net/bluetooth/hci_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI sockets. */
  26 #include <linux/compat.h>
  27 #include <linux/export.h>
  28 #include <linux/utsname.h>
  29 #include <linux/sched.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/hci_mon.h>
  35 #include <net/bluetooth/mgmt.h>
  36
  37 #include "mgmt_util.h"
  38
  39 static LIST_HEAD(mgmt_chan_list);
  40 static DEFINE_MUTEX(mgmt_chan_list_lock);
  41
  42 static DEFINE_IDA(sock_cookie_ida);
  43
  44 static atomic_t monitor_promisc = ATOMIC_INIT(0);
  45
  46 /* ----- HCI socket interface ----- */
  47
  48 /* Socket info */
  49 #define hci_pi(sk) ((struct hci_pinfo *) sk)
  50
  51 struct hci_pinfo {
  52         struct bt_sock    bt;
  53         struct hci_dev    *hdev;
  54         struct hci_filter filter;
  55         __u32             cmsg_mask;
  56         unsigned short    channel;
  57         unsigned long     flags;
  58         __u32             cookie;
  59         char              comm[TASK_COMM_LEN];
  60 };
  61
  62 void hci_sock_set_flag(struct sock *sk, int nr)
  63 {
  64         set_bit(nr, &hci_pi(sk)->flags);
  65 }
  66
  67 void hci_sock_clear_flag(struct sock *sk, int nr)
  68 {
  69         clear_bit(nr, &hci_pi(sk)->flags);
  70 }
  71
  72 int hci_sock_test_flag(struct sock *sk, int nr)
  73 {
  74         return test_bit(nr, &hci_pi(sk)->flags);
  75 }
  76
  77 unsigned short hci_sock_get_channel(struct sock *sk)
  78 {
  79         return hci_pi(sk)->channel;
  80 }
  81
  82 u32 hci_sock_get_cookie(struct sock *sk)
  83 {
  84         return hci_pi(sk)->cookie;
  85 }
  86
  87 static bool hci_sock_gen_cookie(struct sock *sk)
  88 {
  89         int id = hci_pi(sk)->cookie;
  90
  91         if (!id) {
  92                 id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL);
  93                 if (id < 0)
  94                         id = 0xffffffff;
  95
  96                 hci_pi(sk)->cookie = id;
  97                 get_task_comm(hci_pi(sk)->comm, current);
  98                 return true;
  99         }
 100
 101         return false;
 102 }
 103
 104 static void hci_sock_free_cookie(struct sock *sk)
 105 {
 106         int id = hci_pi(sk)->cookie;
 107
 108         if (id) {
 109                 hci_pi(sk)->cookie = 0xffffffff;
 110                 ida_simple_remove(&sock_cookie_ida, id);
 111         }
 112 }
 113
 114 static inline int hci_test_bit(int nr, const void *addr)
 115 {
 116         return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
 117 }
 118
 119 /* Security filter */
 120 #define HCI_SFLT_MAX_OGF  5
 121
 122 struct hci_sec_filter {
 123         __u32 type_mask;
 124         __u32 event_mask[2];
 125         __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
 126 };
 127
 128 static const struct hci_sec_filter hci_sec_filter = {
 129         /* Packet types */
 130         0x10,
 131         /* Events */
 132         { 0x1000d9fe, 0x0000b00c },
 133         /* Commands */
 134         {
 135                 { 0x0 },
 136                 /* OGF_LINK_CTL */
 137                 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
 138                 /* OGF_LINK_POLICY */
 139                 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
 140                 /* OGF_HOST_CTL */
 141                 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
 142                 /* OGF_INFO_PARAM */
 143                 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
 144                 /* OGF_STATUS_PARAM */
 145                 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
 146         }
 147 };
 148
 149 static struct bt_sock_list hci_sk_list = {
 150         .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
 151 };
 152
 153 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
 154 {
 155         struct hci_filter *flt;
 156         int flt_type, flt_event;
 157
 158         /* Apply filter */
 159         flt = &hci_pi(sk)->filter;
 160
 161         flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS;
 162
 163         if (!test_bit(flt_type, &flt->type_mask))
 164                 return true;
 165
 166         /* Extra filter for event packets only */
 167         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT)
 168                 return false;
 169
 170         flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 171
 172         if (!hci_test_bit(flt_event, &flt->event_mask))
 173                 return true;
 174
 175         /* Check filter only when opcode is set */
 176         if (!flt->opcode)
 177                 return false;
 178
 179         if (flt_event == HCI_EV_CMD_COMPLETE &&
 180             flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
 181                 return true;
 182
 183         if (flt_event == HCI_EV_CMD_STATUS &&
 184             flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
 185                 return true;
 186
 187         return false;
 188 }
 189
 190 /* Send frame to RAW socket */
 191 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 192 {
 193         struct sock *sk;
 194         struct sk_buff *skb_copy = NULL;
 195
 196         BT_DBG("hdev %p len %d", hdev, skb->len);
 197
 198         read_lock(&hci_sk_list.lock);
 199
 200         sk_for_each(sk, &hci_sk_list.head) {
 201                 struct sk_buff *nskb;
 202
 203                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
 204                         continue;
 205
 206                 /* Don't send frame to the socket it came from */
 207                 if (skb->sk == sk)
 208                         continue;
 209
 210                 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
 211                         if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
 212                             hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
 213                             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
 214                             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
 215                             hci_skb_pkt_type(skb) != HCI_ISODATA_PKT)
 216                                 continue;
 217                         if (is_filtered_packet(sk, skb))
 218                                 continue;
 219                 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
 220                         if (!bt_cb(skb)->incoming)
 221                                 continue;
 222                         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
 223                             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
 224                             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
 225                             hci_skb_pkt_type(skb) != HCI_ISODATA_PKT)
 226                                 continue;
 227                 } else {
 228                         /* Don't send frame to other channel types */
 229                         continue;
 230                 }
 231
 232                 if (!skb_copy) {
 233                         /* Create a private copy with headroom */
 234                         skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
 235                         if (!skb_copy)
 236                                 continue;
 237
 238                         /* Put type byte before the data */
 239                         memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1);
 240                 }
 241
 242                 nskb = skb_clone(skb_copy, GFP_ATOMIC);
 243                 if (!nskb)
 244                         continue;
 245
 246                 if (sock_queue_rcv_skb(sk, nskb))
 247                         kfree_skb(nskb);
 248         }
 249
 250         read_unlock(&hci_sk_list.lock);
 251
 252         kfree_skb(skb_copy);
 253 }
 254
 255 /* Send frame to sockets with specific channel */
 256 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
 257                                   int flag, struct sock *skip_sk)
 258 {
 259         struct sock *sk;
 260
 261         BT_DBG("channel %u len %d", channel, skb->len);
 262
 263         sk_for_each(sk, &hci_sk_list.head) {
 264                 struct sk_buff *nskb;
 265
 266                 /* Ignore socket without the flag set */
 267                 if (!hci_sock_test_flag(sk, flag))
 268                         continue;
 269
 270                 /* Skip the original socket */
 271                 if (sk == skip_sk)
 272                         continue;
 273
 274                 if (sk->sk_state != BT_BOUND)
 275                         continue;
 276
 277                 if (hci_pi(sk)->channel != channel)
 278                         continue;
 279
 280                 nskb = skb_clone(skb, GFP_ATOMIC);
 281                 if (!nskb)
 282                         continue;
 283
 284                 if (sock_queue_rcv_skb(sk, nskb))
 285                         kfree_skb(nskb);
 286         }
 287
 288 }
 289
 290 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
 291                          int flag, struct sock *skip_sk)
 292 {
 293         read_lock(&hci_sk_list.lock);
 294         __hci_send_to_channel(channel, skb, flag, skip_sk);
 295         read_unlock(&hci_sk_list.lock);
 296 }
 297
 298 /* Send frame to monitor socket */
 299 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 300 {
 301         struct sk_buff *skb_copy = NULL;
 302         struct hci_mon_hdr *hdr;
 303         __le16 opcode;
 304
 305         if (!atomic_read(&monitor_promisc))
 306                 return;
 307
 308         BT_DBG("hdev %p len %d", hdev, skb->len);
 309
 310         switch (hci_skb_pkt_type(skb)) {
 311         case HCI_COMMAND_PKT:
 312                 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
 313                 break;
 314         case HCI_EVENT_PKT:
 315                 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
 316                 break;
 317         case HCI_ACLDATA_PKT:
 318                 if (bt_cb(skb)->incoming)
 319                         opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
 320                 else
 321                         opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
 322                 break;
 323         case HCI_SCODATA_PKT:
 324                 if (bt_cb(skb)->incoming)
 325                         opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
 326                 else
 327                         opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
 328                 break;
 329         case HCI_ISODATA_PKT:
 330                 if (bt_cb(skb)->incoming)
 331                         opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT);
 332                 else
 333                         opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT);
 334                 break;
 335         case HCI_DIAG_PKT:
 336                 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG);
 337                 break;
 338         default:
 339                 return;
 340         }
 341
 342         /* Create a private copy with headroom */
 343         skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true);
 344         if (!skb_copy)
 345                 return;
 346
 347         /* Put header before the data */
 348         hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE);
 349         hdr->opcode = opcode;
 350         hdr->index = cpu_to_le16(hdev->id);
 351         hdr->len = cpu_to_le16(skb->len);
 352
 353         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy,
 354                             HCI_SOCK_TRUSTED, NULL);
 355         kfree_skb(skb_copy);
 356 }
 357
 358 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event,
 359                                  void *data, u16 data_len, ktime_t tstamp,
 360                                  int flag, struct sock *skip_sk)
 361 {
 362         struct sock *sk;
 363         __le16 index;
 364
 365         if (hdev)
 366                 index = cpu_to_le16(hdev->id);
 367         else
 368                 index = cpu_to_le16(MGMT_INDEX_NONE);
 369
 370         read_lock(&hci_sk_list.lock);
 371
 372         sk_for_each(sk, &hci_sk_list.head) {
 373                 struct hci_mon_hdr *hdr;
 374                 struct sk_buff *skb;
 375
 376                 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL)
 377                         continue;
 378
 379                 /* Ignore socket without the flag set */
 380                 if (!hci_sock_test_flag(sk, flag))
 381                         continue;
 382
 383                 /* Skip the original socket */
 384                 if (sk == skip_sk)
 385                         continue;
 386
 387                 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC);
 388                 if (!skb)
 389                         continue;
 390
 391                 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 392                 put_unaligned_le16(event, skb_put(skb, 2));
 393
 394                 if (data)
 395                         skb_put_data(skb, data, data_len);
 396
 397                 skb->tstamp = tstamp;
 398
 399                 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 400                 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT);
 401                 hdr->index = index;
 402                 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 403
 404                 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 405                                       HCI_SOCK_TRUSTED, NULL);
 406                 kfree_skb(skb);
 407         }
 408
 409         read_unlock(&hci_sk_list.lock);
 410 }
 411
 412 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 413 {
 414         struct hci_mon_hdr *hdr;
 415         struct hci_mon_new_index *ni;
 416         struct hci_mon_index_info *ii;
 417         struct sk_buff *skb;
 418         __le16 opcode;
 419
 420         switch (event) {
 421         case HCI_DEV_REG:
 422                 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
 423                 if (!skb)
 424                         return NULL;
 425
 426                 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
 427                 ni->type = hdev->dev_type;
 428                 ni->bus = hdev->bus;
 429                 bacpy(&ni->bdaddr, &hdev->bdaddr);
 430                 memcpy(ni->name, hdev->name, 8);
 431
 432                 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 433                 break;
 434
 435         case HCI_DEV_UNREG:
 436                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 437                 if (!skb)
 438                         return NULL;
 439
 440                 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
 441                 break;
 442
 443         case HCI_DEV_SETUP:
 444                 if (hdev->manufacturer == 0xffff)
 445                         return NULL;
 446
 447                 /* fall through */
 448
 449         case HCI_DEV_UP:
 450                 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC);
 451                 if (!skb)
 452                         return NULL;
 453
 454                 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE);
 455                 bacpy(&ii->bdaddr, &hdev->bdaddr);
 456                 ii->manufacturer = cpu_to_le16(hdev->manufacturer);
 457
 458                 opcode = cpu_to_le16(HCI_MON_INDEX_INFO);
 459                 break;
 460
 461         case HCI_DEV_OPEN:
 462                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 463                 if (!skb)
 464                         return NULL;
 465
 466                 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX);
 467                 break;
 468
 469         case HCI_DEV_CLOSE:
 470                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 471                 if (!skb)
 472                         return NULL;
 473
 474                 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX);
 475                 break;
 476
 477         default:
 478                 return NULL;
 479         }
 480
 481         __net_timestamp(skb);
 482
 483         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 484         hdr->opcode = opcode;
 485         hdr->index = cpu_to_le16(hdev->id);
 486         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 487
 488         return skb;
 489 }
 490
 491 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk)
 492 {
 493         struct hci_mon_hdr *hdr;
 494         struct sk_buff *skb;
 495         u16 format;
 496         u8 ver[3];
 497         u32 flags;
 498
 499         /* No message needed when cookie is not present */
 500         if (!hci_pi(sk)->cookie)
 501                 return NULL;
 502
 503         switch (hci_pi(sk)->channel) {
 504         case HCI_CHANNEL_RAW:
 505                 format = 0x0000;
 506                 ver[0] = BT_SUBSYS_VERSION;
 507                 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
 508                 break;
 509         case HCI_CHANNEL_USER:
 510                 format = 0x0001;
 511                 ver[0] = BT_SUBSYS_VERSION;
 512                 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
 513                 break;
 514         case HCI_CHANNEL_CONTROL:
 515                 format = 0x0002;
 516                 mgmt_fill_version_info(ver);
 517                 break;
 518         default:
 519                 /* No message for unsupported format */
 520                 return NULL;
 521         }
 522
 523         skb = bt_skb_alloc(14 + TASK_COMM_LEN , GFP_ATOMIC);
 524         if (!skb)
 525                 return NULL;
 526
 527         flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0;
 528
 529         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 530         put_unaligned_le16(format, skb_put(skb, 2));
 531         skb_put_data(skb, ver, sizeof(ver));
 532         put_unaligned_le32(flags, skb_put(skb, 4));
 533         skb_put_u8(skb, TASK_COMM_LEN);
 534         skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN);
 535
 536         __net_timestamp(skb);
 537
 538         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 539         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN);
 540         if (hci_pi(sk)->hdev)
 541                 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
 542         else
 543                 hdr->index = cpu_to_le16(HCI_DEV_NONE);
 544         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 545
 546         return skb;
 547 }
 548
 549 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk)
 550 {
 551         struct hci_mon_hdr *hdr;
 552         struct sk_buff *skb;
 553
 554         /* No message needed when cookie is not present */
 555         if (!hci_pi(sk)->cookie)
 556                 return NULL;
 557
 558         switch (hci_pi(sk)->channel) {
 559         case HCI_CHANNEL_RAW:
 560         case HCI_CHANNEL_USER:
 561         case HCI_CHANNEL_CONTROL:
 562                 break;
 563         default:
 564                 /* No message for unsupported format */
 565                 return NULL;
 566         }
 567
 568         skb = bt_skb_alloc(4, GFP_ATOMIC);
 569         if (!skb)
 570                 return NULL;
 571
 572         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 573
 574         __net_timestamp(skb);
 575
 576         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 577         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE);
 578         if (hci_pi(sk)->hdev)
 579                 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
 580         else
 581                 hdr->index = cpu_to_le16(HCI_DEV_NONE);
 582         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 583
 584         return skb;
 585 }
 586
 587 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index,
 588                                                    u16 opcode, u16 len,
 589                                                    const void *buf)
 590 {
 591         struct hci_mon_hdr *hdr;
 592         struct sk_buff *skb;
 593
 594         skb = bt_skb_alloc(6 + len, GFP_ATOMIC);
 595         if (!skb)
 596                 return NULL;
 597
 598         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 599         put_unaligned_le16(opcode, skb_put(skb, 2));
 600
 601         if (buf)
 602                 skb_put_data(skb, buf, len);
 603
 604         __net_timestamp(skb);
 605
 606         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 607         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND);
 608         hdr->index = cpu_to_le16(index);
 609         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 610
 611         return skb;
 612 }
 613
 614 static void __printf(2, 3)
 615 send_monitor_note(struct sock *sk, const char *fmt, ...)
 616 {
 617         size_t len;
 618         struct hci_mon_hdr *hdr;
 619         struct sk_buff *skb;
 620         va_list args;
 621
 622         va_start(args, fmt);
 623         len = vsnprintf(NULL, 0, fmt, args);
 624         va_end(args);
 625
 626         skb = bt_skb_alloc(len + 1, GFP_ATOMIC);
 627         if (!skb)
 628                 return;
 629
 630         va_start(args, fmt);
 631         vsprintf(skb_put(skb, len), fmt, args);
 632         *(u8 *)skb_put(skb, 1) = 0;
 633         va_end(args);
 634
 635         __net_timestamp(skb);
 636
 637         hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE);
 638         hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE);
 639         hdr->index = cpu_to_le16(HCI_DEV_NONE);
 640         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 641
 642         if (sock_queue_rcv_skb(sk, skb))
 643                 kfree_skb(skb);
 644 }
 645
 646 static void send_monitor_replay(struct sock *sk)
 647 {
 648         struct hci_dev *hdev;
 649
 650         read_lock(&hci_dev_list_lock);
 651
 652         list_for_each_entry(hdev, &hci_dev_list, list) {
 653                 struct sk_buff *skb;
 654
 655                 skb = create_monitor_event(hdev, HCI_DEV_REG);
 656                 if (!skb)
 657                         continue;
 658
 659                 if (sock_queue_rcv_skb(sk, skb))
 660                         kfree_skb(skb);
 661
 662                 if (!test_bit(HCI_RUNNING, &hdev->flags))
 663                         continue;
 664
 665                 skb = create_monitor_event(hdev, HCI_DEV_OPEN);
 666                 if (!skb)
 667                         continue;
 668
 669                 if (sock_queue_rcv_skb(sk, skb))
 670                         kfree_skb(skb);
 671
 672                 if (test_bit(HCI_UP, &hdev->flags))
 673                         skb = create_monitor_event(hdev, HCI_DEV_UP);
 674                 else if (hci_dev_test_flag(hdev, HCI_SETUP))
 675                         skb = create_monitor_event(hdev, HCI_DEV_SETUP);
 676                 else
 677                         skb = NULL;
 678
 679                 if (skb) {
 680                         if (sock_queue_rcv_skb(sk, skb))
 681                                 kfree_skb(skb);
 682                 }
 683         }
 684
 685         read_unlock(&hci_dev_list_lock);
 686 }
 687
 688 static void send_monitor_control_replay(struct sock *mon_sk)
 689 {
 690         struct sock *sk;
 691
 692         read_lock(&hci_sk_list.lock);
 693
 694         sk_for_each(sk, &hci_sk_list.head) {
 695                 struct sk_buff *skb;
 696
 697                 skb = create_monitor_ctrl_open(sk);
 698                 if (!skb)
 699                         continue;
 700
 701                 if (sock_queue_rcv_skb(mon_sk, skb))
 702                         kfree_skb(skb);
 703         }
 704
 705         read_unlock(&hci_sk_list.lock);
 706 }
 707
 708 /* Generate internal stack event */
 709 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
 710 {
 711         struct hci_event_hdr *hdr;
 712         struct hci_ev_stack_internal *ev;
 713         struct sk_buff *skb;
 714
 715         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
 716         if (!skb)
 717                 return;
 718
 719         hdr = skb_put(skb, HCI_EVENT_HDR_SIZE);
 720         hdr->evt  = HCI_EV_STACK_INTERNAL;
 721         hdr->plen = sizeof(*ev) + dlen;
 722
 723         ev = skb_put(skb, sizeof(*ev) + dlen);
 724         ev->type = type;
 725         memcpy(ev->data, data, dlen);
 726
 727         bt_cb(skb)->incoming = 1;
 728         __net_timestamp(skb);
 729
 730         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 731         hci_send_to_sock(hdev, skb);
 732         kfree_skb(skb);
 733 }
 734
 735 void hci_sock_dev_event(struct hci_dev *hdev, int event)
 736 {
 737         BT_DBG("hdev %s event %d", hdev->name, event);
 738
 739         if (atomic_read(&monitor_promisc)) {
 740                 struct sk_buff *skb;
 741
 742                 /* Send event to monitor */
 743                 skb = create_monitor_event(hdev, event);
 744                 if (skb) {
 745                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 746                                             HCI_SOCK_TRUSTED, NULL);
 747                         kfree_skb(skb);
 748                 }
 749         }
 750
 751         if (event <= HCI_DEV_DOWN) {
 752                 struct hci_ev_si_device ev;
 753
 754                 /* Send event to sockets */
 755                 ev.event  = event;
 756                 ev.dev_id = hdev->id;
 757                 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
 758         }
 759
 760         if (event == HCI_DEV_UNREG) {
 761                 struct sock *sk;
 762
 763                 /* Detach sockets from device */
 764                 read_lock(&hci_sk_list.lock);
 765                 sk_for_each(sk, &hci_sk_list.head) {
 766                         bh_lock_sock_nested(sk);
 767                         if (hci_pi(sk)->hdev == hdev) {
 768                                 hci_pi(sk)->hdev = NULL;
 769                                 sk->sk_err = EPIPE;
 770                                 sk->sk_state = BT_OPEN;
 771                                 sk->sk_state_change(sk);
 772
 773                                 hci_dev_put(hdev);
 774                         }
 775                         bh_unlock_sock(sk);
 776                 }
 777                 read_unlock(&hci_sk_list.lock);
 778         }
 779 }
 780
 781 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel)
 782 {
 783         struct hci_mgmt_chan *c;
 784
 785         list_for_each_entry(c, &mgmt_chan_list, list) {
 786                 if (c->channel == channel)
 787                         return c;
 788         }
 789
 790         return NULL;
 791 }
 792
 793 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel)
 794 {
 795         struct hci_mgmt_chan *c;
 796
 797         mutex_lock(&mgmt_chan_list_lock);
 798         c = __hci_mgmt_chan_find(channel);
 799         mutex_unlock(&mgmt_chan_list_lock);
 800
 801         return c;
 802 }
 803
 804 int hci_mgmt_chan_register(struct hci_mgmt_chan *c)
 805 {
 806         if (c->channel < HCI_CHANNEL_CONTROL)
 807                 return -EINVAL;
 808
 809         mutex_lock(&mgmt_chan_list_lock);
 810         if (__hci_mgmt_chan_find(c->channel)) {
 811                 mutex_unlock(&mgmt_chan_list_lock);
 812                 return -EALREADY;
 813         }
 814
 815         list_add_tail(&c->list, &mgmt_chan_list);
 816
 817         mutex_unlock(&mgmt_chan_list_lock);
 818
 819         return 0;
 820 }
 821 EXPORT_SYMBOL(hci_mgmt_chan_register);
 822
 823 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c)
 824 {
 825         mutex_lock(&mgmt_chan_list_lock);
 826         list_del(&c->list);
 827         mutex_unlock(&mgmt_chan_list_lock);
 828 }
 829 EXPORT_SYMBOL(hci_mgmt_chan_unregister);
 830
 831 static int hci_sock_release(struct socket *sock)
 832 {
 833         struct sock *sk = sock->sk;
 834         struct hci_dev *hdev;
 835         struct sk_buff *skb;
 836
 837         BT_DBG("sock %p sk %p", sock, sk);
 838
 839         if (!sk)
 840                 return 0;
 841
 842         lock_sock(sk);
 843
 844         switch (hci_pi(sk)->channel) {
 845         case HCI_CHANNEL_MONITOR:
 846                 atomic_dec(&monitor_promisc);
 847                 break;
 848         case HCI_CHANNEL_RAW:
 849         case HCI_CHANNEL_USER:
 850         case HCI_CHANNEL_CONTROL:
 851                 /* Send event to monitor */
 852                 skb = create_monitor_ctrl_close(sk);
 853                 if (skb) {
 854                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 855                                             HCI_SOCK_TRUSTED, NULL);
 856                         kfree_skb(skb);
 857                 }
 858
 859                 hci_sock_free_cookie(sk);
 860                 break;
 861         }
 862
 863         bt_sock_unlink(&hci_sk_list, sk);
 864
 865         hdev = hci_pi(sk)->hdev;
 866         if (hdev) {
 867                 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
 868                         /* When releasing a user channel exclusive access,
 869                          * call hci_dev_do_close directly instead of calling
 870                          * hci_dev_close to ensure the exclusive access will
 871                          * be released and the controller brought back down.
 872                          *
 873                          * The checking of HCI_AUTO_OFF is not needed in this
 874                          * case since it will have been cleared already when
 875                          * opening the user channel.
 876                          */
 877                         hci_dev_do_close(hdev);
 878                         hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
 879                         mgmt_index_added(hdev);
 880                 }
 881
 882                 atomic_dec(&hdev->promisc);
 883                 hci_dev_put(hdev);
 884         }
 885
 886         sock_orphan(sk);
 887
 888         skb_queue_purge(&sk->sk_receive_queue);
 889         skb_queue_purge(&sk->sk_write_queue);
 890
 891         release_sock(sk);
 892         sock_put(sk);
 893         return 0;
 894 }
 895
 896 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 897 {
 898         bdaddr_t bdaddr;
 899         int err;
 900
 901         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
 902                 return -EFAULT;
 903
 904         hci_dev_lock(hdev);
 905
 906         err = hci_bdaddr_list_add(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
 907
 908         hci_dev_unlock(hdev);
 909
 910         return err;
 911 }
 912
 913 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 914 {
 915         bdaddr_t bdaddr;
 916         int err;
 917
 918         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
 919                 return -EFAULT;
 920
 921         hci_dev_lock(hdev);
 922
 923         err = hci_bdaddr_list_del(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
 924
 925         hci_dev_unlock(hdev);
 926
 927         return err;
 928 }
 929
 930 /* Ioctls that require bound socket */
 931 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
 932                                 unsigned long arg)
 933 {
 934         struct hci_dev *hdev = hci_pi(sk)->hdev;
 935
 936         if (!hdev)
 937                 return -EBADFD;
 938
 939         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
 940                 return -EBUSY;
 941
 942         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
 943                 return -EOPNOTSUPP;
 944
 945         if (hdev->dev_type != HCI_PRIMARY)
 946                 return -EOPNOTSUPP;
 947
 948         switch (cmd) {
 949         case HCISETRAW:
 950                 if (!capable(CAP_NET_ADMIN))
 951                         return -EPERM;
 952                 return -EOPNOTSUPP;
 953
 954         case HCIGETCONNINFO:
 955                 return hci_get_conn_info(hdev, (void __user *)arg);
 956
 957         case HCIGETAUTHINFO:
 958                 return hci_get_auth_info(hdev, (void __user *)arg);
 959
 960         case HCIBLOCKADDR:
 961                 if (!capable(CAP_NET_ADMIN))
 962                         return -EPERM;
 963                 return hci_sock_blacklist_add(hdev, (void __user *)arg);
 964
 965         case HCIUNBLOCKADDR:
 966                 if (!capable(CAP_NET_ADMIN))
 967                         return -EPERM;
 968                 return hci_sock_blacklist_del(hdev, (void __user *)arg);
 969         }
 970
 971         return -ENOIOCTLCMD;
 972 }
 973
 974 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
 975                           unsigned long arg)
 976 {
 977         void __user *argp = (void __user *)arg;
 978         struct sock *sk = sock->sk;
 979         int err;
 980
 981         BT_DBG("cmd %x arg %lx", cmd, arg);
 982
 983         lock_sock(sk);
 984
 985         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
 986                 err = -EBADFD;
 987                 goto done;
 988         }
 989
 990         /* When calling an ioctl on an unbound raw socket, then ensure
 991          * that the monitor gets informed. Ensure that the resulting event
 992          * is only send once by checking if the cookie exists or not. The
 993          * socket cookie will be only ever generated once for the lifetime
 994          * of a given socket.
 995          */
 996         if (hci_sock_gen_cookie(sk)) {
 997                 struct sk_buff *skb;
 998
 999                 if (capable(CAP_NET_ADMIN))
1000                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1001
1002                 /* Send event to monitor */
1003                 skb = create_monitor_ctrl_open(sk);
1004                 if (skb) {
1005                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1006                                             HCI_SOCK_TRUSTED, NULL);
1007                         kfree_skb(skb);
1008                 }
1009         }
1010
1011         release_sock(sk);
1012
1013         switch (cmd) {
1014         case HCIGETDEVLIST:
1015                 return hci_get_dev_list(argp);
1016
1017         case HCIGETDEVINFO:
1018                 return hci_get_dev_info(argp);
1019
1020         case HCIGETCONNLIST:
1021                 return hci_get_conn_list(argp);
1022
1023         case HCIDEVUP:
1024                 if (!capable(CAP_NET_ADMIN))
1025                         return -EPERM;
1026                 return hci_dev_open(arg);
1027
1028         case HCIDEVDOWN:
1029                 if (!capable(CAP_NET_ADMIN))
1030                         return -EPERM;
1031                 return hci_dev_close(arg);
1032
1033         case HCIDEVRESET:
1034                 if (!capable(CAP_NET_ADMIN))
1035                         return -EPERM;
1036                 return hci_dev_reset(arg);
1037
1038         case HCIDEVRESTAT:
1039                 if (!capable(CAP_NET_ADMIN))
1040                         return -EPERM;
1041                 return hci_dev_reset_stat(arg);
1042
1043         case HCISETSCAN:
1044         case HCISETAUTH:
1045         case HCISETENCRYPT:
1046         case HCISETPTYPE:
1047         case HCISETLINKPOL:
1048         case HCISETLINKMODE:
1049         case HCISETACLMTU:
1050         case HCISETSCOMTU:
1051                 if (!capable(CAP_NET_ADMIN))
1052                         return -EPERM;
1053                 return hci_dev_cmd(cmd, argp);
1054
1055         case HCIINQUIRY:
1056                 return hci_inquiry(argp);
1057         }
1058
1059         lock_sock(sk);
1060
1061         err = hci_sock_bound_ioctl(sk, cmd, arg);
1062
1063 done:
1064         release_sock(sk);
1065         return err;
1066 }
1067
1068 #ifdef CONFIG_COMPAT
1069 static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd,
1070                                  unsigned long arg)
1071 {
1072         switch (cmd) {
1073         case HCIDEVUP:
1074         case HCIDEVDOWN:
1075         case HCIDEVRESET:
1076         case HCIDEVRESTAT:
1077                 return hci_sock_ioctl(sock, cmd, arg);
1078         }
1079
1080         return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg));
1081 }
1082 #endif
1083
1084 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
1085                          int addr_len)
1086 {
1087         struct sockaddr_hci haddr;
1088         struct sock *sk = sock->sk;
1089         struct hci_dev *hdev = NULL;
1090         struct sk_buff *skb;
1091         int len, err = 0;
1092
1093         BT_DBG("sock %p sk %p", sock, sk);
1094
1095         if (!addr)
1096                 return -EINVAL;
1097
1098         memset(&haddr, 0, sizeof(haddr));
1099         len = min_t(unsigned int, sizeof(haddr), addr_len);
1100         memcpy(&haddr, addr, len);
1101
1102         if (haddr.hci_family != AF_BLUETOOTH)
1103                 return -EINVAL;
1104
1105         lock_sock(sk);
1106
1107         if (sk->sk_state == BT_BOUND) {
1108                 err = -EALREADY;
1109                 goto done;
1110         }
1111
1112         switch (haddr.hci_channel) {
1113         case HCI_CHANNEL_RAW:
1114                 if (hci_pi(sk)->hdev) {
1115                         err = -EALREADY;
1116                         goto done;
1117                 }
1118
1119                 if (haddr.hci_dev != HCI_DEV_NONE) {
1120                         hdev = hci_dev_get(haddr.hci_dev);
1121                         if (!hdev) {
1122                                 err = -ENODEV;
1123                                 goto done;
1124                         }
1125
1126                         atomic_inc(&hdev->promisc);
1127                 }
1128
1129                 hci_pi(sk)->channel = haddr.hci_channel;
1130
1131                 if (!hci_sock_gen_cookie(sk)) {
1132                         /* In the case when a cookie has already been assigned,
1133                          * then there has been already an ioctl issued against
1134                          * an unbound socket and with that triggerd an open
1135                          * notification. Send a close notification first to
1136                          * allow the state transition to bounded.
1137                          */
1138                         skb = create_monitor_ctrl_close(sk);
1139                         if (skb) {
1140                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1141                                                     HCI_SOCK_TRUSTED, NULL);
1142                                 kfree_skb(skb);
1143                         }
1144                 }
1145
1146                 if (capable(CAP_NET_ADMIN))
1147                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1148
1149                 hci_pi(sk)->hdev = hdev;
1150
1151                 /* Send event to monitor */
1152                 skb = create_monitor_ctrl_open(sk);
1153                 if (skb) {
1154                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1155                                             HCI_SOCK_TRUSTED, NULL);
1156                         kfree_skb(skb);
1157                 }
1158                 break;
1159
1160         case HCI_CHANNEL_USER:
1161                 if (hci_pi(sk)->hdev) {
1162                         err = -EALREADY;
1163                         goto done;
1164                 }
1165
1166                 if (haddr.hci_dev == HCI_DEV_NONE) {
1167                         err = -EINVAL;
1168                         goto done;
1169                 }
1170
1171                 if (!capable(CAP_NET_ADMIN)) {
1172                         err = -EPERM;
1173                         goto done;
1174                 }
1175
1176                 hdev = hci_dev_get(haddr.hci_dev);
1177                 if (!hdev) {
1178                         err = -ENODEV;
1179                         goto done;
1180                 }
1181
1182                 if (test_bit(HCI_INIT, &hdev->flags) ||
1183                     hci_dev_test_flag(hdev, HCI_SETUP) ||
1184                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1185                     (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1186                      test_bit(HCI_UP, &hdev->flags))) {
1187                         err = -EBUSY;
1188                         hci_dev_put(hdev);
1189                         goto done;
1190                 }
1191
1192                 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) {
1193                         err = -EUSERS;
1194                         hci_dev_put(hdev);
1195                         goto done;
1196                 }
1197
1198                 mgmt_index_removed(hdev);
1199
1200                 err = hci_dev_open(hdev->id);
1201                 if (err) {
1202                         if (err == -EALREADY) {
1203                                 /* In case the transport is already up and
1204                                  * running, clear the error here.
1205                                  *
1206                                  * This can happen when opening a user
1207                                  * channel and HCI_AUTO_OFF grace period
1208                                  * is still active.
1209                                  */
1210                                 err = 0;
1211                         } else {
1212                                 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
1213                                 mgmt_index_added(hdev);
1214                                 hci_dev_put(hdev);
1215                                 goto done;
1216                         }
1217                 }
1218
1219                 hci_pi(sk)->channel = haddr.hci_channel;
1220
1221                 if (!hci_sock_gen_cookie(sk)) {
1222                         /* In the case when a cookie has already been assigned,
1223                          * this socket will transition from a raw socket into
1224                          * a user channel socket. For a clean transition, send
1225                          * the close notification first.
1226                          */
1227                         skb = create_monitor_ctrl_close(sk);
1228                         if (skb) {
1229                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1230                                                     HCI_SOCK_TRUSTED, NULL);
1231                                 kfree_skb(skb);
1232                         }
1233                 }
1234
1235                 /* The user channel is restricted to CAP_NET_ADMIN
1236                  * capabilities and with that implicitly trusted.
1237                  */
1238                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1239
1240                 hci_pi(sk)->hdev = hdev;
1241
1242                 /* Send event to monitor */
1243                 skb = create_monitor_ctrl_open(sk);
1244                 if (skb) {
1245                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1246                                             HCI_SOCK_TRUSTED, NULL);
1247                         kfree_skb(skb);
1248                 }
1249
1250                 atomic_inc(&hdev->promisc);
1251                 break;
1252
1253         case HCI_CHANNEL_MONITOR:
1254                 if (haddr.hci_dev != HCI_DEV_NONE) {
1255                         err = -EINVAL;
1256                         goto done;
1257                 }
1258
1259                 if (!capable(CAP_NET_RAW)) {
1260                         err = -EPERM;
1261                         goto done;
1262                 }
1263
1264                 hci_pi(sk)->channel = haddr.hci_channel;
1265
1266                 /* The monitor interface is restricted to CAP_NET_RAW
1267                  * capabilities and with that implicitly trusted.
1268                  */
1269                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1270
1271                 send_monitor_note(sk, "Linux version %s (%s)",
1272                                   init_utsname()->release,
1273                                   init_utsname()->machine);
1274                 send_monitor_note(sk, "Bluetooth subsystem version %u.%u",
1275                                   BT_SUBSYS_VERSION, BT_SUBSYS_REVISION);
1276                 send_monitor_replay(sk);
1277                 send_monitor_control_replay(sk);
1278
1279                 atomic_inc(&monitor_promisc);
1280                 break;
1281
1282         case HCI_CHANNEL_LOGGING:
1283                 if (haddr.hci_dev != HCI_DEV_NONE) {
1284                         err = -EINVAL;
1285                         goto done;
1286                 }
1287
1288                 if (!capable(CAP_NET_ADMIN)) {
1289                         err = -EPERM;
1290                         goto done;
1291                 }
1292
1293                 hci_pi(sk)->channel = haddr.hci_channel;
1294                 break;
1295
1296         default:
1297                 if (!hci_mgmt_chan_find(haddr.hci_channel)) {
1298                         err = -EINVAL;
1299                         goto done;
1300                 }
1301
1302                 if (haddr.hci_dev != HCI_DEV_NONE) {
1303                         err = -EINVAL;
1304                         goto done;
1305                 }
1306
1307                 /* Users with CAP_NET_ADMIN capabilities are allowed
1308                  * access to all management commands and events. For
1309                  * untrusted users the interface is restricted and
1310                  * also only untrusted events are sent.
1311                  */
1312                 if (capable(CAP_NET_ADMIN))
1313                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1314
1315                 hci_pi(sk)->channel = haddr.hci_channel;
1316
1317                 /* At the moment the index and unconfigured index events
1318                  * are enabled unconditionally. Setting them on each
1319                  * socket when binding keeps this functionality. They
1320                  * however might be cleared later and then sending of these
1321                  * events will be disabled, but that is then intentional.
1322                  *
1323                  * This also enables generic events that are safe to be
1324                  * received by untrusted users. Example for such events
1325                  * are changes to settings, class of device, name etc.
1326                  */
1327                 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) {
1328                         if (!hci_sock_gen_cookie(sk)) {
1329                                 /* In the case when a cookie has already been
1330                                  * assigned, this socket will transtion from
1331                                  * a raw socket into a control socket. To
1332                                  * allow for a clean transtion, send the
1333                                  * close notification first.
1334                                  */
1335                                 skb = create_monitor_ctrl_close(sk);
1336                                 if (skb) {
1337                                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1338                                                             HCI_SOCK_TRUSTED, NULL);
1339                                         kfree_skb(skb);
1340                                 }
1341                         }
1342
1343                         /* Send event to monitor */
1344                         skb = create_monitor_ctrl_open(sk);
1345                         if (skb) {
1346                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1347                                                     HCI_SOCK_TRUSTED, NULL);
1348                                 kfree_skb(skb);
1349                         }
1350
1351                         hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS);
1352                         hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
1353                         hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS);
1354                         hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS);
1355                         hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1356                         hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1357                 }
1358                 break;
1359         }
1360
1361         sk->sk_state = BT_BOUND;
1362
1363 done:
1364         release_sock(sk);
1365         return err;
1366 }
1367
1368 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
1369                             int peer)
1370 {
1371         struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr;
1372         struct sock *sk = sock->sk;
1373         struct hci_dev *hdev;
1374         int err = 0;
1375
1376         BT_DBG("sock %p sk %p", sock, sk);
1377
1378         if (peer)
1379                 return -EOPNOTSUPP;
1380
1381         lock_sock(sk);
1382
1383         hdev = hci_pi(sk)->hdev;
1384         if (!hdev) {
1385                 err = -EBADFD;
1386                 goto done;
1387         }
1388
1389         haddr->hci_family = AF_BLUETOOTH;
1390         haddr->hci_dev    = hdev->id;
1391         haddr->hci_channel= hci_pi(sk)->channel;
1392         err = sizeof(*haddr);
1393
1394 done:
1395         release_sock(sk);
1396         return err;
1397 }
1398
1399 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
1400                           struct sk_buff *skb)
1401 {
1402         __u32 mask = hci_pi(sk)->cmsg_mask;
1403
1404         if (mask & HCI_CMSG_DIR) {
1405                 int incoming = bt_cb(skb)->incoming;
1406                 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
1407                          &incoming);
1408         }
1409
1410         if (mask & HCI_CMSG_TSTAMP) {
1411 #ifdef CONFIG_COMPAT
1412                 struct old_timeval32 ctv;
1413 #endif
1414                 struct __kernel_old_timeval tv;
1415                 void *data;
1416                 int len;
1417
1418                 skb_get_timestamp(skb, &tv);
1419
1420                 data = &tv;
1421                 len = sizeof(tv);
1422 #ifdef CONFIG_COMPAT
1423                 if (!COMPAT_USE_64BIT_TIME &&
1424                     (msg->msg_flags & MSG_CMSG_COMPAT)) {
1425                         ctv.tv_sec = tv.tv_sec;
1426                         ctv.tv_usec = tv.tv_usec;
1427                         data = &ctv;
1428                         len = sizeof(ctv);
1429                 }
1430 #endif
1431
1432                 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
1433         }
1434 }
1435
1436 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1437                             size_t len, int flags)
1438 {
1439         int noblock = flags & MSG_DONTWAIT;
1440         struct sock *sk = sock->sk;
1441         struct sk_buff *skb;
1442         int copied, err;
1443         unsigned int skblen;
1444
1445         BT_DBG("sock %p, sk %p", sock, sk);
1446
1447         if (flags & MSG_OOB)
1448                 return -EOPNOTSUPP;
1449
1450         if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING)
1451                 return -EOPNOTSUPP;
1452
1453         if (sk->sk_state == BT_CLOSED)
1454                 return 0;
1455
1456         skb = skb_recv_datagram(sk, flags, noblock, &err);
1457         if (!skb)
1458                 return err;
1459
1460         skblen = skb->len;
1461         copied = skb->len;
1462         if (len < copied) {
1463                 msg->msg_flags |= MSG_TRUNC;
1464                 copied = len;
1465         }
1466
1467         skb_reset_transport_header(skb);
1468         err = skb_copy_datagram_msg(skb, 0, msg, copied);
1469
1470         switch (hci_pi(sk)->channel) {
1471         case HCI_CHANNEL_RAW:
1472                 hci_sock_cmsg(sk, msg, skb);
1473                 break;
1474         case HCI_CHANNEL_USER:
1475         case HCI_CHANNEL_MONITOR:
1476                 sock_recv_timestamp(msg, sk, skb);
1477                 break;
1478         default:
1479                 if (hci_mgmt_chan_find(hci_pi(sk)->channel))
1480                         sock_recv_timestamp(msg, sk, skb);
1481                 break;
1482         }
1483
1484         skb_free_datagram(sk, skb);
1485
1486         if (flags & MSG_TRUNC)
1487                 copied = skblen;
1488
1489         return err ? : copied;
1490 }
1491
1492 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
1493                         struct msghdr *msg, size_t msglen)
1494 {
1495         void *buf;
1496         u8 *cp;
1497         struct mgmt_hdr *hdr;
1498         u16 opcode, index, len;
1499         struct hci_dev *hdev = NULL;
1500         const struct hci_mgmt_handler *handler;
1501         bool var_len, no_hdev;
1502         int err;
1503
1504         BT_DBG("got %zu bytes", msglen);
1505
1506         if (msglen < sizeof(*hdr))
1507                 return -EINVAL;
1508
1509         buf = kmalloc(msglen, GFP_KERNEL);
1510         if (!buf)
1511                 return -ENOMEM;
1512
1513         if (memcpy_from_msg(buf, msg, msglen)) {
1514                 err = -EFAULT;
1515                 goto done;
1516         }
1517
1518         hdr = buf;
1519         opcode = __le16_to_cpu(hdr->opcode);
1520         index = __le16_to_cpu(hdr->index);
1521         len = __le16_to_cpu(hdr->len);
1522
1523         if (len != msglen - sizeof(*hdr)) {
1524                 err = -EINVAL;
1525                 goto done;
1526         }
1527
1528         if (chan->channel == HCI_CHANNEL_CONTROL) {
1529                 struct sk_buff *skb;
1530
1531                 /* Send event to monitor */
1532                 skb = create_monitor_ctrl_command(sk, index, opcode, len,
1533                                                   buf + sizeof(*hdr));
1534                 if (skb) {
1535                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1536                                             HCI_SOCK_TRUSTED, NULL);
1537                         kfree_skb(skb);
1538                 }
1539         }
1540
1541         if (opcode >= chan->handler_count ||
1542             chan->handlers[opcode].func == NULL) {
1543                 BT_DBG("Unknown op %u", opcode);
1544                 err = mgmt_cmd_status(sk, index, opcode,
1545                                       MGMT_STATUS_UNKNOWN_COMMAND);
1546                 goto done;
1547         }
1548
1549         handler = &chan->handlers[opcode];
1550
1551         if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
1552             !(handler->flags & HCI_MGMT_UNTRUSTED)) {
1553                 err = mgmt_cmd_status(sk, index, opcode,
1554                                       MGMT_STATUS_PERMISSION_DENIED);
1555                 goto done;
1556         }
1557
1558         if (index != MGMT_INDEX_NONE) {
1559                 hdev = hci_dev_get(index);
1560                 if (!hdev) {
1561                         err = mgmt_cmd_status(sk, index, opcode,
1562                                               MGMT_STATUS_INVALID_INDEX);
1563                         goto done;
1564                 }
1565
1566                 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1567                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1568                     hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1569                         err = mgmt_cmd_status(sk, index, opcode,
1570                                               MGMT_STATUS_INVALID_INDEX);
1571                         goto done;
1572                 }
1573
1574                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1575                     !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
1576                         err = mgmt_cmd_status(sk, index, opcode,
1577                                               MGMT_STATUS_INVALID_INDEX);
1578                         goto done;
1579                 }
1580         }
1581
1582         no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1583         if (no_hdev != !hdev) {
1584                 err = mgmt_cmd_status(sk, index, opcode,
1585                                       MGMT_STATUS_INVALID_INDEX);
1586                 goto done;
1587         }
1588
1589         var_len = (handler->flags & HCI_MGMT_VAR_LEN);
1590         if ((var_len && len < handler->data_len) ||
1591             (!var_len && len != handler->data_len)) {
1592                 err = mgmt_cmd_status(sk, index, opcode,
1593                                       MGMT_STATUS_INVALID_PARAMS);
1594                 goto done;
1595         }
1596
1597         if (hdev && chan->hdev_init)
1598                 chan->hdev_init(sk, hdev);
1599
1600         cp = buf + sizeof(*hdr);
1601
1602         err = handler->func(sk, hdev, cp, len);
1603         if (err < 0)
1604                 goto done;
1605
1606         err = msglen;
1607
1608 done:
1609         if (hdev)
1610                 hci_dev_put(hdev);
1611
1612         kfree(buf);
1613         return err;
1614 }
1615
1616 static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len)
1617 {
1618         struct hci_mon_hdr *hdr;
1619         struct sk_buff *skb;
1620         struct hci_dev *hdev;
1621         u16 index;
1622         int err;
1623
1624         /* The logging frame consists at minimum of the standard header,
1625          * the priority byte, the ident length byte and at least one string
1626          * terminator NUL byte. Anything shorter are invalid packets.
1627          */
1628         if (len < sizeof(*hdr) + 3)
1629                 return -EINVAL;
1630
1631         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1632         if (!skb)
1633                 return err;
1634
1635         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1636                 err = -EFAULT;
1637                 goto drop;
1638         }
1639
1640         hdr = (void *)skb->data;
1641
1642         if (__le16_to_cpu(hdr->len) != len - sizeof(*hdr)) {
1643                 err = -EINVAL;
1644                 goto drop;
1645         }
1646
1647         if (__le16_to_cpu(hdr->opcode) == 0x0000) {
1648                 __u8 priority = skb->data[sizeof(*hdr)];
1649                 __u8 ident_len = skb->data[sizeof(*hdr) + 1];
1650
1651                 /* Only the priorities 0-7 are valid and with that any other
1652                  * value results in an invalid packet.
1653                  *
1654                  * The priority byte is followed by an ident length byte and
1655                  * the NUL terminated ident string. Check that the ident
1656                  * length is not overflowing the packet and also that the
1657                  * ident string itself is NUL terminated. In case the ident
1658                  * length is zero, the length value actually doubles as NUL
1659                  * terminator identifier.
1660                  *
1661                  * The message follows the ident string (if present) and
1662                  * must be NUL terminated. Otherwise it is not a valid packet.
1663                  */
1664                 if (priority > 7 || skb->data[len - 1] != 0x00 ||
1665                     ident_len > len - sizeof(*hdr) - 3 ||
1666                     skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) {
1667                         err = -EINVAL;
1668                         goto drop;
1669                 }
1670         } else {
1671                 err = -EINVAL;
1672                 goto drop;
1673         }
1674
1675         index = __le16_to_cpu(hdr->index);
1676
1677         if (index != MGMT_INDEX_NONE) {
1678                 hdev = hci_dev_get(index);
1679                 if (!hdev) {
1680                         err = -ENODEV;
1681                         goto drop;
1682                 }
1683         } else {
1684                 hdev = NULL;
1685         }
1686
1687         hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING);
1688
1689         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL);
1690         err = len;
1691
1692         if (hdev)
1693                 hci_dev_put(hdev);
1694
1695 drop:
1696         kfree_skb(skb);
1697         return err;
1698 }
1699
1700 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1701                             size_t len)
1702 {
1703         struct sock *sk = sock->sk;
1704         struct hci_mgmt_chan *chan;
1705         struct hci_dev *hdev;
1706         struct sk_buff *skb;
1707         int err;
1708
1709         BT_DBG("sock %p sk %p", sock, sk);
1710
1711         if (msg->msg_flags & MSG_OOB)
1712                 return -EOPNOTSUPP;
1713
1714         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|
1715                                MSG_CMSG_COMPAT))
1716                 return -EINVAL;
1717
1718         if (len < 4 || len > HCI_MAX_FRAME_SIZE)
1719                 return -EINVAL;
1720
1721         lock_sock(sk);
1722
1723         switch (hci_pi(sk)->channel) {
1724         case HCI_CHANNEL_RAW:
1725         case HCI_CHANNEL_USER:
1726                 break;
1727         case HCI_CHANNEL_MONITOR:
1728                 err = -EOPNOTSUPP;
1729                 goto done;
1730         case HCI_CHANNEL_LOGGING:
1731                 err = hci_logging_frame(sk, msg, len);
1732                 goto done;
1733         default:
1734                 mutex_lock(&mgmt_chan_list_lock);
1735                 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);
1736                 if (chan)
1737                         err = hci_mgmt_cmd(chan, sk, msg, len);
1738                 else
1739                         err = -EINVAL;
1740
1741                 mutex_unlock(&mgmt_chan_list_lock);
1742                 goto done;
1743         }
1744
1745         hdev = hci_pi(sk)->hdev;
1746         if (!hdev) {
1747                 err = -EBADFD;
1748                 goto done;
1749         }
1750
1751         if (!test_bit(HCI_UP, &hdev->flags)) {
1752                 err = -ENETDOWN;
1753                 goto done;
1754         }
1755
1756         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1757         if (!skb)
1758                 goto done;
1759
1760         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1761                 err = -EFAULT;
1762                 goto drop;
1763         }
1764
1765         hci_skb_pkt_type(skb) = skb->data[0];
1766         skb_pull(skb, 1);
1767
1768         if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
1769                 /* No permission check is needed for user channel
1770                  * since that gets enforced when binding the socket.
1771                  *
1772                  * However check that the packet type is valid.
1773                  */
1774                 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
1775                     hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1776                     hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
1777                     hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
1778                         err = -EINVAL;
1779                         goto drop;
1780                 }
1781
1782                 skb_queue_tail(&hdev->raw_q, skb);
1783                 queue_work(hdev->workqueue, &hdev->tx_work);
1784         } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) {
1785                 u16 opcode = get_unaligned_le16(skb->data);
1786                 u16 ogf = hci_opcode_ogf(opcode);
1787                 u16 ocf = hci_opcode_ocf(opcode);
1788
1789                 if (((ogf > HCI_SFLT_MAX_OGF) ||
1790                      !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
1791                                    &hci_sec_filter.ocf_mask[ogf])) &&
1792                     !capable(CAP_NET_RAW)) {
1793                         err = -EPERM;
1794                         goto drop;
1795                 }
1796
1797                 /* Since the opcode has already been extracted here, store
1798                  * a copy of the value for later use by the drivers.
1799                  */
1800                 hci_skb_opcode(skb) = opcode;
1801
1802                 if (ogf == 0x3f) {
1803                         skb_queue_tail(&hdev->raw_q, skb);
1804                         queue_work(hdev->workqueue, &hdev->tx_work);
1805                 } else {
1806                         /* Stand-alone HCI commands must be flagged as
1807                          * single-command requests.
1808                          */
1809                         bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
1810
1811                         skb_queue_tail(&hdev->cmd_q, skb);
1812                         queue_work(hdev->workqueue, &hdev->cmd_work);
1813                 }
1814         } else {
1815                 if (!capable(CAP_NET_RAW)) {
1816                         err = -EPERM;
1817                         goto drop;
1818                 }
1819
1820                 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1821                     hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
1822                     hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
1823                         err = -EINVAL;
1824                         goto drop;
1825                 }
1826
1827                 skb_queue_tail(&hdev->raw_q, skb);
1828                 queue_work(hdev->workqueue, &hdev->tx_work);
1829         }
1830
1831         err = len;
1832
1833 done:
1834         release_sock(sk);
1835         return err;
1836
1837 drop:
1838         kfree_skb(skb);
1839         goto done;
1840 }
1841
1842 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
1843                                char __user *optval, unsigned int len)
1844 {
1845         struct hci_ufilter uf = { .opcode = 0 };
1846         struct sock *sk = sock->sk;
1847         int err = 0, opt = 0;
1848
1849         BT_DBG("sk %p, opt %d", sk, optname);
1850
1851         if (level != SOL_HCI)
1852                 return -ENOPROTOOPT;
1853
1854         lock_sock(sk);
1855
1856         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1857                 err = -EBADFD;
1858                 goto done;
1859         }
1860
1861         switch (optname) {
1862         case HCI_DATA_DIR:
1863                 if (get_user(opt, (int __user *)optval)) {
1864                         err = -EFAULT;
1865                         break;
1866                 }
1867
1868                 if (opt)
1869                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
1870                 else
1871                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
1872                 break;
1873
1874         case HCI_TIME_STAMP:
1875                 if (get_user(opt, (int __user *)optval)) {
1876                         err = -EFAULT;
1877                         break;
1878                 }
1879
1880                 if (opt)
1881                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
1882                 else
1883                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
1884                 break;
1885
1886         case HCI_FILTER:
1887                 {
1888                         struct hci_filter *f = &hci_pi(sk)->filter;
1889
1890                         uf.type_mask = f->type_mask;
1891                         uf.opcode    = f->opcode;
1892                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1893                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1894                 }
1895
1896                 len = min_t(unsigned int, len, sizeof(uf));
1897                 if (copy_from_user(&uf, optval, len)) {
1898                         err = -EFAULT;
1899                         break;
1900                 }
1901
1902                 if (!capable(CAP_NET_RAW)) {
1903                         uf.type_mask &= hci_sec_filter.type_mask;
1904                         uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
1905                         uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
1906                 }
1907
1908                 {
1909                         struct hci_filter *f = &hci_pi(sk)->filter;
1910
1911                         f->type_mask = uf.type_mask;
1912                         f->opcode    = uf.opcode;
1913                         *((u32 *) f->event_mask + 0) = uf.event_mask[0];
1914                         *((u32 *) f->event_mask + 1) = uf.event_mask[1];
1915                 }
1916                 break;
1917
1918         default:
1919                 err = -ENOPROTOOPT;
1920                 break;
1921         }
1922
1923 done:
1924         release_sock(sk);
1925         return err;
1926 }
1927
1928 static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
1929                                char __user *optval, int __user *optlen)
1930 {
1931         struct hci_ufilter uf;
1932         struct sock *sk = sock->sk;
1933         int len, opt, err = 0;
1934
1935         BT_DBG("sk %p, opt %d", sk, optname);
1936
1937         if (level != SOL_HCI)
1938                 return -ENOPROTOOPT;
1939
1940         if (get_user(len, optlen))
1941                 return -EFAULT;
1942
1943         lock_sock(sk);
1944
1945         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1946                 err = -EBADFD;
1947                 goto done;
1948         }
1949
1950         switch (optname) {
1951         case HCI_DATA_DIR:
1952                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
1953                         opt = 1;
1954                 else
1955                         opt = 0;
1956
1957                 if (put_user(opt, optval))
1958                         err = -EFAULT;
1959                 break;
1960
1961         case HCI_TIME_STAMP:
1962                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
1963                         opt = 1;
1964                 else
1965                         opt = 0;
1966
1967                 if (put_user(opt, optval))
1968                         err = -EFAULT;
1969                 break;
1970
1971         case HCI_FILTER:
1972                 {
1973                         struct hci_filter *f = &hci_pi(sk)->filter;
1974
1975                         memset(&uf, 0, sizeof(uf));
1976                         uf.type_mask = f->type_mask;
1977                         uf.opcode    = f->opcode;
1978                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1979                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1980                 }
1981
1982                 len = min_t(unsigned int, len, sizeof(uf));
1983                 if (copy_to_user(optval, &uf, len))
1984                         err = -EFAULT;
1985                 break;
1986
1987         default:
1988                 err = -ENOPROTOOPT;
1989                 break;
1990         }
1991
1992 done:
1993         release_sock(sk);
1994         return err;
1995 }
1996
1997 static const struct proto_ops hci_sock_ops = {
1998         .family         = PF_BLUETOOTH,
1999         .owner          = THIS_MODULE,
2000         .release        = hci_sock_release,
2001         .bind           = hci_sock_bind,
2002         .getname        = hci_sock_getname,
2003         .sendmsg        = hci_sock_sendmsg,
2004         .recvmsg        = hci_sock_recvmsg,
2005         .ioctl          = hci_sock_ioctl,
2006 #ifdef CONFIG_COMPAT
2007         .compat_ioctl   = hci_sock_compat_ioctl,
2008 #endif
2009         .poll           = datagram_poll,
2010         .listen         = sock_no_listen,
2011         .shutdown       = sock_no_shutdown,
2012         .setsockopt     = hci_sock_setsockopt,
2013         .getsockopt     = hci_sock_getsockopt,
2014         .connect        = sock_no_connect,
2015         .socketpair     = sock_no_socketpair,
2016         .accept         = sock_no_accept,
2017         .mmap           = sock_no_mmap
2018 };
2019
2020 static struct proto hci_sk_proto = {
2021         .name           = "HCI",
2022         .owner          = THIS_MODULE,
2023         .obj_size       = sizeof(struct hci_pinfo)
2024 };
2025
2026 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
2027                            int kern)
2028 {
2029         struct sock *sk;
2030
2031         BT_DBG("sock %p", sock);
2032
2033         if (sock->type != SOCK_RAW)
2034                 return -ESOCKTNOSUPPORT;
2035
2036         sock->ops = &hci_sock_ops;
2037
2038         sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern);
2039         if (!sk)
2040                 return -ENOMEM;
2041
2042         sock_init_data(sock, sk);
2043
2044         sock_reset_flag(sk, SOCK_ZAPPED);
2045
2046         sk->sk_protocol = protocol;
2047
2048         sock->state = SS_UNCONNECTED;
2049         sk->sk_state = BT_OPEN;
2050
2051         bt_sock_link(&hci_sk_list, sk);
2052         return 0;
2053 }
2054
2055 static const struct net_proto_family hci_sock_family_ops = {
2056         .family = PF_BLUETOOTH,
2057         .owner  = THIS_MODULE,
2058         .create = hci_sock_create,
2059 };
2060
2061 int __init hci_sock_init(void)
2062 {
2063         int err;
2064
2065         BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr));
2066
2067         err = proto_register(&hci_sk_proto, 0);
2068         if (err < 0)
2069                 return err;
2070
2071         err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
2072         if (err < 0) {
2073                 BT_ERR("HCI socket registration failed");
2074                 goto error;
2075         }
2076
2077         err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL);
2078         if (err < 0) {
2079                 BT_ERR("Failed to create HCI proc file");
2080                 bt_sock_unregister(BTPROTO_HCI);
2081                 goto error;
2082         }
2083
2084         BT_INFO("HCI socket layer initialized");
2085
2086         return 0;
2087
2088 error:
2089         proto_unregister(&hci_sk_proto);
2090         return err;
2091 }
2092
2093 void hci_sock_cleanup(void)
2094 {
2095         bt_procfs_cleanup(&init_net, "hci");
2096         bt_sock_unregister(BTPROTO_HCI);
2097         proto_unregister(&hci_sk_proto);
2098 }