net/bluetooth/hci_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI sockets. */
  26
  27 #include <linux/export.h>
  28 #include <linux/utsname.h>
  29 #include <linux/sched.h>
  30 #include <asm/unaligned.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/hci_mon.h>
  35 #include <net/bluetooth/mgmt.h>
  36
  37 #include "mgmt_util.h"
  38
  39 static LIST_HEAD(mgmt_chan_list);
  40 static DEFINE_MUTEX(mgmt_chan_list_lock);
  41
  42 static DEFINE_IDA(sock_cookie_ida);
  43
  44 static atomic_t monitor_promisc = ATOMIC_INIT(0);
  45
  46 /* ----- HCI socket interface ----- */
  47
  48 /* Socket info */
  49 #define hci_pi(sk) ((struct hci_pinfo *) sk)
  50
  51 struct hci_pinfo {
  52         struct bt_sock    bt;
  53         struct hci_dev    *hdev;
  54         struct hci_filter filter;
  55         __u32             cmsg_mask;
  56         unsigned short    channel;
  57         unsigned long     flags;
  58         __u32             cookie;
  59         char              comm[TASK_COMM_LEN];
  60 };
  61
  62 void hci_sock_set_flag(struct sock *sk, int nr)
  63 {
  64         set_bit(nr, &hci_pi(sk)->flags);
  65 }
  66
  67 void hci_sock_clear_flag(struct sock *sk, int nr)
  68 {
  69         clear_bit(nr, &hci_pi(sk)->flags);
  70 }
  71
  72 int hci_sock_test_flag(struct sock *sk, int nr)
  73 {
  74         return test_bit(nr, &hci_pi(sk)->flags);
  75 }
  76
  77 unsigned short hci_sock_get_channel(struct sock *sk)
  78 {
  79         return hci_pi(sk)->channel;
  80 }
  81
  82 u32 hci_sock_get_cookie(struct sock *sk)
  83 {
  84         return hci_pi(sk)->cookie;
  85 }
  86
  87 static bool hci_sock_gen_cookie(struct sock *sk)
  88 {
  89         int id = hci_pi(sk)->cookie;
  90
  91         if (!id) {
  92                 id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL);
  93                 if (id < 0)
  94                         id = 0xffffffff;
  95
  96                 hci_pi(sk)->cookie = id;
  97                 get_task_comm(hci_pi(sk)->comm, current);
  98                 return true;
  99         }
 100
 101         return false;
 102 }
 103
 104 static void hci_sock_free_cookie(struct sock *sk)
 105 {
 106         int id = hci_pi(sk)->cookie;
 107
 108         if (id) {
 109                 hci_pi(sk)->cookie = 0xffffffff;
 110                 ida_simple_remove(&sock_cookie_ida, id);
 111         }
 112 }
 113
 114 static inline int hci_test_bit(int nr, const void *addr)
 115 {
 116         return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
 117 }
 118
 119 /* Security filter */
 120 #define HCI_SFLT_MAX_OGF  5
 121
 122 struct hci_sec_filter {
 123         __u32 type_mask;
 124         __u32 event_mask[2];
 125         __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
 126 };
 127
 128 static const struct hci_sec_filter hci_sec_filter = {
 129         /* Packet types */
 130         0x10,
 131         /* Events */
 132         { 0x1000d9fe, 0x0000b00c },
 133         /* Commands */
 134         {
 135                 { 0x0 },
 136                 /* OGF_LINK_CTL */
 137                 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
 138                 /* OGF_LINK_POLICY */
 139                 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
 140                 /* OGF_HOST_CTL */
 141                 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
 142                 /* OGF_INFO_PARAM */
 143                 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
 144                 /* OGF_STATUS_PARAM */
 145                 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
 146         }
 147 };
 148
 149 static struct bt_sock_list hci_sk_list = {
 150         .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
 151 };
 152
 153 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
 154 {
 155         struct hci_filter *flt;
 156         int flt_type, flt_event;
 157
 158         /* Apply filter */
 159         flt = &hci_pi(sk)->filter;
 160
 161         flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS;
 162
 163         if (!test_bit(flt_type, &flt->type_mask))
 164                 return true;
 165
 166         /* Extra filter for event packets only */
 167         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT)
 168                 return false;
 169
 170         flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 171
 172         if (!hci_test_bit(flt_event, &flt->event_mask))
 173                 return true;
 174
 175         /* Check filter only when opcode is set */
 176         if (!flt->opcode)
 177                 return false;
 178
 179         if (flt_event == HCI_EV_CMD_COMPLETE &&
 180             flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
 181                 return true;
 182
 183         if (flt_event == HCI_EV_CMD_STATUS &&
 184             flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
 185                 return true;
 186
 187         return false;
 188 }
 189
 190 /* Send frame to RAW socket */
 191 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 192 {
 193         struct sock *sk;
 194         struct sk_buff *skb_copy = NULL;
 195
 196         BT_DBG("hdev %p len %d", hdev, skb->len);
 197
 198         read_lock(&hci_sk_list.lock);
 199
 200         sk_for_each(sk, &hci_sk_list.head) {
 201                 struct sk_buff *nskb;
 202
 203                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
 204                         continue;
 205
 206                 /* Don't send frame to the socket it came from */
 207                 if (skb->sk == sk)
 208                         continue;
 209
 210                 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
 211                         if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
 212                             hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
 213                             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
 214                             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT)
 215                                 continue;
 216                         if (is_filtered_packet(sk, skb))
 217                                 continue;
 218                 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
 219                         if (!bt_cb(skb)->incoming)
 220                                 continue;
 221                         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
 222                             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
 223                             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT)
 224                                 continue;
 225                 } else {
 226                         /* Don't send frame to other channel types */
 227                         continue;
 228                 }
 229
 230                 if (!skb_copy) {
 231                         /* Create a private copy with headroom */
 232                         skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
 233                         if (!skb_copy)
 234                                 continue;
 235
 236                         /* Put type byte before the data */
 237                         memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1);
 238                 }
 239
 240                 nskb = skb_clone(skb_copy, GFP_ATOMIC);
 241                 if (!nskb)
 242                         continue;
 243
 244                 if (sock_queue_rcv_skb(sk, nskb))
 245                         kfree_skb(nskb);
 246         }
 247
 248         read_unlock(&hci_sk_list.lock);
 249
 250         kfree_skb(skb_copy);
 251 }
 252
 253 /* Send frame to sockets with specific channel */
 254 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
 255                          int flag, struct sock *skip_sk)
 256 {
 257         struct sock *sk;
 258
 259         BT_DBG("channel %u len %d", channel, skb->len);
 260
 261         read_lock(&hci_sk_list.lock);
 262
 263         sk_for_each(sk, &hci_sk_list.head) {
 264                 struct sk_buff *nskb;
 265
 266                 /* Ignore socket without the flag set */
 267                 if (!hci_sock_test_flag(sk, flag))
 268                         continue;
 269
 270                 /* Skip the original socket */
 271                 if (sk == skip_sk)
 272                         continue;
 273
 274                 if (sk->sk_state != BT_BOUND)
 275                         continue;
 276
 277                 if (hci_pi(sk)->channel != channel)
 278                         continue;
 279
 280                 nskb = skb_clone(skb, GFP_ATOMIC);
 281                 if (!nskb)
 282                         continue;
 283
 284                 if (sock_queue_rcv_skb(sk, nskb))
 285                         kfree_skb(nskb);
 286         }
 287
 288         read_unlock(&hci_sk_list.lock);
 289 }
 290
 291 /* Send frame to monitor socket */
 292 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 293 {
 294         struct sk_buff *skb_copy = NULL;
 295         struct hci_mon_hdr *hdr;
 296         __le16 opcode;
 297
 298         if (!atomic_read(&monitor_promisc))
 299                 return;
 300
 301         BT_DBG("hdev %p len %d", hdev, skb->len);
 302
 303         switch (hci_skb_pkt_type(skb)) {
 304         case HCI_COMMAND_PKT:
 305                 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
 306                 break;
 307         case HCI_EVENT_PKT:
 308                 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
 309                 break;
 310         case HCI_ACLDATA_PKT:
 311                 if (bt_cb(skb)->incoming)
 312                         opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
 313                 else
 314                         opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
 315                 break;
 316         case HCI_SCODATA_PKT:
 317                 if (bt_cb(skb)->incoming)
 318                         opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
 319                 else
 320                         opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
 321                 break;
 322         case HCI_DIAG_PKT:
 323                 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG);
 324                 break;
 325         default:
 326                 return;
 327         }
 328
 329         /* Create a private copy with headroom */
 330         skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true);
 331         if (!skb_copy)
 332                 return;
 333
 334         /* Put header before the data */
 335         hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE);
 336         hdr->opcode = opcode;
 337         hdr->index = cpu_to_le16(hdev->id);
 338         hdr->len = cpu_to_le16(skb->len);
 339
 340         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy,
 341                             HCI_SOCK_TRUSTED, NULL);
 342         kfree_skb(skb_copy);
 343 }
 344
 345 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event,
 346                                  void *data, u16 data_len, ktime_t tstamp,
 347                                  int flag, struct sock *skip_sk)
 348 {
 349         struct sock *sk;
 350         __le16 index;
 351
 352         if (hdev)
 353                 index = cpu_to_le16(hdev->id);
 354         else
 355                 index = cpu_to_le16(MGMT_INDEX_NONE);
 356
 357         read_lock(&hci_sk_list.lock);
 358
 359         sk_for_each(sk, &hci_sk_list.head) {
 360                 struct hci_mon_hdr *hdr;
 361                 struct sk_buff *skb;
 362
 363                 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL)
 364                         continue;
 365
 366                 /* Ignore socket without the flag set */
 367                 if (!hci_sock_test_flag(sk, flag))
 368                         continue;
 369
 370                 /* Skip the original socket */
 371                 if (sk == skip_sk)
 372                         continue;
 373
 374                 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC);
 375                 if (!skb)
 376                         continue;
 377
 378                 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 379                 put_unaligned_le16(event, skb_put(skb, 2));
 380
 381                 if (data)
 382                         skb_put_data(skb, data, data_len);
 383
 384                 skb->tstamp = tstamp;
 385
 386                 hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 387                 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT);
 388                 hdr->index = index;
 389                 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 390
 391                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 392                                     HCI_SOCK_TRUSTED, NULL);
 393                 kfree_skb(skb);
 394         }
 395
 396         read_unlock(&hci_sk_list.lock);
 397 }
 398
 399 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 400 {
 401         struct hci_mon_hdr *hdr;
 402         struct hci_mon_new_index *ni;
 403         struct hci_mon_index_info *ii;
 404         struct sk_buff *skb;
 405         __le16 opcode;
 406
 407         switch (event) {
 408         case HCI_DEV_REG:
 409                 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
 410                 if (!skb)
 411                         return NULL;
 412
 413                 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
 414                 ni->type = hdev->dev_type;
 415                 ni->bus = hdev->bus;
 416                 bacpy(&ni->bdaddr, &hdev->bdaddr);
 417                 memcpy(ni->name, hdev->name, 8);
 418
 419                 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 420                 break;
 421
 422         case HCI_DEV_UNREG:
 423                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 424                 if (!skb)
 425                         return NULL;
 426
 427                 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
 428                 break;
 429
 430         case HCI_DEV_SETUP:
 431                 if (hdev->manufacturer == 0xffff)
 432                         return NULL;
 433
 434                 /* fall through */
 435
 436         case HCI_DEV_UP:
 437                 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC);
 438                 if (!skb)
 439                         return NULL;
 440
 441                 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE);
 442                 bacpy(&ii->bdaddr, &hdev->bdaddr);
 443                 ii->manufacturer = cpu_to_le16(hdev->manufacturer);
 444
 445                 opcode = cpu_to_le16(HCI_MON_INDEX_INFO);
 446                 break;
 447
 448         case HCI_DEV_OPEN:
 449                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 450                 if (!skb)
 451                         return NULL;
 452
 453                 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX);
 454                 break;
 455
 456         case HCI_DEV_CLOSE:
 457                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 458                 if (!skb)
 459                         return NULL;
 460
 461                 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX);
 462                 break;
 463
 464         default:
 465                 return NULL;
 466         }
 467
 468         __net_timestamp(skb);
 469
 470         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 471         hdr->opcode = opcode;
 472         hdr->index = cpu_to_le16(hdev->id);
 473         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 474
 475         return skb;
 476 }
 477
 478 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk)
 479 {
 480         struct hci_mon_hdr *hdr;
 481         struct sk_buff *skb;
 482         u16 format;
 483         u8 ver[3];
 484         u32 flags;
 485
 486         /* No message needed when cookie is not present */
 487         if (!hci_pi(sk)->cookie)
 488                 return NULL;
 489
 490         switch (hci_pi(sk)->channel) {
 491         case HCI_CHANNEL_RAW:
 492                 format = 0x0000;
 493                 ver[0] = BT_SUBSYS_VERSION;
 494                 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
 495                 break;
 496         case HCI_CHANNEL_USER:
 497                 format = 0x0001;
 498                 ver[0] = BT_SUBSYS_VERSION;
 499                 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1);
 500                 break;
 501         case HCI_CHANNEL_CONTROL:
 502                 format = 0x0002;
 503                 mgmt_fill_version_info(ver);
 504                 break;
 505         default:
 506                 /* No message for unsupported format */
 507                 return NULL;
 508         }
 509
 510         skb = bt_skb_alloc(14 + TASK_COMM_LEN , GFP_ATOMIC);
 511         if (!skb)
 512                 return NULL;
 513
 514         flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0;
 515
 516         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 517         put_unaligned_le16(format, skb_put(skb, 2));
 518         skb_put_data(skb, ver, sizeof(ver));
 519         put_unaligned_le32(flags, skb_put(skb, 4));
 520         skb_put_u8(skb, TASK_COMM_LEN);
 521         skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN);
 522
 523         __net_timestamp(skb);
 524
 525         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 526         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN);
 527         if (hci_pi(sk)->hdev)
 528                 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
 529         else
 530                 hdr->index = cpu_to_le16(HCI_DEV_NONE);
 531         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 532
 533         return skb;
 534 }
 535
 536 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk)
 537 {
 538         struct hci_mon_hdr *hdr;
 539         struct sk_buff *skb;
 540
 541         /* No message needed when cookie is not present */
 542         if (!hci_pi(sk)->cookie)
 543                 return NULL;
 544
 545         switch (hci_pi(sk)->channel) {
 546         case HCI_CHANNEL_RAW:
 547         case HCI_CHANNEL_USER:
 548         case HCI_CHANNEL_CONTROL:
 549                 break;
 550         default:
 551                 /* No message for unsupported format */
 552                 return NULL;
 553         }
 554
 555         skb = bt_skb_alloc(4, GFP_ATOMIC);
 556         if (!skb)
 557                 return NULL;
 558
 559         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 560
 561         __net_timestamp(skb);
 562
 563         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 564         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE);
 565         if (hci_pi(sk)->hdev)
 566                 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id);
 567         else
 568                 hdr->index = cpu_to_le16(HCI_DEV_NONE);
 569         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 570
 571         return skb;
 572 }
 573
 574 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index,
 575                                                    u16 opcode, u16 len,
 576                                                    const void *buf)
 577 {
 578         struct hci_mon_hdr *hdr;
 579         struct sk_buff *skb;
 580
 581         skb = bt_skb_alloc(6 + len, GFP_ATOMIC);
 582         if (!skb)
 583                 return NULL;
 584
 585         put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4));
 586         put_unaligned_le16(opcode, skb_put(skb, 2));
 587
 588         if (buf)
 589                 skb_put_data(skb, buf, len);
 590
 591         __net_timestamp(skb);
 592
 593         hdr = skb_push(skb, HCI_MON_HDR_SIZE);
 594         hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND);
 595         hdr->index = cpu_to_le16(index);
 596         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 597
 598         return skb;
 599 }
 600
 601 static void __printf(2, 3)
 602 send_monitor_note(struct sock *sk, const char *fmt, ...)
 603 {
 604         size_t len;
 605         struct hci_mon_hdr *hdr;
 606         struct sk_buff *skb;
 607         va_list args;
 608
 609         va_start(args, fmt);
 610         len = vsnprintf(NULL, 0, fmt, args);
 611         va_end(args);
 612
 613         skb = bt_skb_alloc(len + 1, GFP_ATOMIC);
 614         if (!skb)
 615                 return;
 616
 617         va_start(args, fmt);
 618         vsprintf(skb_put(skb, len), fmt, args);
 619         *(u8 *)skb_put(skb, 1) = 0;
 620         va_end(args);
 621
 622         __net_timestamp(skb);
 623
 624         hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE);
 625         hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE);
 626         hdr->index = cpu_to_le16(HCI_DEV_NONE);
 627         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 628
 629         if (sock_queue_rcv_skb(sk, skb))
 630                 kfree_skb(skb);
 631 }
 632
 633 static void send_monitor_replay(struct sock *sk)
 634 {
 635         struct hci_dev *hdev;
 636
 637         read_lock(&hci_dev_list_lock);
 638
 639         list_for_each_entry(hdev, &hci_dev_list, list) {
 640                 struct sk_buff *skb;
 641
 642                 skb = create_monitor_event(hdev, HCI_DEV_REG);
 643                 if (!skb)
 644                         continue;
 645
 646                 if (sock_queue_rcv_skb(sk, skb))
 647                         kfree_skb(skb);
 648
 649                 if (!test_bit(HCI_RUNNING, &hdev->flags))
 650                         continue;
 651
 652                 skb = create_monitor_event(hdev, HCI_DEV_OPEN);
 653                 if (!skb)
 654                         continue;
 655
 656                 if (sock_queue_rcv_skb(sk, skb))
 657                         kfree_skb(skb);
 658
 659                 if (test_bit(HCI_UP, &hdev->flags))
 660                         skb = create_monitor_event(hdev, HCI_DEV_UP);
 661                 else if (hci_dev_test_flag(hdev, HCI_SETUP))
 662                         skb = create_monitor_event(hdev, HCI_DEV_SETUP);
 663                 else
 664                         skb = NULL;
 665
 666                 if (skb) {
 667                         if (sock_queue_rcv_skb(sk, skb))
 668                                 kfree_skb(skb);
 669                 }
 670         }
 671
 672         read_unlock(&hci_dev_list_lock);
 673 }
 674
 675 static void send_monitor_control_replay(struct sock *mon_sk)
 676 {
 677         struct sock *sk;
 678
 679         read_lock(&hci_sk_list.lock);
 680
 681         sk_for_each(sk, &hci_sk_list.head) {
 682                 struct sk_buff *skb;
 683
 684                 skb = create_monitor_ctrl_open(sk);
 685                 if (!skb)
 686                         continue;
 687
 688                 if (sock_queue_rcv_skb(mon_sk, skb))
 689                         kfree_skb(skb);
 690         }
 691
 692         read_unlock(&hci_sk_list.lock);
 693 }
 694
 695 /* Generate internal stack event */
 696 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
 697 {
 698         struct hci_event_hdr *hdr;
 699         struct hci_ev_stack_internal *ev;
 700         struct sk_buff *skb;
 701
 702         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
 703         if (!skb)
 704                 return;
 705
 706         hdr = skb_put(skb, HCI_EVENT_HDR_SIZE);
 707         hdr->evt  = HCI_EV_STACK_INTERNAL;
 708         hdr->plen = sizeof(*ev) + dlen;
 709
 710         ev = skb_put(skb, sizeof(*ev) + dlen);
 711         ev->type = type;
 712         memcpy(ev->data, data, dlen);
 713
 714         bt_cb(skb)->incoming = 1;
 715         __net_timestamp(skb);
 716
 717         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 718         hci_send_to_sock(hdev, skb);
 719         kfree_skb(skb);
 720 }
 721
 722 void hci_sock_dev_event(struct hci_dev *hdev, int event)
 723 {
 724         BT_DBG("hdev %s event %d", hdev->name, event);
 725
 726         if (atomic_read(&monitor_promisc)) {
 727                 struct sk_buff *skb;
 728
 729                 /* Send event to monitor */
 730                 skb = create_monitor_event(hdev, event);
 731                 if (skb) {
 732                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 733                                             HCI_SOCK_TRUSTED, NULL);
 734                         kfree_skb(skb);
 735                 }
 736         }
 737
 738         if (event <= HCI_DEV_DOWN) {
 739                 struct hci_ev_si_device ev;
 740
 741                 /* Send event to sockets */
 742                 ev.event  = event;
 743                 ev.dev_id = hdev->id;
 744                 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
 745         }
 746
 747         if (event == HCI_DEV_UNREG) {
 748                 struct sock *sk;
 749
 750                 /* Detach sockets from device */
 751                 read_lock(&hci_sk_list.lock);
 752                 sk_for_each(sk, &hci_sk_list.head) {
 753                         bh_lock_sock_nested(sk);
 754                         if (hci_pi(sk)->hdev == hdev) {
 755                                 hci_pi(sk)->hdev = NULL;
 756                                 sk->sk_err = EPIPE;
 757                                 sk->sk_state = BT_OPEN;
 758                                 sk->sk_state_change(sk);
 759
 760                                 hci_dev_put(hdev);
 761                         }
 762                         bh_unlock_sock(sk);
 763                 }
 764                 read_unlock(&hci_sk_list.lock);
 765         }
 766 }
 767
 768 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel)
 769 {
 770         struct hci_mgmt_chan *c;
 771
 772         list_for_each_entry(c, &mgmt_chan_list, list) {
 773                 if (c->channel == channel)
 774                         return c;
 775         }
 776
 777         return NULL;
 778 }
 779
 780 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel)
 781 {
 782         struct hci_mgmt_chan *c;
 783
 784         mutex_lock(&mgmt_chan_list_lock);
 785         c = __hci_mgmt_chan_find(channel);
 786         mutex_unlock(&mgmt_chan_list_lock);
 787
 788         return c;
 789 }
 790
 791 int hci_mgmt_chan_register(struct hci_mgmt_chan *c)
 792 {
 793         if (c->channel < HCI_CHANNEL_CONTROL)
 794                 return -EINVAL;
 795
 796         mutex_lock(&mgmt_chan_list_lock);
 797         if (__hci_mgmt_chan_find(c->channel)) {
 798                 mutex_unlock(&mgmt_chan_list_lock);
 799                 return -EALREADY;
 800         }
 801
 802         list_add_tail(&c->list, &mgmt_chan_list);
 803
 804         mutex_unlock(&mgmt_chan_list_lock);
 805
 806         return 0;
 807 }
 808 EXPORT_SYMBOL(hci_mgmt_chan_register);
 809
 810 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c)
 811 {
 812         mutex_lock(&mgmt_chan_list_lock);
 813         list_del(&c->list);
 814         mutex_unlock(&mgmt_chan_list_lock);
 815 }
 816 EXPORT_SYMBOL(hci_mgmt_chan_unregister);
 817
 818 static int hci_sock_release(struct socket *sock)
 819 {
 820         struct sock *sk = sock->sk;
 821         struct hci_dev *hdev;
 822         struct sk_buff *skb;
 823
 824         BT_DBG("sock %p sk %p", sock, sk);
 825
 826         if (!sk)
 827                 return 0;
 828
 829         hdev = hci_pi(sk)->hdev;
 830
 831         switch (hci_pi(sk)->channel) {
 832         case HCI_CHANNEL_MONITOR:
 833                 atomic_dec(&monitor_promisc);
 834                 break;
 835         case HCI_CHANNEL_RAW:
 836         case HCI_CHANNEL_USER:
 837         case HCI_CHANNEL_CONTROL:
 838                 /* Send event to monitor */
 839                 skb = create_monitor_ctrl_close(sk);
 840                 if (skb) {
 841                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 842                                             HCI_SOCK_TRUSTED, NULL);
 843                         kfree_skb(skb);
 844                 }
 845
 846                 hci_sock_free_cookie(sk);
 847                 break;
 848         }
 849
 850         bt_sock_unlink(&hci_sk_list, sk);
 851
 852         if (hdev) {
 853                 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
 854                         /* When releasing a user channel exclusive access,
 855                          * call hci_dev_do_close directly instead of calling
 856                          * hci_dev_close to ensure the exclusive access will
 857                          * be released and the controller brought back down.
 858                          *
 859                          * The checking of HCI_AUTO_OFF is not needed in this
 860                          * case since it will have been cleared already when
 861                          * opening the user channel.
 862                          */
 863                         hci_dev_do_close(hdev);
 864                         hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
 865                         mgmt_index_added(hdev);
 866                 }
 867
 868                 atomic_dec(&hdev->promisc);
 869                 hci_dev_put(hdev);
 870         }
 871
 872         sock_orphan(sk);
 873
 874         skb_queue_purge(&sk->sk_receive_queue);
 875         skb_queue_purge(&sk->sk_write_queue);
 876
 877         sock_put(sk);
 878         return 0;
 879 }
 880
 881 #ifdef CONFIG_BT_LEGACY_IOCTL
 882 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 883 {
 884         bdaddr_t bdaddr;
 885         int err;
 886
 887         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
 888                 return -EFAULT;
 889
 890         hci_dev_lock(hdev);
 891
 892         err = hci_bdaddr_list_add(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
 893
 894         hci_dev_unlock(hdev);
 895
 896         return err;
 897 }
 898
 899 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 900 {
 901         bdaddr_t bdaddr;
 902         int err;
 903
 904         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
 905                 return -EFAULT;
 906
 907         hci_dev_lock(hdev);
 908
 909         err = hci_bdaddr_list_del(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
 910
 911         hci_dev_unlock(hdev);
 912
 913         return err;
 914 }
 915
 916 /* Ioctls that require bound socket */
 917 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
 918                                 unsigned long arg)
 919 {
 920         struct hci_dev *hdev = hci_pi(sk)->hdev;
 921
 922         if (!hdev)
 923                 return -EBADFD;
 924
 925         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
 926                 return -EBUSY;
 927
 928         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
 929                 return -EOPNOTSUPP;
 930
 931         if (hdev->dev_type != HCI_PRIMARY)
 932                 return -EOPNOTSUPP;
 933
 934         switch (cmd) {
 935         case HCISETRAW:
 936                 if (!capable(CAP_NET_ADMIN))
 937                         return -EPERM;
 938                 return -EOPNOTSUPP;
 939
 940         case HCIGETCONNINFO:
 941                 return hci_get_conn_info(hdev, (void __user *)arg);
 942
 943         case HCIGETAUTHINFO:
 944                 return hci_get_auth_info(hdev, (void __user *)arg);
 945
 946         case HCIBLOCKADDR:
 947                 if (!capable(CAP_NET_ADMIN))
 948                         return -EPERM;
 949                 return hci_sock_blacklist_add(hdev, (void __user *)arg);
 950
 951         case HCIUNBLOCKADDR:
 952                 if (!capable(CAP_NET_ADMIN))
 953                         return -EPERM;
 954                 return hci_sock_blacklist_del(hdev, (void __user *)arg);
 955         }
 956
 957         return -ENOIOCTLCMD;
 958 }
 959
 960 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
 961                           unsigned long arg)
 962 {
 963         void __user *argp = (void __user *)arg;
 964         struct sock *sk = sock->sk;
 965         int err;
 966
 967         BT_DBG("cmd %x arg %lx", cmd, arg);
 968
 969         lock_sock(sk);
 970
 971         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
 972                 err = -EBADFD;
 973                 goto done;
 974         }
 975
 976         /* When calling an ioctl on an unbound raw socket, then ensure
 977          * that the monitor gets informed. Ensure that the resulting event
 978          * is only send once by checking if the cookie exists or not. The
 979          * socket cookie will be only ever generated once for the lifetime
 980          * of a given socket.
 981          */
 982         if (hci_sock_gen_cookie(sk)) {
 983                 struct sk_buff *skb;
 984
 985                 if (capable(CAP_NET_ADMIN))
 986                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
 987
 988                 /* Send event to monitor */
 989                 skb = create_monitor_ctrl_open(sk);
 990                 if (skb) {
 991                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 992                                             HCI_SOCK_TRUSTED, NULL);
 993                         kfree_skb(skb);
 994                 }
 995         }
 996
 997         release_sock(sk);
 998
 999         switch (cmd) {
1000         case HCIGETDEVLIST:
1001                 return hci_get_dev_list(argp);
1002
1003         case HCIGETDEVINFO:
1004                 return hci_get_dev_info(argp);
1005
1006         case HCIGETCONNLIST:
1007                 return hci_get_conn_list(argp);
1008
1009         case HCIDEVUP:
1010                 if (!capable(CAP_NET_ADMIN))
1011                         return -EPERM;
1012                 return hci_dev_open(arg);
1013
1014         case HCIDEVDOWN:
1015                 if (!capable(CAP_NET_ADMIN))
1016                         return -EPERM;
1017                 return hci_dev_close(arg);
1018
1019         case HCIDEVRESET:
1020                 if (!capable(CAP_NET_ADMIN))
1021                         return -EPERM;
1022                 return hci_dev_reset(arg);
1023
1024         case HCIDEVRESTAT:
1025                 if (!capable(CAP_NET_ADMIN))
1026                         return -EPERM;
1027                 return hci_dev_reset_stat(arg);
1028
1029         case HCISETSCAN:
1030         case HCISETAUTH:
1031         case HCISETENCRYPT:
1032         case HCISETPTYPE:
1033         case HCISETLINKPOL:
1034         case HCISETLINKMODE:
1035         case HCISETACLMTU:
1036         case HCISETSCOMTU:
1037                 if (!capable(CAP_NET_ADMIN))
1038                         return -EPERM;
1039                 return hci_dev_cmd(cmd, argp);
1040
1041         case HCIINQUIRY:
1042                 return hci_inquiry(argp);
1043         }
1044
1045         lock_sock(sk);
1046
1047         err = hci_sock_bound_ioctl(sk, cmd, arg);
1048
1049 done:
1050         release_sock(sk);
1051         return err;
1052 }
1053 #endif
1054
1055 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
1056                          int addr_len)
1057 {
1058         struct sockaddr_hci haddr;
1059         struct sock *sk = sock->sk;
1060         struct hci_dev *hdev = NULL;
1061         struct sk_buff *skb;
1062         int len, err = 0;
1063
1064         BT_DBG("sock %p sk %p", sock, sk);
1065
1066         if (!addr)
1067                 return -EINVAL;
1068
1069         memset(&haddr, 0, sizeof(haddr));
1070         len = min_t(unsigned int, sizeof(haddr), addr_len);
1071         memcpy(&haddr, addr, len);
1072
1073         if (haddr.hci_family != AF_BLUETOOTH)
1074                 return -EINVAL;
1075
1076         lock_sock(sk);
1077
1078         if (sk->sk_state == BT_BOUND) {
1079                 err = -EALREADY;
1080                 goto done;
1081         }
1082
1083         switch (haddr.hci_channel) {
1084         case HCI_CHANNEL_RAW:
1085                 if (hci_pi(sk)->hdev) {
1086                         err = -EALREADY;
1087                         goto done;
1088                 }
1089
1090                 if (haddr.hci_dev != HCI_DEV_NONE) {
1091                         hdev = hci_dev_get(haddr.hci_dev);
1092                         if (!hdev) {
1093                                 err = -ENODEV;
1094                                 goto done;
1095                         }
1096
1097                         atomic_inc(&hdev->promisc);
1098                 }
1099
1100                 hci_pi(sk)->channel = haddr.hci_channel;
1101
1102                 if (!hci_sock_gen_cookie(sk)) {
1103                         /* In the case when a cookie has already been assigned,
1104                          * then there has been already an ioctl issued against
1105                          * an unbound socket and with that triggerd an open
1106                          * notification. Send a close notification first to
1107                          * allow the state transition to bounded.
1108                          */
1109                         skb = create_monitor_ctrl_close(sk);
1110                         if (skb) {
1111                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1112                                                     HCI_SOCK_TRUSTED, NULL);
1113                                 kfree_skb(skb);
1114                         }
1115                 }
1116
1117                 if (capable(CAP_NET_ADMIN))
1118                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1119
1120                 hci_pi(sk)->hdev = hdev;
1121
1122                 /* Send event to monitor */
1123                 skb = create_monitor_ctrl_open(sk);
1124                 if (skb) {
1125                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1126                                             HCI_SOCK_TRUSTED, NULL);
1127                         kfree_skb(skb);
1128                 }
1129                 break;
1130
1131         case HCI_CHANNEL_USER:
1132                 if (hci_pi(sk)->hdev) {
1133                         err = -EALREADY;
1134                         goto done;
1135                 }
1136
1137                 if (haddr.hci_dev == HCI_DEV_NONE) {
1138                         err = -EINVAL;
1139                         goto done;
1140                 }
1141
1142                 if (!capable(CAP_NET_ADMIN)) {
1143                         err = -EPERM;
1144                         goto done;
1145                 }
1146
1147                 hdev = hci_dev_get(haddr.hci_dev);
1148                 if (!hdev) {
1149                         err = -ENODEV;
1150                         goto done;
1151                 }
1152
1153                 if (test_bit(HCI_INIT, &hdev->flags) ||
1154                     hci_dev_test_flag(hdev, HCI_SETUP) ||
1155                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1156                     (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1157                      test_bit(HCI_UP, &hdev->flags))) {
1158                         err = -EBUSY;
1159                         hci_dev_put(hdev);
1160                         goto done;
1161                 }
1162
1163                 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) {
1164                         err = -EUSERS;
1165                         hci_dev_put(hdev);
1166                         goto done;
1167                 }
1168
1169                 mgmt_index_removed(hdev);
1170
1171                 err = hci_dev_open(hdev->id);
1172                 if (err) {
1173                         if (err == -EALREADY) {
1174                                 /* In case the transport is already up and
1175                                  * running, clear the error here.
1176                                  *
1177                                  * This can happen when opening a user
1178                                  * channel and HCI_AUTO_OFF grace period
1179                                  * is still active.
1180                                  */
1181                                 err = 0;
1182                         } else {
1183                                 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
1184                                 mgmt_index_added(hdev);
1185                                 hci_dev_put(hdev);
1186                                 goto done;
1187                         }
1188                 }
1189
1190                 hci_pi(sk)->channel = haddr.hci_channel;
1191
1192                 if (!hci_sock_gen_cookie(sk)) {
1193                         /* In the case when a cookie has already been assigned,
1194                          * this socket will transition from a raw socket into
1195                          * a user channel socket. For a clean transition, send
1196                          * the close notification first.
1197                          */
1198                         skb = create_monitor_ctrl_close(sk);
1199                         if (skb) {
1200                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1201                                                     HCI_SOCK_TRUSTED, NULL);
1202                                 kfree_skb(skb);
1203                         }
1204                 }
1205
1206                 /* The user channel is restricted to CAP_NET_ADMIN
1207                  * capabilities and with that implicitly trusted.
1208                  */
1209                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1210
1211                 hci_pi(sk)->hdev = hdev;
1212
1213                 /* Send event to monitor */
1214                 skb = create_monitor_ctrl_open(sk);
1215                 if (skb) {
1216                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1217                                             HCI_SOCK_TRUSTED, NULL);
1218                         kfree_skb(skb);
1219                 }
1220
1221                 atomic_inc(&hdev->promisc);
1222                 break;
1223
1224         case HCI_CHANNEL_MONITOR:
1225                 if (haddr.hci_dev != HCI_DEV_NONE) {
1226                         err = -EINVAL;
1227                         goto done;
1228                 }
1229
1230                 if (!capable(CAP_NET_RAW)) {
1231                         err = -EPERM;
1232                         goto done;
1233                 }
1234
1235                 hci_pi(sk)->channel = haddr.hci_channel;
1236
1237                 /* The monitor interface is restricted to CAP_NET_RAW
1238                  * capabilities and with that implicitly trusted.
1239                  */
1240                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1241
1242                 send_monitor_note(sk, "Linux version %s (%s)",
1243                                   init_utsname()->release,
1244                                   init_utsname()->machine);
1245                 send_monitor_note(sk, "Bluetooth subsystem version %u.%u",
1246                                   BT_SUBSYS_VERSION, BT_SUBSYS_REVISION);
1247                 send_monitor_replay(sk);
1248                 send_monitor_control_replay(sk);
1249
1250                 atomic_inc(&monitor_promisc);
1251                 break;
1252
1253         case HCI_CHANNEL_LOGGING:
1254                 if (haddr.hci_dev != HCI_DEV_NONE) {
1255                         err = -EINVAL;
1256                         goto done;
1257                 }
1258
1259                 if (!capable(CAP_NET_ADMIN)) {
1260                         err = -EPERM;
1261                         goto done;
1262                 }
1263
1264                 hci_pi(sk)->channel = haddr.hci_channel;
1265                 break;
1266
1267         default:
1268                 if (!hci_mgmt_chan_find(haddr.hci_channel)) {
1269                         err = -EINVAL;
1270                         goto done;
1271                 }
1272
1273                 if (haddr.hci_dev != HCI_DEV_NONE) {
1274                         err = -EINVAL;
1275                         goto done;
1276                 }
1277
1278                 /* Users with CAP_NET_ADMIN capabilities are allowed
1279                  * access to all management commands and events. For
1280                  * untrusted users the interface is restricted and
1281                  * also only untrusted events are sent.
1282                  */
1283                 if (capable(CAP_NET_ADMIN))
1284                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
1285
1286                 hci_pi(sk)->channel = haddr.hci_channel;
1287
1288                 /* At the moment the index and unconfigured index events
1289                  * are enabled unconditionally. Setting them on each
1290                  * socket when binding keeps this functionality. They
1291                  * however might be cleared later and then sending of these
1292                  * events will be disabled, but that is then intentional.
1293                  *
1294                  * This also enables generic events that are safe to be
1295                  * received by untrusted users. Example for such events
1296                  * are changes to settings, class of device, name etc.
1297                  */
1298                 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) {
1299                         if (!hci_sock_gen_cookie(sk)) {
1300                                 /* In the case when a cookie has already been
1301                                  * assigned, this socket will transtion from
1302                                  * a raw socket into a control socket. To
1303                                  * allow for a clean transtion, send the
1304                                  * close notification first.
1305                                  */
1306                                 skb = create_monitor_ctrl_close(sk);
1307                                 if (skb) {
1308                                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1309                                                             HCI_SOCK_TRUSTED, NULL);
1310                                         kfree_skb(skb);
1311                                 }
1312                         }
1313
1314                         /* Send event to monitor */
1315                         skb = create_monitor_ctrl_open(sk);
1316                         if (skb) {
1317                                 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1318                                                     HCI_SOCK_TRUSTED, NULL);
1319                                 kfree_skb(skb);
1320                         }
1321
1322                         hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS);
1323                         hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
1324                         hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS);
1325                         hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS);
1326                         hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS);
1327                         hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS);
1328                 }
1329                 break;
1330         }
1331
1332         sk->sk_state = BT_BOUND;
1333
1334 done:
1335         release_sock(sk);
1336         return err;
1337 }
1338
1339 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
1340                             int *addr_len, int peer)
1341 {
1342         struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr;
1343         struct sock *sk = sock->sk;
1344         struct hci_dev *hdev;
1345         int err = 0;
1346
1347         BT_DBG("sock %p sk %p", sock, sk);
1348
1349         if (peer)
1350                 return -EOPNOTSUPP;
1351
1352         lock_sock(sk);
1353
1354         hdev = hci_pi(sk)->hdev;
1355         if (!hdev) {
1356                 err = -EBADFD;
1357                 goto done;
1358         }
1359
1360         *addr_len = sizeof(*haddr);
1361         haddr->hci_family = AF_BLUETOOTH;
1362         haddr->hci_dev    = hdev->id;
1363         haddr->hci_channel= hci_pi(sk)->channel;
1364
1365 done:
1366         release_sock(sk);
1367         return err;
1368 }
1369
1370 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
1371                           struct sk_buff *skb)
1372 {
1373         __u32 mask = hci_pi(sk)->cmsg_mask;
1374
1375         if (mask & HCI_CMSG_DIR) {
1376                 int incoming = bt_cb(skb)->incoming;
1377                 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
1378                          &incoming);
1379         }
1380
1381         if (mask & HCI_CMSG_TSTAMP) {
1382 #ifdef CONFIG_COMPAT
1383                 struct compat_timeval ctv;
1384 #endif
1385                 struct timeval tv;
1386                 void *data;
1387                 int len;
1388
1389                 skb_get_timestamp(skb, &tv);
1390
1391                 data = &tv;
1392                 len = sizeof(tv);
1393 #ifdef CONFIG_COMPAT
1394                 if (!COMPAT_USE_64BIT_TIME &&
1395                     (msg->msg_flags & MSG_CMSG_COMPAT)) {
1396                         ctv.tv_sec = tv.tv_sec;
1397                         ctv.tv_usec = tv.tv_usec;
1398                         data = &ctv;
1399                         len = sizeof(ctv);
1400                 }
1401 #endif
1402
1403                 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
1404         }
1405 }
1406
1407 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg,
1408                             size_t len, int flags)
1409 {
1410         int noblock = flags & MSG_DONTWAIT;
1411         struct sock *sk = sock->sk;
1412         struct sk_buff *skb;
1413         int copied, err;
1414         unsigned int skblen;
1415
1416         BT_DBG("sock %p, sk %p", sock, sk);
1417
1418         if (flags & MSG_OOB)
1419                 return -EOPNOTSUPP;
1420
1421         if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING)
1422                 return -EOPNOTSUPP;
1423
1424         if (sk->sk_state == BT_CLOSED)
1425                 return 0;
1426
1427         skb = skb_recv_datagram(sk, flags, noblock, &err);
1428         if (!skb)
1429                 return err;
1430
1431         skblen = skb->len;
1432         copied = skb->len;
1433         if (len < copied) {
1434                 msg->msg_flags |= MSG_TRUNC;
1435                 copied = len;
1436         }
1437
1438         skb_reset_transport_header(skb);
1439         err = skb_copy_datagram_msg(skb, 0, msg, copied);
1440
1441         switch (hci_pi(sk)->channel) {
1442         case HCI_CHANNEL_RAW:
1443                 hci_sock_cmsg(sk, msg, skb);
1444                 break;
1445         case HCI_CHANNEL_USER:
1446         case HCI_CHANNEL_MONITOR:
1447                 sock_recv_timestamp(msg, sk, skb);
1448                 break;
1449         default:
1450                 if (hci_mgmt_chan_find(hci_pi(sk)->channel))
1451                         sock_recv_timestamp(msg, sk, skb);
1452                 break;
1453         }
1454
1455         skb_free_datagram(sk, skb);
1456
1457         if (flags & MSG_TRUNC)
1458                 copied = skblen;
1459
1460         return err ? : copied;
1461 }
1462
1463 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
1464                         struct msghdr *msg, size_t msglen)
1465 {
1466         void *buf;
1467         u8 *cp;
1468         struct mgmt_hdr *hdr;
1469         u16 opcode, index, len;
1470         struct hci_dev *hdev = NULL;
1471         const struct hci_mgmt_handler *handler;
1472         bool var_len, no_hdev;
1473         int err;
1474
1475         BT_DBG("got %zu bytes", msglen);
1476
1477         if (msglen < sizeof(*hdr))
1478                 return -EINVAL;
1479
1480         buf = kmalloc(msglen, GFP_KERNEL);
1481         if (!buf)
1482                 return -ENOMEM;
1483
1484         if (memcpy_from_msg(buf, msg, msglen)) {
1485                 err = -EFAULT;
1486                 goto done;
1487         }
1488
1489         hdr = buf;
1490         opcode = __le16_to_cpu(hdr->opcode);
1491         index = __le16_to_cpu(hdr->index);
1492         len = __le16_to_cpu(hdr->len);
1493
1494         if (len != msglen - sizeof(*hdr)) {
1495                 err = -EINVAL;
1496                 goto done;
1497         }
1498
1499         if (chan->channel == HCI_CHANNEL_CONTROL) {
1500                 struct sk_buff *skb;
1501
1502                 /* Send event to monitor */
1503                 skb = create_monitor_ctrl_command(sk, index, opcode, len,
1504                                                   buf + sizeof(*hdr));
1505                 if (skb) {
1506                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
1507                                             HCI_SOCK_TRUSTED, NULL);
1508                         kfree_skb(skb);
1509                 }
1510         }
1511
1512         if (opcode >= chan->handler_count ||
1513             chan->handlers[opcode].func == NULL) {
1514                 BT_DBG("Unknown op %u", opcode);
1515                 err = mgmt_cmd_status(sk, index, opcode,
1516                                       MGMT_STATUS_UNKNOWN_COMMAND);
1517                 goto done;
1518         }
1519
1520         handler = &chan->handlers[opcode];
1521
1522         if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
1523             !(handler->flags & HCI_MGMT_UNTRUSTED)) {
1524                 err = mgmt_cmd_status(sk, index, opcode,
1525                                       MGMT_STATUS_PERMISSION_DENIED);
1526                 goto done;
1527         }
1528
1529         if (index != MGMT_INDEX_NONE) {
1530                 hdev = hci_dev_get(index);
1531                 if (!hdev) {
1532                         err = mgmt_cmd_status(sk, index, opcode,
1533                                               MGMT_STATUS_INVALID_INDEX);
1534                         goto done;
1535                 }
1536
1537                 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1538                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1539                     hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1540                         err = mgmt_cmd_status(sk, index, opcode,
1541                                               MGMT_STATUS_INVALID_INDEX);
1542                         goto done;
1543                 }
1544
1545                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1546                     !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
1547                         err = mgmt_cmd_status(sk, index, opcode,
1548                                               MGMT_STATUS_INVALID_INDEX);
1549                         goto done;
1550                 }
1551         }
1552
1553         no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1554         if (no_hdev != !hdev) {
1555                 err = mgmt_cmd_status(sk, index, opcode,
1556                                       MGMT_STATUS_INVALID_INDEX);
1557                 goto done;
1558         }
1559
1560         var_len = (handler->flags & HCI_MGMT_VAR_LEN);
1561         if ((var_len && len < handler->data_len) ||
1562             (!var_len && len != handler->data_len)) {
1563                 err = mgmt_cmd_status(sk, index, opcode,
1564                                       MGMT_STATUS_INVALID_PARAMS);
1565                 goto done;
1566         }
1567
1568         if (hdev && chan->hdev_init)
1569                 chan->hdev_init(sk, hdev);
1570
1571         cp = buf + sizeof(*hdr);
1572
1573         err = handler->func(sk, hdev, cp, len);
1574         if (err < 0)
1575                 goto done;
1576
1577         err = msglen;
1578
1579 done:
1580         if (hdev)
1581                 hci_dev_put(hdev);
1582
1583         kfree(buf);
1584         return err;
1585 }
1586
1587 static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len)
1588 {
1589         struct hci_mon_hdr *hdr;
1590         struct sk_buff *skb;
1591         struct hci_dev *hdev;
1592         u16 index;
1593         int err;
1594
1595         /* The logging frame consists at minimum of the standard header,
1596          * the priority byte, the ident length byte and at least one string
1597          * terminator NUL byte. Anything shorter are invalid packets.
1598          */
1599         if (len < sizeof(*hdr) + 3)
1600                 return -EINVAL;
1601
1602         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1603         if (!skb)
1604                 return err;
1605
1606         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1607                 err = -EFAULT;
1608                 goto drop;
1609         }
1610
1611         hdr = (void *)skb->data;
1612
1613         if (__le16_to_cpu(hdr->len) != len - sizeof(*hdr)) {
1614                 err = -EINVAL;
1615                 goto drop;
1616         }
1617
1618         if (__le16_to_cpu(hdr->opcode) == 0x0000) {
1619                 __u8 priority = skb->data[sizeof(*hdr)];
1620                 __u8 ident_len = skb->data[sizeof(*hdr) + 1];
1621
1622                 /* Only the priorities 0-7 are valid and with that any other
1623                  * value results in an invalid packet.
1624                  *
1625                  * The priority byte is followed by an ident length byte and
1626                  * the NUL terminated ident string. Check that the ident
1627                  * length is not overflowing the packet and also that the
1628                  * ident string itself is NUL terminated. In case the ident
1629                  * length is zero, the length value actually doubles as NUL
1630                  * terminator identifier.
1631                  *
1632                  * The message follows the ident string (if present) and
1633                  * must be NUL terminated. Otherwise it is not a valid packet.
1634                  */
1635                 if (priority > 7 || skb->data[len - 1] != 0x00 ||
1636                     ident_len > len - sizeof(*hdr) - 3 ||
1637                     skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) {
1638                         err = -EINVAL;
1639                         goto drop;
1640                 }
1641         } else {
1642                 err = -EINVAL;
1643                 goto drop;
1644         }
1645
1646         index = __le16_to_cpu(hdr->index);
1647
1648         if (index != MGMT_INDEX_NONE) {
1649                 hdev = hci_dev_get(index);
1650                 if (!hdev) {
1651                         err = -ENODEV;
1652                         goto drop;
1653                 }
1654         } else {
1655                 hdev = NULL;
1656         }
1657
1658         hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING);
1659
1660         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL);
1661         err = len;
1662
1663         if (hdev)
1664                 hci_dev_put(hdev);
1665
1666 drop:
1667         kfree_skb(skb);
1668         return err;
1669 }
1670
1671 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1672                             size_t len)
1673 {
1674         struct sock *sk = sock->sk;
1675         struct hci_mgmt_chan *chan;
1676         struct hci_dev *hdev;
1677         struct sk_buff *skb;
1678         int err;
1679
1680         BT_DBG("sock %p sk %p", sock, sk);
1681
1682         if (msg->msg_flags & MSG_OOB)
1683                 return -EOPNOTSUPP;
1684
1685         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|
1686                                MSG_CMSG_COMPAT))
1687                 return -EINVAL;
1688
1689         if (len < 4 || len > HCI_MAX_FRAME_SIZE)
1690                 return -EINVAL;
1691
1692         lock_sock(sk);
1693
1694         switch (hci_pi(sk)->channel) {
1695         case HCI_CHANNEL_RAW:
1696         case HCI_CHANNEL_USER:
1697                 break;
1698         case HCI_CHANNEL_MONITOR:
1699                 err = -EOPNOTSUPP;
1700                 goto done;
1701         case HCI_CHANNEL_LOGGING:
1702                 err = hci_logging_frame(sk, msg, len);
1703                 goto done;
1704         default:
1705                 mutex_lock(&mgmt_chan_list_lock);
1706                 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);
1707                 if (chan)
1708                         err = hci_mgmt_cmd(chan, sk, msg, len);
1709                 else
1710                         err = -EINVAL;
1711
1712                 mutex_unlock(&mgmt_chan_list_lock);
1713                 goto done;
1714         }
1715
1716         hdev = hci_pi(sk)->hdev;
1717         if (!hdev) {
1718                 err = -EBADFD;
1719                 goto done;
1720         }
1721
1722         if (!test_bit(HCI_UP, &hdev->flags)) {
1723                 err = -ENETDOWN;
1724                 goto done;
1725         }
1726
1727         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1728         if (!skb)
1729                 goto done;
1730
1731         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1732                 err = -EFAULT;
1733                 goto drop;
1734         }
1735
1736         hci_skb_pkt_type(skb) = skb->data[0];
1737         skb_pull(skb, 1);
1738
1739         if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
1740                 /* No permission check is needed for user channel
1741                  * since that gets enforced when binding the socket.
1742                  *
1743                  * However check that the packet type is valid.
1744                  */
1745                 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT &&
1746                     hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1747                     hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
1748                         err = -EINVAL;
1749                         goto drop;
1750                 }
1751
1752                 skb_queue_tail(&hdev->raw_q, skb);
1753                 queue_work(hdev->workqueue, &hdev->tx_work);
1754         } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) {
1755                 u16 opcode = get_unaligned_le16(skb->data);
1756                 u16 ogf = hci_opcode_ogf(opcode);
1757                 u16 ocf = hci_opcode_ocf(opcode);
1758
1759                 if (((ogf > HCI_SFLT_MAX_OGF) ||
1760                      !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
1761                                    &hci_sec_filter.ocf_mask[ogf])) &&
1762                     !capable(CAP_NET_RAW)) {
1763                         err = -EPERM;
1764                         goto drop;
1765                 }
1766
1767                 /* Since the opcode has already been extracted here, store
1768                  * a copy of the value for later use by the drivers.
1769                  */
1770                 hci_skb_opcode(skb) = opcode;
1771
1772                 if (ogf == 0x3f) {
1773                         skb_queue_tail(&hdev->raw_q, skb);
1774                         queue_work(hdev->workqueue, &hdev->tx_work);
1775                 } else {
1776                         /* Stand-alone HCI commands must be flagged as
1777                          * single-command requests.
1778                          */
1779                         bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
1780
1781                         skb_queue_tail(&hdev->cmd_q, skb);
1782                         queue_work(hdev->workqueue, &hdev->cmd_work);
1783                 }
1784         } else {
1785                 if (!capable(CAP_NET_RAW)) {
1786                         err = -EPERM;
1787                         goto drop;
1788                 }
1789
1790                 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
1791                     hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
1792                         err = -EINVAL;
1793                         goto drop;
1794                 }
1795
1796                 skb_queue_tail(&hdev->raw_q, skb);
1797                 queue_work(hdev->workqueue, &hdev->tx_work);
1798         }
1799
1800         err = len;
1801
1802 done:
1803         release_sock(sk);
1804         return err;
1805
1806 drop:
1807         kfree_skb(skb);
1808         goto done;
1809 }
1810
1811 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
1812                                char __user *optval, unsigned int len)
1813 {
1814         struct hci_ufilter uf = { .opcode = 0 };
1815         struct sock *sk = sock->sk;
1816         int err = 0, opt = 0;
1817
1818         BT_DBG("sk %p, opt %d", sk, optname);
1819
1820         if (level != SOL_HCI)
1821                 return -ENOPROTOOPT;
1822
1823         lock_sock(sk);
1824
1825         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1826                 err = -EBADFD;
1827                 goto done;
1828         }
1829
1830         switch (optname) {
1831         case HCI_DATA_DIR:
1832                 if (get_user(opt, (int __user *)optval)) {
1833                         err = -EFAULT;
1834                         break;
1835                 }
1836
1837                 if (opt)
1838                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
1839                 else
1840                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
1841                 break;
1842
1843         case HCI_TIME_STAMP:
1844                 if (get_user(opt, (int __user *)optval)) {
1845                         err = -EFAULT;
1846                         break;
1847                 }
1848
1849                 if (opt)
1850                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
1851                 else
1852                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
1853                 break;
1854
1855         case HCI_FILTER:
1856                 {
1857                         struct hci_filter *f = &hci_pi(sk)->filter;
1858
1859                         uf.type_mask = f->type_mask;
1860                         uf.opcode    = f->opcode;
1861                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1862                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1863                 }
1864
1865                 len = min_t(unsigned int, len, sizeof(uf));
1866                 if (copy_from_user(&uf, optval, len)) {
1867                         err = -EFAULT;
1868                         break;
1869                 }
1870
1871                 if (!capable(CAP_NET_RAW)) {
1872                         uf.type_mask &= hci_sec_filter.type_mask;
1873                         uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
1874                         uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
1875                 }
1876
1877                 {
1878                         struct hci_filter *f = &hci_pi(sk)->filter;
1879
1880                         f->type_mask = uf.type_mask;
1881                         f->opcode    = uf.opcode;
1882                         *((u32 *) f->event_mask + 0) = uf.event_mask[0];
1883                         *((u32 *) f->event_mask + 1) = uf.event_mask[1];
1884                 }
1885                 break;
1886
1887         default:
1888                 err = -ENOPROTOOPT;
1889                 break;
1890         }
1891
1892 done:
1893         release_sock(sk);
1894         return err;
1895 }
1896
1897 static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
1898                                char __user *optval, int __user *optlen)
1899 {
1900         struct hci_ufilter uf;
1901         struct sock *sk = sock->sk;
1902         int len, opt, err = 0;
1903
1904         BT_DBG("sk %p, opt %d", sk, optname);
1905
1906         if (level != SOL_HCI)
1907                 return -ENOPROTOOPT;
1908
1909         if (get_user(len, optlen))
1910                 return -EFAULT;
1911
1912         lock_sock(sk);
1913
1914         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1915                 err = -EBADFD;
1916                 goto done;
1917         }
1918
1919         switch (optname) {
1920         case HCI_DATA_DIR:
1921                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
1922                         opt = 1;
1923                 else
1924                         opt = 0;
1925
1926                 if (put_user(opt, optval))
1927                         err = -EFAULT;
1928                 break;
1929
1930         case HCI_TIME_STAMP:
1931                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
1932                         opt = 1;
1933                 else
1934                         opt = 0;
1935
1936                 if (put_user(opt, optval))
1937                         err = -EFAULT;
1938                 break;
1939
1940         case HCI_FILTER:
1941                 {
1942                         struct hci_filter *f = &hci_pi(sk)->filter;
1943
1944                         memset(&uf, 0, sizeof(uf));
1945                         uf.type_mask = f->type_mask;
1946                         uf.opcode    = f->opcode;
1947                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1948                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1949                 }
1950
1951                 len = min_t(unsigned int, len, sizeof(uf));
1952                 if (copy_to_user(optval, &uf, len))
1953                         err = -EFAULT;
1954                 break;
1955
1956         default:
1957                 err = -ENOPROTOOPT;
1958                 break;
1959         }
1960
1961 done:
1962         release_sock(sk);
1963         return err;
1964 }
1965
1966 static const struct proto_ops hci_sock_ops = {
1967         .family         = PF_BLUETOOTH,
1968         .owner          = THIS_MODULE,
1969         .release        = hci_sock_release,
1970         .bind           = hci_sock_bind,
1971         .getname        = hci_sock_getname,
1972         .sendmsg        = hci_sock_sendmsg,
1973         .recvmsg        = hci_sock_recvmsg,
1974 #ifdef CONFIG_BT_LEGACY_IOCTL
1975         .ioctl          = hci_sock_ioctl,
1976 #else
1977         .ioctl          = sock_no_ioctl,
1978 #endif
1979         .poll           = datagram_poll,
1980         .listen         = sock_no_listen,
1981         .shutdown       = sock_no_shutdown,
1982         .setsockopt     = hci_sock_setsockopt,
1983         .getsockopt     = hci_sock_getsockopt,
1984         .connect        = sock_no_connect,
1985         .socketpair     = sock_no_socketpair,
1986         .accept         = sock_no_accept,
1987         .mmap           = sock_no_mmap
1988 };
1989
1990 static struct proto hci_sk_proto = {
1991         .name           = "HCI",
1992         .owner          = THIS_MODULE,
1993         .obj_size       = sizeof(struct hci_pinfo)
1994 };
1995
1996 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
1997                            int kern)
1998 {
1999         struct sock *sk;
2000
2001         BT_DBG("sock %p", sock);
2002
2003         if (sock->type != SOCK_RAW)
2004                 return -ESOCKTNOSUPPORT;
2005
2006         sock->ops = &hci_sock_ops;
2007
2008         sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern);
2009         if (!sk)
2010                 return -ENOMEM;
2011
2012         sock_init_data(sock, sk);
2013
2014         sock_reset_flag(sk, SOCK_ZAPPED);
2015
2016         sk->sk_protocol = protocol;
2017
2018         sock->state = SS_UNCONNECTED;
2019         sk->sk_state = BT_OPEN;
2020
2021         bt_sock_link(&hci_sk_list, sk);
2022         return 0;
2023 }
2024
2025 static const struct net_proto_family hci_sock_family_ops = {
2026         .family = PF_BLUETOOTH,
2027         .owner  = THIS_MODULE,
2028         .create = hci_sock_create,
2029 };
2030
2031 int __init hci_sock_init(void)
2032 {
2033         int err;
2034
2035         BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr));
2036
2037         err = proto_register(&hci_sk_proto, 0);
2038         if (err < 0)
2039                 return err;
2040
2041         err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
2042         if (err < 0) {
2043                 BT_ERR("HCI socket registration failed");
2044                 goto error;
2045         }
2046
2047         err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL);
2048         if (err < 0) {
2049                 BT_ERR("Failed to create HCI proc file");
2050                 bt_sock_unregister(BTPROTO_HCI);
2051                 goto error;
2052         }
2053
2054         BT_INFO("HCI socket layer initialized");
2055
2056         return 0;
2057
2058 error:
2059         proto_unregister(&hci_sk_proto);
2060         return err;
2061 }
2062
2063 void hci_sock_cleanup(void)
2064 {
2065         bt_procfs_cleanup(&init_net, "hci");
2066         bt_sock_unregister(BTPROTO_HCI);
2067         proto_unregister(&hci_sk_proto);
2068 }