[net-next-2.6.git] / net / bluetooth / hci_sock.c

/* 
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI sockets. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/capability.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/workqueue.h>
#include <linux/interrupt.h>
#include <linux/socket.h>
#include <linux/ioctl.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_SOCK_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

/* ----- HCI socket interface ----- */

static inline int hci_test_bit(int nr, void *addr)
{
	return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
}

/* Security filter */
static struct hci_sec_filter hci_sec_filter = {
	/* Packet types */
	0x10,
	/* Events */
	{ 0x1000d9fe, 0x0000b00c },
	/* Commands */
	{
		{ 0x0 },
		/* OGF_LINK_CTL */
		{ 0xbe000006, 0x00000001, 0x000000, 0x00 },
		/* OGF_LINK_POLICY */
		{ 0x00005200, 0x00000000, 0x000000, 0x00 },
		/* OGF_HOST_CTL */
		{ 0xaab00200, 0x2b402aaa, 0x020154, 0x00 },
		/* OGF_INFO_PARAM */
		{ 0x000002be, 0x00000000, 0x000000, 0x00 },
		/* OGF_STATUS_PARAM */
		{ 0x000000ea, 0x00000000, 0x000000, 0x00 }
	}
};

static struct bt_sock_list hci_sk_list = {
	.lock = RW_LOCK_UNLOCKED
};

/* Send frame to RAW socket */
void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct sock *sk;
	struct hlist_node *node;

	BT_DBG("hdev %p len %d", hdev, skb->len);

	read_lock(&hci_sk_list.lock);
	sk_for_each(sk, node, &hci_sk_list.head) {
		struct hci_filter *flt;
		struct sk_buff *nskb;

		if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
			continue;

		/* Don't send frame to the socket it came from */
		if (skb->sk == sk)
			continue;

		/* Apply filter */
		flt = &hci_pi(sk)->filter;

		if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
				0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
			continue;

		if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
			register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);

			if (!hci_test_bit(evt, &flt->event_mask))
				continue;

			if (flt->opcode &&
			    ((evt == HCI_EV_CMD_COMPLETE &&
			      flt->opcode !=
			      get_unaligned((__le16 *)(skb->data + 3))) ||
			     (evt == HCI_EV_CMD_STATUS &&
			      flt->opcode !=
			      get_unaligned((__le16 *)(skb->data + 4)))))
				continue;
		}

		if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
			continue;

		/* Put type byte before the data */
		memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);

		if (sock_queue_rcv_skb(sk, nskb))
			kfree_skb(nskb);
	}
	read_unlock(&hci_sk_list.lock);
}

static int hci_sock_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!sk)
		return 0;

	hdev = hci_pi(sk)->hdev;

	bt_sock_unlink(&hci_sk_list, sk);

	if (hdev) {
		atomic_dec(&hdev->promisc);
		hci_dev_put(hdev);
	}

	sock_orphan(sk);

	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);

	sock_put(sk);
	return 0;
}

/* Ioctls that require bound socket */ 
static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
{
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	if (!hdev)
		return -EBADFD;

	switch (cmd) {
	case HCISETRAW:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;

		if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
			return -EPERM;

		if (arg)
			set_bit(HCI_RAW, &hdev->flags);
		else
			clear_bit(HCI_RAW, &hdev->flags);

		return 0;

	case HCISETSECMGR:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;

		if (arg)
			set_bit(HCI_SECMGR, &hdev->flags);
		else
			clear_bit(HCI_SECMGR, &hdev->flags);

		return 0;

	case HCIGETCONNINFO:
		return hci_get_conn_info(hdev, (void __user *)arg);

	default:
		if (hdev->ioctl)
			return hdev->ioctl(hdev, cmd, arg);
		return -EINVAL;
	}
}

static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	struct sock *sk = sock->sk;
	void __user *argp = (void __user *)arg;
	int err;

	BT_DBG("cmd %x arg %lx", cmd, arg);

	switch (cmd) {
	case HCIGETDEVLIST:
		return hci_get_dev_list(argp);

	case HCIGETDEVINFO:
		return hci_get_dev_info(argp);

	case HCIGETCONNLIST:
		return hci_get_conn_list(argp);

	case HCIDEVUP:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_open(arg);

	case HCIDEVDOWN:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_close(arg);

	case HCIDEVRESET:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset(arg);

	case HCIDEVRESTAT:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset_stat(arg);

	case HCISETSCAN:
	case HCISETAUTH:
	case HCISETENCRYPT:
	case HCISETPTYPE:
	case HCISETLINKPOL:
	case HCISETLINKMODE:
	case HCISETACLMTU:
	case HCISETSCOMTU:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_cmd(cmd, argp);

	case HCIINQUIRY:
		return hci_inquiry(argp);

	default:
		lock_sock(sk);
		err = hci_sock_bound_ioctl(sk, cmd, arg);
		release_sock(sk);
		return err;
	}
}

static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = NULL;
	int err = 0;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!haddr || haddr->hci_family != AF_BLUETOOTH)
		return -EINVAL;

	lock_sock(sk);

	if (hci_pi(sk)->hdev) {
		err = -EALREADY;
		goto done;
	}

	if (haddr->hci_dev != HCI_DEV_NONE) {
		if (!(hdev = hci_dev_get(haddr->hci_dev))) {
			err = -ENODEV;
			goto done;
		}

		atomic_inc(&hdev->promisc);
	}

	hci_pi(sk)->hdev = hdev;
	sk->sk_state = BT_BOUND;

done:
	release_sock(sk);
	return err;
}

static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!hdev)
		return -EBADFD;

	lock_sock(sk);

	*addr_len = sizeof(*haddr);
	haddr->hci_family = AF_BLUETOOTH;
	haddr->hci_dev    = hdev->id;

	release_sock(sk);
	return 0;
}

static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
{
	__u32 mask = hci_pi(sk)->cmsg_mask;

	if (mask & HCI_CMSG_DIR) {
		int incoming = bt_cb(skb)->incoming;
		put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	}

	if (mask & HCI_CMSG_TSTAMP) {
		struct timeval tv;

		skb_get_timestamp(skb, &tv);
		put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(tv), &tv);
	}
}
 
static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 
				struct msghdr *msg, size_t len, int flags)
{
	int noblock = flags & MSG_DONTWAIT;
	struct sock *sk = sock->sk;
	struct sk_buff *skb;
	int copied, err;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (flags & (MSG_OOB))
		return -EOPNOTSUPP;

	if (sk->sk_state == BT_CLOSED)
		return 0;

	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
		return err;

	msg->msg_namelen = 0;

	copied = skb->len;
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

	skb->h.raw = skb->data;
	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);

	hci_sock_cmsg(sk, msg, skb);

	skb_free_datagram(sk, skb);

	return err ? : copied;
}

static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 
			    struct msghdr *msg, size_t len)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;
	struct sk_buff *skb;
	int err;

	BT_DBG("sock %p sk %p", sock, sk);

	if (msg->msg_flags & MSG_OOB)
		return -EOPNOTSUPP;

	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
		return -EINVAL;

	if (len < 4 || len > HCI_MAX_FRAME_SIZE)
		return -EINVAL;

	lock_sock(sk);

	if (!(hdev = hci_pi(sk)->hdev)) {
		err = -EBADFD;
		goto done;
	}

	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
		goto done;

	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
		err = -EFAULT;
		goto drop;
	}

	bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
	skb_pull(skb, 1);
	skb->dev = (void *) hdev;

	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
		u16 opcode = __le16_to_cpu(get_unaligned((__le16 *) skb->data));
		u16 ogf = hci_opcode_ogf(opcode);
		u16 ocf = hci_opcode_ocf(opcode);

		if (((ogf > HCI_SFLT_MAX_OGF) ||
				!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
					!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		if (test_bit(HCI_RAW, &hdev->flags) || (ogf == OGF_VENDOR_CMD)) {
			skb_queue_tail(&hdev->raw_q, skb);
			hci_sched_tx(hdev);
		} else {
			skb_queue_tail(&hdev->cmd_q, skb);
			hci_sched_cmd(hdev);
		}
	} else {
		if (!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		skb_queue_tail(&hdev->raw_q, skb);
		hci_sched_tx(hdev);
	}

	err = len;

done:
	release_sock(sk);
	return err;

drop:
	kfree_skb(skb);
	goto done;
}

static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int len)
{
	struct hci_ufilter uf = { .opcode = 0 };
	struct sock *sk = sock->sk;
	int err = 0, opt = 0;

	BT_DBG("sk %p, opt %d", sk, optname);

	lock_sock(sk);

	switch (optname) {
	case HCI_DATA_DIR:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
		break;

	case HCI_TIME_STAMP:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
		break;

	case HCI_FILTER:
		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_from_user(&uf, optval, len)) {
			err = -EFAULT;
			break;
		}

		if (!capable(CAP_NET_RAW)) {
			uf.type_mask &= hci_sec_filter.type_mask;
			uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
			uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
		}

		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			f->type_mask = uf.type_mask;
			f->opcode    = uf.opcode;
			*((u32 *) f->event_mask + 0) = uf.event_mask[0];
			*((u32 *) f->event_mask + 1) = uf.event_mask[1];
		}
		break; 

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
{
	struct hci_ufilter uf;
	struct sock *sk = sock->sk;
	int len, opt; 

	if (get_user(len, optlen))
		return -EFAULT;

	switch (optname) {
	case HCI_DATA_DIR:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
			opt = 1;
		else 
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_TIME_STAMP:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
			opt = 1;
		else 
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_FILTER:
		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			uf.type_mask = f->type_mask;
			uf.opcode    = f->opcode;
			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
		}

		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_to_user(optval, &uf, len))
			return -EFAULT;
		break;

	default:
		return -ENOPROTOOPT;
		break;
	}

	return 0;
}

static const struct proto_ops hci_sock_ops = {
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= hci_sock_release,
	.bind		= hci_sock_bind,
	.getname	= hci_sock_getname,
	.sendmsg	= hci_sock_sendmsg,
	.recvmsg	= hci_sock_recvmsg,
	.ioctl		= hci_sock_ioctl,
	.poll		= datagram_poll,
	.listen		= sock_no_listen,
	.shutdown	= sock_no_shutdown,
	.setsockopt	= hci_sock_setsockopt,
	.getsockopt	= hci_sock_getsockopt,
	.connect	= sock_no_connect,
	.socketpair	= sock_no_socketpair,
	.accept		= sock_no_accept,
	.mmap		= sock_no_mmap
};

static struct proto hci_sk_proto = {
	.name		= "HCI",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct hci_pinfo)
};

static int hci_sock_create(struct socket *sock, int protocol)
{
	struct sock *sk;

	BT_DBG("sock %p", sock);

	if (sock->type != SOCK_RAW)
		return -ESOCKTNOSUPPORT;

	sock->ops = &hci_sock_ops;

	sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	sock_reset_flag(sk, SOCK_ZAPPED);

	sk->sk_protocol = protocol;

	sock->state = SS_UNCONNECTED;
	sk->sk_state = BT_OPEN;

	bt_sock_link(&hci_sk_list, sk);
	return 0;
}

static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
	struct hci_dev *hdev = (struct hci_dev *) ptr;
	struct hci_ev_si_device ev;

	BT_DBG("hdev %s event %ld", hdev->name, event);

	/* Send event to sockets */
	ev.event  = event;
	ev.dev_id = hdev->id;
	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);

	if (event == HCI_DEV_UNREG) {
		struct sock *sk;
		struct hlist_node *node;

		/* Detach sockets from device */
		read_lock(&hci_sk_list.lock);
		sk_for_each(sk, node, &hci_sk_list.head) {
			bh_lock_sock(sk);
			if (hci_pi(sk)->hdev == hdev) {
				hci_pi(sk)->hdev = NULL;
				sk->sk_err = EPIPE;
				sk->sk_state = BT_OPEN;
				sk->sk_state_change(sk);

				hci_dev_put(hdev);
			}
			bh_unlock_sock(sk);
		}
		read_unlock(&hci_sk_list.lock);
	}

	return NOTIFY_DONE;
}

static struct net_proto_family hci_sock_family_ops = {
	.family	= PF_BLUETOOTH,
	.owner	= THIS_MODULE,
	.create	= hci_sock_create,
};

static struct notifier_block hci_sock_nblock = {
	.notifier_call = hci_sock_dev_event
};

int __init hci_sock_init(void)
{
	int err;

	err = proto_register(&hci_sk_proto, 0);
	if (err < 0)
		return err;

	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
	if (err < 0)
		goto error;

	hci_register_notifier(&hci_sock_nblock);

	BT_INFO("HCI socket layer initialized");

	return 0;

error:
	BT_ERR("HCI socket registration failed");
	proto_unregister(&hci_sk_proto);
	return err;
}

int __exit hci_sock_cleanup(void)
{
	if (bt_sock_unregister(BTPROTO_HCI) < 0)
		BT_ERR("HCI socket unregistration failed");

	hci_unregister_notifier(&hci_sock_nblock);

	proto_unregister(&hci_sk_proto);

	return 0;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	19
	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI sockets. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
4fc268d2	30	#include <linux/capability.h>
1da177e4 LT	31	#include <linux/errno.h>
1da177e4 LT	32	#include <linux/kernel.h>
1da177e4 LT	33	#include <linux/sched.h>
	34	#include <linux/slab.h>
	35	#include <linux/poll.h>
	36	#include <linux/fcntl.h>
	37	#include <linux/init.h>
	38	#include <linux/skbuff.h>
	39	#include <linux/workqueue.h>
	40	#include <linux/interrupt.h>
	41	#include <linux/socket.h>
	42	#include <linux/ioctl.h>
	43	#include <net/sock.h>
	44
	45	#include <asm/system.h>
	46	#include <asm/uaccess.h>
	47	#include <asm/unaligned.h>
	48
	49	#include <net/bluetooth/bluetooth.h>
	50	#include <net/bluetooth/hci_core.h>
	51
	52	#ifndef CONFIG_BT_HCI_SOCK_DEBUG
	53	#undef BT_DBG
	54	#define BT_DBG(D...)
	55	#endif
	56
	57	/* ----- HCI socket interface ----- */
	58
	59	static inline int hci_test_bit(int nr, void *addr)
	60	{
	61	return ((__u32 ) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
	62	}
	63
	64	/* Security filter */
	65	static struct hci_sec_filter hci_sec_filter = {
	66	/* Packet types */
	67	0x10,
	68	/* Events */
dd7f5527	69	{ 0x1000d9fe, 0x0000b00c },
1da177e4 LT	70	/* Commands */
	71	{
	72	{ 0x0 },
	73	/* OGF_LINK_CTL */
dd7f5527	74	{ 0xbe000006, 0x00000001, 0x000000, 0x00 },
1da177e4	75	/* OGF_LINK_POLICY */
dd7f5527	76	{ 0x00005200, 0x00000000, 0x000000, 0x00 },
1da177e4	77	/* OGF_HOST_CTL */
dd7f5527	78	{ 0xaab00200, 0x2b402aaa, 0x020154, 0x00 },
1da177e4	79	/* OGF_INFO_PARAM */
dd7f5527	80	{ 0x000002be, 0x00000000, 0x000000, 0x00 },
1da177e4	81	/* OGF_STATUS_PARAM */
dd7f5527	82	{ 0x000000ea, 0x00000000, 0x000000, 0x00 }
1da177e4 LT	83	}
	84	};
	85
	86	static struct bt_sock_list hci_sk_list = {
	87	.lock = RW_LOCK_UNLOCKED
	88	};
	89
	90	/* Send frame to RAW socket */
	91	void hci_send_to_sock(struct hci_dev hdev, struct sk_buff skb)
	92	{
	93	struct sock *sk;
	94	struct hlist_node *node;
	95
	96	BT_DBG("hdev %p len %d", hdev, skb->len);
	97
	98	read_lock(&hci_sk_list.lock);
	99	sk_for_each(sk, node, &hci_sk_list.head) {
	100	struct hci_filter *flt;
	101	struct sk_buff *nskb;
	102
	103	if (sk->sk_state != BT_BOUND \|\| hci_pi(sk)->hdev != hdev)
	104	continue;
	105
	106	/* Don't send frame to the socket it came from */
	107	if (skb->sk == sk)
	108	continue;
	109
	110	/* Apply filter */
	111	flt = &hci_pi(sk)->filter;
	112
0d48d939 MH	113	if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
0d48d939 MH	114	0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
1da177e4 LT	115	continue;
1da177e4 LT	116
0d48d939	117	if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
1da177e4 LT	118	register int evt = ((__u8 )skb->data & HCI_FLT_EVENT_BITS);
	119
	120	if (!hci_test_bit(evt, &flt->event_mask))
	121	continue;
	122
4498c80d DM	123	if (flt->opcode &&
	124	((evt == HCI_EV_CMD_COMPLETE &&
	125	flt->opcode !=
905f3ed6	126	get_unaligned((__le16 *)(skb->data + 3))) \|\|
4498c80d DM	127	(evt == HCI_EV_CMD_STATUS &&
4498c80d DM	128	flt->opcode !=
905f3ed6	129	get_unaligned((__le16 *)(skb->data + 4)))))
1da177e4 LT	130	continue;
	131	}
	132
	133	if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
	134	continue;
	135
	136	/* Put type byte before the data */
0d48d939	137	memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
1da177e4 LT	138
	139	if (sock_queue_rcv_skb(sk, nskb))
	140	kfree_skb(nskb);
	141	}
	142	read_unlock(&hci_sk_list.lock);
	143	}
	144
	145	static int hci_sock_release(struct socket *sock)
	146	{
	147	struct sock *sk = sock->sk;
7b005bd3	148	struct hci_dev *hdev;
1da177e4 LT	149
	150	BT_DBG("sock %p sk %p", sock, sk);
	151
	152	if (!sk)
	153	return 0;
	154
7b005bd3 MH	155	hdev = hci_pi(sk)->hdev;
7b005bd3 MH	156
1da177e4 LT	157	bt_sock_unlink(&hci_sk_list, sk);
	158
	159	if (hdev) {
	160	atomic_dec(&hdev->promisc);
	161	hci_dev_put(hdev);
	162	}
	163
	164	sock_orphan(sk);
	165
	166	skb_queue_purge(&sk->sk_receive_queue);
	167	skb_queue_purge(&sk->sk_write_queue);
	168
	169	sock_put(sk);
	170	return 0;
	171	}
	172
	173	/* Ioctls that require bound socket */
	174	static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
	175	{
	176	struct hci_dev *hdev = hci_pi(sk)->hdev;
	177
	178	if (!hdev)
	179	return -EBADFD;
	180
	181	switch (cmd) {
	182	case HCISETRAW:
	183	if (!capable(CAP_NET_ADMIN))
	184	return -EACCES;
	185
	186	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
	187	return -EPERM;
	188
	189	if (arg)
	190	set_bit(HCI_RAW, &hdev->flags);
	191	else
	192	clear_bit(HCI_RAW, &hdev->flags);
	193
	194	return 0;
	195
	196	case HCISETSECMGR:
	197	if (!capable(CAP_NET_ADMIN))
	198	return -EACCES;
	199
	200	if (arg)
	201	set_bit(HCI_SECMGR, &hdev->flags);
	202	else
	203	clear_bit(HCI_SECMGR, &hdev->flags);
	204
	205	return 0;
	206
	207	case HCIGETCONNINFO:
	208	return hci_get_conn_info(hdev, (void __user *)arg);
	209
	210	default:
	211	if (hdev->ioctl)
	212	return hdev->ioctl(hdev, cmd, arg);
	213	return -EINVAL;
	214	}
	215	}
	216
	217	static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
	218	{
	219	struct sock *sk = sock->sk;
	220	void __user argp = (void __user )arg;
221	int err;
222
223	BT_DBG("cmd %x arg %lx", cmd, arg);
224
225	switch (cmd) {
226	case HCIGETDEVLIST:
227	return hci_get_dev_list(argp);
228
229	case HCIGETDEVINFO:
230	return hci_get_dev_info(argp);
231
232	case HCIGETCONNLIST:
233	return hci_get_conn_list(argp);
234
235	case HCIDEVUP:
236	if (!capable(CAP_NET_ADMIN))
237	return -EACCES;
238	return hci_dev_open(arg);
239
240	case HCIDEVDOWN:
241	if (!capable(CAP_NET_ADMIN))
242	return -EACCES;
243	return hci_dev_close(arg);
244
245	case HCIDEVRESET:
246	if (!capable(CAP_NET_ADMIN))
247	return -EACCES;
248	return hci_dev_reset(arg);
249
250	case HCIDEVRESTAT:
251	if (!capable(CAP_NET_ADMIN))
252	return -EACCES;
253	return hci_dev_reset_stat(arg);
254
255	case HCISETSCAN:
256	case HCISETAUTH:
257	case HCISETENCRYPT:
258	case HCISETPTYPE:
259	case HCISETLINKPOL:
260	case HCISETLINKMODE:
261	case HCISETACLMTU:
262	case HCISETSCOMTU:
263	if (!capable(CAP_NET_ADMIN))
264	return -EACCES;
265	return hci_dev_cmd(cmd, argp);
266
267	case HCIINQUIRY:
268	return hci_inquiry(argp);
269
270	default:
271	lock_sock(sk);
272	err = hci_sock_bound_ioctl(sk, cmd, arg);
273	release_sock(sk);
274	return err;
275	}
276	}
277
278	static int hci_sock_bind(struct socket sock, struct sockaddr addr, int addr_len)
279	{
280	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
281	struct sock *sk = sock->sk;
282	struct hci_dev *hdev = NULL;
283	int err = 0;
284
285	BT_DBG("sock %p sk %p", sock, sk);
286
287	if (!haddr \|\| haddr->hci_family != AF_BLUETOOTH)
288	return -EINVAL;
289
290	lock_sock(sk);
291
292	if (hci_pi(sk)->hdev) {
293	err = -EALREADY;
294	goto done;
295	}
296
297	if (haddr->hci_dev != HCI_DEV_NONE) {
298	if (!(hdev = hci_dev_get(haddr->hci_dev))) {
299	err = -ENODEV;
300	goto done;
301	}
302
303	atomic_inc(&hdev->promisc);
304	}
305
306	hci_pi(sk)->hdev = hdev;
307	sk->sk_state = BT_BOUND;
308
309	done:
310	release_sock(sk);
311	return err;
312	}
313
314	static int hci_sock_getname(struct socket sock, struct sockaddr addr, int *addr_len, int peer)
315	{
316	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
317	struct sock *sk = sock->sk;
7b005bd3	318	struct hci_dev *hdev = hci_pi(sk)->hdev;
1da177e4 LT	319
	320	BT_DBG("sock %p sk %p", sock, sk);
	321
7b005bd3 MH	322	if (!hdev)
	323	return -EBADFD;
	324
1da177e4 LT	325	lock_sock(sk);
	326
	327	addr_len = sizeof(haddr);
	328	haddr->hci_family = AF_BLUETOOTH;
7b005bd3	329	haddr->hci_dev = hdev->id;
1da177e4 LT	330
	331	release_sock(sk);
	332	return 0;
	333	}
	334
	335	static inline void hci_sock_cmsg(struct sock sk, struct msghdr msg, struct sk_buff *skb)
	336	{
	337	__u32 mask = hci_pi(sk)->cmsg_mask;
	338
0d48d939 MH	339	if (mask & HCI_CMSG_DIR) {
	340	int incoming = bt_cb(skb)->incoming;
	341	put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	342	}
1da177e4	343
a61bbcf2 PM	344	if (mask & HCI_CMSG_TSTAMP) {
	345	struct timeval tv;
	346
	347	skb_get_timestamp(skb, &tv);
	348	put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(tv), &tv);
	349	}
1da177e4 LT	350	}
	351
	352	static int hci_sock_recvmsg(struct kiocb iocb, struct socket sock,
	353	struct msghdr *msg, size_t len, int flags)
	354	{
	355	int noblock = flags & MSG_DONTWAIT;
	356	struct sock *sk = sock->sk;
	357	struct sk_buff *skb;
	358	int copied, err;
	359
	360	BT_DBG("sock %p, sk %p", sock, sk);
	361
	362	if (flags & (MSG_OOB))
	363	return -EOPNOTSUPP;
	364
	365	if (sk->sk_state == BT_CLOSED)
	366	return 0;
	367
	368	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
	369	return err;
	370
	371	msg->msg_namelen = 0;
	372
	373	copied = skb->len;
	374	if (len < copied) {
	375	msg->msg_flags \|= MSG_TRUNC;
	376	copied = len;
	377	}
	378
	379	skb->h.raw = skb->data;
	380	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	381
	382	hci_sock_cmsg(sk, msg, skb);
	383
	384	skb_free_datagram(sk, skb);
	385
	386	return err ? : copied;
	387	}
	388
	389	static int hci_sock_sendmsg(struct kiocb iocb, struct socket sock,
	390	struct msghdr *msg, size_t len)
	391	{
	392	struct sock *sk = sock->sk;
	393	struct hci_dev *hdev;
	394	struct sk_buff *skb;
	395	int err;
	396
	397	BT_DBG("sock %p sk %p", sock, sk);
	398
	399	if (msg->msg_flags & MSG_OOB)
	400	return -EOPNOTSUPP;
	401
	402	if (msg->msg_flags & ~(MSG_DONTWAIT\|MSG_NOSIGNAL\|MSG_ERRQUEUE))
	403	return -EINVAL;
	404
	405	if (len < 4 \|\| len > HCI_MAX_FRAME_SIZE)
	406	return -EINVAL;
	407
	408	lock_sock(sk);
	409
	410	if (!(hdev = hci_pi(sk)->hdev)) {
	411	err = -EBADFD;
	412	goto done;
	413	}
414
415	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
416	goto done;
417
418	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
419	err = -EFAULT;
420	goto drop;
421	}
422
0d48d939	423	bt_cb(skb)->pkt_type = ((unsigned char ) skb->data);
1da177e4 LT	424	skb_pull(skb, 1);
	425	skb->dev = (void *) hdev;
	426
0d48d939	427	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
1ebb9252	428	u16 opcode = __le16_to_cpu(get_unaligned((__le16 *) skb->data));
1da177e4 LT	429	u16 ogf = hci_opcode_ogf(opcode);
	430	u16 ocf = hci_opcode_ocf(opcode);
	431
	432	if (((ogf > HCI_SFLT_MAX_OGF) \|\|
	433	!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
	434	!capable(CAP_NET_RAW)) {
	435	err = -EPERM;
	436	goto drop;
	437	}
	438
	439	if (test_bit(HCI_RAW, &hdev->flags) \|\| (ogf == OGF_VENDOR_CMD)) {
	440	skb_queue_tail(&hdev->raw_q, skb);
	441	hci_sched_tx(hdev);
	442	} else {
	443	skb_queue_tail(&hdev->cmd_q, skb);
	444	hci_sched_cmd(hdev);
	445	}
	446	} else {
	447	if (!capable(CAP_NET_RAW)) {
	448	err = -EPERM;
	449	goto drop;
	450	}
	451
	452	skb_queue_tail(&hdev->raw_q, skb);
	453	hci_sched_tx(hdev);
	454	}
	455
	456	err = len;
	457
	458	done:
	459	release_sock(sk);
	460	return err;
	461
	462	drop:
	463	kfree_skb(skb);
	464	goto done;
	465	}
	466
	467	static int hci_sock_setsockopt(struct socket sock, int level, int optname, char __user optval, int len)
	468	{
	469	struct hci_ufilter uf = { .opcode = 0 };
	470	struct sock *sk = sock->sk;
	471	int err = 0, opt = 0;
	472
	473	BT_DBG("sk %p, opt %d", sk, optname);
	474
	475	lock_sock(sk);
	476
	477	switch (optname) {
	478	case HCI_DATA_DIR:
	479	if (get_user(opt, (int __user *)optval)) {
	480	err = -EFAULT;
	481	break;
	482	}
	483
	484	if (opt)
	485	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_DIR;
	486	else
	487	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
	488	break;
	489
	490	case HCI_TIME_STAMP:
	491	if (get_user(opt, (int __user *)optval)) {
	492	err = -EFAULT;
493	break;
494	}
495
496	if (opt)
497	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_TSTAMP;
498	else
499	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
500	break;
501
502	case HCI_FILTER:
503	len = min_t(unsigned int, len, sizeof(uf));
504	if (copy_from_user(&uf, optval, len)) {
505	err = -EFAULT;
506	break;
507	}
508
509	if (!capable(CAP_NET_RAW)) {
510	uf.type_mask &= hci_sec_filter.type_mask;
511	uf.event_mask[0] &= ((u32 ) hci_sec_filter.event_mask + 0);
512	uf.event_mask[1] &= ((u32 ) hci_sec_filter.event_mask + 1);
513	}
514
515	{
516	struct hci_filter *f = &hci_pi(sk)->filter;
517
518	f->type_mask = uf.type_mask;
519	f->opcode = uf.opcode;
520	((u32 ) f->event_mask + 0) = uf.event_mask[0];
521	((u32 ) f->event_mask + 1) = uf.event_mask[1];
522	}
523	break;
524
525	default:
526	err = -ENOPROTOOPT;
527	break;
528	}
529
530	release_sock(sk);
531	return err;
532	}
533
534	static int hci_sock_getsockopt(struct socket sock, int level, int optname, char __user optval, int __user *optlen)
535	{
536	struct hci_ufilter uf;
537	struct sock *sk = sock->sk;
538	int len, opt;
539
540	if (get_user(len, optlen))
541	return -EFAULT;
542
543	switch (optname) {
544	case HCI_DATA_DIR:
545	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
546	opt = 1;
547	else
548	opt = 0;
549
550	if (put_user(opt, optval))
551	return -EFAULT;
552	break;
553
554	case HCI_TIME_STAMP:
555	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
556	opt = 1;
557	else
558	opt = 0;
559
560	if (put_user(opt, optval))
561	return -EFAULT;
562	break;
563
564	case HCI_FILTER:
565	{
566	struct hci_filter *f = &hci_pi(sk)->filter;
567
568	uf.type_mask = f->type_mask;
569	uf.opcode = f->opcode;
570	uf.event_mask[0] = ((u32 ) f->event_mask + 0);
571	uf.event_mask[1] = ((u32 ) f->event_mask + 1);
572	}
573
574	len = min_t(unsigned int, len, sizeof(uf));
575	if (copy_to_user(optval, &uf, len))
576	return -EFAULT;
577	break;
578
579	default:
580	return -ENOPROTOOPT;
581	break;
582	}
583
584	return 0;
585	}
586
90ddc4f0	587	static const struct proto_ops hci_sock_ops = {
1da177e4 LT	588	.family = PF_BLUETOOTH,
	589	.owner = THIS_MODULE,
	590	.release = hci_sock_release,
	591	.bind = hci_sock_bind,
	592	.getname = hci_sock_getname,
	593	.sendmsg = hci_sock_sendmsg,
	594	.recvmsg = hci_sock_recvmsg,
	595	.ioctl = hci_sock_ioctl,
	596	.poll = datagram_poll,
	597	.listen = sock_no_listen,
	598	.shutdown = sock_no_shutdown,
	599	.setsockopt = hci_sock_setsockopt,
	600	.getsockopt = hci_sock_getsockopt,
	601	.connect = sock_no_connect,
	602	.socketpair = sock_no_socketpair,
	603	.accept = sock_no_accept,
	604	.mmap = sock_no_mmap
	605	};
	606
	607	static struct proto hci_sk_proto = {
	608	.name = "HCI",
	609	.owner = THIS_MODULE,
	610	.obj_size = sizeof(struct hci_pinfo)
	611	};
	612
	613	static int hci_sock_create(struct socket *sock, int protocol)
	614	{
	615	struct sock *sk;
	616
	617	BT_DBG("sock %p", sock);
	618
	619	if (sock->type != SOCK_RAW)
	620	return -ESOCKTNOSUPPORT;
	621
	622	sock->ops = &hci_sock_ops;
	623
74da626a	624	sk = sk_alloc(PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, 1);
1da177e4 LT	625	if (!sk)
	626	return -ENOMEM;
	627
	628	sock_init_data(sock, sk);
	629
	630	sock_reset_flag(sk, SOCK_ZAPPED);
	631
	632	sk->sk_protocol = protocol;
	633
	634	sock->state = SS_UNCONNECTED;
	635	sk->sk_state = BT_OPEN;
	636
	637	bt_sock_link(&hci_sk_list, sk);
	638	return 0;
	639	}
	640
	641	static int hci_sock_dev_event(struct notifier_block this, unsigned long event, void ptr)
	642	{
	643	struct hci_dev hdev = (struct hci_dev ) ptr;
	644	struct hci_ev_si_device ev;
	645
	646	BT_DBG("hdev %s event %ld", hdev->name, event);
	647
	648	/* Send event to sockets */
	649	ev.event = event;
	650	ev.dev_id = hdev->id;
	651	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
	652
	653	if (event == HCI_DEV_UNREG) {
	654	struct sock *sk;
	655	struct hlist_node *node;
	656
	657	/* Detach sockets from device */
	658	read_lock(&hci_sk_list.lock);
	659	sk_for_each(sk, node, &hci_sk_list.head) {
	660	bh_lock_sock(sk);
	661	if (hci_pi(sk)->hdev == hdev) {
	662	hci_pi(sk)->hdev = NULL;
	663	sk->sk_err = EPIPE;
	664	sk->sk_state = BT_OPEN;
	665	sk->sk_state_change(sk);
	666
	667	hci_dev_put(hdev);
	668	}
	669	bh_unlock_sock(sk);
	670	}
	671	read_unlock(&hci_sk_list.lock);
	672	}
	673
	674	return NOTIFY_DONE;
	675	}
	676
	677	static struct net_proto_family hci_sock_family_ops = {
	678	.family = PF_BLUETOOTH,
	679	.owner = THIS_MODULE,
	680	.create = hci_sock_create,
	681	};
	682
	683	static struct notifier_block hci_sock_nblock = {
	684	.notifier_call = hci_sock_dev_event
	685	};
	686
	687	int __init hci_sock_init(void)
	688	{
689	int err;
690
691	err = proto_register(&hci_sk_proto, 0);
692	if (err < 0)
693	return err;
694
695	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
696	if (err < 0)
697	goto error;
698
699	hci_register_notifier(&hci_sock_nblock);
700
701	BT_INFO("HCI socket layer initialized");
702
703	return 0;
704
705	error:
706	BT_ERR("HCI socket registration failed");
707	proto_unregister(&hci_sk_proto);
708	return err;
709	}
710
711	int __exit hci_sock_cleanup(void)
712	{
713	if (bt_sock_unregister(BTPROTO_HCI) < 0)
714	BT_ERR("HCI socket unregistration failed");
715
716	hci_unregister_notifier(&hci_sock_nblock);
717
718	proto_unregister(&hci_sk_proto);
719
720	return 0;
721	}