[net-next-2.6.git] / net / bluetooth / hci_sock.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI sockets. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/capability.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/workqueue.h>
#include <linux/interrupt.h>
#include <linux/compat.h>
#include <linux/socket.h>
#include <linux/ioctl.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

/* ----- HCI socket interface ----- */

static inline int hci_test_bit(int nr, void *addr)
{
	return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
}

/* Security filter */
static struct hci_sec_filter hci_sec_filter = {
	/* Packet types */
	0x10,
	/* Events */
	{ 0x1000d9fe, 0x0000b00c },
	/* Commands */
	{
		{ 0x0 },
		/* OGF_LINK_CTL */
		{ 0xbe000006, 0x00000001, 0x00000000, 0x00 },
		/* OGF_LINK_POLICY */
		{ 0x00005200, 0x00000000, 0x00000000, 0x00 },
		/* OGF_HOST_CTL */
		{ 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
		/* OGF_INFO_PARAM */
		{ 0x000002be, 0x00000000, 0x00000000, 0x00 },
		/* OGF_STATUS_PARAM */
		{ 0x000000ea, 0x00000000, 0x00000000, 0x00 }
	}
};

static struct bt_sock_list hci_sk_list = {
	.lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
};

/* Send frame to RAW socket */
void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct sock *sk;
	struct hlist_node *node;

	BT_DBG("hdev %p len %d", hdev, skb->len);

	read_lock(&hci_sk_list.lock);
	sk_for_each(sk, node, &hci_sk_list.head) {
		struct hci_filter *flt;
		struct sk_buff *nskb;

		if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
			continue;

		/* Don't send frame to the socket it came from */
		if (skb->sk == sk)
			continue;

		/* Apply filter */
		flt = &hci_pi(sk)->filter;

		if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
				0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
			continue;

		if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
			register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);

			if (!hci_test_bit(evt, &flt->event_mask))
				continue;

			if (flt->opcode &&
			    ((evt == HCI_EV_CMD_COMPLETE &&
			      flt->opcode !=
			      get_unaligned((__le16 *)(skb->data + 3))) ||
			     (evt == HCI_EV_CMD_STATUS &&
			      flt->opcode !=
			      get_unaligned((__le16 *)(skb->data + 4)))))
				continue;
		}

		if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
			continue;

		/* Put type byte before the data */
		memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);

		if (sock_queue_rcv_skb(sk, nskb))
			kfree_skb(nskb);
	}
	read_unlock(&hci_sk_list.lock);
}

static int hci_sock_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!sk)
		return 0;

	hdev = hci_pi(sk)->hdev;

	bt_sock_unlink(&hci_sk_list, sk);

	if (hdev) {
		atomic_dec(&hdev->promisc);
		hci_dev_put(hdev);
	}

	sock_orphan(sk);

	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);

	sock_put(sk);
	return 0;
}

struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct list_head *p;

	list_for_each(p, &hdev->blacklist) {
		struct bdaddr_list *b;

		b = list_entry(p, struct bdaddr_list, list);

		if (bacmp(bdaddr, &b->bdaddr) == 0)
			return b;
	}

	return NULL;
}

static int hci_blacklist_add(struct hci_dev *hdev, void __user *arg)
{
	bdaddr_t bdaddr;
	struct bdaddr_list *entry;

	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
		return -EFAULT;

	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
		return -EBADF;

	if (hci_blacklist_lookup(hdev, &bdaddr))
		return -EEXIST;

	entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
	if (!entry)
		return -ENOMEM;

	bacpy(&entry->bdaddr, &bdaddr);

	list_add(&entry->list, &hdev->blacklist);

	return 0;
}

int hci_blacklist_clear(struct hci_dev *hdev)
{
	struct list_head *p, *n;

	list_for_each_safe(p, n, &hdev->blacklist) {
		struct bdaddr_list *b;

		b = list_entry(p, struct bdaddr_list, list);

		list_del(p);
		kfree(b);
	}

	return 0;
}

static int hci_blacklist_del(struct hci_dev *hdev, void __user *arg)
{
	bdaddr_t bdaddr;
	struct bdaddr_list *entry;

	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
		return -EFAULT;

	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
		return hci_blacklist_clear(hdev);

	entry = hci_blacklist_lookup(hdev, &bdaddr);
	if (!entry)
		return -ENOENT;

	list_del(&entry->list);
	kfree(entry);

	return 0;
}

/* Ioctls that require bound socket */
static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
{
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	if (!hdev)
		return -EBADFD;

	switch (cmd) {
	case HCISETRAW:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;

		if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
			return -EPERM;

		if (arg)
			set_bit(HCI_RAW, &hdev->flags);
		else
			clear_bit(HCI_RAW, &hdev->flags);

		return 0;

	case HCIGETCONNINFO:
		return hci_get_conn_info(hdev, (void __user *) arg);

	case HCIGETAUTHINFO:
		return hci_get_auth_info(hdev, (void __user *) arg);

	case HCIBLOCKADDR:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_blacklist_add(hdev, (void __user *) arg);

	case HCIUNBLOCKADDR:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_blacklist_del(hdev, (void __user *) arg);

	default:
		if (hdev->ioctl)
			return hdev->ioctl(hdev, cmd, arg);
		return -EINVAL;
	}
}

static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	struct sock *sk = sock->sk;
	void __user *argp = (void __user *) arg;
	int err;

	BT_DBG("cmd %x arg %lx", cmd, arg);

	switch (cmd) {
	case HCIGETDEVLIST:
		return hci_get_dev_list(argp);

	case HCIGETDEVINFO:
		return hci_get_dev_info(argp);

	case HCIGETCONNLIST:
		return hci_get_conn_list(argp);

	case HCIDEVUP:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_open(arg);

	case HCIDEVDOWN:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_close(arg);

	case HCIDEVRESET:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset(arg);

	case HCIDEVRESTAT:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset_stat(arg);

	case HCISETSCAN:
	case HCISETAUTH:
	case HCISETENCRYPT:
	case HCISETPTYPE:
	case HCISETLINKPOL:
	case HCISETLINKMODE:
	case HCISETACLMTU:
	case HCISETSCOMTU:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_cmd(cmd, argp);

	case HCIINQUIRY:
		return hci_inquiry(argp);

	default:
		lock_sock(sk);
		err = hci_sock_bound_ioctl(sk, cmd, arg);
		release_sock(sk);
		return err;
	}
}

static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = NULL;
	int err = 0;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!haddr || haddr->hci_family != AF_BLUETOOTH)
		return -EINVAL;

	lock_sock(sk);

	if (hci_pi(sk)->hdev) {
		err = -EALREADY;
		goto done;
	}

	if (haddr->hci_dev != HCI_DEV_NONE) {
		if (!(hdev = hci_dev_get(haddr->hci_dev))) {
			err = -ENODEV;
			goto done;
		}

		atomic_inc(&hdev->promisc);
	}

	hci_pi(sk)->hdev = hdev;
	sk->sk_state = BT_BOUND;

done:
	release_sock(sk);
	return err;
}

static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!hdev)
		return -EBADFD;

	lock_sock(sk);

	*addr_len = sizeof(*haddr);
	haddr->hci_family = AF_BLUETOOTH;
	haddr->hci_dev    = hdev->id;

	release_sock(sk);
	return 0;
}

static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
{
	__u32 mask = hci_pi(sk)->cmsg_mask;

	if (mask & HCI_CMSG_DIR) {
		int incoming = bt_cb(skb)->incoming;
		put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	}

	if (mask & HCI_CMSG_TSTAMP) {
#ifdef CONFIG_COMPAT
		struct compat_timeval ctv;
#endif
		struct timeval tv;
		void *data;
		int len;

		skb_get_timestamp(skb, &tv);

		data = &tv;
		len = sizeof(tv);
#ifdef CONFIG_COMPAT
		if (msg->msg_flags & MSG_CMSG_COMPAT) {
			ctv.tv_sec = tv.tv_sec;
			ctv.tv_usec = tv.tv_usec;
			data = &ctv;
			len = sizeof(ctv);
		}
#endif

		put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
	}
}

static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
				struct msghdr *msg, size_t len, int flags)
{
	int noblock = flags & MSG_DONTWAIT;
	struct sock *sk = sock->sk;
	struct sk_buff *skb;
	int copied, err;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (flags & (MSG_OOB))
		return -EOPNOTSUPP;

	if (sk->sk_state == BT_CLOSED)
		return 0;

	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
		return err;

	msg->msg_namelen = 0;

	copied = skb->len;
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

	skb_reset_transport_header(skb);
	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);

	hci_sock_cmsg(sk, msg, skb);

	skb_free_datagram(sk, skb);

	return err ? : copied;
}

static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
			    struct msghdr *msg, size_t len)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;
	struct sk_buff *skb;
	int err;

	BT_DBG("sock %p sk %p", sock, sk);

	if (msg->msg_flags & MSG_OOB)
		return -EOPNOTSUPP;

	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
		return -EINVAL;

	if (len < 4 || len > HCI_MAX_FRAME_SIZE)
		return -EINVAL;

	lock_sock(sk);

	if (!(hdev = hci_pi(sk)->hdev)) {
		err = -EBADFD;
		goto done;
	}

	if (!test_bit(HCI_UP, &hdev->flags)) {
		err = -ENETDOWN;
		goto done;
	}

	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
		goto done;

	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
		err = -EFAULT;
		goto drop;
	}

	bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
	skb_pull(skb, 1);
	skb->dev = (void *) hdev;

	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
		u16 opcode = get_unaligned_le16(skb->data);
		u16 ogf = hci_opcode_ogf(opcode);
		u16 ocf = hci_opcode_ocf(opcode);

		if (((ogf > HCI_SFLT_MAX_OGF) ||
				!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
					!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
			skb_queue_tail(&hdev->raw_q, skb);
			tasklet_schedule(&hdev->tx_task);
		} else {
			skb_queue_tail(&hdev->cmd_q, skb);
			tasklet_schedule(&hdev->cmd_task);
		}
	} else {
		if (!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		skb_queue_tail(&hdev->raw_q, skb);
		tasklet_schedule(&hdev->tx_task);
	}

	err = len;

done:
	release_sock(sk);
	return err;

drop:
	kfree_skb(skb);
	goto done;
}

static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len)
{
	struct hci_ufilter uf = { .opcode = 0 };
	struct sock *sk = sock->sk;
	int err = 0, opt = 0;

	BT_DBG("sk %p, opt %d", sk, optname);

	lock_sock(sk);

	switch (optname) {
	case HCI_DATA_DIR:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
		break;

	case HCI_TIME_STAMP:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
		break;

	case HCI_FILTER:
		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			uf.type_mask = f->type_mask;
			uf.opcode    = f->opcode;
			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
		}

		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_from_user(&uf, optval, len)) {
			err = -EFAULT;
			break;
		}

		if (!capable(CAP_NET_RAW)) {
			uf.type_mask &= hci_sec_filter.type_mask;
			uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
			uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
		}

		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			f->type_mask = uf.type_mask;
			f->opcode    = uf.opcode;
			*((u32 *) f->event_mask + 0) = uf.event_mask[0];
			*((u32 *) f->event_mask + 1) = uf.event_mask[1];
		}
		break;

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
{
	struct hci_ufilter uf;
	struct sock *sk = sock->sk;
	int len, opt;

	if (get_user(len, optlen))
		return -EFAULT;

	switch (optname) {
	case HCI_DATA_DIR:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
			opt = 1;
		else
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_TIME_STAMP:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
			opt = 1;
		else
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_FILTER:
		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			uf.type_mask = f->type_mask;
			uf.opcode    = f->opcode;
			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
		}

		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_to_user(optval, &uf, len))
			return -EFAULT;
		break;

	default:
		return -ENOPROTOOPT;
		break;
	}

	return 0;
}

static const struct proto_ops hci_sock_ops = {
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= hci_sock_release,
	.bind		= hci_sock_bind,
	.getname	= hci_sock_getname,
	.sendmsg	= hci_sock_sendmsg,
	.recvmsg	= hci_sock_recvmsg,
	.ioctl		= hci_sock_ioctl,
	.poll		= datagram_poll,
	.listen		= sock_no_listen,
	.shutdown	= sock_no_shutdown,
	.setsockopt	= hci_sock_setsockopt,
	.getsockopt	= hci_sock_getsockopt,
	.connect	= sock_no_connect,
	.socketpair	= sock_no_socketpair,
	.accept		= sock_no_accept,
	.mmap		= sock_no_mmap
};

static struct proto hci_sk_proto = {
	.name		= "HCI",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct hci_pinfo)
};

static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
			   int kern)
{
	struct sock *sk;

	BT_DBG("sock %p", sock);

	if (sock->type != SOCK_RAW)
		return -ESOCKTNOSUPPORT;

	sock->ops = &hci_sock_ops;

	sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	sock_reset_flag(sk, SOCK_ZAPPED);

	sk->sk_protocol = protocol;

	sock->state = SS_UNCONNECTED;
	sk->sk_state = BT_OPEN;

	bt_sock_link(&hci_sk_list, sk);
	return 0;
}

static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
	struct hci_dev *hdev = (struct hci_dev *) ptr;
	struct hci_ev_si_device ev;

	BT_DBG("hdev %s event %ld", hdev->name, event);

	/* Send event to sockets */
	ev.event  = event;
	ev.dev_id = hdev->id;
	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);

	if (event == HCI_DEV_UNREG) {
		struct sock *sk;
		struct hlist_node *node;

		/* Detach sockets from device */
		read_lock(&hci_sk_list.lock);
		sk_for_each(sk, node, &hci_sk_list.head) {
			local_bh_disable();
			bh_lock_sock_nested(sk);
			if (hci_pi(sk)->hdev == hdev) {
				hci_pi(sk)->hdev = NULL;
				sk->sk_err = EPIPE;
				sk->sk_state = BT_OPEN;
				sk->sk_state_change(sk);

				hci_dev_put(hdev);
			}
			bh_unlock_sock(sk);
			local_bh_enable();
		}
		read_unlock(&hci_sk_list.lock);
	}

	return NOTIFY_DONE;
}

static const struct net_proto_family hci_sock_family_ops = {
	.family	= PF_BLUETOOTH,
	.owner	= THIS_MODULE,
	.create	= hci_sock_create,
};

static struct notifier_block hci_sock_nblock = {
	.notifier_call = hci_sock_dev_event
};

int __init hci_sock_init(void)
{
	int err;

	err = proto_register(&hci_sk_proto, 0);
	if (err < 0)
		return err;

	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
	if (err < 0)
		goto error;

	hci_register_notifier(&hci_sock_nblock);

	BT_INFO("HCI socket layer initialized");

	return 0;

error:
	BT_ERR("HCI socket registration failed");
	proto_unregister(&hci_sk_proto);
	return err;
}

void __exit hci_sock_cleanup(void)
{
	if (bt_sock_unregister(BTPROTO_HCI) < 0)
		BT_ERR("HCI socket unregistration failed");

	hci_unregister_notifier(&hci_sock_nblock);

	proto_unregister(&hci_sk_proto);
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI sockets. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
4fc268d2	30	#include <linux/capability.h>
1da177e4 LT	31	#include <linux/errno.h>
1da177e4 LT	32	#include <linux/kernel.h>
1da177e4 LT	33	#include <linux/slab.h>
	34	#include <linux/poll.h>
	35	#include <linux/fcntl.h>
	36	#include <linux/init.h>
	37	#include <linux/skbuff.h>
	38	#include <linux/workqueue.h>
	39	#include <linux/interrupt.h>
767c5eb5	40	#include <linux/compat.h>
1da177e4 LT	41	#include <linux/socket.h>
	42	#include <linux/ioctl.h>
	43	#include <net/sock.h>
	44
	45	#include <asm/system.h>
	46	#include <asm/uaccess.h>
	47	#include <asm/unaligned.h>
	48
	49	#include <net/bluetooth/bluetooth.h>
	50	#include <net/bluetooth/hci_core.h>
	51
1da177e4 LT	52	/* ----- HCI socket interface ----- */
	53
	54	static inline int hci_test_bit(int nr, void *addr)
	55	{
	56	return ((__u32 ) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
	57	}
	58
	59	/* Security filter */
	60	static struct hci_sec_filter hci_sec_filter = {
	61	/* Packet types */
	62	0x10,
	63	/* Events */
dd7f5527	64	{ 0x1000d9fe, 0x0000b00c },
1da177e4 LT	65	/* Commands */
	66	{
	67	{ 0x0 },
	68	/* OGF_LINK_CTL */
7c631a67	69	{ 0xbe000006, 0x00000001, 0x00000000, 0x00 },
1da177e4	70	/* OGF_LINK_POLICY */
7c631a67	71	{ 0x00005200, 0x00000000, 0x00000000, 0x00 },
1da177e4	72	/* OGF_HOST_CTL */
7c631a67	73	{ 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
1da177e4	74	/* OGF_INFO_PARAM */
7c631a67	75	{ 0x000002be, 0x00000000, 0x00000000, 0x00 },
1da177e4	76	/* OGF_STATUS_PARAM */
7c631a67	77	{ 0x000000ea, 0x00000000, 0x00000000, 0x00 }
1da177e4 LT	78	}
	79	};
	80
	81	static struct bt_sock_list hci_sk_list = {
d5fb2962	82	.lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
1da177e4 LT	83	};
	84
	85	/* Send frame to RAW socket */
	86	void hci_send_to_sock(struct hci_dev hdev, struct sk_buff skb)
	87	{
	88	struct sock *sk;
	89	struct hlist_node *node;
	90
	91	BT_DBG("hdev %p len %d", hdev, skb->len);
	92
	93	read_lock(&hci_sk_list.lock);
	94	sk_for_each(sk, node, &hci_sk_list.head) {
	95	struct hci_filter *flt;
	96	struct sk_buff *nskb;
	97
	98	if (sk->sk_state != BT_BOUND \|\| hci_pi(sk)->hdev != hdev)
	99	continue;
	100
	101	/* Don't send frame to the socket it came from */
	102	if (skb->sk == sk)
	103	continue;
	104
	105	/* Apply filter */
	106	flt = &hci_pi(sk)->filter;
	107
0d48d939 MH	108	if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
0d48d939 MH	109	0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
1da177e4 LT	110	continue;
1da177e4 LT	111
0d48d939	112	if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
1da177e4 LT	113	register int evt = ((__u8 )skb->data & HCI_FLT_EVENT_BITS);
	114
	115	if (!hci_test_bit(evt, &flt->event_mask))
	116	continue;
	117
4498c80d DM	118	if (flt->opcode &&
	119	((evt == HCI_EV_CMD_COMPLETE &&
	120	flt->opcode !=
905f3ed6	121	get_unaligned((__le16 *)(skb->data + 3))) \|\|
4498c80d DM	122	(evt == HCI_EV_CMD_STATUS &&
4498c80d DM	123	flt->opcode !=
905f3ed6	124	get_unaligned((__le16 *)(skb->data + 4)))))
1da177e4 LT	125	continue;
	126	}
	127
	128	if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
	129	continue;
	130
	131	/* Put type byte before the data */
0d48d939	132	memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
1da177e4 LT	133
	134	if (sock_queue_rcv_skb(sk, nskb))
	135	kfree_skb(nskb);
	136	}
	137	read_unlock(&hci_sk_list.lock);
	138	}
	139
	140	static int hci_sock_release(struct socket *sock)
	141	{
	142	struct sock *sk = sock->sk;
7b005bd3	143	struct hci_dev *hdev;
1da177e4 LT	144
	145	BT_DBG("sock %p sk %p", sock, sk);
	146
	147	if (!sk)
	148	return 0;
	149
7b005bd3 MH	150	hdev = hci_pi(sk)->hdev;
7b005bd3 MH	151
1da177e4 LT	152	bt_sock_unlink(&hci_sk_list, sk);
	153
	154	if (hdev) {
	155	atomic_dec(&hdev->promisc);
	156	hci_dev_put(hdev);
	157	}
	158
	159	sock_orphan(sk);
	160
	161	skb_queue_purge(&sk->sk_receive_queue);
	162	skb_queue_purge(&sk->sk_write_queue);
	163
	164	sock_put(sk);
	165	return 0;
	166	}
	167
f0358568 JH	168	struct bdaddr_list hci_blacklist_lookup(struct hci_dev hdev, bdaddr_t *bdaddr)
	169	{
	170	struct list_head *p;
f0358568	171
ea4bd8ba	172	list_for_each(p, &hdev->blacklist) {
f0358568 JH	173	struct bdaddr_list *b;
	174
	175	b = list_entry(p, struct bdaddr_list, list);
	176
	177	if (bacmp(bdaddr, &b->bdaddr) == 0)
	178	return b;
	179	}
	180
	181	return NULL;
	182	}
	183
	184	static int hci_blacklist_add(struct hci_dev hdev, void __user arg)
	185	{
	186	bdaddr_t bdaddr;
	187	struct bdaddr_list *entry;
	188
	189	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
	190	return -EFAULT;
	191
	192	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
	193	return -EBADF;
	194
	195	if (hci_blacklist_lookup(hdev, &bdaddr))
	196	return -EEXIST;
	197
	198	entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
	199	if (!entry)
	200	return -ENOMEM;
	201
	202	bacpy(&entry->bdaddr, &bdaddr);
	203
ea4bd8ba	204	list_add(&entry->list, &hdev->blacklist);
f0358568 JH	205
	206	return 0;
	207	}
	208
	209	int hci_blacklist_clear(struct hci_dev *hdev)
	210	{
	211	struct list_head p, n;
f0358568	212
ea4bd8ba	213	list_for_each_safe(p, n, &hdev->blacklist) {
f0358568 JH	214	struct bdaddr_list *b;
	215
	216	b = list_entry(p, struct bdaddr_list, list);
	217
	218	list_del(p);
	219	kfree(b);
	220	}
	221
	222	return 0;
	223	}
	224
	225	static int hci_blacklist_del(struct hci_dev hdev, void __user arg)
	226	{
	227	bdaddr_t bdaddr;
	228	struct bdaddr_list *entry;
	229
	230	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
	231	return -EFAULT;
	232
	233	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
	234	return hci_blacklist_clear(hdev);
	235
	236	entry = hci_blacklist_lookup(hdev, &bdaddr);
	237	if (!entry)
	238	return -ENOENT;
	239
	240	list_del(&entry->list);
	241	kfree(entry);
	242
	243	return 0;
	244	}
	245
8e87d142	246	/* Ioctls that require bound socket */
1da177e4 LT	247	static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
	248	{
	249	struct hci_dev *hdev = hci_pi(sk)->hdev;
	250
	251	if (!hdev)
	252	return -EBADFD;
	253
	254	switch (cmd) {
	255	case HCISETRAW:
	256	if (!capable(CAP_NET_ADMIN))
	257	return -EACCES;
	258
	259	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
	260	return -EPERM;
	261
	262	if (arg)
	263	set_bit(HCI_RAW, &hdev->flags);
	264	else
	265	clear_bit(HCI_RAW, &hdev->flags);
	266
	267	return 0;
	268
1da177e4	269	case HCIGETCONNINFO:
40be492f MH	270	return hci_get_conn_info(hdev, (void __user *) arg);
	271
	272	case HCIGETAUTHINFO:
	273	return hci_get_auth_info(hdev, (void __user *) arg);
1da177e4	274
f0358568 JH	275	case HCIBLOCKADDR:
	276	if (!capable(CAP_NET_ADMIN))
	277	return -EACCES;
	278	return hci_blacklist_add(hdev, (void __user *) arg);
	279
	280	case HCIUNBLOCKADDR:
	281	if (!capable(CAP_NET_ADMIN))
	282	return -EACCES;
	283	return hci_blacklist_del(hdev, (void __user *) arg);
	284
1da177e4 LT	285	default:
	286	if (hdev->ioctl)
	287	return hdev->ioctl(hdev, cmd, arg);
	288	return -EINVAL;
	289	}
	290	}
	291
	292	static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
	293	{
	294	struct sock *sk = sock->sk;
40be492f	295	void __user argp = (void __user ) arg;
1da177e4 LT	296	int err;
	297
	298	BT_DBG("cmd %x arg %lx", cmd, arg);
	299
	300	switch (cmd) {
	301	case HCIGETDEVLIST:
	302	return hci_get_dev_list(argp);
	303
	304	case HCIGETDEVINFO:
	305	return hci_get_dev_info(argp);
	306
	307	case HCIGETCONNLIST:
	308	return hci_get_conn_list(argp);
	309
	310	case HCIDEVUP:
	311	if (!capable(CAP_NET_ADMIN))
	312	return -EACCES;
	313	return hci_dev_open(arg);
	314
	315	case HCIDEVDOWN:
	316	if (!capable(CAP_NET_ADMIN))
	317	return -EACCES;
	318	return hci_dev_close(arg);
	319
	320	case HCIDEVRESET:
	321	if (!capable(CAP_NET_ADMIN))
	322	return -EACCES;
	323	return hci_dev_reset(arg);
	324
	325	case HCIDEVRESTAT:
	326	if (!capable(CAP_NET_ADMIN))
	327	return -EACCES;
	328	return hci_dev_reset_stat(arg);
	329
	330	case HCISETSCAN:
	331	case HCISETAUTH:
	332	case HCISETENCRYPT:
	333	case HCISETPTYPE:
	334	case HCISETLINKPOL:
	335	case HCISETLINKMODE:
	336	case HCISETACLMTU:
	337	case HCISETSCOMTU:
	338	if (!capable(CAP_NET_ADMIN))
	339	return -EACCES;
	340	return hci_dev_cmd(cmd, argp);
	341
	342	case HCIINQUIRY:
	343	return hci_inquiry(argp);
	344
	345	default:
	346	lock_sock(sk);
	347	err = hci_sock_bound_ioctl(sk, cmd, arg);
	348	release_sock(sk);
	349	return err;
	350	}
	351	}
	352
	353	static int hci_sock_bind(struct socket sock, struct sockaddr addr, int addr_len)
	354	{
	355	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
	356	struct sock *sk = sock->sk;
	357	struct hci_dev *hdev = NULL;
	358	int err = 0;
	359
360	BT_DBG("sock %p sk %p", sock, sk);
361
362	if (!haddr \|\| haddr->hci_family != AF_BLUETOOTH)
363	return -EINVAL;
364
365	lock_sock(sk);
366
367	if (hci_pi(sk)->hdev) {
368	err = -EALREADY;
369	goto done;
370	}
371
372	if (haddr->hci_dev != HCI_DEV_NONE) {
373	if (!(hdev = hci_dev_get(haddr->hci_dev))) {
374	err = -ENODEV;
375	goto done;
376	}
377
378	atomic_inc(&hdev->promisc);
379	}
380
381	hci_pi(sk)->hdev = hdev;
382	sk->sk_state = BT_BOUND;
383
384	done:
385	release_sock(sk);
386	return err;
387	}
388
389	static int hci_sock_getname(struct socket sock, struct sockaddr addr, int *addr_len, int peer)
390	{
391	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
392	struct sock *sk = sock->sk;
7b005bd3	393	struct hci_dev *hdev = hci_pi(sk)->hdev;
1da177e4 LT	394
	395	BT_DBG("sock %p sk %p", sock, sk);
	396
7b005bd3 MH	397	if (!hdev)
	398	return -EBADFD;
	399
1da177e4 LT	400	lock_sock(sk);
	401
	402	addr_len = sizeof(haddr);
	403	haddr->hci_family = AF_BLUETOOTH;
7b005bd3	404	haddr->hci_dev = hdev->id;
1da177e4 LT	405
	406	release_sock(sk);
	407	return 0;
	408	}
	409
	410	static inline void hci_sock_cmsg(struct sock sk, struct msghdr msg, struct sk_buff *skb)
	411	{
	412	__u32 mask = hci_pi(sk)->cmsg_mask;
	413
0d48d939 MH	414	if (mask & HCI_CMSG_DIR) {
	415	int incoming = bt_cb(skb)->incoming;
	416	put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	417	}
1da177e4	418
a61bbcf2	419	if (mask & HCI_CMSG_TSTAMP) {
f6e623a6 JFS	420	#ifdef CONFIG_COMPAT
	421	struct compat_timeval ctv;
	422	#endif
a61bbcf2	423	struct timeval tv;
767c5eb5 MH	424	void *data;
767c5eb5 MH	425	int len;
a61bbcf2 PM	426
a61bbcf2 PM	427	skb_get_timestamp(skb, &tv);
767c5eb5	428
1da97f83 DM	429	data = &tv;
	430	len = sizeof(tv);
	431	#ifdef CONFIG_COMPAT
767c5eb5	432	if (msg->msg_flags & MSG_CMSG_COMPAT) {
767c5eb5 MH	433	ctv.tv_sec = tv.tv_sec;
	434	ctv.tv_usec = tv.tv_usec;
	435	data = &ctv;
	436	len = sizeof(ctv);
767c5eb5	437	}
1da97f83	438	#endif
767c5eb5 MH	439
767c5eb5 MH	440	put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
a61bbcf2	441	}
1da177e4	442	}
8e87d142 YH	443
8e87d142 YH	444	static int hci_sock_recvmsg(struct kiocb iocb, struct socket sock,
1da177e4 LT	445	struct msghdr *msg, size_t len, int flags)
	446	{
	447	int noblock = flags & MSG_DONTWAIT;
	448	struct sock *sk = sock->sk;
	449	struct sk_buff *skb;
	450	int copied, err;
	451
	452	BT_DBG("sock %p, sk %p", sock, sk);
	453
	454	if (flags & (MSG_OOB))
	455	return -EOPNOTSUPP;
	456
	457	if (sk->sk_state == BT_CLOSED)
	458	return 0;
	459
	460	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
	461	return err;
	462
	463	msg->msg_namelen = 0;
	464
	465	copied = skb->len;
	466	if (len < copied) {
	467	msg->msg_flags \|= MSG_TRUNC;
	468	copied = len;
	469	}
	470
badff6d0	471	skb_reset_transport_header(skb);
1da177e4 LT	472	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	473
	474	hci_sock_cmsg(sk, msg, skb);
	475
	476	skb_free_datagram(sk, skb);
	477
	478	return err ? : copied;
	479	}
	480
8e87d142	481	static int hci_sock_sendmsg(struct kiocb iocb, struct socket sock,
1da177e4 LT	482	struct msghdr *msg, size_t len)
	483	{
	484	struct sock *sk = sock->sk;
	485	struct hci_dev *hdev;
	486	struct sk_buff *skb;
	487	int err;
	488
	489	BT_DBG("sock %p sk %p", sock, sk);
	490
	491	if (msg->msg_flags & MSG_OOB)
	492	return -EOPNOTSUPP;
	493
	494	if (msg->msg_flags & ~(MSG_DONTWAIT\|MSG_NOSIGNAL\|MSG_ERRQUEUE))
	495	return -EINVAL;
	496
	497	if (len < 4 \|\| len > HCI_MAX_FRAME_SIZE)
	498	return -EINVAL;
	499
	500	lock_sock(sk);
	501
	502	if (!(hdev = hci_pi(sk)->hdev)) {
	503	err = -EBADFD;
	504	goto done;
	505	}
	506
7e21addc MH	507	if (!test_bit(HCI_UP, &hdev->flags)) {
	508	err = -ENETDOWN;
	509	goto done;
	510	}
	511
1da177e4 LT	512	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
	513	goto done;
	514
	515	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
	516	err = -EFAULT;
	517	goto drop;
	518	}
	519
0d48d939	520	bt_cb(skb)->pkt_type = ((unsigned char ) skb->data);
1da177e4 LT	521	skb_pull(skb, 1);
	522	skb->dev = (void *) hdev;
	523
0d48d939	524	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
83985319	525	u16 opcode = get_unaligned_le16(skb->data);
1da177e4 LT	526	u16 ogf = hci_opcode_ogf(opcode);
	527	u16 ocf = hci_opcode_ocf(opcode);
	528
	529	if (((ogf > HCI_SFLT_MAX_OGF) \|\|
	530	!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
	531	!capable(CAP_NET_RAW)) {
	532	err = -EPERM;
	533	goto drop;
	534	}
	535
a9de9248	536	if (test_bit(HCI_RAW, &hdev->flags) \|\| (ogf == 0x3f)) {
1da177e4	537	skb_queue_tail(&hdev->raw_q, skb);
c78ae283	538	tasklet_schedule(&hdev->tx_task);
1da177e4 LT	539	} else {
1da177e4 LT	540	skb_queue_tail(&hdev->cmd_q, skb);
c78ae283	541	tasklet_schedule(&hdev->cmd_task);
1da177e4 LT	542	}
	543	} else {
	544	if (!capable(CAP_NET_RAW)) {
	545	err = -EPERM;
	546	goto drop;
	547	}
	548
	549	skb_queue_tail(&hdev->raw_q, skb);
c78ae283	550	tasklet_schedule(&hdev->tx_task);
1da177e4 LT	551	}
	552
	553	err = len;
	554
	555	done:
	556	release_sock(sk);
	557	return err;
	558
	559	drop:
	560	kfree_skb(skb);
	561	goto done;
	562	}
	563
b7058842	564	static int hci_sock_setsockopt(struct socket sock, int level, int optname, char __user optval, unsigned int len)
1da177e4 LT	565	{
	566	struct hci_ufilter uf = { .opcode = 0 };
	567	struct sock *sk = sock->sk;
	568	int err = 0, opt = 0;
	569
	570	BT_DBG("sk %p, opt %d", sk, optname);
	571
	572	lock_sock(sk);
	573
	574	switch (optname) {
	575	case HCI_DATA_DIR:
	576	if (get_user(opt, (int __user *)optval)) {
	577	err = -EFAULT;
	578	break;
	579	}
	580
	581	if (opt)
	582	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_DIR;
	583	else
	584	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
	585	break;
	586
	587	case HCI_TIME_STAMP:
	588	if (get_user(opt, (int __user *)optval)) {
	589	err = -EFAULT;
	590	break;
	591	}
	592
	593	if (opt)
	594	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_TSTAMP;
	595	else
	596	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
	597	break;
	598
	599	case HCI_FILTER:
0878b666 MH	600	{
	601	struct hci_filter *f = &hci_pi(sk)->filter;
	602
	603	uf.type_mask = f->type_mask;
	604	uf.opcode = f->opcode;
	605	uf.event_mask[0] = ((u32 ) f->event_mask + 0);
	606	uf.event_mask[1] = ((u32 ) f->event_mask + 1);
	607	}
	608
1da177e4 LT	609	len = min_t(unsigned int, len, sizeof(uf));
	610	if (copy_from_user(&uf, optval, len)) {
	611	err = -EFAULT;
	612	break;
	613	}
	614
	615	if (!capable(CAP_NET_RAW)) {
	616	uf.type_mask &= hci_sec_filter.type_mask;
	617	uf.event_mask[0] &= ((u32 ) hci_sec_filter.event_mask + 0);
	618	uf.event_mask[1] &= ((u32 ) hci_sec_filter.event_mask + 1);
	619	}
	620
	621	{
	622	struct hci_filter *f = &hci_pi(sk)->filter;
	623
	624	f->type_mask = uf.type_mask;
	625	f->opcode = uf.opcode;
	626	((u32 ) f->event_mask + 0) = uf.event_mask[0];
	627	((u32 ) f->event_mask + 1) = uf.event_mask[1];
	628	}
8e87d142	629	break;
1da177e4 LT	630
	631	default:
	632	err = -ENOPROTOOPT;
	633	break;
	634	}
	635
	636	release_sock(sk);
	637	return err;
	638	}
	639
	640	static int hci_sock_getsockopt(struct socket sock, int level, int optname, char __user optval, int __user *optlen)
	641	{
	642	struct hci_ufilter uf;
	643	struct sock *sk = sock->sk;
8e87d142	644	int len, opt;
1da177e4 LT	645
	646	if (get_user(len, optlen))
	647	return -EFAULT;
	648
	649	switch (optname) {
	650	case HCI_DATA_DIR:
	651	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
	652	opt = 1;
8e87d142	653	else
1da177e4 LT	654	opt = 0;
	655
	656	if (put_user(opt, optval))
	657	return -EFAULT;
	658	break;
	659
	660	case HCI_TIME_STAMP:
	661	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
	662	opt = 1;
8e87d142	663	else
1da177e4 LT	664	opt = 0;
	665
	666	if (put_user(opt, optval))
	667	return -EFAULT;
	668	break;
	669
	670	case HCI_FILTER:
	671	{
	672	struct hci_filter *f = &hci_pi(sk)->filter;
	673
	674	uf.type_mask = f->type_mask;
	675	uf.opcode = f->opcode;
	676	uf.event_mask[0] = ((u32 ) f->event_mask + 0);
	677	uf.event_mask[1] = ((u32 ) f->event_mask + 1);
	678	}
	679
	680	len = min_t(unsigned int, len, sizeof(uf));
	681	if (copy_to_user(optval, &uf, len))
	682	return -EFAULT;
	683	break;
	684
	685	default:
	686	return -ENOPROTOOPT;
	687	break;
	688	}
	689
	690	return 0;
	691	}
	692
90ddc4f0	693	static const struct proto_ops hci_sock_ops = {
1da177e4 LT	694	.family = PF_BLUETOOTH,
	695	.owner = THIS_MODULE,
	696	.release = hci_sock_release,
	697	.bind = hci_sock_bind,
	698	.getname = hci_sock_getname,
	699	.sendmsg = hci_sock_sendmsg,
	700	.recvmsg = hci_sock_recvmsg,
	701	.ioctl = hci_sock_ioctl,
	702	.poll = datagram_poll,
	703	.listen = sock_no_listen,
	704	.shutdown = sock_no_shutdown,
	705	.setsockopt = hci_sock_setsockopt,
	706	.getsockopt = hci_sock_getsockopt,
	707	.connect = sock_no_connect,
	708	.socketpair = sock_no_socketpair,
	709	.accept = sock_no_accept,
	710	.mmap = sock_no_mmap
	711	};
	712
	713	static struct proto hci_sk_proto = {
	714	.name = "HCI",
	715	.owner = THIS_MODULE,
	716	.obj_size = sizeof(struct hci_pinfo)
	717	};
	718
3f378b68 EP	719	static int hci_sock_create(struct net net, struct socket sock, int protocol,
3f378b68 EP	720	int kern)
1da177e4 LT	721	{
	722	struct sock *sk;
	723
	724	BT_DBG("sock %p", sock);
	725
	726	if (sock->type != SOCK_RAW)
	727	return -ESOCKTNOSUPPORT;
	728
	729	sock->ops = &hci_sock_ops;
	730
6257ff21	731	sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
1da177e4 LT	732	if (!sk)
	733	return -ENOMEM;
	734
	735	sock_init_data(sock, sk);
	736
	737	sock_reset_flag(sk, SOCK_ZAPPED);
	738
	739	sk->sk_protocol = protocol;
	740
	741	sock->state = SS_UNCONNECTED;
	742	sk->sk_state = BT_OPEN;
	743
	744	bt_sock_link(&hci_sk_list, sk);
	745	return 0;
	746	}
	747
	748	static int hci_sock_dev_event(struct notifier_block this, unsigned long event, void ptr)
	749	{
	750	struct hci_dev hdev = (struct hci_dev ) ptr;
	751	struct hci_ev_si_device ev;
	752
	753	BT_DBG("hdev %s event %ld", hdev->name, event);
	754
	755	/* Send event to sockets */
	756	ev.event = event;
	757	ev.dev_id = hdev->id;
	758	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
	759
	760	if (event == HCI_DEV_UNREG) {
	761	struct sock *sk;
	762	struct hlist_node *node;
	763
	764	/* Detach sockets from device */
	765	read_lock(&hci_sk_list.lock);
	766	sk_for_each(sk, node, &hci_sk_list.head) {
4ce61d1c SS	767	local_bh_disable();
4ce61d1c SS	768	bh_lock_sock_nested(sk);
1da177e4 LT	769	if (hci_pi(sk)->hdev == hdev) {
	770	hci_pi(sk)->hdev = NULL;
	771	sk->sk_err = EPIPE;
	772	sk->sk_state = BT_OPEN;
	773	sk->sk_state_change(sk);
	774
	775	hci_dev_put(hdev);
	776	}
4ce61d1c SS	777	bh_unlock_sock(sk);
4ce61d1c SS	778	local_bh_enable();
1da177e4 LT	779	}
	780	read_unlock(&hci_sk_list.lock);
	781	}
	782
	783	return NOTIFY_DONE;
	784	}
	785
ec1b4cf7	786	static const struct net_proto_family hci_sock_family_ops = {
1da177e4 LT	787	.family = PF_BLUETOOTH,
	788	.owner = THIS_MODULE,
	789	.create = hci_sock_create,
	790	};
	791
	792	static struct notifier_block hci_sock_nblock = {
	793	.notifier_call = hci_sock_dev_event
	794	};
	795
	796	int __init hci_sock_init(void)
	797	{
	798	int err;
	799
	800	err = proto_register(&hci_sk_proto, 0);
	801	if (err < 0)
	802	return err;
	803
	804	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
	805	if (err < 0)
	806	goto error;
	807
	808	hci_register_notifier(&hci_sock_nblock);
	809
	810	BT_INFO("HCI socket layer initialized");
	811
	812	return 0;
	813
	814	error:
	815	BT_ERR("HCI socket registration failed");
	816	proto_unregister(&hci_sk_proto);
	817	return err;
	818	}
	819
04005dd9	820	void __exit hci_sock_cleanup(void)
1da177e4 LT	821	{
	822	if (bt_sock_unregister(BTPROTO_HCI) < 0)
	823	BT_ERR("HCI socket unregistration failed");
	824
	825	hci_unregister_notifier(&hci_sock_nblock);
	826
	827	proto_unregister(&hci_sk_proto);
1da177e4	828	}