xref: /linux/net/bluetooth/af_bluetooth.c (revision 333f7de560e1196034b67db16916b10a0c529e1d)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3    BlueZ - Bluetooth protocol stack for Linux
4    Copyright (C) 2000-2001 Qualcomm Incorporated
5 
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 
8    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
9    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
10    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
11    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
12    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
13    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 
17    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
18    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
19    SOFTWARE IS DISCLAIMED.
20 */
21 
22 /* Bluetooth address family and sockets. */
23 
24 #include <linux/module.h>
25 #include <linux/debugfs.h>
26 #include <linux/stringify.h>
27 #include <linux/sched/signal.h>
28 
29 #include <asm/ioctls.h>
30 
31 #include <net/bluetooth/bluetooth.h>
32 #include <linux/proc_fs.h>
33 
34 #include <linux/ethtool.h>
35 #include <linux/sockios.h>
36 
37 #include "leds.h"
38 #include "selftest.h"
39 
40 /* Bluetooth sockets */
41 #define BT_MAX_PROTO	(BTPROTO_LAST + 1)
42 static const struct net_proto_family *bt_proto[BT_MAX_PROTO];
43 static DEFINE_RWLOCK(bt_proto_lock);
44 
45 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
46 static const char *const bt_key_strings[BT_MAX_PROTO] = {
47 	"sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP",
48 	"sk_lock-AF_BLUETOOTH-BTPROTO_HCI",
49 	"sk_lock-AF_BLUETOOTH-BTPROTO_SCO",
50 	"sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM",
51 	"sk_lock-AF_BLUETOOTH-BTPROTO_BNEP",
52 	"sk_lock-AF_BLUETOOTH-BTPROTO_CMTP",
53 	"sk_lock-AF_BLUETOOTH-BTPROTO_HIDP",
54 	"sk_lock-AF_BLUETOOTH-BTPROTO_AVDTP",
55 	"sk_lock-AF_BLUETOOTH-BTPROTO_ISO",
56 };
57 
58 static struct lock_class_key bt_slock_key[BT_MAX_PROTO];
59 static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
60 	"slock-AF_BLUETOOTH-BTPROTO_L2CAP",
61 	"slock-AF_BLUETOOTH-BTPROTO_HCI",
62 	"slock-AF_BLUETOOTH-BTPROTO_SCO",
63 	"slock-AF_BLUETOOTH-BTPROTO_RFCOMM",
64 	"slock-AF_BLUETOOTH-BTPROTO_BNEP",
65 	"slock-AF_BLUETOOTH-BTPROTO_CMTP",
66 	"slock-AF_BLUETOOTH-BTPROTO_HIDP",
67 	"slock-AF_BLUETOOTH-BTPROTO_AVDTP",
68 	"slock-AF_BLUETOOTH-BTPROTO_ISO",
69 };
70 
71 void bt_sock_reclassify_lock(struct sock *sk, int proto)
72 {
73 	BUG_ON(!sk);
74 	BUG_ON(!sock_allow_reclassification(sk));
75 
76 	sock_lock_init_class_and_name(sk,
77 				      bt_slock_key_strings[proto], &bt_slock_key[proto],
78 				      bt_key_strings[proto], &bt_lock_key[proto]);
79 }
80 EXPORT_SYMBOL(bt_sock_reclassify_lock);
81 
82 int bt_sock_register(int proto, const struct net_proto_family *ops)
83 {
84 	int err = 0;
85 
86 	if (proto < 0 || proto >= BT_MAX_PROTO)
87 		return -EINVAL;
88 
89 	write_lock(&bt_proto_lock);
90 
91 	if (bt_proto[proto])
92 		err = -EEXIST;
93 	else
94 		bt_proto[proto] = ops;
95 
96 	write_unlock(&bt_proto_lock);
97 
98 	return err;
99 }
100 EXPORT_SYMBOL(bt_sock_register);
101 
102 void bt_sock_unregister(int proto)
103 {
104 	if (proto < 0 || proto >= BT_MAX_PROTO)
105 		return;
106 
107 	write_lock(&bt_proto_lock);
108 	bt_proto[proto] = NULL;
109 	write_unlock(&bt_proto_lock);
110 }
111 EXPORT_SYMBOL(bt_sock_unregister);
112 
113 static int bt_sock_create(struct net *net, struct socket *sock, int proto,
114 			  int kern)
115 {
116 	int err;
117 
118 	if (net != &init_net)
119 		return -EAFNOSUPPORT;
120 
121 	if (proto < 0 || proto >= BT_MAX_PROTO)
122 		return -EINVAL;
123 
124 	if (!bt_proto[proto])
125 		request_module("bt-proto-%d", proto);
126 
127 	err = -EPROTONOSUPPORT;
128 
129 	read_lock(&bt_proto_lock);
130 
131 	if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
132 		err = bt_proto[proto]->create(net, sock, proto, kern);
133 		if (!err)
134 			bt_sock_reclassify_lock(sock->sk, proto);
135 		module_put(bt_proto[proto]->owner);
136 	}
137 
138 	read_unlock(&bt_proto_lock);
139 
140 	return err;
141 }
142 
143 struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
144 			   struct proto *prot, int proto, gfp_t prio, int kern)
145 {
146 	struct sock *sk;
147 
148 	sk = sk_alloc(net, PF_BLUETOOTH, prio, prot, kern);
149 	if (!sk)
150 		return NULL;
151 
152 	sock_init_data(sock, sk);
153 	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
154 	spin_lock_init(&bt_sk(sk)->accept_q_lock);
155 
156 	sock_reset_flag(sk, SOCK_ZAPPED);
157 
158 	sk->sk_protocol = proto;
159 	sk->sk_state    = BT_OPEN;
160 
161 	/* Init peer information so it can be properly monitored */
162 	if (!kern) {
163 		spin_lock(&sk->sk_peer_lock);
164 		sk->sk_peer_pid  = get_pid(task_tgid(current));
165 		sk->sk_peer_cred = get_current_cred();
166 		spin_unlock(&sk->sk_peer_lock);
167 	}
168 
169 	return sk;
170 }
171 EXPORT_SYMBOL(bt_sock_alloc);
172 
173 void bt_sock_link(struct bt_sock_list *l, struct sock *sk)
174 {
175 	write_lock(&l->lock);
176 	sk_add_node(sk, &l->head);
177 	write_unlock(&l->lock);
178 }
179 EXPORT_SYMBOL(bt_sock_link);
180 
181 void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
182 {
183 	write_lock(&l->lock);
184 	sk_del_node_init(sk);
185 	write_unlock(&l->lock);
186 }
187 EXPORT_SYMBOL(bt_sock_unlink);
188 
189 bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
190 {
191 	struct sock *sk;
192 
193 	if (!l || !s)
194 		return false;
195 
196 	read_lock(&l->lock);
197 
198 	sk_for_each(sk, &l->head) {
199 		if (s == sk) {
200 			read_unlock(&l->lock);
201 			return true;
202 		}
203 	}
204 
205 	read_unlock(&l->lock);
206 
207 	return false;
208 }
209 EXPORT_SYMBOL(bt_sock_linked);
210 
211 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
212 {
213 	const struct cred *old_cred;
214 	struct pid *old_pid;
215 	struct bt_sock *par = bt_sk(parent);
216 
217 	BT_DBG("parent %p, sk %p", parent, sk);
218 
219 	sock_hold(sk);
220 
221 	if (bh)
222 		bh_lock_sock_nested(sk);
223 	else
224 		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
225 
226 	bt_sk(sk)->parent = parent;
227 
228 	spin_lock_bh(&par->accept_q_lock);
229 	list_add_tail(&bt_sk(sk)->accept_q, &par->accept_q);
230 	sk_acceptq_added(parent);
231 	spin_unlock_bh(&par->accept_q_lock);
232 
233 	/* Copy credentials from parent since for incoming connections the
234 	 * socket is allocated by the kernel.
235 	 */
236 	spin_lock(&sk->sk_peer_lock);
237 	old_pid = sk->sk_peer_pid;
238 	old_cred = sk->sk_peer_cred;
239 	sk->sk_peer_pid = get_pid(parent->sk_peer_pid);
240 	sk->sk_peer_cred = get_cred(parent->sk_peer_cred);
241 	spin_unlock(&sk->sk_peer_lock);
242 
243 	put_pid(old_pid);
244 	put_cred(old_cred);
245 
246 	if (bh)
247 		bh_unlock_sock(sk);
248 	else
249 		release_sock(sk);
250 }
251 EXPORT_SYMBOL(bt_accept_enqueue);
252 
253 /* Calling function must hold the sk lock.
254  * bt_sk(sk)->parent must be non-NULL meaning sk is in the parent list.
255  */
256 void bt_accept_unlink(struct sock *sk)
257 {
258 	struct sock *parent = bt_sk(sk)->parent;
259 
260 	BT_DBG("sk %p state %d", sk, sk->sk_state);
261 
262 	spin_lock_bh(&bt_sk(parent)->accept_q_lock);
263 	list_del_init(&bt_sk(sk)->accept_q);
264 	sk_acceptq_removed(parent);
265 	spin_unlock_bh(&bt_sk(parent)->accept_q_lock);
266 	bt_sk(sk)->parent = NULL;
267 	sock_put(sk);
268 }
269 EXPORT_SYMBOL(bt_accept_unlink);
270 
271 static struct sock *bt_accept_get(struct sock *parent, struct sock *sk)
272 {
273 	struct bt_sock *bt = bt_sk(parent);
274 	struct sock *next = NULL;
275 
276 	/* accept_q is modified from child teardown paths too, so take a
277 	 * temporary reference before dropping the queue lock.
278 	 */
279 	spin_lock_bh(&bt->accept_q_lock);
280 
281 	if (sk) {
282 		if (bt_sk(sk)->parent != parent)
283 			goto out;
284 
285 		if (!list_is_last(&bt_sk(sk)->accept_q, &bt->accept_q)) {
286 			next = &list_next_entry(bt_sk(sk), accept_q)->sk;
287 			sock_hold(next);
288 		}
289 	} else if (!list_empty(&bt->accept_q)) {
290 		next = &list_first_entry(&bt->accept_q,
291 					 struct bt_sock, accept_q)->sk;
292 		sock_hold(next);
293 	}
294 
295 out:
296 	spin_unlock_bh(&bt->accept_q_lock);
297 	return next;
298 }
299 
300 struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
301 {
302 	struct sock *sk, *next;
303 
304 	BT_DBG("parent %p", parent);
305 
306 restart:
307 	for (sk = bt_accept_get(parent, NULL); sk; sk = next) {
308 		/* The reference from bt_accept_get() keeps sk alive. */
309 		lock_sock(sk);
310 
311 		/* Check sk has not already been unlinked via
312 		 * bt_accept_unlink() due to serialisation caused by sk locking
313 		 */
314 		if (bt_sk(sk)->parent != parent) {
315 			BT_DBG("sk %p, already unlinked", sk);
316 			release_sock(sk);
317 			sock_put(sk);
318 
319 			goto restart;
320 		}
321 
322 		next = bt_accept_get(parent, sk);
323 
324 		/* FIXME: Is this check still needed */
325 		if (sk->sk_state == BT_CLOSED) {
326 			bt_accept_unlink(sk);
327 			release_sock(sk);
328 			sock_put(sk);
329 			continue;
330 		}
331 
332 		if (sk->sk_state == BT_CONNECTED || !newsock ||
333 		    test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) {
334 			bt_accept_unlink(sk);
335 			if (newsock)
336 				sock_graft(sk, newsock);
337 
338 			release_sock(sk);
339 			if (next)
340 				sock_put(next);
341 			return sk;
342 		}
343 
344 		release_sock(sk);
345 		sock_put(sk);
346 	}
347 
348 	return NULL;
349 }
350 EXPORT_SYMBOL(bt_accept_dequeue);
351 
352 int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
353 		    int flags)
354 {
355 	struct sock *sk = sock->sk;
356 	struct sk_buff *skb;
357 	size_t copied;
358 	size_t skblen;
359 	int err;
360 
361 	BT_DBG("sock %p sk %p len %zu", sock, sk, len);
362 
363 	if (flags & MSG_OOB)
364 		return -EOPNOTSUPP;
365 
366 	skb = skb_recv_datagram(sk, flags, &err);
367 	if (!skb) {
368 		if (sk->sk_shutdown & RCV_SHUTDOWN)
369 			err = 0;
370 
371 		return err;
372 	}
373 
374 	skblen = skb->len;
375 	copied = skb->len;
376 	if (len < copied) {
377 		msg->msg_flags |= MSG_TRUNC;
378 		copied = len;
379 	}
380 
381 	skb_reset_transport_header(skb);
382 	err = skb_copy_datagram_msg(skb, 0, msg, copied);
383 	if (err == 0) {
384 		sock_recv_cmsgs(msg, sk, skb);
385 
386 		if (msg->msg_name && bt_sk(sk)->skb_msg_name)
387 			bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
388 						&msg->msg_namelen);
389 
390 		if (test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags)) {
391 			u8 pkt_status = hci_skb_pkt_status(skb);
392 
393 			put_cmsg(msg, SOL_BLUETOOTH, BT_SCM_PKT_STATUS,
394 				 sizeof(pkt_status), &pkt_status);
395 		}
396 
397 		if (test_bit(BT_SK_PKT_SEQNUM, &bt_sk(sk)->flags)) {
398 			u16 pkt_seqnum = hci_skb_pkt_seqnum(skb);
399 
400 			put_cmsg(msg, SOL_BLUETOOTH, BT_SCM_PKT_SEQNUM,
401 				 sizeof(pkt_seqnum), &pkt_seqnum);
402 		}
403 	}
404 
405 	skb_free_datagram(sk, skb);
406 
407 	if (flags & MSG_TRUNC)
408 		copied = skblen;
409 
410 	return err ? : copied;
411 }
412 EXPORT_SYMBOL(bt_sock_recvmsg);
413 
414 static long bt_sock_data_wait(struct sock *sk, long timeo)
415 {
416 	DECLARE_WAITQUEUE(wait, current);
417 
418 	add_wait_queue(sk_sleep(sk), &wait);
419 	for (;;) {
420 		set_current_state(TASK_INTERRUPTIBLE);
421 
422 		if (!skb_queue_empty(&sk->sk_receive_queue))
423 			break;
424 
425 		if (sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN))
426 			break;
427 
428 		if (signal_pending(current) || !timeo)
429 			break;
430 
431 		sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
432 		release_sock(sk);
433 		timeo = schedule_timeout(timeo);
434 		lock_sock(sk);
435 		sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
436 	}
437 
438 	__set_current_state(TASK_RUNNING);
439 	remove_wait_queue(sk_sleep(sk), &wait);
440 	return timeo;
441 }
442 
443 int bt_sock_stream_recvmsg(struct socket *sock, struct msghdr *msg,
444 			   size_t size, int flags)
445 {
446 	struct sock *sk = sock->sk;
447 	int err = 0;
448 	size_t target, copied = 0;
449 	long timeo;
450 
451 	if (flags & MSG_OOB)
452 		return -EOPNOTSUPP;
453 
454 	BT_DBG("sk %p size %zu", sk, size);
455 
456 	lock_sock(sk);
457 
458 	target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
459 	timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
460 
461 	do {
462 		struct sk_buff *skb;
463 		int chunk;
464 
465 		skb = skb_dequeue(&sk->sk_receive_queue);
466 		if (!skb) {
467 			if (copied >= target)
468 				break;
469 
470 			err = sock_error(sk);
471 			if (err)
472 				break;
473 			if (sk->sk_shutdown & RCV_SHUTDOWN)
474 				break;
475 
476 			err = -EAGAIN;
477 			if (!timeo)
478 				break;
479 
480 			timeo = bt_sock_data_wait(sk, timeo);
481 
482 			if (signal_pending(current)) {
483 				err = sock_intr_errno(timeo);
484 				goto out;
485 			}
486 			continue;
487 		}
488 
489 		chunk = min_t(unsigned int, skb->len, size);
490 		if (skb_copy_datagram_msg(skb, 0, msg, chunk)) {
491 			skb_queue_head(&sk->sk_receive_queue, skb);
492 			if (!copied)
493 				copied = -EFAULT;
494 			break;
495 		}
496 		copied += chunk;
497 		size   -= chunk;
498 
499 		sock_recv_cmsgs(msg, sk, skb);
500 
501 		if (!(flags & MSG_PEEK)) {
502 			int skb_len = skb_headlen(skb);
503 
504 			if (chunk <= skb_len) {
505 				__skb_pull(skb, chunk);
506 			} else {
507 				struct sk_buff *frag;
508 
509 				__skb_pull(skb, skb_len);
510 				chunk -= skb_len;
511 
512 				skb_walk_frags(skb, frag) {
513 					if (chunk <= frag->len) {
514 						/* Pulling partial data */
515 						skb->len -= chunk;
516 						skb->data_len -= chunk;
517 						__skb_pull(frag, chunk);
518 						break;
519 					} else if (frag->len) {
520 						/* Pulling all frag data */
521 						chunk -= frag->len;
522 						skb->len -= frag->len;
523 						skb->data_len -= frag->len;
524 						__skb_pull(frag, frag->len);
525 					}
526 				}
527 			}
528 
529 			if (skb->len) {
530 				skb_queue_head(&sk->sk_receive_queue, skb);
531 				break;
532 			}
533 			kfree_skb(skb);
534 
535 		} else {
536 			/* put message back and return */
537 			skb_queue_head(&sk->sk_receive_queue, skb);
538 			break;
539 		}
540 	} while (size);
541 
542 out:
543 	release_sock(sk);
544 	return copied ? : err;
545 }
546 EXPORT_SYMBOL(bt_sock_stream_recvmsg);
547 
548 static inline __poll_t bt_accept_poll(struct sock *parent)
549 {
550 	struct bt_sock *bt = bt_sk(parent);
551 	struct bt_sock *s;
552 	struct sock *sk;
553 	__poll_t mask = 0;
554 
555 	spin_lock_bh(&bt->accept_q_lock);
556 	list_for_each_entry(s, &bt->accept_q, accept_q) {
557 		int state;
558 
559 		sk = (struct sock *)s;
560 		state = READ_ONCE(sk->sk_state);
561 
562 		if (state == BT_CONNECTED ||
563 		    (test_bit(BT_SK_DEFER_SETUP, &bt->flags) &&
564 		     state == BT_CONNECT2)) {
565 			mask = EPOLLIN | EPOLLRDNORM;
566 			break;
567 		}
568 	}
569 	spin_unlock_bh(&bt->accept_q_lock);
570 
571 	return mask;
572 }
573 
574 __poll_t bt_sock_poll(struct file *file, struct socket *sock,
575 		      poll_table *wait)
576 {
577 	struct sock *sk = sock->sk;
578 	__poll_t mask = 0;
579 
580 	poll_wait(file, sk_sleep(sk), wait);
581 
582 	if (sk->sk_state == BT_LISTEN)
583 		return bt_accept_poll(sk);
584 
585 	if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
586 		mask |= EPOLLERR |
587 			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
588 
589 	if (sk->sk_shutdown & RCV_SHUTDOWN)
590 		mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
591 
592 	if (sk->sk_shutdown == SHUTDOWN_MASK)
593 		mask |= EPOLLHUP;
594 
595 	if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
596 		mask |= EPOLLIN | EPOLLRDNORM;
597 
598 	if (sk->sk_state == BT_CLOSED)
599 		mask |= EPOLLHUP;
600 
601 	if (sk->sk_state == BT_CONNECT ||
602 	    sk->sk_state == BT_CONNECT2 ||
603 	    sk->sk_state == BT_CONFIG)
604 		return mask;
605 
606 	if (!test_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags) && sock_writeable(sk))
607 		mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
608 	else
609 		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
610 
611 	return mask;
612 }
613 EXPORT_SYMBOL(bt_sock_poll);
614 
615 static int bt_ethtool_get_ts_info(struct sock *sk, unsigned int index,
616 				  void __user *useraddr)
617 {
618 	struct ethtool_ts_info info;
619 	struct kernel_ethtool_ts_info ts_info = {};
620 	int ret;
621 
622 	ret = hci_ethtool_ts_info(index, sk->sk_protocol, &ts_info);
623 	if (ret == -ENODEV)
624 		return ret;
625 	else if (ret < 0)
626 		return -EIO;
627 
628 	memset(&info, 0, sizeof(info));
629 
630 	info.cmd = ETHTOOL_GET_TS_INFO;
631 	info.so_timestamping = ts_info.so_timestamping;
632 	info.phc_index = ts_info.phc_index;
633 	info.tx_types = ts_info.tx_types;
634 	info.rx_filters = ts_info.rx_filters;
635 
636 	if (copy_to_user(useraddr, &info, sizeof(info)))
637 		return -EFAULT;
638 
639 	return 0;
640 }
641 
642 static int bt_ethtool(struct sock *sk, const struct ifreq *ifr,
643 		      void __user *useraddr)
644 {
645 	unsigned int index;
646 	u32 ethcmd;
647 	int n;
648 
649 	if (copy_from_user(&ethcmd, useraddr, sizeof(ethcmd)))
650 		return -EFAULT;
651 
652 	if (sscanf(ifr->ifr_name, "hci%u%n", &index, &n) != 1 ||
653 	    n != strlen(ifr->ifr_name))
654 		return -ENODEV;
655 
656 	switch (ethcmd) {
657 	case ETHTOOL_GET_TS_INFO:
658 		return bt_ethtool_get_ts_info(sk, index, useraddr);
659 	}
660 
661 	return -EOPNOTSUPP;
662 }
663 
664 static int bt_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
665 {
666 	struct sock *sk = sock->sk;
667 	struct ifreq ifr = {};
668 	void __user *data;
669 	char *colon;
670 	int ret = -ENOIOCTLCMD;
671 
672 	if (get_user_ifreq(&ifr, &data, arg))
673 		return -EFAULT;
674 
675 	ifr.ifr_name[IFNAMSIZ - 1] = 0;
676 	colon = strchr(ifr.ifr_name, ':');
677 	if (colon)
678 		*colon = 0;
679 
680 	switch (cmd) {
681 	case SIOCETHTOOL:
682 		ret = bt_ethtool(sk, &ifr, data);
683 		break;
684 	}
685 
686 	if (colon)
687 		*colon = ':';
688 
689 	if (put_user_ifreq(&ifr, arg))
690 		return -EFAULT;
691 
692 	return ret;
693 }
694 
695 int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
696 {
697 	struct sock *sk = sock->sk;
698 	struct sk_buff *skb;
699 	long amount;
700 	int err;
701 
702 	BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
703 
704 	switch (cmd) {
705 	case TIOCOUTQ:
706 		if (sk->sk_state == BT_LISTEN)
707 			return -EINVAL;
708 
709 		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
710 		if (amount < 0)
711 			amount = 0;
712 		err = put_user(amount, (int __user *)arg);
713 		break;
714 
715 	case TIOCINQ:
716 		if (sk->sk_state == BT_LISTEN)
717 			return -EINVAL;
718 
719 		spin_lock(&sk->sk_receive_queue.lock);
720 		skb = skb_peek(&sk->sk_receive_queue);
721 		amount = skb ? skb->len : 0;
722 		spin_unlock(&sk->sk_receive_queue.lock);
723 
724 		err = put_user(amount, (int __user *)arg);
725 		break;
726 
727 	case SIOCETHTOOL:
728 		err = bt_dev_ioctl(sock, cmd, (void __user *)arg);
729 		break;
730 
731 	default:
732 		err = -ENOIOCTLCMD;
733 		break;
734 	}
735 
736 	return err;
737 }
738 EXPORT_SYMBOL(bt_sock_ioctl);
739 
740 /* This function expects the sk lock to be held when called */
741 int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
742 {
743 	DECLARE_WAITQUEUE(wait, current);
744 	int err = 0;
745 
746 	BT_DBG("sk %p", sk);
747 
748 	add_wait_queue(sk_sleep(sk), &wait);
749 	set_current_state(TASK_INTERRUPTIBLE);
750 	while (sk->sk_state != state) {
751 		if (!timeo) {
752 			err = -EINPROGRESS;
753 			break;
754 		}
755 
756 		if (signal_pending(current)) {
757 			err = sock_intr_errno(timeo);
758 			break;
759 		}
760 
761 		release_sock(sk);
762 		timeo = schedule_timeout(timeo);
763 		lock_sock(sk);
764 		set_current_state(TASK_INTERRUPTIBLE);
765 
766 		err = sock_error(sk);
767 		if (err)
768 			break;
769 	}
770 	__set_current_state(TASK_RUNNING);
771 	remove_wait_queue(sk_sleep(sk), &wait);
772 	return err;
773 }
774 EXPORT_SYMBOL(bt_sock_wait_state);
775 
776 /* This function expects the sk lock to be held when called */
777 int bt_sock_wait_ready(struct sock *sk, unsigned int msg_flags)
778 {
779 	DECLARE_WAITQUEUE(wait, current);
780 	unsigned long timeo;
781 	int err = 0;
782 
783 	BT_DBG("sk %p", sk);
784 
785 	timeo = sock_sndtimeo(sk, !!(msg_flags & MSG_DONTWAIT));
786 
787 	add_wait_queue(sk_sleep(sk), &wait);
788 	set_current_state(TASK_INTERRUPTIBLE);
789 	while (test_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags)) {
790 		if (!timeo) {
791 			err = -EAGAIN;
792 			break;
793 		}
794 
795 		if (signal_pending(current)) {
796 			err = sock_intr_errno(timeo);
797 			break;
798 		}
799 
800 		release_sock(sk);
801 		timeo = schedule_timeout(timeo);
802 		lock_sock(sk);
803 		set_current_state(TASK_INTERRUPTIBLE);
804 
805 		err = sock_error(sk);
806 		if (err)
807 			break;
808 	}
809 	__set_current_state(TASK_RUNNING);
810 	remove_wait_queue(sk_sleep(sk), &wait);
811 
812 	return err;
813 }
814 EXPORT_SYMBOL(bt_sock_wait_ready);
815 
816 #ifdef CONFIG_PROC_FS
817 static void *bt_seq_start(struct seq_file *seq, loff_t *pos)
818 	__acquires(seq->private->l->lock)
819 {
820 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
821 
822 	read_lock(&l->lock);
823 	return seq_hlist_start_head(&l->head, *pos);
824 }
825 
826 static void *bt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
827 {
828 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
829 
830 	return seq_hlist_next(v, &l->head, pos);
831 }
832 
833 static void bt_seq_stop(struct seq_file *seq, void *v)
834 	__releases(seq->private->l->lock)
835 {
836 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
837 
838 	read_unlock(&l->lock);
839 }
840 
841 static int bt_seq_show(struct seq_file *seq, void *v)
842 {
843 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
844 
845 	if (v == SEQ_START_TOKEN) {
846 		seq_puts(seq, "sk               RefCnt Rmem   Wmem   User   Inode  Parent");
847 
848 		if (l->custom_seq_show) {
849 			seq_putc(seq, ' ');
850 			l->custom_seq_show(seq, v);
851 		}
852 
853 		seq_putc(seq, '\n');
854 	} else {
855 		struct sock *sk = sk_entry(v);
856 		struct bt_sock *bt = bt_sk(sk);
857 
858 		seq_printf(seq,
859 			   "%pK %-6d %-6u %-6u %-6u %-6llu %-6llu",
860 			   sk,
861 			   refcount_read(&sk->sk_refcnt),
862 			   sk_rmem_alloc_get(sk),
863 			   sk_wmem_alloc_get(sk),
864 			   from_kuid(seq_user_ns(seq), sk_uid(sk)),
865 			   sock_i_ino(sk),
866 			   bt->parent ? sock_i_ino(bt->parent) : 0ULL);
867 
868 		if (l->custom_seq_show) {
869 			seq_putc(seq, ' ');
870 			l->custom_seq_show(seq, v);
871 		}
872 
873 		seq_putc(seq, '\n');
874 	}
875 	return 0;
876 }
877 
878 static const struct seq_operations bt_seq_ops = {
879 	.start = bt_seq_start,
880 	.next  = bt_seq_next,
881 	.stop  = bt_seq_stop,
882 	.show  = bt_seq_show,
883 };
884 
885 int bt_procfs_init(struct net *net, const char *name,
886 		   struct bt_sock_list *sk_list,
887 		   int (*seq_show)(struct seq_file *, void *))
888 {
889 	sk_list->custom_seq_show = seq_show;
890 
891 	if (!proc_create_seq_data(name, 0, net->proc_net, &bt_seq_ops, sk_list))
892 		return -ENOMEM;
893 	return 0;
894 }
895 
896 void bt_procfs_cleanup(struct net *net, const char *name)
897 {
898 	remove_proc_entry(name, net->proc_net);
899 }
900 #else
901 int bt_procfs_init(struct net *net, const char *name,
902 		   struct bt_sock_list *sk_list,
903 		   int (*seq_show)(struct seq_file *, void *))
904 {
905 	return 0;
906 }
907 
908 void bt_procfs_cleanup(struct net *net, const char *name)
909 {
910 }
911 #endif
912 EXPORT_SYMBOL(bt_procfs_init);
913 EXPORT_SYMBOL(bt_procfs_cleanup);
914 
915 static const struct net_proto_family bt_sock_family_ops = {
916 	.owner	= THIS_MODULE,
917 	.family	= PF_BLUETOOTH,
918 	.create	= bt_sock_create,
919 };
920 
921 struct dentry *bt_debugfs;
922 EXPORT_SYMBOL_GPL(bt_debugfs);
923 
924 #define VERSION __stringify(BT_SUBSYS_VERSION) "." \
925 		__stringify(BT_SUBSYS_REVISION)
926 
927 static int __init bt_init(void)
928 {
929 	int err;
930 
931 	sock_skb_cb_check_size(sizeof(struct bt_skb_cb));
932 
933 	BT_INFO("Core ver %s", VERSION);
934 
935 	err = bt_selftest();
936 	if (err < 0)
937 		return err;
938 
939 	bt_debugfs = debugfs_create_dir("bluetooth", NULL);
940 
941 	bt_leds_init();
942 
943 	err = bt_sysfs_init();
944 	if (err < 0)
945 		goto cleanup_led;
946 
947 	err = sock_register(&bt_sock_family_ops);
948 	if (err)
949 		goto cleanup_sysfs;
950 
951 	BT_INFO("HCI device and connection manager initialized");
952 
953 	err = hci_sock_init();
954 	if (err)
955 		goto unregister_socket;
956 
957 	err = l2cap_init();
958 	if (err)
959 		goto cleanup_socket;
960 
961 	err = sco_init();
962 	if (err)
963 		goto cleanup_cap;
964 
965 	err = mgmt_init();
966 	if (err)
967 		goto cleanup_sco;
968 
969 	return 0;
970 
971 cleanup_sco:
972 	sco_exit();
973 cleanup_cap:
974 	l2cap_exit();
975 cleanup_socket:
976 	hci_sock_cleanup();
977 unregister_socket:
978 	sock_unregister(PF_BLUETOOTH);
979 cleanup_sysfs:
980 	bt_sysfs_cleanup();
981 cleanup_led:
982 	bt_leds_cleanup();
983 	debugfs_remove_recursive(bt_debugfs);
984 	return err;
985 }
986 
987 static void __exit bt_exit(void)
988 {
989 	iso_exit();
990 
991 	mgmt_exit();
992 
993 	sco_exit();
994 
995 	l2cap_exit();
996 
997 	hci_sock_cleanup();
998 
999 	sock_unregister(PF_BLUETOOTH);
1000 
1001 	bt_sysfs_cleanup();
1002 
1003 	bt_leds_cleanup();
1004 
1005 	debugfs_remove_recursive(bt_debugfs);
1006 }
1007 
1008 subsys_initcall(bt_init);
1009 module_exit(bt_exit);
1010 
1011 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1012 MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
1013 MODULE_VERSION(VERSION);
1014 MODULE_LICENSE("GPL");
1015 MODULE_ALIAS_NETPROTO(PF_BLUETOOTH);
1016