2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
39 static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
43 static const struct proto_ops l2cap_sock_ops;
44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio, int kern);
48 bool l2cap_is_socket(struct socket *sock)
50 return sock && sock->ops == &l2cap_sock_ops;
52 EXPORT_SYMBOL(l2cap_is_socket);
54 static int l2cap_validate_bredr_psm(u16 psm)
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm & 0x0101) != 0x0001)
60 /* Restrict usage of well-known PSMs */
61 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
67 static int l2cap_validate_le_psm(u16 psm)
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
82 struct sock *sk = sock->sk;
83 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
84 struct sockaddr_l2 la;
89 if (!addr || addr->sa_family != AF_BLUETOOTH)
92 memset(&la, 0, sizeof(la));
93 len = min_t(unsigned int, sizeof(la), alen);
94 memcpy(&la, addr, len);
96 if (la.l2_cid && la.l2_psm)
99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
103 /* We only allow ATT user space socket */
105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
111 if (sk->sk_state != BT_OPEN) {
117 __u16 psm = __le16_to_cpu(la.l2_psm);
119 if (la.l2_bdaddr_type == BDADDR_BREDR)
120 err = l2cap_validate_bredr_psm(psm);
122 err = l2cap_validate_le_psm(psm);
129 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
131 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
136 switch (chan->chan_type) {
137 case L2CAP_CHAN_CONN_LESS:
138 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
139 chan->sec_level = BT_SECURITY_SDP;
141 case L2CAP_CHAN_CONN_ORIENTED:
142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
143 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
144 chan->sec_level = BT_SECURITY_SDP;
147 chan->sec_level = BT_SECURITY_SDP;
149 case L2CAP_CHAN_FIXED:
150 /* Fixed channels default to the L2CAP core not holding a
151 * hci_conn reference for them. For fixed channels mapping to
152 * L2CAP sockets we do want to hold a reference so set the
153 * appropriate flag to request it.
155 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
159 bacpy(&chan->src, &la.l2_bdaddr);
160 chan->src_type = la.l2_bdaddr_type;
162 if (chan->psm && bdaddr_type_is_le(chan->src_type))
163 chan->mode = L2CAP_MODE_LE_FLOWCTL;
165 chan->state = BT_BOUND;
166 sk->sk_state = BT_BOUND;
173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
176 struct sock *sk = sock->sk;
177 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
178 struct sockaddr_l2 la;
183 if (!addr || alen < sizeof(addr->sa_family) ||
184 addr->sa_family != AF_BLUETOOTH)
187 memset(&la, 0, sizeof(la));
188 len = min_t(unsigned int, sizeof(la), alen);
189 memcpy(&la, addr, len);
191 if (la.l2_cid && la.l2_psm)
194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
197 /* Check that the socket wasn't bound to something that
198 * conflicts with the address given to connect(). If chan->src
199 * is BDADDR_ANY it means bind() was never used, in which case
200 * chan->src_type and la.l2_bdaddr_type do not need to match.
202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
203 bdaddr_type_is_le(la.l2_bdaddr_type)) {
204 /* Old user space versions will try to incorrectly bind
205 * the ATT socket using BDADDR_BREDR. We need to accept
206 * this and fix up the source address type only when
207 * both the source CID and destination CID indicate
208 * ATT. Anything else is an invalid combination.
210 if (chan->scid != L2CAP_CID_ATT ||
211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
214 /* We don't have the hdev available here to make a
215 * better decision on random vs public, but since all
216 * user space versions that exhibit this issue anyway do
217 * not support random local addresses assuming public
218 * here is good enough.
220 chan->src_type = BDADDR_LE_PUBLIC;
223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
227 /* We only allow ATT user space socket */
229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
233 if (chan->psm && bdaddr_type_is_le(chan->src_type))
234 chan->mode = L2CAP_MODE_LE_FLOWCTL;
236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
237 &la.l2_bdaddr, la.l2_bdaddr_type);
243 err = bt_sock_wait_state(sk, BT_CONNECTED,
244 sock_sndtimeo(sk, flags & O_NONBLOCK));
251 static int l2cap_sock_listen(struct socket *sock, int backlog)
253 struct sock *sk = sock->sk;
254 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
257 BT_DBG("sk %p backlog %d", sk, backlog);
261 if (sk->sk_state != BT_BOUND) {
266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
271 switch (chan->mode) {
272 case L2CAP_MODE_BASIC:
273 case L2CAP_MODE_LE_FLOWCTL:
275 case L2CAP_MODE_ERTM:
276 case L2CAP_MODE_STREAMING:
285 sk->sk_max_ack_backlog = backlog;
286 sk->sk_ack_backlog = 0;
288 /* Listening channels need to use nested locking in order not to
289 * cause lockdep warnings when the created child channels end up
290 * being locked in the same thread as the parent channel.
292 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
294 chan->state = BT_LISTEN;
295 sk->sk_state = BT_LISTEN;
302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
305 DEFINE_WAIT_FUNC(wait, woken_wake_function);
306 struct sock *sk = sock->sk, *nsk;
310 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
312 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
314 BT_DBG("sk %p timeo %ld", sk, timeo);
316 /* Wait for an incoming connection. (wake-one). */
317 add_wait_queue_exclusive(sk_sleep(sk), &wait);
319 if (sk->sk_state != BT_LISTEN) {
324 nsk = bt_accept_dequeue(sk, newsock);
333 if (signal_pending(current)) {
334 err = sock_intr_errno(timeo);
340 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
342 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
344 remove_wait_queue(sk_sleep(sk), &wait);
349 newsock->state = SS_CONNECTED;
351 BT_DBG("new socket %p", nsk);
358 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
361 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
362 struct sock *sk = sock->sk;
363 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
365 BT_DBG("sock %p, sk %p", sock, sk);
367 if (peer && sk->sk_state != BT_CONNECTED &&
368 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
369 sk->sk_state != BT_CONFIG)
372 memset(la, 0, sizeof(struct sockaddr_l2));
373 addr->sa_family = AF_BLUETOOTH;
374 *len = sizeof(struct sockaddr_l2);
376 la->l2_psm = chan->psm;
379 bacpy(&la->l2_bdaddr, &chan->dst);
380 la->l2_cid = cpu_to_le16(chan->dcid);
381 la->l2_bdaddr_type = chan->dst_type;
383 bacpy(&la->l2_bdaddr, &chan->src);
384 la->l2_cid = cpu_to_le16(chan->scid);
385 la->l2_bdaddr_type = chan->src_type;
391 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
392 char __user *optval, int __user *optlen)
394 struct sock *sk = sock->sk;
395 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
396 struct l2cap_options opts;
397 struct l2cap_conninfo cinfo;
403 if (get_user(len, optlen))
410 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
411 * legacy ATT code depends on getsockopt for
412 * L2CAP_OPTIONS we need to let this pass.
414 if (bdaddr_type_is_le(chan->src_type) &&
415 chan->scid != L2CAP_CID_ATT) {
420 memset(&opts, 0, sizeof(opts));
421 opts.imtu = chan->imtu;
422 opts.omtu = chan->omtu;
423 opts.flush_to = chan->flush_to;
424 opts.mode = chan->mode;
425 opts.fcs = chan->fcs;
426 opts.max_tx = chan->max_tx;
427 opts.txwin_size = chan->tx_win;
429 len = min_t(unsigned int, len, sizeof(opts));
430 if (copy_to_user(optval, (char *) &opts, len))
436 switch (chan->sec_level) {
437 case BT_SECURITY_LOW:
440 case BT_SECURITY_MEDIUM:
441 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
443 case BT_SECURITY_HIGH:
444 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
447 case BT_SECURITY_FIPS:
448 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
449 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
456 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
457 opt |= L2CAP_LM_MASTER;
459 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
460 opt |= L2CAP_LM_RELIABLE;
462 if (put_user(opt, (u32 __user *) optval))
468 if (sk->sk_state != BT_CONNECTED &&
469 !(sk->sk_state == BT_CONNECT2 &&
470 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
475 memset(&cinfo, 0, sizeof(cinfo));
476 cinfo.hci_handle = chan->conn->hcon->handle;
477 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
479 len = min_t(unsigned int, len, sizeof(cinfo));
480 if (copy_to_user(optval, (char *) &cinfo, len))
494 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
495 char __user *optval, int __user *optlen)
497 struct sock *sk = sock->sk;
498 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
499 struct bt_security sec;
505 if (level == SOL_L2CAP)
506 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
508 if (level != SOL_BLUETOOTH)
511 if (get_user(len, optlen))
518 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
519 chan->chan_type != L2CAP_CHAN_FIXED &&
520 chan->chan_type != L2CAP_CHAN_RAW) {
525 memset(&sec, 0, sizeof(sec));
527 sec.level = chan->conn->hcon->sec_level;
529 if (sk->sk_state == BT_CONNECTED)
530 sec.key_size = chan->conn->hcon->enc_key_size;
532 sec.level = chan->sec_level;
535 len = min_t(unsigned int, len, sizeof(sec));
536 if (copy_to_user(optval, (char *) &sec, len))
542 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
547 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
548 (u32 __user *) optval))
554 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
555 (u32 __user *) optval))
561 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
562 && sk->sk_type != SOCK_RAW) {
567 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
569 len = min_t(unsigned int, len, sizeof(pwr));
570 if (copy_to_user(optval, (char *) &pwr, len))
575 case BT_CHANNEL_POLICY:
576 if (put_user(chan->chan_policy, (u32 __user *) optval))
581 if (!bdaddr_type_is_le(chan->src_type)) {
586 if (sk->sk_state != BT_CONNECTED) {
591 if (put_user(chan->omtu, (u16 __user *) optval))
596 if (!bdaddr_type_is_le(chan->src_type)) {
601 if (put_user(chan->imtu, (u16 __user *) optval))
614 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
616 switch (chan->scid) {
618 if (mtu < L2CAP_LE_MIN_MTU)
623 if (mtu < L2CAP_DEFAULT_MIN_MTU)
630 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
631 char __user *optval, unsigned int optlen)
633 struct sock *sk = sock->sk;
634 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
635 struct l2cap_options opts;
645 if (bdaddr_type_is_le(chan->src_type)) {
650 if (sk->sk_state == BT_CONNECTED) {
655 opts.imtu = chan->imtu;
656 opts.omtu = chan->omtu;
657 opts.flush_to = chan->flush_to;
658 opts.mode = chan->mode;
659 opts.fcs = chan->fcs;
660 opts.max_tx = chan->max_tx;
661 opts.txwin_size = chan->tx_win;
663 len = min_t(unsigned int, sizeof(opts), optlen);
664 if (copy_from_user((char *) &opts, optval, len)) {
669 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
674 if (!l2cap_valid_mtu(chan, opts.imtu)) {
679 chan->mode = opts.mode;
680 switch (chan->mode) {
681 case L2CAP_MODE_LE_FLOWCTL:
683 case L2CAP_MODE_BASIC:
684 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
686 case L2CAP_MODE_ERTM:
687 case L2CAP_MODE_STREAMING:
696 chan->imtu = opts.imtu;
697 chan->omtu = opts.omtu;
698 chan->fcs = opts.fcs;
699 chan->max_tx = opts.max_tx;
700 chan->tx_win = opts.txwin_size;
701 chan->flush_to = opts.flush_to;
705 if (get_user(opt, (u32 __user *) optval)) {
710 if (opt & L2CAP_LM_FIPS) {
715 if (opt & L2CAP_LM_AUTH)
716 chan->sec_level = BT_SECURITY_LOW;
717 if (opt & L2CAP_LM_ENCRYPT)
718 chan->sec_level = BT_SECURITY_MEDIUM;
719 if (opt & L2CAP_LM_SECURE)
720 chan->sec_level = BT_SECURITY_HIGH;
722 if (opt & L2CAP_LM_MASTER)
723 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
725 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
727 if (opt & L2CAP_LM_RELIABLE)
728 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
730 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
742 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
743 char __user *optval, unsigned int optlen)
745 struct sock *sk = sock->sk;
746 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
747 struct bt_security sec;
749 struct l2cap_conn *conn;
755 if (level == SOL_L2CAP)
756 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
758 if (level != SOL_BLUETOOTH)
765 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
766 chan->chan_type != L2CAP_CHAN_FIXED &&
767 chan->chan_type != L2CAP_CHAN_RAW) {
772 sec.level = BT_SECURITY_LOW;
774 len = min_t(unsigned int, sizeof(sec), optlen);
775 if (copy_from_user((char *) &sec, optval, len)) {
780 if (sec.level < BT_SECURITY_LOW ||
781 sec.level > BT_SECURITY_HIGH) {
786 chan->sec_level = sec.level;
793 /*change security for LE channels */
794 if (chan->scid == L2CAP_CID_ATT) {
795 if (smp_conn_security(conn->hcon, sec.level))
797 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
798 sk->sk_state = BT_CONFIG;
799 chan->state = BT_CONFIG;
801 /* or for ACL link */
802 } else if ((sk->sk_state == BT_CONNECT2 &&
803 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
804 sk->sk_state == BT_CONNECTED) {
805 if (!l2cap_chan_check_security(chan, true))
806 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
808 sk->sk_state_change(sk);
815 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
820 if (get_user(opt, (u32 __user *) optval)) {
826 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
827 set_bit(FLAG_DEFER_SETUP, &chan->flags);
829 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
830 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
835 if (get_user(opt, (u32 __user *) optval)) {
840 if (opt > BT_FLUSHABLE_ON) {
845 if (opt == BT_FLUSHABLE_OFF) {
847 /* proceed further only when we have l2cap_conn and
848 No Flush support in the LM */
849 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
856 set_bit(FLAG_FLUSHABLE, &chan->flags);
858 clear_bit(FLAG_FLUSHABLE, &chan->flags);
862 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
863 chan->chan_type != L2CAP_CHAN_RAW) {
868 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
870 len = min_t(unsigned int, sizeof(pwr), optlen);
871 if (copy_from_user((char *) &pwr, optval, len)) {
876 if (pwr.force_active)
877 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
879 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
882 case BT_CHANNEL_POLICY:
883 if (get_user(opt, (u32 __user *) optval)) {
888 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
893 if (chan->mode != L2CAP_MODE_ERTM &&
894 chan->mode != L2CAP_MODE_STREAMING) {
899 chan->chan_policy = (u8) opt;
901 if (sk->sk_state == BT_CONNECTED &&
902 chan->move_role == L2CAP_MOVE_ROLE_NONE)
903 l2cap_move_start(chan);
908 if (!bdaddr_type_is_le(chan->src_type)) {
913 /* Setting is not supported as it's the remote side that
920 if (!bdaddr_type_is_le(chan->src_type)) {
925 if (sk->sk_state == BT_CONNECTED) {
930 if (get_user(opt, (u32 __user *) optval)) {
947 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
950 struct sock *sk = sock->sk;
951 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
954 BT_DBG("sock %p, sk %p", sock, sk);
956 err = sock_error(sk);
960 if (msg->msg_flags & MSG_OOB)
963 if (sk->sk_state != BT_CONNECTED)
967 err = bt_sock_wait_ready(sk, msg->msg_flags);
972 l2cap_chan_lock(chan);
973 err = l2cap_chan_send(chan, msg, len);
974 l2cap_chan_unlock(chan);
979 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
980 size_t len, int flags)
982 struct sock *sk = sock->sk;
983 struct l2cap_pinfo *pi = l2cap_pi(sk);
988 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
989 &bt_sk(sk)->flags)) {
990 if (bdaddr_type_is_le(pi->chan->src_type)) {
991 sk->sk_state = BT_CONNECTED;
992 pi->chan->state = BT_CONNECTED;
993 __l2cap_le_connect_rsp_defer(pi->chan);
995 sk->sk_state = BT_CONFIG;
996 pi->chan->state = BT_CONFIG;
997 __l2cap_connect_rsp_defer(pi->chan);
1006 if (sock->type == SOCK_STREAM)
1007 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1009 err = bt_sock_recvmsg(sock, msg, len, flags);
1011 if (pi->chan->mode != L2CAP_MODE_ERTM)
1014 /* Attempt to put pending rx data in the socket buffer */
1018 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1021 if (pi->rx_busy_skb) {
1022 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1023 pi->rx_busy_skb = NULL;
1028 /* Restore data flow when half of the receive buffer is
1029 * available. This avoids resending large numbers of
1032 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1033 l2cap_chan_busy(pi->chan, 0);
1040 /* Kill socket (only if zapped and orphan)
1041 * Must be called on unlocked socket.
1043 static void l2cap_sock_kill(struct sock *sk)
1045 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1048 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1050 /* Kill poor orphan */
1052 l2cap_chan_put(l2cap_pi(sk)->chan);
1053 sock_set_flag(sk, SOCK_DEAD);
1057 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1059 DECLARE_WAITQUEUE(wait, current);
1061 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1062 /* Timeout to prevent infinite loop */
1063 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1065 add_wait_queue(sk_sleep(sk), &wait);
1066 set_current_state(TASK_INTERRUPTIBLE);
1068 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1069 chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1070 jiffies_to_msecs(timeout - jiffies));
1073 timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1075 if (signal_pending(current)) {
1076 err = sock_intr_errno(timeo);
1081 timeo = schedule_timeout(timeo);
1083 set_current_state(TASK_INTERRUPTIBLE);
1085 err = sock_error(sk);
1089 if (time_after(jiffies, timeout)) {
1094 } while (chan->unacked_frames > 0 &&
1095 chan->state == BT_CONNECTED);
1097 set_current_state(TASK_RUNNING);
1098 remove_wait_queue(sk_sleep(sk), &wait);
1102 static int l2cap_sock_shutdown(struct socket *sock, int how)
1104 struct sock *sk = sock->sk;
1105 struct l2cap_chan *chan;
1106 struct l2cap_conn *conn;
1109 BT_DBG("sock %p, sk %p", sock, sk);
1114 /* prevent sk structure from being freed whilst unlocked */
1117 chan = l2cap_pi(sk)->chan;
1118 /* prevent chan structure from being freed whilst unlocked */
1119 l2cap_chan_hold(chan);
1122 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1125 mutex_lock(&conn->chan_lock);
1127 l2cap_chan_lock(chan);
1130 if (!sk->sk_shutdown) {
1131 if (chan->mode == L2CAP_MODE_ERTM &&
1132 chan->unacked_frames > 0 &&
1133 chan->state == BT_CONNECTED)
1134 err = __l2cap_wait_ack(sk, chan);
1136 sk->sk_shutdown = SHUTDOWN_MASK;
1139 l2cap_chan_close(chan, 0);
1142 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1143 !(current->flags & PF_EXITING))
1144 err = bt_sock_wait_state(sk, BT_CLOSED,
1148 if (!err && sk->sk_err)
1152 l2cap_chan_unlock(chan);
1155 mutex_unlock(&conn->chan_lock);
1157 l2cap_chan_put(chan);
1160 BT_DBG("err: %d", err);
1165 static int l2cap_sock_release(struct socket *sock)
1167 struct sock *sk = sock->sk;
1170 BT_DBG("sock %p, sk %p", sock, sk);
1175 bt_sock_unlink(&l2cap_sk_list, sk);
1177 err = l2cap_sock_shutdown(sock, 2);
1180 l2cap_sock_kill(sk);
1184 static void l2cap_sock_cleanup_listen(struct sock *parent)
1188 BT_DBG("parent %p state %s", parent,
1189 state_to_string(parent->sk_state));
1191 /* Close not yet accepted channels */
1192 while ((sk = bt_accept_dequeue(parent, NULL))) {
1193 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1195 BT_DBG("child chan %p state %s", chan,
1196 state_to_string(chan->state));
1198 l2cap_chan_lock(chan);
1199 __clear_chan_timer(chan);
1200 l2cap_chan_close(chan, ECONNRESET);
1201 l2cap_chan_unlock(chan);
1203 l2cap_sock_kill(sk);
1207 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1209 struct sock *sk, *parent = chan->data;
1213 /* Check for backlog size */
1214 if (sk_acceptq_is_full(parent)) {
1215 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1216 release_sock(parent);
1220 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1223 release_sock(parent);
1227 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1229 l2cap_sock_init(sk, parent);
1231 bt_accept_enqueue(parent, sk);
1233 release_sock(parent);
1235 return l2cap_pi(sk)->chan;
1238 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1240 struct sock *sk = chan->data;
1245 if (l2cap_pi(sk)->rx_busy_skb) {
1250 err = sock_queue_rcv_skb(sk, skb);
1252 /* For ERTM, handle one skb that doesn't fit into the recv
1253 * buffer. This is important to do because the data frames
1254 * have already been acked, so the skb cannot be discarded.
1256 * Notify the l2cap core that the buffer is full, so the
1257 * LOCAL_BUSY state is entered and no more frames are
1258 * acked and reassembled until there is buffer space
1261 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1262 l2cap_pi(sk)->rx_busy_skb = skb;
1263 l2cap_chan_busy(chan, 1);
1273 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1275 struct sock *sk = chan->data;
1277 l2cap_sock_kill(sk);
1280 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1282 struct sock *sk = chan->data;
1283 struct sock *parent;
1285 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1287 /* This callback can be called both for server (BT_LISTEN)
1288 * sockets as well as "normal" ones. To avoid lockdep warnings
1289 * with child socket locking (through l2cap_sock_cleanup_listen)
1290 * we need separation into separate nesting levels. The simplest
1291 * way to accomplish this is to inherit the nesting level used
1294 lock_sock_nested(sk, atomic_read(&chan->nesting));
1296 parent = bt_sk(sk)->parent;
1298 sock_set_flag(sk, SOCK_ZAPPED);
1300 switch (chan->state) {
1306 l2cap_sock_cleanup_listen(sk);
1307 sk->sk_state = BT_CLOSED;
1308 chan->state = BT_CLOSED;
1312 sk->sk_state = BT_CLOSED;
1313 chan->state = BT_CLOSED;
1318 bt_accept_unlink(sk);
1319 parent->sk_data_ready(parent);
1321 sk->sk_state_change(sk);
1330 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1333 struct sock *sk = chan->data;
1335 sk->sk_state = state;
1341 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1342 unsigned long hdr_len,
1343 unsigned long len, int nb)
1345 struct sock *sk = chan->data;
1346 struct sk_buff *skb;
1349 l2cap_chan_unlock(chan);
1350 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1351 l2cap_chan_lock(chan);
1354 return ERR_PTR(err);
1356 skb->priority = sk->sk_priority;
1358 bt_cb(skb)->l2cap.chan = chan;
1363 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1365 struct sock *sk = chan->data;
1366 struct sock *parent;
1370 parent = bt_sk(sk)->parent;
1372 BT_DBG("sk %p, parent %p", sk, parent);
1374 sk->sk_state = BT_CONNECTED;
1375 sk->sk_state_change(sk);
1378 parent->sk_data_ready(parent);
1383 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1385 struct sock *parent, *sk = chan->data;
1389 parent = bt_sk(sk)->parent;
1391 parent->sk_data_ready(parent);
1396 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1398 struct sock *sk = chan->data;
1400 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1401 sk->sk_state = BT_CONNECTED;
1402 chan->state = BT_CONNECTED;
1405 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1406 sk->sk_state_change(sk);
1409 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1411 struct sock *sk = chan->data;
1414 sk->sk_shutdown = SHUTDOWN_MASK;
1418 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1420 struct sock *sk = chan->data;
1422 return sk->sk_sndtimeo;
1425 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1427 struct sock *sk = chan->data;
1429 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1430 sk->sk_state_change(sk);
1433 static const struct l2cap_ops l2cap_chan_ops = {
1434 .name = "L2CAP Socket Interface",
1435 .new_connection = l2cap_sock_new_connection_cb,
1436 .recv = l2cap_sock_recv_cb,
1437 .close = l2cap_sock_close_cb,
1438 .teardown = l2cap_sock_teardown_cb,
1439 .state_change = l2cap_sock_state_change_cb,
1440 .ready = l2cap_sock_ready_cb,
1441 .defer = l2cap_sock_defer_cb,
1442 .resume = l2cap_sock_resume_cb,
1443 .suspend = l2cap_sock_suspend_cb,
1444 .set_shutdown = l2cap_sock_set_shutdown_cb,
1445 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1446 .alloc_skb = l2cap_sock_alloc_skb_cb,
1449 static void l2cap_sock_destruct(struct sock *sk)
1451 BT_DBG("sk %p", sk);
1453 if (l2cap_pi(sk)->chan)
1454 l2cap_chan_put(l2cap_pi(sk)->chan);
1456 if (l2cap_pi(sk)->rx_busy_skb) {
1457 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1458 l2cap_pi(sk)->rx_busy_skb = NULL;
1461 skb_queue_purge(&sk->sk_receive_queue);
1462 skb_queue_purge(&sk->sk_write_queue);
1465 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1468 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1470 memset(la, 0, sizeof(struct sockaddr_l2));
1471 la->l2_family = AF_BLUETOOTH;
1472 la->l2_psm = bt_cb(skb)->l2cap.psm;
1473 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1475 *msg_namelen = sizeof(struct sockaddr_l2);
1478 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1480 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1482 BT_DBG("sk %p", sk);
1485 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1487 sk->sk_type = parent->sk_type;
1488 bt_sk(sk)->flags = bt_sk(parent)->flags;
1490 chan->chan_type = pchan->chan_type;
1491 chan->imtu = pchan->imtu;
1492 chan->omtu = pchan->omtu;
1493 chan->conf_state = pchan->conf_state;
1494 chan->mode = pchan->mode;
1495 chan->fcs = pchan->fcs;
1496 chan->max_tx = pchan->max_tx;
1497 chan->tx_win = pchan->tx_win;
1498 chan->tx_win_max = pchan->tx_win_max;
1499 chan->sec_level = pchan->sec_level;
1500 chan->flags = pchan->flags;
1501 chan->tx_credits = pchan->tx_credits;
1502 chan->rx_credits = pchan->rx_credits;
1504 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1505 chan->scid = pchan->scid;
1506 chan->dcid = pchan->scid;
1509 security_sk_clone(parent, sk);
1511 switch (sk->sk_type) {
1513 chan->chan_type = L2CAP_CHAN_RAW;
1516 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1517 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1519 case SOCK_SEQPACKET:
1521 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1525 chan->imtu = L2CAP_DEFAULT_MTU;
1527 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1528 chan->mode = L2CAP_MODE_ERTM;
1529 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1531 chan->mode = L2CAP_MODE_BASIC;
1534 l2cap_chan_set_defaults(chan);
1537 /* Default config options */
1538 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1541 chan->ops = &l2cap_chan_ops;
1544 static struct proto l2cap_proto = {
1546 .owner = THIS_MODULE,
1547 .obj_size = sizeof(struct l2cap_pinfo)
1550 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1551 int proto, gfp_t prio, int kern)
1554 struct l2cap_chan *chan;
1556 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1560 sock_init_data(sock, sk);
1561 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1563 sk->sk_destruct = l2cap_sock_destruct;
1564 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1566 sock_reset_flag(sk, SOCK_ZAPPED);
1568 sk->sk_protocol = proto;
1569 sk->sk_state = BT_OPEN;
1571 chan = l2cap_chan_create();
1577 l2cap_chan_hold(chan);
1579 l2cap_pi(sk)->chan = chan;
1584 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1589 BT_DBG("sock %p", sock);
1591 sock->state = SS_UNCONNECTED;
1593 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1594 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1595 return -ESOCKTNOSUPPORT;
1597 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1600 sock->ops = &l2cap_sock_ops;
1602 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1606 l2cap_sock_init(sk, NULL);
1607 bt_sock_link(&l2cap_sk_list, sk);
1611 static const struct proto_ops l2cap_sock_ops = {
1612 .family = PF_BLUETOOTH,
1613 .owner = THIS_MODULE,
1614 .release = l2cap_sock_release,
1615 .bind = l2cap_sock_bind,
1616 .connect = l2cap_sock_connect,
1617 .listen = l2cap_sock_listen,
1618 .accept = l2cap_sock_accept,
1619 .getname = l2cap_sock_getname,
1620 .sendmsg = l2cap_sock_sendmsg,
1621 .recvmsg = l2cap_sock_recvmsg,
1622 .poll = bt_sock_poll,
1623 .ioctl = bt_sock_ioctl,
1624 .mmap = sock_no_mmap,
1625 .socketpair = sock_no_socketpair,
1626 .shutdown = l2cap_sock_shutdown,
1627 .setsockopt = l2cap_sock_setsockopt,
1628 .getsockopt = l2cap_sock_getsockopt
1631 static const struct net_proto_family l2cap_sock_family_ops = {
1632 .family = PF_BLUETOOTH,
1633 .owner = THIS_MODULE,
1634 .create = l2cap_sock_create,
1637 int __init l2cap_init_sockets(void)
1641 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1643 err = proto_register(&l2cap_proto, 0);
1647 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1649 BT_ERR("L2CAP socket registration failed");
1653 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1656 BT_ERR("Failed to create L2CAP proc file");
1657 bt_sock_unregister(BTPROTO_L2CAP);
1661 BT_INFO("L2CAP socket layer initialized");
1666 proto_unregister(&l2cap_proto);
1670 void l2cap_cleanup_sockets(void)
1672 bt_procfs_cleanup(&init_net, "l2cap");
1673 bt_sock_unregister(BTPROTO_L2CAP);
1674 proto_unregister(&l2cap_proto);