~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/bluetooth/hci_sock.c

Version: ~ [ linux-4.19-rc7 ] ~ [ linux-4.18.12 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.74 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.131 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.159 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.123 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.59 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.31.14 ] ~ [ linux-2.6.30.10 ] ~ [ linux-2.6.29.6 ] ~ [ linux-2.6.28.10 ] ~ [ linux-2.6.27.62 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2    BlueZ - Bluetooth protocol stack for Linux
  3    Copyright (C) 2000-2001 Qualcomm Incorporated
  4 
  5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  6 
  7    This program is free software; you can redistribute it and/or modify
  8    it under the terms of the GNU General Public License version 2 as
  9    published by the Free Software Foundation;
 10 
 11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
 15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
 16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 19 
 20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
 21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
 22    SOFTWARE IS DISCLAIMED.
 23 */
 24 
 25 /* Bluetooth HCI sockets. */
 26 
 27 #include <linux/export.h>
 28 #include <linux/utsname.h>
 29 #include <linux/sched.h>
 30 #include <asm/unaligned.h>
 31 
 32 #include <net/bluetooth/bluetooth.h>
 33 #include <net/bluetooth/hci_core.h>
 34 #include <net/bluetooth/hci_mon.h>
 35 #include <net/bluetooth/mgmt.h>
 36 
 37 #include "mgmt_util.h"
 38 
 39 static LIST_HEAD(mgmt_chan_list);
 40 static DEFINE_MUTEX(mgmt_chan_list_lock);
 41 
 42 static DEFINE_IDA(sock_cookie_ida);
 43 
 44 static atomic_t monitor_promisc = ATOMIC_INIT(0);
 45 
 46 /* ----- HCI socket interface ----- */
 47 
 48 /* Socket info */
 49 #define hci_pi(sk) ((struct hci_pinfo *) sk)
 50 
 51 struct hci_pinfo {
 52         struct bt_sock    bt;
 53         struct hci_dev    *hdev;
 54         struct hci_filter filter;
 55         __u32             cmsg_mask;
 56         unsigned short    channel;
 57         unsigned long     flags;
 58         __u32             cookie;
 59         char              comm[TASK_COMM_LEN];
 60 };
 61 
 62 void hci_sock_set_flag(struct sock *sk, int nr)
 63 {
 64         set_bit(nr, &hci_pi(sk)->flags);
 65 }
 66 
 67 void hci_sock_clear_flag(struct sock *sk, int nr)
 68 {
 69         clear_bit(nr, &hci_pi(sk)->flags);
 70 }
 71 
 72 int hci_sock_test_flag(struct sock *sk, int nr)
 73 {
 74         return test_bit(nr, &hci_pi(sk)->flags);
 75 }
 76 
 77 unsigned short hci_sock_get_channel(struct sock *sk)
 78 {
 79         return hci_pi(sk)->channel;
 80 }
 81 
 82 u32 hci_sock_get_cookie(struct sock *sk)
 83 {
 84         return hci_pi(sk)->cookie;
 85 }
 86 
 87 static bool hci_sock_gen_cookie(struct sock *sk)
 88 {
 89         int id = hci_pi(sk)->cookie;
 90 
 91         if (!id) {
 92                 id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL);
 93                 if (id < 0)
 94                         id = 0xffffffff;
 95 
 96                 hci_pi(sk)->cookie = id;
 97                 get_task_comm(hci_pi(sk)->comm, current);
 98                 return true;
 99         }
100 
101         return false;
102 }
103 
104 static void hci_sock_free_cookie(struct sock *sk)
105 {
106         int id = hci_pi(sk)->cookie;
107 
108         if (id) {
109                 hci_pi(sk)->cookie = 0xffffffff;
110                 ida_simple_remove(&sock_cookie_ida, id);
111         }
112 }
113 
114 static inline int hci_test_bit(int nr, const void *addr)
115 {
116         return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
117 }
118 
119 /* Security filter */
120 #define HCI_SFLT_MAX_OGF  5
121 
122 struct hci_sec_filter {
123         __u32 type_mask;
124         __u32 event_mask[2];
125         __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
126 };
127 
128 static const struct hci_sec_filter hci_sec_filter = {
129         /* Packet types */
130         0x10,
131         /* Events */
132         { 0x1000d9fe, 0x0000b00c },
133         /* Commands */
134         {
135                 { 0x0 },
136                 /* OGF_LINK_CTL */
137                 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
138                 /* OGF_LINK_POLICY */
139                 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
140                 /* OGF_HOST_CTL */
141                 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
142                 /* OGF_INFO_PARAM */
143                 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
144                 /* OGF_STATUS_PARAM */
145                 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
146         }
147 };
148 
149 static struct bt_sock_list hci_sk_list = {
150         .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
151 };
152 
153 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
154 {
155         struct hci_filter *flt;
156         int flt_type, flt_event;
157 
158         /* Apply filter */
159         flt = &hci_pi(sk)->filter;
160 
161         flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS;
162 
163         if (!test_bit(flt_type, &flt->type_mask))
164                 return true;
165 
166         /* Extra filter for event packets only */
167         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT)
168                 return false;
169 
170         flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
171 
172         if (!hci_test_bit(flt_event, &flt->event_mask))
173                 return true;
174 
175         /* Check filter only when opcode is set */
176         if (!flt->opcode)
177                 return false;
178 
179         if (flt_event == HCI_EV_CMD_COMPLETE &&
180             flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
181                 return true;
182 
183         if (flt_event == HCI_EV_CMD_STATUS &&
184             flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
185                 return true;
186 
187         return false;
188 }
189 
190 /* Send frame to RAW socket */
191 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
192 {
193         struct sock *sk;
194         struct sk_buff *skb_copy = NULL;
195 
196         BT_DBG("hdev %p len %d", hdev, skb->len);
197 
198         read_lock(&hci_sk_list.lock);
199 
200         sk_for_each(sk, &hci_sk_list.head) {
201                 struct sk_buff *nskb;
202 
203                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
204                         continue;
205 
206                 /* Don't send frame to the socket it came from */
207                 if (skb->sk == sk)
208                         continue;
209 
210                 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
211                         if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
212                             hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
213                             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
214                             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT)
215                                 continue;
216                         if (is_filtered_packet(sk, skb))
217                                 continue;
218                 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
219                         if (!bt_cb(skb)->incoming)
220                                 continue;
221                         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
222                             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
223                             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT)
224                                 continue;
225                 } else {
226                         /* Don't send frame to other channel types */
227                         continue;
228                 }
229 
230                 if (!skb_copy) {
231                         /* Create a private copy with headroom */
232                         skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
233                         if (!skb_copy)
234                                 continue;
235 
236                         /* Put type byte before the data */
237                         memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1);
238                 }
239 
240                 nskb = skb_clone(skb_copy, GFP_ATOMIC);
241                 if (!nskb)
242                         continue;
243 
244                 if (sock_queue_rcv_skb(sk, nskb))
245                         kfree_skb(nskb);
246         }
247 
248         read_unlock(&hci_sk_list.lock);
249 
250         kfree_skb(skb_copy);
251 }
252 
253 /* Send frame to sockets with specific channel */
254 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
255                                   int flag, struct sock *skip_sk)
256 {
257         struct sock *sk;
258 
259         BT_DBG("channel %u len %d", channel, skb->len);
260 
261         sk_for_each(sk, &hci_sk_list.head) {
262                 struct sk_buff *nskb;
263 
264                 /* Ignore socket without the flag set */
265                 if (!hci_sock_test_flag(sk, flag))
266                         continue;
267 
268                 /* Skip the original socket */
269                 if (sk == skip_sk)
270                         continue;
271 
272                 if (sk->sk_state != BT_BOUND)
273                         continue;
274 
275                 if (hci_pi(sk)->channel != channel)
276                         continue;
277 
278                 nskb = skb_clone(skb, GFP_ATOMIC);
279                 if (!nskb)
280                         continue;
281 
282                 if (sock_queue_rcv_skb(sk, nskb))
283                         kfree_skb(nskb);
284         }
285 
286 }
287 
288 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
289                          int flag, struct sock *skip_sk)
290 {
291         read_lock(&hci_sk_list.lock);
292         __hci_send_to_channel(channel, skb, flag, skip_sk);
293         read_unlock(&hci_sk_list.lock);
294 }
295 
296 /* Send frame to monitor socket */
297 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
298 {
299         struct sk_buff *skb_copy = NULL;
300         struct hci_mon_hdr *hdr;
301         __le16 opcode;
302 
303         if (!atomic_read(&monitor_promisc))
304                 return;
305 
306         BT_DBG("hdev %p len %d", hdev, skb->len);
307 
308         switch (hci_skb_pkt_type(skb)) {
309         case HCI_COMMAND_PKT:
310                 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
311                 break;
312         case HCI_EVENT_PKT:
313                 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
314                 break;
315         case HCI_ACLDATA_PKT:
316                 if (bt_cb(skb)->incoming)
317                         opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
318                 else
319                         opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
320                 break;
321         case HCI_SCODATA_PKT:
322                 if (bt_cb(skb)->incoming)
323                         opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
324                 else
325                         opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
326                 break;
327         case HCI_DIAG_PKT:
328                 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG);
329                 break;
330         default:
331                 return;
332         }
333 
334         /* Create a private copy with headroom */
335         skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true);
336         if (!skb_copy)
337                 return;
338 
339         /* Put header before the data */
340         hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE);
341         hdr->opcode = opcode;
342         hdr->index = cpu_to_le16(hdev->id);
343         hdr->len = cpu_to_le16(skb->len);
344 
345         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy,
346                             HCI_SOCK_TRUSTED, NULL);
347         kfree_skb(skb_copy);
348 }
349 
350 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event,
351                                  void *data, u16 data_len, ktime_t tstamp,
352                                  int flag, struct sock *skip_sk)
353 {
354         struct sock *sk;
355         __le16 index;
356 
357         if (hdev)
358                 index = cpu_to_le16(hdev->id);
359         else
360                 index = cpu_to_le16(MGMT_INDEX_NONE);
361 
362         read_lock(&hci_sk_list.lock);
363 
364         sk_for_each(sk, &hci_sk_list.head) {
365                 struct hci_mon_hdr *hdr;
366                 struct sk_buff *skb;
367 
368                 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL)
369                         continue;
370 
371                 /* Ignore socket without the flag set */
372                 if (!hci_sock_test_flag(sk, flag))
373                         continue;
374 
375                 /* Skip the original socket */
376                 if (sk == skip_sk)
377                         continue;
378 
379                 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC);
380                 if (!skb)
381                         continue;
382 
383                 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
384                 put_unaligned_le16(event, skb_put(skb, 2));
385 
386                 if (data)
387                         skb_put_data(skb, data, data_len);
388 
389                 skb->tstamp = tstamp;
390 
391                 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
392                 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT);
393                 hdr->index = index;
394                 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
395 
396                 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
397                                       HCI_SOCK_TRUSTED, NULL);
398                 kfree_skb(skb);
399         }
400 
401         read_unlock(&hci_sk_list.lock);
402 }
403 
404 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
405 {
406         struct hci_mon_hdr *hdr;
407         struct hci_mon_new_index *ni;
408         struct hci_mon_index_info *ii;
409         struct sk_buff *skb;
410         __le16 opcode;
411 
412         switch (event) {
413         case HCI_DEV_REG:
414                 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
415                 if (!skb)
416                         return NULL;
417 
418                 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
419                 ni->type = hdev->dev_type;
420                 ni->bus = hdev->bus;
421                 bacpy(&ni->bdaddr, &hdev->bdaddr);
422                 memcpy(ni->name, hdev->name, 8);
423 
424                 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
425                 break;
426 
427         case HCI_DEV_UNREG:
428                 skb = bt_skb_alloc(0, GFP_ATOMIC);
429                 if (!skb)
430                         return NULL;
431 
432                 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
433                 break;
434 
435         case HCI_DEV_SETUP:
436                 if (hdev->manufacturer == 0xffff)
437                         return NULL;
438 
439                 /* fall through */
440 
441         case HCI_DEV_UP:
442                 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC);
443                 if (!skb)
444                         return NULL;
445 
446                 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE);
447                 bacpy(&ii->bdaddr, &hdev->bdaddr);
448                 ii->manufacturer = cpu_to_le16(hdev->manufacturer);
449 
450                 opcode = cpu_to_le16(HCI_MON_INDEX_INFO);
451                 break;
452 
453         case HCI_DEV_OPEN:
454                 skb = bt_skb_alloc(0, GFP_ATOMIC);
455                 if (!skb)
456                         return NULL;
457 
458                 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX);
459                 break;
460 
461         case HCI_DEV_CLOSE:
462                 skb = bt_skb_alloc(0, GFP_ATOMIC);
463                 if (!skb)
464                         return NULL;
465 
466                 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX);
467                 break;
468 
469         default:
470                 return NULL;
471         }
472 
473         __net_timestamp(skb);
474 
475         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
476         hdr->opcode = opcode;
477         hdr->index = cpu_to_le16(hdev->id);
478         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
479 
480         return skb;
481 }
482 
483 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk)
484 {
485         struct hci_mon_hdr *hdr;
486         struct sk_buff *skb;
487         u16 format;
488         u8 ver[3];
489         u32 flags;
490 
491         /* No message needed when cookie is not present */
492         if (!hci_pi(sk)->cookie)
493                 return NULL;
494 
495         switch (hci_pi(sk)->channel) {
496         case HCI_CHANNEL_RAW:
497                 format = 0x0000;
498                 ver[0] = BT_SUBSYS_VERSION;
499                 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
500                 break;
501         case HCI_CHANNEL_USER:
502                 format = 0x0001;
503                 ver[0] = BT_SUBSYS_VERSION;
504                 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
505                 break;
506         case HCI_CHANNEL_CONTROL:
507                 format = 0x0002;
508                 mgmt_fill_version_info(ver);
509                 break;
510         default:
511                 /* No message for unsupported format */
512                 return NULL;
513         }
514 
515         skb = bt_skb_alloc(14 + TASK_COMM_LEN , GFP_ATOMIC);
516         if (!skb)
517                 return NULL;
518 
519         flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0;
520 
521         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
522         put_unaligned_le16(format, skb_put(skb, 2));
523         skb_put_data(skb, ver, sizeof(ver));
524         put_unaligned_le32(flags, skb_put(skb, 4));
525         skb_put_u8(skb, TASK_COMM_LEN);
526         skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN);
527 
528         __net_timestamp(skb);
529 
530         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
531         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN);
532         if (hci_pi(sk)->hdev)
533                 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
534         else
535                 hdr->index = cpu_to_le16(HCI_DEV_NONE);
536         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
537 
538         return skb;
539 }
540 
541 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk)
542 {
543         struct hci_mon_hdr *hdr;
544         struct sk_buff *skb;
545 
546         /* No message needed when cookie is not present */
547         if (!hci_pi(sk)->cookie)
548                 return NULL;
549 
550         switch (hci_pi(sk)->channel) {
551         case HCI_CHANNEL_RAW:
552         case HCI_CHANNEL_USER:
553         case HCI_CHANNEL_CONTROL:
554                 break;
555         default:
556                 /* No message for unsupported format */
557                 return NULL;
558         }
559 
560         skb = bt_skb_alloc(4, GFP_ATOMIC);
561         if (!skb)
562                 return NULL;
563 
564         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
565 
566         __net_timestamp(skb);
567 
568         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
569         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE);
570         if (hci_pi(sk)->hdev)
571                 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
572         else
573                 hdr->index = cpu_to_le16(HCI_DEV_NONE);
574         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
575 
576         return skb;
577 }
578 
579 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index,
580                                                    u16 opcode, u16 len,
581                                                    const void *buf)
582 {
583         struct hci_mon_hdr *hdr;
584         struct sk_buff *skb;
585 
586         skb = bt_skb_alloc(6 + len, GFP_ATOMIC);
587         if (!skb)
588                 return NULL;
589 
590         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
591         put_unaligned_le16(opcode, skb_put(skb, 2));
592 
593         if (buf)
594                 skb_put_data(skb, buf, len);
595 
596         __net_timestamp(skb);
597 
598         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
599         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND);
600         hdr->index = cpu_to_le16(index);
601         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
602 
603         return skb;
604 }
605 
606 static void __printf(2, 3)
607 send_monitor_note(struct sock *sk, const char *fmt, ...)
608 {
609         size_t len;
610         struct hci_mon_hdr *hdr;
611         struct sk_buff *skb;
612         va_list args;
613 
614         va_start(args, fmt);
615         len = vsnprintf(NULL, 0, fmt, args);
616         va_end(args);
617 
618         skb = bt_skb_alloc(len + 1, GFP_ATOMIC);
619         if (!skb)
620                 return;
621 
622         va_start(args, fmt);
623         vsprintf(skb_put(skb, len), fmt, args);
624         *(u8 *)skb_put(skb, 1) = 0;
625         va_end(args);
626 
627         __net_timestamp(skb);
628 
629         hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE);
630         hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE);
631         hdr->index = cpu_to_le16(HCI_DEV_NONE);
632         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
633 
634         if (sock_queue_rcv_skb(sk, skb))
635                 kfree_skb(skb);
636 }
637 
638 static void send_monitor_replay(struct sock *sk)
639 {
640         struct hci_dev *hdev;
641 
642         read_lock(&hci_dev_list_lock);
643 
644         list_for_each_entry(hdev, &hci_dev_list, list) {
645                 struct sk_buff *skb;
646 
647                 skb = create_monitor_event(hdev, HCI_DEV_REG);
648                 if (!skb)
649                         continue;
650 
651                 if (sock_queue_rcv_skb(sk, skb))
652                         kfree_skb(skb);
653 
654                 if (!test_bit(HCI_RUNNING, &hdev->flags))
655                         continue;
656 
657                 skb = create_monitor_event(hdev, HCI_DEV_OPEN);
658                 if (!skb)
659                         continue;
660 
661                 if (sock_queue_rcv_skb(sk, skb))
662                         kfree_skb(skb);
663 
664                 if (test_bit(HCI_UP, &hdev->flags))
665                         skb = create_monitor_event(hdev, HCI_DEV_UP);
666                 else if (hci_dev_test_flag(hdev, HCI_SETUP))
667                         skb = create_monitor_event(hdev, HCI_DEV_SETUP);
668                 else
669                         skb = NULL;
670 
671                 if (skb) {
672                         if (sock_queue_rcv_skb(sk, skb))
673                                 kfree_skb(skb);
674                 }
675         }
676 
677         read_unlock(&hci_dev_list_lock);
678 }
679 
680 static void send_monitor_control_replay(struct sock *mon_sk)
681 {
682         struct sock *sk;
683 
684         read_lock(&hci_sk_list.lock);
685 
686         sk_for_each(sk, &hci_sk_list.head) {
687                 struct sk_buff *skb;
688 
689                 skb = create_monitor_ctrl_open(sk);
690                 if (!skb)
691                         continue;
692 
693                 if (sock_queue_rcv_skb(mon_sk, skb))
694                         kfree_skb(skb);
695         }
696 
697         read_unlock(&hci_sk_list.lock);
698 }
699 
700 /* Generate internal stack event */
701 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
702 {
703         struct hci_event_hdr *hdr;
704         struct hci_ev_stack_internal *ev;
705         struct sk_buff *skb;
706 
707         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
708         if (!skb)
709                 return;
710 
711         hdr = skb_put(skb, HCI_EVENT_HDR_SIZE);
712         hdr->evt  = HCI_EV_STACK_INTERNAL;
713         hdr->plen = sizeof(*ev) + dlen;
714 
715         ev = skb_put(skb, sizeof(*ev) + dlen);
716         ev->type = type;
717         memcpy(ev->data, data, dlen);
718 
719         bt_cb(skb)->incoming = 1;
720         __net_timestamp(skb);
721 
722         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
723         hci_send_to_sock(hdev, skb);
724         kfree_skb(skb);
725 }
726 
727 void hci_sock_dev_event(struct hci_dev *hdev, int event)
728 {
729         BT_DBG("hdev %s event %d", hdev->name, event);
730 
731         if (atomic_read(&monitor_promisc)) {
732                 struct sk_buff *skb;
733 
734                 /* Send event to monitor */
735                 skb = create_monitor_event(hdev, event);
736                 if (skb) {
737                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
738                                             HCI_SOCK_TRUSTED, NULL);
739                         kfree_skb(skb);
740                 }
741         }
742 
743         if (event <= HCI_DEV_DOWN) {
744                 struct hci_ev_si_device ev;
745 
746                 /* Send event to sockets */
747                 ev.event  = event;
748                 ev.dev_id = hdev->id;
749                 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
750         }
751 
752         if (event == HCI_DEV_UNREG) {
753                 struct sock *sk;
754 
755                 /* Detach sockets from device */
756                 read_lock(&hci_sk_list.lock);
757                 sk_for_each(sk, &hci_sk_list.head) {
758                         bh_lock_sock_nested(sk);
759                         if (hci_pi(sk)->hdev == hdev) {
760                                 hci_pi(sk)->hdev = NULL;
761                                 sk->sk_err = EPIPE;
762                                 sk->sk_state = BT_OPEN;
763                                 sk->sk_state_change(sk);
764 
765                                 hci_dev_put(hdev);
766                         }
767                         bh_unlock_sock(sk);
768                 }
769                 read_unlock(&hci_sk_list.lock);
770         }
771 }
772 
773 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel)
774 {
775         struct hci_mgmt_chan *c;
776 
777         list_for_each_entry(c, &mgmt_chan_list, list) {
778                 if (c->channel == channel)
779                         return c;
780         }
781 
782         return NULL;
783 }
784 
785 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel)
786 {
787         struct hci_mgmt_chan *c;
788 
789         mutex_lock(&mgmt_chan_list_lock);
790         c = __hci_mgmt_chan_find(channel);
791         mutex_unlock(&mgmt_chan_list_lock);
792 
793         return c;
794 }
795 
796 int hci_mgmt_chan_register(struct hci_mgmt_chan *c)
797 {
798         if (c->channel < HCI_CHANNEL_CONTROL)
799                 return -EINVAL;
800 
801         mutex_lock(&mgmt_chan_list_lock);
802         if (__hci_mgmt_chan_find(c->channel)) {
803                 mutex_unlock(&mgmt_chan_list_lock);
804                 return -EALREADY;
805         }
806 
807         list_add_tail(&c->list, &mgmt_chan_list);
808 
809         mutex_unlock(&mgmt_chan_list_lock);
810 
811         return 0;
812 }
813 EXPORT_SYMBOL(hci_mgmt_chan_register);
814 
815 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c)
816 {
817         mutex_lock(&mgmt_chan_list_lock);
818         list_del(&c->list);
819         mutex_unlock(&mgmt_chan_list_lock);
820 }
821 EXPORT_SYMBOL(hci_mgmt_chan_unregister);
822 
823 static int hci_sock_release(struct socket *sock)
824 {
825         struct sock *sk = sock->sk;
826         struct hci_dev *hdev;
827         struct sk_buff *skb;
828 
829         BT_DBG("sock %p sk %p", sock, sk);
830 
831         if (!sk)
832                 return 0;
833 
834         hdev = hci_pi(sk)->hdev;
835 
836         switch (hci_pi(sk)->channel) {
837         case HCI_CHANNEL_MONITOR:
838                 atomic_dec(&monitor_promisc);
839                 break;
840         case HCI_CHANNEL_RAW:
841         case HCI_CHANNEL_USER:
842         case HCI_CHANNEL_CONTROL:
843                 /* Send event to monitor */
844                 skb = create_monitor_ctrl_close(sk);
845                 if (skb) {
846                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
847                                             HCI_SOCK_TRUSTED, NULL);
848                         kfree_skb(skb);
849                 }
850 
851                 hci_sock_free_cookie(sk);
852                 break;
853         }
854 
855         bt_sock_unlink(&hci_sk_list, sk);
856 
857         if (hdev) {
858                 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
859                         /* When releasing a user channel exclusive access,
860                          * call hci_dev_do_close directly instead of calling
861                          * hci_dev_close to ensure the exclusive access will
862                          * be released and the controller brought back down.
863                          *
864                          * The checking of HCI_AUTO_OFF is not needed in this
865                          * case since it will have been cleared already when
866                          * opening the user channel.
867                          */
868                         hci_dev_do_close(hdev);
869                         hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
870                         mgmt_index_added(hdev);
871                 }
872 
873                 atomic_dec(&hdev->promisc);
874                 hci_dev_put(hdev);
875         }
876 
877         sock_orphan(sk);
878 
879         skb_queue_purge(&sk->sk_receive_queue);
880         skb_queue_purge(&sk->sk_write_queue);
881 
882         sock_put(sk);
883         return 0;
884 }
885 
886 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
887 {
888         bdaddr_t bdaddr;
889         int err;
890 
891         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
892                 return -EFAULT;
893 
894         hci_dev_lock(hdev);
895 
896         err = hci_bdaddr_list_add(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
897 
898         hci_dev_unlock(hdev);
899 
900         return err;
901 }
902 
903 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
904 {
905         bdaddr_t bdaddr;
906         int err;
907 
908         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
909                 return -EFAULT;
910 
911         hci_dev_lock(hdev);
912 
913         err = hci_bdaddr_list_del(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
914 
915         hci_dev_unlock(hdev);
916 
917         return err;
918 }
919 
920 /* Ioctls that require bound socket */
921 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
922                                 unsigned long arg)
923 {
924         struct hci_dev *hdev = hci_pi(sk)->hdev;
925 
926         if (!hdev)
927                 return -EBADFD;
928 
929         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
930                 return -EBUSY;
931 
932         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
933                 return -EOPNOTSUPP;
934 
935         if (hdev->dev_type != HCI_PRIMARY)
936                 return -EOPNOTSUPP;
937 
938         switch (cmd) {
939         case HCISETRAW:
940                 if (!capable(CAP_NET_ADMIN))
941                         return -EPERM;
942                 return -EOPNOTSUPP;
943 
944         case HCIGETCONNINFO:
945                 return hci_get_conn_info(hdev, (void __user *)arg);
946 
947         case HCIGETAUTHINFO:
948                 return hci_get_auth_info(hdev, (void __user *)arg);
949 
950         case HCIBLOCKADDR:
951                 if (!capable(CAP_NET_ADMIN))
952                         return -EPERM;
953                 return hci_sock_blacklist_add(hdev, (void __user *)arg);
954 
955         case HCIUNBLOCKADDR:
956                 if (!capable(CAP_NET_ADMIN))
957                         return -EPERM;
958                 return hci_sock_blacklist_del(hdev, (void __user *)arg);
959         }
960 
961         return -ENOIOCTLCMD;
962 }
963 
964 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
965                           unsigned long arg)
966 {
967         void __user *argp = (void __user *)arg;
968         struct sock *sk = sock->sk;
969         int err;
970 
971         BT_DBG("cmd %x arg %lx", cmd, arg);
972 
973         lock_sock(sk);
974 
975         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
976                 err = -EBADFD;
977                 goto done;
978         }
979 
980         /* When calling an ioctl on an unbound raw socket, then ensure
981          * that the monitor gets informed. Ensure that the resulting event
982          * is only send once by checking if the cookie exists or not. The
983          * socket cookie will be only ever generated once for the lifetime
984          * of a given socket.
985          */
986         if (hci_sock_gen_cookie(sk)) {
987                 struct sk_buff *skb;
988 
989                 if (capable(CAP_NET_ADMIN))
990                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
991 
992                 /* Send event to monitor */
993                 skb = create_monitor_ctrl_open(sk);
994                 if (skb) {
995                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
996                                             HCI_SOCK_TRUSTED, NULL);
997                         kfree_skb(skb);
998                 }
999         }
1000 
1001         release_sock(sk);
1002 
1003         switch (cmd) {
1004         case HCIGETDEVLIST:
1005                 return hci_get_dev_list(argp);
1006 
1007         case HCIGETDEVINFO:
1008                 return hci_get_dev_info(argp);
1009 
1010         case HCIGETCONNLIST:
1011                 return hci_get_conn_list(argp);
1012 
1013         case HCIDEVUP:
1014                 if (!capable(CAP_NET_ADMIN))
1015                         return -EPERM;
1016                 return hci_dev_open(arg);
1017 
1018         case HCIDEVDOWN:
1019                 if (!capable(CAP_NET_ADMIN))
1020                         return -EPERM;
1021                 return hci_dev_close(arg);
1022 
1023         case HCIDEVRESET:
1024                 if (!capable(CAP_NET_ADMIN))
1025                         return -EPERM;
1026                 return hci_dev_reset(arg);
1027 
1028         case HCIDEVRESTAT:
1029                 if (!capable(CAP_NET_ADMIN))
1030                         return -EPERM;
1031                 return hci_dev_reset_stat(arg);
1032 
1033         case HCISETSCAN:
1034         case HCISETAUTH:
1035         case HCISETENCRYPT:
1036         case HCISETPTYPE:
1037         case HCISETLINKPOL:
1038         case HCISETLINKMODE:
1039         case HCISETACLMTU:
1040         case HCISETSCOMTU:
1041                 if (!capable(CAP_NET_ADMIN))
1042                         return -EPERM;
1043                 return hci_dev_cmd(cmd, argp);
1044 
1045         case HCIINQUIRY:
1046                 return hci_inquiry(argp);
1047         }
1048 
1049         lock_sock(sk);
1050 
1051         err = hci_sock_bound_ioctl(sk, cmd, arg);
1052 
1053 done:
1054         release_sock(sk);
1055         return err;
1056 }
1057 
1058 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
1059                          int addr_len)
1060 {
1061         struct sockaddr_hci haddr;
1062         struct sock *sk = sock->sk;
1063         struct hci_dev *hdev = NULL;
1064         struct sk_buff *skb;
1065         int len, err = 0;
1066 
1067         BT_DBG("sock %p sk %p", sock, sk);
1068 
1069         if (!addr)
1070                 return -EINVAL;
1071 
1072         memset(&haddr, 0, sizeof(haddr));
1073         len = min_t(unsigned int, sizeof(haddr), addr_len);
1074         memcpy(&haddr, addr, len);
1075 
1076         if (haddr.hci_family != AF_BLUETOOTH)
1077                 return -EINVAL;
1078 
1079         lock_sock(sk);
1080 
1081         if (sk->sk_state == BT_BOUND) {
1082                 err = -EALREADY;
1083                 goto done;
1084         }
1085 
1086         switch (haddr.hci_channel) {
1087         case HCI_CHANNEL_RAW:
1088                 if (hci_pi(sk)->hdev) {
1089                         err = -EALREADY;
1090                         goto done;
1091                 }
1092 
1093                 if (haddr.hci_dev != HCI_DEV_NONE) {
1094                         hdev = hci_dev_get(haddr.hci_dev);
1095                         if (!hdev) {
1096                                 err = -ENODEV;
1097                                 goto done;
1098                         }
1099 
1100                         atomic_inc(&hdev->promisc);
1101                 }
1102 
1103                 hci_pi(sk)->channel = haddr.hci_channel;
1104 
1105                 if (!hci_sock_gen_cookie(sk)) {
1106                         /* In the case when a cookie has already been assigned,
1107                          * then there has been already an ioctl issued against
1108                          * an unbound socket and with that triggerd an open
1109                          * notification. Send a close notification first to
1110                          * allow the state transition to bounded.
1111                          */
1112                         skb = create_monitor_ctrl_close(sk);
1113                         if (skb) {
1114                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1115                                                     HCI_SOCK_TRUSTED, NULL);
1116                                 kfree_skb(skb);
1117                         }
1118                 }
1119 
1120                 if (capable(CAP_NET_ADMIN))
1121                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1122 
1123                 hci_pi(sk)->hdev = hdev;
1124 
1125                 /* Send event to monitor */
1126                 skb = create_monitor_ctrl_open(sk);
1127                 if (skb) {
1128                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1129                                             HCI_SOCK_TRUSTED, NULL);
1130                         kfree_skb(skb);
1131                 }
1132                 break;
1133 
1134         case HCI_CHANNEL_USER:
1135                 if (hci_pi(sk)->hdev) {
1136                         err = -EALREADY;
1137                         goto done;
1138                 }
1139 
1140                 if (haddr.hci_dev == HCI_DEV_NONE) {
1141                         err = -EINVAL;
1142                         goto done;
1143                 }
1144 
1145                 if (!capable(CAP_NET_ADMIN)) {
1146                         err = -EPERM;
1147                         goto done;
1148                 }
1149 
1150                 hdev = hci_dev_get(haddr.hci_dev);
1151                 if (!hdev) {
1152                         err = -ENODEV;
1153                         goto done;
1154                 }
1155 
1156                 if (test_bit(HCI_INIT, &hdev->flags) ||
1157                     hci_dev_test_flag(hdev, HCI_SETUP) ||
1158                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1159                     (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1160                      test_bit(HCI_UP, &hdev->flags))) {
1161                         err = -EBUSY;
1162                         hci_dev_put(hdev);
1163                         goto done;
1164                 }
1165 
1166                 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) {
1167                         err = -EUSERS;
1168                         hci_dev_put(hdev);
1169                         goto done;
1170                 }
1171 
1172                 mgmt_index_removed(hdev);
1173 
1174                 err = hci_dev_open(hdev->id);
1175                 if (err) {
1176                         if (err == -EALREADY) {
1177                                 /* In case the transport is already up and
1178                                  * running, clear the error here.
1179                                  *
1180                                  * This can happen when opening a user
1181                                  * channel and HCI_AUTO_OFF grace period
1182                                  * is still active.
1183                                  */
1184                                 err = 0;
1185                         } else {
1186                                 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
1187                                 mgmt_index_added(hdev);
1188                                 hci_dev_put(hdev);
1189                                 goto done;
1190                         }
1191                 }
1192 
1193                 hci_pi(sk)->channel = haddr.hci_channel;
1194 
1195                 if (!hci_sock_gen_cookie(sk)) {
1196                         /* In the case when a cookie has already been assigned,
1197                          * this socket will transition from a raw socket into
1198                          * a user channel socket. For a clean transition, send
1199                          * the close notification first.
1200                          */
1201                         skb = create_monitor_ctrl_close(sk);
1202                         if (skb) {
1203                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1204                                                     HCI_SOCK_TRUSTED, NULL);
1205                                 kfree_skb(skb);
1206                         }
1207                 }
1208 
1209                 /* The user channel is restricted to CAP_NET_ADMIN
1210                  * capabilities and with that implicitly trusted.
1211                  */
1212                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1213 
1214                 hci_pi(sk)->hdev = hdev;
1215 
1216                 /* Send event to monitor */
1217                 skb = create_monitor_ctrl_open(sk);
1218                 if (skb) {
1219                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1220                                             HCI_SOCK_TRUSTED, NULL);
1221                         kfree_skb(skb);
1222                 }
1223 
1224                 atomic_inc(&hdev->promisc);
1225                 break;
1226 
1227         case HCI_CHANNEL_MONITOR:
1228                 if (haddr.hci_dev != HCI_DEV_NONE) {
1229                         err = -EINVAL;
1230                         goto done;
1231                 }
1232 
1233                 if (!capable(CAP_NET_RAW)) {
1234                         err = -EPERM;
1235                         goto done;
1236                 }
1237 
1238                 hci_pi(sk)->channel = haddr.hci_channel;
1239 
1240                 /* The monitor interface is restricted to CAP_NET_RAW
1241                  * capabilities and with that implicitly trusted.
1242                  */
1243                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1244 
1245                 send_monitor_note(sk, "Linux version %s (%s)",
1246                                   init_utsname()->release,
1247                                   init_utsname()->machine);
1248                 send_monitor_note(sk, "Bluetooth subsystem version %u.%u",
1249                                   BT_SUBSYS_VERSION, BT_SUBSYS_REVISION);
1250                 send_monitor_replay(sk);
1251                 send_monitor_control_replay(sk);
1252 
1253                 atomic_inc(&monitor_promisc);
1254                 break;
1255 
1256         case HCI_CHANNEL_LOGGING:
1257                 if (haddr.hci_dev != HCI_DEV_NONE) {
1258                         err = -EINVAL;
1259                         goto done;
1260                 }
1261 
1262                 if (!capable(CAP_NET_ADMIN)) {
1263                         err = -EPERM;
1264                         goto done;
1265                 }
1266 
1267                 hci_pi(sk)->channel = haddr.hci_channel;
1268                 break;
1269 
1270         default:
1271                 if (!hci_mgmt_chan_find(haddr.hci_channel)) {
1272                         err = -EINVAL;
1273                         goto done;
1274                 }
1275 
1276                 if (haddr.hci_dev != HCI_DEV_NONE) {
1277                         err = -EINVAL;
1278                         goto done;
1279                 }
1280 
1281                 /* Users with CAP_NET_ADMIN capabilities are allowed
1282                  * access to all management commands and events. For
1283                  * untrusted users the interface is restricted and
1284                  * also only untrusted events are sent.
1285                  */
1286                 if (capable(CAP_NET_ADMIN))
1287                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1288 
1289                 hci_pi(sk)->channel = haddr.hci_channel;
1290 
1291                 /* At the moment the index and unconfigured index events
1292                  * are enabled unconditionally. Setting them on each
1293                  * socket when binding keeps this functionality. They
1294                  * however might be cleared later and then sending of these
1295                  * events will be disabled, but that is then intentional.
1296                  *
1297                  * This also enables generic events that are safe to be
1298                  * received by untrusted users. Example for such events
1299                  * are changes to settings, class of device, name etc.
1300                  */
1301                 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) {
1302                         if (!hci_sock_gen_cookie(sk)) {
1303                                 /* In the case when a cookie has already been
1304                                  * assigned, this socket will transtion from
1305                                  * a raw socket into a control socket. To
1306                                  * allow for a clean transtion, send the
1307                                  * close notification first.
1308                                  */
1309                                 skb = create_monitor_ctrl_close(sk);
1310                                 if (skb) {
1311                                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1312                                                             HCI_SOCK_TRUSTED, NULL);
1313                                         kfree_skb(skb);
1314                                 }
1315                         }
1316 
1317                         /* Send event to monitor */
1318                         skb = create_monitor_ctrl_open(sk);
1319                         if (skb) {
1320                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1321                                                     HCI_SOCK_TRUSTED, NULL);
1322                                 kfree_skb(skb);
1323                         }
1324 
1325                         hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS);
1326                         hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
1327                         hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS);
1328                         hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS);
1329                         hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1330                         hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1331                 }
1332                 break;
1333         }
1334 
1335         sk->sk_state = BT_BOUND;
1336 
1337 done:
1338         release_sock(sk);
1339         return err;
1340 }
1341 
1342 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
1343                             int peer)
1344 {
1345         struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr;
1346         struct sock *sk = sock->sk;
1347         struct hci_dev *hdev;
1348         int err = 0;
1349 
1350         BT_DBG("sock %p sk %p", sock, sk);
1351 
1352         if (peer)
1353                 return -EOPNOTSUPP;
1354 
1355         lock_sock(sk);
1356 
1357         hdev = hci_pi(sk)->hdev;
1358         if (!hdev) {
1359                 err = -EBADFD;
1360                 goto done;
1361         }
1362 
1363         haddr->hci_family = AF_BLUETOOTH;
1364         haddr->hci_dev    = hdev->id;
1365         haddr->hci_channel= hci_pi(sk)->channel;
1366         err = sizeof(*haddr);
1367 
1368 done:
1369         release_sock(sk);
1370         return err;
1371 }
1372 
1373 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
1374                           struct sk_buff *skb)
1375 {
1376         __u32 mask = hci_pi(sk)->cmsg_mask;
1377 
1378         if (mask & HCI_CMSG_DIR) {
1379                 int incoming = bt_cb(skb)->incoming;
1380                 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
1381                          &incoming);
1382         }
1383 
1384         if (mask & HCI_CMSG_TSTAMP) {
1385 #ifdef CONFIG_COMPAT
1386                 struct compat_timeval ctv;
1387 #endif
1388                 struct timeval tv;
1389                 void *data;
1390                 int len;
1391 
1392                 skb_get_timestamp(skb, &tv);
1393 
1394                 data = &tv;
1395                 len = sizeof(tv);
1396 #ifdef CONFIG_COMPAT
1397                 if (!COMPAT_USE_64BIT_TIME &&
1398                     (msg->msg_flags & MSG_CMSG_COMPAT)) {
1399                         ctv.tv_sec = tv.tv_sec;
1400                         ctv.tv_usec = tv.tv_usec;
1401                         data = &ctv;
1402                         len = sizeof(ctv);
1403                 }
1404 #endif
1405 
1406                 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
1407         }
1408 }
1409 
1410 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1411                             size_t len, int flags)
1412 {
1413         int noblock = flags & MSG_DONTWAIT;
1414         struct sock *sk = sock->sk;
1415         struct sk_buff *skb;
1416         int copied, err;
1417         unsigned int skblen;
1418 
1419         BT_DBG("sock %p, sk %p", sock, sk);
1420 
1421         if (flags & MSG_OOB)
1422                 return -EOPNOTSUPP;
1423 
1424         if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING)
1425                 return -EOPNOTSUPP;
1426 
1427         if (sk->sk_state == BT_CLOSED)
1428                 return 0;
1429 
1430         skb = skb_recv_datagram(sk, flags, noblock, &err);
1431         if (!skb)
1432                 return err;
1433 
1434         skblen = skb->len;
1435         copied = skb->len;
1436         if (len < copied) {
1437                 msg->msg_flags |= MSG_TRUNC;
1438                 copied = len;
1439         }
1440 
1441         skb_reset_transport_header(skb);
1442         err = skb_copy_datagram_msg(skb, 0, msg, copied);
1443 
1444         switch (hci_pi(sk)->channel) {
1445         case HCI_CHANNEL_RAW:
1446                 hci_sock_cmsg(sk, msg, skb);
1447                 break;
1448         case HCI_CHANNEL_USER:
1449         case HCI_CHANNEL_MONITOR:
1450                 sock_recv_timestamp(msg, sk, skb);
1451                 break;
1452         default:
1453                 if (hci_mgmt_chan_find(hci_pi(sk)->channel))
1454                         sock_recv_timestamp(msg, sk, skb);
1455                 break;
1456         }
1457 
1458         skb_free_datagram(sk, skb);
1459 
1460         if (flags & MSG_TRUNC)
1461                 copied = skblen;
1462 
1463         return err ? : copied;
1464 }
1465 
1466 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
1467                         struct msghdr *msg, size_t msglen)
1468 {
1469         void *buf;
1470         u8 *cp;
1471         struct mgmt_hdr *hdr;
1472         u16 opcode, index, len;
1473         struct hci_dev *hdev = NULL;
1474         const struct hci_mgmt_handler *handler;
1475         bool var_len, no_hdev;
1476         int err;
1477 
1478         BT_DBG("got %zu bytes", msglen);
1479 
1480         if (msglen < sizeof(*hdr))
1481                 return -EINVAL;
1482 
1483         buf = kmalloc(msglen, GFP_KERNEL);
1484         if (!buf)
1485                 return -ENOMEM;
1486 
1487         if (memcpy_from_msg(buf, msg, msglen)) {
1488                 err = -EFAULT;
1489                 goto done;
1490         }
1491 
1492         hdr = buf;
1493         opcode = __le16_to_cpu(hdr->opcode);
1494         index = __le16_to_cpu(hdr->index);
1495         len = __le16_to_cpu(hdr->len);
1496 
1497         if (len != msglen - sizeof(*hdr)) {
1498                 err = -EINVAL;
1499                 goto done;
1500         }
1501 
1502         if (chan->channel == HCI_CHANNEL_CONTROL) {
1503                 struct sk_buff *skb;
1504 
1505                 /* Send event to monitor */
1506                 skb = create_monitor_ctrl_command(sk, index, opcode, len,
1507                                                   buf + sizeof(*hdr));
1508                 if (skb) {
1509                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1510                                             HCI_SOCK_TRUSTED, NULL);
1511                         kfree_skb(skb);
1512                 }
1513         }
1514 
1515         if (opcode >= chan->handler_count ||
1516             chan->handlers[opcode].func == NULL) {
1517                 BT_DBG("Unknown op %u", opcode);
1518                 err = mgmt_cmd_status(sk, index, opcode,
1519                                       MGMT_STATUS_UNKNOWN_COMMAND);
1520                 goto done;
1521         }
1522 
1523         handler = &chan->handlers[opcode];
1524 
1525         if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
1526             !(handler->flags & HCI_MGMT_UNTRUSTED)) {
1527                 err = mgmt_cmd_status(sk, index, opcode,
1528                                       MGMT_STATUS_PERMISSION_DENIED);
1529                 goto done;
1530         }
1531 
1532         if (index != MGMT_INDEX_NONE) {
1533                 hdev = hci_dev_get(index);
1534                 if (!hdev) {
1535                         err = mgmt_cmd_status(sk, index, opcode,
1536                                               MGMT_STATUS_INVALID_INDEX);
1537                         goto done;
1538                 }
1539 
1540                 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1541                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1542                     hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1543                         err = mgmt_cmd_status(sk, index, opcode,
1544                                               MGMT_STATUS_INVALID_INDEX);
1545                         goto done;
1546                 }
1547 
1548                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1549                     !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
1550                         err = mgmt_cmd_status(sk, index, opcode,
1551                                               MGMT_STATUS_INVALID_INDEX);
1552                         goto done;
1553                 }
1554         }
1555 
1556         no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1557         if (no_hdev != !hdev) {
1558                 err = mgmt_cmd_status(sk, index, opcode,
1559                                       MGMT_STATUS_INVALID_INDEX);
1560                 goto done;
1561         }
1562 
1563         var_len = (handler->flags & HCI_MGMT_VAR_LEN);
1564         if ((var_len && len < handler->data_len) ||
1565             (!var_len && len != handler->data_len)) {
1566                 err = mgmt_cmd_status(sk, index, opcode,
1567                                       MGMT_STATUS_INVALID_PARAMS);
1568                 goto done;
1569         }
1570 
1571         if (hdev && chan->hdev_init)
1572                 chan->hdev_init(sk, hdev);
1573 
1574         cp = buf + sizeof(*hdr);
1575 
1576         err = handler->func(sk, hdev, cp, len);
1577         if (err < 0)
1578                 goto done;
1579 
1580         err = msglen;
1581 
1582 done:
1583         if (hdev)
1584                 hci_dev_put(hdev);
1585 
1586         kfree(buf);
1587         return err;
1588 }
1589 
1590 static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len)
1591 {
1592         struct hci_mon_hdr *hdr;
1593         struct sk_buff *skb;
1594         struct hci_dev *hdev;
1595         u16 index;
1596         int err;
1597 
1598         /* The logging frame consists at minimum of the standard header,
1599          * the priority byte, the ident length byte and at least one string
1600          * terminator NUL byte. Anything shorter are invalid packets.
1601          */
1602         if (len < sizeof(*hdr) + 3)
1603                 return -EINVAL;
1604 
1605         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1606         if (!skb)
1607                 return err;
1608 
1609         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1610                 err = -EFAULT;
1611                 goto drop;
1612         }
1613 
1614         hdr = (void *)skb->data;
1615 
1616         if (__le16_to_cpu(hdr->len) != len - sizeof(*hdr)) {
1617                 err = -EINVAL;
1618                 goto drop;
1619         }
1620 
1621         if (__le16_to_cpu(hdr->opcode) == 0x0000) {
1622                 __u8 priority = skb->data[sizeof(*hdr)];
1623                 __u8 ident_len = skb->data[sizeof(*hdr) + 1];
1624 
1625                 /* Only the priorities 0-7 are valid and with that any other
1626                  * value results in an invalid packet.
1627                  *
1628                  * The priority byte is followed by an ident length byte and
1629                  * the NUL terminated ident string. Check that the ident
1630                  * length is not overflowing the packet and also that the
1631                  * ident string itself is NUL terminated. In case the ident
1632                  * length is zero, the length value actually doubles as NUL
1633                  * terminator identifier.
1634                  *
1635                  * The message follows the ident string (if present) and
1636                  * must be NUL terminated. Otherwise it is not a valid packet.
1637                  */
1638                 if (priority > 7 || skb->data[len - 1] != 0x00 ||
1639                     ident_len > len - sizeof(*hdr) - 3 ||
1640                     skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) {
1641                         err = -EINVAL;
1642                         goto drop;
1643                 }
1644         } else {
1645                 err = -EINVAL;
1646                 goto drop;
1647         }
1648 
1649         index = __le16_to_cpu(hdr->index);
1650 
1651         if (index != MGMT_INDEX_NONE) {
1652                 hdev = hci_dev_get(index);
1653                 if (!hdev) {
1654                         err = -ENODEV;
1655                         goto drop;
1656                 }
1657         } else {
1658                 hdev = NULL;
1659         }
1660 
1661         hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING);
1662 
1663         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL);
1664         err = len;
1665 
1666         if (hdev)
1667                 hci_dev_put(hdev);
1668 
1669 drop:
1670         kfree_skb(skb);
1671         return err;
1672 }
1673 
1674 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1675                             size_t len)
1676 {
1677         struct sock *sk = sock->sk;
1678         struct hci_mgmt_chan *chan;
1679         struct hci_dev *hdev;
1680         struct sk_buff *skb;
1681         int err;
1682 
1683         BT_DBG("sock %p sk %p", sock, sk);
1684 
1685         if (msg->msg_flags & MSG_OOB)
1686                 return -EOPNOTSUPP;
1687 
1688         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|
1689                                MSG_CMSG_COMPAT))
1690                 return -EINVAL;
1691 
1692         if (len < 4 || len > HCI_MAX_FRAME_SIZE)
1693                 return -EINVAL;
1694 
1695         lock_sock(sk);
1696 
1697         switch (hci_pi(sk)->channel) {
1698         case HCI_CHANNEL_RAW:
1699         case HCI_CHANNEL_USER:
1700                 break;
1701         case HCI_CHANNEL_MONITOR:
1702                 err = -EOPNOTSUPP;
1703                 goto done;
1704         case HCI_CHANNEL_LOGGING:
1705                 err = hci_logging_frame(sk, msg, len);
1706                 goto done;
1707         default:
1708                 mutex_lock(&mgmt_chan_list_lock);
1709                 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);
1710                 if (chan)
1711                         err = hci_mgmt_cmd(chan, sk, msg, len);
1712                 else
1713                         err = -EINVAL;
1714 
1715                 mutex_unlock(&mgmt_chan_list_lock);
1716                 goto done;
1717         }
1718 
1719         hdev = hci_pi(sk)->hdev;
1720         if (!hdev) {
1721                 err = -EBADFD;
1722                 goto done;
1723         }
1724 
1725         if (!test_bit(HCI_UP, &hdev->flags)) {
1726                 err = -ENETDOWN;
1727                 goto done;
1728         }
1729 
1730         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1731         if (!skb)
1732                 goto done;
1733 
1734         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1735                 err = -EFAULT;
1736                 goto drop;
1737         }
1738 
1739         hci_skb_pkt_type(skb) = skb->data[0];
1740         skb_pull(skb, 1);
1741 
1742         if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
1743                 /* No permission check is needed for user channel
1744                  * since that gets enforced when binding the socket.
1745                  *
1746                  * However check that the packet type is valid.
1747                  */
1748                 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
1749                     hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1750                     hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
1751                         err = -EINVAL;
1752                         goto drop;
1753                 }
1754 
1755                 skb_queue_tail(&hdev->raw_q, skb);
1756                 queue_work(hdev->workqueue, &hdev->tx_work);
1757         } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) {
1758                 u16 opcode = get_unaligned_le16(skb->data);
1759                 u16 ogf = hci_opcode_ogf(opcode);
1760                 u16 ocf = hci_opcode_ocf(opcode);
1761 
1762                 if (((ogf > HCI_SFLT_MAX_OGF) ||
1763                      !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
1764                                    &hci_sec_filter.ocf_mask[ogf])) &&
1765                     !capable(CAP_NET_RAW)) {
1766                         err = -EPERM;
1767                         goto drop;
1768                 }
1769 
1770                 /* Since the opcode has already been extracted here, store
1771                  * a copy of the value for later use by the drivers.
1772                  */
1773                 hci_skb_opcode(skb) = opcode;
1774 
1775                 if (ogf == 0x3f) {
1776                         skb_queue_tail(&hdev->raw_q, skb);
1777                         queue_work(hdev->workqueue, &hdev->tx_work);
1778                 } else {
1779                         /* Stand-alone HCI commands must be flagged as
1780                          * single-command requests.
1781                          */
1782                         bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
1783 
1784                         skb_queue_tail(&hdev->cmd_q, skb);
1785                         queue_work(hdev->workqueue, &hdev->cmd_work);
1786                 }
1787         } else {
1788                 if (!capable(CAP_NET_RAW)) {
1789                         err = -EPERM;
1790                         goto drop;
1791                 }
1792 
1793                 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1794                     hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
1795                         err = -EINVAL;
1796                         goto drop;
1797                 }
1798 
1799                 skb_queue_tail(&hdev->raw_q, skb);
1800                 queue_work(hdev->workqueue, &hdev->tx_work);
1801         }
1802 
1803         err = len;
1804 
1805 done:
1806         release_sock(sk);
1807         return err;
1808 
1809 drop:
1810         kfree_skb(skb);
1811         goto done;
1812 }
1813 
1814 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
1815                                char __user *optval, unsigned int len)
1816 {
1817         struct hci_ufilter uf = { .opcode = 0 };
1818         struct sock *sk = sock->sk;
1819         int err = 0, opt = 0;
1820 
1821         BT_DBG("sk %p, opt %d", sk, optname);
1822 
1823         if (level != SOL_HCI)
1824                 return -ENOPROTOOPT;
1825 
1826         lock_sock(sk);
1827 
1828         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1829                 err = -EBADFD;
1830                 goto done;
1831         }
1832 
1833         switch (optname) {
1834         case HCI_DATA_DIR:
1835                 if (get_user(opt, (int __user *)optval)) {
1836                         err = -EFAULT;
1837                         break;
1838                 }
1839 
1840                 if (opt)
1841                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
1842                 else
1843                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
1844                 break;
1845 
1846         case HCI_TIME_STAMP:
1847                 if (get_user(opt, (int __user *)optval)) {
1848                         err = -EFAULT;
1849                         break;
1850                 }
1851 
1852                 if (opt)
1853                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
1854                 else
1855                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
1856                 break;
1857 
1858         case HCI_FILTER:
1859                 {
1860                         struct hci_filter *f = &hci_pi(sk)->filter;
1861 
1862                         uf.type_mask = f->type_mask;
1863                         uf.opcode    = f->opcode;
1864                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1865                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1866                 }
1867 
1868                 len = min_t(unsigned int, len, sizeof(uf));
1869                 if (copy_from_user(&uf, optval, len)) {
1870                         err = -EFAULT;
1871                         break;
1872                 }
1873 
1874                 if (!capable(CAP_NET_RAW)) {
1875                         uf.type_mask &= hci_sec_filter.type_mask;
1876                         uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
1877                         uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
1878                 }
1879 
1880                 {
1881                         struct hci_filter *f = &hci_pi(sk)->filter;
1882 
1883                         f->type_mask = uf.type_mask;
1884                         f->opcode    = uf.opcode;
1885                         *((u32 *) f->event_mask + 0) = uf.event_mask[0];
1886                         *((u32 *) f->event_mask + 1) = uf.event_mask[1];
1887                 }
1888                 break;
1889 
1890         default:
1891                 err = -ENOPROTOOPT;
1892                 break;
1893         }
1894 
1895 done:
1896         release_sock(sk);
1897         return err;
1898 }
1899 
1900 static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
1901                                char __user *optval, int __user *optlen)
1902 {
1903         struct hci_ufilter uf;
1904         struct sock *sk = sock->sk;
1905         int len, opt, err = 0;
1906 
1907         BT_DBG("sk %p, opt %d", sk, optname);
1908 
1909         if (level != SOL_HCI)
1910                 return -ENOPROTOOPT;
1911 
1912         if (get_user(len, optlen))
1913                 return -EFAULT;
1914 
1915         lock_sock(sk);
1916 
1917         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1918                 err = -EBADFD;
1919                 goto done;
1920         }
1921 
1922         switch (optname) {
1923         case HCI_DATA_DIR:
1924                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
1925                         opt = 1;
1926                 else
1927                         opt = 0;
1928 
1929                 if (put_user(opt, optval))
1930                         err = -EFAULT;
1931                 break;
1932 
1933         case HCI_TIME_STAMP:
1934                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
1935                         opt = 1;
1936                 else
1937                         opt = 0;
1938 
1939                 if (put_user(opt, optval))
1940                         err = -EFAULT;
1941                 break;
1942 
1943         case HCI_FILTER:
1944                 {
1945                         struct hci_filter *f = &hci_pi(sk)->filter;
1946 
1947                         memset(&uf, 0, sizeof(uf));
1948                         uf.type_mask = f->type_mask;
1949                         uf.opcode    = f->opcode;
1950                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1951                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1952                 }
1953 
1954                 len = min_t(unsigned int, len, sizeof(uf));
1955                 if (copy_to_user(optval, &uf, len))
1956                         err = -EFAULT;
1957                 break;
1958 
1959         default:
1960                 err = -ENOPROTOOPT;
1961                 break;
1962         }
1963 
1964 done:
1965         release_sock(sk);
1966         return err;
1967 }
1968 
1969 static const struct proto_ops hci_sock_ops = {
1970         .family         = PF_BLUETOOTH,
1971         .owner          = THIS_MODULE,
1972         .release        = hci_sock_release,
1973         .bind           = hci_sock_bind,
1974         .getname        = hci_sock_getname,
1975         .sendmsg        = hci_sock_sendmsg,
1976         .recvmsg        = hci_sock_recvmsg,
1977         .ioctl          = hci_sock_ioctl,
1978         .poll           = datagram_poll,
1979         .listen         = sock_no_listen,
1980         .shutdown       = sock_no_shutdown,
1981         .setsockopt     = hci_sock_setsockopt,
1982         .getsockopt     = hci_sock_getsockopt,
1983         .connect        = sock_no_connect,
1984         .socketpair     = sock_no_socketpair,
1985         .accept         = sock_no_accept,
1986         .mmap           = sock_no_mmap
1987 };
1988 
1989 static struct proto hci_sk_proto = {
1990         .name           = "HCI",
1991         .owner          = THIS_MODULE,
1992         .obj_size       = sizeof(struct hci_pinfo)
1993 };
1994 
1995 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
1996                            int kern)
1997 {
1998         struct sock *sk;
1999 
2000         BT_DBG("sock %p", sock);
2001 
2002         if (sock->type != SOCK_RAW)
2003                 return -ESOCKTNOSUPPORT;
2004 
2005         sock->ops = &hci_sock_ops;
2006 
2007         sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern);
2008         if (!sk)
2009                 return -ENOMEM;
2010 
2011         sock_init_data(sock, sk);
2012 
2013         sock_reset_flag(sk, SOCK_ZAPPED);
2014 
2015         sk->sk_protocol = protocol;
2016 
2017         sock->state = SS_UNCONNECTED;
2018         sk->sk_state = BT_OPEN;
2019 
2020         bt_sock_link(&hci_sk_list, sk);
2021         return 0;
2022 }
2023 
2024 static const struct net_proto_family hci_sock_family_ops = {
2025         .family = PF_BLUETOOTH,
2026         .owner  = THIS_MODULE,
2027         .create = hci_sock_create,
2028 };
2029 
2030 int __init hci_sock_init(void)
2031 {
2032         int err;
2033 
2034         BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr));
2035 
2036         err = proto_register(&hci_sk_proto, 0);
2037         if (err < 0)
2038                 return err;
2039 
2040         err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
2041         if (err < 0) {
2042                 BT_ERR("HCI socket registration failed");
2043                 goto error;
2044         }
2045 
2046         err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL);
2047         if (err < 0) {
2048                 BT_ERR("Failed to create HCI proc file");
2049                 bt_sock_unregister(BTPROTO_HCI);
2050                 goto error;
2051         }
2052 
2053         BT_INFO("HCI socket layer initialized");
2054 
2055         return 0;
2056 
2057 error:
2058         proto_unregister(&hci_sk_proto);
2059         return err;
2060 }
2061 
2062 void hci_sock_cleanup(void)
2063 {
2064         bt_procfs_cleanup(&init_net, "hci");
2065         bt_sock_unregister(BTPROTO_HCI);
2066         proto_unregister(&hci_sk_proto);
2067 }
2068 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp