[deliverable/linux.git] / net / bluetooth / hci_sock.c

/*
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI sockets. */

#include <linux/module.h>

#include <linux/types.h>
#include <linux/capability.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/workqueue.h>
#include <linux/interrupt.h>
#include <linux/compat.h>
#include <linux/socket.h>
#include <linux/ioctl.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

/* ----- HCI socket interface ----- */

static inline int hci_test_bit(int nr, void *addr)
{
	return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
}

/* Security filter */
static struct hci_sec_filter hci_sec_filter = {
	/* Packet types */
	0x10,
	/* Events */
	{ 0x1000d9fe, 0x0000b00c },
	/* Commands */
	{
		{ 0x0 },
		/* OGF_LINK_CTL */
		{ 0xbe000006, 0x00000001, 0x00000000, 0x00 },
		/* OGF_LINK_POLICY */
		{ 0x00005200, 0x00000000, 0x00000000, 0x00 },
		/* OGF_HOST_CTL */
		{ 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
		/* OGF_INFO_PARAM */
		{ 0x000002be, 0x00000000, 0x00000000, 0x00 },
		/* OGF_STATUS_PARAM */
		{ 0x000000ea, 0x00000000, 0x00000000, 0x00 }
	}
};

static struct bt_sock_list hci_sk_list = {
	.lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
};

/* Send frame to RAW socket */
void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct sock *sk;
	struct hlist_node *node;

	BT_DBG("hdev %p len %d", hdev, skb->len);

	read_lock(&hci_sk_list.lock);
	sk_for_each(sk, node, &hci_sk_list.head) {
		struct hci_filter *flt;
		struct sk_buff *nskb;

		if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
			continue;

		/* Don't send frame to the socket it came from */
		if (skb->sk == sk)
			continue;

		/* Apply filter */
		flt = &hci_pi(sk)->filter;

		if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
				0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
			continue;

		if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
			register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);

			if (!hci_test_bit(evt, &flt->event_mask))
				continue;

			if (flt->opcode &&
			    ((evt == HCI_EV_CMD_COMPLETE &&
			      flt->opcode !=
			      get_unaligned((__le16 *)(skb->data + 3))) ||
			     (evt == HCI_EV_CMD_STATUS &&
			      flt->opcode !=
			      get_unaligned((__le16 *)(skb->data + 4)))))
				continue;
		}

		if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
			continue;

		/* Put type byte before the data */
		memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);

		if (sock_queue_rcv_skb(sk, nskb))
			kfree_skb(nskb);
	}
	read_unlock(&hci_sk_list.lock);
}

static int hci_sock_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!sk)
		return 0;

	hdev = hci_pi(sk)->hdev;

	bt_sock_unlink(&hci_sk_list, sk);

	if (hdev) {
		atomic_dec(&hdev->promisc);
		hci_dev_put(hdev);
	}

	sock_orphan(sk);

	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);

	sock_put(sk);
	return 0;
}

struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct list_head *p;
	struct bdaddr_list *blacklist = &hdev->blacklist;

	list_for_each(p, &blacklist->list) {
		struct bdaddr_list *b;

		b = list_entry(p, struct bdaddr_list, list);

		if (bacmp(bdaddr, &b->bdaddr) == 0)
			return b;
	}

	return NULL;
}

static int hci_blacklist_add(struct hci_dev *hdev, void __user *arg)
{
	bdaddr_t bdaddr;
	struct bdaddr_list *entry;

	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
		return -EFAULT;

	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
		return -EBADF;

	if (hci_blacklist_lookup(hdev, &bdaddr))
		return -EEXIST;

	entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
	if (!entry)
		return -ENOMEM;

	bacpy(&entry->bdaddr, &bdaddr);

	list_add(&entry->list, &hdev->blacklist.list);

	return 0;
}

int hci_blacklist_clear(struct hci_dev *hdev)
{
	struct list_head *p, *n;
	struct bdaddr_list *blacklist = &hdev->blacklist;

	list_for_each_safe(p, n, &blacklist->list) {
		struct bdaddr_list *b;

		b = list_entry(p, struct bdaddr_list, list);

		list_del(p);
		kfree(b);
	}

	return 0;
}

static int hci_blacklist_del(struct hci_dev *hdev, void __user *arg)
{
	bdaddr_t bdaddr;
	struct bdaddr_list *entry;

	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
		return -EFAULT;

	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
		return hci_blacklist_clear(hdev);

	entry = hci_blacklist_lookup(hdev, &bdaddr);
	if (!entry)
		return -ENOENT;

	list_del(&entry->list);
	kfree(entry);

	return 0;
}

/* Ioctls that require bound socket */
static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
{
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	if (!hdev)
		return -EBADFD;

	switch (cmd) {
	case HCISETRAW:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;

		if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
			return -EPERM;

		if (arg)
			set_bit(HCI_RAW, &hdev->flags);
		else
			clear_bit(HCI_RAW, &hdev->flags);

		return 0;

	case HCIGETCONNINFO:
		return hci_get_conn_info(hdev, (void __user *) arg);

	case HCIGETAUTHINFO:
		return hci_get_auth_info(hdev, (void __user *) arg);

	case HCIBLOCKADDR:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_blacklist_add(hdev, (void __user *) arg);

	case HCIUNBLOCKADDR:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_blacklist_del(hdev, (void __user *) arg);

	default:
		if (hdev->ioctl)
			return hdev->ioctl(hdev, cmd, arg);
		return -EINVAL;
	}
}

static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	struct sock *sk = sock->sk;
	void __user *argp = (void __user *) arg;
	int err;

	BT_DBG("cmd %x arg %lx", cmd, arg);

	switch (cmd) {
	case HCIGETDEVLIST:
		return hci_get_dev_list(argp);

	case HCIGETDEVINFO:
		return hci_get_dev_info(argp);

	case HCIGETCONNLIST:
		return hci_get_conn_list(argp);

	case HCIDEVUP:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_open(arg);

	case HCIDEVDOWN:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_close(arg);

	case HCIDEVRESET:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset(arg);

	case HCIDEVRESTAT:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset_stat(arg);

	case HCISETSCAN:
	case HCISETAUTH:
	case HCISETENCRYPT:
	case HCISETPTYPE:
	case HCISETLINKPOL:
	case HCISETLINKMODE:
	case HCISETACLMTU:
	case HCISETSCOMTU:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_cmd(cmd, argp);

	case HCIINQUIRY:
		return hci_inquiry(argp);

	default:
		lock_sock(sk);
		err = hci_sock_bound_ioctl(sk, cmd, arg);
		release_sock(sk);
		return err;
	}
}

static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = NULL;
	int err = 0;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!haddr || haddr->hci_family != AF_BLUETOOTH)
		return -EINVAL;

	lock_sock(sk);

	if (hci_pi(sk)->hdev) {
		err = -EALREADY;
		goto done;
	}

	if (haddr->hci_dev != HCI_DEV_NONE) {
		if (!(hdev = hci_dev_get(haddr->hci_dev))) {
			err = -ENODEV;
			goto done;
		}

		atomic_inc(&hdev->promisc);
	}

	hci_pi(sk)->hdev = hdev;
	sk->sk_state = BT_BOUND;

done:
	release_sock(sk);
	return err;
}

static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!hdev)
		return -EBADFD;

	lock_sock(sk);

	*addr_len = sizeof(*haddr);
	haddr->hci_family = AF_BLUETOOTH;
	haddr->hci_dev    = hdev->id;

	release_sock(sk);
	return 0;
}

static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
{
	__u32 mask = hci_pi(sk)->cmsg_mask;

	if (mask & HCI_CMSG_DIR) {
		int incoming = bt_cb(skb)->incoming;
		put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	}

	if (mask & HCI_CMSG_TSTAMP) {
#ifdef CONFIG_COMPAT
		struct compat_timeval ctv;
#endif
		struct timeval tv;
		void *data;
		int len;

		skb_get_timestamp(skb, &tv);

		data = &tv;
		len = sizeof(tv);
#ifdef CONFIG_COMPAT
		if (msg->msg_flags & MSG_CMSG_COMPAT) {
			ctv.tv_sec = tv.tv_sec;
			ctv.tv_usec = tv.tv_usec;
			data = &ctv;
			len = sizeof(ctv);
		}
#endif

		put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
	}
}

static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
				struct msghdr *msg, size_t len, int flags)
{
	int noblock = flags & MSG_DONTWAIT;
	struct sock *sk = sock->sk;
	struct sk_buff *skb;
	int copied, err;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (flags & (MSG_OOB))
		return -EOPNOTSUPP;

	if (sk->sk_state == BT_CLOSED)
		return 0;

	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
		return err;

	msg->msg_namelen = 0;

	copied = skb->len;
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

	skb_reset_transport_header(skb);
	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);

	hci_sock_cmsg(sk, msg, skb);

	skb_free_datagram(sk, skb);

	return err ? : copied;
}

static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
			    struct msghdr *msg, size_t len)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;
	struct sk_buff *skb;
	int err;

	BT_DBG("sock %p sk %p", sock, sk);

	if (msg->msg_flags & MSG_OOB)
		return -EOPNOTSUPP;

	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
		return -EINVAL;

	if (len < 4 || len > HCI_MAX_FRAME_SIZE)
		return -EINVAL;

	lock_sock(sk);

	if (!(hdev = hci_pi(sk)->hdev)) {
		err = -EBADFD;
		goto done;
	}

	if (!test_bit(HCI_UP, &hdev->flags)) {
		err = -ENETDOWN;
		goto done;
	}

	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
		goto done;

	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
		err = -EFAULT;
		goto drop;
	}

	bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
	skb_pull(skb, 1);
	skb->dev = (void *) hdev;

	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
		u16 opcode = get_unaligned_le16(skb->data);
		u16 ogf = hci_opcode_ogf(opcode);
		u16 ocf = hci_opcode_ocf(opcode);

		if (((ogf > HCI_SFLT_MAX_OGF) ||
				!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
					!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
			skb_queue_tail(&hdev->raw_q, skb);
			tasklet_schedule(&hdev->tx_task);
		} else {
			skb_queue_tail(&hdev->cmd_q, skb);
			tasklet_schedule(&hdev->cmd_task);
		}
	} else {
		if (!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		skb_queue_tail(&hdev->raw_q, skb);
		tasklet_schedule(&hdev->tx_task);
	}

	err = len;

done:
	release_sock(sk);
	return err;

drop:
	kfree_skb(skb);
	goto done;
}

static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len)
{
	struct hci_ufilter uf = { .opcode = 0 };
	struct sock *sk = sock->sk;
	int err = 0, opt = 0;

	BT_DBG("sk %p, opt %d", sk, optname);

	lock_sock(sk);

	switch (optname) {
	case HCI_DATA_DIR:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
		break;

	case HCI_TIME_STAMP:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
		break;

	case HCI_FILTER:
		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			uf.type_mask = f->type_mask;
			uf.opcode    = f->opcode;
			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
		}

		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_from_user(&uf, optval, len)) {
			err = -EFAULT;
			break;
		}

		if (!capable(CAP_NET_RAW)) {
			uf.type_mask &= hci_sec_filter.type_mask;
			uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
			uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
		}

		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			f->type_mask = uf.type_mask;
			f->opcode    = uf.opcode;
			*((u32 *) f->event_mask + 0) = uf.event_mask[0];
			*((u32 *) f->event_mask + 1) = uf.event_mask[1];
		}
		break;

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
{
	struct hci_ufilter uf;
	struct sock *sk = sock->sk;
	int len, opt;

	if (get_user(len, optlen))
		return -EFAULT;

	switch (optname) {
	case HCI_DATA_DIR:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
			opt = 1;
		else
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_TIME_STAMP:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
			opt = 1;
		else
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_FILTER:
		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			uf.type_mask = f->type_mask;
			uf.opcode    = f->opcode;
			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
		}

		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_to_user(optval, &uf, len))
			return -EFAULT;
		break;

	default:
		return -ENOPROTOOPT;
		break;
	}

	return 0;
}

static const struct proto_ops hci_sock_ops = {
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= hci_sock_release,
	.bind		= hci_sock_bind,
	.getname	= hci_sock_getname,
	.sendmsg	= hci_sock_sendmsg,
	.recvmsg	= hci_sock_recvmsg,
	.ioctl		= hci_sock_ioctl,
	.poll		= datagram_poll,
	.listen		= sock_no_listen,
	.shutdown	= sock_no_shutdown,
	.setsockopt	= hci_sock_setsockopt,
	.getsockopt	= hci_sock_getsockopt,
	.connect	= sock_no_connect,
	.socketpair	= sock_no_socketpair,
	.accept		= sock_no_accept,
	.mmap		= sock_no_mmap
};

static struct proto hci_sk_proto = {
	.name		= "HCI",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct hci_pinfo)
};

static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
			   int kern)
{
	struct sock *sk;

	BT_DBG("sock %p", sock);

	if (sock->type != SOCK_RAW)
		return -ESOCKTNOSUPPORT;

	sock->ops = &hci_sock_ops;

	sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	sock_reset_flag(sk, SOCK_ZAPPED);

	sk->sk_protocol = protocol;

	sock->state = SS_UNCONNECTED;
	sk->sk_state = BT_OPEN;

	bt_sock_link(&hci_sk_list, sk);
	return 0;
}

static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
	struct hci_dev *hdev = (struct hci_dev *) ptr;
	struct hci_ev_si_device ev;

	BT_DBG("hdev %s event %ld", hdev->name, event);

	/* Send event to sockets */
	ev.event  = event;
	ev.dev_id = hdev->id;
	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);

	if (event == HCI_DEV_UNREG) {
		struct sock *sk;
		struct hlist_node *node;

		/* Detach sockets from device */
		read_lock(&hci_sk_list.lock);
		sk_for_each(sk, node, &hci_sk_list.head) {
			local_bh_disable();
			bh_lock_sock_nested(sk);
			if (hci_pi(sk)->hdev == hdev) {
				hci_pi(sk)->hdev = NULL;
				sk->sk_err = EPIPE;
				sk->sk_state = BT_OPEN;
				sk->sk_state_change(sk);

				hci_dev_put(hdev);
			}
			bh_unlock_sock(sk);
			local_bh_enable();
		}
		read_unlock(&hci_sk_list.lock);
	}

	return NOTIFY_DONE;
}

static const struct net_proto_family hci_sock_family_ops = {
	.family	= PF_BLUETOOTH,
	.owner	= THIS_MODULE,
	.create	= hci_sock_create,
};

static struct notifier_block hci_sock_nblock = {
	.notifier_call = hci_sock_dev_event
};

int __init hci_sock_init(void)
{
	int err;

	err = proto_register(&hci_sk_proto, 0);
	if (err < 0)
		return err;

	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
	if (err < 0)
		goto error;

	hci_register_notifier(&hci_sock_nblock);

	BT_INFO("HCI socket layer initialized");

	return 0;

error:
	BT_ERR("HCI socket registration failed");
	proto_unregister(&hci_sk_proto);
	return err;
}

void __exit hci_sock_cleanup(void)
{
	if (bt_sock_unregister(BTPROTO_HCI) < 0)
		BT_ERR("HCI socket unregistration failed");

	hci_unregister_notifier(&hci_sock_nblock);

	proto_unregister(&hci_sk_proto);
}
Commit	Line	Data
8e87d142	1	/*
1da177e4 LT	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142 YH	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4 LT	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1da177e4 LT	19
8e87d142 YH	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
8e87d142 YH	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4 LT	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI sockets. */
	26
1da177e4 LT	27	#include <linux/module.h>
	28
	29	#include <linux/types.h>
4fc268d2	30	#include <linux/capability.h>
1da177e4 LT	31	#include <linux/errno.h>
1da177e4 LT	32	#include <linux/kernel.h>
1da177e4 LT	33	#include <linux/slab.h>
	34	#include <linux/poll.h>
	35	#include <linux/fcntl.h>
	36	#include <linux/init.h>
	37	#include <linux/skbuff.h>
	38	#include <linux/workqueue.h>
	39	#include <linux/interrupt.h>
767c5eb5	40	#include <linux/compat.h>
1da177e4 LT	41	#include <linux/socket.h>
	42	#include <linux/ioctl.h>
	43	#include <net/sock.h>
	44
	45	#include <asm/system.h>
	46	#include <asm/uaccess.h>
	47	#include <asm/unaligned.h>
	48
	49	#include <net/bluetooth/bluetooth.h>
	50	#include <net/bluetooth/hci_core.h>
	51
1da177e4 LT	52	/* ----- HCI socket interface ----- */
	53
	54	static inline int hci_test_bit(int nr, void *addr)
	55	{
	56	return ((__u32 ) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
	57	}
	58
	59	/* Security filter */
	60	static struct hci_sec_filter hci_sec_filter = {
	61	/* Packet types */
	62	0x10,
	63	/* Events */
dd7f5527	64	{ 0x1000d9fe, 0x0000b00c },
1da177e4 LT	65	/* Commands */
	66	{
	67	{ 0x0 },
	68	/* OGF_LINK_CTL */
7c631a67	69	{ 0xbe000006, 0x00000001, 0x00000000, 0x00 },
1da177e4	70	/* OGF_LINK_POLICY */
7c631a67	71	{ 0x00005200, 0x00000000, 0x00000000, 0x00 },
1da177e4	72	/* OGF_HOST_CTL */
7c631a67	73	{ 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
1da177e4	74	/* OGF_INFO_PARAM */
7c631a67	75	{ 0x000002be, 0x00000000, 0x00000000, 0x00 },
1da177e4	76	/* OGF_STATUS_PARAM */
7c631a67	77	{ 0x000000ea, 0x00000000, 0x00000000, 0x00 }
1da177e4 LT	78	}
	79	};
	80
	81	static struct bt_sock_list hci_sk_list = {
d5fb2962	82	.lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
1da177e4 LT	83	};
	84
	85	/* Send frame to RAW socket */
	86	void hci_send_to_sock(struct hci_dev hdev, struct sk_buff skb)
	87	{
	88	struct sock *sk;
	89	struct hlist_node *node;
	90
	91	BT_DBG("hdev %p len %d", hdev, skb->len);
	92
	93	read_lock(&hci_sk_list.lock);
	94	sk_for_each(sk, node, &hci_sk_list.head) {
	95	struct hci_filter *flt;
	96	struct sk_buff *nskb;
	97
	98	if (sk->sk_state != BT_BOUND \|\| hci_pi(sk)->hdev != hdev)
	99	continue;
	100
	101	/* Don't send frame to the socket it came from */
	102	if (skb->sk == sk)
	103	continue;
	104
	105	/* Apply filter */
	106	flt = &hci_pi(sk)->filter;
	107
0d48d939 MH	108	if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
0d48d939 MH	109	0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
1da177e4 LT	110	continue;
1da177e4 LT	111
0d48d939	112	if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
1da177e4 LT	113	register int evt = ((__u8 )skb->data & HCI_FLT_EVENT_BITS);
	114
	115	if (!hci_test_bit(evt, &flt->event_mask))
	116	continue;
	117
4498c80d DM	118	if (flt->opcode &&
	119	((evt == HCI_EV_CMD_COMPLETE &&
	120	flt->opcode !=
905f3ed6	121	get_unaligned((__le16 *)(skb->data + 3))) \|\|
4498c80d DM	122	(evt == HCI_EV_CMD_STATUS &&
4498c80d DM	123	flt->opcode !=
905f3ed6	124	get_unaligned((__le16 *)(skb->data + 4)))))
1da177e4 LT	125	continue;
	126	}
	127
	128	if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
	129	continue;
	130
	131	/* Put type byte before the data */
0d48d939	132	memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
1da177e4 LT	133
	134	if (sock_queue_rcv_skb(sk, nskb))
	135	kfree_skb(nskb);
	136	}
	137	read_unlock(&hci_sk_list.lock);
	138	}
	139
	140	static int hci_sock_release(struct socket *sock)
	141	{
	142	struct sock *sk = sock->sk;
7b005bd3	143	struct hci_dev *hdev;
1da177e4 LT	144
	145	BT_DBG("sock %p sk %p", sock, sk);
	146
	147	if (!sk)
	148	return 0;
	149
7b005bd3 MH	150	hdev = hci_pi(sk)->hdev;
7b005bd3 MH	151
1da177e4 LT	152	bt_sock_unlink(&hci_sk_list, sk);
	153
	154	if (hdev) {
	155	atomic_dec(&hdev->promisc);
	156	hci_dev_put(hdev);
	157	}
	158
	159	sock_orphan(sk);
	160
	161	skb_queue_purge(&sk->sk_receive_queue);
	162	skb_queue_purge(&sk->sk_write_queue);
	163
	164	sock_put(sk);
	165	return 0;
	166	}
	167
f0358568 JH	168	struct bdaddr_list hci_blacklist_lookup(struct hci_dev hdev, bdaddr_t *bdaddr)
	169	{
	170	struct list_head *p;
	171	struct bdaddr_list *blacklist = &hdev->blacklist;
	172
	173	list_for_each(p, &blacklist->list) {
	174	struct bdaddr_list *b;
	175
	176	b = list_entry(p, struct bdaddr_list, list);
	177
	178	if (bacmp(bdaddr, &b->bdaddr) == 0)
	179	return b;
	180	}
	181
	182	return NULL;
	183	}
	184
	185	static int hci_blacklist_add(struct hci_dev hdev, void __user arg)
	186	{
	187	bdaddr_t bdaddr;
	188	struct bdaddr_list *entry;
	189
	190	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
	191	return -EFAULT;
	192
	193	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
	194	return -EBADF;
	195
	196	if (hci_blacklist_lookup(hdev, &bdaddr))
	197	return -EEXIST;
	198
	199	entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
	200	if (!entry)
	201	return -ENOMEM;
	202
	203	bacpy(&entry->bdaddr, &bdaddr);
	204
	205	list_add(&entry->list, &hdev->blacklist.list);
	206
	207	return 0;
	208	}
	209
	210	int hci_blacklist_clear(struct hci_dev *hdev)
	211	{
	212	struct list_head p, n;
	213	struct bdaddr_list *blacklist = &hdev->blacklist;
	214
	215	list_for_each_safe(p, n, &blacklist->list) {
	216	struct bdaddr_list *b;
	217
	218	b = list_entry(p, struct bdaddr_list, list);
	219
	220	list_del(p);
	221	kfree(b);
	222	}
	223
	224	return 0;
	225	}
	226
	227	static int hci_blacklist_del(struct hci_dev hdev, void __user arg)
	228	{
	229	bdaddr_t bdaddr;
	230	struct bdaddr_list *entry;
	231
232	if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
233	return -EFAULT;
234
235	if (bacmp(&bdaddr, BDADDR_ANY) == 0)
236	return hci_blacklist_clear(hdev);
237
238	entry = hci_blacklist_lookup(hdev, &bdaddr);
239	if (!entry)
240	return -ENOENT;
241
242	list_del(&entry->list);
243	kfree(entry);
244
245	return 0;
246	}
247
8e87d142	248	/* Ioctls that require bound socket */
1da177e4 LT	249	static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
	250	{
	251	struct hci_dev *hdev = hci_pi(sk)->hdev;
	252
	253	if (!hdev)
	254	return -EBADFD;
	255
	256	switch (cmd) {
	257	case HCISETRAW:
	258	if (!capable(CAP_NET_ADMIN))
	259	return -EACCES;
	260
	261	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
	262	return -EPERM;
	263
	264	if (arg)
	265	set_bit(HCI_RAW, &hdev->flags);
	266	else
	267	clear_bit(HCI_RAW, &hdev->flags);
	268
	269	return 0;
	270
1da177e4	271	case HCIGETCONNINFO:
40be492f MH	272	return hci_get_conn_info(hdev, (void __user *) arg);
	273
	274	case HCIGETAUTHINFO:
	275	return hci_get_auth_info(hdev, (void __user *) arg);
1da177e4	276
f0358568 JH	277	case HCIBLOCKADDR:
	278	if (!capable(CAP_NET_ADMIN))
	279	return -EACCES;
	280	return hci_blacklist_add(hdev, (void __user *) arg);
	281
	282	case HCIUNBLOCKADDR:
	283	if (!capable(CAP_NET_ADMIN))
	284	return -EACCES;
	285	return hci_blacklist_del(hdev, (void __user *) arg);
	286
1da177e4 LT	287	default:
	288	if (hdev->ioctl)
	289	return hdev->ioctl(hdev, cmd, arg);
	290	return -EINVAL;
	291	}
	292	}
	293
	294	static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
	295	{
	296	struct sock *sk = sock->sk;
40be492f	297	void __user argp = (void __user ) arg;
1da177e4 LT	298	int err;
	299
	300	BT_DBG("cmd %x arg %lx", cmd, arg);
	301
	302	switch (cmd) {
	303	case HCIGETDEVLIST:
	304	return hci_get_dev_list(argp);
	305
	306	case HCIGETDEVINFO:
	307	return hci_get_dev_info(argp);
	308
	309	case HCIGETCONNLIST:
	310	return hci_get_conn_list(argp);
	311
	312	case HCIDEVUP:
	313	if (!capable(CAP_NET_ADMIN))
	314	return -EACCES;
	315	return hci_dev_open(arg);
	316
	317	case HCIDEVDOWN:
	318	if (!capable(CAP_NET_ADMIN))
	319	return -EACCES;
	320	return hci_dev_close(arg);
	321
	322	case HCIDEVRESET:
	323	if (!capable(CAP_NET_ADMIN))
	324	return -EACCES;
	325	return hci_dev_reset(arg);
	326
	327	case HCIDEVRESTAT:
	328	if (!capable(CAP_NET_ADMIN))
	329	return -EACCES;
	330	return hci_dev_reset_stat(arg);
	331
	332	case HCISETSCAN:
	333	case HCISETAUTH:
	334	case HCISETENCRYPT:
	335	case HCISETPTYPE:
	336	case HCISETLINKPOL:
	337	case HCISETLINKMODE:
	338	case HCISETACLMTU:
	339	case HCISETSCOMTU:
	340	if (!capable(CAP_NET_ADMIN))
	341	return -EACCES;
	342	return hci_dev_cmd(cmd, argp);
	343
	344	case HCIINQUIRY:
	345	return hci_inquiry(argp);
	346
	347	default:
	348	lock_sock(sk);
	349	err = hci_sock_bound_ioctl(sk, cmd, arg);
	350	release_sock(sk);
	351	return err;
	352	}
	353	}
	354
	355	static int hci_sock_bind(struct socket sock, struct sockaddr addr, int addr_len)
	356	{
	357	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
	358	struct sock *sk = sock->sk;
	359	struct hci_dev *hdev = NULL;
	360	int err = 0;
	361
362	BT_DBG("sock %p sk %p", sock, sk);
363
364	if (!haddr \|\| haddr->hci_family != AF_BLUETOOTH)
365	return -EINVAL;
366
367	lock_sock(sk);
368
369	if (hci_pi(sk)->hdev) {
370	err = -EALREADY;
371	goto done;
372	}
373
374	if (haddr->hci_dev != HCI_DEV_NONE) {
375	if (!(hdev = hci_dev_get(haddr->hci_dev))) {
376	err = -ENODEV;
377	goto done;
378	}
379
380	atomic_inc(&hdev->promisc);
381	}
382
383	hci_pi(sk)->hdev = hdev;
384	sk->sk_state = BT_BOUND;
385
386	done:
387	release_sock(sk);
388	return err;
389	}
390
391	static int hci_sock_getname(struct socket sock, struct sockaddr addr, int *addr_len, int peer)
392	{
393	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
394	struct sock *sk = sock->sk;
7b005bd3	395	struct hci_dev *hdev = hci_pi(sk)->hdev;
1da177e4 LT	396
	397	BT_DBG("sock %p sk %p", sock, sk);
	398
7b005bd3 MH	399	if (!hdev)
	400	return -EBADFD;
	401
1da177e4 LT	402	lock_sock(sk);
	403
	404	addr_len = sizeof(haddr);
	405	haddr->hci_family = AF_BLUETOOTH;
7b005bd3	406	haddr->hci_dev = hdev->id;
1da177e4 LT	407
	408	release_sock(sk);
	409	return 0;
	410	}
	411
	412	static inline void hci_sock_cmsg(struct sock sk, struct msghdr msg, struct sk_buff *skb)
	413	{
	414	__u32 mask = hci_pi(sk)->cmsg_mask;
	415
0d48d939 MH	416	if (mask & HCI_CMSG_DIR) {
	417	int incoming = bt_cb(skb)->incoming;
	418	put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	419	}
1da177e4	420
a61bbcf2	421	if (mask & HCI_CMSG_TSTAMP) {
f6e623a6 JFS	422	#ifdef CONFIG_COMPAT
	423	struct compat_timeval ctv;
	424	#endif
a61bbcf2	425	struct timeval tv;
767c5eb5 MH	426	void *data;
767c5eb5 MH	427	int len;
a61bbcf2 PM	428
a61bbcf2 PM	429	skb_get_timestamp(skb, &tv);
767c5eb5	430
1da97f83 DM	431	data = &tv;
	432	len = sizeof(tv);
	433	#ifdef CONFIG_COMPAT
767c5eb5	434	if (msg->msg_flags & MSG_CMSG_COMPAT) {
767c5eb5 MH	435	ctv.tv_sec = tv.tv_sec;
	436	ctv.tv_usec = tv.tv_usec;
	437	data = &ctv;
	438	len = sizeof(ctv);
767c5eb5	439	}
1da97f83	440	#endif
767c5eb5 MH	441
767c5eb5 MH	442	put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
a61bbcf2	443	}
1da177e4	444	}
8e87d142 YH	445
8e87d142 YH	446	static int hci_sock_recvmsg(struct kiocb iocb, struct socket sock,
1da177e4 LT	447	struct msghdr *msg, size_t len, int flags)
	448	{
	449	int noblock = flags & MSG_DONTWAIT;
	450	struct sock *sk = sock->sk;
	451	struct sk_buff *skb;
	452	int copied, err;
	453
	454	BT_DBG("sock %p, sk %p", sock, sk);
	455
	456	if (flags & (MSG_OOB))
	457	return -EOPNOTSUPP;
	458
	459	if (sk->sk_state == BT_CLOSED)
	460	return 0;
	461
	462	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
	463	return err;
	464
	465	msg->msg_namelen = 0;
	466
	467	copied = skb->len;
	468	if (len < copied) {
	469	msg->msg_flags \|= MSG_TRUNC;
	470	copied = len;
	471	}
	472
badff6d0	473	skb_reset_transport_header(skb);
1da177e4 LT	474	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	475
	476	hci_sock_cmsg(sk, msg, skb);
	477
	478	skb_free_datagram(sk, skb);
	479
	480	return err ? : copied;
	481	}
	482
8e87d142	483	static int hci_sock_sendmsg(struct kiocb iocb, struct socket sock,
1da177e4 LT	484	struct msghdr *msg, size_t len)
	485	{
	486	struct sock *sk = sock->sk;
	487	struct hci_dev *hdev;
	488	struct sk_buff *skb;
	489	int err;
	490
	491	BT_DBG("sock %p sk %p", sock, sk);
	492
	493	if (msg->msg_flags & MSG_OOB)
	494	return -EOPNOTSUPP;
	495
	496	if (msg->msg_flags & ~(MSG_DONTWAIT\|MSG_NOSIGNAL\|MSG_ERRQUEUE))
	497	return -EINVAL;
	498
	499	if (len < 4 \|\| len > HCI_MAX_FRAME_SIZE)
	500	return -EINVAL;
	501
	502	lock_sock(sk);
	503
	504	if (!(hdev = hci_pi(sk)->hdev)) {
	505	err = -EBADFD;
	506	goto done;
	507	}
	508
7e21addc MH	509	if (!test_bit(HCI_UP, &hdev->flags)) {
	510	err = -ENETDOWN;
	511	goto done;
	512	}
	513
1da177e4 LT	514	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
	515	goto done;
	516
	517	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
	518	err = -EFAULT;
	519	goto drop;
	520	}
	521
0d48d939	522	bt_cb(skb)->pkt_type = ((unsigned char ) skb->data);
1da177e4 LT	523	skb_pull(skb, 1);
	524	skb->dev = (void *) hdev;
	525
0d48d939	526	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
83985319	527	u16 opcode = get_unaligned_le16(skb->data);
1da177e4 LT	528	u16 ogf = hci_opcode_ogf(opcode);
	529	u16 ocf = hci_opcode_ocf(opcode);
	530
	531	if (((ogf > HCI_SFLT_MAX_OGF) \|\|
	532	!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
	533	!capable(CAP_NET_RAW)) {
	534	err = -EPERM;
	535	goto drop;
	536	}
	537
a9de9248	538	if (test_bit(HCI_RAW, &hdev->flags) \|\| (ogf == 0x3f)) {
1da177e4	539	skb_queue_tail(&hdev->raw_q, skb);
c78ae283	540	tasklet_schedule(&hdev->tx_task);
1da177e4 LT	541	} else {
1da177e4 LT	542	skb_queue_tail(&hdev->cmd_q, skb);
c78ae283	543	tasklet_schedule(&hdev->cmd_task);
1da177e4 LT	544	}
	545	} else {
	546	if (!capable(CAP_NET_RAW)) {
	547	err = -EPERM;
	548	goto drop;
	549	}
	550
	551	skb_queue_tail(&hdev->raw_q, skb);
c78ae283	552	tasklet_schedule(&hdev->tx_task);
1da177e4 LT	553	}
	554
	555	err = len;
	556
	557	done:
	558	release_sock(sk);
	559	return err;
	560
	561	drop:
	562	kfree_skb(skb);
	563	goto done;
	564	}
	565
b7058842	566	static int hci_sock_setsockopt(struct socket sock, int level, int optname, char __user optval, unsigned int len)
1da177e4 LT	567	{
	568	struct hci_ufilter uf = { .opcode = 0 };
	569	struct sock *sk = sock->sk;
	570	int err = 0, opt = 0;
	571
	572	BT_DBG("sk %p, opt %d", sk, optname);
	573
	574	lock_sock(sk);
	575
	576	switch (optname) {
	577	case HCI_DATA_DIR:
	578	if (get_user(opt, (int __user *)optval)) {
	579	err = -EFAULT;
	580	break;
	581	}
	582
	583	if (opt)
	584	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_DIR;
	585	else
	586	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
	587	break;
	588
	589	case HCI_TIME_STAMP:
	590	if (get_user(opt, (int __user *)optval)) {
	591	err = -EFAULT;
	592	break;
	593	}
	594
	595	if (opt)
	596	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_TSTAMP;
	597	else
	598	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
	599	break;
	600
	601	case HCI_FILTER:
0878b666 MH	602	{
	603	struct hci_filter *f = &hci_pi(sk)->filter;
	604
	605	uf.type_mask = f->type_mask;
	606	uf.opcode = f->opcode;
	607	uf.event_mask[0] = ((u32 ) f->event_mask + 0);
	608	uf.event_mask[1] = ((u32 ) f->event_mask + 1);
	609	}
	610
1da177e4 LT	611	len = min_t(unsigned int, len, sizeof(uf));
	612	if (copy_from_user(&uf, optval, len)) {
	613	err = -EFAULT;
	614	break;
	615	}
	616
	617	if (!capable(CAP_NET_RAW)) {
	618	uf.type_mask &= hci_sec_filter.type_mask;
	619	uf.event_mask[0] &= ((u32 ) hci_sec_filter.event_mask + 0);
	620	uf.event_mask[1] &= ((u32 ) hci_sec_filter.event_mask + 1);
	621	}
	622
	623	{
	624	struct hci_filter *f = &hci_pi(sk)->filter;
	625
	626	f->type_mask = uf.type_mask;
	627	f->opcode = uf.opcode;
	628	((u32 ) f->event_mask + 0) = uf.event_mask[0];
	629	((u32 ) f->event_mask + 1) = uf.event_mask[1];
	630	}
8e87d142	631	break;
1da177e4 LT	632
	633	default:
	634	err = -ENOPROTOOPT;
	635	break;
	636	}
	637
	638	release_sock(sk);
	639	return err;
	640	}
	641
	642	static int hci_sock_getsockopt(struct socket sock, int level, int optname, char __user optval, int __user *optlen)
	643	{
	644	struct hci_ufilter uf;
	645	struct sock *sk = sock->sk;
8e87d142	646	int len, opt;
1da177e4 LT	647
	648	if (get_user(len, optlen))
	649	return -EFAULT;
	650
	651	switch (optname) {
	652	case HCI_DATA_DIR:
	653	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
	654	opt = 1;
8e87d142	655	else
1da177e4 LT	656	opt = 0;
	657
	658	if (put_user(opt, optval))
	659	return -EFAULT;
	660	break;
	661
	662	case HCI_TIME_STAMP:
	663	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
	664	opt = 1;
8e87d142	665	else
1da177e4 LT	666	opt = 0;
	667
	668	if (put_user(opt, optval))
	669	return -EFAULT;
	670	break;
	671
	672	case HCI_FILTER:
	673	{
	674	struct hci_filter *f = &hci_pi(sk)->filter;
	675
	676	uf.type_mask = f->type_mask;
	677	uf.opcode = f->opcode;
	678	uf.event_mask[0] = ((u32 ) f->event_mask + 0);
	679	uf.event_mask[1] = ((u32 ) f->event_mask + 1);
	680	}
	681
	682	len = min_t(unsigned int, len, sizeof(uf));
	683	if (copy_to_user(optval, &uf, len))
	684	return -EFAULT;
	685	break;
	686
	687	default:
	688	return -ENOPROTOOPT;
	689	break;
	690	}
	691
	692	return 0;
	693	}
	694
90ddc4f0	695	static const struct proto_ops hci_sock_ops = {
1da177e4 LT	696	.family = PF_BLUETOOTH,
	697	.owner = THIS_MODULE,
	698	.release = hci_sock_release,
	699	.bind = hci_sock_bind,
	700	.getname = hci_sock_getname,
	701	.sendmsg = hci_sock_sendmsg,
	702	.recvmsg = hci_sock_recvmsg,
	703	.ioctl = hci_sock_ioctl,
	704	.poll = datagram_poll,
	705	.listen = sock_no_listen,
	706	.shutdown = sock_no_shutdown,
	707	.setsockopt = hci_sock_setsockopt,
	708	.getsockopt = hci_sock_getsockopt,
	709	.connect = sock_no_connect,
	710	.socketpair = sock_no_socketpair,
	711	.accept = sock_no_accept,
	712	.mmap = sock_no_mmap
	713	};
	714
	715	static struct proto hci_sk_proto = {
	716	.name = "HCI",
	717	.owner = THIS_MODULE,
	718	.obj_size = sizeof(struct hci_pinfo)
	719	};
	720
3f378b68 EP	721	static int hci_sock_create(struct net net, struct socket sock, int protocol,
3f378b68 EP	722	int kern)
1da177e4 LT	723	{
	724	struct sock *sk;
	725
	726	BT_DBG("sock %p", sock);
	727
	728	if (sock->type != SOCK_RAW)
	729	return -ESOCKTNOSUPPORT;
	730
	731	sock->ops = &hci_sock_ops;
	732
6257ff21	733	sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
1da177e4 LT	734	if (!sk)
	735	return -ENOMEM;
	736
	737	sock_init_data(sock, sk);
	738
	739	sock_reset_flag(sk, SOCK_ZAPPED);
	740
	741	sk->sk_protocol = protocol;
	742
	743	sock->state = SS_UNCONNECTED;
	744	sk->sk_state = BT_OPEN;
	745
	746	bt_sock_link(&hci_sk_list, sk);
	747	return 0;
	748	}
	749
	750	static int hci_sock_dev_event(struct notifier_block this, unsigned long event, void ptr)
	751	{
	752	struct hci_dev hdev = (struct hci_dev ) ptr;
	753	struct hci_ev_si_device ev;
	754
	755	BT_DBG("hdev %s event %ld", hdev->name, event);
	756
	757	/* Send event to sockets */
	758	ev.event = event;
	759	ev.dev_id = hdev->id;
	760	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
	761
	762	if (event == HCI_DEV_UNREG) {
	763	struct sock *sk;
	764	struct hlist_node *node;
	765
	766	/* Detach sockets from device */
	767	read_lock(&hci_sk_list.lock);
	768	sk_for_each(sk, node, &hci_sk_list.head) {
4ce61d1c SS	769	local_bh_disable();
4ce61d1c SS	770	bh_lock_sock_nested(sk);
1da177e4 LT	771	if (hci_pi(sk)->hdev == hdev) {
	772	hci_pi(sk)->hdev = NULL;
	773	sk->sk_err = EPIPE;
	774	sk->sk_state = BT_OPEN;
	775	sk->sk_state_change(sk);
	776
	777	hci_dev_put(hdev);
	778	}
4ce61d1c SS	779	bh_unlock_sock(sk);
4ce61d1c SS	780	local_bh_enable();
1da177e4 LT	781	}
	782	read_unlock(&hci_sk_list.lock);
	783	}
	784
	785	return NOTIFY_DONE;
	786	}
	787
ec1b4cf7	788	static const struct net_proto_family hci_sock_family_ops = {
1da177e4 LT	789	.family = PF_BLUETOOTH,
	790	.owner = THIS_MODULE,
	791	.create = hci_sock_create,
	792	};
	793
	794	static struct notifier_block hci_sock_nblock = {
	795	.notifier_call = hci_sock_dev_event
	796	};
	797
	798	int __init hci_sock_init(void)
	799	{
	800	int err;
	801
	802	err = proto_register(&hci_sk_proto, 0);
	803	if (err < 0)
	804	return err;
	805
	806	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
	807	if (err < 0)
	808	goto error;
	809
	810	hci_register_notifier(&hci_sock_nblock);
	811
	812	BT_INFO("HCI socket layer initialized");
	813
	814	return 0;
	815
	816	error:
	817	BT_ERR("HCI socket registration failed");
	818	proto_unregister(&hci_sk_proto);
	819	return err;
	820	}
	821
04005dd9	822	void __exit hci_sock_cleanup(void)
1da177e4 LT	823	{
	824	if (bt_sock_unregister(BTPROTO_HCI) < 0)
	825	BT_ERR("HCI socket unregistration failed");
	826
	827	hci_unregister_notifier(&hci_sock_nblock);
	828
	829	proto_unregister(&hci_sk_proto);
1da177e4	830	}