?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
[linux/fpc-iii.git] / net / bluetooth / hci_sock.c
blobea1cd8b21708a6a120ab2395ff0078735f52bdd5
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI sockets. */
26
27 #include <linux/export.h>
28 #include <asm/unaligned.h>
29
30 #include <net/bluetooth/bluetooth.h>
31 #include <net/bluetooth/hci_core.h>
32 #include <net/bluetooth/hci_mon.h>
33 #include <net/bluetooth/mgmt.h>
34
35 #include "mgmt_util.h"
36
37 static LIST_HEAD(mgmt_chan_list);
38 static DEFINE_MUTEX(mgmt_chan_list_lock);
39
40 static atomic_t monitor_promisc = ATOMIC_INIT(0);
41
42 /* ----- HCI socket interface ----- */
43
44 /* Socket info */
45 #define hci_pi(sk) ((struct hci_pinfo *) sk)
46
47 struct hci_pinfo {
48 struct bt_sock bt;
49 struct hci_dev *hdev;
50 struct hci_filter filter;
51 __u32 cmsg_mask;
52 unsigned short channel;
53 unsigned long flags;
54 };
55
56 void hci_sock_set_flag(struct sock *sk, int nr)
57 {
58 set_bit(nr, &hci_pi(sk)->flags);
59 }
60
61 void hci_sock_clear_flag(struct sock *sk, int nr)
62 {
63 clear_bit(nr, &hci_pi(sk)->flags);
64 }
65
66 int hci_sock_test_flag(struct sock *sk, int nr)
67 {
68 return test_bit(nr, &hci_pi(sk)->flags);
69 }
70
71 unsigned short hci_sock_get_channel(struct sock *sk)
72 {
73 return hci_pi(sk)->channel;
74 }
75
76 static inline int hci_test_bit(int nr, const void *addr)
77 {
78 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
79 }
80
81 /* Security filter */
82 #define HCI_SFLT_MAX_OGF 5
83
84 struct hci_sec_filter {
85 __u32 type_mask;
86 __u32 event_mask[2];
87 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
88 };
89
90 static const struct hci_sec_filter hci_sec_filter = {
91 /* Packet types */
92 0x10,
93 /* Events */
94 { 0x1000d9fe, 0x0000b00c },
95 /* Commands */
96 {
97 { 0x0 },
98 /* OGF_LINK_CTL */
99 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
100 /* OGF_LINK_POLICY */
101 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
102 /* OGF_HOST_CTL */
103 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
104 /* OGF_INFO_PARAM */
105 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
106 /* OGF_STATUS_PARAM */
107 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
108 }
109 };
110
111 static struct bt_sock_list hci_sk_list = {
112 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
113 };
114
115 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
116 {
117 struct hci_filter *flt;
118 int flt_type, flt_event;
119
120 /* Apply filter */
121 flt = &hci_pi(sk)->filter;
122
123 flt_type = bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS;
124
125 if (!test_bit(flt_type, &flt->type_mask))
126 return true;
127
128 /* Extra filter for event packets only */
129 if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT)
130 return false;
131
132 flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
133
134 if (!hci_test_bit(flt_event, &flt->event_mask))
135 return true;
136
137 /* Check filter only when opcode is set */
138 if (!flt->opcode)
139 return false;
140
141 if (flt_event == HCI_EV_CMD_COMPLETE &&
142 flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
143 return true;
144
145 if (flt_event == HCI_EV_CMD_STATUS &&
146 flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
147 return true;
148
149 return false;
150 }
151
152 /* Send frame to RAW socket */
153 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
154 {
155 struct sock *sk;
156 struct sk_buff *skb_copy = NULL;
157
158 BT_DBG("hdev %p len %d", hdev, skb->len);
159
160 read_lock(&hci_sk_list.lock);
161
162 sk_for_each(sk, &hci_sk_list.head) {
163 struct sk_buff *nskb;
164
165 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
166 continue;
167
168 /* Don't send frame to the socket it came from */
169 if (skb->sk == sk)
170 continue;
171
172 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
173 if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
174 bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&
175 bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
176 bt_cb(skb)->pkt_type != HCI_SCODATA_PKT)
177 continue;
178 if (is_filtered_packet(sk, skb))
179 continue;
180 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
181 if (!bt_cb(skb)->incoming)
182 continue;
183 if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&
184 bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
185 bt_cb(skb)->pkt_type != HCI_SCODATA_PKT)
186 continue;
187 } else {
188 /* Don't send frame to other channel types */
189 continue;
190 }
191
192 if (!skb_copy) {
193 /* Create a private copy with headroom */
194 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
195 if (!skb_copy)
196 continue;
197
198 /* Put type byte before the data */
199 memcpy(skb_push(skb_copy, 1), &bt_cb(skb)->pkt_type, 1);
200 }
201
202 nskb = skb_clone(skb_copy, GFP_ATOMIC);
203 if (!nskb)
204 continue;
205
206 if (sock_queue_rcv_skb(sk, nskb))
207 kfree_skb(nskb);
208 }
209
210 read_unlock(&hci_sk_list.lock);
211
212 kfree_skb(skb_copy);
213 }
214
215 /* Send frame to sockets with specific channel */
216 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
217 int flag, struct sock *skip_sk)
218 {
219 struct sock *sk;
220
221 BT_DBG("channel %u len %d", channel, skb->len);
222
223 read_lock(&hci_sk_list.lock);
224
225 sk_for_each(sk, &hci_sk_list.head) {
226 struct sk_buff *nskb;
227
228 /* Ignore socket without the flag set */
229 if (!hci_sock_test_flag(sk, flag))
230 continue;
231
232 /* Skip the original socket */
233 if (sk == skip_sk)
234 continue;
235
236 if (sk->sk_state != BT_BOUND)
237 continue;
238
239 if (hci_pi(sk)->channel != channel)
240 continue;
241
242 nskb = skb_clone(skb, GFP_ATOMIC);
243 if (!nskb)
244 continue;
245
246 if (sock_queue_rcv_skb(sk, nskb))
247 kfree_skb(nskb);
248 }
249
250 read_unlock(&hci_sk_list.lock);
251 }
252
253 /* Send frame to monitor socket */
254 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
255 {
256 struct sk_buff *skb_copy = NULL;
257 struct hci_mon_hdr *hdr;
258 __le16 opcode;
259
260 if (!atomic_read(&monitor_promisc))
261 return;
262
263 BT_DBG("hdev %p len %d", hdev, skb->len);
264
265 switch (bt_cb(skb)->pkt_type) {
266 case HCI_COMMAND_PKT:
267 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
268 break;
269 case HCI_EVENT_PKT:
270 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
271 break;
272 case HCI_ACLDATA_PKT:
273 if (bt_cb(skb)->incoming)
274 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
275 else
276 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
277 break;
278 case HCI_SCODATA_PKT:
279 if (bt_cb(skb)->incoming)
280 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
281 else
282 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
283 break;
284 case HCI_DIAG_PKT:
285 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG);
286 break;
287 default:
288 return;
289 }
290
291 /* Create a private copy with headroom */
292 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true);
293 if (!skb_copy)
294 return;
295
296 /* Put header before the data */
297 hdr = (void *) skb_push(skb_copy, HCI_MON_HDR_SIZE);
298 hdr->opcode = opcode;
299 hdr->index = cpu_to_le16(hdev->id);
300 hdr->len = cpu_to_le16(skb->len);
301
302 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy,
303 HCI_SOCK_TRUSTED, NULL);
304 kfree_skb(skb_copy);
305 }
306
307 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
308 {
309 struct hci_mon_hdr *hdr;
310 struct hci_mon_new_index *ni;
311 struct hci_mon_index_info *ii;
312 struct sk_buff *skb;
313 __le16 opcode;
314
315 switch (event) {
316 case HCI_DEV_REG:
317 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
318 if (!skb)
319 return NULL;
320
321 ni = (void *)skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
322 ni->type = hdev->dev_type;
323 ni->bus = hdev->bus;
324 bacpy(&ni->bdaddr, &hdev->bdaddr);
325 memcpy(ni->name, hdev->name, 8);
326
327 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
328 break;
329
330 case HCI_DEV_UNREG:
331 skb = bt_skb_alloc(0, GFP_ATOMIC);
332 if (!skb)
333 return NULL;
334
335 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
336 break;
337
338 case HCI_DEV_SETUP:
339 if (hdev->manufacturer == 0xffff)
340 return NULL;
341
342 /* fall through */
343
344 case HCI_DEV_UP:
345 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC);
346 if (!skb)
347 return NULL;
348
349 ii = (void *)skb_put(skb, HCI_MON_INDEX_INFO_SIZE);
350 bacpy(&ii->bdaddr, &hdev->bdaddr);
351 ii->manufacturer = cpu_to_le16(hdev->manufacturer);
352
353 opcode = cpu_to_le16(HCI_MON_INDEX_INFO);
354 break;
355
356 case HCI_DEV_OPEN:
357 skb = bt_skb_alloc(0, GFP_ATOMIC);
358 if (!skb)
359 return NULL;
360
361 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX);
362 break;
363
364 case HCI_DEV_CLOSE:
365 skb = bt_skb_alloc(0, GFP_ATOMIC);
366 if (!skb)
367 return NULL;
368
369 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX);
370 break;
371
372 default:
373 return NULL;
374 }
375
376 __net_timestamp(skb);
377
378 hdr = (void *) skb_push(skb, HCI_MON_HDR_SIZE);
379 hdr->opcode = opcode;
380 hdr->index = cpu_to_le16(hdev->id);
381 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
382
383 return skb;
384 }
385
386 static void send_monitor_replay(struct sock *sk)
387 {
388 struct hci_dev *hdev;
389
390 read_lock(&hci_dev_list_lock);
391
392 list_for_each_entry(hdev, &hci_dev_list, list) {
393 struct sk_buff *skb;
394
395 skb = create_monitor_event(hdev, HCI_DEV_REG);
396 if (!skb)
397 continue;
398
399 if (sock_queue_rcv_skb(sk, skb))
400 kfree_skb(skb);
401
402 if (!test_bit(HCI_RUNNING, &hdev->flags))
403 continue;
404
405 skb = create_monitor_event(hdev, HCI_DEV_OPEN);
406 if (!skb)
407 continue;
408
409 if (sock_queue_rcv_skb(sk, skb))
410 kfree_skb(skb);
411
412 if (test_bit(HCI_UP, &hdev->flags))
413 skb = create_monitor_event(hdev, HCI_DEV_UP);
414 else if (hci_dev_test_flag(hdev, HCI_SETUP))
415 skb = create_monitor_event(hdev, HCI_DEV_SETUP);
416 else
417 skb = NULL;
418
419 if (skb) {
420 if (sock_queue_rcv_skb(sk, skb))
421 kfree_skb(skb);
422 }
423 }
424
425 read_unlock(&hci_dev_list_lock);
426 }
427
428 /* Generate internal stack event */
429 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
430 {
431 struct hci_event_hdr *hdr;
432 struct hci_ev_stack_internal *ev;
433 struct sk_buff *skb;
434
435 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
436 if (!skb)
437 return;
438
439 hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
440 hdr->evt = HCI_EV_STACK_INTERNAL;
441 hdr->plen = sizeof(*ev) + dlen;
442
443 ev = (void *) skb_put(skb, sizeof(*ev) + dlen);
444 ev->type = type;
445 memcpy(ev->data, data, dlen);
446
447 bt_cb(skb)->incoming = 1;
448 __net_timestamp(skb);
449
450 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
451 hci_send_to_sock(hdev, skb);
452 kfree_skb(skb);
453 }
454
455 void hci_sock_dev_event(struct hci_dev *hdev, int event)
456 {
457 BT_DBG("hdev %s event %d", hdev->name, event);
458
459 if (atomic_read(&monitor_promisc)) {
460 struct sk_buff *skb;
461
462 /* Send event to monitor */
463 skb = create_monitor_event(hdev, event);
464 if (skb) {
465 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
466 HCI_SOCK_TRUSTED, NULL);
467 kfree_skb(skb);
468 }
469 }
470
471 if (event <= HCI_DEV_DOWN) {
472 struct hci_ev_si_device ev;
473
474 /* Send event to sockets */
475 ev.event = event;
476 ev.dev_id = hdev->id;
477 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
478 }
479
480 if (event == HCI_DEV_UNREG) {
481 struct sock *sk;
482
483 /* Detach sockets from device */
484 read_lock(&hci_sk_list.lock);
485 sk_for_each(sk, &hci_sk_list.head) {
486 bh_lock_sock_nested(sk);
487 if (hci_pi(sk)->hdev == hdev) {
488 hci_pi(sk)->hdev = NULL;
489 sk->sk_err = EPIPE;
490 sk->sk_state = BT_OPEN;
491 sk->sk_state_change(sk);
492
493 hci_dev_put(hdev);
494 }
495 bh_unlock_sock(sk);
496 }
497 read_unlock(&hci_sk_list.lock);
498 }
499 }
500
501 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel)
502 {
503 struct hci_mgmt_chan *c;
504
505 list_for_each_entry(c, &mgmt_chan_list, list) {
506 if (c->channel == channel)
507 return c;
508 }
509
510 return NULL;
511 }
512
513 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel)
514 {
515 struct hci_mgmt_chan *c;
516
517 mutex_lock(&mgmt_chan_list_lock);
518 c = __hci_mgmt_chan_find(channel);
519 mutex_unlock(&mgmt_chan_list_lock);
520
521 return c;
522 }
523
524 int hci_mgmt_chan_register(struct hci_mgmt_chan *c)
525 {
526 if (c->channel < HCI_CHANNEL_CONTROL)
527 return -EINVAL;
528
529 mutex_lock(&mgmt_chan_list_lock);
530 if (__hci_mgmt_chan_find(c->channel)) {
531 mutex_unlock(&mgmt_chan_list_lock);
532 return -EALREADY;
533 }
534
535 list_add_tail(&c->list, &mgmt_chan_list);
536
537 mutex_unlock(&mgmt_chan_list_lock);
538
539 return 0;
540 }
541 EXPORT_SYMBOL(hci_mgmt_chan_register);
542
543 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c)
544 {
545 mutex_lock(&mgmt_chan_list_lock);
546 list_del(&c->list);
547 mutex_unlock(&mgmt_chan_list_lock);
548 }
549 EXPORT_SYMBOL(hci_mgmt_chan_unregister);
550
551 static int hci_sock_release(struct socket *sock)
552 {
553 struct sock *sk = sock->sk;
554 struct hci_dev *hdev;
555
556 BT_DBG("sock %p sk %p", sock, sk);
557
558 if (!sk)
559 return 0;
560
561 if (hci_pi(sk)->channel == HCI_CHANNEL_MONITOR)
562 atomic_dec(&monitor_promisc);
563
564 bt_sock_unlink(&hci_sk_list, sk);
565
566 hdev = hci_pi(sk)->hdev;
567 if (hdev) {
568 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
569 /* When releasing an user channel exclusive access,
570 * call hci_dev_do_close directly instead of calling
571 * hci_dev_close to ensure the exclusive access will
572 * be released and the controller brought back down.
573 *
574 * The checking of HCI_AUTO_OFF is not needed in this
575 * case since it will have been cleared already when
576 * opening the user channel.
577 */
578 hci_dev_do_close(hdev);
579 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
580 mgmt_index_added(hdev);
581 }
582
583 atomic_dec(&hdev->promisc);
584 hci_dev_put(hdev);
585 }
586
587 sock_orphan(sk);
588
589 skb_queue_purge(&sk->sk_receive_queue);
590 skb_queue_purge(&sk->sk_write_queue);
591
592 sock_put(sk);
593 return 0;
594 }
595
596 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
597 {
598 bdaddr_t bdaddr;
599 int err;
600
601 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
602 return -EFAULT;
603
604 hci_dev_lock(hdev);
605
606 err = hci_bdaddr_list_add(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
607
608 hci_dev_unlock(hdev);
609
610 return err;
611 }
612
613 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
614 {
615 bdaddr_t bdaddr;
616 int err;
617
618 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
619 return -EFAULT;
620
621 hci_dev_lock(hdev);
622
623 err = hci_bdaddr_list_del(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
624
625 hci_dev_unlock(hdev);
626
627 return err;
628 }
629
630 /* Ioctls that require bound socket */
631 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
632 unsigned long arg)
633 {
634 struct hci_dev *hdev = hci_pi(sk)->hdev;
635
636 if (!hdev)
637 return -EBADFD;
638
639 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
640 return -EBUSY;
641
642 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
643 return -EOPNOTSUPP;
644
645 if (hdev->dev_type != HCI_BREDR)
646 return -EOPNOTSUPP;
647
648 switch (cmd) {
649 case HCISETRAW:
650 if (!capable(CAP_NET_ADMIN))
651 return -EPERM;
652 return -EOPNOTSUPP;
653
654 case HCIGETCONNINFO:
655 return hci_get_conn_info(hdev, (void __user *) arg);
656
657 case HCIGETAUTHINFO:
658 return hci_get_auth_info(hdev, (void __user *) arg);
659
660 case HCIBLOCKADDR:
661 if (!capable(CAP_NET_ADMIN))
662 return -EPERM;
663 return hci_sock_blacklist_add(hdev, (void __user *) arg);
664
665 case HCIUNBLOCKADDR:
666 if (!capable(CAP_NET_ADMIN))
667 return -EPERM;
668 return hci_sock_blacklist_del(hdev, (void __user *) arg);
669 }
670
671 return -ENOIOCTLCMD;
672 }
673
674 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
675 unsigned long arg)
676 {
677 void __user *argp = (void __user *) arg;
678 struct sock *sk = sock->sk;
679 int err;
680
681 BT_DBG("cmd %x arg %lx", cmd, arg);
682
683 lock_sock(sk);
684
685 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
686 err = -EBADFD;
687 goto done;
688 }
689
690 release_sock(sk);
691
692 switch (cmd) {
693 case HCIGETDEVLIST:
694 return hci_get_dev_list(argp);
695
696 case HCIGETDEVINFO:
697 return hci_get_dev_info(argp);
698
699 case HCIGETCONNLIST:
700 return hci_get_conn_list(argp);
701
702 case HCIDEVUP:
703 if (!capable(CAP_NET_ADMIN))
704 return -EPERM;
705 return hci_dev_open(arg);
706
707 case HCIDEVDOWN:
708 if (!capable(CAP_NET_ADMIN))
709 return -EPERM;
710 return hci_dev_close(arg);
711
712 case HCIDEVRESET:
713 if (!capable(CAP_NET_ADMIN))
714 return -EPERM;
715 return hci_dev_reset(arg);
716
717 case HCIDEVRESTAT:
718 if (!capable(CAP_NET_ADMIN))
719 return -EPERM;
720 return hci_dev_reset_stat(arg);
721
722 case HCISETSCAN:
723 case HCISETAUTH:
724 case HCISETENCRYPT:
725 case HCISETPTYPE:
726 case HCISETLINKPOL:
727 case HCISETLINKMODE:
728 case HCISETACLMTU:
729 case HCISETSCOMTU:
730 if (!capable(CAP_NET_ADMIN))
731 return -EPERM;
732 return hci_dev_cmd(cmd, argp);
733
734 case HCIINQUIRY:
735 return hci_inquiry(argp);
736 }
737
738 lock_sock(sk);
739
740 err = hci_sock_bound_ioctl(sk, cmd, arg);
741
742 done:
743 release_sock(sk);
744 return err;
745 }
746
747 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
748 int addr_len)
749 {
750 struct sockaddr_hci haddr;
751 struct sock *sk = sock->sk;
752 struct hci_dev *hdev = NULL;
753 int len, err = 0;
754
755 BT_DBG("sock %p sk %p", sock, sk);
756
757 if (!addr)
758 return -EINVAL;
759
760 memset(&haddr, 0, sizeof(haddr));
761 len = min_t(unsigned int, sizeof(haddr), addr_len);
762 memcpy(&haddr, addr, len);
763
764 if (haddr.hci_family != AF_BLUETOOTH)
765 return -EINVAL;
766
767 lock_sock(sk);
768
769 if (sk->sk_state == BT_BOUND) {
770 err = -EALREADY;
771 goto done;
772 }
773
774 switch (haddr.hci_channel) {
775 case HCI_CHANNEL_RAW:
776 if (hci_pi(sk)->hdev) {
777 err = -EALREADY;
778 goto done;
779 }
780
781 if (haddr.hci_dev != HCI_DEV_NONE) {
782 hdev = hci_dev_get(haddr.hci_dev);
783 if (!hdev) {
784 err = -ENODEV;
785 goto done;
786 }
787
788 atomic_inc(&hdev->promisc);
789 }
790
791 hci_pi(sk)->hdev = hdev;
792 break;
793
794 case HCI_CHANNEL_USER:
795 if (hci_pi(sk)->hdev) {
796 err = -EALREADY;
797 goto done;
798 }
799
800 if (haddr.hci_dev == HCI_DEV_NONE) {
801 err = -EINVAL;
802 goto done;
803 }
804
805 if (!capable(CAP_NET_ADMIN)) {
806 err = -EPERM;
807 goto done;
808 }
809
810 hdev = hci_dev_get(haddr.hci_dev);
811 if (!hdev) {
812 err = -ENODEV;
813 goto done;
814 }
815
816 if (test_bit(HCI_INIT, &hdev->flags) ||
817 hci_dev_test_flag(hdev, HCI_SETUP) ||
818 hci_dev_test_flag(hdev, HCI_CONFIG) ||
819 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
820 test_bit(HCI_UP, &hdev->flags))) {
821 err = -EBUSY;
822 hci_dev_put(hdev);
823 goto done;
824 }
825
826 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) {
827 err = -EUSERS;
828 hci_dev_put(hdev);
829 goto done;
830 }
831
832 mgmt_index_removed(hdev);
833
834 err = hci_dev_open(hdev->id);
835 if (err) {
836 if (err == -EALREADY) {
837 /* In case the transport is already up and
838 * running, clear the error here.
839 *
840 * This can happen when opening an user
841 * channel and HCI_AUTO_OFF grace period
842 * is still active.
843 */
844 err = 0;
845 } else {
846 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
847 mgmt_index_added(hdev);
848 hci_dev_put(hdev);
849 goto done;
850 }
851 }
852
853 atomic_inc(&hdev->promisc);
854
855 hci_pi(sk)->hdev = hdev;
856 break;
857
858 case HCI_CHANNEL_MONITOR:
859 if (haddr.hci_dev != HCI_DEV_NONE) {
860 err = -EINVAL;
861 goto done;
862 }
863
864 if (!capable(CAP_NET_RAW)) {
865 err = -EPERM;
866 goto done;
867 }
868
869 /* The monitor interface is restricted to CAP_NET_RAW
870 * capabilities and with that implicitly trusted.
871 */
872 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
873
874 send_monitor_replay(sk);
875
876 atomic_inc(&monitor_promisc);
877 break;
878
879 default:
880 if (!hci_mgmt_chan_find(haddr.hci_channel)) {
881 err = -EINVAL;
882 goto done;
883 }
884
885 if (haddr.hci_dev != HCI_DEV_NONE) {
886 err = -EINVAL;
887 goto done;
888 }
889
890 /* Users with CAP_NET_ADMIN capabilities are allowed
891 * access to all management commands and events. For
892 * untrusted users the interface is restricted and
893 * also only untrusted events are sent.
894 */
895 if (capable(CAP_NET_ADMIN))
896 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
897
898 /* At the moment the index and unconfigured index events
899 * are enabled unconditionally. Setting them on each
900 * socket when binding keeps this functionality. They
901 * however might be cleared later and then sending of these
902 * events will be disabled, but that is then intentional.
903 *
904 * This also enables generic events that are safe to be
905 * received by untrusted users. Example for such events
906 * are changes to settings, class of device, name etc.
907 */
908 if (haddr.hci_channel == HCI_CHANNEL_CONTROL) {
909 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS);
910 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
911 hci_sock_set_flag(sk, HCI_MGMT_GENERIC_EVENTS);
912 }
913 break;
914 }
915
916
917 hci_pi(sk)->channel = haddr.hci_channel;
918 sk->sk_state = BT_BOUND;
919
920 done:
921 release_sock(sk);
922 return err;
923 }
924
925 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
926 int *addr_len, int peer)
927 {
928 struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
929 struct sock *sk = sock->sk;
930 struct hci_dev *hdev;
931 int err = 0;
932
933 BT_DBG("sock %p sk %p", sock, sk);
934
935 if (peer)
936 return -EOPNOTSUPP;
937
938 lock_sock(sk);
939
940 hdev = hci_pi(sk)->hdev;
941 if (!hdev) {
942 err = -EBADFD;
943 goto done;
944 }
945
946 *addr_len = sizeof(*haddr);
947 haddr->hci_family = AF_BLUETOOTH;
948 haddr->hci_dev = hdev->id;
949 haddr->hci_channel= hci_pi(sk)->channel;
950
951 done:
952 release_sock(sk);
953 return err;
954 }
955
956 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
957 struct sk_buff *skb)
958 {
959 __u32 mask = hci_pi(sk)->cmsg_mask;
960
961 if (mask & HCI_CMSG_DIR) {
962 int incoming = bt_cb(skb)->incoming;
963 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
964 &incoming);
965 }
966
967 if (mask & HCI_CMSG_TSTAMP) {
968 #ifdef CONFIG_COMPAT
969 struct compat_timeval ctv;
970 #endif
971 struct timeval tv;
972 void *data;
973 int len;
974
975 skb_get_timestamp(skb, &tv);
976
977 data = &tv;
978 len = sizeof(tv);
979 #ifdef CONFIG_COMPAT
980 if (!COMPAT_USE_64BIT_TIME &&
981 (msg->msg_flags & MSG_CMSG_COMPAT)) {
982 ctv.tv_sec = tv.tv_sec;
983 ctv.tv_usec = tv.tv_usec;
984 data = &ctv;
985 len = sizeof(ctv);
986 }
987 #endif
988
989 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
990 }
991 }
992
993 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
994 int flags)
995 {
996 int noblock = flags & MSG_DONTWAIT;
997 struct sock *sk = sock->sk;
998 struct sk_buff *skb;
999 int copied, err;
1000
1001 BT_DBG("sock %p, sk %p", sock, sk);
1002
1003 if (flags & MSG_OOB)
1004 return -EOPNOTSUPP;
1005
1006 if (sk->sk_state == BT_CLOSED)
1007 return 0;
1008
1009 skb = skb_recv_datagram(sk, flags, noblock, &err);
1010 if (!skb)
1011 return err;
1012
1013 copied = skb->len;
1014 if (len < copied) {
1015 msg->msg_flags |= MSG_TRUNC;
1016 copied = len;
1017 }
1018
1019 skb_reset_transport_header(skb);
1020 err = skb_copy_datagram_msg(skb, 0, msg, copied);
1021
1022 switch (hci_pi(sk)->channel) {
1023 case HCI_CHANNEL_RAW:
1024 hci_sock_cmsg(sk, msg, skb);
1025 break;
1026 case HCI_CHANNEL_USER:
1027 case HCI_CHANNEL_MONITOR:
1028 sock_recv_timestamp(msg, sk, skb);
1029 break;
1030 default:
1031 if (hci_mgmt_chan_find(hci_pi(sk)->channel))
1032 sock_recv_timestamp(msg, sk, skb);
1033 break;
1034 }
1035
1036 skb_free_datagram(sk, skb);
1037
1038 return err ? : copied;
1039 }
1040
1041 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
1042 struct msghdr *msg, size_t msglen)
1043 {
1044 void *buf;
1045 u8 *cp;
1046 struct mgmt_hdr *hdr;
1047 u16 opcode, index, len;
1048 struct hci_dev *hdev = NULL;
1049 const struct hci_mgmt_handler *handler;
1050 bool var_len, no_hdev;
1051 int err;
1052
1053 BT_DBG("got %zu bytes", msglen);
1054
1055 if (msglen < sizeof(*hdr))
1056 return -EINVAL;
1057
1058 buf = kmalloc(msglen, GFP_KERNEL);
1059 if (!buf)
1060 return -ENOMEM;
1061
1062 if (memcpy_from_msg(buf, msg, msglen)) {
1063 err = -EFAULT;
1064 goto done;
1065 }
1066
1067 hdr = buf;
1068 opcode = __le16_to_cpu(hdr->opcode);
1069 index = __le16_to_cpu(hdr->index);
1070 len = __le16_to_cpu(hdr->len);
1071
1072 if (len != msglen - sizeof(*hdr)) {
1073 err = -EINVAL;
1074 goto done;
1075 }
1076
1077 if (opcode >= chan->handler_count ||
1078 chan->handlers[opcode].func == NULL) {
1079 BT_DBG("Unknown op %u", opcode);
1080 err = mgmt_cmd_status(sk, index, opcode,
1081 MGMT_STATUS_UNKNOWN_COMMAND);
1082 goto done;
1083 }
1084
1085 handler = &chan->handlers[opcode];
1086
1087 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
1088 !(handler->flags & HCI_MGMT_UNTRUSTED)) {
1089 err = mgmt_cmd_status(sk, index, opcode,
1090 MGMT_STATUS_PERMISSION_DENIED);
1091 goto done;
1092 }
1093
1094 if (index != MGMT_INDEX_NONE) {
1095 hdev = hci_dev_get(index);
1096 if (!hdev) {
1097 err = mgmt_cmd_status(sk, index, opcode,
1098 MGMT_STATUS_INVALID_INDEX);
1099 goto done;
1100 }
1101
1102 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1103 hci_dev_test_flag(hdev, HCI_CONFIG) ||
1104 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1105 err = mgmt_cmd_status(sk, index, opcode,
1106 MGMT_STATUS_INVALID_INDEX);
1107 goto done;
1108 }
1109
1110 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1111 !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
1112 err = mgmt_cmd_status(sk, index, opcode,
1113 MGMT_STATUS_INVALID_INDEX);
1114 goto done;
1115 }
1116 }
1117
1118 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1119 if (no_hdev != !hdev) {
1120 err = mgmt_cmd_status(sk, index, opcode,
1121 MGMT_STATUS_INVALID_INDEX);
1122 goto done;
1123 }
1124
1125 var_len = (handler->flags & HCI_MGMT_VAR_LEN);
1126 if ((var_len && len < handler->data_len) ||
1127 (!var_len && len != handler->data_len)) {
1128 err = mgmt_cmd_status(sk, index, opcode,
1129 MGMT_STATUS_INVALID_PARAMS);
1130 goto done;
1131 }
1132
1133 if (hdev && chan->hdev_init)
1134 chan->hdev_init(sk, hdev);
1135
1136 cp = buf + sizeof(*hdr);
1137
1138 err = handler->func(sk, hdev, cp, len);
1139 if (err < 0)
1140 goto done;
1141
1142 err = msglen;
1143
1144 done:
1145 if (hdev)
1146 hci_dev_put(hdev);
1147
1148 kfree(buf);
1149 return err;
1150 }
1151
1152 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1153 size_t len)
1154 {
1155 struct sock *sk = sock->sk;
1156 struct hci_mgmt_chan *chan;
1157 struct hci_dev *hdev;
1158 struct sk_buff *skb;
1159 int err;
1160
1161 BT_DBG("sock %p sk %p", sock, sk);
1162
1163 if (msg->msg_flags & MSG_OOB)
1164 return -EOPNOTSUPP;
1165
1166 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|
1167 MSG_CMSG_COMPAT))
1168 return -EINVAL;
1169
1170 if (len < 4 || len > HCI_MAX_FRAME_SIZE)
1171 return -EINVAL;
1172
1173 lock_sock(sk);
1174
1175 switch (hci_pi(sk)->channel) {
1176 case HCI_CHANNEL_RAW:
1177 case HCI_CHANNEL_USER:
1178 break;
1179 case HCI_CHANNEL_MONITOR:
1180 err = -EOPNOTSUPP;
1181 goto done;
1182 default:
1183 mutex_lock(&mgmt_chan_list_lock);
1184 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);
1185 if (chan)
1186 err = hci_mgmt_cmd(chan, sk, msg, len);
1187 else
1188 err = -EINVAL;
1189
1190 mutex_unlock(&mgmt_chan_list_lock);
1191 goto done;
1192 }
1193
1194 hdev = hci_pi(sk)->hdev;
1195 if (!hdev) {
1196 err = -EBADFD;
1197 goto done;
1198 }
1199
1200 if (!test_bit(HCI_UP, &hdev->flags)) {
1201 err = -ENETDOWN;
1202 goto done;
1203 }
1204
1205 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1206 if (!skb)
1207 goto done;
1208
1209 if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1210 err = -EFAULT;
1211 goto drop;
1212 }
1213
1214 bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
1215 skb_pull(skb, 1);
1216
1217 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
1218 /* No permission check is needed for user channel
1219 * since that gets enforced when binding the socket.
1220 *
1221 * However check that the packet type is valid.
1222 */
1223 if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
1224 bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
1225 bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
1226 err = -EINVAL;
1227 goto drop;
1228 }
1229
1230 skb_queue_tail(&hdev->raw_q, skb);
1231 queue_work(hdev->workqueue, &hdev->tx_work);
1232 } else if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
1233 u16 opcode = get_unaligned_le16(skb->data);
1234 u16 ogf = hci_opcode_ogf(opcode);
1235 u16 ocf = hci_opcode_ocf(opcode);
1236
1237 if (((ogf > HCI_SFLT_MAX_OGF) ||
1238 !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
1239 &hci_sec_filter.ocf_mask[ogf])) &&
1240 !capable(CAP_NET_RAW)) {
1241 err = -EPERM;
1242 goto drop;
1243 }
1244
1245 if (ogf == 0x3f) {
1246 skb_queue_tail(&hdev->raw_q, skb);
1247 queue_work(hdev->workqueue, &hdev->tx_work);
1248 } else {
1249 /* Stand-alone HCI commands must be flagged as
1250 * single-command requests.
1251 */
1252 bt_cb(skb)->hci.req_start = true;
1253
1254 skb_queue_tail(&hdev->cmd_q, skb);
1255 queue_work(hdev->workqueue, &hdev->cmd_work);
1256 }
1257 } else {
1258 if (!capable(CAP_NET_RAW)) {
1259 err = -EPERM;
1260 goto drop;
1261 }
1262
1263 if (bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
1264 bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
1265 err = -EINVAL;
1266 goto drop;
1267 }
1268
1269 skb_queue_tail(&hdev->raw_q, skb);
1270 queue_work(hdev->workqueue, &hdev->tx_work);
1271 }
1272
1273 err = len;
1274
1275 done:
1276 release_sock(sk);
1277 return err;
1278
1279 drop:
1280 kfree_skb(skb);
1281 goto done;
1282 }
1283
1284 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
1285 char __user *optval, unsigned int len)
1286 {
1287 struct hci_ufilter uf = { .opcode = 0 };
1288 struct sock *sk = sock->sk;
1289 int err = 0, opt = 0;
1290
1291 BT_DBG("sk %p, opt %d", sk, optname);
1292
1293 lock_sock(sk);
1294
1295 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1296 err = -EBADFD;
1297 goto done;
1298 }
1299
1300 switch (optname) {
1301 case HCI_DATA_DIR:
1302 if (get_user(opt, (int __user *)optval)) {
1303 err = -EFAULT;
1304 break;
1305 }
1306
1307 if (opt)
1308 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
1309 else
1310 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
1311 break;
1312
1313 case HCI_TIME_STAMP:
1314 if (get_user(opt, (int __user *)optval)) {
1315 err = -EFAULT;
1316 break;
1317 }
1318
1319 if (opt)
1320 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
1321 else
1322 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
1323 break;
1324
1325 case HCI_FILTER:
1326 {
1327 struct hci_filter *f = &hci_pi(sk)->filter;
1328
1329 uf.type_mask = f->type_mask;
1330 uf.opcode = f->opcode;
1331 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1332 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1333 }
1334
1335 len = min_t(unsigned int, len, sizeof(uf));
1336 if (copy_from_user(&uf, optval, len)) {
1337 err = -EFAULT;
1338 break;
1339 }
1340
1341 if (!capable(CAP_NET_RAW)) {
1342 uf.type_mask &= hci_sec_filter.type_mask;
1343 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
1344 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
1345 }
1346
1347 {
1348 struct hci_filter *f = &hci_pi(sk)->filter;
1349
1350 f->type_mask = uf.type_mask;
1351 f->opcode = uf.opcode;
1352 *((u32 *) f->event_mask + 0) = uf.event_mask[0];
1353 *((u32 *) f->event_mask + 1) = uf.event_mask[1];
1354 }
1355 break;
1356
1357 default:
1358 err = -ENOPROTOOPT;
1359 break;
1360 }
1361
1362 done:
1363 release_sock(sk);
1364 return err;
1365 }
1366
1367 static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
1368 char __user *optval, int __user *optlen)
1369 {
1370 struct hci_ufilter uf;
1371 struct sock *sk = sock->sk;
1372 int len, opt, err = 0;
1373
1374 BT_DBG("sk %p, opt %d", sk, optname);
1375
1376 if (get_user(len, optlen))
1377 return -EFAULT;
1378
1379 lock_sock(sk);
1380
1381 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1382 err = -EBADFD;
1383 goto done;
1384 }
1385
1386 switch (optname) {
1387 case HCI_DATA_DIR:
1388 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
1389 opt = 1;
1390 else
1391 opt = 0;
1392
1393 if (put_user(opt, optval))
1394 err = -EFAULT;
1395 break;
1396
1397 case HCI_TIME_STAMP:
1398 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
1399 opt = 1;
1400 else
1401 opt = 0;
1402
1403 if (put_user(opt, optval))
1404 err = -EFAULT;
1405 break;
1406
1407 case HCI_FILTER:
1408 {
1409 struct hci_filter *f = &hci_pi(sk)->filter;
1410
1411 memset(&uf, 0, sizeof(uf));
1412 uf.type_mask = f->type_mask;
1413 uf.opcode = f->opcode;
1414 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1415 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1416 }
1417
1418 len = min_t(unsigned int, len, sizeof(uf));
1419 if (copy_to_user(optval, &uf, len))
1420 err = -EFAULT;
1421 break;
1422
1423 default:
1424 err = -ENOPROTOOPT;
1425 break;
1426 }
1427
1428 done:
1429 release_sock(sk);
1430 return err;
1431 }
1432
1433 static const struct proto_ops hci_sock_ops = {
1434 .family = PF_BLUETOOTH,
1435 .owner = THIS_MODULE,
1436 .release = hci_sock_release,
1437 .bind = hci_sock_bind,
1438 .getname = hci_sock_getname,
1439 .sendmsg = hci_sock_sendmsg,
1440 .recvmsg = hci_sock_recvmsg,
1441 .ioctl = hci_sock_ioctl,
1442 .poll = datagram_poll,
1443 .listen = sock_no_listen,
1444 .shutdown = sock_no_shutdown,
1445 .setsockopt = hci_sock_setsockopt,
1446 .getsockopt = hci_sock_getsockopt,
1447 .connect = sock_no_connect,
1448 .socketpair = sock_no_socketpair,
1449 .accept = sock_no_accept,
1450 .mmap = sock_no_mmap
1451 };
1452
1453 static struct proto hci_sk_proto = {
1454 .name = "HCI",
1455 .owner = THIS_MODULE,
1456 .obj_size = sizeof(struct hci_pinfo)
1457 };
1458
1459 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
1460 int kern)
1461 {
1462 struct sock *sk;
1463
1464 BT_DBG("sock %p", sock);
1465
1466 if (sock->type != SOCK_RAW)
1467 return -ESOCKTNOSUPPORT;
1468
1469 sock->ops = &hci_sock_ops;
1470
1471 sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern);
1472 if (!sk)
1473 return -ENOMEM;
1474
1475 sock_init_data(sock, sk);
1476
1477 sock_reset_flag(sk, SOCK_ZAPPED);
1478
1479 sk->sk_protocol = protocol;
1480
1481 sock->state = SS_UNCONNECTED;
1482 sk->sk_state = BT_OPEN;
1483
1484 bt_sock_link(&hci_sk_list, sk);
1485 return 0;
1486 }
1487
1488 static const struct net_proto_family hci_sock_family_ops = {
1489 .family = PF_BLUETOOTH,
1490 .owner = THIS_MODULE,
1491 .create = hci_sock_create,
1492 };
1493
1494 int __init hci_sock_init(void)
1495 {
1496 int err;
1497
1498 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr));
1499
1500 err = proto_register(&hci_sk_proto, 0);
1501 if (err < 0)
1502 return err;
1503
1504 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
1505 if (err < 0) {
1506 BT_ERR("HCI socket registration failed");
1507 goto error;
1508 }
1509
1510 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL);
1511 if (err < 0) {
1512 BT_ERR("Failed to create HCI proc file");
1513 bt_sock_unregister(BTPROTO_HCI);
1514 goto error;
1515 }
1516
1517 BT_INFO("HCI socket layer initialized");
1518
1519 return 0;
1520
1521 error:
1522 proto_unregister(&hci_sk_proto);
1523 return err;
1524 }
1525
1526 void hci_sock_cleanup(void)
1527 {
1528 bt_procfs_cleanup(&init_net, "hci");
1529 bt_sock_unregister(BTPROTO_HCI);
1530 proto_unregister(&hci_sk_proto);
1531 }
Linux with added FPC-III support