2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI sockets. */
27 #include <linux/module.h>
29 #include <linux/types.h>
30 #include <linux/capability.h>
31 #include <linux/errno.h>
32 #include <linux/kernel.h>
33 #include <linux/slab.h>
34 #include <linux/poll.h>
35 #include <linux/fcntl.h>
36 #include <linux/init.h>
37 #include <linux/skbuff.h>
38 #include <linux/workqueue.h>
39 #include <linux/interrupt.h>
40 #include <linux/compat.h>
41 #include <linux/socket.h>
42 #include <linux/ioctl.h>
45 #include <asm/system.h>
46 #include <linux/uaccess.h>
47 #include <asm/unaligned.h>
49 #include <net/bluetooth/bluetooth.h>
50 #include <net/bluetooth/hci_core.h>
52 static bool enable_mgmt;
54 /* ----- HCI socket interface ----- */
56 static inline int hci_test_bit(int nr, void *addr)
58 return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
62 static struct hci_sec_filter hci_sec_filter = {
66 { 0x1000d9fe, 0x0000b00c },
71 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
73 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
75 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
77 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
78 /* OGF_STATUS_PARAM */
79 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
83 static struct bt_sock_list hci_sk_list = {
84 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
87 /* Send frame to RAW socket */
88 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb,
92 struct hlist_node *node;
94 BT_DBG("hdev %p len %d", hdev, skb->len);
96 read_lock(&hci_sk_list.lock);
97 sk_for_each(sk, node, &hci_sk_list.head) {
98 struct hci_filter *flt;
104 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
107 /* Don't send frame to the socket it came from */
111 if (bt_cb(skb)->channel != hci_pi(sk)->channel)
114 if (bt_cb(skb)->channel == HCI_CHANNEL_CONTROL)
118 flt = &hci_pi(sk)->filter;
120 if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ?
121 0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask))
124 if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) {
125 register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
127 if (!hci_test_bit(evt, &flt->event_mask))
131 ((evt == HCI_EV_CMD_COMPLETE &&
133 get_unaligned((__le16 *)(skb->data + 3))) ||
134 (evt == HCI_EV_CMD_STATUS &&
136 get_unaligned((__le16 *)(skb->data + 4)))))
141 nskb = skb_clone(skb, GFP_ATOMIC);
145 /* Put type byte before the data */
146 if (bt_cb(skb)->channel == HCI_CHANNEL_RAW)
147 memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1);
149 if (sock_queue_rcv_skb(sk, nskb))
152 read_unlock(&hci_sk_list.lock);
155 static int hci_sock_release(struct socket *sock)
157 struct sock *sk = sock->sk;
158 struct hci_dev *hdev;
160 BT_DBG("sock %p sk %p", sock, sk);
165 hdev = hci_pi(sk)->hdev;
167 bt_sock_unlink(&hci_sk_list, sk);
170 atomic_dec(&hdev->promisc);
176 skb_queue_purge(&sk->sk_receive_queue);
177 skb_queue_purge(&sk->sk_write_queue);
183 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
188 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
193 err = hci_blacklist_add(hdev, &bdaddr);
195 hci_dev_unlock(hdev);
200 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
205 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
210 err = hci_blacklist_del(hdev, &bdaddr);
212 hci_dev_unlock(hdev);
217 /* Ioctls that require bound socket */
218 static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg)
220 struct hci_dev *hdev = hci_pi(sk)->hdev;
227 if (!capable(CAP_NET_ADMIN))
230 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
234 set_bit(HCI_RAW, &hdev->flags);
236 clear_bit(HCI_RAW, &hdev->flags);
241 return hci_get_conn_info(hdev, (void __user *) arg);
244 return hci_get_auth_info(hdev, (void __user *) arg);
247 if (!capable(CAP_NET_ADMIN))
249 return hci_sock_blacklist_add(hdev, (void __user *) arg);
252 if (!capable(CAP_NET_ADMIN))
254 return hci_sock_blacklist_del(hdev, (void __user *) arg);
258 return hdev->ioctl(hdev, cmd, arg);
263 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
265 struct sock *sk = sock->sk;
266 void __user *argp = (void __user *) arg;
269 BT_DBG("cmd %x arg %lx", cmd, arg);
273 return hci_get_dev_list(argp);
276 return hci_get_dev_info(argp);
279 return hci_get_conn_list(argp);
282 if (!capable(CAP_NET_ADMIN))
284 return hci_dev_open(arg);
287 if (!capable(CAP_NET_ADMIN))
289 return hci_dev_close(arg);
292 if (!capable(CAP_NET_ADMIN))
294 return hci_dev_reset(arg);
297 if (!capable(CAP_NET_ADMIN))
299 return hci_dev_reset_stat(arg);
309 if (!capable(CAP_NET_ADMIN))
311 return hci_dev_cmd(cmd, argp);
314 return hci_inquiry(argp);
318 err = hci_sock_bound_ioctl(sk, cmd, arg);
324 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
326 struct sockaddr_hci haddr;
327 struct sock *sk = sock->sk;
328 struct hci_dev *hdev = NULL;
331 BT_DBG("sock %p sk %p", sock, sk);
336 memset(&haddr, 0, sizeof(haddr));
337 len = min_t(unsigned int, sizeof(haddr), addr_len);
338 memcpy(&haddr, addr, len);
340 if (haddr.hci_family != AF_BLUETOOTH)
343 if (haddr.hci_channel > HCI_CHANNEL_CONTROL)
346 if (haddr.hci_channel == HCI_CHANNEL_CONTROL) {
349 set_bit(HCI_PI_MGMT_INIT, &hci_pi(sk)->flags);
354 if (sk->sk_state == BT_BOUND || hci_pi(sk)->hdev) {
359 if (haddr.hci_dev != HCI_DEV_NONE) {
360 hdev = hci_dev_get(haddr.hci_dev);
366 atomic_inc(&hdev->promisc);
369 hci_pi(sk)->channel = haddr.hci_channel;
370 hci_pi(sk)->hdev = hdev;
371 sk->sk_state = BT_BOUND;
378 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer)
380 struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
381 struct sock *sk = sock->sk;
382 struct hci_dev *hdev = hci_pi(sk)->hdev;
384 BT_DBG("sock %p sk %p", sock, sk);
391 *addr_len = sizeof(*haddr);
392 haddr->hci_family = AF_BLUETOOTH;
393 haddr->hci_dev = hdev->id;
399 static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
401 __u32 mask = hci_pi(sk)->cmsg_mask;
403 if (mask & HCI_CMSG_DIR) {
404 int incoming = bt_cb(skb)->incoming;
405 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming);
408 if (mask & HCI_CMSG_TSTAMP) {
410 struct compat_timeval ctv;
416 skb_get_timestamp(skb, &tv);
421 if (!COMPAT_USE_64BIT_TIME &&
422 (msg->msg_flags & MSG_CMSG_COMPAT)) {
423 ctv.tv_sec = tv.tv_sec;
424 ctv.tv_usec = tv.tv_usec;
430 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
434 static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
435 struct msghdr *msg, size_t len, int flags)
437 int noblock = flags & MSG_DONTWAIT;
438 struct sock *sk = sock->sk;
442 BT_DBG("sock %p, sk %p", sock, sk);
444 if (flags & (MSG_OOB))
447 if (sk->sk_state == BT_CLOSED)
450 skb = skb_recv_datagram(sk, flags, noblock, &err);
454 msg->msg_namelen = 0;
458 msg->msg_flags |= MSG_TRUNC;
462 skb_reset_transport_header(skb);
463 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
465 hci_sock_cmsg(sk, msg, skb);
467 skb_free_datagram(sk, skb);
469 return err ? : copied;
472 static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
473 struct msghdr *msg, size_t len)
475 struct sock *sk = sock->sk;
476 struct hci_dev *hdev;
480 BT_DBG("sock %p sk %p", sock, sk);
482 if (msg->msg_flags & MSG_OOB)
485 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
488 if (len < 4 || len > HCI_MAX_FRAME_SIZE)
493 switch (hci_pi(sk)->channel) {
494 case HCI_CHANNEL_RAW:
496 case HCI_CHANNEL_CONTROL:
497 err = mgmt_control(sk, msg, len);
504 hdev = hci_pi(sk)->hdev;
510 if (!test_bit(HCI_UP, &hdev->flags)) {
515 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
519 if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {
524 bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
526 skb->dev = (void *) hdev;
528 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
529 u16 opcode = get_unaligned_le16(skb->data);
530 u16 ogf = hci_opcode_ogf(opcode);
531 u16 ocf = hci_opcode_ocf(opcode);
533 if (((ogf > HCI_SFLT_MAX_OGF) ||
534 !hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) &&
535 !capable(CAP_NET_RAW)) {
540 if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) {
541 skb_queue_tail(&hdev->raw_q, skb);
542 queue_work(hdev->workqueue, &hdev->tx_work);
544 skb_queue_tail(&hdev->cmd_q, skb);
545 queue_work(hdev->workqueue, &hdev->cmd_work);
548 if (!capable(CAP_NET_RAW)) {
553 skb_queue_tail(&hdev->raw_q, skb);
554 queue_work(hdev->workqueue, &hdev->tx_work);
568 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len)
570 struct hci_ufilter uf = { .opcode = 0 };
571 struct sock *sk = sock->sk;
572 int err = 0, opt = 0;
574 BT_DBG("sk %p, opt %d", sk, optname);
580 if (get_user(opt, (int __user *)optval)) {
586 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
588 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
592 if (get_user(opt, (int __user *)optval)) {
598 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
600 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
605 struct hci_filter *f = &hci_pi(sk)->filter;
607 uf.type_mask = f->type_mask;
608 uf.opcode = f->opcode;
609 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
610 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
613 len = min_t(unsigned int, len, sizeof(uf));
614 if (copy_from_user(&uf, optval, len)) {
619 if (!capable(CAP_NET_RAW)) {
620 uf.type_mask &= hci_sec_filter.type_mask;
621 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
622 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
626 struct hci_filter *f = &hci_pi(sk)->filter;
628 f->type_mask = uf.type_mask;
629 f->opcode = uf.opcode;
630 *((u32 *) f->event_mask + 0) = uf.event_mask[0];
631 *((u32 *) f->event_mask + 1) = uf.event_mask[1];
644 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen)
646 struct hci_ufilter uf;
647 struct sock *sk = sock->sk;
650 if (get_user(len, optlen))
655 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
660 if (put_user(opt, optval))
665 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
670 if (put_user(opt, optval))
676 struct hci_filter *f = &hci_pi(sk)->filter;
678 uf.type_mask = f->type_mask;
679 uf.opcode = f->opcode;
680 uf.event_mask[0] = *((u32 *) f->event_mask + 0);
681 uf.event_mask[1] = *((u32 *) f->event_mask + 1);
684 len = min_t(unsigned int, len, sizeof(uf));
685 if (copy_to_user(optval, &uf, len))
697 static const struct proto_ops hci_sock_ops = {
698 .family = PF_BLUETOOTH,
699 .owner = THIS_MODULE,
700 .release = hci_sock_release,
701 .bind = hci_sock_bind,
702 .getname = hci_sock_getname,
703 .sendmsg = hci_sock_sendmsg,
704 .recvmsg = hci_sock_recvmsg,
705 .ioctl = hci_sock_ioctl,
706 .poll = datagram_poll,
707 .listen = sock_no_listen,
708 .shutdown = sock_no_shutdown,
709 .setsockopt = hci_sock_setsockopt,
710 .getsockopt = hci_sock_getsockopt,
711 .connect = sock_no_connect,
712 .socketpair = sock_no_socketpair,
713 .accept = sock_no_accept,
717 static struct proto hci_sk_proto = {
719 .owner = THIS_MODULE,
720 .obj_size = sizeof(struct hci_pinfo)
723 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
728 BT_DBG("sock %p", sock);
730 if (sock->type != SOCK_RAW)
731 return -ESOCKTNOSUPPORT;
733 sock->ops = &hci_sock_ops;
735 sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
739 sock_init_data(sock, sk);
741 sock_reset_flag(sk, SOCK_ZAPPED);
743 sk->sk_protocol = protocol;
745 sock->state = SS_UNCONNECTED;
746 sk->sk_state = BT_OPEN;
748 bt_sock_link(&hci_sk_list, sk);
752 static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr)
754 struct hci_dev *hdev = (struct hci_dev *) ptr;
755 struct hci_ev_si_device ev;
757 BT_DBG("hdev %s event %ld", hdev->name, event);
759 /* Send event to sockets */
761 ev.dev_id = hdev->id;
762 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
764 if (event == HCI_DEV_UNREG) {
766 struct hlist_node *node;
768 /* Detach sockets from device */
769 read_lock(&hci_sk_list.lock);
770 sk_for_each(sk, node, &hci_sk_list.head) {
771 bh_lock_sock_nested(sk);
772 if (hci_pi(sk)->hdev == hdev) {
773 hci_pi(sk)->hdev = NULL;
775 sk->sk_state = BT_OPEN;
776 sk->sk_state_change(sk);
782 read_unlock(&hci_sk_list.lock);
788 static const struct net_proto_family hci_sock_family_ops = {
789 .family = PF_BLUETOOTH,
790 .owner = THIS_MODULE,
791 .create = hci_sock_create,
794 static struct notifier_block hci_sock_nblock = {
795 .notifier_call = hci_sock_dev_event
798 int __init hci_sock_init(void)
802 err = proto_register(&hci_sk_proto, 0);
806 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
810 hci_register_notifier(&hci_sock_nblock);
812 BT_INFO("HCI socket layer initialized");
817 BT_ERR("HCI socket registration failed");
818 proto_unregister(&hci_sk_proto);
822 void hci_sock_cleanup(void)
824 if (bt_sock_unregister(BTPROTO_HCI) < 0)
825 BT_ERR("HCI socket unregistration failed");
827 hci_unregister_notifier(&hci_sock_nblock);
829 proto_unregister(&hci_sk_proto);
832 module_param(enable_mgmt, bool, 0644);
833 MODULE_PARM_DESC(enable_mgmt, "Enable Management interface");