2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
39 static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
43 static const struct proto_ops l2cap_sock_ops;
44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio, int kern);
48 bool l2cap_is_socket(struct socket *sock)
50 return sock && sock->ops == &l2cap_sock_ops;
52 EXPORT_SYMBOL(l2cap_is_socket);
54 static int l2cap_validate_bredr_psm(u16 psm)
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm & 0x0101) != 0x0001)
60 /* Restrict usage of well-known PSMs */
61 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
67 static int l2cap_validate_le_psm(u16 psm)
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
70 if (psm > L2CAP_PSM_LE_DYN_END)
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
82 struct sock *sk = sock->sk;
83 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
84 struct sockaddr_l2 la;
89 if (!addr || addr->sa_family != AF_BLUETOOTH)
92 memset(&la, 0, sizeof(la));
93 len = min_t(unsigned int, sizeof(la), alen);
94 memcpy(&la, addr, len);
96 if (la.l2_cid && la.l2_psm)
99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
103 /* We only allow ATT user space socket */
105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
111 if (sk->sk_state != BT_OPEN) {
117 __u16 psm = __le16_to_cpu(la.l2_psm);
119 if (la.l2_bdaddr_type == BDADDR_BREDR)
120 err = l2cap_validate_bredr_psm(psm);
122 err = l2cap_validate_le_psm(psm);
128 bacpy(&chan->src, &la.l2_bdaddr);
129 chan->src_type = la.l2_bdaddr_type;
132 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
134 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
139 switch (chan->chan_type) {
140 case L2CAP_CHAN_CONN_LESS:
141 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
142 chan->sec_level = BT_SECURITY_SDP;
144 case L2CAP_CHAN_CONN_ORIENTED:
145 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
146 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
147 chan->sec_level = BT_SECURITY_SDP;
150 chan->sec_level = BT_SECURITY_SDP;
152 case L2CAP_CHAN_FIXED:
153 /* Fixed channels default to the L2CAP core not holding a
154 * hci_conn reference for them. For fixed channels mapping to
155 * L2CAP sockets we do want to hold a reference so set the
156 * appropriate flag to request it.
158 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
162 if (chan->psm && bdaddr_type_is_le(chan->src_type))
163 chan->mode = L2CAP_MODE_LE_FLOWCTL;
165 chan->state = BT_BOUND;
166 sk->sk_state = BT_BOUND;
173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
176 struct sock *sk = sock->sk;
177 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
178 struct sockaddr_l2 la;
183 if (!addr || alen < sizeof(addr->sa_family) ||
184 addr->sa_family != AF_BLUETOOTH)
187 memset(&la, 0, sizeof(la));
188 len = min_t(unsigned int, sizeof(la), alen);
189 memcpy(&la, addr, len);
191 if (la.l2_cid && la.l2_psm)
194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
197 /* Check that the socket wasn't bound to something that
198 * conflicts with the address given to connect(). If chan->src
199 * is BDADDR_ANY it means bind() was never used, in which case
200 * chan->src_type and la.l2_bdaddr_type do not need to match.
202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
203 bdaddr_type_is_le(la.l2_bdaddr_type)) {
204 /* Old user space versions will try to incorrectly bind
205 * the ATT socket using BDADDR_BREDR. We need to accept
206 * this and fix up the source address type only when
207 * both the source CID and destination CID indicate
208 * ATT. Anything else is an invalid combination.
210 if (chan->scid != L2CAP_CID_ATT ||
211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
214 /* We don't have the hdev available here to make a
215 * better decision on random vs public, but since all
216 * user space versions that exhibit this issue anyway do
217 * not support random local addresses assuming public
218 * here is good enough.
220 chan->src_type = BDADDR_LE_PUBLIC;
223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
227 /* We only allow ATT user space socket */
229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
233 if (chan->psm && bdaddr_type_is_le(chan->src_type))
234 chan->mode = L2CAP_MODE_LE_FLOWCTL;
236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
237 &la.l2_bdaddr, la.l2_bdaddr_type);
243 err = bt_sock_wait_state(sk, BT_CONNECTED,
244 sock_sndtimeo(sk, flags & O_NONBLOCK));
251 static int l2cap_sock_listen(struct socket *sock, int backlog)
253 struct sock *sk = sock->sk;
254 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
257 BT_DBG("sk %p backlog %d", sk, backlog);
261 if (sk->sk_state != BT_BOUND) {
266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
271 switch (chan->mode) {
272 case L2CAP_MODE_BASIC:
273 case L2CAP_MODE_LE_FLOWCTL:
275 case L2CAP_MODE_ERTM:
276 case L2CAP_MODE_STREAMING:
285 sk->sk_max_ack_backlog = backlog;
286 sk->sk_ack_backlog = 0;
288 /* Listening channels need to use nested locking in order not to
289 * cause lockdep warnings when the created child channels end up
290 * being locked in the same thread as the parent channel.
292 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
294 chan->state = BT_LISTEN;
295 sk->sk_state = BT_LISTEN;
302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
305 DEFINE_WAIT_FUNC(wait, woken_wake_function);
306 struct sock *sk = sock->sk, *nsk;
310 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
312 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
314 BT_DBG("sk %p timeo %ld", sk, timeo);
316 /* Wait for an incoming connection. (wake-one). */
317 add_wait_queue_exclusive(sk_sleep(sk), &wait);
319 if (sk->sk_state != BT_LISTEN) {
324 nsk = bt_accept_dequeue(sk, newsock);
333 if (signal_pending(current)) {
334 err = sock_intr_errno(timeo);
340 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
342 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
344 remove_wait_queue(sk_sleep(sk), &wait);
349 newsock->state = SS_CONNECTED;
351 BT_DBG("new socket %p", nsk);
358 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
361 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
362 struct sock *sk = sock->sk;
363 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
365 BT_DBG("sock %p, sk %p", sock, sk);
367 if (peer && sk->sk_state != BT_CONNECTED &&
368 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
369 sk->sk_state != BT_CONFIG)
372 memset(la, 0, sizeof(struct sockaddr_l2));
373 addr->sa_family = AF_BLUETOOTH;
374 *len = sizeof(struct sockaddr_l2);
376 la->l2_psm = chan->psm;
379 bacpy(&la->l2_bdaddr, &chan->dst);
380 la->l2_cid = cpu_to_le16(chan->dcid);
381 la->l2_bdaddr_type = chan->dst_type;
383 bacpy(&la->l2_bdaddr, &chan->src);
384 la->l2_cid = cpu_to_le16(chan->scid);
385 la->l2_bdaddr_type = chan->src_type;
391 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
392 char __user *optval, int __user *optlen)
394 struct sock *sk = sock->sk;
395 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
396 struct l2cap_options opts;
397 struct l2cap_conninfo cinfo;
403 if (get_user(len, optlen))
410 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
411 * legacy ATT code depends on getsockopt for
412 * L2CAP_OPTIONS we need to let this pass.
414 if (bdaddr_type_is_le(chan->src_type) &&
415 chan->scid != L2CAP_CID_ATT) {
420 memset(&opts, 0, sizeof(opts));
421 opts.imtu = chan->imtu;
422 opts.omtu = chan->omtu;
423 opts.flush_to = chan->flush_to;
424 opts.mode = chan->mode;
425 opts.fcs = chan->fcs;
426 opts.max_tx = chan->max_tx;
427 opts.txwin_size = chan->tx_win;
429 len = min_t(unsigned int, len, sizeof(opts));
430 if (copy_to_user(optval, (char *) &opts, len))
436 switch (chan->sec_level) {
437 case BT_SECURITY_LOW:
440 case BT_SECURITY_MEDIUM:
441 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
443 case BT_SECURITY_HIGH:
444 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
447 case BT_SECURITY_FIPS:
448 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
449 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
456 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
457 opt |= L2CAP_LM_MASTER;
459 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
460 opt |= L2CAP_LM_RELIABLE;
462 if (put_user(opt, (u32 __user *) optval))
468 if (sk->sk_state != BT_CONNECTED &&
469 !(sk->sk_state == BT_CONNECT2 &&
470 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
475 memset(&cinfo, 0, sizeof(cinfo));
476 cinfo.hci_handle = chan->conn->hcon->handle;
477 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
479 len = min_t(unsigned int, len, sizeof(cinfo));
480 if (copy_to_user(optval, (char *) &cinfo, len))
494 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
495 char __user *optval, int __user *optlen)
497 struct sock *sk = sock->sk;
498 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
499 struct bt_security sec;
505 if (level == SOL_L2CAP)
506 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
508 if (level != SOL_BLUETOOTH)
511 if (get_user(len, optlen))
518 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
519 chan->chan_type != L2CAP_CHAN_FIXED &&
520 chan->chan_type != L2CAP_CHAN_RAW) {
525 memset(&sec, 0, sizeof(sec));
527 sec.level = chan->conn->hcon->sec_level;
529 if (sk->sk_state == BT_CONNECTED)
530 sec.key_size = chan->conn->hcon->enc_key_size;
532 sec.level = chan->sec_level;
535 len = min_t(unsigned int, len, sizeof(sec));
536 if (copy_to_user(optval, (char *) &sec, len))
542 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
547 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
548 (u32 __user *) optval))
554 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
555 (u32 __user *) optval))
561 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
562 && sk->sk_type != SOCK_RAW) {
567 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
569 len = min_t(unsigned int, len, sizeof(pwr));
570 if (copy_to_user(optval, (char *) &pwr, len))
575 case BT_CHANNEL_POLICY:
576 if (put_user(chan->chan_policy, (u32 __user *) optval))
581 if (!bdaddr_type_is_le(chan->src_type)) {
586 if (sk->sk_state != BT_CONNECTED) {
591 if (put_user(chan->omtu, (u16 __user *) optval))
596 if (!bdaddr_type_is_le(chan->src_type)) {
601 if (put_user(chan->imtu, (u16 __user *) optval))
614 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
616 switch (chan->scid) {
618 if (mtu < L2CAP_LE_MIN_MTU)
623 if (mtu < L2CAP_DEFAULT_MIN_MTU)
630 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
631 char __user *optval, unsigned int optlen)
633 struct sock *sk = sock->sk;
634 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
635 struct l2cap_options opts;
645 if (bdaddr_type_is_le(chan->src_type)) {
650 if (sk->sk_state == BT_CONNECTED) {
655 opts.imtu = chan->imtu;
656 opts.omtu = chan->omtu;
657 opts.flush_to = chan->flush_to;
658 opts.mode = chan->mode;
659 opts.fcs = chan->fcs;
660 opts.max_tx = chan->max_tx;
661 opts.txwin_size = chan->tx_win;
663 len = min_t(unsigned int, sizeof(opts), optlen);
664 if (copy_from_user((char *) &opts, optval, len)) {
669 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
674 if (!l2cap_valid_mtu(chan, opts.imtu)) {
679 chan->mode = opts.mode;
680 switch (chan->mode) {
681 case L2CAP_MODE_LE_FLOWCTL:
683 case L2CAP_MODE_BASIC:
684 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
686 case L2CAP_MODE_ERTM:
687 case L2CAP_MODE_STREAMING:
696 chan->imtu = opts.imtu;
697 chan->omtu = opts.omtu;
698 chan->fcs = opts.fcs;
699 chan->max_tx = opts.max_tx;
700 chan->tx_win = opts.txwin_size;
701 chan->flush_to = opts.flush_to;
705 if (get_user(opt, (u32 __user *) optval)) {
710 if (opt & L2CAP_LM_FIPS) {
715 if (opt & L2CAP_LM_AUTH)
716 chan->sec_level = BT_SECURITY_LOW;
717 if (opt & L2CAP_LM_ENCRYPT)
718 chan->sec_level = BT_SECURITY_MEDIUM;
719 if (opt & L2CAP_LM_SECURE)
720 chan->sec_level = BT_SECURITY_HIGH;
722 if (opt & L2CAP_LM_MASTER)
723 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
725 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
727 if (opt & L2CAP_LM_RELIABLE)
728 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
730 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
742 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
743 char __user *optval, unsigned int optlen)
745 struct sock *sk = sock->sk;
746 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
747 struct bt_security sec;
749 struct l2cap_conn *conn;
755 if (level == SOL_L2CAP)
756 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
758 if (level != SOL_BLUETOOTH)
765 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
766 chan->chan_type != L2CAP_CHAN_FIXED &&
767 chan->chan_type != L2CAP_CHAN_RAW) {
772 sec.level = BT_SECURITY_LOW;
774 len = min_t(unsigned int, sizeof(sec), optlen);
775 if (copy_from_user((char *) &sec, optval, len)) {
780 if (sec.level < BT_SECURITY_LOW ||
781 sec.level > BT_SECURITY_HIGH) {
786 chan->sec_level = sec.level;
793 /*change security for LE channels */
794 if (chan->scid == L2CAP_CID_ATT) {
795 if (smp_conn_security(conn->hcon, sec.level))
797 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
798 sk->sk_state = BT_CONFIG;
799 chan->state = BT_CONFIG;
801 /* or for ACL link */
802 } else if ((sk->sk_state == BT_CONNECT2 &&
803 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
804 sk->sk_state == BT_CONNECTED) {
805 if (!l2cap_chan_check_security(chan, true))
806 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
808 sk->sk_state_change(sk);
815 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
820 if (get_user(opt, (u32 __user *) optval)) {
826 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
827 set_bit(FLAG_DEFER_SETUP, &chan->flags);
829 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
830 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
835 if (get_user(opt, (u32 __user *) optval)) {
840 if (opt > BT_FLUSHABLE_ON) {
845 if (opt == BT_FLUSHABLE_OFF) {
847 /* proceed further only when we have l2cap_conn and
848 No Flush support in the LM */
849 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
856 set_bit(FLAG_FLUSHABLE, &chan->flags);
858 clear_bit(FLAG_FLUSHABLE, &chan->flags);
862 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
863 chan->chan_type != L2CAP_CHAN_RAW) {
868 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
870 len = min_t(unsigned int, sizeof(pwr), optlen);
871 if (copy_from_user((char *) &pwr, optval, len)) {
876 if (pwr.force_active)
877 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
879 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
882 case BT_CHANNEL_POLICY:
883 if (get_user(opt, (u32 __user *) optval)) {
888 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
893 if (chan->mode != L2CAP_MODE_ERTM &&
894 chan->mode != L2CAP_MODE_STREAMING) {
899 chan->chan_policy = (u8) opt;
901 if (sk->sk_state == BT_CONNECTED &&
902 chan->move_role == L2CAP_MOVE_ROLE_NONE)
903 l2cap_move_start(chan);
908 if (!bdaddr_type_is_le(chan->src_type)) {
913 /* Setting is not supported as it's the remote side that
920 if (!bdaddr_type_is_le(chan->src_type)) {
925 if (sk->sk_state == BT_CONNECTED) {
930 if (get_user(opt, (u32 __user *) optval)) {
947 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
950 struct sock *sk = sock->sk;
951 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
954 BT_DBG("sock %p, sk %p", sock, sk);
956 err = sock_error(sk);
960 if (msg->msg_flags & MSG_OOB)
963 if (sk->sk_state != BT_CONNECTED)
967 err = bt_sock_wait_ready(sk, msg->msg_flags);
972 l2cap_chan_lock(chan);
973 err = l2cap_chan_send(chan, msg, len);
974 l2cap_chan_unlock(chan);
979 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
980 size_t len, int flags)
982 struct sock *sk = sock->sk;
983 struct l2cap_pinfo *pi = l2cap_pi(sk);
988 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
989 &bt_sk(sk)->flags)) {
990 if (bdaddr_type_is_le(pi->chan->src_type)) {
991 sk->sk_state = BT_CONNECTED;
992 pi->chan->state = BT_CONNECTED;
993 __l2cap_le_connect_rsp_defer(pi->chan);
995 sk->sk_state = BT_CONFIG;
996 pi->chan->state = BT_CONFIG;
997 __l2cap_connect_rsp_defer(pi->chan);
1006 if (sock->type == SOCK_STREAM)
1007 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1009 err = bt_sock_recvmsg(sock, msg, len, flags);
1011 if (pi->chan->mode != L2CAP_MODE_ERTM)
1014 /* Attempt to put pending rx data in the socket buffer */
1018 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1021 if (pi->rx_busy_skb) {
1022 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1023 pi->rx_busy_skb = NULL;
1028 /* Restore data flow when half of the receive buffer is
1029 * available. This avoids resending large numbers of
1032 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1033 l2cap_chan_busy(pi->chan, 0);
1040 /* Kill socket (only if zapped and orphan)
1041 * Must be called on unlocked socket.
1043 static void l2cap_sock_kill(struct sock *sk)
1045 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1048 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1050 /* Kill poor orphan */
1052 l2cap_chan_put(l2cap_pi(sk)->chan);
1053 sock_set_flag(sk, SOCK_DEAD);
1057 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1059 DECLARE_WAITQUEUE(wait, current);
1061 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1062 /* Timeout to prevent infinite loop */
1063 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1065 add_wait_queue(sk_sleep(sk), &wait);
1066 set_current_state(TASK_INTERRUPTIBLE);
1068 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1069 chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1070 jiffies_to_msecs(timeout - jiffies));
1073 timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1075 if (signal_pending(current)) {
1076 err = sock_intr_errno(timeo);
1081 timeo = schedule_timeout(timeo);
1083 set_current_state(TASK_INTERRUPTIBLE);
1085 err = sock_error(sk);
1089 if (time_after(jiffies, timeout)) {
1094 } while (chan->unacked_frames > 0 &&
1095 chan->state == BT_CONNECTED);
1097 set_current_state(TASK_RUNNING);
1098 remove_wait_queue(sk_sleep(sk), &wait);
1102 static int l2cap_sock_shutdown(struct socket *sock, int how)
1104 struct sock *sk = sock->sk;
1105 struct l2cap_chan *chan;
1106 struct l2cap_conn *conn;
1109 BT_DBG("sock %p, sk %p", sock, sk);
1116 if (sk->sk_shutdown)
1117 goto shutdown_already;
1119 BT_DBG("Handling sock shutdown");
1121 /* prevent sk structure from being freed whilst unlocked */
1124 chan = l2cap_pi(sk)->chan;
1125 /* prevent chan structure from being freed whilst unlocked */
1126 l2cap_chan_hold(chan);
1128 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1130 if (chan->mode == L2CAP_MODE_ERTM &&
1131 chan->unacked_frames > 0 &&
1132 chan->state == BT_CONNECTED) {
1133 err = __l2cap_wait_ack(sk, chan);
1135 /* After waiting for ACKs, check whether shutdown
1136 * has already been actioned to close the L2CAP
1137 * link such as by l2cap_disconnection_req().
1139 if (sk->sk_shutdown)
1143 sk->sk_shutdown = SHUTDOWN_MASK;
1146 l2cap_chan_lock(chan);
1149 /* prevent conn structure from being freed */
1150 l2cap_conn_get(conn);
1151 l2cap_chan_unlock(chan);
1154 /* mutex lock must be taken before l2cap_chan_lock() */
1155 mutex_lock(&conn->chan_lock);
1157 l2cap_chan_lock(chan);
1158 l2cap_chan_close(chan, 0);
1159 l2cap_chan_unlock(chan);
1162 mutex_unlock(&conn->chan_lock);
1163 l2cap_conn_put(conn);
1168 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1169 !(current->flags & PF_EXITING))
1170 err = bt_sock_wait_state(sk, BT_CLOSED,
1174 l2cap_chan_put(chan);
1178 if (!err && sk->sk_err)
1183 BT_DBG("Sock shutdown complete err: %d", err);
1188 static int l2cap_sock_release(struct socket *sock)
1190 struct sock *sk = sock->sk;
1193 BT_DBG("sock %p, sk %p", sock, sk);
1198 bt_sock_unlink(&l2cap_sk_list, sk);
1200 err = l2cap_sock_shutdown(sock, 2);
1203 l2cap_sock_kill(sk);
1207 static void l2cap_sock_cleanup_listen(struct sock *parent)
1211 BT_DBG("parent %p state %s", parent,
1212 state_to_string(parent->sk_state));
1214 /* Close not yet accepted channels */
1215 while ((sk = bt_accept_dequeue(parent, NULL))) {
1216 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1218 BT_DBG("child chan %p state %s", chan,
1219 state_to_string(chan->state));
1221 l2cap_chan_lock(chan);
1222 __clear_chan_timer(chan);
1223 l2cap_chan_close(chan, ECONNRESET);
1224 l2cap_chan_unlock(chan);
1226 l2cap_sock_kill(sk);
1230 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1232 struct sock *sk, *parent = chan->data;
1236 /* Check for backlog size */
1237 if (sk_acceptq_is_full(parent)) {
1238 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1239 release_sock(parent);
1243 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1246 release_sock(parent);
1250 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1252 l2cap_sock_init(sk, parent);
1254 bt_accept_enqueue(parent, sk);
1256 release_sock(parent);
1258 return l2cap_pi(sk)->chan;
1261 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1263 struct sock *sk = chan->data;
1268 if (l2cap_pi(sk)->rx_busy_skb) {
1273 err = sock_queue_rcv_skb(sk, skb);
1275 /* For ERTM, handle one skb that doesn't fit into the recv
1276 * buffer. This is important to do because the data frames
1277 * have already been acked, so the skb cannot be discarded.
1279 * Notify the l2cap core that the buffer is full, so the
1280 * LOCAL_BUSY state is entered and no more frames are
1281 * acked and reassembled until there is buffer space
1284 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1285 l2cap_pi(sk)->rx_busy_skb = skb;
1286 l2cap_chan_busy(chan, 1);
1296 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1298 struct sock *sk = chan->data;
1300 l2cap_sock_kill(sk);
1303 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1305 struct sock *sk = chan->data;
1306 struct sock *parent;
1308 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1310 /* This callback can be called both for server (BT_LISTEN)
1311 * sockets as well as "normal" ones. To avoid lockdep warnings
1312 * with child socket locking (through l2cap_sock_cleanup_listen)
1313 * we need separation into separate nesting levels. The simplest
1314 * way to accomplish this is to inherit the nesting level used
1317 lock_sock_nested(sk, atomic_read(&chan->nesting));
1319 parent = bt_sk(sk)->parent;
1321 sock_set_flag(sk, SOCK_ZAPPED);
1323 switch (chan->state) {
1329 l2cap_sock_cleanup_listen(sk);
1330 sk->sk_state = BT_CLOSED;
1331 chan->state = BT_CLOSED;
1335 sk->sk_state = BT_CLOSED;
1336 chan->state = BT_CLOSED;
1341 bt_accept_unlink(sk);
1342 parent->sk_data_ready(parent);
1344 sk->sk_state_change(sk);
1353 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1356 struct sock *sk = chan->data;
1358 sk->sk_state = state;
1364 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1365 unsigned long hdr_len,
1366 unsigned long len, int nb)
1368 struct sock *sk = chan->data;
1369 struct sk_buff *skb;
1372 l2cap_chan_unlock(chan);
1373 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1374 l2cap_chan_lock(chan);
1377 return ERR_PTR(err);
1379 skb->priority = sk->sk_priority;
1381 bt_cb(skb)->l2cap.chan = chan;
1386 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1388 struct sock *sk = chan->data;
1389 struct sock *parent;
1393 parent = bt_sk(sk)->parent;
1395 BT_DBG("sk %p, parent %p", sk, parent);
1397 sk->sk_state = BT_CONNECTED;
1398 sk->sk_state_change(sk);
1401 parent->sk_data_ready(parent);
1406 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1408 struct sock *parent, *sk = chan->data;
1412 parent = bt_sk(sk)->parent;
1414 parent->sk_data_ready(parent);
1419 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1421 struct sock *sk = chan->data;
1423 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1424 sk->sk_state = BT_CONNECTED;
1425 chan->state = BT_CONNECTED;
1428 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1429 sk->sk_state_change(sk);
1432 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1434 struct sock *sk = chan->data;
1437 sk->sk_shutdown = SHUTDOWN_MASK;
1441 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1443 struct sock *sk = chan->data;
1445 return sk->sk_sndtimeo;
1448 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1450 struct sock *sk = chan->data;
1452 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1453 sk->sk_state_change(sk);
1456 static const struct l2cap_ops l2cap_chan_ops = {
1457 .name = "L2CAP Socket Interface",
1458 .new_connection = l2cap_sock_new_connection_cb,
1459 .recv = l2cap_sock_recv_cb,
1460 .close = l2cap_sock_close_cb,
1461 .teardown = l2cap_sock_teardown_cb,
1462 .state_change = l2cap_sock_state_change_cb,
1463 .ready = l2cap_sock_ready_cb,
1464 .defer = l2cap_sock_defer_cb,
1465 .resume = l2cap_sock_resume_cb,
1466 .suspend = l2cap_sock_suspend_cb,
1467 .set_shutdown = l2cap_sock_set_shutdown_cb,
1468 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1469 .alloc_skb = l2cap_sock_alloc_skb_cb,
1472 static void l2cap_sock_destruct(struct sock *sk)
1474 BT_DBG("sk %p", sk);
1476 if (l2cap_pi(sk)->chan)
1477 l2cap_chan_put(l2cap_pi(sk)->chan);
1479 if (l2cap_pi(sk)->rx_busy_skb) {
1480 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1481 l2cap_pi(sk)->rx_busy_skb = NULL;
1484 skb_queue_purge(&sk->sk_receive_queue);
1485 skb_queue_purge(&sk->sk_write_queue);
1488 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1491 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1493 memset(la, 0, sizeof(struct sockaddr_l2));
1494 la->l2_family = AF_BLUETOOTH;
1495 la->l2_psm = bt_cb(skb)->l2cap.psm;
1496 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1498 *msg_namelen = sizeof(struct sockaddr_l2);
1501 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1503 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1505 BT_DBG("sk %p", sk);
1508 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1510 sk->sk_type = parent->sk_type;
1511 bt_sk(sk)->flags = bt_sk(parent)->flags;
1513 chan->chan_type = pchan->chan_type;
1514 chan->imtu = pchan->imtu;
1515 chan->omtu = pchan->omtu;
1516 chan->conf_state = pchan->conf_state;
1517 chan->mode = pchan->mode;
1518 chan->fcs = pchan->fcs;
1519 chan->max_tx = pchan->max_tx;
1520 chan->tx_win = pchan->tx_win;
1521 chan->tx_win_max = pchan->tx_win_max;
1522 chan->sec_level = pchan->sec_level;
1523 chan->flags = pchan->flags;
1524 chan->tx_credits = pchan->tx_credits;
1525 chan->rx_credits = pchan->rx_credits;
1527 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1528 chan->scid = pchan->scid;
1529 chan->dcid = pchan->scid;
1532 security_sk_clone(parent, sk);
1534 switch (sk->sk_type) {
1536 chan->chan_type = L2CAP_CHAN_RAW;
1539 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1540 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1542 case SOCK_SEQPACKET:
1544 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1548 chan->imtu = L2CAP_DEFAULT_MTU;
1550 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1551 chan->mode = L2CAP_MODE_ERTM;
1552 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1554 chan->mode = L2CAP_MODE_BASIC;
1557 l2cap_chan_set_defaults(chan);
1560 /* Default config options */
1561 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1564 chan->ops = &l2cap_chan_ops;
1567 static struct proto l2cap_proto = {
1569 .owner = THIS_MODULE,
1570 .obj_size = sizeof(struct l2cap_pinfo)
1573 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1574 int proto, gfp_t prio, int kern)
1577 struct l2cap_chan *chan;
1579 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1583 sock_init_data(sock, sk);
1584 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1586 sk->sk_destruct = l2cap_sock_destruct;
1587 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1589 sock_reset_flag(sk, SOCK_ZAPPED);
1591 sk->sk_protocol = proto;
1592 sk->sk_state = BT_OPEN;
1594 chan = l2cap_chan_create();
1600 l2cap_chan_hold(chan);
1602 l2cap_pi(sk)->chan = chan;
1607 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1612 BT_DBG("sock %p", sock);
1614 sock->state = SS_UNCONNECTED;
1616 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1617 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1618 return -ESOCKTNOSUPPORT;
1620 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1623 sock->ops = &l2cap_sock_ops;
1625 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1629 l2cap_sock_init(sk, NULL);
1630 bt_sock_link(&l2cap_sk_list, sk);
1634 static const struct proto_ops l2cap_sock_ops = {
1635 .family = PF_BLUETOOTH,
1636 .owner = THIS_MODULE,
1637 .release = l2cap_sock_release,
1638 .bind = l2cap_sock_bind,
1639 .connect = l2cap_sock_connect,
1640 .listen = l2cap_sock_listen,
1641 .accept = l2cap_sock_accept,
1642 .getname = l2cap_sock_getname,
1643 .sendmsg = l2cap_sock_sendmsg,
1644 .recvmsg = l2cap_sock_recvmsg,
1645 .poll = bt_sock_poll,
1646 .ioctl = bt_sock_ioctl,
1647 .mmap = sock_no_mmap,
1648 .socketpair = sock_no_socketpair,
1649 .shutdown = l2cap_sock_shutdown,
1650 .setsockopt = l2cap_sock_setsockopt,
1651 .getsockopt = l2cap_sock_getsockopt
1654 static const struct net_proto_family l2cap_sock_family_ops = {
1655 .family = PF_BLUETOOTH,
1656 .owner = THIS_MODULE,
1657 .create = l2cap_sock_create,
1660 int __init l2cap_init_sockets(void)
1664 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1666 err = proto_register(&l2cap_proto, 0);
1670 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1672 BT_ERR("L2CAP socket registration failed");
1676 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1679 BT_ERR("Failed to create L2CAP proc file");
1680 bt_sock_unregister(BTPROTO_L2CAP);
1684 BT_INFO("L2CAP socket layer initialized");
1689 proto_unregister(&l2cap_proto);
1693 void l2cap_cleanup_sockets(void)
1695 bt_procfs_cleanup(&init_net, "l2cap");
1696 bt_sock_unregister(BTPROTO_L2CAP);
1697 proto_unregister(&l2cap_proto);