2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2009-2010 Gustavo F. Padovan <gustavo@padovan.org>
5 Copyright (C) 2010 Google Inc.
6 Copyright (C) 2011 ProFUSION Embedded Systems
8 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License version 2 as
12 published by the Free Software Foundation;
14 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
15 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
16 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
17 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
18 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
19 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
20 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
21 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
24 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
25 SOFTWARE IS DISCLAIMED.
28 /* Bluetooth L2CAP sockets. */
30 #include <linux/module.h>
31 #include <linux/export.h>
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35 #include <net/bluetooth/l2cap.h>
39 static struct bt_sock_list l2cap_sk_list
= {
40 .lock
= __RW_LOCK_UNLOCKED(l2cap_sk_list
.lock
)
43 static const struct proto_ops l2cap_sock_ops
;
44 static void l2cap_sock_init(struct sock
*sk
, struct sock
*parent
);
45 static struct sock
*l2cap_sock_alloc(struct net
*net
, struct socket
*sock
,
46 int proto
, gfp_t prio
);
48 bool l2cap_is_socket(struct socket
*sock
)
50 return sock
&& sock
->ops
== &l2cap_sock_ops
;
52 EXPORT_SYMBOL(l2cap_is_socket
);
54 static int l2cap_validate_bredr_psm(u16 psm
)
56 /* PSM must be odd and lsb of upper byte must be 0 */
57 if ((psm
& 0x0101) != 0x0001)
60 /* Restrict usage of well-known PSMs */
61 if (psm
< 0x1001 && !capable(CAP_NET_BIND_SERVICE
))
67 static int l2cap_validate_le_psm(u16 psm
)
69 /* Valid LE_PSM ranges are defined only until 0x00ff */
73 /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
74 if (psm
<= 0x007f && !capable(CAP_NET_BIND_SERVICE
))
80 static int l2cap_sock_bind(struct socket
*sock
, struct sockaddr
*addr
, int alen
)
82 struct sock
*sk
= sock
->sk
;
83 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
84 struct sockaddr_l2 la
;
89 if (!addr
|| addr
->sa_family
!= AF_BLUETOOTH
)
92 memset(&la
, 0, sizeof(la
));
93 len
= min_t(unsigned int, sizeof(la
), alen
);
94 memcpy(&la
, addr
, len
);
96 if (la
.l2_cid
&& la
.l2_psm
)
99 if (!bdaddr_type_is_valid(la
.l2_bdaddr_type
))
103 /* When the socket gets created it defaults to
104 * CHAN_CONN_ORIENTED, so we need to overwrite the
107 chan
->chan_type
= L2CAP_CHAN_FIXED
;
108 chan
->omtu
= L2CAP_DEFAULT_MTU
;
111 if (bdaddr_type_is_le(la
.l2_bdaddr_type
)) {
112 /* We only allow ATT user space socket */
114 la
.l2_cid
!= cpu_to_le16(L2CAP_CID_ATT
))
120 if (sk
->sk_state
!= BT_OPEN
) {
126 __u16 psm
= __le16_to_cpu(la
.l2_psm
);
128 if (la
.l2_bdaddr_type
== BDADDR_BREDR
)
129 err
= l2cap_validate_bredr_psm(psm
);
131 err
= l2cap_validate_le_psm(psm
);
138 err
= l2cap_add_scid(chan
, __le16_to_cpu(la
.l2_cid
));
140 err
= l2cap_add_psm(chan
, &la
.l2_bdaddr
, la
.l2_psm
);
145 switch (chan
->chan_type
) {
146 case L2CAP_CHAN_CONN_LESS
:
147 if (__le16_to_cpu(la
.l2_psm
) == L2CAP_PSM_3DSP
)
148 chan
->sec_level
= BT_SECURITY_SDP
;
150 case L2CAP_CHAN_CONN_ORIENTED
:
151 if (__le16_to_cpu(la
.l2_psm
) == L2CAP_PSM_SDP
||
152 __le16_to_cpu(la
.l2_psm
) == L2CAP_PSM_RFCOMM
)
153 chan
->sec_level
= BT_SECURITY_SDP
;
156 chan
->sec_level
= BT_SECURITY_SDP
;
160 bacpy(&chan
->src
, &la
.l2_bdaddr
);
161 chan
->src_type
= la
.l2_bdaddr_type
;
163 if (chan
->psm
&& bdaddr_type_is_le(chan
->src_type
))
164 chan
->mode
= L2CAP_MODE_LE_FLOWCTL
;
166 chan
->state
= BT_BOUND
;
167 sk
->sk_state
= BT_BOUND
;
174 static int l2cap_sock_connect(struct socket
*sock
, struct sockaddr
*addr
,
177 struct sock
*sk
= sock
->sk
;
178 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
179 struct sockaddr_l2 la
;
184 if (!addr
|| alen
< sizeof(addr
->sa_family
) ||
185 addr
->sa_family
!= AF_BLUETOOTH
)
188 memset(&la
, 0, sizeof(la
));
189 len
= min_t(unsigned int, sizeof(la
), alen
);
190 memcpy(&la
, addr
, len
);
192 if (la
.l2_cid
&& la
.l2_psm
)
195 if (!bdaddr_type_is_valid(la
.l2_bdaddr_type
))
198 /* Check that the socket wasn't bound to something that
199 * conflicts with the address given to connect(). If chan->src
200 * is BDADDR_ANY it means bind() was never used, in which case
201 * chan->src_type and la.l2_bdaddr_type do not need to match.
203 if (chan
->src_type
== BDADDR_BREDR
&& bacmp(&chan
->src
, BDADDR_ANY
) &&
204 bdaddr_type_is_le(la
.l2_bdaddr_type
)) {
205 /* Old user space versions will try to incorrectly bind
206 * the ATT socket using BDADDR_BREDR. We need to accept
207 * this and fix up the source address type only when
208 * both the source CID and destination CID indicate
209 * ATT. Anything else is an invalid combination.
211 if (chan
->scid
!= L2CAP_CID_ATT
||
212 la
.l2_cid
!= cpu_to_le16(L2CAP_CID_ATT
))
215 /* We don't have the hdev available here to make a
216 * better decision on random vs public, but since all
217 * user space versions that exhibit this issue anyway do
218 * not support random local addresses assuming public
219 * here is good enough.
221 chan
->src_type
= BDADDR_LE_PUBLIC
;
224 if (chan
->src_type
!= BDADDR_BREDR
&& la
.l2_bdaddr_type
== BDADDR_BREDR
)
227 if (bdaddr_type_is_le(la
.l2_bdaddr_type
)) {
228 /* We only allow ATT user space socket */
230 la
.l2_cid
!= cpu_to_le16(L2CAP_CID_ATT
))
234 if (chan
->psm
&& bdaddr_type_is_le(chan
->src_type
))
235 chan
->mode
= L2CAP_MODE_LE_FLOWCTL
;
237 err
= l2cap_chan_connect(chan
, la
.l2_psm
, __le16_to_cpu(la
.l2_cid
),
238 &la
.l2_bdaddr
, la
.l2_bdaddr_type
);
244 err
= bt_sock_wait_state(sk
, BT_CONNECTED
,
245 sock_sndtimeo(sk
, flags
& O_NONBLOCK
));
252 static int l2cap_sock_listen(struct socket
*sock
, int backlog
)
254 struct sock
*sk
= sock
->sk
;
255 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
258 BT_DBG("sk %p backlog %d", sk
, backlog
);
262 if (sk
->sk_state
!= BT_BOUND
) {
267 if (sk
->sk_type
!= SOCK_SEQPACKET
&& sk
->sk_type
!= SOCK_STREAM
) {
272 switch (chan
->mode
) {
273 case L2CAP_MODE_BASIC
:
274 case L2CAP_MODE_LE_FLOWCTL
:
276 case L2CAP_MODE_ERTM
:
277 case L2CAP_MODE_STREAMING
:
286 sk
->sk_max_ack_backlog
= backlog
;
287 sk
->sk_ack_backlog
= 0;
289 chan
->state
= BT_LISTEN
;
290 sk
->sk_state
= BT_LISTEN
;
297 static int l2cap_sock_accept(struct socket
*sock
, struct socket
*newsock
,
300 DECLARE_WAITQUEUE(wait
, current
);
301 struct sock
*sk
= sock
->sk
, *nsk
;
305 lock_sock_nested(sk
, SINGLE_DEPTH_NESTING
);
307 timeo
= sock_rcvtimeo(sk
, flags
& O_NONBLOCK
);
309 BT_DBG("sk %p timeo %ld", sk
, timeo
);
311 /* Wait for an incoming connection. (wake-one). */
312 add_wait_queue_exclusive(sk_sleep(sk
), &wait
);
314 set_current_state(TASK_INTERRUPTIBLE
);
316 if (sk
->sk_state
!= BT_LISTEN
) {
321 nsk
= bt_accept_dequeue(sk
, newsock
);
330 if (signal_pending(current
)) {
331 err
= sock_intr_errno(timeo
);
336 timeo
= schedule_timeout(timeo
);
337 lock_sock_nested(sk
, SINGLE_DEPTH_NESTING
);
339 __set_current_state(TASK_RUNNING
);
340 remove_wait_queue(sk_sleep(sk
), &wait
);
345 newsock
->state
= SS_CONNECTED
;
347 BT_DBG("new socket %p", nsk
);
354 static int l2cap_sock_getname(struct socket
*sock
, struct sockaddr
*addr
,
357 struct sockaddr_l2
*la
= (struct sockaddr_l2
*) addr
;
358 struct sock
*sk
= sock
->sk
;
359 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
361 BT_DBG("sock %p, sk %p", sock
, sk
);
363 if (peer
&& sk
->sk_state
!= BT_CONNECTED
&&
364 sk
->sk_state
!= BT_CONNECT
&& sk
->sk_state
!= BT_CONNECT2
)
367 memset(la
, 0, sizeof(struct sockaddr_l2
));
368 addr
->sa_family
= AF_BLUETOOTH
;
369 *len
= sizeof(struct sockaddr_l2
);
371 la
->l2_psm
= chan
->psm
;
374 bacpy(&la
->l2_bdaddr
, &chan
->dst
);
375 la
->l2_cid
= cpu_to_le16(chan
->dcid
);
376 la
->l2_bdaddr_type
= chan
->dst_type
;
378 bacpy(&la
->l2_bdaddr
, &chan
->src
);
379 la
->l2_cid
= cpu_to_le16(chan
->scid
);
380 la
->l2_bdaddr_type
= chan
->src_type
;
386 static int l2cap_sock_getsockopt_old(struct socket
*sock
, int optname
,
387 char __user
*optval
, int __user
*optlen
)
389 struct sock
*sk
= sock
->sk
;
390 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
391 struct l2cap_options opts
;
392 struct l2cap_conninfo cinfo
;
398 if (get_user(len
, optlen
))
405 /* LE sockets should use BT_SNDMTU/BT_RCVMTU, but since
406 * legacy ATT code depends on getsockopt for
407 * L2CAP_OPTIONS we need to let this pass.
409 if (bdaddr_type_is_le(chan
->src_type
) &&
410 chan
->scid
!= L2CAP_CID_ATT
) {
415 memset(&opts
, 0, sizeof(opts
));
416 opts
.imtu
= chan
->imtu
;
417 opts
.omtu
= chan
->omtu
;
418 opts
.flush_to
= chan
->flush_to
;
419 opts
.mode
= chan
->mode
;
420 opts
.fcs
= chan
->fcs
;
421 opts
.max_tx
= chan
->max_tx
;
422 opts
.txwin_size
= chan
->tx_win
;
424 len
= min_t(unsigned int, len
, sizeof(opts
));
425 if (copy_to_user(optval
, (char *) &opts
, len
))
431 switch (chan
->sec_level
) {
432 case BT_SECURITY_LOW
:
435 case BT_SECURITY_MEDIUM
:
436 opt
= L2CAP_LM_AUTH
| L2CAP_LM_ENCRYPT
;
438 case BT_SECURITY_HIGH
:
439 opt
= L2CAP_LM_AUTH
| L2CAP_LM_ENCRYPT
|
442 case BT_SECURITY_FIPS
:
443 opt
= L2CAP_LM_AUTH
| L2CAP_LM_ENCRYPT
|
444 L2CAP_LM_SECURE
| L2CAP_LM_FIPS
;
451 if (test_bit(FLAG_ROLE_SWITCH
, &chan
->flags
))
452 opt
|= L2CAP_LM_MASTER
;
454 if (test_bit(FLAG_FORCE_RELIABLE
, &chan
->flags
))
455 opt
|= L2CAP_LM_RELIABLE
;
457 if (put_user(opt
, (u32 __user
*) optval
))
463 if (sk
->sk_state
!= BT_CONNECTED
&&
464 !(sk
->sk_state
== BT_CONNECT2
&&
465 test_bit(BT_SK_DEFER_SETUP
, &bt_sk(sk
)->flags
))) {
470 memset(&cinfo
, 0, sizeof(cinfo
));
471 cinfo
.hci_handle
= chan
->conn
->hcon
->handle
;
472 memcpy(cinfo
.dev_class
, chan
->conn
->hcon
->dev_class
, 3);
474 len
= min_t(unsigned int, len
, sizeof(cinfo
));
475 if (copy_to_user(optval
, (char *) &cinfo
, len
))
489 static int l2cap_sock_getsockopt(struct socket
*sock
, int level
, int optname
,
490 char __user
*optval
, int __user
*optlen
)
492 struct sock
*sk
= sock
->sk
;
493 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
494 struct bt_security sec
;
500 if (level
== SOL_L2CAP
)
501 return l2cap_sock_getsockopt_old(sock
, optname
, optval
, optlen
);
503 if (level
!= SOL_BLUETOOTH
)
506 if (get_user(len
, optlen
))
513 if (chan
->chan_type
!= L2CAP_CHAN_CONN_ORIENTED
&&
514 chan
->chan_type
!= L2CAP_CHAN_FIXED
&&
515 chan
->chan_type
!= L2CAP_CHAN_RAW
) {
520 memset(&sec
, 0, sizeof(sec
));
522 sec
.level
= chan
->conn
->hcon
->sec_level
;
524 if (sk
->sk_state
== BT_CONNECTED
)
525 sec
.key_size
= chan
->conn
->hcon
->enc_key_size
;
527 sec
.level
= chan
->sec_level
;
530 len
= min_t(unsigned int, len
, sizeof(sec
));
531 if (copy_to_user(optval
, (char *) &sec
, len
))
537 if (sk
->sk_state
!= BT_BOUND
&& sk
->sk_state
!= BT_LISTEN
) {
542 if (put_user(test_bit(BT_SK_DEFER_SETUP
, &bt_sk(sk
)->flags
),
543 (u32 __user
*) optval
))
549 if (put_user(test_bit(FLAG_FLUSHABLE
, &chan
->flags
),
550 (u32 __user
*) optval
))
556 if (sk
->sk_type
!= SOCK_SEQPACKET
&& sk
->sk_type
!= SOCK_STREAM
557 && sk
->sk_type
!= SOCK_RAW
) {
562 pwr
.force_active
= test_bit(FLAG_FORCE_ACTIVE
, &chan
->flags
);
564 len
= min_t(unsigned int, len
, sizeof(pwr
));
565 if (copy_to_user(optval
, (char *) &pwr
, len
))
570 case BT_CHANNEL_POLICY
:
571 if (put_user(chan
->chan_policy
, (u32 __user
*) optval
))
576 if (!bdaddr_type_is_le(chan
->src_type
)) {
581 if (sk
->sk_state
!= BT_CONNECTED
) {
586 if (put_user(chan
->omtu
, (u16 __user
*) optval
))
591 if (!bdaddr_type_is_le(chan
->src_type
)) {
596 if (put_user(chan
->imtu
, (u16 __user
*) optval
))
609 static bool l2cap_valid_mtu(struct l2cap_chan
*chan
, u16 mtu
)
611 switch (chan
->scid
) {
613 if (mtu
< L2CAP_LE_MIN_MTU
)
618 if (mtu
< L2CAP_DEFAULT_MIN_MTU
)
625 static int l2cap_sock_setsockopt_old(struct socket
*sock
, int optname
,
626 char __user
*optval
, unsigned int optlen
)
628 struct sock
*sk
= sock
->sk
;
629 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
630 struct l2cap_options opts
;
640 if (bdaddr_type_is_le(chan
->src_type
)) {
645 if (sk
->sk_state
== BT_CONNECTED
) {
650 opts
.imtu
= chan
->imtu
;
651 opts
.omtu
= chan
->omtu
;
652 opts
.flush_to
= chan
->flush_to
;
653 opts
.mode
= chan
->mode
;
654 opts
.fcs
= chan
->fcs
;
655 opts
.max_tx
= chan
->max_tx
;
656 opts
.txwin_size
= chan
->tx_win
;
658 len
= min_t(unsigned int, sizeof(opts
), optlen
);
659 if (copy_from_user((char *) &opts
, optval
, len
)) {
664 if (opts
.txwin_size
> L2CAP_DEFAULT_EXT_WINDOW
) {
669 if (!l2cap_valid_mtu(chan
, opts
.imtu
)) {
674 chan
->mode
= opts
.mode
;
675 switch (chan
->mode
) {
676 case L2CAP_MODE_LE_FLOWCTL
:
678 case L2CAP_MODE_BASIC
:
679 clear_bit(CONF_STATE2_DEVICE
, &chan
->conf_state
);
681 case L2CAP_MODE_ERTM
:
682 case L2CAP_MODE_STREAMING
:
691 chan
->imtu
= opts
.imtu
;
692 chan
->omtu
= opts
.omtu
;
693 chan
->fcs
= opts
.fcs
;
694 chan
->max_tx
= opts
.max_tx
;
695 chan
->tx_win
= opts
.txwin_size
;
696 chan
->flush_to
= opts
.flush_to
;
700 if (get_user(opt
, (u32 __user
*) optval
)) {
705 if (opt
& L2CAP_LM_FIPS
) {
710 if (opt
& L2CAP_LM_AUTH
)
711 chan
->sec_level
= BT_SECURITY_LOW
;
712 if (opt
& L2CAP_LM_ENCRYPT
)
713 chan
->sec_level
= BT_SECURITY_MEDIUM
;
714 if (opt
& L2CAP_LM_SECURE
)
715 chan
->sec_level
= BT_SECURITY_HIGH
;
717 if (opt
& L2CAP_LM_MASTER
)
718 set_bit(FLAG_ROLE_SWITCH
, &chan
->flags
);
720 clear_bit(FLAG_ROLE_SWITCH
, &chan
->flags
);
722 if (opt
& L2CAP_LM_RELIABLE
)
723 set_bit(FLAG_FORCE_RELIABLE
, &chan
->flags
);
725 clear_bit(FLAG_FORCE_RELIABLE
, &chan
->flags
);
737 static int l2cap_sock_setsockopt(struct socket
*sock
, int level
, int optname
,
738 char __user
*optval
, unsigned int optlen
)
740 struct sock
*sk
= sock
->sk
;
741 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
742 struct bt_security sec
;
744 struct l2cap_conn
*conn
;
750 if (level
== SOL_L2CAP
)
751 return l2cap_sock_setsockopt_old(sock
, optname
, optval
, optlen
);
753 if (level
!= SOL_BLUETOOTH
)
760 if (chan
->chan_type
!= L2CAP_CHAN_CONN_ORIENTED
&&
761 chan
->chan_type
!= L2CAP_CHAN_FIXED
&&
762 chan
->chan_type
!= L2CAP_CHAN_RAW
) {
767 sec
.level
= BT_SECURITY_LOW
;
769 len
= min_t(unsigned int, sizeof(sec
), optlen
);
770 if (copy_from_user((char *) &sec
, optval
, len
)) {
775 if (sec
.level
< BT_SECURITY_LOW
||
776 sec
.level
> BT_SECURITY_HIGH
) {
781 chan
->sec_level
= sec
.level
;
788 /*change security for LE channels */
789 if (chan
->scid
== L2CAP_CID_ATT
) {
790 if (smp_conn_security(conn
->hcon
, sec
.level
))
792 sk
->sk_state
= BT_CONFIG
;
793 chan
->state
= BT_CONFIG
;
795 /* or for ACL link */
796 } else if ((sk
->sk_state
== BT_CONNECT2
&&
797 test_bit(BT_SK_DEFER_SETUP
, &bt_sk(sk
)->flags
)) ||
798 sk
->sk_state
== BT_CONNECTED
) {
799 if (!l2cap_chan_check_security(chan
))
800 set_bit(BT_SK_SUSPEND
, &bt_sk(sk
)->flags
);
802 sk
->sk_state_change(sk
);
809 if (sk
->sk_state
!= BT_BOUND
&& sk
->sk_state
!= BT_LISTEN
) {
814 if (get_user(opt
, (u32 __user
*) optval
)) {
820 set_bit(BT_SK_DEFER_SETUP
, &bt_sk(sk
)->flags
);
821 set_bit(FLAG_DEFER_SETUP
, &chan
->flags
);
823 clear_bit(BT_SK_DEFER_SETUP
, &bt_sk(sk
)->flags
);
824 clear_bit(FLAG_DEFER_SETUP
, &chan
->flags
);
829 if (get_user(opt
, (u32 __user
*) optval
)) {
834 if (opt
> BT_FLUSHABLE_ON
) {
839 if (opt
== BT_FLUSHABLE_OFF
) {
841 /* proceed further only when we have l2cap_conn and
842 No Flush support in the LM */
843 if (!conn
|| !lmp_no_flush_capable(conn
->hcon
->hdev
)) {
850 set_bit(FLAG_FLUSHABLE
, &chan
->flags
);
852 clear_bit(FLAG_FLUSHABLE
, &chan
->flags
);
856 if (chan
->chan_type
!= L2CAP_CHAN_CONN_ORIENTED
&&
857 chan
->chan_type
!= L2CAP_CHAN_RAW
) {
862 pwr
.force_active
= BT_POWER_FORCE_ACTIVE_ON
;
864 len
= min_t(unsigned int, sizeof(pwr
), optlen
);
865 if (copy_from_user((char *) &pwr
, optval
, len
)) {
870 if (pwr
.force_active
)
871 set_bit(FLAG_FORCE_ACTIVE
, &chan
->flags
);
873 clear_bit(FLAG_FORCE_ACTIVE
, &chan
->flags
);
876 case BT_CHANNEL_POLICY
:
877 if (get_user(opt
, (u32 __user
*) optval
)) {
882 if (opt
> BT_CHANNEL_POLICY_AMP_PREFERRED
) {
887 if (chan
->mode
!= L2CAP_MODE_ERTM
&&
888 chan
->mode
!= L2CAP_MODE_STREAMING
) {
893 chan
->chan_policy
= (u8
) opt
;
895 if (sk
->sk_state
== BT_CONNECTED
&&
896 chan
->move_role
== L2CAP_MOVE_ROLE_NONE
)
897 l2cap_move_start(chan
);
902 if (!bdaddr_type_is_le(chan
->src_type
)) {
907 /* Setting is not supported as it's the remote side that
914 if (!bdaddr_type_is_le(chan
->src_type
)) {
919 if (sk
->sk_state
== BT_CONNECTED
) {
924 if (get_user(opt
, (u32 __user
*) optval
)) {
941 static int l2cap_sock_sendmsg(struct kiocb
*iocb
, struct socket
*sock
,
942 struct msghdr
*msg
, size_t len
)
944 struct sock
*sk
= sock
->sk
;
945 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
948 BT_DBG("sock %p, sk %p", sock
, sk
);
950 err
= sock_error(sk
);
954 if (msg
->msg_flags
& MSG_OOB
)
957 if (sk
->sk_state
!= BT_CONNECTED
)
961 err
= bt_sock_wait_ready(sk
, msg
->msg_flags
);
966 l2cap_chan_lock(chan
);
967 err
= l2cap_chan_send(chan
, msg
, len
, sk
->sk_priority
);
968 l2cap_chan_unlock(chan
);
973 static int l2cap_sock_recvmsg(struct kiocb
*iocb
, struct socket
*sock
,
974 struct msghdr
*msg
, size_t len
, int flags
)
976 struct sock
*sk
= sock
->sk
;
977 struct l2cap_pinfo
*pi
= l2cap_pi(sk
);
982 if (sk
->sk_state
== BT_CONNECT2
&& test_bit(BT_SK_DEFER_SETUP
,
983 &bt_sk(sk
)->flags
)) {
984 if (bdaddr_type_is_le(pi
->chan
->src_type
)) {
985 sk
->sk_state
= BT_CONNECTED
;
986 pi
->chan
->state
= BT_CONNECTED
;
987 __l2cap_le_connect_rsp_defer(pi
->chan
);
989 sk
->sk_state
= BT_CONFIG
;
990 pi
->chan
->state
= BT_CONFIG
;
991 __l2cap_connect_rsp_defer(pi
->chan
);
1000 if (sock
->type
== SOCK_STREAM
)
1001 err
= bt_sock_stream_recvmsg(iocb
, sock
, msg
, len
, flags
);
1003 err
= bt_sock_recvmsg(iocb
, sock
, msg
, len
, flags
);
1005 if (pi
->chan
->mode
!= L2CAP_MODE_ERTM
)
1008 /* Attempt to put pending rx data in the socket buffer */
1012 if (!test_bit(CONN_LOCAL_BUSY
, &pi
->chan
->conn_state
))
1015 if (pi
->rx_busy_skb
) {
1016 if (!sock_queue_rcv_skb(sk
, pi
->rx_busy_skb
))
1017 pi
->rx_busy_skb
= NULL
;
1022 /* Restore data flow when half of the receive buffer is
1023 * available. This avoids resending large numbers of
1026 if (atomic_read(&sk
->sk_rmem_alloc
) <= sk
->sk_rcvbuf
>> 1)
1027 l2cap_chan_busy(pi
->chan
, 0);
1034 /* Kill socket (only if zapped and orphan)
1035 * Must be called on unlocked socket.
1037 static void l2cap_sock_kill(struct sock
*sk
)
1039 if (!sock_flag(sk
, SOCK_ZAPPED
) || sk
->sk_socket
)
1042 BT_DBG("sk %p state %s", sk
, state_to_string(sk
->sk_state
));
1044 /* Kill poor orphan */
1046 l2cap_chan_put(l2cap_pi(sk
)->chan
);
1047 sock_set_flag(sk
, SOCK_DEAD
);
1051 static int __l2cap_wait_ack(struct sock
*sk
)
1053 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
1054 DECLARE_WAITQUEUE(wait
, current
);
1058 add_wait_queue(sk_sleep(sk
), &wait
);
1059 set_current_state(TASK_INTERRUPTIBLE
);
1060 while (chan
->unacked_frames
> 0 && chan
->conn
) {
1064 if (signal_pending(current
)) {
1065 err
= sock_intr_errno(timeo
);
1070 timeo
= schedule_timeout(timeo
);
1072 set_current_state(TASK_INTERRUPTIBLE
);
1074 err
= sock_error(sk
);
1078 set_current_state(TASK_RUNNING
);
1079 remove_wait_queue(sk_sleep(sk
), &wait
);
1083 static int l2cap_sock_shutdown(struct socket
*sock
, int how
)
1085 struct sock
*sk
= sock
->sk
;
1086 struct l2cap_chan
*chan
;
1087 struct l2cap_conn
*conn
;
1090 BT_DBG("sock %p, sk %p", sock
, sk
);
1095 chan
= l2cap_pi(sk
)->chan
;
1099 mutex_lock(&conn
->chan_lock
);
1101 l2cap_chan_lock(chan
);
1104 if (!sk
->sk_shutdown
) {
1105 if (chan
->mode
== L2CAP_MODE_ERTM
)
1106 err
= __l2cap_wait_ack(sk
);
1108 sk
->sk_shutdown
= SHUTDOWN_MASK
;
1111 l2cap_chan_close(chan
, 0);
1114 if (sock_flag(sk
, SOCK_LINGER
) && sk
->sk_lingertime
)
1115 err
= bt_sock_wait_state(sk
, BT_CLOSED
,
1119 if (!err
&& sk
->sk_err
)
1123 l2cap_chan_unlock(chan
);
1126 mutex_unlock(&conn
->chan_lock
);
1131 static int l2cap_sock_release(struct socket
*sock
)
1133 struct sock
*sk
= sock
->sk
;
1136 BT_DBG("sock %p, sk %p", sock
, sk
);
1141 bt_sock_unlink(&l2cap_sk_list
, sk
);
1143 err
= l2cap_sock_shutdown(sock
, 2);
1146 l2cap_sock_kill(sk
);
1150 static void l2cap_sock_cleanup_listen(struct sock
*parent
)
1154 BT_DBG("parent %p", parent
);
1156 /* Close not yet accepted channels */
1157 while ((sk
= bt_accept_dequeue(parent
, NULL
))) {
1158 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
1160 l2cap_chan_lock(chan
);
1161 __clear_chan_timer(chan
);
1162 l2cap_chan_close(chan
, ECONNRESET
);
1163 l2cap_chan_unlock(chan
);
1165 l2cap_sock_kill(sk
);
1169 static struct l2cap_chan
*l2cap_sock_new_connection_cb(struct l2cap_chan
*chan
)
1171 struct sock
*sk
, *parent
= chan
->data
;
1175 /* Check for backlog size */
1176 if (sk_acceptq_is_full(parent
)) {
1177 BT_DBG("backlog full %d", parent
->sk_ack_backlog
);
1178 release_sock(parent
);
1182 sk
= l2cap_sock_alloc(sock_net(parent
), NULL
, BTPROTO_L2CAP
,
1185 release_sock(parent
);
1189 bt_sock_reclassify_lock(sk
, BTPROTO_L2CAP
);
1191 l2cap_sock_init(sk
, parent
);
1193 bt_accept_enqueue(parent
, sk
);
1195 release_sock(parent
);
1197 return l2cap_pi(sk
)->chan
;
1200 static int l2cap_sock_recv_cb(struct l2cap_chan
*chan
, struct sk_buff
*skb
)
1202 struct sock
*sk
= chan
->data
;
1207 if (l2cap_pi(sk
)->rx_busy_skb
) {
1212 err
= sock_queue_rcv_skb(sk
, skb
);
1214 /* For ERTM, handle one skb that doesn't fit into the recv
1215 * buffer. This is important to do because the data frames
1216 * have already been acked, so the skb cannot be discarded.
1218 * Notify the l2cap core that the buffer is full, so the
1219 * LOCAL_BUSY state is entered and no more frames are
1220 * acked and reassembled until there is buffer space
1223 if (err
< 0 && chan
->mode
== L2CAP_MODE_ERTM
) {
1224 l2cap_pi(sk
)->rx_busy_skb
= skb
;
1225 l2cap_chan_busy(chan
, 1);
1235 static void l2cap_sock_close_cb(struct l2cap_chan
*chan
)
1237 struct sock
*sk
= chan
->data
;
1239 l2cap_sock_kill(sk
);
1242 static void l2cap_sock_teardown_cb(struct l2cap_chan
*chan
, int err
)
1244 struct sock
*sk
= chan
->data
;
1245 struct sock
*parent
;
1249 parent
= bt_sk(sk
)->parent
;
1251 sock_set_flag(sk
, SOCK_ZAPPED
);
1253 switch (chan
->state
) {
1259 l2cap_sock_cleanup_listen(sk
);
1260 sk
->sk_state
= BT_CLOSED
;
1261 chan
->state
= BT_CLOSED
;
1265 sk
->sk_state
= BT_CLOSED
;
1266 chan
->state
= BT_CLOSED
;
1271 bt_accept_unlink(sk
);
1272 parent
->sk_data_ready(parent
);
1274 sk
->sk_state_change(sk
);
1283 static void l2cap_sock_state_change_cb(struct l2cap_chan
*chan
, int state
,
1286 struct sock
*sk
= chan
->data
;
1288 sk
->sk_state
= state
;
1294 static struct sk_buff
*l2cap_sock_alloc_skb_cb(struct l2cap_chan
*chan
,
1295 unsigned long len
, int nb
)
1297 struct sock
*sk
= chan
->data
;
1298 struct sk_buff
*skb
;
1301 l2cap_chan_unlock(chan
);
1302 skb
= bt_skb_send_alloc(sk
, len
, nb
, &err
);
1303 l2cap_chan_lock(chan
);
1306 return ERR_PTR(err
);
1308 bt_cb(skb
)->chan
= chan
;
1313 static void l2cap_sock_ready_cb(struct l2cap_chan
*chan
)
1315 struct sock
*sk
= chan
->data
;
1316 struct sock
*parent
;
1320 parent
= bt_sk(sk
)->parent
;
1322 BT_DBG("sk %p, parent %p", sk
, parent
);
1324 sk
->sk_state
= BT_CONNECTED
;
1325 sk
->sk_state_change(sk
);
1328 parent
->sk_data_ready(parent
);
1333 static void l2cap_sock_defer_cb(struct l2cap_chan
*chan
)
1335 struct sock
*parent
, *sk
= chan
->data
;
1339 parent
= bt_sk(sk
)->parent
;
1341 parent
->sk_data_ready(parent
);
1346 static void l2cap_sock_resume_cb(struct l2cap_chan
*chan
)
1348 struct sock
*sk
= chan
->data
;
1350 clear_bit(BT_SK_SUSPEND
, &bt_sk(sk
)->flags
);
1351 sk
->sk_state_change(sk
);
1354 static void l2cap_sock_set_shutdown_cb(struct l2cap_chan
*chan
)
1356 struct sock
*sk
= chan
->data
;
1359 sk
->sk_shutdown
= SHUTDOWN_MASK
;
1363 static long l2cap_sock_get_sndtimeo_cb(struct l2cap_chan
*chan
)
1365 struct sock
*sk
= chan
->data
;
1367 return sk
->sk_sndtimeo
;
1370 static void l2cap_sock_suspend_cb(struct l2cap_chan
*chan
)
1372 struct sock
*sk
= chan
->data
;
1374 set_bit(BT_SK_SUSPEND
, &bt_sk(sk
)->flags
);
1375 sk
->sk_state_change(sk
);
1378 static struct l2cap_ops l2cap_chan_ops
= {
1379 .name
= "L2CAP Socket Interface",
1380 .new_connection
= l2cap_sock_new_connection_cb
,
1381 .recv
= l2cap_sock_recv_cb
,
1382 .close
= l2cap_sock_close_cb
,
1383 .teardown
= l2cap_sock_teardown_cb
,
1384 .state_change
= l2cap_sock_state_change_cb
,
1385 .ready
= l2cap_sock_ready_cb
,
1386 .defer
= l2cap_sock_defer_cb
,
1387 .resume
= l2cap_sock_resume_cb
,
1388 .suspend
= l2cap_sock_suspend_cb
,
1389 .set_shutdown
= l2cap_sock_set_shutdown_cb
,
1390 .get_sndtimeo
= l2cap_sock_get_sndtimeo_cb
,
1391 .alloc_skb
= l2cap_sock_alloc_skb_cb
,
1394 static void l2cap_sock_destruct(struct sock
*sk
)
1396 BT_DBG("sk %p", sk
);
1398 if (l2cap_pi(sk
)->chan
)
1399 l2cap_chan_put(l2cap_pi(sk
)->chan
);
1401 if (l2cap_pi(sk
)->rx_busy_skb
) {
1402 kfree_skb(l2cap_pi(sk
)->rx_busy_skb
);
1403 l2cap_pi(sk
)->rx_busy_skb
= NULL
;
1406 skb_queue_purge(&sk
->sk_receive_queue
);
1407 skb_queue_purge(&sk
->sk_write_queue
);
1410 static void l2cap_skb_msg_name(struct sk_buff
*skb
, void *msg_name
,
1413 DECLARE_SOCKADDR(struct sockaddr_l2
*, la
, msg_name
);
1415 memset(la
, 0, sizeof(struct sockaddr_l2
));
1416 la
->l2_family
= AF_BLUETOOTH
;
1417 la
->l2_psm
= bt_cb(skb
)->psm
;
1418 bacpy(&la
->l2_bdaddr
, &bt_cb(skb
)->bdaddr
);
1420 *msg_namelen
= sizeof(struct sockaddr_l2
);
1423 static void l2cap_sock_init(struct sock
*sk
, struct sock
*parent
)
1425 struct l2cap_chan
*chan
= l2cap_pi(sk
)->chan
;
1427 BT_DBG("sk %p", sk
);
1430 struct l2cap_chan
*pchan
= l2cap_pi(parent
)->chan
;
1432 sk
->sk_type
= parent
->sk_type
;
1433 bt_sk(sk
)->flags
= bt_sk(parent
)->flags
;
1435 chan
->chan_type
= pchan
->chan_type
;
1436 chan
->imtu
= pchan
->imtu
;
1437 chan
->omtu
= pchan
->omtu
;
1438 chan
->conf_state
= pchan
->conf_state
;
1439 chan
->mode
= pchan
->mode
;
1440 chan
->fcs
= pchan
->fcs
;
1441 chan
->max_tx
= pchan
->max_tx
;
1442 chan
->tx_win
= pchan
->tx_win
;
1443 chan
->tx_win_max
= pchan
->tx_win_max
;
1444 chan
->sec_level
= pchan
->sec_level
;
1445 chan
->flags
= pchan
->flags
;
1446 chan
->tx_credits
= pchan
->tx_credits
;
1447 chan
->rx_credits
= pchan
->rx_credits
;
1449 if (chan
->chan_type
== L2CAP_CHAN_FIXED
) {
1450 chan
->scid
= pchan
->scid
;
1451 chan
->dcid
= pchan
->scid
;
1454 security_sk_clone(parent
, sk
);
1456 switch (sk
->sk_type
) {
1458 chan
->chan_type
= L2CAP_CHAN_RAW
;
1461 chan
->chan_type
= L2CAP_CHAN_CONN_LESS
;
1462 bt_sk(sk
)->skb_msg_name
= l2cap_skb_msg_name
;
1464 case SOCK_SEQPACKET
:
1466 chan
->chan_type
= L2CAP_CHAN_CONN_ORIENTED
;
1470 chan
->imtu
= L2CAP_DEFAULT_MTU
;
1472 if (!disable_ertm
&& sk
->sk_type
== SOCK_STREAM
) {
1473 chan
->mode
= L2CAP_MODE_ERTM
;
1474 set_bit(CONF_STATE2_DEVICE
, &chan
->conf_state
);
1476 chan
->mode
= L2CAP_MODE_BASIC
;
1479 l2cap_chan_set_defaults(chan
);
1482 /* Default config options */
1483 chan
->flush_to
= L2CAP_DEFAULT_FLUSH_TO
;
1486 chan
->ops
= &l2cap_chan_ops
;
1489 static struct proto l2cap_proto
= {
1491 .owner
= THIS_MODULE
,
1492 .obj_size
= sizeof(struct l2cap_pinfo
)
1495 static struct sock
*l2cap_sock_alloc(struct net
*net
, struct socket
*sock
,
1496 int proto
, gfp_t prio
)
1499 struct l2cap_chan
*chan
;
1501 sk
= sk_alloc(net
, PF_BLUETOOTH
, prio
, &l2cap_proto
);
1505 sock_init_data(sock
, sk
);
1506 INIT_LIST_HEAD(&bt_sk(sk
)->accept_q
);
1508 sk
->sk_destruct
= l2cap_sock_destruct
;
1509 sk
->sk_sndtimeo
= L2CAP_CONN_TIMEOUT
;
1511 sock_reset_flag(sk
, SOCK_ZAPPED
);
1513 sk
->sk_protocol
= proto
;
1514 sk
->sk_state
= BT_OPEN
;
1516 chan
= l2cap_chan_create();
1522 l2cap_chan_hold(chan
);
1524 l2cap_pi(sk
)->chan
= chan
;
1529 static int l2cap_sock_create(struct net
*net
, struct socket
*sock
, int protocol
,
1534 BT_DBG("sock %p", sock
);
1536 sock
->state
= SS_UNCONNECTED
;
1538 if (sock
->type
!= SOCK_SEQPACKET
&& sock
->type
!= SOCK_STREAM
&&
1539 sock
->type
!= SOCK_DGRAM
&& sock
->type
!= SOCK_RAW
)
1540 return -ESOCKTNOSUPPORT
;
1542 if (sock
->type
== SOCK_RAW
&& !kern
&& !capable(CAP_NET_RAW
))
1545 sock
->ops
= &l2cap_sock_ops
;
1547 sk
= l2cap_sock_alloc(net
, sock
, protocol
, GFP_ATOMIC
);
1551 l2cap_sock_init(sk
, NULL
);
1552 bt_sock_link(&l2cap_sk_list
, sk
);
1556 static const struct proto_ops l2cap_sock_ops
= {
1557 .family
= PF_BLUETOOTH
,
1558 .owner
= THIS_MODULE
,
1559 .release
= l2cap_sock_release
,
1560 .bind
= l2cap_sock_bind
,
1561 .connect
= l2cap_sock_connect
,
1562 .listen
= l2cap_sock_listen
,
1563 .accept
= l2cap_sock_accept
,
1564 .getname
= l2cap_sock_getname
,
1565 .sendmsg
= l2cap_sock_sendmsg
,
1566 .recvmsg
= l2cap_sock_recvmsg
,
1567 .poll
= bt_sock_poll
,
1568 .ioctl
= bt_sock_ioctl
,
1569 .mmap
= sock_no_mmap
,
1570 .socketpair
= sock_no_socketpair
,
1571 .shutdown
= l2cap_sock_shutdown
,
1572 .setsockopt
= l2cap_sock_setsockopt
,
1573 .getsockopt
= l2cap_sock_getsockopt
1576 static const struct net_proto_family l2cap_sock_family_ops
= {
1577 .family
= PF_BLUETOOTH
,
1578 .owner
= THIS_MODULE
,
1579 .create
= l2cap_sock_create
,
1582 int __init
l2cap_init_sockets(void)
1586 err
= proto_register(&l2cap_proto
, 0);
1590 err
= bt_sock_register(BTPROTO_L2CAP
, &l2cap_sock_family_ops
);
1592 BT_ERR("L2CAP socket registration failed");
1596 err
= bt_procfs_init(&init_net
, "l2cap", &l2cap_sk_list
,
1599 BT_ERR("Failed to create L2CAP proc file");
1600 bt_sock_unregister(BTPROTO_L2CAP
);
1604 BT_INFO("L2CAP socket layer initialized");
1609 proto_unregister(&l2cap_proto
);
1613 void l2cap_cleanup_sockets(void)
1615 bt_procfs_cleanup(&init_net
, "l2cap");
1616 bt_sock_unregister(BTPROTO_L2CAP
);
1617 proto_unregister(&l2cap_proto
);