2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
39 static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
43 static const struct proto_ops l2cap_sock_ops;
44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio, int kern);
48 bool l2cap_is_socket(struct socket *sock)
50 return sock && sock->ops == &l2cap_sock_ops;
52 EXPORT_SYMBOL(l2cap_is_socket);
54 static int l2cap_validate_bredr_psm(u16 psm)
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm & 0x0101) != 0x0001)
60 /* Restrict usage of well-known PSMs */
61 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
67 static int l2cap_validate_le_psm(u16 psm)
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
82 struct sock *sk = sock->sk;
83 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
84 struct sockaddr_l2 la;
89 if (!addr || addr->sa_family != AF_BLUETOOTH)
92 memset(&la, 0, sizeof(la));
93 len = min_t(unsigned int, sizeof(la), alen);
94 memcpy(&la, addr, len);
96 if (la.l2_cid && la.l2_psm)
99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
103 /* We only allow ATT user space socket */
105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
111 if (sk->sk_state != BT_OPEN) {
117 __u16 psm = __le16_to_cpu(la.l2_psm);
119 if (la.l2_bdaddr_type == BDADDR_BREDR)
120 err = l2cap_validate_bredr_psm(psm);
122 err = l2cap_validate_le_psm(psm);
129 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
131 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
136 switch (chan->chan_type) {
137 case L2CAP_CHAN_CONN_LESS:
138 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
139 chan->sec_level = BT_SECURITY_SDP;
141 case L2CAP_CHAN_CONN_ORIENTED:
142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
143 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
144 chan->sec_level = BT_SECURITY_SDP;
147 chan->sec_level = BT_SECURITY_SDP;
149 case L2CAP_CHAN_FIXED:
150 /* Fixed channels default to the L2CAP core not holding a
151 * hci_conn reference for them. For fixed channels mapping to
152 * L2CAP sockets we do want to hold a reference so set the
153 * appropriate flag to request it.
155 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
159 bacpy(&chan->src, &la.l2_bdaddr);
160 chan->src_type = la.l2_bdaddr_type;
162 if (chan->psm && bdaddr_type_is_le(chan->src_type))
163 chan->mode = L2CAP_MODE_LE_FLOWCTL;
165 chan->state = BT_BOUND;
166 sk->sk_state = BT_BOUND;
173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
176 struct sock *sk = sock->sk;
177 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
178 struct sockaddr_l2 la;
183 if (!addr || alen < sizeof(addr->sa_family) ||
184 addr->sa_family != AF_BLUETOOTH)
187 memset(&la, 0, sizeof(la));
188 len = min_t(unsigned int, sizeof(la), alen);
189 memcpy(&la, addr, len);
191 if (la.l2_cid && la.l2_psm)
194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
197 /* Check that the socket wasn't bound to something that
198 * conflicts with the address given to connect(). If chan->src
199 * is BDADDR_ANY it means bind() was never used, in which case
200 * chan->src_type and la.l2_bdaddr_type do not need to match.
202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
203 bdaddr_type_is_le(la.l2_bdaddr_type)) {
204 /* Old user space versions will try to incorrectly bind
205 * the ATT socket using BDADDR_BREDR. We need to accept
206 * this and fix up the source address type only when
207 * both the source CID and destination CID indicate
208 * ATT. Anything else is an invalid combination.
210 if (chan->scid != L2CAP_CID_ATT ||
211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
214 /* We don't have the hdev available here to make a
215 * better decision on random vs public, but since all
216 * user space versions that exhibit this issue anyway do
217 * not support random local addresses assuming public
218 * here is good enough.
220 chan->src_type = BDADDR_LE_PUBLIC;
223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
227 /* We only allow ATT user space socket */
229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
233 if (chan->psm && bdaddr_type_is_le(chan->src_type))
234 chan->mode = L2CAP_MODE_LE_FLOWCTL;
236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
237 &la.l2_bdaddr, la.l2_bdaddr_type);
243 err = bt_sock_wait_state(sk, BT_CONNECTED,
244 sock_sndtimeo(sk, flags & O_NONBLOCK));
251 static int l2cap_sock_listen(struct socket *sock, int backlog)
253 struct sock *sk = sock->sk;
254 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
257 BT_DBG("sk %p backlog %d", sk, backlog);
261 if (sk->sk_state != BT_BOUND) {
266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
271 switch (chan->mode) {
272 case L2CAP_MODE_BASIC:
273 case L2CAP_MODE_LE_FLOWCTL:
275 case L2CAP_MODE_ERTM:
276 case L2CAP_MODE_STREAMING:
285 sk->sk_max_ack_backlog = backlog;
286 sk->sk_ack_backlog = 0;
288 /* Listening channels need to use nested locking in order not to
289 * cause lockdep warnings when the created child channels end up
290 * being locked in the same thread as the parent channel.
292 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
294 chan->state = BT_LISTEN;
295 sk->sk_state = BT_LISTEN;
302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
305 DEFINE_WAIT_FUNC(wait, woken_wake_function);
306 struct sock *sk = sock->sk, *nsk;
310 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
312 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
314 BT_DBG("sk %p timeo %ld", sk, timeo);
316 /* Wait for an incoming connection. (wake-one). */
317 add_wait_queue_exclusive(sk_sleep(sk), &wait);
319 if (sk->sk_state != BT_LISTEN) {
324 nsk = bt_accept_dequeue(sk, newsock);
333 if (signal_pending(current)) {
334 err = sock_intr_errno(timeo);
340 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
342 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
344 remove_wait_queue(sk_sleep(sk), &wait);
349 newsock->state = SS_CONNECTED;
351 BT_DBG("new socket %p", nsk);
358 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
361 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
362 struct sock *sk = sock->sk;
363 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
365 BT_DBG("sock %p, sk %p", sock, sk);
367 if (peer && sk->sk_state != BT_CONNECTED &&
368 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
369 sk->sk_state != BT_CONFIG)
372 memset(la, 0, sizeof(struct sockaddr_l2));
373 addr->sa_family = AF_BLUETOOTH;
374 *len = sizeof(struct sockaddr_l2);
376 la->l2_psm = chan->psm;
379 bacpy(&la->l2_bdaddr, &chan->dst);
380 la->l2_cid = cpu_to_le16(chan->dcid);
381 la->l2_bdaddr_type = chan->dst_type;
383 bacpy(&la->l2_bdaddr, &chan->src);
384 la->l2_cid = cpu_to_le16(chan->scid);
385 la->l2_bdaddr_type = chan->src_type;
391 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
392 char __user *optval, int __user *optlen)
394 struct sock *sk = sock->sk;
395 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
396 struct l2cap_options opts;
397 struct l2cap_conninfo cinfo;
403 if (get_user(len, optlen))
410 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
411 * legacy ATT code depends on getsockopt for
412 * L2CAP_OPTIONS we need to let this pass.
414 if (bdaddr_type_is_le(chan->src_type) &&
415 chan->scid != L2CAP_CID_ATT) {
420 memset(&opts, 0, sizeof(opts));
421 opts.imtu = chan->imtu;
422 opts.omtu = chan->omtu;
423 opts.flush_to = chan->flush_to;
424 opts.mode = chan->mode;
425 opts.fcs = chan->fcs;
426 opts.max_tx = chan->max_tx;
427 opts.txwin_size = chan->tx_win;
429 len = min_t(unsigned int, len, sizeof(opts));
430 if (copy_to_user(optval, (char *) &opts, len))
436 switch (chan->sec_level) {
437 case BT_SECURITY_LOW:
440 case BT_SECURITY_MEDIUM:
441 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
443 case BT_SECURITY_HIGH:
444 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
447 case BT_SECURITY_FIPS:
448 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
449 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
456 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
457 opt |= L2CAP_LM_MASTER;
459 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
460 opt |= L2CAP_LM_RELIABLE;
462 if (put_user(opt, (u32 __user *) optval))
468 if (sk->sk_state != BT_CONNECTED &&
469 !(sk->sk_state == BT_CONNECT2 &&
470 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
475 memset(&cinfo, 0, sizeof(cinfo));
476 cinfo.hci_handle = chan->conn->hcon->handle;
477 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
479 len = min_t(unsigned int, len, sizeof(cinfo));
480 if (copy_to_user(optval, (char *) &cinfo, len))
494 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
495 char __user *optval, int __user *optlen)
497 struct sock *sk = sock->sk;
498 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
499 struct bt_security sec;
505 if (level == SOL_L2CAP)
506 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
508 if (level != SOL_BLUETOOTH)
511 if (get_user(len, optlen))
518 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
519 chan->chan_type != L2CAP_CHAN_FIXED &&
520 chan->chan_type != L2CAP_CHAN_RAW) {
525 memset(&sec, 0, sizeof(sec));
527 sec.level = chan->conn->hcon->sec_level;
529 if (sk->sk_state == BT_CONNECTED)
530 sec.key_size = chan->conn->hcon->enc_key_size;
532 sec.level = chan->sec_level;
535 len = min_t(unsigned int, len, sizeof(sec));
536 if (copy_to_user(optval, (char *) &sec, len))
542 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
547 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
548 (u32 __user *) optval))
554 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
555 (u32 __user *) optval))
561 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
562 && sk->sk_type != SOCK_RAW) {
567 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
569 len = min_t(unsigned int, len, sizeof(pwr));
570 if (copy_to_user(optval, (char *) &pwr, len))
575 case BT_CHANNEL_POLICY:
576 if (put_user(chan->chan_policy, (u32 __user *) optval))
581 if (!bdaddr_type_is_le(chan->src_type)) {
586 if (sk->sk_state != BT_CONNECTED) {
591 if (put_user(chan->omtu, (u16 __user *) optval))
596 if (!bdaddr_type_is_le(chan->src_type)) {
601 if (put_user(chan->imtu, (u16 __user *) optval))
614 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
616 switch (chan->scid) {
618 if (mtu < L2CAP_LE_MIN_MTU)
623 if (mtu < L2CAP_DEFAULT_MIN_MTU)
630 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
631 char __user *optval, unsigned int optlen)
633 struct sock *sk = sock->sk;
634 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
635 struct l2cap_options opts;
645 if (bdaddr_type_is_le(chan->src_type)) {
650 if (sk->sk_state == BT_CONNECTED) {
655 opts.imtu = chan->imtu;
656 opts.omtu = chan->omtu;
657 opts.flush_to = chan->flush_to;
658 opts.mode = chan->mode;
659 opts.fcs = chan->fcs;
660 opts.max_tx = chan->max_tx;
661 opts.txwin_size = chan->tx_win;
663 len = min_t(unsigned int, sizeof(opts), optlen);
664 if (copy_from_user((char *) &opts, optval, len)) {
669 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
674 if (!l2cap_valid_mtu(chan, opts.imtu)) {
679 chan->mode = opts.mode;
680 switch (chan->mode) {
681 case L2CAP_MODE_LE_FLOWCTL:
683 case L2CAP_MODE_BASIC:
684 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
686 case L2CAP_MODE_ERTM:
687 case L2CAP_MODE_STREAMING:
696 chan->imtu = opts.imtu;
697 chan->omtu = opts.omtu;
698 chan->fcs = opts.fcs;
699 chan->max_tx = opts.max_tx;
700 chan->tx_win = opts.txwin_size;
701 chan->flush_to = opts.flush_to;
705 if (get_user(opt, (u32 __user *) optval)) {
710 if (opt & L2CAP_LM_FIPS) {
715 if (opt & L2CAP_LM_AUTH)
716 chan->sec_level = BT_SECURITY_LOW;
717 if (opt & L2CAP_LM_ENCRYPT)
718 chan->sec_level = BT_SECURITY_MEDIUM;
719 if (opt & L2CAP_LM_SECURE)
720 chan->sec_level = BT_SECURITY_HIGH;
722 if (opt & L2CAP_LM_MASTER)
723 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
725 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
727 if (opt & L2CAP_LM_RELIABLE)
728 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
730 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
742 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
743 char __user *optval, unsigned int optlen)
745 struct sock *sk = sock->sk;
746 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
747 struct bt_security sec;
749 struct l2cap_conn *conn;
755 if (level == SOL_L2CAP)
756 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
758 if (level != SOL_BLUETOOTH)
765 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
766 chan->chan_type != L2CAP_CHAN_FIXED &&
767 chan->chan_type != L2CAP_CHAN_RAW) {
772 sec.level = BT_SECURITY_LOW;
774 len = min_t(unsigned int, sizeof(sec), optlen);
775 if (copy_from_user((char *) &sec, optval, len)) {
780 if (sec.level < BT_SECURITY_LOW ||
781 sec.level > BT_SECURITY_HIGH) {
786 chan->sec_level = sec.level;
793 /*change security for LE channels */
794 if (chan->scid == L2CAP_CID_ATT) {
795 if (smp_conn_security(conn->hcon, sec.level))
797 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
798 sk->sk_state = BT_CONFIG;
799 chan->state = BT_CONFIG;
801 /* or for ACL link */
802 } else if ((sk->sk_state == BT_CONNECT2 &&
803 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
804 sk->sk_state == BT_CONNECTED) {
805 if (!l2cap_chan_check_security(chan, true))
806 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
808 sk->sk_state_change(sk);
815 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
820 if (get_user(opt, (u32 __user *) optval)) {
826 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
827 set_bit(FLAG_DEFER_SETUP, &chan->flags);
829 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
830 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
835 if (get_user(opt, (u32 __user *) optval)) {
840 if (opt > BT_FLUSHABLE_ON) {
845 if (opt == BT_FLUSHABLE_OFF) {
847 /* proceed further only when we have l2cap_conn and
848 No Flush support in the LM */
849 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
856 set_bit(FLAG_FLUSHABLE, &chan->flags);
858 clear_bit(FLAG_FLUSHABLE, &chan->flags);
862 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
863 chan->chan_type != L2CAP_CHAN_RAW) {
868 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
870 len = min_t(unsigned int, sizeof(pwr), optlen);
871 if (copy_from_user((char *) &pwr, optval, len)) {
876 if (pwr.force_active)
877 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
879 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
882 case BT_CHANNEL_POLICY:
883 if (get_user(opt, (u32 __user *) optval)) {
888 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
893 if (chan->mode != L2CAP_MODE_ERTM &&
894 chan->mode != L2CAP_MODE_STREAMING) {
899 chan->chan_policy = (u8) opt;
901 if (sk->sk_state == BT_CONNECTED &&
902 chan->move_role == L2CAP_MOVE_ROLE_NONE)
903 l2cap_move_start(chan);
908 if (!bdaddr_type_is_le(chan->src_type)) {
913 /* Setting is not supported as it's the remote side that
920 if (!bdaddr_type_is_le(chan->src_type)) {
925 if (sk->sk_state == BT_CONNECTED) {
930 if (get_user(opt, (u16 __user *) optval)) {
947 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
950 struct sock *sk = sock->sk;
951 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
954 BT_DBG("sock %p, sk %p", sock, sk);
956 err = sock_error(sk);
960 if (msg->msg_flags & MSG_OOB)
963 if (sk->sk_state != BT_CONNECTED)
967 err = bt_sock_wait_ready(sk, msg->msg_flags);
972 l2cap_chan_lock(chan);
973 err = l2cap_chan_send(chan, msg, len);
974 l2cap_chan_unlock(chan);
979 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
980 size_t len, int flags)
982 struct sock *sk = sock->sk;
983 struct l2cap_pinfo *pi = l2cap_pi(sk);
988 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
989 &bt_sk(sk)->flags)) {
990 if (bdaddr_type_is_le(pi->chan->src_type)) {
991 sk->sk_state = BT_CONNECTED;
992 pi->chan->state = BT_CONNECTED;
993 __l2cap_le_connect_rsp_defer(pi->chan);
995 sk->sk_state = BT_CONFIG;
996 pi->chan->state = BT_CONFIG;
997 __l2cap_connect_rsp_defer(pi->chan);
1006 if (sock->type == SOCK_STREAM)
1007 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1009 err = bt_sock_recvmsg(sock, msg, len, flags);
1011 if (pi->chan->mode != L2CAP_MODE_ERTM)
1014 /* Attempt to put pending rx data in the socket buffer */
1018 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1021 if (pi->rx_busy_skb) {
1022 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1023 pi->rx_busy_skb = NULL;
1028 /* Restore data flow when half of the receive buffer is
1029 * available. This avoids resending large numbers of
1032 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1033 l2cap_chan_busy(pi->chan, 0);
1040 /* Kill socket (only if zapped and orphan)
1041 * Must be called on unlocked socket, with l2cap channel lock.
1043 static void l2cap_sock_kill(struct sock *sk)
1045 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1048 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1050 /* Kill poor orphan */
1052 l2cap_chan_put(l2cap_pi(sk)->chan);
1053 sock_set_flag(sk, SOCK_DEAD);
1057 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1059 DECLARE_WAITQUEUE(wait, current);
1061 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1062 /* Timeout to prevent infinite loop */
1063 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1065 add_wait_queue(sk_sleep(sk), &wait);
1066 set_current_state(TASK_INTERRUPTIBLE);
1068 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1069 chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1070 jiffies_to_msecs(timeout - jiffies));
1073 timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1075 if (signal_pending(current)) {
1076 err = sock_intr_errno(timeo);
1081 timeo = schedule_timeout(timeo);
1083 set_current_state(TASK_INTERRUPTIBLE);
1085 err = sock_error(sk);
1089 if (time_after(jiffies, timeout)) {
1094 } while (chan->unacked_frames > 0 &&
1095 chan->state == BT_CONNECTED);
1097 set_current_state(TASK_RUNNING);
1098 remove_wait_queue(sk_sleep(sk), &wait);
1102 static int l2cap_sock_shutdown(struct socket *sock, int how)
1104 struct sock *sk = sock->sk;
1105 struct l2cap_chan *chan;
1106 struct l2cap_conn *conn;
1109 BT_DBG("sock %p, sk %p", sock, sk);
1116 if (sk->sk_shutdown)
1117 goto shutdown_already;
1119 BT_DBG("Handling sock shutdown");
1121 /* prevent sk structure from being freed whilst unlocked */
1124 chan = l2cap_pi(sk)->chan;
1125 /* prevent chan structure from being freed whilst unlocked */
1126 l2cap_chan_hold(chan);
1128 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1130 if (chan->mode == L2CAP_MODE_ERTM &&
1131 chan->unacked_frames > 0 &&
1132 chan->state == BT_CONNECTED) {
1133 err = __l2cap_wait_ack(sk, chan);
1135 /* After waiting for ACKs, check whether shutdown
1136 * has already been actioned to close the L2CAP
1137 * link such as by l2cap_disconnection_req().
1139 if (sk->sk_shutdown)
1143 sk->sk_shutdown = SHUTDOWN_MASK;
1146 l2cap_chan_lock(chan);
1149 /* prevent conn structure from being freed */
1150 l2cap_conn_get(conn);
1151 l2cap_chan_unlock(chan);
1154 /* mutex lock must be taken before l2cap_chan_lock() */
1155 mutex_lock(&conn->chan_lock);
1157 l2cap_chan_lock(chan);
1158 l2cap_chan_close(chan, 0);
1159 l2cap_chan_unlock(chan);
1162 mutex_unlock(&conn->chan_lock);
1163 l2cap_conn_put(conn);
1168 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1169 !(current->flags & PF_EXITING))
1170 err = bt_sock_wait_state(sk, BT_CLOSED,
1174 l2cap_chan_put(chan);
1178 if (!err && sk->sk_err)
1183 BT_DBG("Sock shutdown complete err: %d", err);
1188 static int l2cap_sock_release(struct socket *sock)
1190 struct sock *sk = sock->sk;
1192 struct l2cap_chan *chan;
1194 BT_DBG("sock %p, sk %p", sock, sk);
1199 bt_sock_unlink(&l2cap_sk_list, sk);
1201 err = l2cap_sock_shutdown(sock, 2);
1202 chan = l2cap_pi(sk)->chan;
1204 l2cap_chan_hold(chan);
1205 l2cap_chan_lock(chan);
1208 l2cap_sock_kill(sk);
1210 l2cap_chan_unlock(chan);
1211 l2cap_chan_put(chan);
1216 static void l2cap_sock_cleanup_listen(struct sock *parent)
1220 BT_DBG("parent %p state %s", parent,
1221 state_to_string(parent->sk_state));
1223 /* Close not yet accepted channels */
1224 while ((sk = bt_accept_dequeue(parent, NULL))) {
1225 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1227 BT_DBG("child chan %p state %s", chan,
1228 state_to_string(chan->state));
1230 l2cap_chan_hold(chan);
1231 l2cap_chan_lock(chan);
1233 __clear_chan_timer(chan);
1234 l2cap_chan_close(chan, ECONNRESET);
1235 l2cap_sock_kill(sk);
1237 l2cap_chan_unlock(chan);
1238 l2cap_chan_put(chan);
1242 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1244 struct sock *sk, *parent = chan->data;
1248 /* Check for backlog size */
1249 if (sk_acceptq_is_full(parent)) {
1250 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1251 release_sock(parent);
1255 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1258 release_sock(parent);
1262 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1264 l2cap_sock_init(sk, parent);
1266 bt_accept_enqueue(parent, sk);
1268 release_sock(parent);
1270 return l2cap_pi(sk)->chan;
1273 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1275 struct sock *sk = chan->data;
1280 if (l2cap_pi(sk)->rx_busy_skb) {
1285 err = sock_queue_rcv_skb(sk, skb);
1287 /* For ERTM, handle one skb that doesn't fit into the recv
1288 * buffer. This is important to do because the data frames
1289 * have already been acked, so the skb cannot be discarded.
1291 * Notify the l2cap core that the buffer is full, so the
1292 * LOCAL_BUSY state is entered and no more frames are
1293 * acked and reassembled until there is buffer space
1296 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1297 l2cap_pi(sk)->rx_busy_skb = skb;
1298 l2cap_chan_busy(chan, 1);
1308 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1310 struct sock *sk = chan->data;
1312 l2cap_sock_kill(sk);
1315 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1317 struct sock *sk = chan->data;
1318 struct sock *parent;
1320 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1322 /* This callback can be called both for server (BT_LISTEN)
1323 * sockets as well as "normal" ones. To avoid lockdep warnings
1324 * with child socket locking (through l2cap_sock_cleanup_listen)
1325 * we need separation into separate nesting levels. The simplest
1326 * way to accomplish this is to inherit the nesting level used
1329 lock_sock_nested(sk, atomic_read(&chan->nesting));
1331 parent = bt_sk(sk)->parent;
1333 switch (chan->state) {
1339 l2cap_sock_cleanup_listen(sk);
1340 sk->sk_state = BT_CLOSED;
1341 chan->state = BT_CLOSED;
1345 sk->sk_state = BT_CLOSED;
1346 chan->state = BT_CLOSED;
1351 bt_accept_unlink(sk);
1352 parent->sk_data_ready(parent);
1354 sk->sk_state_change(sk);
1361 /* Only zap after cleanup to avoid use after free race */
1362 sock_set_flag(sk, SOCK_ZAPPED);
1366 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1369 struct sock *sk = chan->data;
1371 sk->sk_state = state;
1377 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1378 unsigned long hdr_len,
1379 unsigned long len, int nb)
1381 struct sock *sk = chan->data;
1382 struct sk_buff *skb;
1385 l2cap_chan_unlock(chan);
1386 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1387 l2cap_chan_lock(chan);
1390 return ERR_PTR(err);
1392 skb->priority = sk->sk_priority;
1394 bt_cb(skb)->l2cap.chan = chan;
1399 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1401 struct sock *sk = chan->data;
1402 struct sock *parent;
1406 parent = bt_sk(sk)->parent;
1408 BT_DBG("sk %p, parent %p", sk, parent);
1410 sk->sk_state = BT_CONNECTED;
1411 sk->sk_state_change(sk);
1414 parent->sk_data_ready(parent);
1419 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1421 struct sock *parent, *sk = chan->data;
1425 parent = bt_sk(sk)->parent;
1427 parent->sk_data_ready(parent);
1432 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1434 struct sock *sk = chan->data;
1436 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1437 sk->sk_state = BT_CONNECTED;
1438 chan->state = BT_CONNECTED;
1441 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1442 sk->sk_state_change(sk);
1445 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1447 struct sock *sk = chan->data;
1450 sk->sk_shutdown = SHUTDOWN_MASK;
1454 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1456 struct sock *sk = chan->data;
1458 return sk->sk_sndtimeo;
1461 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1463 struct sock *sk = chan->data;
1465 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1466 sk->sk_state_change(sk);
1469 static const struct l2cap_ops l2cap_chan_ops = {
1470 .name = "L2CAP Socket Interface",
1471 .new_connection = l2cap_sock_new_connection_cb,
1472 .recv = l2cap_sock_recv_cb,
1473 .close = l2cap_sock_close_cb,
1474 .teardown = l2cap_sock_teardown_cb,
1475 .state_change = l2cap_sock_state_change_cb,
1476 .ready = l2cap_sock_ready_cb,
1477 .defer = l2cap_sock_defer_cb,
1478 .resume = l2cap_sock_resume_cb,
1479 .suspend = l2cap_sock_suspend_cb,
1480 .set_shutdown = l2cap_sock_set_shutdown_cb,
1481 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1482 .alloc_skb = l2cap_sock_alloc_skb_cb,
1485 static void l2cap_sock_destruct(struct sock *sk)
1487 BT_DBG("sk %p", sk);
1489 if (l2cap_pi(sk)->chan)
1490 l2cap_chan_put(l2cap_pi(sk)->chan);
1492 if (l2cap_pi(sk)->rx_busy_skb) {
1493 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1494 l2cap_pi(sk)->rx_busy_skb = NULL;
1497 skb_queue_purge(&sk->sk_receive_queue);
1498 skb_queue_purge(&sk->sk_write_queue);
1501 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1504 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1506 memset(la, 0, sizeof(struct sockaddr_l2));
1507 la->l2_family = AF_BLUETOOTH;
1508 la->l2_psm = bt_cb(skb)->l2cap.psm;
1509 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1511 *msg_namelen = sizeof(struct sockaddr_l2);
1514 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1516 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1518 BT_DBG("sk %p", sk);
1521 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1523 sk->sk_type = parent->sk_type;
1524 bt_sk(sk)->flags = bt_sk(parent)->flags;
1526 chan->chan_type = pchan->chan_type;
1527 chan->imtu = pchan->imtu;
1528 chan->omtu = pchan->omtu;
1529 chan->conf_state = pchan->conf_state;
1530 chan->mode = pchan->mode;
1531 chan->fcs = pchan->fcs;
1532 chan->max_tx = pchan->max_tx;
1533 chan->tx_win = pchan->tx_win;
1534 chan->tx_win_max = pchan->tx_win_max;
1535 chan->sec_level = pchan->sec_level;
1536 chan->flags = pchan->flags;
1537 chan->tx_credits = pchan->tx_credits;
1538 chan->rx_credits = pchan->rx_credits;
1540 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1541 chan->scid = pchan->scid;
1542 chan->dcid = pchan->scid;
1545 security_sk_clone(parent, sk);
1547 switch (sk->sk_type) {
1549 chan->chan_type = L2CAP_CHAN_RAW;
1552 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1553 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1555 case SOCK_SEQPACKET:
1557 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1561 chan->imtu = L2CAP_DEFAULT_MTU;
1563 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1564 chan->mode = L2CAP_MODE_ERTM;
1565 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1567 chan->mode = L2CAP_MODE_BASIC;
1570 l2cap_chan_set_defaults(chan);
1573 /* Default config options */
1574 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1577 chan->ops = &l2cap_chan_ops;
1580 static struct proto l2cap_proto = {
1582 .owner = THIS_MODULE,
1583 .obj_size = sizeof(struct l2cap_pinfo)
1586 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1587 int proto, gfp_t prio, int kern)
1590 struct l2cap_chan *chan;
1592 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1596 sock_init_data(sock, sk);
1597 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1599 sk->sk_destruct = l2cap_sock_destruct;
1600 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1602 sock_reset_flag(sk, SOCK_ZAPPED);
1604 sk->sk_protocol = proto;
1605 sk->sk_state = BT_OPEN;
1607 chan = l2cap_chan_create();
1613 l2cap_chan_hold(chan);
1615 l2cap_pi(sk)->chan = chan;
1620 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1625 BT_DBG("sock %p", sock);
1627 sock->state = SS_UNCONNECTED;
1629 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1630 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1631 return -ESOCKTNOSUPPORT;
1633 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1636 sock->ops = &l2cap_sock_ops;
1638 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1642 l2cap_sock_init(sk, NULL);
1643 bt_sock_link(&l2cap_sk_list, sk);
1647 static const struct proto_ops l2cap_sock_ops = {
1648 .family = PF_BLUETOOTH,
1649 .owner = THIS_MODULE,
1650 .release = l2cap_sock_release,
1651 .bind = l2cap_sock_bind,
1652 .connect = l2cap_sock_connect,
1653 .listen = l2cap_sock_listen,
1654 .accept = l2cap_sock_accept,
1655 .getname = l2cap_sock_getname,
1656 .sendmsg = l2cap_sock_sendmsg,
1657 .recvmsg = l2cap_sock_recvmsg,
1658 .poll = bt_sock_poll,
1659 .ioctl = bt_sock_ioctl,
1660 .mmap = sock_no_mmap,
1661 .socketpair = sock_no_socketpair,
1662 .shutdown = l2cap_sock_shutdown,
1663 .setsockopt = l2cap_sock_setsockopt,
1664 .getsockopt = l2cap_sock_getsockopt
1667 static const struct net_proto_family l2cap_sock_family_ops = {
1668 .family = PF_BLUETOOTH,
1669 .owner = THIS_MODULE,
1670 .create = l2cap_sock_create,
1673 int __init l2cap_init_sockets(void)
1677 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1679 err = proto_register(&l2cap_proto, 0);
1683 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1685 BT_ERR("L2CAP socket registration failed");
1689 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1692 BT_ERR("Failed to create L2CAP proc file");
1693 bt_sock_unregister(BTPROTO_L2CAP);
1697 BT_INFO("L2CAP socket layer initialized");
1702 proto_unregister(&l2cap_proto);
1706 void l2cap_cleanup_sockets(void)
1708 bt_procfs_cleanup(&init_net, "l2cap");
1709 bt_sock_unregister(BTPROTO_L2CAP);
1710 proto_unregister(&l2cap_proto);