2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI sockets. */
27 #include <linux/module.h>
29 #include <linux/types.h>
30 #include <linux/capability.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/slab.h>
34 #include <linux/poll.h>
35 #include <linux/fcntl.h>
36 #include <linux/init.h>
37 #include <linux/skbuff.h>
38 #include <linux/workqueue.h>
39 #include <linux/interrupt.h>
40 #include <linux/compat.h>
41 #include <linux/socket.h>
42 #include <linux/ioctl.h>
45 #include <asm/system.h>
46 #include <linux/uaccess.h>
47 #include <asm/unaligned.h>
49 #include <net/bluetooth/bluetooth.h>
50 #include <net/bluetooth/hci_core.h>
52 /* ----- HCI socket interface ----- */
54 static inline int hci_test_bit(int nr, void *addr)
56 return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
60 static struct hci_sec_filter hci_sec_filter = {
64 { 0x1000d9fe, 0x0000b00c },
69 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
71 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
73 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
75 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
76 /* OGF_STATUS_PARAM */
77 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
81 static struct bt_sock_list hci_sk_list = {
82 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
85 /* Send frame to RAW socket */
86 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
90 struct hlist_node *node;
92 BT_DBG("hdev %p len %d", hdev, skb->len);
94 read_lock(&hci_sk_list.lock);
95 sk_for_each(sk, node, &hci_sk_list.head) {
96 struct hci_filter *flt;
102 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
105 /* Don't send frame to the socket it came from */
109 if (bt_cb(skb)->channel != hci_pi(sk)->channel)
112 if (bt_cb(skb)->channel == HCI_CHANNEL_CONTROL)
116 flt = &hci_pi(sk)->filter;
118 if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
119 0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
122 if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
123 register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
125 if (!hci_test_bit(evt, &flt->event_mask))
129 ((evt == HCI_EV_CMD_COMPLETE &&
131 get_unaligned((__le16 *)(skb->data + 3))) ||
132 (evt == HCI_EV_CMD_STATUS &&
134 get_unaligned((__le16 *)(skb->data + 4)))))
139 nskb = skb_clone(skb, GFP_ATOMIC);
143 /* Put type byte before the data */
144 if (bt_cb(skb)->channel == HCI_CHANNEL_RAW)
145 memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
147 if (sock_queue_rcv_skb(sk, nskb))
150 read_unlock(&hci_sk_list.lock);
153 static int hci_sock_release(struct socket *sock)
155 struct sock *sk = sock->sk;
156 struct hci_dev *hdev;
158 BT_DBG("sock %p sk %p", sock, sk);
163 hdev = hci_pi(sk)->hdev;
165 bt_sock_unlink(&hci_sk_list, sk);
168 atomic_dec(&hdev->promisc);
174 skb_queue_purge(&sk->sk_receive_queue);
175 skb_queue_purge(&sk->sk_write_queue);
181 /* sync from bluez git */
182 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
187 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
192 err = hci_blacklist_add(hdev, &bdaddr, 0);
194 hci_dev_unlock(hdev);
199 /* sync from bluez git */
200 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
205 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
210 err = hci_blacklist_del(hdev, &bdaddr, 0);
212 hci_dev_unlock(hdev);
217 /* Ioctls that require bound socket */
218 static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
220 struct hci_dev *hdev = hci_pi(sk)->hdev;
227 if (!capable(CAP_NET_ADMIN))
230 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
234 set_bit(HCI_RAW, &hdev->flags);
236 clear_bit(HCI_RAW, &hdev->flags);
241 return hci_get_conn_info(hdev, (void __user *) arg);
244 return hci_get_auth_info(hdev, (void __user *) arg);
247 if (!capable(CAP_NET_ADMIN))
249 return hci_sock_blacklist_add(hdev, (void __user *) arg);
252 if (!capable(CAP_NET_ADMIN))
254 return hci_sock_blacklist_del(hdev, (void __user *) arg);
258 return hdev->ioctl(hdev, cmd, arg);
263 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
265 struct sock *sk = sock->sk;
266 void __user *argp = (void __user *) arg;
269 BT_DBG("cmd %x arg %lx", cmd, arg);
273 return hci_get_dev_list(argp);
276 return hci_get_dev_info(argp);
279 return hci_get_conn_list(argp);
282 if (!capable(CAP_NET_ADMIN))
284 return hci_dev_open(arg);
287 if (!capable(CAP_NET_ADMIN))
289 return hci_dev_close(arg);
292 if (!capable(CAP_NET_ADMIN))
294 return hci_dev_reset(arg);
297 if (!capable(CAP_NET_ADMIN))
299 return hci_dev_reset_stat(arg);
309 if (!capable(CAP_NET_ADMIN))
311 return hci_dev_cmd(cmd, argp);
314 return hci_inquiry(argp);
318 err = hci_sock_bound_ioctl(sk, cmd, arg);
324 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
326 struct sockaddr_hci haddr;
327 struct sock *sk = sock->sk;
328 struct hci_dev *hdev = NULL;
331 BT_DBG("sock %p sk %p", sock, sk);
336 memset(&haddr, 0, sizeof(haddr));
337 len = min_t(unsigned int, sizeof(haddr), addr_len);
338 memcpy(&haddr, addr, len);
340 if (haddr.hci_family != AF_BLUETOOTH)
343 if (haddr.hci_channel > HCI_CHANNEL_CONTROL)
346 if (haddr.hci_channel == HCI_CHANNEL_CONTROL) {
347 set_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags);
352 if (sk->sk_state == BT_BOUND || hci_pi(sk)->hdev) {
357 if (haddr.hci_dev != HCI_DEV_NONE) {
358 hdev = hci_dev_get(haddr.hci_dev);
364 atomic_inc(&hdev->promisc);
367 hci_pi(sk)->channel = haddr.hci_channel;
368 hci_pi(sk)->hdev = hdev;
369 sk->sk_state = BT_BOUND;
376 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
378 struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
379 struct sock *sk = sock->sk;
380 struct hci_dev *hdev = hci_pi(sk)->hdev;
382 BT_DBG("sock %p sk %p", sock, sk);
389 *addr_len = sizeof(*haddr);
390 haddr->hci_family = AF_BLUETOOTH;
391 haddr->hci_dev = hdev->id;
397 static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
399 __u32 mask = hci_pi(sk)->cmsg_mask;
401 if (mask & HCI_CMSG_DIR) {
402 int incoming = bt_cb(skb)->incoming;
403 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
406 if (mask & HCI_CMSG_TSTAMP) {
408 struct compat_timeval ctv;
414 skb_get_timestamp(skb, &tv);
419 if (msg->msg_flags & MSG_CMSG_COMPAT) {
420 ctv.tv_sec = tv.tv_sec;
421 ctv.tv_usec = tv.tv_usec;
427 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
431 static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
432 struct msghdr *msg, size_t len, int flags)
434 int noblock = flags & MSG_DONTWAIT;
435 struct sock *sk = sock->sk;
439 BT_DBG("sock %p, sk %p", sock, sk);
441 if (flags & (MSG_OOB))
444 if (sk->sk_state == BT_CLOSED)
447 skb = skb_recv_datagram(sk, flags, noblock, &err);
451 msg->msg_namelen = 0;
455 msg->msg_flags |= MSG_TRUNC;
459 skb_reset_transport_header(skb);
460 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
462 hci_sock_cmsg(sk, msg, skb);
464 skb_free_datagram(sk, skb);
466 return err ? : copied;
469 static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
470 struct msghdr *msg, size_t len)
472 struct sock *sk = sock->sk;
473 struct hci_dev *hdev;
477 BT_DBG("sock %p sk %p", sock, sk);
479 if (msg->msg_flags & MSG_OOB)
482 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
485 if (len < 4 || len > HCI_MAX_FRAME_SIZE)
490 switch (hci_pi(sk)->channel) {
491 case HCI_CHANNEL_RAW:
493 case HCI_CHANNEL_CONTROL:
494 err = mgmt_control(sk, msg, len);
501 hdev = hci_pi(sk)->hdev;
507 if (!test_bit(HCI_UP, &hdev->flags)) {
512 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
516 if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
521 bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
523 skb->dev = (void *) hdev;
525 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
526 u16 opcode = get_unaligned_le16(skb->data);
527 u16 ogf = hci_opcode_ogf(opcode);
528 u16 ocf = hci_opcode_ocf(opcode);
530 if (((ogf > HCI_SFLT_MAX_OGF) ||
531 !hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
532 !capable(CAP_NET_RAW)) {
537 if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
538 skb_queue_tail(&hdev->raw_q, skb);
539 tasklet_schedule(&hdev->tx_task);
541 skb_queue_tail(&hdev->cmd_q, skb);
542 tasklet_schedule(&hdev->cmd_task);
545 if (!capable(CAP_NET_RAW)) {
550 skb_queue_tail(&hdev->raw_q, skb);
551 tasklet_schedule(&hdev->tx_task);
565 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len)
567 struct hci_ufilter uf = { .opcode = 0 };
568 struct sock *sk = sock->sk;
569 int err = 0, opt = 0;
571 BT_DBG("sk %p, opt %d", sk, optname);
577 if (get_user(opt, (int __user *)optval)) {
583 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
585 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
589 if (get_user(opt, (int __user *)optval)) {
595 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
597 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
602 struct hci_filter *f = &hci_pi(sk)->filter;
604 uf.type_mask = f->type_mask;
605 uf.opcode = f->opcode;
606 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
607 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
610 len = min_t(unsigned int, len, sizeof(uf));
611 if (copy_from_user(&uf, optval, len)) {
616 if (!capable(CAP_NET_RAW)) {
617 uf.type_mask &= hci_sec_filter.type_mask;
618 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
619 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
623 struct hci_filter *f = &hci_pi(sk)->filter;
625 f->type_mask = uf.type_mask;
626 f->opcode = uf.opcode;
627 *((u32 *) f->event_mask + 0) = uf.event_mask[0];
628 *((u32 *) f->event_mask + 1) = uf.event_mask[1];
641 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
643 struct hci_ufilter uf;
644 struct sock *sk = sock->sk;
647 if (get_user(len, optlen))
652 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
657 if (put_user(opt, optval))
662 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
667 if (put_user(opt, optval))
673 struct hci_filter *f = &hci_pi(sk)->filter;
675 uf.type_mask = f->type_mask;
676 uf.opcode = f->opcode;
677 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
678 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
681 len = min_t(unsigned int, len, sizeof(uf));
682 if (copy_to_user(optval, &uf, len))
694 static const struct proto_ops hci_sock_ops = {
695 .family = PF_BLUETOOTH,
696 .owner = THIS_MODULE,
697 .release = hci_sock_release,
698 .bind = hci_sock_bind,
699 .getname = hci_sock_getname,
700 .sendmsg = hci_sock_sendmsg,
701 .recvmsg = hci_sock_recvmsg,
702 .ioctl = hci_sock_ioctl,
703 .poll = datagram_poll,
704 .listen = sock_no_listen,
705 .shutdown = sock_no_shutdown,
706 .setsockopt = hci_sock_setsockopt,
707 .getsockopt = hci_sock_getsockopt,
708 .connect = sock_no_connect,
709 .socketpair = sock_no_socketpair,
710 .accept = sock_no_accept,
714 static struct proto hci_sk_proto = {
716 .owner = THIS_MODULE,
717 .obj_size = sizeof(struct hci_pinfo)
720 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
725 BT_DBG("sock %p", sock);
727 if (sock->type != SOCK_RAW)
728 return -ESOCKTNOSUPPORT;
730 sock->ops = &hci_sock_ops;
732 sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
736 sock_init_data(sock, sk);
738 sock_reset_flag(sk, SOCK_ZAPPED);
740 sk->sk_protocol = protocol;
742 sock->state = SS_UNCONNECTED;
743 sk->sk_state = BT_OPEN;
745 bt_sock_link(&hci_sk_list, sk);
749 static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
751 struct hci_dev *hdev = (struct hci_dev *) ptr;
752 struct hci_ev_si_device ev;
754 BT_DBG("hdev %s event %ld", hdev->name, event);
756 /* Send event to sockets */
758 ev.dev_id = hdev->id;
759 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
761 if (event == HCI_DEV_UNREG) {
763 struct hlist_node *node;
765 /* Detach sockets from device */
766 read_lock(&hci_sk_list.lock);
767 sk_for_each(sk, node, &hci_sk_list.head) {
769 bh_lock_sock_nested(sk);
770 if (hci_pi(sk)->hdev == hdev) {
771 hci_pi(sk)->hdev = NULL;
773 sk->sk_state = BT_OPEN;
774 sk->sk_state_change(sk);
781 read_unlock(&hci_sk_list.lock);
787 static const struct net_proto_family hci_sock_family_ops = {
788 .family = PF_BLUETOOTH,
789 .owner = THIS_MODULE,
790 .create = hci_sock_create,
793 static struct notifier_block hci_sock_nblock = {
794 .notifier_call = hci_sock_dev_event
797 int __init hci_sock_init(void)
801 err = proto_register(&hci_sk_proto, 0);
805 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
809 hci_register_notifier(&hci_sock_nblock);
811 BT_INFO("HCI socket layer initialized");
816 BT_ERR("HCI socket registration failed");
817 proto_unregister(&hci_sk_proto);
821 void hci_sock_cleanup(void)
823 if (bt_sock_unregister(BTPROTO_HCI) < 0)
824 BT_ERR("HCI socket unregistration failed");
826 hci_unregister_notifier(&hci_sock_nblock);
828 proto_unregister(&hci_sk_proto);