net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  *
  27  * $Id: sock.c,v 1.24 2002/10/03 01:00:34 maxk Exp $
  28  */
  29
  30 #include <linux/config.h>
  31 #include <linux/module.h>
  32
  33 #include <linux/types.h>
  34 #include <linux/errno.h>
  35 #include <linux/kernel.h>
  36 #include <linux/major.h>
  37 #include <linux/sched.h>
  38 #include <linux/slab.h>
  39 #include <linux/poll.h>
  40 #include <linux/fcntl.h>
  41 #include <linux/init.h>
  42 #include <linux/interrupt.h>
  43 #include <linux/socket.h>
  44 #include <linux/skbuff.h>
  45 #include <linux/list.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/seq_file.h>
  48 #include <net/sock.h>
  49
  50 #include <asm/system.h>
  51 #include <asm/uaccess.h>
  52
  53 #include <net/bluetooth/bluetooth.h>
  54 #include <net/bluetooth/hci_core.h>
  55 #include <net/bluetooth/l2cap.h>
  56 #include <net/bluetooth/rfcomm.h>
  57
  58 #ifndef CONFIG_BT_RFCOMM_DEBUG
  59 #undef  BT_DBG
  60 #define BT_DBG(D...)
  61 #endif
  62
  63 static struct proto_ops rfcomm_sock_ops;
  64
  65 static struct bt_sock_list rfcomm_sk_list = {
  66         .lock = RW_LOCK_UNLOCKED
  67 };
  68
  69 static void rfcomm_sock_close(struct sock *sk);
  70 static void rfcomm_sock_kill(struct sock *sk);
  71
  72 /* ---- DLC callbacks ----
  73  *
  74  * called under rfcomm_dlc_lock()
  75  */
  76 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  77 {
  78         struct sock *sk = d->owner;
  79         if (!sk)
  80                 return;
  81
  82         atomic_add(skb->len, &sk->sk_rmem_alloc);
  83         skb_queue_tail(&sk->sk_receive_queue, skb);
  84         sk->sk_data_ready(sk, skb->len);
  85
  86         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  87                 rfcomm_dlc_throttle(d);
  88 }
  89
  90 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  91 {
  92         struct sock *sk = d->owner, *parent;
  93         if (!sk)
  94                 return;
  95
  96         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  97
  98         bh_lock_sock(sk);
  99
 100         if (err)
 101                 sk->sk_err = err;
 102
 103         sk->sk_state = d->state;
 104
 105         parent = bt_sk(sk)->parent;
 106         if (parent) {
 107                 if (d->state == BT_CLOSED) {
 108                         sk->sk_zapped = 1;
 109                         bt_accept_unlink(sk);
 110                 }
 111                 parent->sk_data_ready(parent, 0);
 112         } else {
 113                 if (d->state == BT_CONNECTED)
 114                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
 115                 sk->sk_state_change(sk);
 116         }
 117
 118         bh_unlock_sock(sk);
 119
 120         if (parent && sk->sk_zapped) {
 121                 /* We have to drop DLC lock here, otherwise
 122                  * rfcomm_sock_destruct() will dead lock. */
 123                 rfcomm_dlc_unlock(d);
 124                 rfcomm_sock_kill(sk);
 125                 rfcomm_dlc_lock(d);
 126         }
 127 }
 128
 129 /* ---- Socket functions ---- */
 130 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 131 {
 132         struct sock *sk = NULL;
 133         struct hlist_node *node;
 134
 135         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 136                 if (rfcomm_pi(sk)->channel == channel &&
 137                                 !bacmp(&bt_sk(sk)->src, src))
 138                         break;
 139         }
 140
 141         return node ? sk : NULL;
 142 }
 143
 144 /* Find socket with channel and source bdaddr.
 145  * Returns closest match.
 146  */
 147 static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 148 {
 149         struct sock *sk = NULL, *sk1 = NULL;
 150         struct hlist_node *node;
 151
 152         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 153                 if (state && sk->sk_state != state)
 154                         continue;
 155
 156                 if (rfcomm_pi(sk)->channel == channel) {
 157                         /* Exact match. */
 158                         if (!bacmp(&bt_sk(sk)->src, src))
 159                                 break;
 160
 161                         /* Closest match */
 162                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 163                                 sk1 = sk;
 164                 }
 165         }
 166         return node ? sk : sk1;
 167 }
 168
 169 /* Find socket with given address (channel, src).
 170  * Returns locked socket */
 171 static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 172 {
 173         struct sock *s;
 174         read_lock(&rfcomm_sk_list.lock);
 175         s = __rfcomm_get_sock_by_channel(state, channel, src);
 176         if (s) bh_lock_sock(s);
 177         read_unlock(&rfcomm_sk_list.lock);
 178         return s;
 179 }
 180
 181 static void rfcomm_sock_destruct(struct sock *sk)
 182 {
 183         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 184
 185         BT_DBG("sk %p dlc %p", sk, d);
 186
 187         skb_queue_purge(&sk->sk_receive_queue);
 188         skb_queue_purge(&sk->sk_write_queue);
 189
 190         rfcomm_dlc_lock(d);
 191         rfcomm_pi(sk)->dlc = NULL;
 192
 193         /* Detach DLC if it's owned by this socket */
 194         if (d->owner == sk)
 195                 d->owner = NULL;
 196         rfcomm_dlc_unlock(d);
 197
 198         rfcomm_dlc_put(d);
 199
 200         if (sk->sk_protinfo)
 201                 kfree(sk->sk_protinfo);
 202 }
 203
 204 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 205 {
 206         struct sock *sk;
 207
 208         BT_DBG("parent %p", parent);
 209
 210         /* Close not yet accepted dlcs */
 211         while ((sk = bt_accept_dequeue(parent, NULL))) {
 212                 rfcomm_sock_close(sk);
 213                 rfcomm_sock_kill(sk);
 214         }
 215
 216         parent->sk_state  = BT_CLOSED;
 217         parent->sk_zapped = 1;
 218 }
 219
 220 /* Kill socket (only if zapped and orphan)
 221  * Must be called on unlocked socket.
 222  */
 223 static void rfcomm_sock_kill(struct sock *sk)
 224 {
 225         if (!sk->sk_zapped || sk->sk_socket)
 226                 return;
 227
 228         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 229
 230         /* Kill poor orphan */
 231         bt_sock_unlink(&rfcomm_sk_list, sk);
 232         sock_set_flag(sk, SOCK_DEAD);
 233         sock_put(sk);
 234 }
 235
 236 static void __rfcomm_sock_close(struct sock *sk)
 237 {
 238         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 239
 240         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 241
 242         switch (sk->sk_state) {
 243         case BT_LISTEN:
 244                 rfcomm_sock_cleanup_listen(sk);
 245                 break;
 246
 247         case BT_CONNECT:
 248         case BT_CONNECT2:
 249         case BT_CONFIG:
 250         case BT_CONNECTED:
 251                 rfcomm_dlc_close(d, 0);
 252
 253         default:
 254                 sk->sk_zapped = 1;
 255                 break;
 256         }
 257 }
 258
 259 /* Close socket.
 260  * Must be called on unlocked socket.
 261  */
 262 static void rfcomm_sock_close(struct sock *sk)
 263 {
 264         lock_sock(sk);
 265         __rfcomm_sock_close(sk);
 266         release_sock(sk);
 267 }
 268
 269 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 270 {
 271         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 272
 273         BT_DBG("sk %p", sk);
 274
 275         if (parent) {
 276                 sk->sk_type = parent->sk_type;
 277                 pi->link_mode = rfcomm_pi(parent)->link_mode;
 278         } else {
 279                 pi->link_mode = 0;
 280         }
 281
 282         pi->dlc->link_mode = pi->link_mode;
 283 }
 284
 285 static struct sock *rfcomm_sock_alloc(struct socket *sock, int proto, int prio)
 286 {
 287         struct rfcomm_dlc *d;
 288         struct sock *sk;
 289
 290         sk = bt_sock_alloc(sock, BTPROTO_RFCOMM, sizeof(struct rfcomm_pinfo), prio);
 291         if (!sk)
 292                 return NULL;
 293
 294         sk_set_owner(sk, THIS_MODULE);
 295
 296         d = rfcomm_dlc_alloc(prio);
 297         if (!d) {
 298                 sk_free(sk);
 299                 return NULL;
 300         }
 301         d->data_ready   = rfcomm_sk_data_ready;
 302         d->state_change = rfcomm_sk_state_change;
 303
 304         rfcomm_pi(sk)->dlc = d;
 305         d->owner = sk;
 306
 307         sk->sk_destruct = rfcomm_sock_destruct;
 308         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 309
 310         sk->sk_sndbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 311         sk->sk_rcvbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 312
 313         sk->sk_protocol = proto;
 314         sk->sk_state    = BT_OPEN;
 315
 316         bt_sock_link(&rfcomm_sk_list, sk);
 317
 318         BT_DBG("sk %p", sk);
 319         return sk;
 320 }
 321
 322 static int rfcomm_sock_create(struct socket *sock, int protocol)
 323 {
 324         struct sock *sk;
 325
 326         BT_DBG("sock %p", sock);
 327
 328         sock->state = SS_UNCONNECTED;
 329
 330         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 331                 return -ESOCKTNOSUPPORT;
 332
 333         sock->ops = &rfcomm_sock_ops;
 334
 335         if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL)))
 336                 return -ENOMEM;
 337
 338         rfcomm_sock_init(sk, NULL);
 339         return 0;
 340 }
 341
 342 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 343 {
 344         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 345         struct sock *sk = sock->sk;
 346         int err = 0;
 347
 348         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
 349
 350         if (!addr || addr->sa_family != AF_BLUETOOTH)
 351                 return -EINVAL;
 352
 353         lock_sock(sk);
 354
 355         if (sk->sk_state != BT_OPEN) {
 356                 err = -EBADFD;
 357                 goto done;
 358         }
 359
 360         write_lock_bh(&rfcomm_sk_list.lock);
 361
 362         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 363                 err = -EADDRINUSE;
 364         } else {
 365                 /* Save source address */
 366                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 367                 rfcomm_pi(sk)->channel = sa->rc_channel;
 368                 sk->sk_state = BT_BOUND;
 369         }
 370
 371         write_unlock_bh(&rfcomm_sk_list.lock);
 372
 373 done:
 374         release_sock(sk);
 375         return err;
 376 }
 377
 378 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 379 {
 380         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 381         struct sock *sk = sock->sk;
 382         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 383         int err = 0;
 384
 385         BT_DBG("sk %p", sk);
 386
 387         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
 388                 return -EINVAL;
 389
 390         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND)
 391                 return -EBADFD;
 392
 393         if (sk->sk_type != SOCK_STREAM)
 394                 return -EINVAL;
 395
 396         lock_sock(sk);
 397
 398         sk->sk_state = BT_CONNECT;
 399         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 400         rfcomm_pi(sk)->channel = sa->rc_channel;
 401
 402         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 403         if (!err)
 404                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 405                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 406
 407         release_sock(sk);
 408         return err;
 409 }
 410
 411 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 412 {
 413         struct sock *sk = sock->sk;
 414         int err = 0;
 415
 416         BT_DBG("sk %p backlog %d", sk, backlog);
 417
 418         lock_sock(sk);
 419
 420         if (sk->sk_state != BT_BOUND) {
 421                 err = -EBADFD;
 422                 goto done;
 423         }
 424
 425         if (!rfcomm_pi(sk)->channel) {
 426                 bdaddr_t *src = &bt_sk(sk)->src;
 427                 u8 channel;
 428
 429                 err = -EINVAL;
 430
 431                 write_lock_bh(&rfcomm_sk_list.lock);
 432
 433                 for (channel = 1; channel < 31; channel++)
 434                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 435                                 rfcomm_pi(sk)->channel = channel;
 436                                 err = 0;
 437                                 break;
 438                         }
 439
 440                 write_unlock_bh(&rfcomm_sk_list.lock);
 441
 442                 if (err < 0)
 443                         goto done;
 444         }
 445
 446         sk->sk_max_ack_backlog = backlog;
 447         sk->sk_ack_backlog = 0;
 448         sk->sk_state = BT_LISTEN;
 449
 450 done:
 451         release_sock(sk);
 452         return err;
 453 }
 454
 455 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 456 {
 457         DECLARE_WAITQUEUE(wait, current);
 458         struct sock *sk = sock->sk, *nsk;
 459         long timeo;
 460         int err = 0;
 461
 462         lock_sock(sk);
 463
 464         if (sk->sk_state != BT_LISTEN) {
 465                 err = -EBADFD;
 466                 goto done;
 467         }
 468
 469         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 470
 471         BT_DBG("sk %p timeo %ld", sk, timeo);
 472
 473         /* Wait for an incoming connection. (wake-one). */
 474         add_wait_queue_exclusive(sk->sk_sleep, &wait);
 475         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 476                 set_current_state(TASK_INTERRUPTIBLE);
 477                 if (!timeo) {
 478                         err = -EAGAIN;
 479                         break;
 480                 }
 481
 482                 release_sock(sk);
 483                 timeo = schedule_timeout(timeo);
 484                 lock_sock(sk);
 485
 486                 if (sk->sk_state != BT_LISTEN) {
 487                         err = -EBADFD;
 488                         break;
 489                 }
 490
 491                 if (signal_pending(current)) {
 492                         err = sock_intr_errno(timeo);
 493                         break;
 494                 }
 495         }
 496         set_current_state(TASK_RUNNING);
 497         remove_wait_queue(sk->sk_sleep, &wait);
 498
 499         if (err)
 500                 goto done;
 501
 502         newsock->state = SS_CONNECTED;
 503
 504         BT_DBG("new socket %p", nsk);
 505
 506 done:
 507         release_sock(sk);
 508         return err;
 509 }
 510
 511 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 512 {
 513         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 514         struct sock *sk = sock->sk;
 515
 516         BT_DBG("sock %p, sk %p", sock, sk);
 517
 518         sa->rc_family  = AF_BLUETOOTH;
 519         sa->rc_channel = rfcomm_pi(sk)->channel;
 520         if (peer)
 521                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 522         else
 523                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 524
 525         *len = sizeof(struct sockaddr_rc);
 526         return 0;
 527 }
 528
 529 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 530                                struct msghdr *msg, size_t len)
 531 {
 532         struct sock *sk = sock->sk;
 533         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 534         struct sk_buff *skb;
 535         int err;
 536         int sent = 0;
 537
 538         if (msg->msg_flags & MSG_OOB)
 539                 return -EOPNOTSUPP;
 540
 541         if (sk->sk_shutdown & SEND_SHUTDOWN)
 542                 return -EPIPE;
 543
 544         BT_DBG("sock %p, sk %p", sock, sk);
 545
 546         lock_sock(sk);
 547
 548         while (len) {
 549                 size_t size = min_t(size_t, len, d->mtu);
 550
 551                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 552                                 msg->msg_flags & MSG_DONTWAIT, &err);
 553                 if (!skb)
 554                         break;
 555                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 556
 557                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 558                 if (err) {
 559                         kfree_skb(skb);
 560                         sent = err;
 561                         break;
 562                 }
 563
 564                 err = rfcomm_dlc_send(d, skb);
 565                 if (err < 0) {
 566                         kfree_skb(skb);
 567                         break;
 568                 }
 569
 570                 sent += size;
 571                 len  -= size;
 572         }
 573
 574         release_sock(sk);
 575
 576         return sent ? sent : err;
 577 }
 578
 579 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
 580 {
 581         DECLARE_WAITQUEUE(wait, current);
 582
 583         add_wait_queue(sk->sk_sleep, &wait);
 584         for (;;) {
 585                 set_current_state(TASK_INTERRUPTIBLE);
 586
 587                 if (skb_queue_len(&sk->sk_receive_queue) || sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN) ||
 588                                 signal_pending(current) || !timeo)
 589                         break;
 590
 591                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 592                 release_sock(sk);
 593                 timeo = schedule_timeout(timeo);
 594                 lock_sock(sk);
 595                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 596         }
 597
 598         __set_current_state(TASK_RUNNING);
 599         remove_wait_queue(sk->sk_sleep, &wait);
 600         return timeo;
 601 }
 602
 603 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 604                                struct msghdr *msg, size_t size, int flags)
 605 {
 606         struct sock *sk = sock->sk;
 607         int err = 0;
 608         size_t target, copied = 0;
 609         long timeo;
 610
 611         if (flags & MSG_OOB)
 612                 return -EOPNOTSUPP;
 613
 614         msg->msg_namelen = 0;
 615
 616         BT_DBG("sk %p size %d", sk, size);
 617
 618         lock_sock(sk);
 619
 620         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
 621         timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 622
 623         do {
 624                 struct sk_buff *skb;
 625                 int chunk;
 626
 627                 skb = skb_dequeue(&sk->sk_receive_queue);
 628                 if (!skb) {
 629                         if (copied >= target)
 630                                 break;
 631
 632                         if ((err = sock_error(sk)) != 0)
 633                                 break;
 634                         if (sk->sk_shutdown & RCV_SHUTDOWN)
 635                                 break;
 636
 637                         err = -EAGAIN;
 638                         if (!timeo)
 639                                 break;
 640
 641                         timeo = rfcomm_sock_data_wait(sk, timeo);
 642
 643                         if (signal_pending(current)) {
 644                                 err = sock_intr_errno(timeo);
 645                                 goto out;
 646                         }
 647                         continue;
 648                 }
 649
 650                 chunk = min_t(unsigned int, skb->len, size);
 651                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
 652                         skb_queue_head(&sk->sk_receive_queue, skb);
 653                         if (!copied)
 654                                 copied = -EFAULT;
 655                         break;
 656                 }
 657                 copied += chunk;
 658                 size   -= chunk;
 659
 660                 if (!(flags & MSG_PEEK)) {
 661                         atomic_sub(chunk, &sk->sk_rmem_alloc);
 662
 663                         skb_pull(skb, chunk);
 664                         if (skb->len) {
 665                                 skb_queue_head(&sk->sk_receive_queue, skb);
 666                                 break;
 667                         }
 668                         kfree_skb(skb);
 669
 670                 } else {
 671                         /* put message back and return */
 672                         skb_queue_head(&sk->sk_receive_queue, skb);
 673                         break;
 674                 }
 675         } while (size);
 676
 677 out:
 678         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 679                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 680
 681         release_sock(sk);
 682         return copied ? : err;
 683 }
 684
 685 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 686 {
 687         struct sock *sk = sock->sk;
 688         int err = 0;
 689         u32 opt;
 690
 691         BT_DBG("sk %p", sk);
 692
 693         lock_sock(sk);
 694
 695         switch (optname) {
 696         case RFCOMM_LM:
 697                 if (get_user(opt, (u32 __user *) optval)) {
 698                         err = -EFAULT;
 699                         break;
 700                 }
 701
 702                 rfcomm_pi(sk)->link_mode = opt;
 703                 break;
 704
 705         default:
 706                 err = -ENOPROTOOPT;
 707                 break;
 708         }
 709
 710         release_sock(sk);
 711         return err;
 712 }
 713
 714 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 715 {
 716         struct sock *sk = sock->sk;
 717         struct sock *l2cap_sk;
 718         struct rfcomm_conninfo cinfo;
 719         int len, err = 0;
 720
 721         BT_DBG("sk %p", sk);
 722
 723         if (get_user(len, optlen))
 724                 return -EFAULT;
 725
 726         lock_sock(sk);
 727
 728         switch (optname) {
 729         case RFCOMM_LM:
 730                 if (put_user(rfcomm_pi(sk)->link_mode, (u32 __user *) optval))
 731                         err = -EFAULT;
 732                 break;
 733
 734         case RFCOMM_CONNINFO:
 735                 if (sk->sk_state != BT_CONNECTED) {
 736                         err = -ENOTCONN;
 737                         break;
 738                 }
 739
 740                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 741
 742                 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
 743                 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
 744
 745                 len = min_t(unsigned int, len, sizeof(cinfo));
 746                 if (copy_to_user(optval, (char *) &cinfo, len))
 747                         err = -EFAULT;
 748
 749                 break;
 750
 751         default:
 752                 err = -ENOPROTOOPT;
 753                 break;
 754         }
 755
 756         release_sock(sk);
 757         return err;
 758 }
 759
 760 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 761 {
 762         struct sock *sk = sock->sk;
 763         int err;
 764
 765         lock_sock(sk);
 766
 767 #ifdef CONFIG_BT_RFCOMM_TTY
 768         err = rfcomm_dev_ioctl(sk, cmd, (void __user *)arg);
 769 #else
 770         err = -EOPNOTSUPP;
 771 #endif
 772
 773         release_sock(sk);
 774         return err;
 775 }
 776
 777 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 778 {
 779         struct sock *sk = sock->sk;
 780         int err = 0;
 781
 782         BT_DBG("sock %p, sk %p", sock, sk);
 783
 784         if (!sk) return 0;
 785
 786         lock_sock(sk);
 787         if (!sk->sk_shutdown) {
 788                 sk->sk_shutdown = SHUTDOWN_MASK;
 789                 __rfcomm_sock_close(sk);
 790
 791                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 792                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 793         }
 794         release_sock(sk);
 795         return err;
 796 }
 797
 798 static int rfcomm_sock_release(struct socket *sock)
 799 {
 800         struct sock *sk = sock->sk;
 801         int err;
 802
 803         BT_DBG("sock %p, sk %p", sock, sk);
 804
 805         if (!sk)
 806                 return 0;
 807
 808         err = rfcomm_sock_shutdown(sock, 2);
 809
 810         sock_orphan(sk);
 811         rfcomm_sock_kill(sk);
 812         return err;
 813 }
 814
 815 /* ---- RFCOMM core layer callbacks ----
 816  *
 817  * called under rfcomm_lock()
 818  */
 819 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 820 {
 821         struct sock *sk, *parent;
 822         bdaddr_t src, dst;
 823         int result = 0;
 824
 825         BT_DBG("session %p channel %d", s, channel);
 826
 827         rfcomm_session_getaddr(s, &src, &dst);
 828
 829         /* Check if we have socket listening on channel */
 830         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 831         if (!parent)
 832                 return 0;
 833
 834         /* Check for backlog size */
 835         if (parent->sk_ack_backlog > parent->sk_max_ack_backlog) {
 836                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 837                 goto done;
 838         }
 839
 840         sk = rfcomm_sock_alloc(NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 841         if (!sk)
 842                 goto done;
 843
 844         rfcomm_sock_init(sk, parent);
 845         bacpy(&bt_sk(sk)->src, &src);
 846         bacpy(&bt_sk(sk)->dst, &dst);
 847         rfcomm_pi(sk)->channel = channel;
 848
 849         sk->sk_state = BT_CONFIG;
 850         bt_accept_enqueue(parent, sk);
 851
 852         /* Accept connection and return socket DLC */
 853         *d = rfcomm_pi(sk)->dlc;
 854         result = 1;
 855
 856 done:
 857         bh_unlock_sock(parent);
 858         return result;
 859 }
 860
 861 /* ---- Proc fs support ---- */
 862 #ifdef CONFIG_PROC_FS
 863 static void *rfcomm_seq_start(struct seq_file *seq, loff_t *pos)
 864 {
 865         struct sock *sk;
 866         struct hlist_node *node;
 867         loff_t l = *pos;
 868
 869         read_lock_bh(&rfcomm_sk_list.lock);
 870
 871         sk_for_each(sk, node, &rfcomm_sk_list.head)
 872                 if (!l--)
 873                         return sk;
 874         return NULL;
 875 }
 876
 877 static void *rfcomm_seq_next(struct seq_file *seq, void *e, loff_t *pos)
 878 {
 879         struct sock *sk = e;
 880         (*pos)++;
 881         return sk_next(sk);
 882 }
 883
 884 static void rfcomm_seq_stop(struct seq_file *seq, void *e)
 885 {
 886         read_unlock_bh(&rfcomm_sk_list.lock);
 887 }
 888
 889 static int  rfcomm_seq_show(struct seq_file *seq, void *e)
 890 {
 891         struct sock *sk = e;
 892         seq_printf(seq, "%s %s %d %d\n",
 893                         batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
 894                         sk->sk_state, rfcomm_pi(sk)->channel);
 895         return 0;
 896 }
 897
 898 static struct seq_operations rfcomm_seq_ops = {
 899         .start  = rfcomm_seq_start,
 900         .next   = rfcomm_seq_next,
 901         .stop   = rfcomm_seq_stop,
 902         .show   = rfcomm_seq_show
 903 };
 904
 905 static int rfcomm_seq_open(struct inode *inode, struct file *file)
 906 {
 907         return seq_open(file, &rfcomm_seq_ops);
 908 }
 909
 910 static struct file_operations rfcomm_seq_fops = {
 911         .owner   = THIS_MODULE,
 912         .open    = rfcomm_seq_open,
 913         .read    = seq_read,
 914         .llseek  = seq_lseek,
 915         .release = seq_release,
 916 };
 917
 918 static int  __init rfcomm_sock_proc_init(void)
 919 {
 920         struct proc_dir_entry *p = create_proc_entry("sock", S_IRUGO, proc_bt_rfcomm);
 921         if (!p)
 922                 return -ENOMEM;
 923         p->proc_fops = &rfcomm_seq_fops;
 924         return 0;
 925 }
 926
 927 static void __exit rfcomm_sock_proc_cleanup(void)
 928 {
 929         remove_proc_entry("sock", proc_bt_rfcomm);
 930 }
 931
 932 #else /* CONFIG_PROC_FS */
 933
 934 static int  __init rfcomm_sock_proc_init(void)
 935 {
 936         return 0;
 937 }
 938
 939 static void __exit rfcomm_sock_proc_cleanup(void)
 940 {
 941         return;
 942 }
 943 #endif /* CONFIG_PROC_FS */
 944
 945 static struct proto_ops rfcomm_sock_ops = {
 946         .family         = PF_BLUETOOTH,
 947         .owner          = THIS_MODULE,
 948         .release        = rfcomm_sock_release,
 949         .bind           = rfcomm_sock_bind,
 950         .connect        = rfcomm_sock_connect,
 951         .listen         = rfcomm_sock_listen,
 952         .accept         = rfcomm_sock_accept,
 953         .getname        = rfcomm_sock_getname,
 954         .sendmsg        = rfcomm_sock_sendmsg,
 955         .recvmsg        = rfcomm_sock_recvmsg,
 956         .shutdown       = rfcomm_sock_shutdown,
 957         .setsockopt     = rfcomm_sock_setsockopt,
 958         .getsockopt     = rfcomm_sock_getsockopt,
 959         .ioctl          = rfcomm_sock_ioctl,
 960         .poll           = bt_sock_poll,
 961         .socketpair     = sock_no_socketpair,
 962         .mmap           = sock_no_mmap
 963 };
 964
 965 static struct net_proto_family rfcomm_sock_family_ops = {
 966         .family         = PF_BLUETOOTH,
 967         .owner          = THIS_MODULE,
 968         .create         = rfcomm_sock_create
 969 };
 970
 971 int  __init rfcomm_init_sockets(void)
 972 {
 973         int err;
 974
 975         if ((err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops))) {
 976                 BT_ERR("RFCOMM socket layer registration failed. %d", err);
 977                 return err;
 978         }
 979
 980         rfcomm_sock_proc_init();
 981
 982         BT_INFO("RFCOMM socket layer initialized");
 983         return 0;
 984 }
 985
 986 void __exit rfcomm_cleanup_sockets(void)
 987 {
 988         int err;
 989
 990         rfcomm_sock_proc_cleanup();
 991
 992         /* Unregister socket, protocol and notifier */
 993         if ((err = bt_sock_unregister(BTPROTO_RFCOMM)))
 994                 BT_ERR("RFCOMM socket layer unregistration failed. %d", err);
 995 }