2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
41 static struct bt_sock_list l2cap_sk_list = {
42 .lock = __RW_LOCK_UNLOCKED(l2cap_sk_list.lock)
45 static const struct proto_ops l2cap_sock_ops;
46 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
47 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
48 int proto, gfp_t prio);
50 bool l2cap_is_socket(struct socket *sock)
52 return sock && sock->ops == &l2cap_sock_ops;
54 EXPORT_SYMBOL(l2cap_is_socket);
56 static int l2cap_validate_bredr_psm(u16 psm)
58 /* PSM must be odd and lsb of upper byte must be 0 */
59 if ((psm & 0x0101) != 0x0001)
62 /* Restrict usage of well-known PSMs */
63 if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
69 static int l2cap_validate_le_psm(u16 psm)
71 /* Valid LE_PSM ranges are defined only until 0x00ff */
75 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
76 if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
82 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
84 struct sock *sk = sock->sk;
85 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
86 struct sockaddr_l2 la;
91 if (!addr || addr->sa_family != AF_BLUETOOTH)
94 memset(&la, 0, sizeof(la));
95 len = min_t(unsigned int, sizeof(la), alen);
96 memcpy(&la, addr, len);
98 if (la.l2_cid && la.l2_psm)
101 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
104 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
105 if (!enable_lecoc && la.l2_psm)
107 /* We only allow ATT user space socket */
109 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
115 if (sk->sk_state != BT_OPEN) {
121 __u16 psm = __le16_to_cpu(la.l2_psm);
123 if (la.l2_bdaddr_type == BDADDR_BREDR)
124 err = l2cap_validate_bredr_psm(psm);
126 err = l2cap_validate_le_psm(psm);
133 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
135 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
140 switch (chan->chan_type) {
141 case L2CAP_CHAN_CONN_LESS:
142 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_3DSP)
143 chan->sec_level = BT_SECURITY_SDP;
145 case L2CAP_CHAN_CONN_ORIENTED:
146 if (__le16_to_cpu(la.l2_psm) == L2CAP_PSM_SDP ||
147 __le16_to_cpu(la.l2_psm) == L2CAP_PSM_RFCOMM)
148 chan->sec_level = BT_SECURITY_SDP;
151 chan->sec_level = BT_SECURITY_SDP;
155 bacpy(&chan->src, &la.l2_bdaddr);
156 chan->src_type = la.l2_bdaddr_type;
158 if (chan->psm && bdaddr_type_is_le(chan->src_type))
159 chan->mode = L2CAP_MODE_LE_FLOWCTL;
161 chan->state = BT_BOUND;
162 sk->sk_state = BT_BOUND;
169 static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr,
172 struct sock *sk = sock->sk;
173 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
174 struct sockaddr_l2 la;
179 if (!addr || alen < sizeof(addr->sa_family) ||
180 addr->sa_family != AF_BLUETOOTH)
183 memset(&la, 0, sizeof(la));
184 len = min_t(unsigned int, sizeof(la), alen);
185 memcpy(&la, addr, len);
187 if (la.l2_cid && la.l2_psm)
190 if (!bdaddr_type_is_valid(la.l2_bdaddr_type))
193 /* Check that the socket wasn't bound to something that
194 * conflicts with the address given to connect(). If chan->src
195 * is BDADDR_ANY it means bind() was never used, in which case
196 * chan->src_type and la.l2_bdaddr_type do not need to match.
198 if (chan->src_type == BDADDR_BREDR && bacmp(&chan->src, BDADDR_ANY) &&
199 bdaddr_type_is_le(la.l2_bdaddr_type)) {
200 /* Old user space versions will try to incorrectly bind
201 * the ATT socket using BDADDR_BREDR. We need to accept
202 * this and fix up the source address type only when
203 * both the source CID and destination CID indicate
204 * ATT. Anything else is an invalid combination.
206 if (chan->scid != L2CAP_CID_ATT ||
207 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
210 /* We don't have the hdev available here to make a
211 * better decision on random vs public, but since all
212 * user space versions that exhibit this issue anyway do
213 * not support random local addresses assuming public
214 * here is good enough.
216 chan->src_type = BDADDR_LE_PUBLIC;
219 if (chan->src_type != BDADDR_BREDR && la.l2_bdaddr_type == BDADDR_BREDR)
222 if (bdaddr_type_is_le(la.l2_bdaddr_type)) {
223 if (!enable_lecoc && la.l2_psm)
225 /* We only allow ATT user space socket */
227 la.l2_cid != __constant_cpu_to_le16(L2CAP_CID_ATT))
231 if (chan->psm && bdaddr_type_is_le(chan->src_type))
232 chan->mode = L2CAP_MODE_LE_FLOWCTL;
234 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
235 &la.l2_bdaddr, la.l2_bdaddr_type);
241 err = bt_sock_wait_state(sk, BT_CONNECTED,
242 sock_sndtimeo(sk, flags & O_NONBLOCK));
249 static int l2cap_sock_listen(struct socket *sock, int backlog)
251 struct sock *sk = sock->sk;
252 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
255 BT_DBG("sk %p backlog %d", sk, backlog);
259 if (sk->sk_state != BT_BOUND) {
264 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM) {
269 switch (chan->mode) {
270 case L2CAP_MODE_BASIC:
271 case L2CAP_MODE_LE_FLOWCTL:
273 case L2CAP_MODE_ERTM:
274 case L2CAP_MODE_STREAMING:
283 sk->sk_max_ack_backlog = backlog;
284 sk->sk_ack_backlog = 0;
286 chan->state = BT_LISTEN;
287 sk->sk_state = BT_LISTEN;
294 static int l2cap_sock_accept(struct socket *sock, struct socket *newsock,
297 DECLARE_WAITQUEUE(wait, current);
298 struct sock *sk = sock->sk, *nsk;
302 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
304 timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
306 BT_DBG("sk %p timeo %ld", sk, timeo);
308 /* Wait for an incoming connection. (wake-one). */
309 add_wait_queue_exclusive(sk_sleep(sk), &wait);
311 set_current_state(TASK_INTERRUPTIBLE);
313 if (sk->sk_state != BT_LISTEN) {
318 nsk = bt_accept_dequeue(sk, newsock);
327 if (signal_pending(current)) {
328 err = sock_intr_errno(timeo);
333 timeo = schedule_timeout(timeo);
334 lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
336 __set_current_state(TASK_RUNNING);
337 remove_wait_queue(sk_sleep(sk), &wait);
342 newsock->state = SS_CONNECTED;
344 BT_DBG("new socket %p", nsk);
351 static int l2cap_sock_getname(struct socket *sock, struct sockaddr *addr,
354 struct sockaddr_l2 *la = (struct sockaddr_l2 *) addr;
355 struct sock *sk = sock->sk;
356 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
358 BT_DBG("sock %p, sk %p", sock, sk);
360 memset(la, 0, sizeof(struct sockaddr_l2));
361 addr->sa_family = AF_BLUETOOTH;
362 *len = sizeof(struct sockaddr_l2);
365 la->l2_psm = chan->psm;
366 bacpy(&la->l2_bdaddr, &chan->dst);
367 la->l2_cid = cpu_to_le16(chan->dcid);
368 la->l2_bdaddr_type = chan->dst_type;
370 la->l2_psm = chan->sport;
371 bacpy(&la->l2_bdaddr, &chan->src);
372 la->l2_cid = cpu_to_le16(chan->scid);
373 la->l2_bdaddr_type = chan->src_type;
379 static int l2cap_sock_getsockopt_old(struct socket *sock, int optname,
380 char __user *optval, int __user *optlen)
382 struct sock *sk = sock->sk;
383 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
384 struct l2cap_options opts;
385 struct l2cap_conninfo cinfo;
391 if (get_user(len, optlen))
398 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
399 * legacy ATT code depends on getsockopt for
400 * L2CAP_OPTIONS we need to let this pass.
402 if (bdaddr_type_is_le(chan->src_type) &&
403 chan->scid != L2CAP_CID_ATT) {
408 memset(&opts, 0, sizeof(opts));
409 opts.imtu = chan->imtu;
410 opts.omtu = chan->omtu;
411 opts.flush_to = chan->flush_to;
412 opts.mode = chan->mode;
413 opts.fcs = chan->fcs;
414 opts.max_tx = chan->max_tx;
415 opts.txwin_size = chan->tx_win;
417 len = min_t(unsigned int, len, sizeof(opts));
418 if (copy_to_user(optval, (char *) &opts, len))
424 switch (chan->sec_level) {
425 case BT_SECURITY_LOW:
428 case BT_SECURITY_MEDIUM:
429 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT;
431 case BT_SECURITY_HIGH:
432 opt = L2CAP_LM_AUTH | L2CAP_LM_ENCRYPT |
440 if (test_bit(FLAG_ROLE_SWITCH, &chan->flags))
441 opt |= L2CAP_LM_MASTER;
443 if (test_bit(FLAG_FORCE_RELIABLE, &chan->flags))
444 opt |= L2CAP_LM_RELIABLE;
446 if (put_user(opt, (u32 __user *) optval))
451 if (sk->sk_state != BT_CONNECTED &&
452 !(sk->sk_state == BT_CONNECT2 &&
453 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags))) {
458 memset(&cinfo, 0, sizeof(cinfo));
459 cinfo.hci_handle = chan->conn->hcon->handle;
460 memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
462 len = min_t(unsigned int, len, sizeof(cinfo));
463 if (copy_to_user(optval, (char *) &cinfo, len))
477 static int l2cap_sock_getsockopt(struct socket *sock, int level, int optname,
478 char __user *optval, int __user *optlen)
480 struct sock *sk = sock->sk;
481 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
482 struct bt_security sec;
488 if (level == SOL_L2CAP)
489 return l2cap_sock_getsockopt_old(sock, optname, optval, optlen);
491 if (level != SOL_BLUETOOTH)
494 if (get_user(len, optlen))
501 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
502 chan->chan_type != L2CAP_CHAN_RAW) {
507 memset(&sec, 0, sizeof(sec));
509 sec.level = chan->conn->hcon->sec_level;
511 if (sk->sk_state == BT_CONNECTED)
512 sec.key_size = chan->conn->hcon->enc_key_size;
514 sec.level = chan->sec_level;
517 len = min_t(unsigned int, len, sizeof(sec));
518 if (copy_to_user(optval, (char *) &sec, len))
524 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
529 if (put_user(test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags),
530 (u32 __user *) optval))
536 if (put_user(test_bit(FLAG_FLUSHABLE, &chan->flags),
537 (u32 __user *) optval))
543 if (sk->sk_type != SOCK_SEQPACKET && sk->sk_type != SOCK_STREAM
544 && sk->sk_type != SOCK_RAW) {
549 pwr.force_active = test_bit(FLAG_FORCE_ACTIVE, &chan->flags);
551 len = min_t(unsigned int, len, sizeof(pwr));
552 if (copy_to_user(optval, (char *) &pwr, len))
557 case BT_CHANNEL_POLICY:
558 if (put_user(chan->chan_policy, (u32 __user *) optval))
564 err = -EPROTONOSUPPORT;
568 if (!bdaddr_type_is_le(chan->src_type)) {
573 if (sk->sk_state != BT_CONNECTED) {
578 if (put_user(chan->omtu, (u16 __user *) optval))
584 err = -EPROTONOSUPPORT;
588 if (!bdaddr_type_is_le(chan->src_type)) {
593 if (put_user(chan->imtu, (u16 __user *) optval))
606 static bool l2cap_valid_mtu(struct l2cap_chan *chan, u16 mtu)
608 switch (chan->scid) {
610 if (mtu < L2CAP_LE_MIN_MTU)
615 if (mtu < L2CAP_DEFAULT_MIN_MTU)
622 static int l2cap_sock_setsockopt_old(struct socket *sock, int optname,
623 char __user *optval, unsigned int optlen)
625 struct sock *sk = sock->sk;
626 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
627 struct l2cap_options opts;
637 if (bdaddr_type_is_le(chan->src_type)) {
642 if (sk->sk_state == BT_CONNECTED) {
647 opts.imtu = chan->imtu;
648 opts.omtu = chan->omtu;
649 opts.flush_to = chan->flush_to;
650 opts.mode = chan->mode;
651 opts.fcs = chan->fcs;
652 opts.max_tx = chan->max_tx;
653 opts.txwin_size = chan->tx_win;
655 len = min_t(unsigned int, sizeof(opts), optlen);
656 if (copy_from_user((char *) &opts, optval, len)) {
661 if (opts.txwin_size > L2CAP_DEFAULT_EXT_WINDOW) {
666 if (!l2cap_valid_mtu(chan, opts.imtu)) {
671 chan->mode = opts.mode;
672 switch (chan->mode) {
673 case L2CAP_MODE_LE_FLOWCTL:
675 case L2CAP_MODE_BASIC:
676 clear_bit(CONF_STATE2_DEVICE, &chan->conf_state);
678 case L2CAP_MODE_ERTM:
679 case L2CAP_MODE_STREAMING:
688 chan->imtu = opts.imtu;
689 chan->omtu = opts.omtu;
690 chan->fcs = opts.fcs;
691 chan->max_tx = opts.max_tx;
692 chan->tx_win = opts.txwin_size;
693 chan->flush_to = opts.flush_to;
697 if (get_user(opt, (u32 __user *) optval)) {
702 if (opt & L2CAP_LM_AUTH)
703 chan->sec_level = BT_SECURITY_LOW;
704 if (opt & L2CAP_LM_ENCRYPT)
705 chan->sec_level = BT_SECURITY_MEDIUM;
706 if (opt & L2CAP_LM_SECURE)
707 chan->sec_level = BT_SECURITY_HIGH;
709 if (opt & L2CAP_LM_MASTER)
710 set_bit(FLAG_ROLE_SWITCH, &chan->flags);
712 clear_bit(FLAG_ROLE_SWITCH, &chan->flags);
714 if (opt & L2CAP_LM_RELIABLE)
715 set_bit(FLAG_FORCE_RELIABLE, &chan->flags);
717 clear_bit(FLAG_FORCE_RELIABLE, &chan->flags);
729 static int l2cap_sock_setsockopt(struct socket *sock, int level, int optname,
730 char __user *optval, unsigned int optlen)
732 struct sock *sk = sock->sk;
733 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
734 struct bt_security sec;
736 struct l2cap_conn *conn;
742 if (level == SOL_L2CAP)
743 return l2cap_sock_setsockopt_old(sock, optname, optval, optlen);
745 if (level != SOL_BLUETOOTH)
752 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
753 chan->chan_type != L2CAP_CHAN_RAW) {
758 sec.level = BT_SECURITY_LOW;
760 len = min_t(unsigned int, sizeof(sec), optlen);
761 if (copy_from_user((char *) &sec, optval, len)) {
766 if (sec.level < BT_SECURITY_LOW ||
767 sec.level > BT_SECURITY_HIGH) {
772 chan->sec_level = sec.level;
779 /*change security for LE channels */
780 if (chan->scid == L2CAP_CID_ATT) {
781 if (smp_conn_security(conn->hcon, sec.level))
783 sk->sk_state = BT_CONFIG;
784 chan->state = BT_CONFIG;
786 /* or for ACL link */
787 } else if ((sk->sk_state == BT_CONNECT2 &&
788 test_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) ||
789 sk->sk_state == BT_CONNECTED) {
790 if (!l2cap_chan_check_security(chan))
791 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
793 sk->sk_state_change(sk);
800 if (sk->sk_state != BT_BOUND && sk->sk_state != BT_LISTEN) {
805 if (get_user(opt, (u32 __user *) optval)) {
811 set_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
812 set_bit(FLAG_DEFER_SETUP, &chan->flags);
814 clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags);
815 clear_bit(FLAG_DEFER_SETUP, &chan->flags);
820 if (get_user(opt, (u32 __user *) optval)) {
825 if (opt > BT_FLUSHABLE_ON) {
830 if (opt == BT_FLUSHABLE_OFF) {
832 /* proceed further only when we have l2cap_conn and
833 No Flush support in the LM */
834 if (!conn || !lmp_no_flush_capable(conn->hcon->hdev)) {
841 set_bit(FLAG_FLUSHABLE, &chan->flags);
843 clear_bit(FLAG_FLUSHABLE, &chan->flags);
847 if (chan->chan_type != L2CAP_CHAN_CONN_ORIENTED &&
848 chan->chan_type != L2CAP_CHAN_RAW) {
853 pwr.force_active = BT_POWER_FORCE_ACTIVE_ON;
855 len = min_t(unsigned int, sizeof(pwr), optlen);
856 if (copy_from_user((char *) &pwr, optval, len)) {
861 if (pwr.force_active)
862 set_bit(FLAG_FORCE_ACTIVE, &chan->flags);
864 clear_bit(FLAG_FORCE_ACTIVE, &chan->flags);
867 case BT_CHANNEL_POLICY:
868 if (get_user(opt, (u32 __user *) optval)) {
873 if (opt > BT_CHANNEL_POLICY_AMP_PREFERRED) {
878 if (chan->mode != L2CAP_MODE_ERTM &&
879 chan->mode != L2CAP_MODE_STREAMING) {
884 chan->chan_policy = (u8) opt;
886 if (sk->sk_state == BT_CONNECTED &&
887 chan->move_role == L2CAP_MOVE_ROLE_NONE)
888 l2cap_move_start(chan);
894 err = -EPROTONOSUPPORT;
898 if (!bdaddr_type_is_le(chan->src_type)) {
903 /* Setting is not supported as it's the remote side that
911 err = -EPROTONOSUPPORT;
915 if (!bdaddr_type_is_le(chan->src_type)) {
920 if (sk->sk_state == BT_CONNECTED) {
925 if (get_user(opt, (u32 __user *) optval)) {
942 static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
943 struct msghdr *msg, size_t len)
945 struct sock *sk = sock->sk;
946 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
949 BT_DBG("sock %p, sk %p", sock, sk);
951 err = sock_error(sk);
955 if (msg->msg_flags & MSG_OOB)
958 if (sk->sk_state != BT_CONNECTED)
962 err = bt_sock_wait_ready(sk, msg->msg_flags);
967 l2cap_chan_lock(chan);
968 err = l2cap_chan_send(chan, msg, len, sk->sk_priority);
969 l2cap_chan_unlock(chan);
974 static int l2cap_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
975 struct msghdr *msg, size_t len, int flags)
977 struct sock *sk = sock->sk;
978 struct l2cap_pinfo *pi = l2cap_pi(sk);
983 if (sk->sk_state == BT_CONNECT2 && test_bit(BT_SK_DEFER_SETUP,
984 &bt_sk(sk)->flags)) {
985 if (bdaddr_type_is_le(pi->chan->src_type)) {
986 sk->sk_state = BT_CONNECTED;
987 pi->chan->state = BT_CONNECTED;
988 __l2cap_le_connect_rsp_defer(pi->chan);
990 sk->sk_state = BT_CONFIG;
991 pi->chan->state = BT_CONFIG;
992 __l2cap_connect_rsp_defer(pi->chan);
1001 if (sock->type == SOCK_STREAM)
1002 err = bt_sock_stream_recvmsg(iocb, sock, msg, len, flags);
1004 err = bt_sock_recvmsg(iocb, sock, msg, len, flags);
1006 if (pi->chan->mode != L2CAP_MODE_ERTM)
1009 /* Attempt to put pending rx data in the socket buffer */
1013 if (!test_bit(CONN_LOCAL_BUSY, &pi->chan->conn_state))
1016 if (pi->rx_busy_skb) {
1017 if (!sock_queue_rcv_skb(sk, pi->rx_busy_skb))
1018 pi->rx_busy_skb = NULL;
1023 /* Restore data flow when half of the receive buffer is
1024 * available. This avoids resending large numbers of
1027 if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf >> 1)
1028 l2cap_chan_busy(pi->chan, 0);
1035 /* Kill socket (only if zapped and orphan)
1036 * Must be called on unlocked socket.
1038 static void l2cap_sock_kill(struct sock *sk)
1040 if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket)
1043 BT_DBG("sk %p state %s", sk, state_to_string(sk->sk_state));
1045 /* Kill poor orphan */
1047 l2cap_chan_put(l2cap_pi(sk)->chan);
1048 sock_set_flag(sk, SOCK_DEAD);
1052 static int __l2cap_wait_ack(struct sock *sk)
1054 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1055 DECLARE_WAITQUEUE(wait, current);
1059 add_wait_queue(sk_sleep(sk), &wait);
1060 set_current_state(TASK_INTERRUPTIBLE);
1061 while (chan->unacked_frames > 0 && chan->conn) {
1065 if (signal_pending(current)) {
1066 err = sock_intr_errno(timeo);
1071 timeo = schedule_timeout(timeo);
1073 set_current_state(TASK_INTERRUPTIBLE);
1075 err = sock_error(sk);
1079 set_current_state(TASK_RUNNING);
1080 remove_wait_queue(sk_sleep(sk), &wait);
1084 static int l2cap_sock_shutdown(struct socket *sock, int how)
1086 struct sock *sk = sock->sk;
1087 struct l2cap_chan *chan;
1088 struct l2cap_conn *conn;
1091 BT_DBG("sock %p, sk %p", sock, sk);
1096 chan = l2cap_pi(sk)->chan;
1100 mutex_lock(&conn->chan_lock);
1102 l2cap_chan_lock(chan);
1105 if (!sk->sk_shutdown) {
1106 if (chan->mode == L2CAP_MODE_ERTM)
1107 err = __l2cap_wait_ack(sk);
1109 sk->sk_shutdown = SHUTDOWN_MASK;
1112 l2cap_chan_close(chan, 0);
1115 if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
1116 !(current->flags & PF_EXITING))
1117 err = bt_sock_wait_state(sk, BT_CLOSED,
1121 if (!err && sk->sk_err)
1125 l2cap_chan_unlock(chan);
1128 mutex_unlock(&conn->chan_lock);
1133 static int l2cap_sock_release(struct socket *sock)
1135 struct sock *sk = sock->sk;
1138 BT_DBG("sock %p, sk %p", sock, sk);
1143 bt_sock_unlink(&l2cap_sk_list, sk);
1145 err = l2cap_sock_shutdown(sock, 2);
1148 l2cap_sock_kill(sk);
1152 static void l2cap_sock_cleanup_listen(struct sock *parent)
1156 BT_DBG("parent %p", parent);
1158 /* Close not yet accepted channels */
1159 while ((sk = bt_accept_dequeue(parent, NULL))) {
1160 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1162 l2cap_chan_lock(chan);
1163 __clear_chan_timer(chan);
1164 l2cap_chan_close(chan, ECONNRESET);
1165 l2cap_chan_unlock(chan);
1167 l2cap_sock_kill(sk);
1171 static struct l2cap_chan *l2cap_sock_new_connection_cb(struct l2cap_chan *chan)
1173 struct sock *sk, *parent = chan->data;
1177 /* Check for backlog size */
1178 if (sk_acceptq_is_full(parent)) {
1179 BT_DBG("backlog full %d", parent->sk_ack_backlog);
1180 release_sock(parent);
1184 sk = l2cap_sock_alloc(sock_net(parent), NULL, BTPROTO_L2CAP,
1187 release_sock(parent);
1191 bt_sock_reclassify_lock(sk, BTPROTO_L2CAP);
1193 l2cap_sock_init(sk, parent);
1195 bt_accept_enqueue(parent, sk);
1197 release_sock(parent);
1199 return l2cap_pi(sk)->chan;
1202 static int l2cap_sock_recv_cb(struct l2cap_chan *chan, struct sk_buff *skb)
1204 struct sock *sk = chan->data;
1209 if (l2cap_pi(sk)->rx_busy_skb) {
1214 err = sock_queue_rcv_skb(sk, skb);
1216 /* For ERTM, handle one skb that doesn't fit into the recv
1217 * buffer. This is important to do because the data frames
1218 * have already been acked, so the skb cannot be discarded.
1220 * Notify the l2cap core that the buffer is full, so the
1221 * LOCAL_BUSY state is entered and no more frames are
1222 * acked and reassembled until there is buffer space
1225 if (err < 0 && chan->mode == L2CAP_MODE_ERTM) {
1226 l2cap_pi(sk)->rx_busy_skb = skb;
1227 l2cap_chan_busy(chan, 1);
1237 static void l2cap_sock_close_cb(struct l2cap_chan *chan)
1239 struct sock *sk = chan->data;
1241 l2cap_sock_kill(sk);
1244 static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
1246 struct sock *sk = chan->data;
1247 struct sock *parent;
1251 parent = bt_sk(sk)->parent;
1253 sock_set_flag(sk, SOCK_ZAPPED);
1255 switch (chan->state) {
1261 l2cap_sock_cleanup_listen(sk);
1262 sk->sk_state = BT_CLOSED;
1263 chan->state = BT_CLOSED;
1267 sk->sk_state = BT_CLOSED;
1268 chan->state = BT_CLOSED;
1273 bt_accept_unlink(sk);
1274 parent->sk_data_ready(parent, 0);
1276 sk->sk_state_change(sk);
1285 static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
1288 struct sock *sk = chan->data;
1290 sk->sk_state = state;
1296 static struct sk_buff *l2cap_sock_alloc_skb_cb(struct l2cap_chan *chan,
1297 unsigned long len, int nb)
1299 struct sock *sk = chan->data;
1300 struct sk_buff *skb;
1303 l2cap_chan_unlock(chan);
1304 skb = bt_skb_send_alloc(sk, len, nb, &err);
1305 l2cap_chan_lock(chan);
1308 return ERR_PTR(err);
1310 bt_cb(skb)->chan = chan;
1315 static void l2cap_sock_ready_cb(struct l2cap_chan *chan)
1317 struct sock *sk = chan->data;
1318 struct sock *parent;
1322 parent = bt_sk(sk)->parent;
1324 BT_DBG("sk %p, parent %p", sk, parent);
1326 sk->sk_state = BT_CONNECTED;
1327 sk->sk_state_change(sk);
1330 parent->sk_data_ready(parent, 0);
1335 static void l2cap_sock_defer_cb(struct l2cap_chan *chan)
1337 struct sock *parent, *sk = chan->data;
1341 parent = bt_sk(sk)->parent;
1343 parent->sk_data_ready(parent, 0);
1348 static void l2cap_sock_resume_cb(struct l2cap_chan *chan)
1350 struct sock *sk = chan->data;
1352 clear_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1353 sk->sk_state_change(sk);
1356 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan *chan)
1358 struct sock *sk = chan->data;
1361 sk->sk_shutdown = SHUTDOWN_MASK;
1365 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan *chan)
1367 struct sock *sk = chan->data;
1369 return sk->sk_sndtimeo;
1372 static void l2cap_sock_suspend_cb(struct l2cap_chan *chan)
1374 struct sock *sk = chan->data;
1376 set_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags);
1377 sk->sk_state_change(sk);
1380 static struct l2cap_ops l2cap_chan_ops = {
1381 .name = "L2CAP Socket Interface",
1382 .new_connection = l2cap_sock_new_connection_cb,
1383 .recv = l2cap_sock_recv_cb,
1384 .close = l2cap_sock_close_cb,
1385 .teardown = l2cap_sock_teardown_cb,
1386 .state_change = l2cap_sock_state_change_cb,
1387 .ready = l2cap_sock_ready_cb,
1388 .defer = l2cap_sock_defer_cb,
1389 .resume = l2cap_sock_resume_cb,
1390 .suspend = l2cap_sock_suspend_cb,
1391 .set_shutdown = l2cap_sock_set_shutdown_cb,
1392 .get_sndtimeo = l2cap_sock_get_sndtimeo_cb,
1393 .alloc_skb = l2cap_sock_alloc_skb_cb,
1396 static void l2cap_sock_destruct(struct sock *sk)
1398 BT_DBG("sk %p", sk);
1400 if (l2cap_pi(sk)->chan)
1401 l2cap_chan_put(l2cap_pi(sk)->chan);
1403 if (l2cap_pi(sk)->rx_busy_skb) {
1404 kfree_skb(l2cap_pi(sk)->rx_busy_skb);
1405 l2cap_pi(sk)->rx_busy_skb = NULL;
1408 skb_queue_purge(&sk->sk_receive_queue);
1409 skb_queue_purge(&sk->sk_write_queue);
1412 static void l2cap_skb_msg_name(struct sk_buff *skb, void *msg_name,
1415 DECLARE_SOCKADDR(struct sockaddr_l2 *, la, msg_name);
1417 memset(la, 0, sizeof(struct sockaddr_l2));
1418 la->l2_family = AF_BLUETOOTH;
1419 la->l2_psm = bt_cb(skb)->psm;
1420 bacpy(&la->l2_bdaddr, &bt_cb(skb)->bdaddr);
1422 *msg_namelen = sizeof(struct sockaddr_l2);
1425 static void l2cap_sock_init(struct sock *sk, struct sock *parent)
1427 struct l2cap_chan *chan = l2cap_pi(sk)->chan;
1429 BT_DBG("sk %p", sk);
1432 struct l2cap_chan *pchan = l2cap_pi(parent)->chan;
1434 sk->sk_type = parent->sk_type;
1435 bt_sk(sk)->flags = bt_sk(parent)->flags;
1437 chan->chan_type = pchan->chan_type;
1438 chan->imtu = pchan->imtu;
1439 chan->omtu = pchan->omtu;
1440 chan->conf_state = pchan->conf_state;
1441 chan->mode = pchan->mode;
1442 chan->fcs = pchan->fcs;
1443 chan->max_tx = pchan->max_tx;
1444 chan->tx_win = pchan->tx_win;
1445 chan->tx_win_max = pchan->tx_win_max;
1446 chan->sec_level = pchan->sec_level;
1447 chan->flags = pchan->flags;
1448 chan->tx_credits = pchan->tx_credits;
1449 chan->rx_credits = pchan->rx_credits;
1451 security_sk_clone(parent, sk);
1453 switch (sk->sk_type) {
1455 chan->chan_type = L2CAP_CHAN_RAW;
1458 chan->chan_type = L2CAP_CHAN_CONN_LESS;
1459 bt_sk(sk)->skb_msg_name = l2cap_skb_msg_name;
1461 case SOCK_SEQPACKET:
1463 chan->chan_type = L2CAP_CHAN_CONN_ORIENTED;
1467 chan->imtu = L2CAP_DEFAULT_MTU;
1469 if (!disable_ertm && sk->sk_type == SOCK_STREAM) {
1470 chan->mode = L2CAP_MODE_ERTM;
1471 set_bit(CONF_STATE2_DEVICE, &chan->conf_state);
1473 chan->mode = L2CAP_MODE_BASIC;
1476 l2cap_chan_set_defaults(chan);
1479 /* Default config options */
1480 chan->flush_to = L2CAP_DEFAULT_FLUSH_TO;
1483 chan->ops = &l2cap_chan_ops;
1486 static struct proto l2cap_proto = {
1488 .owner = THIS_MODULE,
1489 .obj_size = sizeof(struct l2cap_pinfo)
1492 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock,
1493 int proto, gfp_t prio)
1496 struct l2cap_chan *chan;
1498 sk = sk_alloc(net, PF_BLUETOOTH, prio, &l2cap_proto);
1502 sock_init_data(sock, sk);
1503 INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
1505 sk->sk_destruct = l2cap_sock_destruct;
1506 sk->sk_sndtimeo = L2CAP_CONN_TIMEOUT;
1508 sock_reset_flag(sk, SOCK_ZAPPED);
1510 sk->sk_protocol = proto;
1511 sk->sk_state = BT_OPEN;
1513 chan = l2cap_chan_create();
1519 l2cap_chan_hold(chan);
1521 l2cap_pi(sk)->chan = chan;
1526 static int l2cap_sock_create(struct net *net, struct socket *sock, int protocol,
1531 BT_DBG("sock %p", sock);
1533 sock->state = SS_UNCONNECTED;
1535 if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM &&
1536 sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
1537 return -ESOCKTNOSUPPORT;
1539 if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
1542 sock->ops = &l2cap_sock_ops;
1544 sk = l2cap_sock_alloc(net, sock, protocol, GFP_ATOMIC);
1548 l2cap_sock_init(sk, NULL);
1549 bt_sock_link(&l2cap_sk_list, sk);
1553 static const struct proto_ops l2cap_sock_ops = {
1554 .family = PF_BLUETOOTH,
1555 .owner = THIS_MODULE,
1556 .release = l2cap_sock_release,
1557 .bind = l2cap_sock_bind,
1558 .connect = l2cap_sock_connect,
1559 .listen = l2cap_sock_listen,
1560 .accept = l2cap_sock_accept,
1561 .getname = l2cap_sock_getname,
1562 .sendmsg = l2cap_sock_sendmsg,
1563 .recvmsg = l2cap_sock_recvmsg,
1564 .poll = bt_sock_poll,
1565 .ioctl = bt_sock_ioctl,
1566 .mmap = sock_no_mmap,
1567 .socketpair = sock_no_socketpair,
1568 .shutdown = l2cap_sock_shutdown,
1569 .setsockopt = l2cap_sock_setsockopt,
1570 .getsockopt = l2cap_sock_getsockopt
1573 static const struct net_proto_family l2cap_sock_family_ops = {
1574 .family = PF_BLUETOOTH,
1575 .owner = THIS_MODULE,
1576 .create = l2cap_sock_create,
1579 int __init l2cap_init_sockets(void)
1583 err = proto_register(&l2cap_proto, 0);
1587 err = bt_sock_register(BTPROTO_L2CAP, &l2cap_sock_family_ops);
1589 BT_ERR("L2CAP socket registration failed");
1593 err = bt_procfs_init(&init_net, "l2cap", &l2cap_sk_list,
1596 BT_ERR("Failed to create L2CAP proc file");
1597 bt_sock_unregister(BTPROTO_L2CAP);
1601 BT_INFO("L2CAP socket layer initialized");
1606 proto_unregister(&l2cap_proto);
1610 void l2cap_cleanup_sockets(void)
1612 bt_procfs_cleanup(&init_net, "l2cap");
1613 bt_sock_unregister(BTPROTO_L2CAP);
1614 proto_unregister(&l2cap_proto);
1617 module_param(enable_lecoc, bool, 0644);
1618 MODULE_PARM_DESC(enable_lecoc, "Enable support for LE CoC");