1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI sockets. */ 26 27 #include <linux/export.h> 28 #include <linux/utsname.h> 29 #include <linux/sched.h> 30 #include <asm/unaligned.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/hci_mon.h> 35 #include <net/bluetooth/mgmt.h> 36 37 #include "mgmt_util.h" 38 39 static LIST_HEAD(mgmt_chan_list); 40 static DEFINE_MUTEX(mgmt_chan_list_lock); 41 42 static DEFINE_IDA(sock_cookie_ida); 43 44 static atomic_t monitor_promisc = ATOMIC_INIT(0); 45 46 /* ----- HCI socket interface ----- */ 47 48 /* Socket info */ 49 #define hci_pi(sk) ((struct hci_pinfo *) sk) 50 51 struct hci_pinfo { 52 struct bt_sock bt; 53 struct hci_dev *hdev; 54 struct hci_filter filter; 55 __u32 cmsg_mask; 56 unsigned short channel; 57 unsigned long flags; 58 __u32 cookie; 59 char comm[TASK_COMM_LEN]; 60 }; 61 62 void hci_sock_set_flag(struct sock *sk, int nr) 63 { 64 set_bit(nr, &hci_pi(sk)->flags); 65 } 66 67 void hci_sock_clear_flag(struct sock *sk, int nr) 68 { 69 clear_bit(nr, &hci_pi(sk)->flags); 70 } 71 72 int hci_sock_test_flag(struct sock *sk, int nr) 73 { 74 return test_bit(nr, &hci_pi(sk)->flags); 75 } 76 77 unsigned short hci_sock_get_channel(struct sock *sk) 78 { 79 return hci_pi(sk)->channel; 80 } 81 82 u32 hci_sock_get_cookie(struct sock *sk) 83 { 84 return hci_pi(sk)->cookie; 85 } 86 87 static bool hci_sock_gen_cookie(struct sock *sk) 88 { 89 int id = hci_pi(sk)->cookie; 90 91 if (!id) { 92 id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL); 93 if (id < 0) 94 id = 0xffffffff; 95 96 hci_pi(sk)->cookie = id; 97 get_task_comm(hci_pi(sk)->comm, current); 98 return true; 99 } 100 101 return false; 102 } 103 104 static void hci_sock_free_cookie(struct sock *sk) 105 { 106 int id = hci_pi(sk)->cookie; 107 108 if (id) { 109 hci_pi(sk)->cookie = 0xffffffff; 110 ida_simple_remove(&sock_cookie_ida, id); 111 } 112 } 113 114 static inline int hci_test_bit(int nr, const void *addr) 115 { 116 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31)); 117 } 118 119 /* Security filter */ 120 #define HCI_SFLT_MAX_OGF 5 121 122 struct hci_sec_filter { 123 __u32 type_mask; 124 __u32 event_mask[2]; 125 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4]; 126 }; 127 128 static const struct hci_sec_filter hci_sec_filter = { 129 /* Packet types */ 130 0x10, 131 /* Events */ 132 { 0x1000d9fe, 0x0000b00c }, 133 /* Commands */ 134 { 135 { 0x0 }, 136 /* OGF_LINK_CTL */ 137 { 0xbe000006, 0x00000001, 0x00000000, 0x00 }, 138 /* OGF_LINK_POLICY */ 139 { 0x00005200, 0x00000000, 0x00000000, 0x00 }, 140 /* OGF_HOST_CTL */ 141 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 }, 142 /* OGF_INFO_PARAM */ 143 { 0x000002be, 0x00000000, 0x00000000, 0x00 }, 144 /* OGF_STATUS_PARAM */ 145 { 0x000000ea, 0x00000000, 0x00000000, 0x00 } 146 } 147 }; 148 149 static struct bt_sock_list hci_sk_list = { 150 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock) 151 }; 152 153 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) 154 { 155 struct hci_filter *flt; 156 int flt_type, flt_event; 157 158 /* Apply filter */ 159 flt = &hci_pi(sk)->filter; 160 161 flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS; 162 163 if (!test_bit(flt_type, &flt->type_mask)) 164 return true; 165 166 /* Extra filter for event packets only */ 167 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT) 168 return false; 169 170 flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS); 171 172 if (!hci_test_bit(flt_event, &flt->event_mask)) 173 return true; 174 175 /* Check filter only when opcode is set */ 176 if (!flt->opcode) 177 return false; 178 179 if (flt_event == HCI_EV_CMD_COMPLETE && 180 flt->opcode != get_unaligned((__le16 *)(skb->data + 3))) 181 return true; 182 183 if (flt_event == HCI_EV_CMD_STATUS && 184 flt->opcode != get_unaligned((__le16 *)(skb->data + 4))) 185 return true; 186 187 return false; 188 } 189 190 /* Send frame to RAW socket */ 191 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 192 { 193 struct sock *sk; 194 struct sk_buff *skb_copy = NULL; 195 196 BT_DBG("hdev %p len %d", hdev, skb->len); 197 198 read_lock(&hci_sk_list.lock); 199 200 sk_for_each(sk, &hci_sk_list.head) { 201 struct sk_buff *nskb; 202 203 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev) 204 continue; 205 206 /* Don't send frame to the socket it came from */ 207 if (skb->sk == sk) 208 continue; 209 210 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) { 211 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 212 hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 213 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 214 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) 215 continue; 216 if (is_filtered_packet(sk, skb)) 217 continue; 218 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 219 if (!bt_cb(skb)->incoming) 220 continue; 221 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 222 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 223 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) 224 continue; 225 } else { 226 /* Don't send frame to other channel types */ 227 continue; 228 } 229 230 if (!skb_copy) { 231 /* Create a private copy with headroom */ 232 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true); 233 if (!skb_copy) 234 continue; 235 236 /* Put type byte before the data */ 237 memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1); 238 } 239 240 nskb = skb_clone(skb_copy, GFP_ATOMIC); 241 if (!nskb) 242 continue; 243 244 if (sock_queue_rcv_skb(sk, nskb)) 245 kfree_skb(nskb); 246 } 247 248 read_unlock(&hci_sk_list.lock); 249 250 kfree_skb(skb_copy); 251 } 252 253 /* Send frame to sockets with specific channel */ 254 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 255 int flag, struct sock *skip_sk) 256 { 257 struct sock *sk; 258 259 BT_DBG("channel %u len %d", channel, skb->len); 260 261 read_lock(&hci_sk_list.lock); 262 263 sk_for_each(sk, &hci_sk_list.head) { 264 struct sk_buff *nskb; 265 266 /* Ignore socket without the flag set */ 267 if (!hci_sock_test_flag(sk, flag)) 268 continue; 269 270 /* Skip the original socket */ 271 if (sk == skip_sk) 272 continue; 273 274 if (sk->sk_state != BT_BOUND) 275 continue; 276 277 if (hci_pi(sk)->channel != channel) 278 continue; 279 280 nskb = skb_clone(skb, GFP_ATOMIC); 281 if (!nskb) 282 continue; 283 284 if (sock_queue_rcv_skb(sk, nskb)) 285 kfree_skb(nskb); 286 } 287 288 read_unlock(&hci_sk_list.lock); 289 } 290 291 /* Send frame to monitor socket */ 292 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb) 293 { 294 struct sk_buff *skb_copy = NULL; 295 struct hci_mon_hdr *hdr; 296 __le16 opcode; 297 298 if (!atomic_read(&monitor_promisc)) 299 return; 300 301 BT_DBG("hdev %p len %d", hdev, skb->len); 302 303 switch (hci_skb_pkt_type(skb)) { 304 case HCI_COMMAND_PKT: 305 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT); 306 break; 307 case HCI_EVENT_PKT: 308 opcode = cpu_to_le16(HCI_MON_EVENT_PKT); 309 break; 310 case HCI_ACLDATA_PKT: 311 if (bt_cb(skb)->incoming) 312 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT); 313 else 314 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT); 315 break; 316 case HCI_SCODATA_PKT: 317 if (bt_cb(skb)->incoming) 318 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT); 319 else 320 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT); 321 break; 322 case HCI_DIAG_PKT: 323 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG); 324 break; 325 default: 326 return; 327 } 328 329 /* Create a private copy with headroom */ 330 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true); 331 if (!skb_copy) 332 return; 333 334 /* Put header before the data */ 335 hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE); 336 hdr->opcode = opcode; 337 hdr->index = cpu_to_le16(hdev->id); 338 hdr->len = cpu_to_le16(skb->len); 339 340 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy, 341 HCI_SOCK_TRUSTED, NULL); 342 kfree_skb(skb_copy); 343 } 344 345 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event, 346 void *data, u16 data_len, ktime_t tstamp, 347 int flag, struct sock *skip_sk) 348 { 349 struct sock *sk; 350 __le16 index; 351 352 if (hdev) 353 index = cpu_to_le16(hdev->id); 354 else 355 index = cpu_to_le16(MGMT_INDEX_NONE); 356 357 read_lock(&hci_sk_list.lock); 358 359 sk_for_each(sk, &hci_sk_list.head) { 360 struct hci_mon_hdr *hdr; 361 struct sk_buff *skb; 362 363 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL) 364 continue; 365 366 /* Ignore socket without the flag set */ 367 if (!hci_sock_test_flag(sk, flag)) 368 continue; 369 370 /* Skip the original socket */ 371 if (sk == skip_sk) 372 continue; 373 374 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC); 375 if (!skb) 376 continue; 377 378 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 379 put_unaligned_le16(event, skb_put(skb, 2)); 380 381 if (data) 382 skb_put_data(skb, data, data_len); 383 384 skb->tstamp = tstamp; 385 386 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 387 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT); 388 hdr->index = index; 389 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 390 391 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 392 HCI_SOCK_TRUSTED, NULL); 393 kfree_skb(skb); 394 } 395 396 read_unlock(&hci_sk_list.lock); 397 } 398 399 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event) 400 { 401 struct hci_mon_hdr *hdr; 402 struct hci_mon_new_index *ni; 403 struct hci_mon_index_info *ii; 404 struct sk_buff *skb; 405 __le16 opcode; 406 407 switch (event) { 408 case HCI_DEV_REG: 409 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC); 410 if (!skb) 411 return NULL; 412 413 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE); 414 ni->type = hdev->dev_type; 415 ni->bus = hdev->bus; 416 bacpy(&ni->bdaddr, &hdev->bdaddr); 417 memcpy(ni->name, hdev->name, 8); 418 419 opcode = cpu_to_le16(HCI_MON_NEW_INDEX); 420 break; 421 422 case HCI_DEV_UNREG: 423 skb = bt_skb_alloc(0, GFP_ATOMIC); 424 if (!skb) 425 return NULL; 426 427 opcode = cpu_to_le16(HCI_MON_DEL_INDEX); 428 break; 429 430 case HCI_DEV_SETUP: 431 if (hdev->manufacturer == 0xffff) 432 return NULL; 433 434 /* fall through */ 435 436 case HCI_DEV_UP: 437 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC); 438 if (!skb) 439 return NULL; 440 441 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE); 442 bacpy(&ii->bdaddr, &hdev->bdaddr); 443 ii->manufacturer = cpu_to_le16(hdev->manufacturer); 444 445 opcode = cpu_to_le16(HCI_MON_INDEX_INFO); 446 break; 447 448 case HCI_DEV_OPEN: 449 skb = bt_skb_alloc(0, GFP_ATOMIC); 450 if (!skb) 451 return NULL; 452 453 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX); 454 break; 455 456 case HCI_DEV_CLOSE: 457 skb = bt_skb_alloc(0, GFP_ATOMIC); 458 if (!skb) 459 return NULL; 460 461 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX); 462 break; 463 464 default: 465 return NULL; 466 } 467 468 __net_timestamp(skb); 469 470 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 471 hdr->opcode = opcode; 472 hdr->index = cpu_to_le16(hdev->id); 473 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 474 475 return skb; 476 } 477 478 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk) 479 { 480 struct hci_mon_hdr *hdr; 481 struct sk_buff *skb; 482 u16 format; 483 u8 ver[3]; 484 u32 flags; 485 486 /* No message needed when cookie is not present */ 487 if (!hci_pi(sk)->cookie) 488 return NULL; 489 490 switch (hci_pi(sk)->channel) { 491 case HCI_CHANNEL_RAW: 492 format = 0x0000; 493 ver[0] = BT_SUBSYS_VERSION; 494 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 495 break; 496 case HCI_CHANNEL_USER: 497 format = 0x0001; 498 ver[0] = BT_SUBSYS_VERSION; 499 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 500 break; 501 case HCI_CHANNEL_CONTROL: 502 format = 0x0002; 503 mgmt_fill_version_info(ver); 504 break; 505 default: 506 /* No message for unsupported format */ 507 return NULL; 508 } 509 510 skb = bt_skb_alloc(14 + TASK_COMM_LEN , GFP_ATOMIC); 511 if (!skb) 512 return NULL; 513 514 flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0; 515 516 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 517 put_unaligned_le16(format, skb_put(skb, 2)); 518 skb_put_data(skb, ver, sizeof(ver)); 519 put_unaligned_le32(flags, skb_put(skb, 4)); 520 skb_put_u8(skb, TASK_COMM_LEN); 521 skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN); 522 523 __net_timestamp(skb); 524 525 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 526 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN); 527 if (hci_pi(sk)->hdev) 528 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 529 else 530 hdr->index = cpu_to_le16(HCI_DEV_NONE); 531 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 532 533 return skb; 534 } 535 536 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk) 537 { 538 struct hci_mon_hdr *hdr; 539 struct sk_buff *skb; 540 541 /* No message needed when cookie is not present */ 542 if (!hci_pi(sk)->cookie) 543 return NULL; 544 545 switch (hci_pi(sk)->channel) { 546 case HCI_CHANNEL_RAW: 547 case HCI_CHANNEL_USER: 548 case HCI_CHANNEL_CONTROL: 549 break; 550 default: 551 /* No message for unsupported format */ 552 return NULL; 553 } 554 555 skb = bt_skb_alloc(4, GFP_ATOMIC); 556 if (!skb) 557 return NULL; 558 559 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 560 561 __net_timestamp(skb); 562 563 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 564 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE); 565 if (hci_pi(sk)->hdev) 566 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 567 else 568 hdr->index = cpu_to_le16(HCI_DEV_NONE); 569 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 570 571 return skb; 572 } 573 574 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index, 575 u16 opcode, u16 len, 576 const void *buf) 577 { 578 struct hci_mon_hdr *hdr; 579 struct sk_buff *skb; 580 581 skb = bt_skb_alloc(6 + len, GFP_ATOMIC); 582 if (!skb) 583 return NULL; 584 585 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 586 put_unaligned_le16(opcode, skb_put(skb, 2)); 587 588 if (buf) 589 skb_put_data(skb, buf, len); 590 591 __net_timestamp(skb); 592 593 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 594 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND); 595 hdr->index = cpu_to_le16(index); 596 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 597 598 return skb; 599 } 600 601 static void __printf(2, 3) 602 send_monitor_note(struct sock *sk, const char *fmt, ...) 603 { 604 size_t len; 605 struct hci_mon_hdr *hdr; 606 struct sk_buff *skb; 607 va_list args; 608 609 va_start(args, fmt); 610 len = vsnprintf(NULL, 0, fmt, args); 611 va_end(args); 612 613 skb = bt_skb_alloc(len + 1, GFP_ATOMIC); 614 if (!skb) 615 return; 616 617 va_start(args, fmt); 618 vsprintf(skb_put(skb, len), fmt, args); 619 *(u8 *)skb_put(skb, 1) = 0; 620 va_end(args); 621 622 __net_timestamp(skb); 623 624 hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE); 625 hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE); 626 hdr->index = cpu_to_le16(HCI_DEV_NONE); 627 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 628 629 if (sock_queue_rcv_skb(sk, skb)) 630 kfree_skb(skb); 631 } 632 633 static void send_monitor_replay(struct sock *sk) 634 { 635 struct hci_dev *hdev; 636 637 read_lock(&hci_dev_list_lock); 638 639 list_for_each_entry(hdev, &hci_dev_list, list) { 640 struct sk_buff *skb; 641 642 skb = create_monitor_event(hdev, HCI_DEV_REG); 643 if (!skb) 644 continue; 645 646 if (sock_queue_rcv_skb(sk, skb)) 647 kfree_skb(skb); 648 649 if (!test_bit(HCI_RUNNING, &hdev->flags)) 650 continue; 651 652 skb = create_monitor_event(hdev, HCI_DEV_OPEN); 653 if (!skb) 654 continue; 655 656 if (sock_queue_rcv_skb(sk, skb)) 657 kfree_skb(skb); 658 659 if (test_bit(HCI_UP, &hdev->flags)) 660 skb = create_monitor_event(hdev, HCI_DEV_UP); 661 else if (hci_dev_test_flag(hdev, HCI_SETUP)) 662 skb = create_monitor_event(hdev, HCI_DEV_SETUP); 663 else 664 skb = NULL; 665 666 if (skb) { 667 if (sock_queue_rcv_skb(sk, skb)) 668 kfree_skb(skb); 669 } 670 } 671 672 read_unlock(&hci_dev_list_lock); 673 } 674 675 static void send_monitor_control_replay(struct sock *mon_sk) 676 { 677 struct sock *sk; 678 679 read_lock(&hci_sk_list.lock); 680 681 sk_for_each(sk, &hci_sk_list.head) { 682 struct sk_buff *skb; 683 684 skb = create_monitor_ctrl_open(sk); 685 if (!skb) 686 continue; 687 688 if (sock_queue_rcv_skb(mon_sk, skb)) 689 kfree_skb(skb); 690 } 691 692 read_unlock(&hci_sk_list.lock); 693 } 694 695 /* Generate internal stack event */ 696 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data) 697 { 698 struct hci_event_hdr *hdr; 699 struct hci_ev_stack_internal *ev; 700 struct sk_buff *skb; 701 702 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC); 703 if (!skb) 704 return; 705 706 hdr = skb_put(skb, HCI_EVENT_HDR_SIZE); 707 hdr->evt = HCI_EV_STACK_INTERNAL; 708 hdr->plen = sizeof(*ev) + dlen; 709 710 ev = skb_put(skb, sizeof(*ev) + dlen); 711 ev->type = type; 712 memcpy(ev->data, data, dlen); 713 714 bt_cb(skb)->incoming = 1; 715 __net_timestamp(skb); 716 717 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 718 hci_send_to_sock(hdev, skb); 719 kfree_skb(skb); 720 } 721 722 void hci_sock_dev_event(struct hci_dev *hdev, int event) 723 { 724 BT_DBG("hdev %s event %d", hdev->name, event); 725 726 if (atomic_read(&monitor_promisc)) { 727 struct sk_buff *skb; 728 729 /* Send event to monitor */ 730 skb = create_monitor_event(hdev, event); 731 if (skb) { 732 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 733 HCI_SOCK_TRUSTED, NULL); 734 kfree_skb(skb); 735 } 736 } 737 738 if (event <= HCI_DEV_DOWN) { 739 struct hci_ev_si_device ev; 740 741 /* Send event to sockets */ 742 ev.event = event; 743 ev.dev_id = hdev->id; 744 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev); 745 } 746 747 if (event == HCI_DEV_UNREG) { 748 struct sock *sk; 749 750 /* Detach sockets from device */ 751 read_lock(&hci_sk_list.lock); 752 sk_for_each(sk, &hci_sk_list.head) { 753 bh_lock_sock_nested(sk); 754 if (hci_pi(sk)->hdev == hdev) { 755 hci_pi(sk)->hdev = NULL; 756 sk->sk_err = EPIPE; 757 sk->sk_state = BT_OPEN; 758 sk->sk_state_change(sk); 759 760 hci_dev_put(hdev); 761 } 762 bh_unlock_sock(sk); 763 } 764 read_unlock(&hci_sk_list.lock); 765 } 766 } 767 768 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel) 769 { 770 struct hci_mgmt_chan *c; 771 772 list_for_each_entry(c, &mgmt_chan_list, list) { 773 if (c->channel == channel) 774 return c; 775 } 776 777 return NULL; 778 } 779 780 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel) 781 { 782 struct hci_mgmt_chan *c; 783 784 mutex_lock(&mgmt_chan_list_lock); 785 c = __hci_mgmt_chan_find(channel); 786 mutex_unlock(&mgmt_chan_list_lock); 787 788 return c; 789 } 790 791 int hci_mgmt_chan_register(struct hci_mgmt_chan *c) 792 { 793 if (c->channel < HCI_CHANNEL_CONTROL) 794 return -EINVAL; 795 796 mutex_lock(&mgmt_chan_list_lock); 797 if (__hci_mgmt_chan_find(c->channel)) { 798 mutex_unlock(&mgmt_chan_list_lock); 799 return -EALREADY; 800 } 801 802 list_add_tail(&c->list, &mgmt_chan_list); 803 804 mutex_unlock(&mgmt_chan_list_lock); 805 806 return 0; 807 } 808 EXPORT_SYMBOL(hci_mgmt_chan_register); 809 810 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c) 811 { 812 mutex_lock(&mgmt_chan_list_lock); 813 list_del(&c->list); 814 mutex_unlock(&mgmt_chan_list_lock); 815 } 816 EXPORT_SYMBOL(hci_mgmt_chan_unregister); 817 818 static int hci_sock_release(struct socket *sock) 819 { 820 struct sock *sk = sock->sk; 821 struct hci_dev *hdev; 822 struct sk_buff *skb; 823 824 BT_DBG("sock %p sk %p", sock, sk); 825 826 if (!sk) 827 return 0; 828 829 hdev = hci_pi(sk)->hdev; 830 831 switch (hci_pi(sk)->channel) { 832 case HCI_CHANNEL_MONITOR: 833 atomic_dec(&monitor_promisc); 834 break; 835 case HCI_CHANNEL_RAW: 836 case HCI_CHANNEL_USER: 837 case HCI_CHANNEL_CONTROL: 838 /* Send event to monitor */ 839 skb = create_monitor_ctrl_close(sk); 840 if (skb) { 841 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 842 HCI_SOCK_TRUSTED, NULL); 843 kfree_skb(skb); 844 } 845 846 hci_sock_free_cookie(sk); 847 break; 848 } 849 850 bt_sock_unlink(&hci_sk_list, sk); 851 852 if (hdev) { 853 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 854 /* When releasing a user channel exclusive access, 855 * call hci_dev_do_close directly instead of calling 856 * hci_dev_close to ensure the exclusive access will 857 * be released and the controller brought back down. 858 * 859 * The checking of HCI_AUTO_OFF is not needed in this 860 * case since it will have been cleared already when 861 * opening the user channel. 862 */ 863 hci_dev_do_close(hdev); 864 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 865 mgmt_index_added(hdev); 866 } 867 868 atomic_dec(&hdev->promisc); 869 hci_dev_put(hdev); 870 } 871 872 sock_orphan(sk); 873 874 skb_queue_purge(&sk->sk_receive_queue); 875 skb_queue_purge(&sk->sk_write_queue); 876 877 sock_put(sk); 878 return 0; 879 } 880 881 #ifdef CONFIG_BT_LEGACY_IOCTL 882 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg) 883 { 884 bdaddr_t bdaddr; 885 int err; 886 887 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 888 return -EFAULT; 889 890 hci_dev_lock(hdev); 891 892 err = hci_bdaddr_list_add(&hdev->blacklist, &bdaddr, BDADDR_BREDR); 893 894 hci_dev_unlock(hdev); 895 896 return err; 897 } 898 899 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg) 900 { 901 bdaddr_t bdaddr; 902 int err; 903 904 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 905 return -EFAULT; 906 907 hci_dev_lock(hdev); 908 909 err = hci_bdaddr_list_del(&hdev->blacklist, &bdaddr, BDADDR_BREDR); 910 911 hci_dev_unlock(hdev); 912 913 return err; 914 } 915 916 /* Ioctls that require bound socket */ 917 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, 918 unsigned long arg) 919 { 920 struct hci_dev *hdev = hci_pi(sk)->hdev; 921 922 if (!hdev) 923 return -EBADFD; 924 925 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 926 return -EBUSY; 927 928 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 929 return -EOPNOTSUPP; 930 931 if (hdev->dev_type != HCI_PRIMARY) 932 return -EOPNOTSUPP; 933 934 switch (cmd) { 935 case HCISETRAW: 936 if (!capable(CAP_NET_ADMIN)) 937 return -EPERM; 938 return -EOPNOTSUPP; 939 940 case HCIGETCONNINFO: 941 return hci_get_conn_info(hdev, (void __user *)arg); 942 943 case HCIGETAUTHINFO: 944 return hci_get_auth_info(hdev, (void __user *)arg); 945 946 case HCIBLOCKADDR: 947 if (!capable(CAP_NET_ADMIN)) 948 return -EPERM; 949 return hci_sock_blacklist_add(hdev, (void __user *)arg); 950 951 case HCIUNBLOCKADDR: 952 if (!capable(CAP_NET_ADMIN)) 953 return -EPERM; 954 return hci_sock_blacklist_del(hdev, (void __user *)arg); 955 } 956 957 return -ENOIOCTLCMD; 958 } 959 960 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, 961 unsigned long arg) 962 { 963 void __user *argp = (void __user *)arg; 964 struct sock *sk = sock->sk; 965 int err; 966 967 BT_DBG("cmd %x arg %lx", cmd, arg); 968 969 lock_sock(sk); 970 971 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 972 err = -EBADFD; 973 goto done; 974 } 975 976 /* When calling an ioctl on an unbound raw socket, then ensure 977 * that the monitor gets informed. Ensure that the resulting event 978 * is only send once by checking if the cookie exists or not. The 979 * socket cookie will be only ever generated once for the lifetime 980 * of a given socket. 981 */ 982 if (hci_sock_gen_cookie(sk)) { 983 struct sk_buff *skb; 984 985 if (capable(CAP_NET_ADMIN)) 986 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 987 988 /* Send event to monitor */ 989 skb = create_monitor_ctrl_open(sk); 990 if (skb) { 991 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 992 HCI_SOCK_TRUSTED, NULL); 993 kfree_skb(skb); 994 } 995 } 996 997 release_sock(sk); 998 999 switch (cmd) { 1000 case HCIGETDEVLIST: 1001 return hci_get_dev_list(argp); 1002 1003 case HCIGETDEVINFO: 1004 return hci_get_dev_info(argp); 1005 1006 case HCIGETCONNLIST: 1007 return hci_get_conn_list(argp); 1008 1009 case HCIDEVUP: 1010 if (!capable(CAP_NET_ADMIN)) 1011 return -EPERM; 1012 return hci_dev_open(arg); 1013 1014 case HCIDEVDOWN: 1015 if (!capable(CAP_NET_ADMIN)) 1016 return -EPERM; 1017 return hci_dev_close(arg); 1018 1019 case HCIDEVRESET: 1020 if (!capable(CAP_NET_ADMIN)) 1021 return -EPERM; 1022 return hci_dev_reset(arg); 1023 1024 case HCIDEVRESTAT: 1025 if (!capable(CAP_NET_ADMIN)) 1026 return -EPERM; 1027 return hci_dev_reset_stat(arg); 1028 1029 case HCISETSCAN: 1030 case HCISETAUTH: 1031 case HCISETENCRYPT: 1032 case HCISETPTYPE: 1033 case HCISETLINKPOL: 1034 case HCISETLINKMODE: 1035 case HCISETACLMTU: 1036 case HCISETSCOMTU: 1037 if (!capable(CAP_NET_ADMIN)) 1038 return -EPERM; 1039 return hci_dev_cmd(cmd, argp); 1040 1041 case HCIINQUIRY: 1042 return hci_inquiry(argp); 1043 } 1044 1045 lock_sock(sk); 1046 1047 err = hci_sock_bound_ioctl(sk, cmd, arg); 1048 1049 done: 1050 release_sock(sk); 1051 return err; 1052 } 1053 #endif 1054 1055 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, 1056 int addr_len) 1057 { 1058 struct sockaddr_hci haddr; 1059 struct sock *sk = sock->sk; 1060 struct hci_dev *hdev = NULL; 1061 struct sk_buff *skb; 1062 int len, err = 0; 1063 1064 BT_DBG("sock %p sk %p", sock, sk); 1065 1066 if (!addr) 1067 return -EINVAL; 1068 1069 memset(&haddr, 0, sizeof(haddr)); 1070 len = min_t(unsigned int, sizeof(haddr), addr_len); 1071 memcpy(&haddr, addr, len); 1072 1073 if (haddr.hci_family != AF_BLUETOOTH) 1074 return -EINVAL; 1075 1076 lock_sock(sk); 1077 1078 if (sk->sk_state == BT_BOUND) { 1079 err = -EALREADY; 1080 goto done; 1081 } 1082 1083 switch (haddr.hci_channel) { 1084 case HCI_CHANNEL_RAW: 1085 if (hci_pi(sk)->hdev) { 1086 err = -EALREADY; 1087 goto done; 1088 } 1089 1090 if (haddr.hci_dev != HCI_DEV_NONE) { 1091 hdev = hci_dev_get(haddr.hci_dev); 1092 if (!hdev) { 1093 err = -ENODEV; 1094 goto done; 1095 } 1096 1097 atomic_inc(&hdev->promisc); 1098 } 1099 1100 hci_pi(sk)->channel = haddr.hci_channel; 1101 1102 if (!hci_sock_gen_cookie(sk)) { 1103 /* In the case when a cookie has already been assigned, 1104 * then there has been already an ioctl issued against 1105 * an unbound socket and with that triggerd an open 1106 * notification. Send a close notification first to 1107 * allow the state transition to bounded. 1108 */ 1109 skb = create_monitor_ctrl_close(sk); 1110 if (skb) { 1111 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1112 HCI_SOCK_TRUSTED, NULL); 1113 kfree_skb(skb); 1114 } 1115 } 1116 1117 if (capable(CAP_NET_ADMIN)) 1118 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1119 1120 hci_pi(sk)->hdev = hdev; 1121 1122 /* Send event to monitor */ 1123 skb = create_monitor_ctrl_open(sk); 1124 if (skb) { 1125 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1126 HCI_SOCK_TRUSTED, NULL); 1127 kfree_skb(skb); 1128 } 1129 break; 1130 1131 case HCI_CHANNEL_USER: 1132 if (hci_pi(sk)->hdev) { 1133 err = -EALREADY; 1134 goto done; 1135 } 1136 1137 if (haddr.hci_dev == HCI_DEV_NONE) { 1138 err = -EINVAL; 1139 goto done; 1140 } 1141 1142 if (!capable(CAP_NET_ADMIN)) { 1143 err = -EPERM; 1144 goto done; 1145 } 1146 1147 hdev = hci_dev_get(haddr.hci_dev); 1148 if (!hdev) { 1149 err = -ENODEV; 1150 goto done; 1151 } 1152 1153 if (test_bit(HCI_INIT, &hdev->flags) || 1154 hci_dev_test_flag(hdev, HCI_SETUP) || 1155 hci_dev_test_flag(hdev, HCI_CONFIG) || 1156 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && 1157 test_bit(HCI_UP, &hdev->flags))) { 1158 err = -EBUSY; 1159 hci_dev_put(hdev); 1160 goto done; 1161 } 1162 1163 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) { 1164 err = -EUSERS; 1165 hci_dev_put(hdev); 1166 goto done; 1167 } 1168 1169 mgmt_index_removed(hdev); 1170 1171 err = hci_dev_open(hdev->id); 1172 if (err) { 1173 if (err == -EALREADY) { 1174 /* In case the transport is already up and 1175 * running, clear the error here. 1176 * 1177 * This can happen when opening a user 1178 * channel and HCI_AUTO_OFF grace period 1179 * is still active. 1180 */ 1181 err = 0; 1182 } else { 1183 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 1184 mgmt_index_added(hdev); 1185 hci_dev_put(hdev); 1186 goto done; 1187 } 1188 } 1189 1190 hci_pi(sk)->channel = haddr.hci_channel; 1191 1192 if (!hci_sock_gen_cookie(sk)) { 1193 /* In the case when a cookie has already been assigned, 1194 * this socket will transition from a raw socket into 1195 * a user channel socket. For a clean transition, send 1196 * the close notification first. 1197 */ 1198 skb = create_monitor_ctrl_close(sk); 1199 if (skb) { 1200 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1201 HCI_SOCK_TRUSTED, NULL); 1202 kfree_skb(skb); 1203 } 1204 } 1205 1206 /* The user channel is restricted to CAP_NET_ADMIN 1207 * capabilities and with that implicitly trusted. 1208 */ 1209 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1210 1211 hci_pi(sk)->hdev = hdev; 1212 1213 /* Send event to monitor */ 1214 skb = create_monitor_ctrl_open(sk); 1215 if (skb) { 1216 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1217 HCI_SOCK_TRUSTED, NULL); 1218 kfree_skb(skb); 1219 } 1220 1221 atomic_inc(&hdev->promisc); 1222 break; 1223 1224 case HCI_CHANNEL_MONITOR: 1225 if (haddr.hci_dev != HCI_DEV_NONE) { 1226 err = -EINVAL; 1227 goto done; 1228 } 1229 1230 if (!capable(CAP_NET_RAW)) { 1231 err = -EPERM; 1232 goto done; 1233 } 1234 1235 hci_pi(sk)->channel = haddr.hci_channel; 1236 1237 /* The monitor interface is restricted to CAP_NET_RAW 1238 * capabilities and with that implicitly trusted. 1239 */ 1240 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1241 1242 send_monitor_note(sk, "Linux version %s (%s)", 1243 init_utsname()->release, 1244 init_utsname()->machine); 1245 send_monitor_note(sk, "Bluetooth subsystem version %u.%u", 1246 BT_SUBSYS_VERSION, BT_SUBSYS_REVISION); 1247 send_monitor_replay(sk); 1248 send_monitor_control_replay(sk); 1249 1250 atomic_inc(&monitor_promisc); 1251 break; 1252 1253 case HCI_CHANNEL_LOGGING: 1254 if (haddr.hci_dev != HCI_DEV_NONE) { 1255 err = -EINVAL; 1256 goto done; 1257 } 1258 1259 if (!capable(CAP_NET_ADMIN)) { 1260 err = -EPERM; 1261 goto done; 1262 } 1263 1264 hci_pi(sk)->channel = haddr.hci_channel; 1265 break; 1266 1267 default: 1268 if (!hci_mgmt_chan_find(haddr.hci_channel)) { 1269 err = -EINVAL; 1270 goto done; 1271 } 1272 1273 if (haddr.hci_dev != HCI_DEV_NONE) { 1274 err = -EINVAL; 1275 goto done; 1276 } 1277 1278 /* Users with CAP_NET_ADMIN capabilities are allowed 1279 * access to all management commands and events. For 1280 * untrusted users the interface is restricted and 1281 * also only untrusted events are sent. 1282 */ 1283 if (capable(CAP_NET_ADMIN)) 1284 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1285 1286 hci_pi(sk)->channel = haddr.hci_channel; 1287 1288 /* At the moment the index and unconfigured index events 1289 * are enabled unconditionally. Setting them on each 1290 * socket when binding keeps this functionality. They 1291 * however might be cleared later and then sending of these 1292 * events will be disabled, but that is then intentional. 1293 * 1294 * This also enables generic events that are safe to be 1295 * received by untrusted users. Example for such events 1296 * are changes to settings, class of device, name etc. 1297 */ 1298 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) { 1299 if (!hci_sock_gen_cookie(sk)) { 1300 /* In the case when a cookie has already been 1301 * assigned, this socket will transtion from 1302 * a raw socket into a control socket. To 1303 * allow for a clean transtion, send the 1304 * close notification first. 1305 */ 1306 skb = create_monitor_ctrl_close(sk); 1307 if (skb) { 1308 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1309 HCI_SOCK_TRUSTED, NULL); 1310 kfree_skb(skb); 1311 } 1312 } 1313 1314 /* Send event to monitor */ 1315 skb = create_monitor_ctrl_open(sk); 1316 if (skb) { 1317 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1318 HCI_SOCK_TRUSTED, NULL); 1319 kfree_skb(skb); 1320 } 1321 1322 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS); 1323 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 1324 hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS); 1325 hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS); 1326 hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1327 hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1328 } 1329 break; 1330 } 1331 1332 sk->sk_state = BT_BOUND; 1333 1334 done: 1335 release_sock(sk); 1336 return err; 1337 } 1338 1339 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, 1340 int *addr_len, int peer) 1341 { 1342 struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr; 1343 struct sock *sk = sock->sk; 1344 struct hci_dev *hdev; 1345 int err = 0; 1346 1347 BT_DBG("sock %p sk %p", sock, sk); 1348 1349 if (peer) 1350 return -EOPNOTSUPP; 1351 1352 lock_sock(sk); 1353 1354 hdev = hci_pi(sk)->hdev; 1355 if (!hdev) { 1356 err = -EBADFD; 1357 goto done; 1358 } 1359 1360 *addr_len = sizeof(*haddr); 1361 haddr->hci_family = AF_BLUETOOTH; 1362 haddr->hci_dev = hdev->id; 1363 haddr->hci_channel= hci_pi(sk)->channel; 1364 1365 done: 1366 release_sock(sk); 1367 return err; 1368 } 1369 1370 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, 1371 struct sk_buff *skb) 1372 { 1373 __u32 mask = hci_pi(sk)->cmsg_mask; 1374 1375 if (mask & HCI_CMSG_DIR) { 1376 int incoming = bt_cb(skb)->incoming; 1377 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), 1378 &incoming); 1379 } 1380 1381 if (mask & HCI_CMSG_TSTAMP) { 1382 #ifdef CONFIG_COMPAT 1383 struct compat_timeval ctv; 1384 #endif 1385 struct timeval tv; 1386 void *data; 1387 int len; 1388 1389 skb_get_timestamp(skb, &tv); 1390 1391 data = &tv; 1392 len = sizeof(tv); 1393 #ifdef CONFIG_COMPAT 1394 if (!COMPAT_USE_64BIT_TIME && 1395 (msg->msg_flags & MSG_CMSG_COMPAT)) { 1396 ctv.tv_sec = tv.tv_sec; 1397 ctv.tv_usec = tv.tv_usec; 1398 data = &ctv; 1399 len = sizeof(ctv); 1400 } 1401 #endif 1402 1403 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data); 1404 } 1405 } 1406 1407 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1408 size_t len, int flags) 1409 { 1410 int noblock = flags & MSG_DONTWAIT; 1411 struct sock *sk = sock->sk; 1412 struct sk_buff *skb; 1413 int copied, err; 1414 unsigned int skblen; 1415 1416 BT_DBG("sock %p, sk %p", sock, sk); 1417 1418 if (flags & MSG_OOB) 1419 return -EOPNOTSUPP; 1420 1421 if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING) 1422 return -EOPNOTSUPP; 1423 1424 if (sk->sk_state == BT_CLOSED) 1425 return 0; 1426 1427 skb = skb_recv_datagram(sk, flags, noblock, &err); 1428 if (!skb) 1429 return err; 1430 1431 skblen = skb->len; 1432 copied = skb->len; 1433 if (len < copied) { 1434 msg->msg_flags |= MSG_TRUNC; 1435 copied = len; 1436 } 1437 1438 skb_reset_transport_header(skb); 1439 err = skb_copy_datagram_msg(skb, 0, msg, copied); 1440 1441 switch (hci_pi(sk)->channel) { 1442 case HCI_CHANNEL_RAW: 1443 hci_sock_cmsg(sk, msg, skb); 1444 break; 1445 case HCI_CHANNEL_USER: 1446 case HCI_CHANNEL_MONITOR: 1447 sock_recv_timestamp(msg, sk, skb); 1448 break; 1449 default: 1450 if (hci_mgmt_chan_find(hci_pi(sk)->channel)) 1451 sock_recv_timestamp(msg, sk, skb); 1452 break; 1453 } 1454 1455 skb_free_datagram(sk, skb); 1456 1457 if (flags & MSG_TRUNC) 1458 copied = skblen; 1459 1460 return err ? : copied; 1461 } 1462 1463 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 1464 struct msghdr *msg, size_t msglen) 1465 { 1466 void *buf; 1467 u8 *cp; 1468 struct mgmt_hdr *hdr; 1469 u16 opcode, index, len; 1470 struct hci_dev *hdev = NULL; 1471 const struct hci_mgmt_handler *handler; 1472 bool var_len, no_hdev; 1473 int err; 1474 1475 BT_DBG("got %zu bytes", msglen); 1476 1477 if (msglen < sizeof(*hdr)) 1478 return -EINVAL; 1479 1480 buf = kmalloc(msglen, GFP_KERNEL); 1481 if (!buf) 1482 return -ENOMEM; 1483 1484 if (memcpy_from_msg(buf, msg, msglen)) { 1485 err = -EFAULT; 1486 goto done; 1487 } 1488 1489 hdr = buf; 1490 opcode = __le16_to_cpu(hdr->opcode); 1491 index = __le16_to_cpu(hdr->index); 1492 len = __le16_to_cpu(hdr->len); 1493 1494 if (len != msglen - sizeof(*hdr)) { 1495 err = -EINVAL; 1496 goto done; 1497 } 1498 1499 if (chan->channel == HCI_CHANNEL_CONTROL) { 1500 struct sk_buff *skb; 1501 1502 /* Send event to monitor */ 1503 skb = create_monitor_ctrl_command(sk, index, opcode, len, 1504 buf + sizeof(*hdr)); 1505 if (skb) { 1506 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1507 HCI_SOCK_TRUSTED, NULL); 1508 kfree_skb(skb); 1509 } 1510 } 1511 1512 if (opcode >= chan->handler_count || 1513 chan->handlers[opcode].func == NULL) { 1514 BT_DBG("Unknown op %u", opcode); 1515 err = mgmt_cmd_status(sk, index, opcode, 1516 MGMT_STATUS_UNKNOWN_COMMAND); 1517 goto done; 1518 } 1519 1520 handler = &chan->handlers[opcode]; 1521 1522 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) && 1523 !(handler->flags & HCI_MGMT_UNTRUSTED)) { 1524 err = mgmt_cmd_status(sk, index, opcode, 1525 MGMT_STATUS_PERMISSION_DENIED); 1526 goto done; 1527 } 1528 1529 if (index != MGMT_INDEX_NONE) { 1530 hdev = hci_dev_get(index); 1531 if (!hdev) { 1532 err = mgmt_cmd_status(sk, index, opcode, 1533 MGMT_STATUS_INVALID_INDEX); 1534 goto done; 1535 } 1536 1537 if (hci_dev_test_flag(hdev, HCI_SETUP) || 1538 hci_dev_test_flag(hdev, HCI_CONFIG) || 1539 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1540 err = mgmt_cmd_status(sk, index, opcode, 1541 MGMT_STATUS_INVALID_INDEX); 1542 goto done; 1543 } 1544 1545 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1546 !(handler->flags & HCI_MGMT_UNCONFIGURED)) { 1547 err = mgmt_cmd_status(sk, index, opcode, 1548 MGMT_STATUS_INVALID_INDEX); 1549 goto done; 1550 } 1551 } 1552 1553 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV); 1554 if (no_hdev != !hdev) { 1555 err = mgmt_cmd_status(sk, index, opcode, 1556 MGMT_STATUS_INVALID_INDEX); 1557 goto done; 1558 } 1559 1560 var_len = (handler->flags & HCI_MGMT_VAR_LEN); 1561 if ((var_len && len < handler->data_len) || 1562 (!var_len && len != handler->data_len)) { 1563 err = mgmt_cmd_status(sk, index, opcode, 1564 MGMT_STATUS_INVALID_PARAMS); 1565 goto done; 1566 } 1567 1568 if (hdev && chan->hdev_init) 1569 chan->hdev_init(sk, hdev); 1570 1571 cp = buf + sizeof(*hdr); 1572 1573 err = handler->func(sk, hdev, cp, len); 1574 if (err < 0) 1575 goto done; 1576 1577 err = msglen; 1578 1579 done: 1580 if (hdev) 1581 hci_dev_put(hdev); 1582 1583 kfree(buf); 1584 return err; 1585 } 1586 1587 static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len) 1588 { 1589 struct hci_mon_hdr *hdr; 1590 struct sk_buff *skb; 1591 struct hci_dev *hdev; 1592 u16 index; 1593 int err; 1594 1595 /* The logging frame consists at minimum of the standard header, 1596 * the priority byte, the ident length byte and at least one string 1597 * terminator NUL byte. Anything shorter are invalid packets. 1598 */ 1599 if (len < sizeof(*hdr) + 3) 1600 return -EINVAL; 1601 1602 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); 1603 if (!skb) 1604 return err; 1605 1606 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 1607 err = -EFAULT; 1608 goto drop; 1609 } 1610 1611 hdr = (void *)skb->data; 1612 1613 if (__le16_to_cpu(hdr->len) != len - sizeof(*hdr)) { 1614 err = -EINVAL; 1615 goto drop; 1616 } 1617 1618 if (__le16_to_cpu(hdr->opcode) == 0x0000) { 1619 __u8 priority = skb->data[sizeof(*hdr)]; 1620 __u8 ident_len = skb->data[sizeof(*hdr) + 1]; 1621 1622 /* Only the priorities 0-7 are valid and with that any other 1623 * value results in an invalid packet. 1624 * 1625 * The priority byte is followed by an ident length byte and 1626 * the NUL terminated ident string. Check that the ident 1627 * length is not overflowing the packet and also that the 1628 * ident string itself is NUL terminated. In case the ident 1629 * length is zero, the length value actually doubles as NUL 1630 * terminator identifier. 1631 * 1632 * The message follows the ident string (if present) and 1633 * must be NUL terminated. Otherwise it is not a valid packet. 1634 */ 1635 if (priority > 7 || skb->data[len - 1] != 0x00 || 1636 ident_len > len - sizeof(*hdr) - 3 || 1637 skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) { 1638 err = -EINVAL; 1639 goto drop; 1640 } 1641 } else { 1642 err = -EINVAL; 1643 goto drop; 1644 } 1645 1646 index = __le16_to_cpu(hdr->index); 1647 1648 if (index != MGMT_INDEX_NONE) { 1649 hdev = hci_dev_get(index); 1650 if (!hdev) { 1651 err = -ENODEV; 1652 goto drop; 1653 } 1654 } else { 1655 hdev = NULL; 1656 } 1657 1658 hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING); 1659 1660 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL); 1661 err = len; 1662 1663 if (hdev) 1664 hci_dev_put(hdev); 1665 1666 drop: 1667 kfree_skb(skb); 1668 return err; 1669 } 1670 1671 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1672 size_t len) 1673 { 1674 struct sock *sk = sock->sk; 1675 struct hci_mgmt_chan *chan; 1676 struct hci_dev *hdev; 1677 struct sk_buff *skb; 1678 int err; 1679 1680 BT_DBG("sock %p sk %p", sock, sk); 1681 1682 if (msg->msg_flags & MSG_OOB) 1683 return -EOPNOTSUPP; 1684 1685 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE| 1686 MSG_CMSG_COMPAT)) 1687 return -EINVAL; 1688 1689 if (len < 4 || len > HCI_MAX_FRAME_SIZE) 1690 return -EINVAL; 1691 1692 lock_sock(sk); 1693 1694 switch (hci_pi(sk)->channel) { 1695 case HCI_CHANNEL_RAW: 1696 case HCI_CHANNEL_USER: 1697 break; 1698 case HCI_CHANNEL_MONITOR: 1699 err = -EOPNOTSUPP; 1700 goto done; 1701 case HCI_CHANNEL_LOGGING: 1702 err = hci_logging_frame(sk, msg, len); 1703 goto done; 1704 default: 1705 mutex_lock(&mgmt_chan_list_lock); 1706 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel); 1707 if (chan) 1708 err = hci_mgmt_cmd(chan, sk, msg, len); 1709 else 1710 err = -EINVAL; 1711 1712 mutex_unlock(&mgmt_chan_list_lock); 1713 goto done; 1714 } 1715 1716 hdev = hci_pi(sk)->hdev; 1717 if (!hdev) { 1718 err = -EBADFD; 1719 goto done; 1720 } 1721 1722 if (!test_bit(HCI_UP, &hdev->flags)) { 1723 err = -ENETDOWN; 1724 goto done; 1725 } 1726 1727 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); 1728 if (!skb) 1729 goto done; 1730 1731 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 1732 err = -EFAULT; 1733 goto drop; 1734 } 1735 1736 hci_skb_pkt_type(skb) = skb->data[0]; 1737 skb_pull(skb, 1); 1738 1739 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 1740 /* No permission check is needed for user channel 1741 * since that gets enforced when binding the socket. 1742 * 1743 * However check that the packet type is valid. 1744 */ 1745 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 1746 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1747 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) { 1748 err = -EINVAL; 1749 goto drop; 1750 } 1751 1752 skb_queue_tail(&hdev->raw_q, skb); 1753 queue_work(hdev->workqueue, &hdev->tx_work); 1754 } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) { 1755 u16 opcode = get_unaligned_le16(skb->data); 1756 u16 ogf = hci_opcode_ogf(opcode); 1757 u16 ocf = hci_opcode_ocf(opcode); 1758 1759 if (((ogf > HCI_SFLT_MAX_OGF) || 1760 !hci_test_bit(ocf & HCI_FLT_OCF_BITS, 1761 &hci_sec_filter.ocf_mask[ogf])) && 1762 !capable(CAP_NET_RAW)) { 1763 err = -EPERM; 1764 goto drop; 1765 } 1766 1767 /* Since the opcode has already been extracted here, store 1768 * a copy of the value for later use by the drivers. 1769 */ 1770 hci_skb_opcode(skb) = opcode; 1771 1772 if (ogf == 0x3f) { 1773 skb_queue_tail(&hdev->raw_q, skb); 1774 queue_work(hdev->workqueue, &hdev->tx_work); 1775 } else { 1776 /* Stand-alone HCI commands must be flagged as 1777 * single-command requests. 1778 */ 1779 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 1780 1781 skb_queue_tail(&hdev->cmd_q, skb); 1782 queue_work(hdev->workqueue, &hdev->cmd_work); 1783 } 1784 } else { 1785 if (!capable(CAP_NET_RAW)) { 1786 err = -EPERM; 1787 goto drop; 1788 } 1789 1790 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1791 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) { 1792 err = -EINVAL; 1793 goto drop; 1794 } 1795 1796 skb_queue_tail(&hdev->raw_q, skb); 1797 queue_work(hdev->workqueue, &hdev->tx_work); 1798 } 1799 1800 err = len; 1801 1802 done: 1803 release_sock(sk); 1804 return err; 1805 1806 drop: 1807 kfree_skb(skb); 1808 goto done; 1809 } 1810 1811 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 1812 char __user *optval, unsigned int len) 1813 { 1814 struct hci_ufilter uf = { .opcode = 0 }; 1815 struct sock *sk = sock->sk; 1816 int err = 0, opt = 0; 1817 1818 BT_DBG("sk %p, opt %d", sk, optname); 1819 1820 if (level != SOL_HCI) 1821 return -ENOPROTOOPT; 1822 1823 lock_sock(sk); 1824 1825 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1826 err = -EBADFD; 1827 goto done; 1828 } 1829 1830 switch (optname) { 1831 case HCI_DATA_DIR: 1832 if (get_user(opt, (int __user *)optval)) { 1833 err = -EFAULT; 1834 break; 1835 } 1836 1837 if (opt) 1838 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; 1839 else 1840 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR; 1841 break; 1842 1843 case HCI_TIME_STAMP: 1844 if (get_user(opt, (int __user *)optval)) { 1845 err = -EFAULT; 1846 break; 1847 } 1848 1849 if (opt) 1850 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; 1851 else 1852 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP; 1853 break; 1854 1855 case HCI_FILTER: 1856 { 1857 struct hci_filter *f = &hci_pi(sk)->filter; 1858 1859 uf.type_mask = f->type_mask; 1860 uf.opcode = f->opcode; 1861 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 1862 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 1863 } 1864 1865 len = min_t(unsigned int, len, sizeof(uf)); 1866 if (copy_from_user(&uf, optval, len)) { 1867 err = -EFAULT; 1868 break; 1869 } 1870 1871 if (!capable(CAP_NET_RAW)) { 1872 uf.type_mask &= hci_sec_filter.type_mask; 1873 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0); 1874 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1); 1875 } 1876 1877 { 1878 struct hci_filter *f = &hci_pi(sk)->filter; 1879 1880 f->type_mask = uf.type_mask; 1881 f->opcode = uf.opcode; 1882 *((u32 *) f->event_mask + 0) = uf.event_mask[0]; 1883 *((u32 *) f->event_mask + 1) = uf.event_mask[1]; 1884 } 1885 break; 1886 1887 default: 1888 err = -ENOPROTOOPT; 1889 break; 1890 } 1891 1892 done: 1893 release_sock(sk); 1894 return err; 1895 } 1896 1897 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, 1898 char __user *optval, int __user *optlen) 1899 { 1900 struct hci_ufilter uf; 1901 struct sock *sk = sock->sk; 1902 int len, opt, err = 0; 1903 1904 BT_DBG("sk %p, opt %d", sk, optname); 1905 1906 if (level != SOL_HCI) 1907 return -ENOPROTOOPT; 1908 1909 if (get_user(len, optlen)) 1910 return -EFAULT; 1911 1912 lock_sock(sk); 1913 1914 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1915 err = -EBADFD; 1916 goto done; 1917 } 1918 1919 switch (optname) { 1920 case HCI_DATA_DIR: 1921 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR) 1922 opt = 1; 1923 else 1924 opt = 0; 1925 1926 if (put_user(opt, optval)) 1927 err = -EFAULT; 1928 break; 1929 1930 case HCI_TIME_STAMP: 1931 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP) 1932 opt = 1; 1933 else 1934 opt = 0; 1935 1936 if (put_user(opt, optval)) 1937 err = -EFAULT; 1938 break; 1939 1940 case HCI_FILTER: 1941 { 1942 struct hci_filter *f = &hci_pi(sk)->filter; 1943 1944 memset(&uf, 0, sizeof(uf)); 1945 uf.type_mask = f->type_mask; 1946 uf.opcode = f->opcode; 1947 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 1948 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 1949 } 1950 1951 len = min_t(unsigned int, len, sizeof(uf)); 1952 if (copy_to_user(optval, &uf, len)) 1953 err = -EFAULT; 1954 break; 1955 1956 default: 1957 err = -ENOPROTOOPT; 1958 break; 1959 } 1960 1961 done: 1962 release_sock(sk); 1963 return err; 1964 } 1965 1966 static const struct proto_ops hci_sock_ops = { 1967 .family = PF_BLUETOOTH, 1968 .owner = THIS_MODULE, 1969 .release = hci_sock_release, 1970 .bind = hci_sock_bind, 1971 .getname = hci_sock_getname, 1972 .sendmsg = hci_sock_sendmsg, 1973 .recvmsg = hci_sock_recvmsg, 1974 #ifdef CONFIG_BT_LEGACY_IOCTL 1975 .ioctl = hci_sock_ioctl, 1976 #else 1977 .ioctl = sock_no_ioctl, 1978 #endif 1979 .poll = datagram_poll, 1980 .listen = sock_no_listen, 1981 .shutdown = sock_no_shutdown, 1982 .setsockopt = hci_sock_setsockopt, 1983 .getsockopt = hci_sock_getsockopt, 1984 .connect = sock_no_connect, 1985 .socketpair = sock_no_socketpair, 1986 .accept = sock_no_accept, 1987 .mmap = sock_no_mmap 1988 }; 1989 1990 static struct proto hci_sk_proto = { 1991 .name = "HCI", 1992 .owner = THIS_MODULE, 1993 .obj_size = sizeof(struct hci_pinfo) 1994 }; 1995 1996 static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 1997 int kern) 1998 { 1999 struct sock *sk; 2000 2001 BT_DBG("sock %p", sock); 2002 2003 if (sock->type != SOCK_RAW) 2004 return -ESOCKTNOSUPPORT; 2005 2006 sock->ops = &hci_sock_ops; 2007 2008 sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern); 2009 if (!sk) 2010 return -ENOMEM; 2011 2012 sock_init_data(sock, sk); 2013 2014 sock_reset_flag(sk, SOCK_ZAPPED); 2015 2016 sk->sk_protocol = protocol; 2017 2018 sock->state = SS_UNCONNECTED; 2019 sk->sk_state = BT_OPEN; 2020 2021 bt_sock_link(&hci_sk_list, sk); 2022 return 0; 2023 } 2024 2025 static const struct net_proto_family hci_sock_family_ops = { 2026 .family = PF_BLUETOOTH, 2027 .owner = THIS_MODULE, 2028 .create = hci_sock_create, 2029 }; 2030 2031 int __init hci_sock_init(void) 2032 { 2033 int err; 2034 2035 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr)); 2036 2037 err = proto_register(&hci_sk_proto, 0); 2038 if (err < 0) 2039 return err; 2040 2041 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops); 2042 if (err < 0) { 2043 BT_ERR("HCI socket registration failed"); 2044 goto error; 2045 } 2046 2047 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL); 2048 if (err < 0) { 2049 BT_ERR("Failed to create HCI proc file"); 2050 bt_sock_unregister(BTPROTO_HCI); 2051 goto error; 2052 } 2053 2054 BT_INFO("HCI socket layer initialized"); 2055 2056 return 0; 2057 2058 error: 2059 proto_unregister(&hci_sk_proto); 2060 return err; 2061 } 2062 2063 void hci_sock_cleanup(void) 2064 { 2065 bt_procfs_cleanup(&init_net, "hci"); 2066 bt_sock_unregister(BTPROTO_HCI); 2067 proto_unregister(&hci_sk_proto); 2068 } 2069