[deliverable/linux.git] / net / bluetooth / hci_sock.c

/* 
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI sockets. */

#include <linux/config.h>
#include <linux/module.h>

#include <linux/types.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/workqueue.h>
#include <linux/interrupt.h>
#include <linux/socket.h>
#include <linux/ioctl.h>
#include <net/sock.h>

#include <asm/system.h>
#include <asm/uaccess.h>
#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#ifndef CONFIG_BT_HCI_SOCK_DEBUG
#undef  BT_DBG
#define BT_DBG(D...)
#endif

/* ----- HCI socket interface ----- */

static inline int hci_test_bit(int nr, void *addr)
{
	return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
}

/* Security filter */
static struct hci_sec_filter hci_sec_filter = {
	/* Packet types */
	0x10,
	/* Events */
	{ 0x1000d9fe, 0x0000300c },
	/* Commands */
	{
		{ 0x0 },
		/* OGF_LINK_CTL */
		{ 0xbe000006, 0x00000001, 0x0000, 0x00 },
		/* OGF_LINK_POLICY */
		{ 0x00005200, 0x00000000, 0x0000, 0x00 },
		/* OGF_HOST_CTL */
		{ 0xaab00200, 0x2b402aaa, 0x0154, 0x00 },
		/* OGF_INFO_PARAM */
		{ 0x000002be, 0x00000000, 0x0000, 0x00 },
		/* OGF_STATUS_PARAM */
		{ 0x000000ea, 0x00000000, 0x0000, 0x00 }
	}
};

static struct bt_sock_list hci_sk_list = {
	.lock = RW_LOCK_UNLOCKED
};

/* Send frame to RAW socket */
void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct sock *sk;
	struct hlist_node *node;

	BT_DBG("hdev %p len %d", hdev, skb->len);

	read_lock(&hci_sk_list.lock);
	sk_for_each(sk, node, &hci_sk_list.head) {
		struct hci_filter *flt;
		struct sk_buff *nskb;

		if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
			continue;

		/* Don't send frame to the socket it came from */
		if (skb->sk == sk)
			continue;

		/* Apply filter */
		flt = &hci_pi(sk)->filter;

		if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
				0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
			continue;

		if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
			register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);

			if (!hci_test_bit(evt, &flt->event_mask))
				continue;

			if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE && 
					flt->opcode != *(__u16 *)(skb->data + 3)) ||
					(evt == HCI_EV_CMD_STATUS && 
					flt->opcode != *(__u16 *)(skb->data + 4))))
				continue;
		}

		if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
			continue;

		/* Put type byte before the data */
		memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);

		if (sock_queue_rcv_skb(sk, nskb))
			kfree_skb(nskb);
	}
	read_unlock(&hci_sk_list.lock);
}

static int hci_sock_release(struct socket *sock)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!sk)
		return 0;

	bt_sock_unlink(&hci_sk_list, sk);

	if (hdev) {
		atomic_dec(&hdev->promisc);
		hci_dev_put(hdev);
	}

	sock_orphan(sk);

	skb_queue_purge(&sk->sk_receive_queue);
	skb_queue_purge(&sk->sk_write_queue);

	sock_put(sk);
	return 0;
}

/* Ioctls that require bound socket */ 
static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
{
	struct hci_dev *hdev = hci_pi(sk)->hdev;

	if (!hdev)
		return -EBADFD;

	switch (cmd) {
	case HCISETRAW:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;

		if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
			return -EPERM;

		if (arg)
			set_bit(HCI_RAW, &hdev->flags);
		else
			clear_bit(HCI_RAW, &hdev->flags);

		return 0;

	case HCISETSECMGR:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;

		if (arg)
			set_bit(HCI_SECMGR, &hdev->flags);
		else
			clear_bit(HCI_SECMGR, &hdev->flags);

		return 0;

	case HCIGETCONNINFO:
		return hci_get_conn_info(hdev, (void __user *)arg);

	default:
		if (hdev->ioctl)
			return hdev->ioctl(hdev, cmd, arg);
		return -EINVAL;
	}
}

static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
{
	struct sock *sk = sock->sk;
	void __user *argp = (void __user *)arg;
	int err;

	BT_DBG("cmd %x arg %lx", cmd, arg);

	switch (cmd) {
	case HCIGETDEVLIST:
		return hci_get_dev_list(argp);

	case HCIGETDEVINFO:
		return hci_get_dev_info(argp);

	case HCIGETCONNLIST:
		return hci_get_conn_list(argp);

	case HCIDEVUP:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_open(arg);

	case HCIDEVDOWN:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_close(arg);

	case HCIDEVRESET:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset(arg);

	case HCIDEVRESTAT:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_reset_stat(arg);

	case HCISETSCAN:
	case HCISETAUTH:
	case HCISETENCRYPT:
	case HCISETPTYPE:
	case HCISETLINKPOL:
	case HCISETLINKMODE:
	case HCISETACLMTU:
	case HCISETSCOMTU:
		if (!capable(CAP_NET_ADMIN))
			return -EACCES;
		return hci_dev_cmd(cmd, argp);

	case HCIINQUIRY:
		return hci_inquiry(argp);

	default:
		lock_sock(sk);
		err = hci_sock_bound_ioctl(sk, cmd, arg);
		release_sock(sk);
		return err;
	}
}

static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;
	struct hci_dev *hdev = NULL;
	int err = 0;

	BT_DBG("sock %p sk %p", sock, sk);

	if (!haddr || haddr->hci_family != AF_BLUETOOTH)
		return -EINVAL;

	lock_sock(sk);

	if (hci_pi(sk)->hdev) {
		err = -EALREADY;
		goto done;
	}

	if (haddr->hci_dev != HCI_DEV_NONE) {
		if (!(hdev = hci_dev_get(haddr->hci_dev))) {
			err = -ENODEV;
			goto done;
		}

		atomic_inc(&hdev->promisc);
	}

	hci_pi(sk)->hdev = hdev;
	sk->sk_state = BT_BOUND;

done:
	release_sock(sk);
	return err;
}

static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
{
	struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
	struct sock *sk = sock->sk;

	BT_DBG("sock %p sk %p", sock, sk);

	lock_sock(sk);

	*addr_len = sizeof(*haddr);
	haddr->hci_family = AF_BLUETOOTH;
	haddr->hci_dev    = hci_pi(sk)->hdev->id;

	release_sock(sk);
	return 0;
}

static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
{
	__u32 mask = hci_pi(sk)->cmsg_mask;

	if (mask & HCI_CMSG_DIR) {
		int incoming = bt_cb(skb)->incoming;
		put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	}

	if (mask & HCI_CMSG_TSTAMP)
		put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
}
 
static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 
				struct msghdr *msg, size_t len, int flags)
{
	int noblock = flags & MSG_DONTWAIT;
	struct sock *sk = sock->sk;
	struct sk_buff *skb;
	int copied, err;

	BT_DBG("sock %p, sk %p", sock, sk);

	if (flags & (MSG_OOB))
		return -EOPNOTSUPP;

	if (sk->sk_state == BT_CLOSED)
		return 0;

	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
		return err;

	msg->msg_namelen = 0;

	copied = skb->len;
	if (len < copied) {
		msg->msg_flags |= MSG_TRUNC;
		copied = len;
	}

	skb->h.raw = skb->data;
	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);

	hci_sock_cmsg(sk, msg, skb);

	skb_free_datagram(sk, skb);

	return err ? : copied;
}

static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 
			    struct msghdr *msg, size_t len)
{
	struct sock *sk = sock->sk;
	struct hci_dev *hdev;
	struct sk_buff *skb;
	int err;

	BT_DBG("sock %p sk %p", sock, sk);

	if (msg->msg_flags & MSG_OOB)
		return -EOPNOTSUPP;

	if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
		return -EINVAL;

	if (len < 4 || len > HCI_MAX_FRAME_SIZE)
		return -EINVAL;

	lock_sock(sk);

	if (!(hdev = hci_pi(sk)->hdev)) {
		err = -EBADFD;
		goto done;
	}

	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
		goto done;

	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
		err = -EFAULT;
		goto drop;
	}

	bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
	skb_pull(skb, 1);
	skb->dev = (void *) hdev;

	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
		u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
		u16 ogf = hci_opcode_ogf(opcode);
		u16 ocf = hci_opcode_ocf(opcode);

		if (((ogf > HCI_SFLT_MAX_OGF) ||
				!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
					!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		if (test_bit(HCI_RAW, &hdev->flags) || (ogf == OGF_VENDOR_CMD)) {
			skb_queue_tail(&hdev->raw_q, skb);
			hci_sched_tx(hdev);
		} else {
			skb_queue_tail(&hdev->cmd_q, skb);
			hci_sched_cmd(hdev);
		}
	} else {
		if (!capable(CAP_NET_RAW)) {
			err = -EPERM;
			goto drop;
		}

		skb_queue_tail(&hdev->raw_q, skb);
		hci_sched_tx(hdev);
	}

	err = len;

done:
	release_sock(sk);
	return err;

drop:
	kfree_skb(skb);
	goto done;
}

static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, int len)
{
	struct hci_ufilter uf = { .opcode = 0 };
	struct sock *sk = sock->sk;
	int err = 0, opt = 0;

	BT_DBG("sk %p, opt %d", sk, optname);

	lock_sock(sk);

	switch (optname) {
	case HCI_DATA_DIR:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
		break;

	case HCI_TIME_STAMP:
		if (get_user(opt, (int __user *)optval)) {
			err = -EFAULT;
			break;
		}

		if (opt)
			hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
		else
			hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
		break;

	case HCI_FILTER:
		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_from_user(&uf, optval, len)) {
			err = -EFAULT;
			break;
		}

		if (!capable(CAP_NET_RAW)) {
			uf.type_mask &= hci_sec_filter.type_mask;
			uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
			uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
		}

		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			f->type_mask = uf.type_mask;
			f->opcode    = uf.opcode;
			*((u32 *) f->event_mask + 0) = uf.event_mask[0];
			*((u32 *) f->event_mask + 1) = uf.event_mask[1];
		}
		break; 

	default:
		err = -ENOPROTOOPT;
		break;
	}

	release_sock(sk);
	return err;
}

static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
{
	struct hci_ufilter uf;
	struct sock *sk = sock->sk;
	int len, opt; 

	if (get_user(len, optlen))
		return -EFAULT;

	switch (optname) {
	case HCI_DATA_DIR:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
			opt = 1;
		else 
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_TIME_STAMP:
		if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
			opt = 1;
		else 
			opt = 0;

		if (put_user(opt, optval))
			return -EFAULT;
		break;

	case HCI_FILTER:
		{
			struct hci_filter *f = &hci_pi(sk)->filter;

			uf.type_mask = f->type_mask;
			uf.opcode    = f->opcode;
			uf.event_mask[0] = *((u32 *) f->event_mask + 0);
			uf.event_mask[1] = *((u32 *) f->event_mask + 1);
		}

		len = min_t(unsigned int, len, sizeof(uf));
		if (copy_to_user(optval, &uf, len))
			return -EFAULT;
		break;

	default:
		return -ENOPROTOOPT;
		break;
	}

	return 0;
}

static struct proto_ops hci_sock_ops = {
	.family		= PF_BLUETOOTH,
	.owner		= THIS_MODULE,
	.release	= hci_sock_release,
	.bind		= hci_sock_bind,
	.getname	= hci_sock_getname,
	.sendmsg	= hci_sock_sendmsg,
	.recvmsg	= hci_sock_recvmsg,
	.ioctl		= hci_sock_ioctl,
	.poll		= datagram_poll,
	.listen		= sock_no_listen,
	.shutdown	= sock_no_shutdown,
	.setsockopt	= hci_sock_setsockopt,
	.getsockopt	= hci_sock_getsockopt,
	.connect	= sock_no_connect,
	.socketpair	= sock_no_socketpair,
	.accept		= sock_no_accept,
	.mmap		= sock_no_mmap
};

static struct proto hci_sk_proto = {
	.name		= "HCI",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct hci_pinfo)
};

static int hci_sock_create(struct socket *sock, int protocol)
{
	struct sock *sk;

	BT_DBG("sock %p", sock);

	if (sock->type != SOCK_RAW)
		return -ESOCKTNOSUPPORT;

	sock->ops = &hci_sock_ops;

	sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1);
	if (!sk)
		return -ENOMEM;

	sock_init_data(sock, sk);

	sock_reset_flag(sk, SOCK_ZAPPED);

	sk->sk_protocol = protocol;

	sock->state = SS_UNCONNECTED;
	sk->sk_state = BT_OPEN;

	bt_sock_link(&hci_sk_list, sk);
	return 0;
}

static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
{
	struct hci_dev *hdev = (struct hci_dev *) ptr;
	struct hci_ev_si_device ev;

	BT_DBG("hdev %s event %ld", hdev->name, event);

	/* Send event to sockets */
	ev.event  = event;
	ev.dev_id = hdev->id;
	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);

	if (event == HCI_DEV_UNREG) {
		struct sock *sk;
		struct hlist_node *node;

		/* Detach sockets from device */
		read_lock(&hci_sk_list.lock);
		sk_for_each(sk, node, &hci_sk_list.head) {
			bh_lock_sock(sk);
			if (hci_pi(sk)->hdev == hdev) {
				hci_pi(sk)->hdev = NULL;
				sk->sk_err = EPIPE;
				sk->sk_state = BT_OPEN;
				sk->sk_state_change(sk);

				hci_dev_put(hdev);
			}
			bh_unlock_sock(sk);
		}
		read_unlock(&hci_sk_list.lock);
	}

	return NOTIFY_DONE;
}

static struct net_proto_family hci_sock_family_ops = {
	.family	= PF_BLUETOOTH,
	.owner	= THIS_MODULE,
	.create	= hci_sock_create,
};

static struct notifier_block hci_sock_nblock = {
	.notifier_call = hci_sock_dev_event
};

int __init hci_sock_init(void)
{
	int err;

	err = proto_register(&hci_sk_proto, 0);
	if (err < 0)
		return err;

	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
	if (err < 0)
		goto error;

	hci_register_notifier(&hci_sock_nblock);

	BT_INFO("HCI socket layer initialized");

	return 0;

error:
	BT_ERR("HCI socket registration failed");
	proto_unregister(&hci_sk_proto);
	return err;
}

int __exit hci_sock_cleanup(void)
{
	if (bt_sock_unregister(BTPROTO_HCI) < 0)
		BT_ERR("HCI socket unregistration failed");

	hci_unregister_notifier(&hci_sock_nblock);

	proto_unregister(&hci_sk_proto);

	return 0;
}
Commit	Line	Data
1da177e4 LT	1	/*
	2	BlueZ - Bluetooth protocol stack for Linux
	3	Copyright (C) 2000-2001 Qualcomm Incorporated
	4
	5	Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
	6
	7	This program is free software; you can redistribute it and/or modify
	8	it under the terms of the GNU General Public License version 2 as
	9	published by the Free Software Foundation;
	10
	11	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	12	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	13	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	14	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
	15	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	16	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	17	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	18	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	19
	20	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
	21	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
	22	SOFTWARE IS DISCLAIMED.
	23	*/
	24
	25	/* Bluetooth HCI sockets. */
	26
	27	#include <linux/config.h>
	28	#include <linux/module.h>
	29
	30	#include <linux/types.h>
	31	#include <linux/errno.h>
	32	#include <linux/kernel.h>
1da177e4 LT	33	#include <linux/sched.h>
	34	#include <linux/slab.h>
	35	#include <linux/poll.h>
	36	#include <linux/fcntl.h>
	37	#include <linux/init.h>
	38	#include <linux/skbuff.h>
	39	#include <linux/workqueue.h>
	40	#include <linux/interrupt.h>
	41	#include <linux/socket.h>
	42	#include <linux/ioctl.h>
	43	#include <net/sock.h>
	44
	45	#include <asm/system.h>
	46	#include <asm/uaccess.h>
	47	#include <asm/unaligned.h>
	48
	49	#include <net/bluetooth/bluetooth.h>
	50	#include <net/bluetooth/hci_core.h>
	51
	52	#ifndef CONFIG_BT_HCI_SOCK_DEBUG
	53	#undef BT_DBG
	54	#define BT_DBG(D...)
	55	#endif
	56
	57	/* ----- HCI socket interface ----- */
	58
	59	static inline int hci_test_bit(int nr, void *addr)
	60	{
	61	return ((__u32 ) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
	62	}
	63
	64	/* Security filter */
	65	static struct hci_sec_filter hci_sec_filter = {
	66	/* Packet types */
	67	0x10,
	68	/* Events */
	69	{ 0x1000d9fe, 0x0000300c },
	70	/* Commands */
	71	{
	72	{ 0x0 },
	73	/* OGF_LINK_CTL */
	74	{ 0xbe000006, 0x00000001, 0x0000, 0x00 },
	75	/* OGF_LINK_POLICY */
	76	{ 0x00005200, 0x00000000, 0x0000, 0x00 },
	77	/* OGF_HOST_CTL */
	78	{ 0xaab00200, 0x2b402aaa, 0x0154, 0x00 },
	79	/* OGF_INFO_PARAM */
	80	{ 0x000002be, 0x00000000, 0x0000, 0x00 },
	81	/* OGF_STATUS_PARAM */
	82	{ 0x000000ea, 0x00000000, 0x0000, 0x00 }
	83	}
	84	};
	85
	86	static struct bt_sock_list hci_sk_list = {
	87	.lock = RW_LOCK_UNLOCKED
	88	};
	89
	90	/* Send frame to RAW socket */
	91	void hci_send_to_sock(struct hci_dev hdev, struct sk_buff skb)
	92	{
	93	struct sock *sk;
	94	struct hlist_node *node;
	95
	96	BT_DBG("hdev %p len %d", hdev, skb->len);
97
98	read_lock(&hci_sk_list.lock);
99	sk_for_each(sk, node, &hci_sk_list.head) {
100	struct hci_filter *flt;
101	struct sk_buff *nskb;
102
103	if (sk->sk_state != BT_BOUND \|\| hci_pi(sk)->hdev != hdev)
104	continue;
105
106	/* Don't send frame to the socket it came from */
107	if (skb->sk == sk)
108	continue;
109
110	/* Apply filter */
111	flt = &hci_pi(sk)->filter;
112
0d48d939 MH	113	if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
0d48d939 MH	114	0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
1da177e4 LT	115	continue;
1da177e4 LT	116
0d48d939	117	if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
1da177e4 LT	118	register int evt = ((__u8 )skb->data & HCI_FLT_EVENT_BITS);
	119
	120	if (!hci_test_bit(evt, &flt->event_mask))
	121	continue;
	122
	123	if (flt->opcode && ((evt == HCI_EV_CMD_COMPLETE &&
	124	flt->opcode != (__u16 )(skb->data + 3)) \|\|
	125	(evt == HCI_EV_CMD_STATUS &&
	126	flt->opcode != (__u16 )(skb->data + 4))))
	127	continue;
	128	}
	129
	130	if (!(nskb = skb_clone(skb, GFP_ATOMIC)))
	131	continue;
	132
	133	/* Put type byte before the data */
0d48d939	134	memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
1da177e4 LT	135
	136	if (sock_queue_rcv_skb(sk, nskb))
	137	kfree_skb(nskb);
	138	}
	139	read_unlock(&hci_sk_list.lock);
	140	}
	141
	142	static int hci_sock_release(struct socket *sock)
	143	{
	144	struct sock *sk = sock->sk;
	145	struct hci_dev *hdev = hci_pi(sk)->hdev;
	146
	147	BT_DBG("sock %p sk %p", sock, sk);
	148
	149	if (!sk)
	150	return 0;
	151
	152	bt_sock_unlink(&hci_sk_list, sk);
	153
	154	if (hdev) {
	155	atomic_dec(&hdev->promisc);
	156	hci_dev_put(hdev);
	157	}
	158
	159	sock_orphan(sk);
	160
	161	skb_queue_purge(&sk->sk_receive_queue);
	162	skb_queue_purge(&sk->sk_write_queue);
	163
	164	sock_put(sk);
	165	return 0;
	166	}
	167
	168	/* Ioctls that require bound socket */
	169	static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
	170	{
	171	struct hci_dev *hdev = hci_pi(sk)->hdev;
	172
	173	if (!hdev)
	174	return -EBADFD;
	175
	176	switch (cmd) {
	177	case HCISETRAW:
	178	if (!capable(CAP_NET_ADMIN))
	179	return -EACCES;
	180
	181	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
	182	return -EPERM;
	183
	184	if (arg)
	185	set_bit(HCI_RAW, &hdev->flags);
	186	else
	187	clear_bit(HCI_RAW, &hdev->flags);
	188
	189	return 0;
	190
	191	case HCISETSECMGR:
	192	if (!capable(CAP_NET_ADMIN))
	193	return -EACCES;
	194
	195	if (arg)
	196	set_bit(HCI_SECMGR, &hdev->flags);
	197	else
	198	clear_bit(HCI_SECMGR, &hdev->flags);
199
200	return 0;
201
202	case HCIGETCONNINFO:
203	return hci_get_conn_info(hdev, (void __user *)arg);
204
205	default:
206	if (hdev->ioctl)
207	return hdev->ioctl(hdev, cmd, arg);
208	return -EINVAL;
209	}
210	}
211
212	static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
213	{
214	struct sock *sk = sock->sk;
215	void __user argp = (void __user )arg;
216	int err;
217
218	BT_DBG("cmd %x arg %lx", cmd, arg);
219
220	switch (cmd) {
221	case HCIGETDEVLIST:
222	return hci_get_dev_list(argp);
223
224	case HCIGETDEVINFO:
225	return hci_get_dev_info(argp);
226
227	case HCIGETCONNLIST:
228	return hci_get_conn_list(argp);
229
230	case HCIDEVUP:
231	if (!capable(CAP_NET_ADMIN))
232	return -EACCES;
233	return hci_dev_open(arg);
234
235	case HCIDEVDOWN:
236	if (!capable(CAP_NET_ADMIN))
237	return -EACCES;
238	return hci_dev_close(arg);
239
240	case HCIDEVRESET:
241	if (!capable(CAP_NET_ADMIN))
242	return -EACCES;
243	return hci_dev_reset(arg);
244
245	case HCIDEVRESTAT:
246	if (!capable(CAP_NET_ADMIN))
247	return -EACCES;
248	return hci_dev_reset_stat(arg);
249
250	case HCISETSCAN:
251	case HCISETAUTH:
252	case HCISETENCRYPT:
253	case HCISETPTYPE:
254	case HCISETLINKPOL:
255	case HCISETLINKMODE:
256	case HCISETACLMTU:
257	case HCISETSCOMTU:
258	if (!capable(CAP_NET_ADMIN))
259	return -EACCES;
260	return hci_dev_cmd(cmd, argp);
261
262	case HCIINQUIRY:
263	return hci_inquiry(argp);
264
265	default:
266	lock_sock(sk);
267	err = hci_sock_bound_ioctl(sk, cmd, arg);
268	release_sock(sk);
269	return err;
270	}
271	}
272
273	static int hci_sock_bind(struct socket sock, struct sockaddr addr, int addr_len)
274	{
275	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
276	struct sock *sk = sock->sk;
277	struct hci_dev *hdev = NULL;
278	int err = 0;
279
280	BT_DBG("sock %p sk %p", sock, sk);
281
282	if (!haddr \|\| haddr->hci_family != AF_BLUETOOTH)
283	return -EINVAL;
284
285	lock_sock(sk);
286
287	if (hci_pi(sk)->hdev) {
288	err = -EALREADY;
289	goto done;
290	}
291
292	if (haddr->hci_dev != HCI_DEV_NONE) {
293	if (!(hdev = hci_dev_get(haddr->hci_dev))) {
294	err = -ENODEV;
295	goto done;
296	}
297
298	atomic_inc(&hdev->promisc);
299	}
300
301	hci_pi(sk)->hdev = hdev;
302	sk->sk_state = BT_BOUND;
303
304	done:
305	release_sock(sk);
306	return err;
307	}
308
309	static int hci_sock_getname(struct socket sock, struct sockaddr addr, int *addr_len, int peer)
310	{
311	struct sockaddr_hci haddr = (struct sockaddr_hci ) addr;
312	struct sock *sk = sock->sk;
313
314	BT_DBG("sock %p sk %p", sock, sk);
315
316	lock_sock(sk);
317
318	addr_len = sizeof(haddr);
319	haddr->hci_family = AF_BLUETOOTH;
320	haddr->hci_dev = hci_pi(sk)->hdev->id;
321
322	release_sock(sk);
323	return 0;
324	}
325
326	static inline void hci_sock_cmsg(struct sock sk, struct msghdr msg, struct sk_buff *skb)
327	{
328	__u32 mask = hci_pi(sk)->cmsg_mask;
329
0d48d939 MH	330	if (mask & HCI_CMSG_DIR) {
	331	int incoming = bt_cb(skb)->incoming;
	332	put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
	333	}
1da177e4 LT	334
	335	if (mask & HCI_CMSG_TSTAMP)
	336	put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, sizeof(skb->stamp), &skb->stamp);
	337	}
	338
	339	static int hci_sock_recvmsg(struct kiocb iocb, struct socket sock,
	340	struct msghdr *msg, size_t len, int flags)
	341	{
	342	int noblock = flags & MSG_DONTWAIT;
	343	struct sock *sk = sock->sk;
	344	struct sk_buff *skb;
	345	int copied, err;
	346
	347	BT_DBG("sock %p, sk %p", sock, sk);
	348
	349	if (flags & (MSG_OOB))
	350	return -EOPNOTSUPP;
	351
	352	if (sk->sk_state == BT_CLOSED)
	353	return 0;
	354
	355	if (!(skb = skb_recv_datagram(sk, flags, noblock, &err)))
	356	return err;
	357
	358	msg->msg_namelen = 0;
	359
	360	copied = skb->len;
	361	if (len < copied) {
	362	msg->msg_flags \|= MSG_TRUNC;
	363	copied = len;
	364	}
	365
	366	skb->h.raw = skb->data;
	367	err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
	368
	369	hci_sock_cmsg(sk, msg, skb);
	370
	371	skb_free_datagram(sk, skb);
	372
	373	return err ? : copied;
	374	}
	375
	376	static int hci_sock_sendmsg(struct kiocb iocb, struct socket sock,
	377	struct msghdr *msg, size_t len)
	378	{
	379	struct sock *sk = sock->sk;
	380	struct hci_dev *hdev;
	381	struct sk_buff *skb;
	382	int err;
	383
	384	BT_DBG("sock %p sk %p", sock, sk);
	385
	386	if (msg->msg_flags & MSG_OOB)
	387	return -EOPNOTSUPP;
	388
	389	if (msg->msg_flags & ~(MSG_DONTWAIT\|MSG_NOSIGNAL\|MSG_ERRQUEUE))
	390	return -EINVAL;
	391
	392	if (len < 4 \|\| len > HCI_MAX_FRAME_SIZE)
	393	return -EINVAL;
	394
	395	lock_sock(sk);
	396
	397	if (!(hdev = hci_pi(sk)->hdev)) {
398	err = -EBADFD;
399	goto done;
400	}
401
402	if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err)))
403	goto done;
404
405	if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
406	err = -EFAULT;
407	goto drop;
408	}
409
0d48d939	410	bt_cb(skb)->pkt_type = ((unsigned char ) skb->data);
1da177e4 LT	411	skb_pull(skb, 1);
	412	skb->dev = (void *) hdev;
	413
0d48d939	414	if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
1da177e4 LT	415	u16 opcode = __le16_to_cpu(get_unaligned((u16 *)skb->data));
	416	u16 ogf = hci_opcode_ogf(opcode);
	417	u16 ocf = hci_opcode_ocf(opcode);
	418
	419	if (((ogf > HCI_SFLT_MAX_OGF) \|\|
	420	!hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
	421	!capable(CAP_NET_RAW)) {
	422	err = -EPERM;
	423	goto drop;
	424	}
	425
	426	if (test_bit(HCI_RAW, &hdev->flags) \|\| (ogf == OGF_VENDOR_CMD)) {
	427	skb_queue_tail(&hdev->raw_q, skb);
	428	hci_sched_tx(hdev);
	429	} else {
	430	skb_queue_tail(&hdev->cmd_q, skb);
	431	hci_sched_cmd(hdev);
	432	}
	433	} else {
	434	if (!capable(CAP_NET_RAW)) {
	435	err = -EPERM;
	436	goto drop;
	437	}
	438
	439	skb_queue_tail(&hdev->raw_q, skb);
	440	hci_sched_tx(hdev);
	441	}
	442
	443	err = len;
	444
	445	done:
	446	release_sock(sk);
	447	return err;
	448
	449	drop:
	450	kfree_skb(skb);
	451	goto done;
	452	}
	453
	454	static int hci_sock_setsockopt(struct socket sock, int level, int optname, char __user optval, int len)
	455	{
	456	struct hci_ufilter uf = { .opcode = 0 };
	457	struct sock *sk = sock->sk;
	458	int err = 0, opt = 0;
	459
	460	BT_DBG("sk %p, opt %d", sk, optname);
	461
	462	lock_sock(sk);
	463
	464	switch (optname) {
	465	case HCI_DATA_DIR:
	466	if (get_user(opt, (int __user *)optval)) {
	467	err = -EFAULT;
	468	break;
	469	}
	470
	471	if (opt)
	472	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_DIR;
	473	else
	474	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
	475	break;
	476
	477	case HCI_TIME_STAMP:
	478	if (get_user(opt, (int __user *)optval)) {
479	err = -EFAULT;
480	break;
481	}
482
483	if (opt)
484	hci_pi(sk)->cmsg_mask \|= HCI_CMSG_TSTAMP;
485	else
486	hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
487	break;
488
489	case HCI_FILTER:
490	len = min_t(unsigned int, len, sizeof(uf));
491	if (copy_from_user(&uf, optval, len)) {
492	err = -EFAULT;
493	break;
494	}
495
496	if (!capable(CAP_NET_RAW)) {
497	uf.type_mask &= hci_sec_filter.type_mask;
498	uf.event_mask[0] &= ((u32 ) hci_sec_filter.event_mask + 0);
499	uf.event_mask[1] &= ((u32 ) hci_sec_filter.event_mask + 1);
500	}
501
502	{
503	struct hci_filter *f = &hci_pi(sk)->filter;
504
505	f->type_mask = uf.type_mask;
506	f->opcode = uf.opcode;
507	((u32 ) f->event_mask + 0) = uf.event_mask[0];
508	((u32 ) f->event_mask + 1) = uf.event_mask[1];
509	}
510	break;
511
512	default:
513	err = -ENOPROTOOPT;
514	break;
515	}
516
517	release_sock(sk);
518	return err;
519	}
520
521	static int hci_sock_getsockopt(struct socket sock, int level, int optname, char __user optval, int __user *optlen)
522	{
523	struct hci_ufilter uf;
524	struct sock *sk = sock->sk;
525	int len, opt;
526
527	if (get_user(len, optlen))
528	return -EFAULT;
529
530	switch (optname) {
531	case HCI_DATA_DIR:
532	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
533	opt = 1;
534	else
535	opt = 0;
536
537	if (put_user(opt, optval))
538	return -EFAULT;
539	break;
540
541	case HCI_TIME_STAMP:
542	if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
543	opt = 1;
544	else
545	opt = 0;
546
547	if (put_user(opt, optval))
548	return -EFAULT;
549	break;
550
551	case HCI_FILTER:
552	{
553	struct hci_filter *f = &hci_pi(sk)->filter;
554
555	uf.type_mask = f->type_mask;
556	uf.opcode = f->opcode;
557	uf.event_mask[0] = ((u32 ) f->event_mask + 0);
558	uf.event_mask[1] = ((u32 ) f->event_mask + 1);
559	}
560
561	len = min_t(unsigned int, len, sizeof(uf));
562	if (copy_to_user(optval, &uf, len))
563	return -EFAULT;
564	break;
565
566	default:
567	return -ENOPROTOOPT;
568	break;
569	}
570
571	return 0;
572	}
573
574	static struct proto_ops hci_sock_ops = {
575	.family = PF_BLUETOOTH,
576	.owner = THIS_MODULE,
577	.release = hci_sock_release,
578	.bind = hci_sock_bind,
579	.getname = hci_sock_getname,
580	.sendmsg = hci_sock_sendmsg,
581	.recvmsg = hci_sock_recvmsg,
582	.ioctl = hci_sock_ioctl,
583	.poll = datagram_poll,
584	.listen = sock_no_listen,
585	.shutdown = sock_no_shutdown,
586	.setsockopt = hci_sock_setsockopt,
587	.getsockopt = hci_sock_getsockopt,
588	.connect = sock_no_connect,
589	.socketpair = sock_no_socketpair,
590	.accept = sock_no_accept,
591	.mmap = sock_no_mmap
592	};
593
594	static struct proto hci_sk_proto = {
595	.name = "HCI",
596	.owner = THIS_MODULE,
597	.obj_size = sizeof(struct hci_pinfo)
598	};
599
600	static int hci_sock_create(struct socket *sock, int protocol)
601	{
602	struct sock *sk;
603
604	BT_DBG("sock %p", sock);
605
606	if (sock->type != SOCK_RAW)
607	return -ESOCKTNOSUPPORT;
608
609	sock->ops = &hci_sock_ops;
610
611	sk = sk_alloc(PF_BLUETOOTH, GFP_KERNEL, &hci_sk_proto, 1);
612	if (!sk)
613	return -ENOMEM;
614
615	sock_init_data(sock, sk);
616
617	sock_reset_flag(sk, SOCK_ZAPPED);
618
619	sk->sk_protocol = protocol;
620
621	sock->state = SS_UNCONNECTED;
622	sk->sk_state = BT_OPEN;
623
624	bt_sock_link(&hci_sk_list, sk);
625	return 0;
626	}
627
628	static int hci_sock_dev_event(struct notifier_block this, unsigned long event, void ptr)
629	{
630	struct hci_dev hdev = (struct hci_dev ) ptr;
631	struct hci_ev_si_device ev;
632
633	BT_DBG("hdev %s event %ld", hdev->name, event);
634
635	/* Send event to sockets */
636	ev.event = event;
637	ev.dev_id = hdev->id;
638	hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
639
640	if (event == HCI_DEV_UNREG) {
641	struct sock *sk;
642	struct hlist_node *node;
643
644	/* Detach sockets from device */
645	read_lock(&hci_sk_list.lock);
646	sk_for_each(sk, node, &hci_sk_list.head) {
647	bh_lock_sock(sk);
648	if (hci_pi(sk)->hdev == hdev) {
649	hci_pi(sk)->hdev = NULL;
650	sk->sk_err = EPIPE;
651	sk->sk_state = BT_OPEN;
652	sk->sk_state_change(sk);
653
654	hci_dev_put(hdev);
655	}
656	bh_unlock_sock(sk);
657	}
658	read_unlock(&hci_sk_list.lock);
659	}
660
661	return NOTIFY_DONE;
662	}
663
664	static struct net_proto_family hci_sock_family_ops = {
665	.family = PF_BLUETOOTH,
666	.owner = THIS_MODULE,
667	.create = hci_sock_create,
668	};
669
670	static struct notifier_block hci_sock_nblock = {
671	.notifier_call = hci_sock_dev_event
672	};
673
674	int __init hci_sock_init(void)
675	{
676	int err;
677
678	err = proto_register(&hci_sk_proto, 0);
679	if (err < 0)
680	return err;
681
682	err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
683	if (err < 0)
684	goto error;
685
686	hci_register_notifier(&hci_sock_nblock);
687
688	BT_INFO("HCI socket layer initialized");
689
690	return 0;
691
692	error:
693	BT_ERR("HCI socket registration failed");
694	proto_unregister(&hci_sk_proto);
695	return err;
696	}
697
698	int __exit hci_sock_cleanup(void)
699	{
700	if (bt_sock_unregister(BTPROTO_HCI) < 0)
701	BT_ERR("HCI socket unregistration failed");
702
703	hci_unregister_notifier(&hci_sock_nblock);
704
705	proto_unregister(&hci_sk_proto);
706
707	return 0;
708	}