2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
41 static struct bt_sock_list l2cap_sk_list = {
42 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
45 static const struct proto_ops l2cap_sock_ops;
46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
48 int proto, gfp_t prio);
50 bool l2cap_is_socket(struct socket *sock)
52 return sock && sock->ops == &l2cap_sock_ops;
54 EXPORT_SYMBOL(l2cap_is_socket);
56 static int l2cap_validate_bredr_psm(u16 psm)
58 /* PSM must be odd and lsb of upper byte must be 0 */
59 if ((psm & 0x0101) != 0x0001)
62 /* Restrict usage of well-known PSMs */
63 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
69 static int l2cap_validate_le_psm(u16 psm)
71 /* Valid LE_PSM ranges are defined only until 0x00ff */
75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
76 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
84 struct sock *sk = sock->sk;
85 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
86 struct sockaddr_l2 la;
91 if (!addr || addr->sa_family != AF_BLUETOOTH)
94 memset(&la, 0, sizeof(la));
95 len = min_t(unsigned int, sizeof(la), alen);
96 memcpy(&la, addr, len);
98 if (la.l2_cid && la.l2_psm)
101 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
104 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
105 if (!enable_lecoc && la.l2_psm)
107 /* We only allow ATT user space socket */
109 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
115 if (sk->sk_state != BT_OPEN) {
121 __u16 psm = __le16_to_cpu(la.l2_psm);
123 if (la.l2_bdaddr_type == BDADDR_BREDR)
124 err = l2cap_validate_bredr_psm(psm);
126 err = l2cap_validate_le_psm(psm);
133 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
135 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
140 switch (chan->chan_type) {
141 case L2CAP_CHAN_CONN_LESS:
142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
143 chan->sec_level = BT_SECURITY_SDP;
145 case L2CAP_CHAN_CONN_ORIENTED:
146 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
147 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
148 chan->sec_level = BT_SECURITY_SDP;
151 chan->sec_level = BT_SECURITY_SDP;
155 bacpy(&chan->src, &la.l2_bdaddr);
156 chan->src_type = la.l2_bdaddr_type;
158 if (chan->psm && bdaddr_type_is_le(chan->src_type))
159 chan->mode = L2CAP_MODE_LE_FLOWCTL;
161 chan->state = BT_BOUND;
162 sk->sk_state = BT_BOUND;
169 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
172 struct sock *sk = sock->sk;
173 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
174 struct sockaddr_l2 la;
179 if (!addr || alen < sizeof(addr->sa_family) ||
180 addr->sa_family != AF_BLUETOOTH)
183 memset(&la, 0, sizeof(la));
184 len = min_t(unsigned int, sizeof(la), alen);
185 memcpy(&la, addr, len);
187 if (la.l2_cid && la.l2_psm)
190 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
193 /* Check that the socket wasn't bound to something that
194 * conflicts with the address given to connect(). If chan->src
195 * is BDADDR_ANY it means bind() was never used, in which case
196 * chan->src_type and la.l2_bdaddr_type do not need to match.
198 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
199 bdaddr_type_is_le(la.l2_bdaddr_type)) {
200 /* Old user space versions will try to incorrectly bind
201 * the ATT socket using BDADDR_BREDR. We need to accept
202 * this and fix up the source address type only when
203 * both the source CID and destination CID indicate
204 * ATT. Anything else is an invalid combination.
206 if (chan->scid != L2CAP_CID_ATT ||
207 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
210 /* We don't have the hdev available here to make a
211 * better decision on random vs public, but since all
212 * user space versions that exhibit this issue anyway do
213 * not support random local addresses assuming public
214 * here is good enough.
216 chan->src_type = BDADDR_LE_PUBLIC;
219 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
222 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
223 if (!enable_lecoc && la.l2_psm)
225 /* We only allow ATT user space socket */
227 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
231 if (chan->psm && bdaddr_type_is_le(chan->src_type))
232 chan->mode = L2CAP_MODE_LE_FLOWCTL;
234 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
235 &la.l2_bdaddr, la.l2_bdaddr_type);
241 err = bt_sock_wait_state(sk, BT_CONNECTED,
242 sock_sndtimeo(sk, flags & O_NONBLOCK));
249 static int l2cap_sock_listen(struct socket *sock, int backlog)
251 struct sock *sk = sock->sk;
252 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
255 BT_DBG("sk %p backlog %d", sk, backlog);
259 if (sk->sk_state != BT_BOUND) {
264 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
269 switch (chan->mode) {
270 case L2CAP_MODE_BASIC:
271 case L2CAP_MODE_LE_FLOWCTL:
273 case L2CAP_MODE_ERTM:
274 case L2CAP_MODE_STREAMING:
283 sk->sk_max_ack_backlog = backlog;
284 sk->sk_ack_backlog = 0;
286 chan->state = BT_LISTEN;
287 sk->sk_state = BT_LISTEN;
294 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
297 DECLARE_WAITQUEUE(wait, current);
298 struct sock *sk = sock->sk, *nsk;
302 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
304 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
306 BT_DBG("sk %p timeo %ld", sk, timeo);
308 /* Wait for an incoming connection. (wake-one). */
309 add_wait_queue_exclusive(sk_sleep(sk), &wait);
311 set_current_state(TASK_INTERRUPTIBLE);
313 if (sk->sk_state != BT_LISTEN) {
318 nsk = bt_accept_dequeue(sk, newsock);
327 if (signal_pending(current)) {
328 err = sock_intr_errno(timeo);
333 timeo = schedule_timeout(timeo);
334 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
336 __set_current_state(TASK_RUNNING);
337 remove_wait_queue(sk_sleep(sk), &wait);
342 newsock->state = SS_CONNECTED;
344 BT_DBG("new socket %p", nsk);
351 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
354 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
355 struct sock *sk = sock->sk;
356 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
358 BT_DBG("sock %p, sk %p", sock, sk);
360 memset(la, 0, sizeof(struct sockaddr_l2));
361 addr->sa_family = AF_BLUETOOTH;
362 *len = sizeof(struct sockaddr_l2);
365 la->l2_psm = chan->psm;
366 bacpy(&la->l2_bdaddr, &chan->dst);
367 la->l2_cid = cpu_to_le16(chan->dcid);
368 la->l2_bdaddr_type = chan->dst_type;
370 la->l2_psm = chan->sport;
371 bacpy(&la->l2_bdaddr, &chan->src);
372 la->l2_cid = cpu_to_le16(chan->scid);
373 la->l2_bdaddr_type = chan->src_type;
379 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
380 char __user *optval, int __user *optlen)
382 struct sock *sk = sock->sk;
383 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
384 struct l2cap_options opts;
385 struct l2cap_conninfo cinfo;
391 if (get_user(len, optlen))
398 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
399 * legacy ATT code depends on getsockopt for
400 * L2CAP_OPTIONS we need to let this pass.
402 if (bdaddr_type_is_le(chan->src_type) &&
403 chan->scid != L2CAP_CID_ATT) {
408 memset(&opts, 0, sizeof(opts));
409 opts.imtu = chan->imtu;
410 opts.omtu = chan->omtu;
411 opts.flush_to = chan->flush_to;
412 opts.mode = chan->mode;
413 opts.fcs = chan->fcs;
414 opts.max_tx = chan->max_tx;
415 opts.txwin_size = chan->tx_win;
417 len = min_t(unsigned int, len, sizeof(opts));
418 if (copy_to_user(optval, (char *) &opts, len))
424 switch (chan->sec_level) {
425 case BT_SECURITY_LOW:
428 case BT_SECURITY_MEDIUM:
429 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
431 case BT_SECURITY_HIGH:
432 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
440 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
441 opt |= L2CAP_LM_MASTER;
443 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
444 opt |= L2CAP_LM_RELIABLE;
446 if (put_user(opt, (u32 __user *) optval))
451 if (sk->sk_state != BT_CONNECTED &&
452 !(sk->sk_state == BT_CONNECT2 &&
453 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
458 memset(&cinfo, 0, sizeof(cinfo));
459 cinfo.hci_handle = chan->conn->hcon->handle;
460 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
462 len = min_t(unsigned int, len, sizeof(cinfo));
463 if (copy_to_user(optval, (char *) &cinfo, len))
477 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
478 char __user *optval, int __user *optlen)
480 struct sock *sk = sock->sk;
481 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
482 struct bt_security sec;
488 if (level == SOL_L2CAP)
489 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
491 if (level != SOL_BLUETOOTH)
494 if (get_user(len, optlen))
501 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
502 chan->chan_type != L2CAP_CHAN_RAW) {
507 memset(&sec, 0, sizeof(sec));
509 sec.level = chan->conn->hcon->sec_level;
511 if (sk->sk_state == BT_CONNECTED)
512 sec.key_size = chan->conn->hcon->enc_key_size;
514 sec.level = chan->sec_level;
517 len = min_t(unsigned int, len, sizeof(sec));
518 if (copy_to_user(optval, (char *) &sec, len))
524 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
529 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
530 (u32 __user *) optval))
536 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
537 (u32 __user *) optval))
543 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
544 && sk->sk_type != SOCK_RAW) {
549 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
551 len = min_t(unsigned int, len, sizeof(pwr));
552 if (copy_to_user(optval, (char *) &pwr, len))
557 case BT_CHANNEL_POLICY:
558 if (put_user(chan->chan_policy, (u32 __user *) optval))
564 err = -EPROTONOSUPPORT;
568 if (!bdaddr_type_is_le(chan->src_type)) {
573 if (sk->sk_state != BT_CONNECTED) {
578 if (put_user(chan->omtu, (u16 __user *) optval))
584 err = -EPROTONOSUPPORT;
588 if (!bdaddr_type_is_le(chan->src_type)) {
593 if (put_user(chan->imtu, (u16 __user *) optval))
606 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
608 switch (chan->scid) {
610 if (mtu < L2CAP_LE_MIN_MTU)
615 if (mtu < L2CAP_DEFAULT_MIN_MTU)
622 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
623 char __user *optval, unsigned int optlen)
625 struct sock *sk = sock->sk;
626 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
627 struct l2cap_options opts;
637 if (bdaddr_type_is_le(chan->src_type)) {
642 if (sk->sk_state == BT_CONNECTED) {
647 opts.imtu = chan->imtu;
648 opts.omtu = chan->omtu;
649 opts.flush_to = chan->flush_to;
650 opts.mode = chan->mode;
651 opts.fcs = chan->fcs;
652 opts.max_tx = chan->max_tx;
653 opts.txwin_size = chan->tx_win;
655 len = min_t(unsigned int, sizeof(opts), optlen);
656 if (copy_from_user((char *) &opts, optval, len)) {
661 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
666 if (!l2cap_valid_mtu(chan, opts.imtu)) {
671 chan->mode = opts.mode;
672 switch (chan->mode) {
673 case L2CAP_MODE_LE_FLOWCTL:
675 case L2CAP_MODE_BASIC:
676 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
678 case L2CAP_MODE_ERTM:
679 case L2CAP_MODE_STREAMING:
688 chan->imtu = opts.imtu;
689 chan->omtu = opts.omtu;
690 chan->fcs = opts.fcs;
691 chan->max_tx = opts.max_tx;
692 chan->tx_win = opts.txwin_size;
693 chan->flush_to = opts.flush_to;
697 if (get_user(opt, (u32 __user *) optval)) {
702 if (opt & L2CAP_LM_AUTH)
703 chan->sec_level = BT_SECURITY_LOW;
704 if (opt & L2CAP_LM_ENCRYPT)
705 chan->sec_level = BT_SECURITY_MEDIUM;
706 if (opt & L2CAP_LM_SECURE)
707 chan->sec_level = BT_SECURITY_HIGH;
709 if (opt & L2CAP_LM_MASTER)
710 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
712 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
714 if (opt & L2CAP_LM_RELIABLE)
715 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
717 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
729 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
730 char __user *optval, unsigned int optlen)
732 struct sock *sk = sock->sk;
733 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
734 struct bt_security sec;
736 struct l2cap_conn *conn;
742 if (level == SOL_L2CAP)
743 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
745 if (level != SOL_BLUETOOTH)
752 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
753 chan->chan_type != L2CAP_CHAN_RAW) {
758 sec.level = BT_SECURITY_LOW;
760 len = min_t(unsigned int, sizeof(sec), optlen);
761 if (copy_from_user((char *) &sec, optval, len)) {
766 if (sec.level < BT_SECURITY_LOW ||
767 sec.level > BT_SECURITY_HIGH) {
772 chan->sec_level = sec.level;
779 /*change security for LE channels */
780 if (chan->scid == L2CAP_CID_ATT) {
781 if (!conn->hcon->out) {
786 if (smp_conn_security(conn->hcon, sec.level))
788 sk->sk_state = BT_CONFIG;
789 chan->state = BT_CONFIG;
791 /* or for ACL link */
792 } else if ((sk->sk_state == BT_CONNECT2 &&
793 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
794 sk->sk_state == BT_CONNECTED) {
795 if (!l2cap_chan_check_security(chan))
796 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
798 sk->sk_state_change(sk);
805 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
810 if (get_user(opt, (u32 __user *) optval)) {
816 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
817 set_bit(FLAG_DEFER_SETUP, &chan->flags);
819 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
820 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
825 if (get_user(opt, (u32 __user *) optval)) {
830 if (opt > BT_FLUSHABLE_ON) {
835 if (opt == BT_FLUSHABLE_OFF) {
837 /* proceed further only when we have l2cap_conn and
838 No Flush support in the LM */
839 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
846 set_bit(FLAG_FLUSHABLE, &chan->flags);
848 clear_bit(FLAG_FLUSHABLE, &chan->flags);
852 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
853 chan->chan_type != L2CAP_CHAN_RAW) {
858 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
860 len = min_t(unsigned int, sizeof(pwr), optlen);
861 if (copy_from_user((char *) &pwr, optval, len)) {
866 if (pwr.force_active)
867 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
869 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
872 case BT_CHANNEL_POLICY:
873 if (get_user(opt, (u32 __user *) optval)) {
878 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
883 if (chan->mode != L2CAP_MODE_ERTM &&
884 chan->mode != L2CAP_MODE_STREAMING) {
889 chan->chan_policy = (u8) opt;
891 if (sk->sk_state == BT_CONNECTED &&
892 chan->move_role == L2CAP_MOVE_ROLE_NONE)
893 l2cap_move_start(chan);
899 err = -EPROTONOSUPPORT;
903 if (!bdaddr_type_is_le(chan->src_type)) {
908 /* Setting is not supported as it's the remote side that
916 err = -EPROTONOSUPPORT;
920 if (!bdaddr_type_is_le(chan->src_type)) {
925 if (sk->sk_state == BT_CONNECTED) {
930 if (get_user(opt, (u32 __user *) optval)) {
947 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
948 struct msghdr *msg, size_t len)
950 struct sock *sk = sock->sk;
951 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
954 BT_DBG("sock %p, sk %p", sock, sk);
956 err = sock_error(sk);
960 if (msg->msg_flags & MSG_OOB)
963 if (sk->sk_state != BT_CONNECTED)
967 err = bt_sock_wait_ready(sk, msg->msg_flags);
972 l2cap_chan_lock(chan);
973 err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
974 l2cap_chan_unlock(chan);
979 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
980 struct msghdr *msg, size_t len, int flags)
982 struct sock *sk = sock->sk;
983 struct l2cap_pinfo *pi = l2cap_pi(sk);
988 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
989 &bt_sk(sk)->flags)) {
990 if (bdaddr_type_is_le(pi->chan->src_type)) {
991 sk->sk_state = BT_CONNECTED;
992 pi->chan->state = BT_CONNECTED;
993 __l2cap_le_connect_rsp_defer(pi->chan);
995 sk->sk_state = BT_CONFIG;
996 pi->chan->state = BT_CONFIG;
997 __l2cap_connect_rsp_defer(pi->chan);
1006 if (sock->type == SOCK_STREAM)
1007 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1009 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1011 if (pi->chan->mode != L2CAP_MODE_ERTM)
1014 /* Attempt to put pending rx data in the socket buffer */
1018 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1021 if (pi->rx_busy_skb) {
1022 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1023 pi->rx_busy_skb = NULL;
1028 /* Restore data flow when half of the receive buffer is
1029 * available. This avoids resending large numbers of
1032 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1033 l2cap_chan_busy(pi->chan, 0);
1040 /* Kill socket (only if zapped and orphan)
1041 * Must be called on unlocked socket.
1043 static void l2cap_sock_kill(struct sock *sk)
1045 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1048 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1050 /* Kill poor orphan */
1052 l2cap_chan_put(l2cap_pi(sk)->chan);
1053 sock_set_flag(sk, SOCK_DEAD);
1057 static int __l2cap_wait_ack(struct sock *sk)
1059 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1060 DECLARE_WAITQUEUE(wait, current);
1064 add_wait_queue(sk_sleep(sk), &wait);
1065 set_current_state(TASK_INTERRUPTIBLE);
1066 while (chan->unacked_frames > 0 && chan->conn) {
1070 if (signal_pending(current)) {
1071 err = sock_intr_errno(timeo);
1076 timeo = schedule_timeout(timeo);
1078 set_current_state(TASK_INTERRUPTIBLE);
1080 err = sock_error(sk);
1084 set_current_state(TASK_RUNNING);
1085 remove_wait_queue(sk_sleep(sk), &wait);
1089 static int l2cap_sock_shutdown(struct socket *sock, int how)
1091 struct sock *sk = sock->sk;
1092 struct l2cap_chan *chan;
1093 struct l2cap_conn *conn;
1096 BT_DBG("sock %p, sk %p", sock, sk);
1101 chan = l2cap_pi(sk)->chan;
1105 mutex_lock(&conn->chan_lock);
1107 l2cap_chan_lock(chan);
1110 if (!sk->sk_shutdown) {
1111 if (chan->mode == L2CAP_MODE_ERTM)
1112 err = __l2cap_wait_ack(sk);
1114 sk->sk_shutdown = SHUTDOWN_MASK;
1117 l2cap_chan_close(chan, 0);
1120 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
1121 err = bt_sock_wait_state(sk, BT_CLOSED,
1125 if (!err && sk->sk_err)
1129 l2cap_chan_unlock(chan);
1132 mutex_unlock(&conn->chan_lock);
1137 static int l2cap_sock_release(struct socket *sock)
1139 struct sock *sk = sock->sk;
1142 BT_DBG("sock %p, sk %p", sock, sk);
1147 bt_sock_unlink(&l2cap_sk_list, sk);
1149 err = l2cap_sock_shutdown(sock, 2);
1152 l2cap_sock_kill(sk);
1156 static void l2cap_sock_cleanup_listen(struct sock *parent)
1160 BT_DBG("parent %p", parent);
1162 /* Close not yet accepted channels */
1163 while ((sk = bt_accept_dequeue(parent, NULL))) {
1164 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1166 l2cap_chan_lock(chan);
1167 __clear_chan_timer(chan);
1168 l2cap_chan_close(chan, ECONNRESET);
1169 l2cap_chan_unlock(chan);
1171 l2cap_sock_kill(sk);
1175 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1177 struct sock *sk, *parent = chan->data;
1181 /* Check for backlog size */
1182 if (sk_acceptq_is_full(parent)) {
1183 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1184 release_sock(parent);
1188 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1191 release_sock(parent);
1195 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1197 l2cap_sock_init(sk, parent);
1199 bt_accept_enqueue(parent, sk);
1201 release_sock(parent);
1203 return l2cap_pi(sk)->chan;
1206 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1208 struct sock *sk = chan->data;
1213 if (l2cap_pi(sk)->rx_busy_skb) {
1218 err = sock_queue_rcv_skb(sk, skb);
1220 /* For ERTM, handle one skb that doesn't fit into the recv
1221 * buffer. This is important to do because the data frames
1222 * have already been acked, so the skb cannot be discarded.
1224 * Notify the l2cap core that the buffer is full, so the
1225 * LOCAL_BUSY state is entered and no more frames are
1226 * acked and reassembled until there is buffer space
1229 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1230 l2cap_pi(sk)->rx_busy_skb = skb;
1231 l2cap_chan_busy(chan, 1);
1241 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1243 struct sock *sk = chan->data;
1245 l2cap_sock_kill(sk);
1248 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1250 struct sock *sk = chan->data;
1251 struct sock *parent;
1255 parent = bt_sk(sk)->parent;
1257 sock_set_flag(sk, SOCK_ZAPPED);
1259 switch (chan->state) {
1265 l2cap_sock_cleanup_listen(sk);
1266 sk->sk_state = BT_CLOSED;
1267 chan->state = BT_CLOSED;
1271 sk->sk_state = BT_CLOSED;
1272 chan->state = BT_CLOSED;
1277 bt_accept_unlink(sk);
1278 parent->sk_data_ready(parent, 0);
1280 sk->sk_state_change(sk);
1289 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1292 struct sock *sk = chan->data;
1294 sk->sk_state = state;
1300 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1301 unsigned long len, int nb)
1303 struct sock *sk = chan->data;
1304 struct sk_buff *skb;
1307 l2cap_chan_unlock(chan);
1308 skb = bt_skb_send_alloc(sk, len, nb, &err);
1309 l2cap_chan_lock(chan);
1312 return ERR_PTR(err);
1314 bt_cb(skb)->chan = chan;
1319 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1321 struct sock *sk = chan->data;
1322 struct sock *parent;
1326 parent = bt_sk(sk)->parent;
1328 BT_DBG("sk %p, parent %p", sk, parent);
1330 sk->sk_state = BT_CONNECTED;
1331 sk->sk_state_change(sk);
1334 parent->sk_data_ready(parent, 0);
1339 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1341 struct sock *parent, *sk = chan->data;
1345 parent = bt_sk(sk)->parent;
1347 parent->sk_data_ready(parent, 0);
1352 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1354 struct sock *sk = chan->data;
1356 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1357 sk->sk_state_change(sk);
1360 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1362 struct sock *sk = chan->data;
1365 sk->sk_shutdown = SHUTDOWN_MASK;
1369 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1371 struct sock *sk = chan->data;
1373 return sk->sk_sndtimeo;
1376 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1378 struct sock *sk = chan->data;
1380 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1381 sk->sk_state_change(sk);
1384 static struct l2cap_ops l2cap_chan_ops = {
1385 .name = "L2CAP Socket Interface",
1386 .new_connection = l2cap_sock_new_connection_cb,
1387 .recv = l2cap_sock_recv_cb,
1388 .close = l2cap_sock_close_cb,
1389 .teardown = l2cap_sock_teardown_cb,
1390 .state_change = l2cap_sock_state_change_cb,
1391 .ready = l2cap_sock_ready_cb,
1392 .defer = l2cap_sock_defer_cb,
1393 .resume = l2cap_sock_resume_cb,
1394 .suspend = l2cap_sock_suspend_cb,
1395 .set_shutdown = l2cap_sock_set_shutdown_cb,
1396 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1397 .alloc_skb = l2cap_sock_alloc_skb_cb,
1400 static void l2cap_sock_destruct(struct sock *sk)
1402 BT_DBG("sk %p", sk);
1404 if (l2cap_pi(sk)->chan)
1405 l2cap_chan_put(l2cap_pi(sk)->chan);
1407 if (l2cap_pi(sk)->rx_busy_skb) {
1408 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1409 l2cap_pi(sk)->rx_busy_skb = NULL;
1412 skb_queue_purge(&sk->sk_receive_queue);
1413 skb_queue_purge(&sk->sk_write_queue);
1416 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1419 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1421 memset(la, 0, sizeof(struct sockaddr_l2));
1422 la->l2_family = AF_BLUETOOTH;
1423 la->l2_psm = bt_cb(skb)->psm;
1424 bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1426 *msg_namelen = sizeof(struct sockaddr_l2);
1429 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1431 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1433 BT_DBG("sk %p", sk);
1436 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1438 sk->sk_type = parent->sk_type;
1439 bt_sk(sk)->flags = bt_sk(parent)->flags;
1441 chan->chan_type = pchan->chan_type;
1442 chan->imtu = pchan->imtu;
1443 chan->omtu = pchan->omtu;
1444 chan->conf_state = pchan->conf_state;
1445 chan->mode = pchan->mode;
1446 chan->fcs = pchan->fcs;
1447 chan->max_tx = pchan->max_tx;
1448 chan->tx_win = pchan->tx_win;
1449 chan->tx_win_max = pchan->tx_win_max;
1450 chan->sec_level = pchan->sec_level;
1451 chan->flags = pchan->flags;
1452 chan->tx_credits = pchan->tx_credits;
1453 chan->rx_credits = pchan->rx_credits;
1455 security_sk_clone(parent, sk);
1457 switch (sk->sk_type) {
1459 chan->chan_type = L2CAP_CHAN_RAW;
1462 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1463 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1465 case SOCK_SEQPACKET:
1467 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1471 chan->imtu = L2CAP_DEFAULT_MTU;
1473 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1474 chan->mode = L2CAP_MODE_ERTM;
1475 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1477 chan->mode = L2CAP_MODE_BASIC;
1480 l2cap_chan_set_defaults(chan);
1483 /* Default config options */
1484 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1487 chan->ops = &l2cap_chan_ops;
1490 static struct proto l2cap_proto = {
1492 .owner = THIS_MODULE,
1493 .obj_size = sizeof(struct l2cap_pinfo)
1496 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1497 int proto, gfp_t prio)
1500 struct l2cap_chan *chan;
1502 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1506 sock_init_data(sock, sk);
1507 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1509 sk->sk_destruct = l2cap_sock_destruct;
1510 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1512 sock_reset_flag(sk, SOCK_ZAPPED);
1514 sk->sk_protocol = proto;
1515 sk->sk_state = BT_OPEN;
1517 chan = l2cap_chan_create();
1523 l2cap_chan_hold(chan);
1525 l2cap_pi(sk)->chan = chan;
1530 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1535 BT_DBG("sock %p", sock);
1537 sock->state = SS_UNCONNECTED;
1539 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1540 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1541 return -ESOCKTNOSUPPORT;
1543 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1546 sock->ops = &l2cap_sock_ops;
1548 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1552 l2cap_sock_init(sk, NULL);
1553 bt_sock_link(&l2cap_sk_list, sk);
1557 static const struct proto_ops l2cap_sock_ops = {
1558 .family = PF_BLUETOOTH,
1559 .owner = THIS_MODULE,
1560 .release = l2cap_sock_release,
1561 .bind = l2cap_sock_bind,
1562 .connect = l2cap_sock_connect,
1563 .listen = l2cap_sock_listen,
1564 .accept = l2cap_sock_accept,
1565 .getname = l2cap_sock_getname,
1566 .sendmsg = l2cap_sock_sendmsg,
1567 .recvmsg = l2cap_sock_recvmsg,
1568 .poll = bt_sock_poll,
1569 .ioctl = bt_sock_ioctl,
1570 .mmap = sock_no_mmap,
1571 .socketpair = sock_no_socketpair,
1572 .shutdown = l2cap_sock_shutdown,
1573 .setsockopt = l2cap_sock_setsockopt,
1574 .getsockopt = l2cap_sock_getsockopt
1577 static const struct net_proto_family l2cap_sock_family_ops = {
1578 .family = PF_BLUETOOTH,
1579 .owner = THIS_MODULE,
1580 .create = l2cap_sock_create,
1583 int __init l2cap_init_sockets(void)
1587 err = proto_register(&l2cap_proto, 0);
1591 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1593 BT_ERR("L2CAP socket registration failed");
1597 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1600 BT_ERR("Failed to create L2CAP proc file");
1601 bt_sock_unregister(BTPROTO_L2CAP);
1605 BT_INFO("L2CAP socket layer initialized");
1610 proto_unregister(&l2cap_proto);
1614 void l2cap_cleanup_sockets(void)
1616 bt_procfs_cleanup(&init_net, "l2cap");
1617 bt_sock_unregister(BTPROTO_L2CAP);
1618 proto_unregister(&l2cap_proto);
1621 module_param(enable_lecoc, bool, 0644);
1622 MODULE_PARM_DESC(enable_lecoc, "Enable support for LE CoC");