1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI sockets. */ 26 27 #include <linux/module.h> 28 29 #include <linux/types.h> 30 #include <linux/capability.h> 31 #include <linux/errno.h> 32 #include <linux/kernel.h> 33 #include <linux/slab.h> 34 #include <linux/poll.h> 35 #include <linux/fcntl.h> 36 #include <linux/init.h> 37 #include <linux/skbuff.h> 38 #include <linux/workqueue.h> 39 #include <linux/interrupt.h> 40 #include <linux/compat.h> 41 #include <linux/socket.h> 42 #include <linux/ioctl.h> 43 #include <net/sock.h> 44 45 #include <asm/system.h> 46 #include <asm/uaccess.h> 47 #include <asm/unaligned.h> 48 49 #include <net/bluetooth/bluetooth.h> 50 #include <net/bluetooth/hci_core.h> 51 52 /* ----- HCI socket interface ----- */ 53 54 static inline int hci_test_bit(int nr, void *addr) 55 { 56 return *((__u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31)); 57 } 58 59 /* Security filter */ 60 static struct hci_sec_filter hci_sec_filter = { 61 /* Packet types */ 62 0x10, 63 /* Events */ 64 { 0x1000d9fe, 0x0000b00c }, 65 /* Commands */ 66 { 67 { 0x0 }, 68 /* OGF_LINK_CTL */ 69 { 0xbe000006, 0x00000001, 0x00000000, 0x00 }, 70 /* OGF_LINK_POLICY */ 71 { 0x00005200, 0x00000000, 0x00000000, 0x00 }, 72 /* OGF_HOST_CTL */ 73 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 }, 74 /* OGF_INFO_PARAM */ 75 { 0x000002be, 0x00000000, 0x00000000, 0x00 }, 76 /* OGF_STATUS_PARAM */ 77 { 0x000000ea, 0x00000000, 0x00000000, 0x00 } 78 } 79 }; 80 81 static struct bt_sock_list hci_sk_list = { 82 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock) 83 }; 84 85 /* Send frame to RAW socket */ 86 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 87 { 88 struct sock *sk; 89 struct hlist_node *node; 90 91 BT_DBG("hdev %p len %d", hdev, skb->len); 92 93 read_lock(&hci_sk_list.lock); 94 sk_for_each(sk, node, &hci_sk_list.head) { 95 struct hci_filter *flt; 96 struct sk_buff *nskb; 97 98 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev) 99 continue; 100 101 /* Don't send frame to the socket it came from */ 102 if (skb->sk == sk) 103 continue; 104 105 /* Apply filter */ 106 flt = &hci_pi(sk)->filter; 107 108 if (!test_bit((bt_cb(skb)->pkt_type == HCI_VENDOR_PKT) ? 109 0 : (bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS), &flt->type_mask)) 110 continue; 111 112 if (bt_cb(skb)->pkt_type == HCI_EVENT_PKT) { 113 register int evt = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS); 114 115 if (!hci_test_bit(evt, &flt->event_mask)) 116 continue; 117 118 if (flt->opcode && 119 ((evt == HCI_EV_CMD_COMPLETE && 120 flt->opcode != 121 get_unaligned((__le16 *)(skb->data + 3))) || 122 (evt == HCI_EV_CMD_STATUS && 123 flt->opcode != 124 get_unaligned((__le16 *)(skb->data + 4))))) 125 continue; 126 } 127 128 if (!(nskb = skb_clone(skb, GFP_ATOMIC))) 129 continue; 130 131 /* Put type byte before the data */ 132 memcpy(skb_push(nskb, 1), &bt_cb(nskb)->pkt_type, 1); 133 134 if (sock_queue_rcv_skb(sk, nskb)) 135 kfree_skb(nskb); 136 } 137 read_unlock(&hci_sk_list.lock); 138 } 139 140 static int hci_sock_release(struct socket *sock) 141 { 142 struct sock *sk = sock->sk; 143 struct hci_dev *hdev; 144 145 BT_DBG("sock %p sk %p", sock, sk); 146 147 if (!sk) 148 return 0; 149 150 hdev = hci_pi(sk)->hdev; 151 152 bt_sock_unlink(&hci_sk_list, sk); 153 154 if (hdev) { 155 atomic_dec(&hdev->promisc); 156 hci_dev_put(hdev); 157 } 158 159 sock_orphan(sk); 160 161 skb_queue_purge(&sk->sk_receive_queue); 162 skb_queue_purge(&sk->sk_write_queue); 163 164 sock_put(sk); 165 return 0; 166 } 167 168 /* Ioctls that require bound socket */ 169 static inline int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, unsigned long arg) 170 { 171 struct hci_dev *hdev = hci_pi(sk)->hdev; 172 173 if (!hdev) 174 return -EBADFD; 175 176 switch (cmd) { 177 case HCISETRAW: 178 if (!capable(CAP_NET_ADMIN)) 179 return -EACCES; 180 181 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 182 return -EPERM; 183 184 if (arg) 185 set_bit(HCI_RAW, &hdev->flags); 186 else 187 clear_bit(HCI_RAW, &hdev->flags); 188 189 return 0; 190 191 case HCIGETCONNINFO: 192 return hci_get_conn_info(hdev, (void __user *) arg); 193 194 case HCIGETAUTHINFO: 195 return hci_get_auth_info(hdev, (void __user *) arg); 196 197 default: 198 if (hdev->ioctl) 199 return hdev->ioctl(hdev, cmd, arg); 200 return -EINVAL; 201 } 202 } 203 204 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 205 { 206 struct sock *sk = sock->sk; 207 void __user *argp = (void __user *) arg; 208 int err; 209 210 BT_DBG("cmd %x arg %lx", cmd, arg); 211 212 switch (cmd) { 213 case HCIGETDEVLIST: 214 return hci_get_dev_list(argp); 215 216 case HCIGETDEVINFO: 217 return hci_get_dev_info(argp); 218 219 case HCIGETCONNLIST: 220 return hci_get_conn_list(argp); 221 222 case HCIDEVUP: 223 if (!capable(CAP_NET_ADMIN)) 224 return -EACCES; 225 return hci_dev_open(arg); 226 227 case HCIDEVDOWN: 228 if (!capable(CAP_NET_ADMIN)) 229 return -EACCES; 230 return hci_dev_close(arg); 231 232 case HCIDEVRESET: 233 if (!capable(CAP_NET_ADMIN)) 234 return -EACCES; 235 return hci_dev_reset(arg); 236 237 case HCIDEVRESTAT: 238 if (!capable(CAP_NET_ADMIN)) 239 return -EACCES; 240 return hci_dev_reset_stat(arg); 241 242 case HCISETSCAN: 243 case HCISETAUTH: 244 case HCISETENCRYPT: 245 case HCISETPTYPE: 246 case HCISETLINKPOL: 247 case HCISETLINKMODE: 248 case HCISETACLMTU: 249 case HCISETSCOMTU: 250 if (!capable(CAP_NET_ADMIN)) 251 return -EACCES; 252 return hci_dev_cmd(cmd, argp); 253 254 case HCIINQUIRY: 255 return hci_inquiry(argp); 256 257 default: 258 lock_sock(sk); 259 err = hci_sock_bound_ioctl(sk, cmd, arg); 260 release_sock(sk); 261 return err; 262 } 263 } 264 265 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) 266 { 267 struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr; 268 struct sock *sk = sock->sk; 269 struct hci_dev *hdev = NULL; 270 int err = 0; 271 272 BT_DBG("sock %p sk %p", sock, sk); 273 274 if (!haddr || haddr->hci_family != AF_BLUETOOTH) 275 return -EINVAL; 276 277 lock_sock(sk); 278 279 if (hci_pi(sk)->hdev) { 280 err = -EALREADY; 281 goto done; 282 } 283 284 if (haddr->hci_dev != HCI_DEV_NONE) { 285 if (!(hdev = hci_dev_get(haddr->hci_dev))) { 286 err = -ENODEV; 287 goto done; 288 } 289 290 atomic_inc(&hdev->promisc); 291 } 292 293 hci_pi(sk)->hdev = hdev; 294 sk->sk_state = BT_BOUND; 295 296 done: 297 release_sock(sk); 298 return err; 299 } 300 301 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, int *addr_len, int peer) 302 { 303 struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr; 304 struct sock *sk = sock->sk; 305 struct hci_dev *hdev = hci_pi(sk)->hdev; 306 307 BT_DBG("sock %p sk %p", sock, sk); 308 309 if (!hdev) 310 return -EBADFD; 311 312 lock_sock(sk); 313 314 *addr_len = sizeof(*haddr); 315 haddr->hci_family = AF_BLUETOOTH; 316 haddr->hci_dev = hdev->id; 317 318 release_sock(sk); 319 return 0; 320 } 321 322 static inline void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, struct sk_buff *skb) 323 { 324 __u32 mask = hci_pi(sk)->cmsg_mask; 325 326 if (mask & HCI_CMSG_DIR) { 327 int incoming = bt_cb(skb)->incoming; 328 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), &incoming); 329 } 330 331 if (mask & HCI_CMSG_TSTAMP) { 332 struct timeval tv; 333 void *data; 334 int len; 335 336 skb_get_timestamp(skb, &tv); 337 338 data = &tv; 339 len = sizeof(tv); 340 #ifdef CONFIG_COMPAT 341 if (msg->msg_flags & MSG_CMSG_COMPAT) { 342 struct compat_timeval ctv; 343 ctv.tv_sec = tv.tv_sec; 344 ctv.tv_usec = tv.tv_usec; 345 data = &ctv; 346 len = sizeof(ctv); 347 } 348 #endif 349 350 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data); 351 } 352 } 353 354 static int hci_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 355 struct msghdr *msg, size_t len, int flags) 356 { 357 int noblock = flags & MSG_DONTWAIT; 358 struct sock *sk = sock->sk; 359 struct sk_buff *skb; 360 int copied, err; 361 362 BT_DBG("sock %p, sk %p", sock, sk); 363 364 if (flags & (MSG_OOB)) 365 return -EOPNOTSUPP; 366 367 if (sk->sk_state == BT_CLOSED) 368 return 0; 369 370 if (!(skb = skb_recv_datagram(sk, flags, noblock, &err))) 371 return err; 372 373 msg->msg_namelen = 0; 374 375 copied = skb->len; 376 if (len < copied) { 377 msg->msg_flags |= MSG_TRUNC; 378 copied = len; 379 } 380 381 skb_reset_transport_header(skb); 382 err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied); 383 384 hci_sock_cmsg(sk, msg, skb); 385 386 skb_free_datagram(sk, skb); 387 388 return err ? : copied; 389 } 390 391 static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock, 392 struct msghdr *msg, size_t len) 393 { 394 struct sock *sk = sock->sk; 395 struct hci_dev *hdev; 396 struct sk_buff *skb; 397 int err; 398 399 BT_DBG("sock %p sk %p", sock, sk); 400 401 if (msg->msg_flags & MSG_OOB) 402 return -EOPNOTSUPP; 403 404 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE)) 405 return -EINVAL; 406 407 if (len < 4 || len > HCI_MAX_FRAME_SIZE) 408 return -EINVAL; 409 410 lock_sock(sk); 411 412 if (!(hdev = hci_pi(sk)->hdev)) { 413 err = -EBADFD; 414 goto done; 415 } 416 417 if (!test_bit(HCI_UP, &hdev->flags)) { 418 err = -ENETDOWN; 419 goto done; 420 } 421 422 if (!(skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err))) 423 goto done; 424 425 if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { 426 err = -EFAULT; 427 goto drop; 428 } 429 430 bt_cb(skb)->pkt_type = *((unsigned char *) skb->data); 431 skb_pull(skb, 1); 432 skb->dev = (void *) hdev; 433 434 if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) { 435 u16 opcode = get_unaligned_le16(skb->data); 436 u16 ogf = hci_opcode_ogf(opcode); 437 u16 ocf = hci_opcode_ocf(opcode); 438 439 if (((ogf > HCI_SFLT_MAX_OGF) || 440 !hci_test_bit(ocf & HCI_FLT_OCF_BITS, &hci_sec_filter.ocf_mask[ogf])) && 441 !capable(CAP_NET_RAW)) { 442 err = -EPERM; 443 goto drop; 444 } 445 446 if (test_bit(HCI_RAW, &hdev->flags) || (ogf == 0x3f)) { 447 skb_queue_tail(&hdev->raw_q, skb); 448 tasklet_schedule(&hdev->tx_task); 449 } else { 450 skb_queue_tail(&hdev->cmd_q, skb); 451 tasklet_schedule(&hdev->cmd_task); 452 } 453 } else { 454 if (!capable(CAP_NET_RAW)) { 455 err = -EPERM; 456 goto drop; 457 } 458 459 skb_queue_tail(&hdev->raw_q, skb); 460 tasklet_schedule(&hdev->tx_task); 461 } 462 463 err = len; 464 465 done: 466 release_sock(sk); 467 return err; 468 469 drop: 470 kfree_skb(skb); 471 goto done; 472 } 473 474 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, char __user *optval, unsigned int len) 475 { 476 struct hci_ufilter uf = { .opcode = 0 }; 477 struct sock *sk = sock->sk; 478 int err = 0, opt = 0; 479 480 BT_DBG("sk %p, opt %d", sk, optname); 481 482 lock_sock(sk); 483 484 switch (optname) { 485 case HCI_DATA_DIR: 486 if (get_user(opt, (int __user *)optval)) { 487 err = -EFAULT; 488 break; 489 } 490 491 if (opt) 492 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; 493 else 494 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR; 495 break; 496 497 case HCI_TIME_STAMP: 498 if (get_user(opt, (int __user *)optval)) { 499 err = -EFAULT; 500 break; 501 } 502 503 if (opt) 504 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; 505 else 506 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP; 507 break; 508 509 case HCI_FILTER: 510 { 511 struct hci_filter *f = &hci_pi(sk)->filter; 512 513 uf.type_mask = f->type_mask; 514 uf.opcode = f->opcode; 515 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 516 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 517 } 518 519 len = min_t(unsigned int, len, sizeof(uf)); 520 if (copy_from_user(&uf, optval, len)) { 521 err = -EFAULT; 522 break; 523 } 524 525 if (!capable(CAP_NET_RAW)) { 526 uf.type_mask &= hci_sec_filter.type_mask; 527 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0); 528 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1); 529 } 530 531 { 532 struct hci_filter *f = &hci_pi(sk)->filter; 533 534 f->type_mask = uf.type_mask; 535 f->opcode = uf.opcode; 536 *((u32 *) f->event_mask + 0) = uf.event_mask[0]; 537 *((u32 *) f->event_mask + 1) = uf.event_mask[1]; 538 } 539 break; 540 541 default: 542 err = -ENOPROTOOPT; 543 break; 544 } 545 546 release_sock(sk); 547 return err; 548 } 549 550 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, char __user *optval, int __user *optlen) 551 { 552 struct hci_ufilter uf; 553 struct sock *sk = sock->sk; 554 int len, opt; 555 556 if (get_user(len, optlen)) 557 return -EFAULT; 558 559 switch (optname) { 560 case HCI_DATA_DIR: 561 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR) 562 opt = 1; 563 else 564 opt = 0; 565 566 if (put_user(opt, optval)) 567 return -EFAULT; 568 break; 569 570 case HCI_TIME_STAMP: 571 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP) 572 opt = 1; 573 else 574 opt = 0; 575 576 if (put_user(opt, optval)) 577 return -EFAULT; 578 break; 579 580 case HCI_FILTER: 581 { 582 struct hci_filter *f = &hci_pi(sk)->filter; 583 584 uf.type_mask = f->type_mask; 585 uf.opcode = f->opcode; 586 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 587 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 588 } 589 590 len = min_t(unsigned int, len, sizeof(uf)); 591 if (copy_to_user(optval, &uf, len)) 592 return -EFAULT; 593 break; 594 595 default: 596 return -ENOPROTOOPT; 597 break; 598 } 599 600 return 0; 601 } 602 603 static const struct proto_ops hci_sock_ops = { 604 .family = PF_BLUETOOTH, 605 .owner = THIS_MODULE, 606 .release = hci_sock_release, 607 .bind = hci_sock_bind, 608 .getname = hci_sock_getname, 609 .sendmsg = hci_sock_sendmsg, 610 .recvmsg = hci_sock_recvmsg, 611 .ioctl = hci_sock_ioctl, 612 .poll = datagram_poll, 613 .listen = sock_no_listen, 614 .shutdown = sock_no_shutdown, 615 .setsockopt = hci_sock_setsockopt, 616 .getsockopt = hci_sock_getsockopt, 617 .connect = sock_no_connect, 618 .socketpair = sock_no_socketpair, 619 .accept = sock_no_accept, 620 .mmap = sock_no_mmap 621 }; 622 623 static struct proto hci_sk_proto = { 624 .name = "HCI", 625 .owner = THIS_MODULE, 626 .obj_size = sizeof(struct hci_pinfo) 627 }; 628 629 static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 630 int kern) 631 { 632 struct sock *sk; 633 634 BT_DBG("sock %p", sock); 635 636 if (sock->type != SOCK_RAW) 637 return -ESOCKTNOSUPPORT; 638 639 sock->ops = &hci_sock_ops; 640 641 sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto); 642 if (!sk) 643 return -ENOMEM; 644 645 sock_init_data(sock, sk); 646 647 sock_reset_flag(sk, SOCK_ZAPPED); 648 649 sk->sk_protocol = protocol; 650 651 sock->state = SS_UNCONNECTED; 652 sk->sk_state = BT_OPEN; 653 654 bt_sock_link(&hci_sk_list, sk); 655 return 0; 656 } 657 658 static int hci_sock_dev_event(struct notifier_block *this, unsigned long event, void *ptr) 659 { 660 struct hci_dev *hdev = (struct hci_dev *) ptr; 661 struct hci_ev_si_device ev; 662 663 BT_DBG("hdev %s event %ld", hdev->name, event); 664 665 /* Send event to sockets */ 666 ev.event = event; 667 ev.dev_id = hdev->id; 668 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev); 669 670 if (event == HCI_DEV_UNREG) { 671 struct sock *sk; 672 struct hlist_node *node; 673 674 /* Detach sockets from device */ 675 read_lock(&hci_sk_list.lock); 676 sk_for_each(sk, node, &hci_sk_list.head) { 677 local_bh_disable(); 678 bh_lock_sock_nested(sk); 679 if (hci_pi(sk)->hdev == hdev) { 680 hci_pi(sk)->hdev = NULL; 681 sk->sk_err = EPIPE; 682 sk->sk_state = BT_OPEN; 683 sk->sk_state_change(sk); 684 685 hci_dev_put(hdev); 686 } 687 bh_unlock_sock(sk); 688 local_bh_enable(); 689 } 690 read_unlock(&hci_sk_list.lock); 691 } 692 693 return NOTIFY_DONE; 694 } 695 696 static const struct net_proto_family hci_sock_family_ops = { 697 .family = PF_BLUETOOTH, 698 .owner = THIS_MODULE, 699 .create = hci_sock_create, 700 }; 701 702 static struct notifier_block hci_sock_nblock = { 703 .notifier_call = hci_sock_dev_event 704 }; 705 706 int __init hci_sock_init(void) 707 { 708 int err; 709 710 err = proto_register(&hci_sk_proto, 0); 711 if (err < 0) 712 return err; 713 714 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops); 715 if (err < 0) 716 goto error; 717 718 hci_register_notifier(&hci_sock_nblock); 719 720 BT_INFO("HCI socket layer initialized"); 721 722 return 0; 723 724 error: 725 BT_ERR("HCI socket registration failed"); 726 proto_unregister(&hci_sk_proto); 727 return err; 728 } 729 730 void __exit hci_sock_cleanup(void) 731 { 732 if (bt_sock_unregister(BTPROTO_HCI) < 0) 733 BT_ERR("HCI socket unregistration failed"); 734 735 hci_unregister_notifier(&hci_sock_nblock); 736 737 proto_unregister(&hci_sk_proto); 738 } 739