2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI sockets. */
27 #include <linux/module.h>
29 #include <linux/types.h>
30 #include <linux/capability.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/slab.h>
34 #include <linux/poll.h>
35 #include <linux/fcntl.h>
36 #include <linux/init.h>
37 #include <linux/skbuff.h>
38 #include <linux/workqueue.h>
39 #include <linux/interrupt.h>
40 #include <linux/compat.h>
41 #include <linux/socket.h>
42 #include <linux/ioctl.h>
45 #include <asm/system.h>
46 #include <linux/uaccess.h>
47 #include <asm/unaligned.h>
49 #include <net/bluetooth/bluetooth.h>
50 #include <net/bluetooth/hci_core.h>
52 static bool enable_mgmt
;
54 /* ----- HCI socket interface ----- */
56 static inline int hci_test_bit(int nr
, void *addr
)
58 return *((__u32
*) addr
+ (nr
>> 5)) & ((__u32
) 1 << (nr
& 31));
62 static struct hci_sec_filter hci_sec_filter
= {
66 { 0x1000d9fe, 0x0000b00c },
71 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
73 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
75 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
77 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
78 /* OGF_STATUS_PARAM */
79 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
83 static struct bt_sock_list hci_sk_list
= {
84 .lock
= __RW_LOCK_UNLOCKED(hci_sk_list
.lock
)
87 /* Send frame to RAW socket */
88 void hci_send_to_sock(struct hci_dev
*hdev
, struct sk_buff
*skb
)
91 struct hlist_node
*node
;
92 struct sk_buff
*skb_copy
= NULL
;
94 BT_DBG("hdev %p len %d", hdev
, skb
->len
);
96 read_lock(&hci_sk_list
.lock
);
98 sk_for_each(sk
, node
, &hci_sk_list
.head
) {
99 struct hci_filter
*flt
;
100 struct sk_buff
*nskb
;
102 if (sk
->sk_state
!= BT_BOUND
|| hci_pi(sk
)->hdev
!= hdev
)
105 /* Don't send frame to the socket it came from */
109 if (hci_pi(sk
)->channel
!= HCI_CHANNEL_RAW
)
113 flt
= &hci_pi(sk
)->filter
;
115 if (!test_bit((bt_cb(skb
)->pkt_type
== HCI_VENDOR_PKT
) ?
116 0 : (bt_cb(skb
)->pkt_type
& HCI_FLT_TYPE_BITS
), &flt
->type_mask
))
119 if (bt_cb(skb
)->pkt_type
== HCI_EVENT_PKT
) {
120 register int evt
= (*(__u8
*)skb
->data
& HCI_FLT_EVENT_BITS
);
122 if (!hci_test_bit(evt
, &flt
->event_mask
))
126 ((evt
== HCI_EV_CMD_COMPLETE
&&
128 get_unaligned((__le16
*)(skb
->data
+ 3))) ||
129 (evt
== HCI_EV_CMD_STATUS
&&
131 get_unaligned((__le16
*)(skb
->data
+ 4)))))
136 /* Create a private copy with headroom */
137 skb_copy
= __pskb_copy(skb
, 1, GFP_ATOMIC
);
141 /* Put type byte before the data */
142 memcpy(skb_push(skb_copy
, 1), &bt_cb(skb
)->pkt_type
, 1);
145 nskb
= skb_clone(skb_copy
, GFP_ATOMIC
);
149 if (sock_queue_rcv_skb(sk
, nskb
))
153 read_unlock(&hci_sk_list
.lock
);
158 /* Send frame to control socket */
159 void hci_send_to_control(struct sk_buff
*skb
, struct sock
*skip_sk
)
162 struct hlist_node
*node
;
164 BT_DBG("len %d", skb
->len
);
166 read_lock(&hci_sk_list
.lock
);
168 sk_for_each(sk
, node
, &hci_sk_list
.head
) {
169 struct sk_buff
*nskb
;
171 /* Skip the original socket */
175 if (sk
->sk_state
!= BT_BOUND
)
178 if (hci_pi(sk
)->channel
!= HCI_CHANNEL_CONTROL
)
181 nskb
= skb_clone(skb
, GFP_ATOMIC
);
185 if (sock_queue_rcv_skb(sk
, nskb
))
189 read_unlock(&hci_sk_list
.lock
);
192 static int hci_sock_release(struct socket
*sock
)
194 struct sock
*sk
= sock
->sk
;
195 struct hci_dev
*hdev
;
197 BT_DBG("sock %p sk %p", sock
, sk
);
202 hdev
= hci_pi(sk
)->hdev
;
204 bt_sock_unlink(&hci_sk_list
, sk
);
207 atomic_dec(&hdev
->promisc
);
213 skb_queue_purge(&sk
->sk_receive_queue
);
214 skb_queue_purge(&sk
->sk_write_queue
);
220 static int hci_sock_blacklist_add(struct hci_dev
*hdev
, void __user
*arg
)
225 if (copy_from_user(&bdaddr
, arg
, sizeof(bdaddr
)))
230 err
= hci_blacklist_add(hdev
, &bdaddr
, 0);
232 hci_dev_unlock(hdev
);
237 static int hci_sock_blacklist_del(struct hci_dev
*hdev
, void __user
*arg
)
242 if (copy_from_user(&bdaddr
, arg
, sizeof(bdaddr
)))
247 err
= hci_blacklist_del(hdev
, &bdaddr
, 0);
249 hci_dev_unlock(hdev
);
254 /* Ioctls that require bound socket */
255 static inline int hci_sock_bound_ioctl(struct sock
*sk
, unsigned int cmd
, unsigned long arg
)
257 struct hci_dev
*hdev
= hci_pi(sk
)->hdev
;
264 if (!capable(CAP_NET_ADMIN
))
267 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &hdev
->quirks
))
271 set_bit(HCI_RAW
, &hdev
->flags
);
273 clear_bit(HCI_RAW
, &hdev
->flags
);
278 return hci_get_conn_info(hdev
, (void __user
*) arg
);
281 return hci_get_auth_info(hdev
, (void __user
*) arg
);
284 if (!capable(CAP_NET_ADMIN
))
286 return hci_sock_blacklist_add(hdev
, (void __user
*) arg
);
289 if (!capable(CAP_NET_ADMIN
))
291 return hci_sock_blacklist_del(hdev
, (void __user
*) arg
);
295 return hdev
->ioctl(hdev
, cmd
, arg
);
300 static int hci_sock_ioctl(struct socket
*sock
, unsigned int cmd
, unsigned long arg
)
302 struct sock
*sk
= sock
->sk
;
303 void __user
*argp
= (void __user
*) arg
;
306 BT_DBG("cmd %x arg %lx", cmd
, arg
);
310 return hci_get_dev_list(argp
);
313 return hci_get_dev_info(argp
);
316 return hci_get_conn_list(argp
);
319 if (!capable(CAP_NET_ADMIN
))
321 return hci_dev_open(arg
);
324 if (!capable(CAP_NET_ADMIN
))
326 return hci_dev_close(arg
);
329 if (!capable(CAP_NET_ADMIN
))
331 return hci_dev_reset(arg
);
334 if (!capable(CAP_NET_ADMIN
))
336 return hci_dev_reset_stat(arg
);
346 if (!capable(CAP_NET_ADMIN
))
348 return hci_dev_cmd(cmd
, argp
);
351 return hci_inquiry(argp
);
355 err
= hci_sock_bound_ioctl(sk
, cmd
, arg
);
361 static int hci_sock_bind(struct socket
*sock
, struct sockaddr
*addr
, int addr_len
)
363 struct sockaddr_hci haddr
;
364 struct sock
*sk
= sock
->sk
;
365 struct hci_dev
*hdev
= NULL
;
368 BT_DBG("sock %p sk %p", sock
, sk
);
373 memset(&haddr
, 0, sizeof(haddr
));
374 len
= min_t(unsigned int, sizeof(haddr
), addr_len
);
375 memcpy(&haddr
, addr
, len
);
377 if (haddr
.hci_family
!= AF_BLUETOOTH
)
382 if (sk
->sk_state
== BT_BOUND
) {
387 switch (haddr
.hci_channel
) {
388 case HCI_CHANNEL_RAW
:
389 if (hci_pi(sk
)->hdev
) {
394 if (haddr
.hci_dev
!= HCI_DEV_NONE
) {
395 hdev
= hci_dev_get(haddr
.hci_dev
);
401 atomic_inc(&hdev
->promisc
);
404 hci_pi(sk
)->hdev
= hdev
;
407 case HCI_CHANNEL_CONTROL
:
408 if (haddr
.hci_dev
!= HCI_DEV_NONE
|| !enable_mgmt
) {
413 set_bit(HCI_PI_MGMT_INIT
, &hci_pi(sk
)->flags
);
422 hci_pi(sk
)->channel
= haddr
.hci_channel
;
423 sk
->sk_state
= BT_BOUND
;
430 static int hci_sock_getname(struct socket
*sock
, struct sockaddr
*addr
, int *addr_len
, int peer
)
432 struct sockaddr_hci
*haddr
= (struct sockaddr_hci
*) addr
;
433 struct sock
*sk
= sock
->sk
;
434 struct hci_dev
*hdev
= hci_pi(sk
)->hdev
;
436 BT_DBG("sock %p sk %p", sock
, sk
);
443 *addr_len
= sizeof(*haddr
);
444 haddr
->hci_family
= AF_BLUETOOTH
;
445 haddr
->hci_dev
= hdev
->id
;
451 static inline void hci_sock_cmsg(struct sock
*sk
, struct msghdr
*msg
, struct sk_buff
*skb
)
453 __u32 mask
= hci_pi(sk
)->cmsg_mask
;
455 if (mask
& HCI_CMSG_DIR
) {
456 int incoming
= bt_cb(skb
)->incoming
;
457 put_cmsg(msg
, SOL_HCI
, HCI_CMSG_DIR
, sizeof(incoming
), &incoming
);
460 if (mask
& HCI_CMSG_TSTAMP
) {
462 struct compat_timeval ctv
;
468 skb_get_timestamp(skb
, &tv
);
473 if (msg
->msg_flags
& MSG_CMSG_COMPAT
) {
474 ctv
.tv_sec
= tv
.tv_sec
;
475 ctv
.tv_usec
= tv
.tv_usec
;
481 put_cmsg(msg
, SOL_HCI
, HCI_CMSG_TSTAMP
, len
, data
);
485 static int hci_sock_recvmsg(struct kiocb
*iocb
, struct socket
*sock
,
486 struct msghdr
*msg
, size_t len
, int flags
)
488 int noblock
= flags
& MSG_DONTWAIT
;
489 struct sock
*sk
= sock
->sk
;
493 BT_DBG("sock %p, sk %p", sock
, sk
);
495 if (flags
& (MSG_OOB
))
498 if (sk
->sk_state
== BT_CLOSED
)
501 skb
= skb_recv_datagram(sk
, flags
, noblock
, &err
);
505 msg
->msg_namelen
= 0;
509 msg
->msg_flags
|= MSG_TRUNC
;
513 skb_reset_transport_header(skb
);
514 err
= skb_copy_datagram_iovec(skb
, 0, msg
->msg_iov
, copied
);
516 switch (hci_pi(sk
)->channel
) {
517 case HCI_CHANNEL_RAW
:
518 hci_sock_cmsg(sk
, msg
, skb
);
522 skb_free_datagram(sk
, skb
);
524 return err
? : copied
;
527 static int hci_sock_sendmsg(struct kiocb
*iocb
, struct socket
*sock
,
528 struct msghdr
*msg
, size_t len
)
530 struct sock
*sk
= sock
->sk
;
531 struct hci_dev
*hdev
;
535 BT_DBG("sock %p sk %p", sock
, sk
);
537 if (msg
->msg_flags
& MSG_OOB
)
540 if (msg
->msg_flags
& ~(MSG_DONTWAIT
|MSG_NOSIGNAL
|MSG_ERRQUEUE
))
543 if (len
< 4 || len
> HCI_MAX_FRAME_SIZE
)
548 switch (hci_pi(sk
)->channel
) {
549 case HCI_CHANNEL_RAW
:
551 case HCI_CHANNEL_CONTROL
:
552 err
= mgmt_control(sk
, msg
, len
);
559 hdev
= hci_pi(sk
)->hdev
;
565 if (!test_bit(HCI_UP
, &hdev
->flags
)) {
570 skb
= bt_skb_send_alloc(sk
, len
, msg
->msg_flags
& MSG_DONTWAIT
, &err
);
574 if (memcpy_fromiovec(skb_put(skb
, len
), msg
->msg_iov
, len
)) {
579 bt_cb(skb
)->pkt_type
= *((unsigned char *) skb
->data
);
581 skb
->dev
= (void *) hdev
;
583 if (bt_cb(skb
)->pkt_type
== HCI_COMMAND_PKT
) {
584 u16 opcode
= get_unaligned_le16(skb
->data
);
585 u16 ogf
= hci_opcode_ogf(opcode
);
586 u16 ocf
= hci_opcode_ocf(opcode
);
588 if (((ogf
> HCI_SFLT_MAX_OGF
) ||
589 !hci_test_bit(ocf
& HCI_FLT_OCF_BITS
, &hci_sec_filter
.ocf_mask
[ogf
])) &&
590 !capable(CAP_NET_RAW
)) {
595 if (test_bit(HCI_RAW
, &hdev
->flags
) || (ogf
== 0x3f)) {
596 skb_queue_tail(&hdev
->raw_q
, skb
);
597 queue_work(hdev
->workqueue
, &hdev
->tx_work
);
599 skb_queue_tail(&hdev
->cmd_q
, skb
);
600 queue_work(hdev
->workqueue
, &hdev
->cmd_work
);
603 if (!capable(CAP_NET_RAW
)) {
608 skb_queue_tail(&hdev
->raw_q
, skb
);
609 queue_work(hdev
->workqueue
, &hdev
->tx_work
);
623 static int hci_sock_setsockopt(struct socket
*sock
, int level
, int optname
, char __user
*optval
, unsigned int len
)
625 struct hci_ufilter uf
= { .opcode
= 0 };
626 struct sock
*sk
= sock
->sk
;
627 int err
= 0, opt
= 0;
629 BT_DBG("sk %p, opt %d", sk
, optname
);
633 if (hci_pi(sk
)->channel
!= HCI_CHANNEL_RAW
) {
640 if (get_user(opt
, (int __user
*)optval
)) {
646 hci_pi(sk
)->cmsg_mask
|= HCI_CMSG_DIR
;
648 hci_pi(sk
)->cmsg_mask
&= ~HCI_CMSG_DIR
;
652 if (get_user(opt
, (int __user
*)optval
)) {
658 hci_pi(sk
)->cmsg_mask
|= HCI_CMSG_TSTAMP
;
660 hci_pi(sk
)->cmsg_mask
&= ~HCI_CMSG_TSTAMP
;
665 struct hci_filter
*f
= &hci_pi(sk
)->filter
;
667 uf
.type_mask
= f
->type_mask
;
668 uf
.opcode
= f
->opcode
;
669 uf
.event_mask
[0] = *((u32
*) f
->event_mask
+ 0);
670 uf
.event_mask
[1] = *((u32
*) f
->event_mask
+ 1);
673 len
= min_t(unsigned int, len
, sizeof(uf
));
674 if (copy_from_user(&uf
, optval
, len
)) {
679 if (!capable(CAP_NET_RAW
)) {
680 uf
.type_mask
&= hci_sec_filter
.type_mask
;
681 uf
.event_mask
[0] &= *((u32
*) hci_sec_filter
.event_mask
+ 0);
682 uf
.event_mask
[1] &= *((u32
*) hci_sec_filter
.event_mask
+ 1);
686 struct hci_filter
*f
= &hci_pi(sk
)->filter
;
688 f
->type_mask
= uf
.type_mask
;
689 f
->opcode
= uf
.opcode
;
690 *((u32
*) f
->event_mask
+ 0) = uf
.event_mask
[0];
691 *((u32
*) f
->event_mask
+ 1) = uf
.event_mask
[1];
705 static int hci_sock_getsockopt(struct socket
*sock
, int level
, int optname
, char __user
*optval
, int __user
*optlen
)
707 struct hci_ufilter uf
;
708 struct sock
*sk
= sock
->sk
;
709 int len
, opt
, err
= 0;
711 BT_DBG("sk %p, opt %d", sk
, optname
);
713 if (get_user(len
, optlen
))
718 if (hci_pi(sk
)->channel
!= HCI_CHANNEL_RAW
) {
725 if (hci_pi(sk
)->cmsg_mask
& HCI_CMSG_DIR
)
730 if (put_user(opt
, optval
))
735 if (hci_pi(sk
)->cmsg_mask
& HCI_CMSG_TSTAMP
)
740 if (put_user(opt
, optval
))
746 struct hci_filter
*f
= &hci_pi(sk
)->filter
;
748 uf
.type_mask
= f
->type_mask
;
749 uf
.opcode
= f
->opcode
;
750 uf
.event_mask
[0] = *((u32
*) f
->event_mask
+ 0);
751 uf
.event_mask
[1] = *((u32
*) f
->event_mask
+ 1);
754 len
= min_t(unsigned int, len
, sizeof(uf
));
755 if (copy_to_user(optval
, &uf
, len
))
769 static const struct proto_ops hci_sock_ops
= {
770 .family
= PF_BLUETOOTH
,
771 .owner
= THIS_MODULE
,
772 .release
= hci_sock_release
,
773 .bind
= hci_sock_bind
,
774 .getname
= hci_sock_getname
,
775 .sendmsg
= hci_sock_sendmsg
,
776 .recvmsg
= hci_sock_recvmsg
,
777 .ioctl
= hci_sock_ioctl
,
778 .poll
= datagram_poll
,
779 .listen
= sock_no_listen
,
780 .shutdown
= sock_no_shutdown
,
781 .setsockopt
= hci_sock_setsockopt
,
782 .getsockopt
= hci_sock_getsockopt
,
783 .connect
= sock_no_connect
,
784 .socketpair
= sock_no_socketpair
,
785 .accept
= sock_no_accept
,
789 static struct proto hci_sk_proto
= {
791 .owner
= THIS_MODULE
,
792 .obj_size
= sizeof(struct hci_pinfo
)
795 static int hci_sock_create(struct net
*net
, struct socket
*sock
, int protocol
,
800 BT_DBG("sock %p", sock
);
802 if (sock
->type
!= SOCK_RAW
)
803 return -ESOCKTNOSUPPORT
;
805 sock
->ops
= &hci_sock_ops
;
807 sk
= sk_alloc(net
, PF_BLUETOOTH
, GFP_ATOMIC
, &hci_sk_proto
);
811 sock_init_data(sock
, sk
);
813 sock_reset_flag(sk
, SOCK_ZAPPED
);
815 sk
->sk_protocol
= protocol
;
817 sock
->state
= SS_UNCONNECTED
;
818 sk
->sk_state
= BT_OPEN
;
820 bt_sock_link(&hci_sk_list
, sk
);
824 static int hci_sock_dev_event(struct notifier_block
*this, unsigned long event
, void *ptr
)
826 struct hci_dev
*hdev
= (struct hci_dev
*) ptr
;
827 struct hci_ev_si_device ev
;
829 BT_DBG("hdev %s event %ld", hdev
->name
, event
);
831 /* Send event to sockets */
833 ev
.dev_id
= hdev
->id
;
834 hci_si_event(NULL
, HCI_EV_SI_DEVICE
, sizeof(ev
), &ev
);
836 if (event
== HCI_DEV_UNREG
) {
838 struct hlist_node
*node
;
840 /* Detach sockets from device */
841 read_lock(&hci_sk_list
.lock
);
842 sk_for_each(sk
, node
, &hci_sk_list
.head
) {
843 bh_lock_sock_nested(sk
);
844 if (hci_pi(sk
)->hdev
== hdev
) {
845 hci_pi(sk
)->hdev
= NULL
;
847 sk
->sk_state
= BT_OPEN
;
848 sk
->sk_state_change(sk
);
854 read_unlock(&hci_sk_list
.lock
);
860 static const struct net_proto_family hci_sock_family_ops
= {
861 .family
= PF_BLUETOOTH
,
862 .owner
= THIS_MODULE
,
863 .create
= hci_sock_create
,
866 static struct notifier_block hci_sock_nblock
= {
867 .notifier_call
= hci_sock_dev_event
870 int __init
hci_sock_init(void)
874 err
= proto_register(&hci_sk_proto
, 0);
878 err
= bt_sock_register(BTPROTO_HCI
, &hci_sock_family_ops
);
882 hci_register_notifier(&hci_sock_nblock
);
884 BT_INFO("HCI socket layer initialized");
889 BT_ERR("HCI socket registration failed");
890 proto_unregister(&hci_sk_proto
);
894 void hci_sock_cleanup(void)
896 if (bt_sock_unregister(BTPROTO_HCI
) < 0)
897 BT_ERR("HCI socket unregistration failed");
899 hci_unregister_notifier(&hci_sock_nblock
);
901 proto_unregister(&hci_sk_proto
);
904 module_param(enable_mgmt
, bool, 0644);
905 MODULE_PARM_DESC(enable_mgmt
, "Enable Management interface");