net/bluetooth/rfcomm/sock.c

   1 /*
   2    RFCOMM implementation for Linux Bluetooth stack (BlueZ).
   3    Copyright (C) 2002 Maxim Krasnyansky <maxk@qualcomm.com>
   4    Copyright (C) 2002 Marcel Holtmann <marcel@holtmann.org>
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 /*
  25  * RFCOMM sockets.
  26  *
  27  * $Id: sock.c,v 1.24 2002/10/03 01:00:34 maxk Exp $
  28  */
  29
  30 #include <linux/module.h>
  31
  32 #include <linux/types.h>
  33 #include <linux/errno.h>
  34 #include <linux/kernel.h>
  35 #include <linux/sched.h>
  36 #include <linux/slab.h>
  37 #include <linux/poll.h>
  38 #include <linux/fcntl.h>
  39 #include <linux/init.h>
  40 #include <linux/interrupt.h>
  41 #include <linux/socket.h>
  42 #include <linux/skbuff.h>
  43 #include <linux/list.h>
  44 #include <linux/device.h>
  45 #include <net/sock.h>
  46
  47 #include <asm/system.h>
  48 #include <asm/uaccess.h>
  49
  50 #include <net/bluetooth/bluetooth.h>
  51 #include <net/bluetooth/hci_core.h>
  52 #include <net/bluetooth/l2cap.h>
  53 #include <net/bluetooth/rfcomm.h>
  54
  55 #ifndef CONFIG_BT_RFCOMM_DEBUG
  56 #undef  BT_DBG
  57 #define BT_DBG(D...)
  58 #endif
  59
  60 static const struct proto_ops rfcomm_sock_ops;
  61
  62 static struct bt_sock_list rfcomm_sk_list = {
  63         .lock = RW_LOCK_UNLOCKED
  64 };
  65
  66 static void rfcomm_sock_close(struct sock *sk);
  67 static void rfcomm_sock_kill(struct sock *sk);
  68
  69 /* ---- DLC callbacks ----
  70  *
  71  * called under rfcomm_dlc_lock()
  72  */
  73 static void rfcomm_sk_data_ready(struct rfcomm_dlc *d, struct sk_buff *skb)
  74 {
  75         struct sock *sk = d->owner;
  76         if (!sk)
  77                 return;
  78
  79         atomic_add(skb->len, &sk->sk_rmem_alloc);
  80         skb_queue_tail(&sk->sk_receive_queue, skb);
  81         sk->sk_data_ready(sk, skb->len);
  82
  83         if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
  84                 rfcomm_dlc_throttle(d);
  85 }
  86
  87 static void rfcomm_sk_state_change(struct rfcomm_dlc *d, int err)
  88 {
  89         struct sock *sk = d->owner, *parent;
  90         if (!sk)
  91                 return;
  92
  93         BT_DBG("dlc %p state %ld err %d", d, d->state, err);
  94
  95         bh_lock_sock(sk);
  96
  97         if (err)
  98                 sk->sk_err = err;
  99
 100         sk->sk_state = d->state;
 101
 102         parent = bt_sk(sk)->parent;
 103         if (parent) {
 104                 if (d->state == BT_CLOSED) {
 105                         sock_set_flag(sk, SOCK_ZAPPED);
 106                         bt_accept_unlink(sk);
 107                 }
 108                 parent->sk_data_ready(parent, 0);
 109         } else {
 110                 if (d->state == BT_CONNECTED)
 111                         rfcomm_session_getaddr(d->session, &bt_sk(sk)->src, NULL);
 112                 sk->sk_state_change(sk);
 113         }
 114
 115         bh_unlock_sock(sk);
 116
 117         if (parent && sock_flag(sk, SOCK_ZAPPED)) {
 118                 /* We have to drop DLC lock here, otherwise
 119                  * rfcomm_sock_destruct() will dead lock. */
 120                 rfcomm_dlc_unlock(d);
 121                 rfcomm_sock_kill(sk);
 122                 rfcomm_dlc_lock(d);
 123         }
 124 }
 125
 126 /* ---- Socket functions ---- */
 127 static struct sock *__rfcomm_get_sock_by_addr(u8 channel, bdaddr_t *src)
 128 {
 129         struct sock *sk = NULL;
 130         struct hlist_node *node;
 131
 132         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 133                 if (rfcomm_pi(sk)->channel == channel &&
 134                                 !bacmp(&bt_sk(sk)->src, src))
 135                         break;
 136         }
 137
 138         return node ? sk : NULL;
 139 }
 140
 141 /* Find socket with channel and source bdaddr.
 142  * Returns closest match.
 143  */
 144 static struct sock *__rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 145 {
 146         struct sock *sk = NULL, *sk1 = NULL;
 147         struct hlist_node *node;
 148
 149         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 150                 if (state && sk->sk_state != state)
 151                         continue;
 152
 153                 if (rfcomm_pi(sk)->channel == channel) {
 154                         /* Exact match. */
 155                         if (!bacmp(&bt_sk(sk)->src, src))
 156                                 break;
 157
 158                         /* Closest match */
 159                         if (!bacmp(&bt_sk(sk)->src, BDADDR_ANY))
 160                                 sk1 = sk;
 161                 }
 162         }
 163         return node ? sk : sk1;
 164 }
 165
 166 /* Find socket with given address (channel, src).
 167  * Returns locked socket */
 168 static inline struct sock *rfcomm_get_sock_by_channel(int state, u8 channel, bdaddr_t *src)
 169 {
 170         struct sock *s;
 171         read_lock(&rfcomm_sk_list.lock);
 172         s = __rfcomm_get_sock_by_channel(state, channel, src);
 173         if (s) bh_lock_sock(s);
 174         read_unlock(&rfcomm_sk_list.lock);
 175         return s;
 176 }
 177
 178 static void rfcomm_sock_destruct(struct sock *sk)
 179 {
 180         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 181
 182         BT_DBG("sk %p dlc %p", sk, d);
 183
 184         skb_queue_purge(&sk->sk_receive_queue);
 185         skb_queue_purge(&sk->sk_write_queue);
 186
 187         rfcomm_dlc_lock(d);
 188         rfcomm_pi(sk)->dlc = NULL;
 189
 190         /* Detach DLC if it's owned by this socket */
 191         if (d->owner == sk)
 192                 d->owner = NULL;
 193         rfcomm_dlc_unlock(d);
 194
 195         rfcomm_dlc_put(d);
 196 }
 197
 198 static void rfcomm_sock_cleanup_listen(struct sock *parent)
 199 {
 200         struct sock *sk;
 201
 202         BT_DBG("parent %p", parent);
 203
 204         /* Close not yet accepted dlcs */
 205         while ((sk = bt_accept_dequeue(parent, NULL))) {
 206                 rfcomm_sock_close(sk);
 207                 rfcomm_sock_kill(sk);
 208         }
 209
 210         parent->sk_state  = BT_CLOSED;
 211         sock_set_flag(parent, SOCK_ZAPPED);
 212 }
 213
 214 /* Kill socket (only if zapped and orphan)
 215  * Must be called on unlocked socket.
 216  */
 217 static void rfcomm_sock_kill(struct sock *sk)
 218 {
 219         if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
 220                 return;
 221
 222         BT_DBG("sk %p state %d refcnt %d", sk, sk->sk_state, atomic_read(&sk->sk_refcnt));
 223
 224         /* Kill poor orphan */
 225         bt_sock_unlink(&rfcomm_sk_list, sk);
 226         sock_set_flag(sk, SOCK_DEAD);
 227         sock_put(sk);
 228 }
 229
 230 static void __rfcomm_sock_close(struct sock *sk)
 231 {
 232         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 233
 234         BT_DBG("sk %p state %d socket %p", sk, sk->sk_state, sk->sk_socket);
 235
 236         switch (sk->sk_state) {
 237         case BT_LISTEN:
 238                 rfcomm_sock_cleanup_listen(sk);
 239                 break;
 240
 241         case BT_CONNECT:
 242         case BT_CONNECT2:
 243         case BT_CONFIG:
 244         case BT_CONNECTED:
 245                 rfcomm_dlc_close(d, 0);
 246
 247         default:
 248                 sock_set_flag(sk, SOCK_ZAPPED);
 249                 break;
 250         }
 251 }
 252
 253 /* Close socket.
 254  * Must be called on unlocked socket.
 255  */
 256 static void rfcomm_sock_close(struct sock *sk)
 257 {
 258         lock_sock(sk);
 259         __rfcomm_sock_close(sk);
 260         release_sock(sk);
 261 }
 262
 263 static void rfcomm_sock_init(struct sock *sk, struct sock *parent)
 264 {
 265         struct rfcomm_pinfo *pi = rfcomm_pi(sk);
 266
 267         BT_DBG("sk %p", sk);
 268
 269         if (parent) {
 270                 sk->sk_type = parent->sk_type;
 271                 pi->link_mode = rfcomm_pi(parent)->link_mode;
 272         } else {
 273                 pi->link_mode = 0;
 274         }
 275
 276         pi->dlc->link_mode = pi->link_mode;
 277 }
 278
 279 static struct proto rfcomm_proto = {
 280         .name           = "RFCOMM",
 281         .owner          = THIS_MODULE,
 282         .obj_size       = sizeof(struct rfcomm_pinfo)
 283 };
 284
 285 static struct sock *rfcomm_sock_alloc(struct socket *sock, int proto, gfp_t prio)
 286 {
 287         struct rfcomm_dlc *d;
 288         struct sock *sk;
 289
 290         sk = sk_alloc(PF_BLUETOOTH, prio, &rfcomm_proto, 1);
 291         if (!sk)
 292                 return NULL;
 293
 294         sock_init_data(sock, sk);
 295         INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
 296
 297         d = rfcomm_dlc_alloc(prio);
 298         if (!d) {
 299                 sk_free(sk);
 300                 return NULL;
 301         }
 302
 303         d->data_ready   = rfcomm_sk_data_ready;
 304         d->state_change = rfcomm_sk_state_change;
 305
 306         rfcomm_pi(sk)->dlc = d;
 307         d->owner = sk;
 308
 309         sk->sk_destruct = rfcomm_sock_destruct;
 310         sk->sk_sndtimeo = RFCOMM_CONN_TIMEOUT;
 311
 312         sk->sk_sndbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 313         sk->sk_rcvbuf   = RFCOMM_MAX_CREDITS * RFCOMM_DEFAULT_MTU * 10;
 314
 315         sock_reset_flag(sk, SOCK_ZAPPED);
 316
 317         sk->sk_protocol = proto;
 318         sk->sk_state    = BT_OPEN;
 319
 320         bt_sock_link(&rfcomm_sk_list, sk);
 321
 322         BT_DBG("sk %p", sk);
 323         return sk;
 324 }
 325
 326 static int rfcomm_sock_create(struct socket *sock, int protocol)
 327 {
 328         struct sock *sk;
 329
 330         BT_DBG("sock %p", sock);
 331
 332         sock->state = SS_UNCONNECTED;
 333
 334         if (sock->type != SOCK_STREAM && sock->type != SOCK_RAW)
 335                 return -ESOCKTNOSUPPORT;
 336
 337         sock->ops = &rfcomm_sock_ops;
 338
 339         if (!(sk = rfcomm_sock_alloc(sock, protocol, GFP_KERNEL)))
 340                 return -ENOMEM;
 341
 342         rfcomm_sock_init(sk, NULL);
 343         return 0;
 344 }
 345
 346 static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
 347 {
 348         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 349         struct sock *sk = sock->sk;
 350         int err = 0;
 351
 352         BT_DBG("sk %p %s", sk, batostr(&sa->rc_bdaddr));
 353
 354         if (!addr || addr->sa_family != AF_BLUETOOTH)
 355                 return -EINVAL;
 356
 357         lock_sock(sk);
 358
 359         if (sk->sk_state != BT_OPEN) {
 360                 err = -EBADFD;
 361                 goto done;
 362         }
 363
 364         if (sk->sk_type != SOCK_STREAM) {
 365                 err = -EINVAL;
 366                 goto done;
 367         }
 368
 369         write_lock_bh(&rfcomm_sk_list.lock);
 370
 371         if (sa->rc_channel && __rfcomm_get_sock_by_addr(sa->rc_channel, &sa->rc_bdaddr)) {
 372                 err = -EADDRINUSE;
 373         } else {
 374                 /* Save source address */
 375                 bacpy(&bt_sk(sk)->src, &sa->rc_bdaddr);
 376                 rfcomm_pi(sk)->channel = sa->rc_channel;
 377                 sk->sk_state = BT_BOUND;
 378         }
 379
 380         write_unlock_bh(&rfcomm_sk_list.lock);
 381
 382 done:
 383         release_sock(sk);
 384         return err;
 385 }
 386
 387 static int rfcomm_sock_connect(struct socket *sock, struct sockaddr *addr, int alen, int flags)
 388 {
 389         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 390         struct sock *sk = sock->sk;
 391         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 392         int err = 0;
 393
 394         BT_DBG("sk %p", sk);
 395
 396         if (addr->sa_family != AF_BLUETOOTH || alen < sizeof(struct sockaddr_rc))
 397                 return -EINVAL;
 398
 399         lock_sock(sk);
 400
 401         if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) {
 402                 err = -EBADFD;
 403                 goto done;
 404         }
 405
 406         if (sk->sk_type != SOCK_STREAM) {
 407                 err = -EINVAL;
 408                 goto done;
 409         }
 410
 411         sk->sk_state = BT_CONNECT;
 412         bacpy(&bt_sk(sk)->dst, &sa->rc_bdaddr);
 413         rfcomm_pi(sk)->channel = sa->rc_channel;
 414
 415         err = rfcomm_dlc_open(d, &bt_sk(sk)->src, &sa->rc_bdaddr, sa->rc_channel);
 416         if (!err)
 417                 err = bt_sock_wait_state(sk, BT_CONNECTED,
 418                                 sock_sndtimeo(sk, flags & O_NONBLOCK));
 419
 420 done:
 421         release_sock(sk);
 422         return err;
 423 }
 424
 425 static int rfcomm_sock_listen(struct socket *sock, int backlog)
 426 {
 427         struct sock *sk = sock->sk;
 428         int err = 0;
 429
 430         BT_DBG("sk %p backlog %d", sk, backlog);
 431
 432         lock_sock(sk);
 433
 434         if (sk->sk_state != BT_BOUND) {
 435                 err = -EBADFD;
 436                 goto done;
 437         }
 438
 439         if (sk->sk_type != SOCK_STREAM) {
 440                 err = -EINVAL;
 441                 goto done;
 442         }
 443
 444         if (!rfcomm_pi(sk)->channel) {
 445                 bdaddr_t *src = &bt_sk(sk)->src;
 446                 u8 channel;
 447
 448                 err = -EINVAL;
 449
 450                 write_lock_bh(&rfcomm_sk_list.lock);
 451
 452                 for (channel = 1; channel < 31; channel++)
 453                         if (!__rfcomm_get_sock_by_addr(channel, src)) {
 454                                 rfcomm_pi(sk)->channel = channel;
 455                                 err = 0;
 456                                 break;
 457                         }
 458
 459                 write_unlock_bh(&rfcomm_sk_list.lock);
 460
 461                 if (err < 0)
 462                         goto done;
 463         }
 464
 465         sk->sk_max_ack_backlog = backlog;
 466         sk->sk_ack_backlog = 0;
 467         sk->sk_state = BT_LISTEN;
 468
 469 done:
 470         release_sock(sk);
 471         return err;
 472 }
 473
 474 static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int flags)
 475 {
 476         DECLARE_WAITQUEUE(wait, current);
 477         struct sock *sk = sock->sk, *nsk;
 478         long timeo;
 479         int err = 0;
 480
 481         lock_sock(sk);
 482
 483         if (sk->sk_state != BT_LISTEN) {
 484                 err = -EBADFD;
 485                 goto done;
 486         }
 487
 488         if (sk->sk_type != SOCK_STREAM) {
 489                 err = -EINVAL;
 490                 goto done;
 491         }
 492
 493         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 494
 495         BT_DBG("sk %p timeo %ld", sk, timeo);
 496
 497         /* Wait for an incoming connection. (wake-one). */
 498         add_wait_queue_exclusive(sk->sk_sleep, &wait);
 499         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
 500                 set_current_state(TASK_INTERRUPTIBLE);
 501                 if (!timeo) {
 502                         err = -EAGAIN;
 503                         break;
 504                 }
 505
 506                 release_sock(sk);
 507                 timeo = schedule_timeout(timeo);
 508                 lock_sock(sk);
 509
 510                 if (sk->sk_state != BT_LISTEN) {
 511                         err = -EBADFD;
 512                         break;
 513                 }
 514
 515                 if (signal_pending(current)) {
 516                         err = sock_intr_errno(timeo);
 517                         break;
 518                 }
 519         }
 520         set_current_state(TASK_RUNNING);
 521         remove_wait_queue(sk->sk_sleep, &wait);
 522
 523         if (err)
 524                 goto done;
 525
 526         newsock->state = SS_CONNECTED;
 527
 528         BT_DBG("new socket %p", nsk);
 529
 530 done:
 531         release_sock(sk);
 532         return err;
 533 }
 534
 535 static int rfcomm_sock_getname(struct socket *sock, struct sockaddr *addr, int *len, int peer)
 536 {
 537         struct sockaddr_rc *sa = (struct sockaddr_rc *) addr;
 538         struct sock *sk = sock->sk;
 539
 540         BT_DBG("sock %p, sk %p", sock, sk);
 541
 542         sa->rc_family  = AF_BLUETOOTH;
 543         sa->rc_channel = rfcomm_pi(sk)->channel;
 544         if (peer)
 545                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->dst);
 546         else
 547                 bacpy(&sa->rc_bdaddr, &bt_sk(sk)->src);
 548
 549         *len = sizeof(struct sockaddr_rc);
 550         return 0;
 551 }
 552
 553 static int rfcomm_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
 554                                struct msghdr *msg, size_t len)
 555 {
 556         struct sock *sk = sock->sk;
 557         struct rfcomm_dlc *d = rfcomm_pi(sk)->dlc;
 558         struct sk_buff *skb;
 559         int err;
 560         int sent = 0;
 561
 562         if (msg->msg_flags & MSG_OOB)
 563                 return -EOPNOTSUPP;
 564
 565         if (sk->sk_shutdown & SEND_SHUTDOWN)
 566                 return -EPIPE;
 567
 568         BT_DBG("sock %p, sk %p", sock, sk);
 569
 570         lock_sock(sk);
 571
 572         while (len) {
 573                 size_t size = min_t(size_t, len, d->mtu);
 574
 575                 skb = sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE,
 576                                 msg->msg_flags & MSG_DONTWAIT, &err);
 577                 if (!skb)
 578                         break;
 579                 skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE);
 580
 581                 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
 582                 if (err) {
 583                         kfree_skb(skb);
 584                         sent = err;
 585                         break;
 586                 }
 587
 588                 err = rfcomm_dlc_send(d, skb);
 589                 if (err < 0) {
 590                         kfree_skb(skb);
 591                         break;
 592                 }
 593
 594                 sent += size;
 595                 len  -= size;
 596         }
 597
 598         release_sock(sk);
 599
 600         return sent ? sent : err;
 601 }
 602
 603 static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
 604 {
 605         DECLARE_WAITQUEUE(wait, current);
 606
 607         add_wait_queue(sk->sk_sleep, &wait);
 608         for (;;) {
 609                 set_current_state(TASK_INTERRUPTIBLE);
 610
 611                 if (!skb_queue_empty(&sk->sk_receive_queue) ||
 612                     sk->sk_err ||
 613                     (sk->sk_shutdown & RCV_SHUTDOWN) ||
 614                     signal_pending(current) ||
 615                     !timeo)
 616                         break;
 617
 618                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 619                 release_sock(sk);
 620                 timeo = schedule_timeout(timeo);
 621                 lock_sock(sk);
 622                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
 623         }
 624
 625         __set_current_state(TASK_RUNNING);
 626         remove_wait_queue(sk->sk_sleep, &wait);
 627         return timeo;
 628 }
 629
 630 static int rfcomm_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 631                                struct msghdr *msg, size_t size, int flags)
 632 {
 633         struct sock *sk = sock->sk;
 634         int err = 0;
 635         size_t target, copied = 0;
 636         long timeo;
 637
 638         if (flags & MSG_OOB)
 639                 return -EOPNOTSUPP;
 640
 641         msg->msg_namelen = 0;
 642
 643         BT_DBG("sk %p size %d", sk, size);
 644
 645         lock_sock(sk);
 646
 647         target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
 648         timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
 649
 650         do {
 651                 struct sk_buff *skb;
 652                 int chunk;
 653
 654                 skb = skb_dequeue(&sk->sk_receive_queue);
 655                 if (!skb) {
 656                         if (copied >= target)
 657                                 break;
 658
 659                         if ((err = sock_error(sk)) != 0)
 660                                 break;
 661                         if (sk->sk_shutdown & RCV_SHUTDOWN)
 662                                 break;
 663
 664                         err = -EAGAIN;
 665                         if (!timeo)
 666                                 break;
 667
 668                         timeo = rfcomm_sock_data_wait(sk, timeo);
 669
 670                         if (signal_pending(current)) {
 671                                 err = sock_intr_errno(timeo);
 672                                 goto out;
 673                         }
 674                         continue;
 675                 }
 676
 677                 chunk = min_t(unsigned int, skb->len, size);
 678                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
 679                         skb_queue_head(&sk->sk_receive_queue, skb);
 680                         if (!copied)
 681                                 copied = -EFAULT;
 682                         break;
 683                 }
 684                 copied += chunk;
 685                 size   -= chunk;
 686
 687                 if (!(flags & MSG_PEEK)) {
 688                         atomic_sub(chunk, &sk->sk_rmem_alloc);
 689
 690                         skb_pull(skb, chunk);
 691                         if (skb->len) {
 692                                 skb_queue_head(&sk->sk_receive_queue, skb);
 693                                 break;
 694                         }
 695                         kfree_skb(skb);
 696
 697                 } else {
 698                         /* put message back and return */
 699                         skb_queue_head(&sk->sk_receive_queue, skb);
 700                         break;
 701                 }
 702         } while (size);
 703
 704 out:
 705         if (atomic_read(&sk->sk_rmem_alloc) <= (sk->sk_rcvbuf >> 2))
 706                 rfcomm_dlc_unthrottle(rfcomm_pi(sk)->dlc);
 707
 708         release_sock(sk);
 709         return copied ? : err;
 710 }
 711
 712 static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int optlen)
 713 {
 714         struct sock *sk = sock->sk;
 715         int err = 0;
 716         u32 opt;
 717
 718         BT_DBG("sk %p", sk);
 719
 720         lock_sock(sk);
 721
 722         switch (optname) {
 723         case RFCOMM_LM:
 724                 if (get_user(opt, (u32 __user *) optval)) {
 725                         err = -EFAULT;
 726                         break;
 727                 }
 728
 729                 rfcomm_pi(sk)->link_mode = opt;
 730                 break;
 731
 732         default:
 733                 err = -ENOPROTOOPT;
 734                 break;
 735         }
 736
 737         release_sock(sk);
 738         return err;
 739 }
 740
 741 static int rfcomm_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
 742 {
 743         struct sock *sk = sock->sk;
 744         struct sock *l2cap_sk;
 745         struct rfcomm_conninfo cinfo;
 746         int len, err = 0;
 747
 748         BT_DBG("sk %p", sk);
 749
 750         if (get_user(len, optlen))
 751                 return -EFAULT;
 752
 753         lock_sock(sk);
 754
 755         switch (optname) {
 756         case RFCOMM_LM:
 757                 if (put_user(rfcomm_pi(sk)->link_mode, (u32 __user *) optval))
 758                         err = -EFAULT;
 759                 break;
 760
 761         case RFCOMM_CONNINFO:
 762                 if (sk->sk_state != BT_CONNECTED) {
 763                         err = -ENOTCONN;
 764                         break;
 765                 }
 766
 767                 l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 768
 769                 cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
 770                 memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
 771
 772                 len = min_t(unsigned int, len, sizeof(cinfo));
 773                 if (copy_to_user(optval, (char *) &cinfo, len))
 774                         err = -EFAULT;
 775
 776                 break;
 777
 778         default:
 779                 err = -ENOPROTOOPT;
 780                 break;
 781         }
 782
 783         release_sock(sk);
 784         return err;
 785 }
 786
 787 static int rfcomm_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 788 {
 789         struct sock *sk = sock->sk;
 790         int err;
 791
 792         lock_sock(sk);
 793
 794 #ifdef CONFIG_BT_RFCOMM_TTY
 795         err = rfcomm_dev_ioctl(sk, cmd, (void __user *)arg);
 796 #else
 797         err = -EOPNOTSUPP;
 798 #endif
 799
 800         release_sock(sk);
 801         return err;
 802 }
 803
 804 static int rfcomm_sock_shutdown(struct socket *sock, int how)
 805 {
 806         struct sock *sk = sock->sk;
 807         int err = 0;
 808
 809         BT_DBG("sock %p, sk %p", sock, sk);
 810
 811         if (!sk) return 0;
 812
 813         lock_sock(sk);
 814         if (!sk->sk_shutdown) {
 815                 sk->sk_shutdown = SHUTDOWN_MASK;
 816                 __rfcomm_sock_close(sk);
 817
 818                 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
 819                         err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
 820         }
 821         release_sock(sk);
 822         return err;
 823 }
 824
 825 static int rfcomm_sock_release(struct socket *sock)
 826 {
 827         struct sock *sk = sock->sk;
 828         int err;
 829
 830         BT_DBG("sock %p, sk %p", sock, sk);
 831
 832         if (!sk)
 833                 return 0;
 834
 835         err = rfcomm_sock_shutdown(sock, 2);
 836
 837         sock_orphan(sk);
 838         rfcomm_sock_kill(sk);
 839         return err;
 840 }
 841
 842 /* ---- RFCOMM core layer callbacks ----
 843  *
 844  * called under rfcomm_lock()
 845  */
 846 int rfcomm_connect_ind(struct rfcomm_session *s, u8 channel, struct rfcomm_dlc **d)
 847 {
 848         struct sock *sk, *parent;
 849         bdaddr_t src, dst;
 850         int result = 0;
 851
 852         BT_DBG("session %p channel %d", s, channel);
 853
 854         rfcomm_session_getaddr(s, &src, &dst);
 855
 856         /* Check if we have socket listening on channel */
 857         parent = rfcomm_get_sock_by_channel(BT_LISTEN, channel, &src);
 858         if (!parent)
 859                 return 0;
 860
 861         /* Check for backlog size */
 862         if (sk_acceptq_is_full(parent)) {
 863                 BT_DBG("backlog full %d", parent->sk_ack_backlog);
 864                 goto done;
 865         }
 866
 867         sk = rfcomm_sock_alloc(NULL, BTPROTO_RFCOMM, GFP_ATOMIC);
 868         if (!sk)
 869                 goto done;
 870
 871         rfcomm_sock_init(sk, parent);
 872         bacpy(&bt_sk(sk)->src, &src);
 873         bacpy(&bt_sk(sk)->dst, &dst);
 874         rfcomm_pi(sk)->channel = channel;
 875
 876         sk->sk_state = BT_CONFIG;
 877         bt_accept_enqueue(parent, sk);
 878
 879         /* Accept connection and return socket DLC */
 880         *d = rfcomm_pi(sk)->dlc;
 881         result = 1;
 882
 883 done:
 884         bh_unlock_sock(parent);
 885         return result;
 886 }
 887
 888 static ssize_t rfcomm_sock_sysfs_show(struct class *dev, char *buf)
 889 {
 890         struct sock *sk;
 891         struct hlist_node *node;
 892         char *str = buf;
 893
 894         read_lock_bh(&rfcomm_sk_list.lock);
 895
 896         sk_for_each(sk, node, &rfcomm_sk_list.head) {
 897                 str += sprintf(str, "%s %s %d %d\n",
 898                                 batostr(&bt_sk(sk)->src), batostr(&bt_sk(sk)->dst),
 899                                 sk->sk_state, rfcomm_pi(sk)->channel);
 900         }
 901
 902         read_unlock_bh(&rfcomm_sk_list.lock);
 903
 904         return (str - buf);
 905 }
 906
 907 static CLASS_ATTR(rfcomm, S_IRUGO, rfcomm_sock_sysfs_show, NULL);
 908
 909 static const struct proto_ops rfcomm_sock_ops = {
 910         .family         = PF_BLUETOOTH,
 911         .owner          = THIS_MODULE,
 912         .release        = rfcomm_sock_release,
 913         .bind           = rfcomm_sock_bind,
 914         .connect        = rfcomm_sock_connect,
 915         .listen         = rfcomm_sock_listen,
 916         .accept         = rfcomm_sock_accept,
 917         .getname        = rfcomm_sock_getname,
 918         .sendmsg        = rfcomm_sock_sendmsg,
 919         .recvmsg        = rfcomm_sock_recvmsg,
 920         .shutdown       = rfcomm_sock_shutdown,
 921         .setsockopt     = rfcomm_sock_setsockopt,
 922         .getsockopt     = rfcomm_sock_getsockopt,
 923         .ioctl          = rfcomm_sock_ioctl,
 924         .poll           = bt_sock_poll,
 925         .socketpair     = sock_no_socketpair,
 926         .mmap           = sock_no_mmap
 927 };
 928
 929 static struct net_proto_family rfcomm_sock_family_ops = {
 930         .family         = PF_BLUETOOTH,
 931         .owner          = THIS_MODULE,
 932         .create         = rfcomm_sock_create
 933 };
 934
 935 int __init rfcomm_init_sockets(void)
 936 {
 937         int err;
 938
 939         err = proto_register(&rfcomm_proto, 0);
 940         if (err < 0)
 941                 return err;
 942
 943         err = bt_sock_register(BTPROTO_RFCOMM, &rfcomm_sock_family_ops);
 944         if (err < 0)
 945                 goto error;
 946
 947         class_create_file(bt_class, &class_attr_rfcomm);
 948
 949         BT_INFO("RFCOMM socket layer initialized");
 950
 951         return 0;
 952
 953 error:
 954         BT_ERR("RFCOMM socket layer registration failed");
 955         proto_unregister(&rfcomm_proto);
 956         return err;
 957 }
 958
 959 void __exit rfcomm_cleanup_sockets(void)
 960 {
 961         class_remove_file(bt_class, &class_attr_rfcomm);
 962
 963         if (bt_sock_unregister(BTPROTO_RFCOMM) < 0)
 964                 BT_ERR("RFCOMM socket layer unregistration failed");
 965
 966         proto_unregister(&rfcomm_proto);
 967 }