590                 }
 591
 592                 err = rfcomm_dlc_send(d, skb);
 593                 if (err < 0) {
 594                         kfree_skb(skb);
 595                         if (sent == 0)
 596                                 sent = err;
 597                         break;
 598                 }
 599
 600                 sent += size;
 601                 len  -= size;
 602         }
 603
 604         release_sock(sk);
 605
 606         return sent;
 607 }
 608
 609 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
 610 {
 611         DECLARE_WAITQUEUE(wait, current);
 612
 613         add_wait_queue(sk->sk_sleep, &wait);
 614         for (;;) {
 615                 set_current_state(TASK_INTERRUPTIBLE);
 616
 617                 if (!skb_queue_empty(&sk->sk_receive_queue) ||
 618                     sk->sk_err ||
 619                     (sk->sk_shutdown & RCV_SHUTDOWN) ||
 620                     signal_pending(current) ||
 621                     !timeo)
 622                         break;
 623
 624                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 625                 release_sock(sk);
 626                 timeo = schedule_timeout(timeo);
 627                 lock_sock(sk);
 628                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 629         }
 630
 631         __set_current_state(TASK_RUNNING);
 632         remove_wait_queue(sk->sk_sleep, &wait);
 633         return timeo;
 634 }
 635
 636 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 637                                struct msghdr *msg, size_t size, int flags)
 638 {
 639         struct sock *sk = sock->sk;
 640         int err = 0;
 641         size_t target, copied = 0;
 642         long timeo;
 643
 644         if (flags & MSG_OOB)
 645                 return -EOPNOTSUPP;
 646
 647         msg->msg_namelen = 0;
 648
 649         BT_DBG("sk %p size %d", sk, size);
 650
 651         lock_sock(sk);
 652
 653         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
 654         timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 655
 656         do {
 657                 struct sk_buff *skb;
 658                 int chunk;
 659
 660                 skb = skb_dequeue(&sk->sk_receive_queue);
 661                 if (!skb) {
 662                         if (copied >= target)
 663                                 break;
 664
 665                         if ((err = sock_error(sk)) != 0)
 666                                 break;
 667                         if (sk->sk_shutdown & RCV_SHUTDOWN)
 668                                 break;
 669
 670                         err = -EAGAIN;
 671                         if (!timeo)
 672                                 break;
 673
 674                         timeo = rfcomm_sock_data_wait(sk, timeo);
 675
 676                         if (signal_pending(current)) {
 677                                 err = sock_intr_errno(timeo);
 678                                 goto out;
 679                         }
 680                         continue;
 681                 }
 682
 683                 chunk = min_t(unsigned int, skb->len, size);
 684                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
 685                         skb_queue_head(&sk->sk_receive_queue, skb);
 686                         if (!copied)
 687                                 copied = -EFAULT;
 688                         break;
 689                 }
 690                 copied += chunk;
 691                 size   -= chunk;
 692
 693                 sock_recv_timestamp(msg, sk, skb);
 694
 695                 if (!(flags & MSG_PEEK)) {
 696                         atomic_sub(chunk, &sk->sk_rmem_alloc);
 697
 698                         skb_pull(skb, chunk);
 699                         if (skb->len) {
 700                                 skb_queue_head(&sk->sk_receive_queue, skb);
 701                                 break;
 702                         }
 703                         kfree_skb(skb);
 704
 705                 } else {
 706                         /* put message back and return */
 707                         skb_queue_head(&sk->sk_receive_queue, skb);
 708                         break;
 709                 }
 710         } while (size);
 711
 712 out:
 713         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 714                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 715
 716         release_sock(sk);
 717         return copied ? : err;
 718 }
 719
 720 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 721 {
 722         struct sock *sk = sock->sk;
 723         int err = 0;
 724         u32 opt;
 725
 726         BT_DBG("sk %p", sk);
 727
 728         lock_sock(sk);
 729
 730         switch (optname) {
 731         case RFCOMM_LM:
 732                 if (get_user(opt, (u32 __user *) optval)) {
 733                         err = -EFAULT;
 734                         break;
 735                 }
 736
 737                 rfcomm_pi(sk)->link_mode = opt;
 738                 break;
 739
 740         default:
 741                 err = -ENOPROTOOPT;
 742                 break;
 743         }
 744
 745         release_sock(sk);
 746         return err;
 747 }
 748
 749 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 750 {
 751         struct sock *sk = sock->sk;
 752         struct sock *l2cap_sk;
 753         struct rfcomm_conninfo cinfo;
 754         int len, err = 0;
 755
 756         BT_DBG("sk %p", sk);
 757
 758         if (get_user(len, optlen))
 759                 return -EFAULT;
 760
 761         lock_sock(sk);
 762
 763         switch (optname) {
 764         case RFCOMM_LM:
 765                 if (put_user(rfcomm_pi(sk)->link_mode, (u32 __user *) optval))
 766                         err = -EFAULT;
 767                 break;
 768
 769         case RFCOMM_CONNINFO:
 770                 if (sk->sk_state != BT_CONNECTED) {
 771                         err = -ENOTCONN;
 772                         break;
 773                 }
 774
 775                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 776
 777                 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
 778                 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
 779
 780                 len = min_t(unsigned int, len, sizeof(cinfo));
 781                 if (copy_to_user(optval, (char *) &cinfo, len))
 782                         err = -EFAULT;
 783
 784                 break;
 785
 786         default:
 787                 err = -ENOPROTOOPT;
 788                 break;
 789         }
 790
 791         release_sock(sk);
 792         return err;
 793 }
 794
 795 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 796 {
 797         struct sock *sk = sock->sk;
 798         int err;
 799
 800         BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
 801
 802         err = bt_sock_ioctl(sock, cmd, arg);
 803
 804         if (err == -ENOIOCTLCMD) {
 805 #ifdef CONFIG_BT_RFCOMM_TTY
 806                 lock_sock(sk);
 807                 err = rfcomm_dev_ioctl(sk, cmd, (void __user *) arg);
 808                 release_sock(sk);
 809 #else
 810                 err = -EOPNOTSUPP;
 811 #endif
 812         }
 813
 814         return err;
 815 }
 816
 817 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 818 {
 819         struct sock *sk = sock->sk;
 820         int err = 0;
 821
 822         BT_DBG("sock %p, sk %p", sock, sk);
 823
 824         if (!sk) return 0;
 825
 826         lock_sock(sk);
 827         if (!sk->sk_shutdown) {
 828                 sk->sk_shutdown = SHUTDOWN_MASK;
 829                 __rfcomm_sock_close(sk);
 830
 831                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 832                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 833         }
 834         release_sock(sk);
 835         return err;
 836 }
 837
 838 static int rfcomm_sock_release(struct socket *sock)
 839 {
 840         struct sock *sk = sock->sk;
 841         int err;
 842
 843         BT_DBG("sock %p, sk %p", sock, sk);
 844
 845         if (!sk)
 846                 return 0;
 847
 848         err = rfcomm_sock_shutdown(sock, 2);
 849
 850         sock_orphan(sk);
 851         rfcomm_sock_kill(sk);
 852         return err;
 853 }
 854
 855 /* ---- RFCOMM core layer callbacks ----
 856  *
 857  * called under rfcomm_lock()
 858  */
 859 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 860 {
 861         struct sock *sk, *parent;
 862         bdaddr_t src, dst;
 863         int result = 0;
 864
 865         BT_DBG("session %p channel %d", s, channel);
 866
 867         rfcomm_session_getaddr(s, &src, &dst);
 868
 869         /* Check if we have socket listening on channel */
 870         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 871         if (!parent)
 872                 return 0;
 873
 874         /* Check for backlog size */
 875         if (sk_acceptq_is_full(parent)) {
 876                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 877                 goto done;
 878         }
 879
 880         sk = rfcomm_sock_alloc(sock_net(parent), NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 881         if (!sk)
 882                 goto done;
 883
 884         rfcomm_sock_init(sk, parent);
 885         bacpy(&bt_sk(sk)->src, &src);
 886         bacpy(&bt_sk(sk)->dst, &dst);
 887         rfcomm_pi(sk)->channel = channel;
 888
 889         sk->sk_state = BT_CONFIG;
 890         bt_accept_enqueue(parent, sk);
 891
 892         /* Accept connection and return socket DLC */
 893         *d = rfcomm_pi(sk)->dlc;
 894         result = 1;
 895
 896 done:
 897         bh_unlock_sock(parent);
 898         return result;
 899 }
 900
 901 static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
 902 {
 903         struct sock *sk;
 904         struct hlist_node *node;
 905         char *str = buf;
 906
 907         read_lock_bh(&rfcomm_sk_list.lock);
 908
 909         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 910                 str += sprintf(str, "%s %s %d %d\n",
 911                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
 912                                 sk->sk_state, rfcomm_pi(sk)->channel);
 913         }
 914
 915         read_unlock_bh(&rfcomm_sk_list.lock);
 916
 917         return (str - buf);
 918 }
 919
 920 static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
 921
 922 static const struct proto_ops rfcomm_sock_ops = {
 923         .family         = PF_BLUETOOTH,
 924         .owner          = THIS_MODULE,
 925         .release        = rfcomm_sock_release,
 926         .bind           = rfcomm_sock_bind,
 927         .connect        = rfcomm_sock_connect,
 928         .listen         = rfcomm_sock_listen,
 929         .accept         = rfcomm_sock_accept,
 930         .getname        = rfcomm_sock_getname,
 931         .sendmsg        = rfcomm_sock_sendmsg,
 932         .recvmsg        = rfcomm_sock_recvmsg,
 933         .shutdown       = rfcomm_sock_shutdown,
 934         .setsockopt     = rfcomm_sock_setsockopt,
 935         .getsockopt     = rfcomm_sock_getsockopt,
 936         .ioctl          = rfcomm_sock_ioctl,
 937         .poll           = bt_sock_poll,
 938         .socketpair     = sock_no_socketpair,
 939         .mmap           = sock_no_mmap
 940 };
 941
 942 static struct net_proto_family rfcomm_sock_family_ops = {
 943         .family         = PF_BLUETOOTH,
 944         .owner          = THIS_MODULE,
 945         .create         = rfcomm_sock_create
 946 };
 947
 948 int __init rfcomm_init_sockets(void)
 949 {
 950         int err;
 951
 952         err = proto_register(&rfcomm_proto, 0);
 953         if (err < 0)
 954                 return err;
 955
 956         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
 957         if (err < 0)
 958                 goto error;
 959
 960         if (class_create_file(bt_class, &class_attr_rfcomm) < 0)
 961                 BT_ERR("Failed to create RFCOMM info file");
 962
 963         BT_INFO("RFCOMM socket layer initialized");
 964
 965         return 0;
 966
 967 error:
 968         BT_ERR("RFCOMM socket layer registration failed");
 969         proto_unregister(&rfcomm_proto);
 970         return err;
 971 }
 972
 973 void __exit rfcomm_cleanup_sockets(void)
 974 {
 975         class_remove_file(bt_class, &class_attr_rfcomm);
 976
 977         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
 978                 BT_ERR("RFCOMM socket layer unregistration failed");
 979
 980         proto_unregister(&rfcomm_proto);
 981 }