2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
39 static struct bt_sock_list l2cap_sk_list = {
40 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
43 static const struct proto_ops l2cap_sock_ops;
44 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
45 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
46 int proto, gfp_t prio, int kern);
48 bool l2cap_is_socket(struct socket *sock)
50 return sock && sock->ops == &l2cap_sock_ops;
52 EXPORT_SYMBOL(l2cap_is_socket);
54 static int l2cap_validate_bredr_psm(u16 psm)
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm & 0x0101) != 0x0001)
60 /* Restrict usage of well-known PSMs */
61 if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
67 static int l2cap_validate_le_psm(u16 psm)
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
70 if (psm > L2CAP_PSM_LE_DYN_END)
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
80 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
82 struct sock *sk = sock->sk;
83 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
84 struct sockaddr_l2 la;
89 if (!addr || addr->sa_family != AF_BLUETOOTH)
92 memset(&la, 0, sizeof(la));
93 len = min_t(unsigned int, sizeof(la), alen);
94 memcpy(&la, addr, len);
96 if (la.l2_cid && la.l2_psm)
99 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
102 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
103 /* We only allow ATT user space socket */
105 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
111 if (sk->sk_state != BT_OPEN) {
117 __u16 psm = __le16_to_cpu(la.l2_psm);
119 if (la.l2_bdaddr_type == BDADDR_BREDR)
120 err = l2cap_validate_bredr_psm(psm);
122 err = l2cap_validate_le_psm(psm);
128 bacpy(&chan->src, &la.l2_bdaddr);
129 chan->src_type = la.l2_bdaddr_type;
132 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
134 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
139 switch (chan->chan_type) {
140 case L2CAP_CHAN_CONN_LESS:
141 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
142 chan->sec_level = BT_SECURITY_SDP;
144 case L2CAP_CHAN_CONN_ORIENTED:
145 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
146 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
147 chan->sec_level = BT_SECURITY_SDP;
150 chan->sec_level = BT_SECURITY_SDP;
152 case L2CAP_CHAN_FIXED:
153 /* Fixed channels default to the L2CAP core not holding a
154 * hci_conn reference for them. For fixed channels mapping to
155 * L2CAP sockets we do want to hold a reference so set the
156 * appropriate flag to request it.
158 set_bit(FLAG_HOLD_HCI_CONN, &chan->flags);
162 if (chan->psm && bdaddr_type_is_le(chan->src_type))
163 chan->mode = L2CAP_MODE_LE_FLOWCTL;
165 chan->state = BT_BOUND;
166 sk->sk_state = BT_BOUND;
173 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
176 struct sock *sk = sock->sk;
177 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
178 struct sockaddr_l2 la;
183 if (!addr || alen < sizeof(addr->sa_family) ||
184 addr->sa_family != AF_BLUETOOTH)
187 memset(&la, 0, sizeof(la));
188 len = min_t(unsigned int, sizeof(la), alen);
189 memcpy(&la, addr, len);
191 if (la.l2_cid && la.l2_psm)
194 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
197 /* Check that the socket wasn't bound to something that
198 * conflicts with the address given to connect(). If chan->src
199 * is BDADDR_ANY it means bind() was never used, in which case
200 * chan->src_type and la.l2_bdaddr_type do not need to match.
202 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
203 bdaddr_type_is_le(la.l2_bdaddr_type)) {
204 /* Old user space versions will try to incorrectly bind
205 * the ATT socket using BDADDR_BREDR. We need to accept
206 * this and fix up the source address type only when
207 * both the source CID and destination CID indicate
208 * ATT. Anything else is an invalid combination.
210 if (chan->scid != L2CAP_CID_ATT ||
211 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
214 /* We don't have the hdev available here to make a
215 * better decision on random vs public, but since all
216 * user space versions that exhibit this issue anyway do
217 * not support random local addresses assuming public
218 * here is good enough.
220 chan->src_type = BDADDR_LE_PUBLIC;
223 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
226 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
227 /* We only allow ATT user space socket */
229 la.l2_cid != cpu_to_le16(L2CAP_CID_ATT))
233 if (chan->psm && bdaddr_type_is_le(chan->src_type))
234 chan->mode = L2CAP_MODE_LE_FLOWCTL;
236 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
237 &la.l2_bdaddr, la.l2_bdaddr_type);
243 err = bt_sock_wait_state(sk, BT_CONNECTED,
244 sock_sndtimeo(sk, flags & O_NONBLOCK));
251 static int l2cap_sock_listen(struct socket *sock, int backlog)
253 struct sock *sk = sock->sk;
254 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
257 BT_DBG("sk %p backlog %d", sk, backlog);
261 if (sk->sk_state != BT_BOUND) {
266 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
271 switch (chan->mode) {
272 case L2CAP_MODE_BASIC:
273 case L2CAP_MODE_LE_FLOWCTL:
275 case L2CAP_MODE_ERTM:
276 case L2CAP_MODE_STREAMING:
285 sk->sk_max_ack_backlog = backlog;
286 sk->sk_ack_backlog = 0;
288 /* Listening channels need to use nested locking in order not to
289 * cause lockdep warnings when the created child channels end up
290 * being locked in the same thread as the parent channel.
292 atomic_set(&chan->nesting, L2CAP_NESTING_PARENT);
294 chan->state = BT_LISTEN;
295 sk->sk_state = BT_LISTEN;
302 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
305 DEFINE_WAIT_FUNC(wait, woken_wake_function);
306 struct sock *sk = sock->sk, *nsk;
310 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
312 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
314 BT_DBG("sk %p timeo %ld", sk, timeo);
316 /* Wait for an incoming connection. (wake-one). */
317 add_wait_queue_exclusive(sk_sleep(sk), &wait);
319 if (sk->sk_state != BT_LISTEN) {
324 nsk = bt_accept_dequeue(sk, newsock);
333 if (signal_pending(current)) {
334 err = sock_intr_errno(timeo);
340 timeo = wait_woken(&wait, TASK_INTERRUPTIBLE, timeo);
342 lock_sock_nested(sk, L2CAP_NESTING_PARENT);
344 remove_wait_queue(sk_sleep(sk), &wait);
349 newsock->state = SS_CONNECTED;
351 BT_DBG("new socket %p", nsk);
358 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
361 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
362 struct sock *sk = sock->sk;
363 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
365 BT_DBG("sock %p, sk %p", sock, sk);
367 if (peer && sk->sk_state != BT_CONNECTED &&
368 sk->sk_state != BT_CONNECT && sk->sk_state != BT_CONNECT2 &&
369 sk->sk_state != BT_CONFIG)
372 memset(la, 0, sizeof(struct sockaddr_l2));
373 addr->sa_family = AF_BLUETOOTH;
374 *len = sizeof(struct sockaddr_l2);
376 la->l2_psm = chan->psm;
379 bacpy(&la->l2_bdaddr, &chan->dst);
380 la->l2_cid = cpu_to_le16(chan->dcid);
381 la->l2_bdaddr_type = chan->dst_type;
383 bacpy(&la->l2_bdaddr, &chan->src);
384 la->l2_cid = cpu_to_le16(chan->scid);
385 la->l2_bdaddr_type = chan->src_type;
391 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
392 char __user *optval, int __user *optlen)
394 struct sock *sk = sock->sk;
395 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
396 struct l2cap_options opts;
397 struct l2cap_conninfo cinfo;
403 if (get_user(len, optlen))
410 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
411 * legacy ATT code depends on getsockopt for
412 * L2CAP_OPTIONS we need to let this pass.
414 if (bdaddr_type_is_le(chan->src_type) &&
415 chan->scid != L2CAP_CID_ATT) {
420 memset(&opts, 0, sizeof(opts));
421 opts.imtu = chan->imtu;
422 opts.omtu = chan->omtu;
423 opts.flush_to = chan->flush_to;
424 opts.mode = chan->mode;
425 opts.fcs = chan->fcs;
426 opts.max_tx = chan->max_tx;
427 opts.txwin_size = chan->tx_win;
429 len = min_t(unsigned int, len, sizeof(opts));
430 if (copy_to_user(optval, (char *) &opts, len))
436 switch (chan->sec_level) {
437 case BT_SECURITY_LOW:
440 case BT_SECURITY_MEDIUM:
441 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
443 case BT_SECURITY_HIGH:
444 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
447 case BT_SECURITY_FIPS:
448 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
449 L2CAP_LM_SECURE | L2CAP_LM_FIPS;
456 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
457 opt |= L2CAP_LM_MASTER;
459 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
460 opt |= L2CAP_LM_RELIABLE;
462 if (put_user(opt, (u32 __user *) optval))
468 if (sk->sk_state != BT_CONNECTED &&
469 !(sk->sk_state == BT_CONNECT2 &&
470 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
475 memset(&cinfo, 0, sizeof(cinfo));
476 cinfo.hci_handle = chan->conn->hcon->handle;
477 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
479 len = min_t(unsigned int, len, sizeof(cinfo));
480 if (copy_to_user(optval, (char *) &cinfo, len))
494 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
495 char __user *optval, int __user *optlen)
497 struct sock *sk = sock->sk;
498 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
499 struct bt_security sec;
505 if (level == SOL_L2CAP)
506 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
508 if (level != SOL_BLUETOOTH)
511 if (get_user(len, optlen))
518 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
519 chan->chan_type != L2CAP_CHAN_FIXED &&
520 chan->chan_type != L2CAP_CHAN_RAW) {
525 memset(&sec, 0, sizeof(sec));
527 sec.level = chan->conn->hcon->sec_level;
529 if (sk->sk_state == BT_CONNECTED)
530 sec.key_size = chan->conn->hcon->enc_key_size;
532 sec.level = chan->sec_level;
535 len = min_t(unsigned int, len, sizeof(sec));
536 if (copy_to_user(optval, (char *) &sec, len))
542 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
547 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
548 (u32 __user *) optval))
554 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
555 (u32 __user *) optval))
561 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
562 && sk->sk_type != SOCK_RAW) {
567 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
569 len = min_t(unsigned int, len, sizeof(pwr));
570 if (copy_to_user(optval, (char *) &pwr, len))
575 case BT_CHANNEL_POLICY:
576 if (put_user(chan->chan_policy, (u32 __user *) optval))
581 if (!bdaddr_type_is_le(chan->src_type)) {
586 if (sk->sk_state != BT_CONNECTED) {
591 if (put_user(chan->omtu, (u16 __user *) optval))
596 if (!bdaddr_type_is_le(chan->src_type)) {
601 if (put_user(chan->imtu, (u16 __user *) optval))
614 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
616 switch (chan->scid) {
618 if (mtu < L2CAP_LE_MIN_MTU)
623 if (mtu < L2CAP_DEFAULT_MIN_MTU)
630 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
631 char __user *optval, unsigned int optlen)
633 struct sock *sk = sock->sk;
634 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
635 struct l2cap_options opts;
645 if (bdaddr_type_is_le(chan->src_type)) {
650 if (sk->sk_state == BT_CONNECTED) {
655 opts.imtu = chan->imtu;
656 opts.omtu = chan->omtu;
657 opts.flush_to = chan->flush_to;
658 opts.mode = chan->mode;
659 opts.fcs = chan->fcs;
660 opts.max_tx = chan->max_tx;
661 opts.txwin_size = chan->tx_win;
663 len = min_t(unsigned int, sizeof(opts), optlen);
664 if (copy_from_user((char *) &opts, optval, len)) {
669 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
674 if (!l2cap_valid_mtu(chan, opts.imtu)) {
679 chan->mode = opts.mode;
680 switch (chan->mode) {
681 case L2CAP_MODE_LE_FLOWCTL:
683 case L2CAP_MODE_BASIC:
684 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
686 case L2CAP_MODE_ERTM:
687 case L2CAP_MODE_STREAMING:
696 chan->imtu = opts.imtu;
697 chan->omtu = opts.omtu;
698 chan->fcs = opts.fcs;
699 chan->max_tx = opts.max_tx;
700 chan->tx_win = opts.txwin_size;
701 chan->flush_to = opts.flush_to;
705 if (get_user(opt, (u32 __user *) optval)) {
710 if (opt & L2CAP_LM_FIPS) {
715 if (opt & L2CAP_LM_AUTH)
716 chan->sec_level = BT_SECURITY_LOW;
717 if (opt & L2CAP_LM_ENCRYPT)
718 chan->sec_level = BT_SECURITY_MEDIUM;
719 if (opt & L2CAP_LM_SECURE)
720 chan->sec_level = BT_SECURITY_HIGH;
722 if (opt & L2CAP_LM_MASTER)
723 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
725 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
727 if (opt & L2CAP_LM_RELIABLE)
728 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
730 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
742 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
743 char __user *optval, unsigned int optlen)
745 struct sock *sk = sock->sk;
746 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
747 struct bt_security sec;
749 struct l2cap_conn *conn;
755 if (level == SOL_L2CAP)
756 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
758 if (level != SOL_BLUETOOTH)
765 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
766 chan->chan_type != L2CAP_CHAN_FIXED &&
767 chan->chan_type != L2CAP_CHAN_RAW) {
772 sec.level = BT_SECURITY_LOW;
774 len = min_t(unsigned int, sizeof(sec), optlen);
775 if (copy_from_user((char *) &sec, optval, len)) {
780 if (sec.level < BT_SECURITY_LOW ||
781 sec.level > BT_SECURITY_FIPS) {
786 chan->sec_level = sec.level;
793 /*change security for LE channels */
794 if (chan->scid == L2CAP_CID_ATT) {
795 if (smp_conn_security(conn->hcon, sec.level))
797 set_bit(FLAG_PENDING_SECURITY, &chan->flags);
798 sk->sk_state = BT_CONFIG;
799 chan->state = BT_CONFIG;
801 /* or for ACL link */
802 } else if ((sk->sk_state == BT_CONNECT2 &&
803 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
804 sk->sk_state == BT_CONNECTED) {
805 if (!l2cap_chan_check_security(chan, true))
806 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
808 sk->sk_state_change(sk);
815 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
820 if (get_user(opt, (u32 __user *) optval)) {
826 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
827 set_bit(FLAG_DEFER_SETUP, &chan->flags);
829 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
830 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
835 if (get_user(opt, (u32 __user *) optval)) {
840 if (opt > BT_FLUSHABLE_ON) {
845 if (opt == BT_FLUSHABLE_OFF) {
847 /* proceed further only when we have l2cap_conn and
848 No Flush support in the LM */
849 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
856 set_bit(FLAG_FLUSHABLE, &chan->flags);
858 clear_bit(FLAG_FLUSHABLE, &chan->flags);
862 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
863 chan->chan_type != L2CAP_CHAN_RAW) {
868 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
870 len = min_t(unsigned int, sizeof(pwr), optlen);
871 if (copy_from_user((char *) &pwr, optval, len)) {
876 if (pwr.force_active)
877 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
879 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
882 case BT_CHANNEL_POLICY:
883 if (get_user(opt, (u32 __user *) optval)) {
888 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
893 if (chan->mode != L2CAP_MODE_ERTM &&
894 chan->mode != L2CAP_MODE_STREAMING) {
899 chan->chan_policy = (u8) opt;
901 if (sk->sk_state == BT_CONNECTED &&
902 chan->move_role == L2CAP_MOVE_ROLE_NONE)
903 l2cap_move_start(chan);
908 if (!bdaddr_type_is_le(chan->src_type)) {
913 /* Setting is not supported as it's the remote side that
920 if (!bdaddr_type_is_le(chan->src_type)) {
925 if (sk->sk_state == BT_CONNECTED) {
930 if (get_user(opt, (u16 __user *) optval)) {
947 static int l2cap_sock_sendmsg(struct socket *sock, struct msghdr *msg,
950 struct sock *sk = sock->sk;
951 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
954 BT_DBG("sock %p, sk %p", sock, sk);
956 err = sock_error(sk);
960 if (msg->msg_flags & MSG_OOB)
963 if (sk->sk_state != BT_CONNECTED)
967 err = bt_sock_wait_ready(sk, msg->msg_flags);
972 l2cap_chan_lock(chan);
973 err = l2cap_chan_send(chan, msg, len);
974 l2cap_chan_unlock(chan);
979 static int l2cap_sock_recvmsg(struct socket *sock, struct msghdr *msg,
980 size_t len, int flags)
982 struct sock *sk = sock->sk;
983 struct l2cap_pinfo *pi = l2cap_pi(sk);
988 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
989 &bt_sk(sk)->flags)) {
990 if (bdaddr_type_is_le(pi->chan->src_type)) {
991 sk->sk_state = BT_CONNECTED;
992 pi->chan->state = BT_CONNECTED;
993 __l2cap_le_connect_rsp_defer(pi->chan);
995 sk->sk_state = BT_CONFIG;
996 pi->chan->state = BT_CONFIG;
997 __l2cap_connect_rsp_defer(pi->chan);
1006 if (sock->type == SOCK_STREAM)
1007 err = bt_sock_stream_recvmsg(sock, msg, len, flags);
1009 err = bt_sock_recvmsg(sock, msg, len, flags);
1011 if (pi->chan->mode != L2CAP_MODE_ERTM)
1014 /* Attempt to put pending rx data in the socket buffer */
1018 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1021 if (pi->rx_busy_skb) {
1022 if (!__sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1023 pi->rx_busy_skb = NULL;
1028 /* Restore data flow when half of the receive buffer is
1029 * available. This avoids resending large numbers of
1032 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1033 l2cap_chan_busy(pi->chan, 0);
1040 /* Kill socket (only if zapped and orphan)
1041 * Must be called on unlocked socket, with l2cap channel lock.
1043 static void l2cap_sock_kill(struct sock *sk)
1045 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1048 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1050 /* Kill poor orphan */
1052 l2cap_chan_put(l2cap_pi(sk)->chan);
1053 sock_set_flag(sk, SOCK_DEAD);
1057 static int __l2cap_wait_ack(struct sock *sk, struct l2cap_chan *chan)
1059 DECLARE_WAITQUEUE(wait, current);
1061 int timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1062 /* Timeout to prevent infinite loop */
1063 unsigned long timeout = jiffies + L2CAP_WAIT_ACK_TIMEOUT;
1065 add_wait_queue(sk_sleep(sk), &wait);
1066 set_current_state(TASK_INTERRUPTIBLE);
1068 BT_DBG("Waiting for %d ACKs, timeout %04d ms",
1069 chan->unacked_frames, time_after(jiffies, timeout) ? 0 :
1070 jiffies_to_msecs(timeout - jiffies));
1073 timeo = L2CAP_WAIT_ACK_POLL_PERIOD;
1075 if (signal_pending(current)) {
1076 err = sock_intr_errno(timeo);
1081 timeo = schedule_timeout(timeo);
1083 set_current_state(TASK_INTERRUPTIBLE);
1085 err = sock_error(sk);
1089 if (time_after(jiffies, timeout)) {
1094 } while (chan->unacked_frames > 0 &&
1095 chan->state == BT_CONNECTED);
1097 set_current_state(TASK_RUNNING);
1098 remove_wait_queue(sk_sleep(sk), &wait);
1102 static int l2cap_sock_shutdown(struct socket *sock, int how)
1104 struct sock *sk = sock->sk;
1105 struct l2cap_chan *chan;
1106 struct l2cap_conn *conn;
1109 BT_DBG("sock %p, sk %p", sock, sk);
1116 if (sk->sk_shutdown)
1117 goto shutdown_already;
1119 BT_DBG("Handling sock shutdown");
1121 /* prevent sk structure from being freed whilst unlocked */
1124 chan = l2cap_pi(sk)->chan;
1125 /* prevent chan structure from being freed whilst unlocked */
1126 l2cap_chan_hold(chan);
1128 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1130 if (chan->mode == L2CAP_MODE_ERTM &&
1131 chan->unacked_frames > 0 &&
1132 chan->state == BT_CONNECTED) {
1133 err = __l2cap_wait_ack(sk, chan);
1135 /* After waiting for ACKs, check whether shutdown
1136 * has already been actioned to close the L2CAP
1137 * link such as by l2cap_disconnection_req().
1139 if (sk->sk_shutdown)
1143 sk->sk_shutdown = SHUTDOWN_MASK;
1146 l2cap_chan_lock(chan);
1149 /* prevent conn structure from being freed */
1150 l2cap_conn_get(conn);
1151 l2cap_chan_unlock(chan);
1154 /* mutex lock must be taken before l2cap_chan_lock() */
1155 mutex_lock(&conn->chan_lock);
1157 l2cap_chan_lock(chan);
1158 l2cap_chan_close(chan, 0);
1159 l2cap_chan_unlock(chan);
1162 mutex_unlock(&conn->chan_lock);
1163 l2cap_conn_put(conn);
1168 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1169 !(current->flags & PF_EXITING))
1170 err = bt_sock_wait_state(sk, BT_CLOSED,
1174 l2cap_chan_put(chan);
1178 if (!err && sk->sk_err)
1183 BT_DBG("Sock shutdown complete err: %d", err);
1188 static int l2cap_sock_release(struct socket *sock)
1190 struct sock *sk = sock->sk;
1192 struct l2cap_chan *chan;
1194 BT_DBG("sock %p, sk %p", sock, sk);
1199 bt_sock_unlink(&l2cap_sk_list, sk);
1201 err = l2cap_sock_shutdown(sock, 2);
1202 chan = l2cap_pi(sk)->chan;
1204 l2cap_chan_hold(chan);
1205 l2cap_chan_lock(chan);
1208 l2cap_sock_kill(sk);
1210 l2cap_chan_unlock(chan);
1211 l2cap_chan_put(chan);
1216 static void l2cap_sock_cleanup_listen(struct sock *parent)
1220 BT_DBG("parent %p state %s", parent,
1221 state_to_string(parent->sk_state));
1223 /* Close not yet accepted channels */
1224 while ((sk = bt_accept_dequeue(parent, NULL))) {
1225 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1227 BT_DBG("child chan %p state %s", chan,
1228 state_to_string(chan->state));
1230 l2cap_chan_hold(chan);
1231 l2cap_chan_lock(chan);
1233 __clear_chan_timer(chan);
1234 l2cap_chan_close(chan, ECONNRESET);
1235 l2cap_sock_kill(sk);
1237 l2cap_chan_unlock(chan);
1238 l2cap_chan_put(chan);
1242 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1244 struct sock *sk, *parent = chan->data;
1248 /* Check for backlog size */
1249 if (sk_acceptq_is_full(parent)) {
1250 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1251 release_sock(parent);
1255 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1258 release_sock(parent);
1262 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1264 l2cap_sock_init(sk, parent);
1266 bt_accept_enqueue(parent, sk);
1268 release_sock(parent);
1270 return l2cap_pi(sk)->chan;
1273 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1275 struct sock *sk = chan->data;
1280 if (l2cap_pi(sk)->rx_busy_skb) {
1285 if (chan->mode != L2CAP_MODE_ERTM &&
1286 chan->mode != L2CAP_MODE_STREAMING) {
1287 /* Even if no filter is attached, we could potentially
1288 * get errors from security modules, etc.
1290 err = sk_filter(sk, skb);
1295 err = __sock_queue_rcv_skb(sk, skb);
1297 /* For ERTM, handle one skb that doesn't fit into the recv
1298 * buffer. This is important to do because the data frames
1299 * have already been acked, so the skb cannot be discarded.
1301 * Notify the l2cap core that the buffer is full, so the
1302 * LOCAL_BUSY state is entered and no more frames are
1303 * acked and reassembled until there is buffer space
1306 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1307 l2cap_pi(sk)->rx_busy_skb = skb;
1308 l2cap_chan_busy(chan, 1);
1318 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1320 struct sock *sk = chan->data;
1325 l2cap_sock_kill(sk);
1328 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1330 struct sock *sk = chan->data;
1331 struct sock *parent;
1336 BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
1338 /* This callback can be called both for server (BT_LISTEN)
1339 * sockets as well as "normal" ones. To avoid lockdep warnings
1340 * with child socket locking (through l2cap_sock_cleanup_listen)
1341 * we need separation into separate nesting levels. The simplest
1342 * way to accomplish this is to inherit the nesting level used
1345 lock_sock_nested(sk, atomic_read(&chan->nesting));
1347 parent = bt_sk(sk)->parent;
1349 switch (chan->state) {
1355 l2cap_sock_cleanup_listen(sk);
1356 sk->sk_state = BT_CLOSED;
1357 chan->state = BT_CLOSED;
1361 sk->sk_state = BT_CLOSED;
1362 chan->state = BT_CLOSED;
1367 bt_accept_unlink(sk);
1368 parent->sk_data_ready(parent);
1370 sk->sk_state_change(sk);
1377 /* Only zap after cleanup to avoid use after free race */
1378 sock_set_flag(sk, SOCK_ZAPPED);
1382 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1385 struct sock *sk = chan->data;
1387 sk->sk_state = state;
1393 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1394 unsigned long hdr_len,
1395 unsigned long len, int nb)
1397 struct sock *sk = chan->data;
1398 struct sk_buff *skb;
1401 l2cap_chan_unlock(chan);
1402 skb = bt_skb_send_alloc(sk, hdr_len + len, nb, &err);
1403 l2cap_chan_lock(chan);
1406 return ERR_PTR(err);
1408 skb->priority = sk->sk_priority;
1410 bt_cb(skb)->l2cap.chan = chan;
1415 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1417 struct sock *sk = chan->data;
1418 struct sock *parent;
1422 parent = bt_sk(sk)->parent;
1424 BT_DBG("sk %p, parent %p", sk, parent);
1426 sk->sk_state = BT_CONNECTED;
1427 sk->sk_state_change(sk);
1430 parent->sk_data_ready(parent);
1435 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1437 struct sock *parent, *sk = chan->data;
1441 parent = bt_sk(sk)->parent;
1443 parent->sk_data_ready(parent);
1448 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1450 struct sock *sk = chan->data;
1452 if (test_and_clear_bit(FLAG_PENDING_SECURITY, &chan->flags)) {
1453 sk->sk_state = BT_CONNECTED;
1454 chan->state = BT_CONNECTED;
1457 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1458 sk->sk_state_change(sk);
1461 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1463 struct sock *sk = chan->data;
1466 sk->sk_shutdown = SHUTDOWN_MASK;
1470 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1472 struct sock *sk = chan->data;
1474 return sk->sk_sndtimeo;
1477 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1479 struct sock *sk = chan->data;
1481 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1482 sk->sk_state_change(sk);
1485 static int l2cap_sock_filter(struct l2cap_chan *chan, struct sk_buff *skb)
1487 struct sock *sk = chan->data;
1489 switch (chan->mode) {
1490 case L2CAP_MODE_ERTM:
1491 case L2CAP_MODE_STREAMING:
1492 return sk_filter(sk, skb);
1498 static const struct l2cap_ops l2cap_chan_ops = {
1499 .name = "L2CAP Socket Interface",
1500 .new_connection = l2cap_sock_new_connection_cb,
1501 .recv = l2cap_sock_recv_cb,
1502 .close = l2cap_sock_close_cb,
1503 .teardown = l2cap_sock_teardown_cb,
1504 .state_change = l2cap_sock_state_change_cb,
1505 .ready = l2cap_sock_ready_cb,
1506 .defer = l2cap_sock_defer_cb,
1507 .resume = l2cap_sock_resume_cb,
1508 .suspend = l2cap_sock_suspend_cb,
1509 .set_shutdown = l2cap_sock_set_shutdown_cb,
1510 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1511 .alloc_skb = l2cap_sock_alloc_skb_cb,
1512 .filter = l2cap_sock_filter,
1515 static void l2cap_sock_destruct(struct sock *sk)
1517 BT_DBG("sk %p", sk);
1519 if (l2cap_pi(sk)->chan) {
1520 l2cap_pi(sk)->chan->data = NULL;
1521 l2cap_chan_put(l2cap_pi(sk)->chan);
1524 if (l2cap_pi(sk)->rx_busy_skb) {
1525 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1526 l2cap_pi(sk)->rx_busy_skb = NULL;
1529 skb_queue_purge(&sk->sk_receive_queue);
1530 skb_queue_purge(&sk->sk_write_queue);
1533 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1536 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1538 memset(la, 0, sizeof(struct sockaddr_l2));
1539 la->l2_family = AF_BLUETOOTH;
1540 la->l2_psm = bt_cb(skb)->l2cap.psm;
1541 bacpy(&la->l2_bdaddr, &bt_cb(skb)->l2cap.bdaddr);
1543 *msg_namelen = sizeof(struct sockaddr_l2);
1546 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1548 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1550 BT_DBG("sk %p", sk);
1553 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1555 sk->sk_type = parent->sk_type;
1556 bt_sk(sk)->flags = bt_sk(parent)->flags;
1558 chan->chan_type = pchan->chan_type;
1559 chan->imtu = pchan->imtu;
1560 chan->omtu = pchan->omtu;
1561 chan->conf_state = pchan->conf_state;
1562 chan->mode = pchan->mode;
1563 chan->fcs = pchan->fcs;
1564 chan->max_tx = pchan->max_tx;
1565 chan->tx_win = pchan->tx_win;
1566 chan->tx_win_max = pchan->tx_win_max;
1567 chan->sec_level = pchan->sec_level;
1568 chan->flags = pchan->flags;
1569 chan->tx_credits = pchan->tx_credits;
1570 chan->rx_credits = pchan->rx_credits;
1572 if (chan->chan_type == L2CAP_CHAN_FIXED) {
1573 chan->scid = pchan->scid;
1574 chan->dcid = pchan->scid;
1577 security_sk_clone(parent, sk);
1579 switch (sk->sk_type) {
1581 chan->chan_type = L2CAP_CHAN_RAW;
1584 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1585 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1587 case SOCK_SEQPACKET:
1589 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1593 chan->imtu = L2CAP_DEFAULT_MTU;
1595 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1596 chan->mode = L2CAP_MODE_ERTM;
1597 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1599 chan->mode = L2CAP_MODE_BASIC;
1602 l2cap_chan_set_defaults(chan);
1605 /* Default config options */
1606 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1609 chan->ops = &l2cap_chan_ops;
1612 static struct proto l2cap_proto = {
1614 .owner = THIS_MODULE,
1615 .obj_size = sizeof(struct l2cap_pinfo)
1618 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1619 int proto, gfp_t prio, int kern)
1622 struct l2cap_chan *chan;
1624 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto, kern);
1628 sock_init_data(sock, sk);
1629 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1631 sk->sk_destruct = l2cap_sock_destruct;
1632 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1634 sock_reset_flag(sk, SOCK_ZAPPED);
1636 sk->sk_protocol = proto;
1637 sk->sk_state = BT_OPEN;
1639 chan = l2cap_chan_create();
1645 l2cap_chan_hold(chan);
1647 l2cap_pi(sk)->chan = chan;
1652 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1657 BT_DBG("sock %p", sock);
1659 sock->state = SS_UNCONNECTED;
1661 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1662 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1663 return -ESOCKTNOSUPPORT;
1665 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1668 sock->ops = &l2cap_sock_ops;
1670 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC, kern);
1674 l2cap_sock_init(sk, NULL);
1675 bt_sock_link(&l2cap_sk_list, sk);
1679 static const struct proto_ops l2cap_sock_ops = {
1680 .family = PF_BLUETOOTH,
1681 .owner = THIS_MODULE,
1682 .release = l2cap_sock_release,
1683 .bind = l2cap_sock_bind,
1684 .connect = l2cap_sock_connect,
1685 .listen = l2cap_sock_listen,
1686 .accept = l2cap_sock_accept,
1687 .getname = l2cap_sock_getname,
1688 .sendmsg = l2cap_sock_sendmsg,
1689 .recvmsg = l2cap_sock_recvmsg,
1690 .poll = bt_sock_poll,
1691 .ioctl = bt_sock_ioctl,
1692 .mmap = sock_no_mmap,
1693 .socketpair = sock_no_socketpair,
1694 .shutdown = l2cap_sock_shutdown,
1695 .setsockopt = l2cap_sock_setsockopt,
1696 .getsockopt = l2cap_sock_getsockopt
1699 static const struct net_proto_family l2cap_sock_family_ops = {
1700 .family = PF_BLUETOOTH,
1701 .owner = THIS_MODULE,
1702 .create = l2cap_sock_create,
1705 int __init l2cap_init_sockets(void)
1709 BUILD_BUG_ON(sizeof(struct sockaddr_l2) > sizeof(struct sockaddr));
1711 err = proto_register(&l2cap_proto, 0);
1715 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1717 BT_ERR("L2CAP socket registration failed");
1721 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1724 BT_ERR("Failed to create L2CAP proc file");
1725 bt_sock_unregister(BTPROTO_L2CAP);
1729 BT_INFO("L2CAP socket layer initialized");
1734 proto_unregister(&l2cap_proto);
1738 void l2cap_cleanup_sockets(void)
1740 bt_procfs_cleanup(&init_net, "l2cap");
1741 bt_sock_unregister(BTPROTO_L2CAP);
1742 proto_unregister(&l2cap_proto);