1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI sockets. */ 26 #include <linux/compat.h> 27 #include <linux/export.h> 28 #include <linux/utsname.h> 29 #include <linux/sched.h> 30 #include <asm/unaligned.h> 31 32 #include <net/bluetooth/bluetooth.h> 33 #include <net/bluetooth/hci_core.h> 34 #include <net/bluetooth/hci_mon.h> 35 #include <net/bluetooth/mgmt.h> 36 37 #include "mgmt_util.h" 38 39 static LIST_HEAD(mgmt_chan_list); 40 static DEFINE_MUTEX(mgmt_chan_list_lock); 41 42 static DEFINE_IDA(sock_cookie_ida); 43 44 static atomic_t monitor_promisc = ATOMIC_INIT(0); 45 46 /* ----- HCI socket interface ----- */ 47 48 /* Socket info */ 49 #define hci_pi(sk) ((struct hci_pinfo *) sk) 50 51 struct hci_pinfo { 52 struct bt_sock bt; 53 struct hci_dev *hdev; 54 struct hci_filter filter; 55 __u8 cmsg_mask; 56 unsigned short channel; 57 unsigned long flags; 58 __u32 cookie; 59 char comm[TASK_COMM_LEN]; 60 }; 61 62 void hci_sock_set_flag(struct sock *sk, int nr) 63 { 64 set_bit(nr, &hci_pi(sk)->flags); 65 } 66 67 void hci_sock_clear_flag(struct sock *sk, int nr) 68 { 69 clear_bit(nr, &hci_pi(sk)->flags); 70 } 71 72 int hci_sock_test_flag(struct sock *sk, int nr) 73 { 74 return test_bit(nr, &hci_pi(sk)->flags); 75 } 76 77 unsigned short hci_sock_get_channel(struct sock *sk) 78 { 79 return hci_pi(sk)->channel; 80 } 81 82 u32 hci_sock_get_cookie(struct sock *sk) 83 { 84 return hci_pi(sk)->cookie; 85 } 86 87 static bool hci_sock_gen_cookie(struct sock *sk) 88 { 89 int id = hci_pi(sk)->cookie; 90 91 if (!id) { 92 id = ida_simple_get(&sock_cookie_ida, 1, 0, GFP_KERNEL); 93 if (id < 0) 94 id = 0xffffffff; 95 96 hci_pi(sk)->cookie = id; 97 get_task_comm(hci_pi(sk)->comm, current); 98 return true; 99 } 100 101 return false; 102 } 103 104 static void hci_sock_free_cookie(struct sock *sk) 105 { 106 int id = hci_pi(sk)->cookie; 107 108 if (id) { 109 hci_pi(sk)->cookie = 0xffffffff; 110 ida_simple_remove(&sock_cookie_ida, id); 111 } 112 } 113 114 static inline int hci_test_bit(int nr, const void *addr) 115 { 116 return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31)); 117 } 118 119 /* Security filter */ 120 #define HCI_SFLT_MAX_OGF 5 121 122 struct hci_sec_filter { 123 __u32 type_mask; 124 __u32 event_mask[2]; 125 __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4]; 126 }; 127 128 static const struct hci_sec_filter hci_sec_filter = { 129 /* Packet types */ 130 0x10, 131 /* Events */ 132 { 0x1000d9fe, 0x0000b00c }, 133 /* Commands */ 134 { 135 { 0x0 }, 136 /* OGF_LINK_CTL */ 137 { 0xbe000006, 0x00000001, 0x00000000, 0x00 }, 138 /* OGF_LINK_POLICY */ 139 { 0x00005200, 0x00000000, 0x00000000, 0x00 }, 140 /* OGF_HOST_CTL */ 141 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 }, 142 /* OGF_INFO_PARAM */ 143 { 0x000002be, 0x00000000, 0x00000000, 0x00 }, 144 /* OGF_STATUS_PARAM */ 145 { 0x000000ea, 0x00000000, 0x00000000, 0x00 } 146 } 147 }; 148 149 static struct bt_sock_list hci_sk_list = { 150 .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock) 151 }; 152 153 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb) 154 { 155 struct hci_filter *flt; 156 int flt_type, flt_event; 157 158 /* Apply filter */ 159 flt = &hci_pi(sk)->filter; 160 161 flt_type = hci_skb_pkt_type(skb) & HCI_FLT_TYPE_BITS; 162 163 if (!test_bit(flt_type, &flt->type_mask)) 164 return true; 165 166 /* Extra filter for event packets only */ 167 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT) 168 return false; 169 170 flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS); 171 172 if (!hci_test_bit(flt_event, &flt->event_mask)) 173 return true; 174 175 /* Check filter only when opcode is set */ 176 if (!flt->opcode) 177 return false; 178 179 if (flt_event == HCI_EV_CMD_COMPLETE && 180 flt->opcode != get_unaligned((__le16 *)(skb->data + 3))) 181 return true; 182 183 if (flt_event == HCI_EV_CMD_STATUS && 184 flt->opcode != get_unaligned((__le16 *)(skb->data + 4))) 185 return true; 186 187 return false; 188 } 189 190 /* Send frame to RAW socket */ 191 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb) 192 { 193 struct sock *sk; 194 struct sk_buff *skb_copy = NULL; 195 196 BT_DBG("hdev %p len %d", hdev, skb->len); 197 198 read_lock(&hci_sk_list.lock); 199 200 sk_for_each(sk, &hci_sk_list.head) { 201 struct sk_buff *nskb; 202 203 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev) 204 continue; 205 206 /* Don't send frame to the socket it came from */ 207 if (skb->sk == sk) 208 continue; 209 210 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) { 211 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 212 hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 213 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 214 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 215 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) 216 continue; 217 if (is_filtered_packet(sk, skb)) 218 continue; 219 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 220 if (!bt_cb(skb)->incoming) 221 continue; 222 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT && 223 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 224 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 225 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) 226 continue; 227 } else { 228 /* Don't send frame to other channel types */ 229 continue; 230 } 231 232 if (!skb_copy) { 233 /* Create a private copy with headroom */ 234 skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true); 235 if (!skb_copy) 236 continue; 237 238 /* Put type byte before the data */ 239 memcpy(skb_push(skb_copy, 1), &hci_skb_pkt_type(skb), 1); 240 } 241 242 nskb = skb_clone(skb_copy, GFP_ATOMIC); 243 if (!nskb) 244 continue; 245 246 if (sock_queue_rcv_skb(sk, nskb)) 247 kfree_skb(nskb); 248 } 249 250 read_unlock(&hci_sk_list.lock); 251 252 kfree_skb(skb_copy); 253 } 254 255 /* Send frame to sockets with specific channel */ 256 static void __hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 257 int flag, struct sock *skip_sk) 258 { 259 struct sock *sk; 260 261 BT_DBG("channel %u len %d", channel, skb->len); 262 263 sk_for_each(sk, &hci_sk_list.head) { 264 struct sk_buff *nskb; 265 266 /* Ignore socket without the flag set */ 267 if (!hci_sock_test_flag(sk, flag)) 268 continue; 269 270 /* Skip the original socket */ 271 if (sk == skip_sk) 272 continue; 273 274 if (sk->sk_state != BT_BOUND) 275 continue; 276 277 if (hci_pi(sk)->channel != channel) 278 continue; 279 280 nskb = skb_clone(skb, GFP_ATOMIC); 281 if (!nskb) 282 continue; 283 284 if (sock_queue_rcv_skb(sk, nskb)) 285 kfree_skb(nskb); 286 } 287 288 } 289 290 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb, 291 int flag, struct sock *skip_sk) 292 { 293 read_lock(&hci_sk_list.lock); 294 __hci_send_to_channel(channel, skb, flag, skip_sk); 295 read_unlock(&hci_sk_list.lock); 296 } 297 298 /* Send frame to monitor socket */ 299 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb) 300 { 301 struct sk_buff *skb_copy = NULL; 302 struct hci_mon_hdr *hdr; 303 __le16 opcode; 304 305 if (!atomic_read(&monitor_promisc)) 306 return; 307 308 BT_DBG("hdev %p len %d", hdev, skb->len); 309 310 switch (hci_skb_pkt_type(skb)) { 311 case HCI_COMMAND_PKT: 312 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT); 313 break; 314 case HCI_EVENT_PKT: 315 opcode = cpu_to_le16(HCI_MON_EVENT_PKT); 316 break; 317 case HCI_ACLDATA_PKT: 318 if (bt_cb(skb)->incoming) 319 opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT); 320 else 321 opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT); 322 break; 323 case HCI_SCODATA_PKT: 324 if (bt_cb(skb)->incoming) 325 opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT); 326 else 327 opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT); 328 break; 329 case HCI_ISODATA_PKT: 330 if (bt_cb(skb)->incoming) 331 opcode = cpu_to_le16(HCI_MON_ISO_RX_PKT); 332 else 333 opcode = cpu_to_le16(HCI_MON_ISO_TX_PKT); 334 break; 335 case HCI_DIAG_PKT: 336 opcode = cpu_to_le16(HCI_MON_VENDOR_DIAG); 337 break; 338 default: 339 return; 340 } 341 342 /* Create a private copy with headroom */ 343 skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true); 344 if (!skb_copy) 345 return; 346 347 /* Put header before the data */ 348 hdr = skb_push(skb_copy, HCI_MON_HDR_SIZE); 349 hdr->opcode = opcode; 350 hdr->index = cpu_to_le16(hdev->id); 351 hdr->len = cpu_to_le16(skb->len); 352 353 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy, 354 HCI_SOCK_TRUSTED, NULL); 355 kfree_skb(skb_copy); 356 } 357 358 void hci_send_monitor_ctrl_event(struct hci_dev *hdev, u16 event, 359 void *data, u16 data_len, ktime_t tstamp, 360 int flag, struct sock *skip_sk) 361 { 362 struct sock *sk; 363 __le16 index; 364 365 if (hdev) 366 index = cpu_to_le16(hdev->id); 367 else 368 index = cpu_to_le16(MGMT_INDEX_NONE); 369 370 read_lock(&hci_sk_list.lock); 371 372 sk_for_each(sk, &hci_sk_list.head) { 373 struct hci_mon_hdr *hdr; 374 struct sk_buff *skb; 375 376 if (hci_pi(sk)->channel != HCI_CHANNEL_CONTROL) 377 continue; 378 379 /* Ignore socket without the flag set */ 380 if (!hci_sock_test_flag(sk, flag)) 381 continue; 382 383 /* Skip the original socket */ 384 if (sk == skip_sk) 385 continue; 386 387 skb = bt_skb_alloc(6 + data_len, GFP_ATOMIC); 388 if (!skb) 389 continue; 390 391 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 392 put_unaligned_le16(event, skb_put(skb, 2)); 393 394 if (data) 395 skb_put_data(skb, data, data_len); 396 397 skb->tstamp = tstamp; 398 399 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 400 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_EVENT); 401 hdr->index = index; 402 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 403 404 __hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 405 HCI_SOCK_TRUSTED, NULL); 406 kfree_skb(skb); 407 } 408 409 read_unlock(&hci_sk_list.lock); 410 } 411 412 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event) 413 { 414 struct hci_mon_hdr *hdr; 415 struct hci_mon_new_index *ni; 416 struct hci_mon_index_info *ii; 417 struct sk_buff *skb; 418 __le16 opcode; 419 420 switch (event) { 421 case HCI_DEV_REG: 422 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC); 423 if (!skb) 424 return NULL; 425 426 ni = skb_put(skb, HCI_MON_NEW_INDEX_SIZE); 427 ni->type = hdev->dev_type; 428 ni->bus = hdev->bus; 429 bacpy(&ni->bdaddr, &hdev->bdaddr); 430 memcpy(ni->name, hdev->name, 8); 431 432 opcode = cpu_to_le16(HCI_MON_NEW_INDEX); 433 break; 434 435 case HCI_DEV_UNREG: 436 skb = bt_skb_alloc(0, GFP_ATOMIC); 437 if (!skb) 438 return NULL; 439 440 opcode = cpu_to_le16(HCI_MON_DEL_INDEX); 441 break; 442 443 case HCI_DEV_SETUP: 444 if (hdev->manufacturer == 0xffff) 445 return NULL; 446 fallthrough; 447 448 case HCI_DEV_UP: 449 skb = bt_skb_alloc(HCI_MON_INDEX_INFO_SIZE, GFP_ATOMIC); 450 if (!skb) 451 return NULL; 452 453 ii = skb_put(skb, HCI_MON_INDEX_INFO_SIZE); 454 bacpy(&ii->bdaddr, &hdev->bdaddr); 455 ii->manufacturer = cpu_to_le16(hdev->manufacturer); 456 457 opcode = cpu_to_le16(HCI_MON_INDEX_INFO); 458 break; 459 460 case HCI_DEV_OPEN: 461 skb = bt_skb_alloc(0, GFP_ATOMIC); 462 if (!skb) 463 return NULL; 464 465 opcode = cpu_to_le16(HCI_MON_OPEN_INDEX); 466 break; 467 468 case HCI_DEV_CLOSE: 469 skb = bt_skb_alloc(0, GFP_ATOMIC); 470 if (!skb) 471 return NULL; 472 473 opcode = cpu_to_le16(HCI_MON_CLOSE_INDEX); 474 break; 475 476 default: 477 return NULL; 478 } 479 480 __net_timestamp(skb); 481 482 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 483 hdr->opcode = opcode; 484 hdr->index = cpu_to_le16(hdev->id); 485 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 486 487 return skb; 488 } 489 490 static struct sk_buff *create_monitor_ctrl_open(struct sock *sk) 491 { 492 struct hci_mon_hdr *hdr; 493 struct sk_buff *skb; 494 u16 format; 495 u8 ver[3]; 496 u32 flags; 497 498 /* No message needed when cookie is not present */ 499 if (!hci_pi(sk)->cookie) 500 return NULL; 501 502 switch (hci_pi(sk)->channel) { 503 case HCI_CHANNEL_RAW: 504 format = 0x0000; 505 ver[0] = BT_SUBSYS_VERSION; 506 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 507 break; 508 case HCI_CHANNEL_USER: 509 format = 0x0001; 510 ver[0] = BT_SUBSYS_VERSION; 511 put_unaligned_le16(BT_SUBSYS_REVISION, ver + 1); 512 break; 513 case HCI_CHANNEL_CONTROL: 514 format = 0x0002; 515 mgmt_fill_version_info(ver); 516 break; 517 default: 518 /* No message for unsupported format */ 519 return NULL; 520 } 521 522 skb = bt_skb_alloc(14 + TASK_COMM_LEN , GFP_ATOMIC); 523 if (!skb) 524 return NULL; 525 526 flags = hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) ? 0x1 : 0x0; 527 528 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 529 put_unaligned_le16(format, skb_put(skb, 2)); 530 skb_put_data(skb, ver, sizeof(ver)); 531 put_unaligned_le32(flags, skb_put(skb, 4)); 532 skb_put_u8(skb, TASK_COMM_LEN); 533 skb_put_data(skb, hci_pi(sk)->comm, TASK_COMM_LEN); 534 535 __net_timestamp(skb); 536 537 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 538 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_OPEN); 539 if (hci_pi(sk)->hdev) 540 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 541 else 542 hdr->index = cpu_to_le16(HCI_DEV_NONE); 543 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 544 545 return skb; 546 } 547 548 static struct sk_buff *create_monitor_ctrl_close(struct sock *sk) 549 { 550 struct hci_mon_hdr *hdr; 551 struct sk_buff *skb; 552 553 /* No message needed when cookie is not present */ 554 if (!hci_pi(sk)->cookie) 555 return NULL; 556 557 switch (hci_pi(sk)->channel) { 558 case HCI_CHANNEL_RAW: 559 case HCI_CHANNEL_USER: 560 case HCI_CHANNEL_CONTROL: 561 break; 562 default: 563 /* No message for unsupported format */ 564 return NULL; 565 } 566 567 skb = bt_skb_alloc(4, GFP_ATOMIC); 568 if (!skb) 569 return NULL; 570 571 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 572 573 __net_timestamp(skb); 574 575 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 576 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_CLOSE); 577 if (hci_pi(sk)->hdev) 578 hdr->index = cpu_to_le16(hci_pi(sk)->hdev->id); 579 else 580 hdr->index = cpu_to_le16(HCI_DEV_NONE); 581 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 582 583 return skb; 584 } 585 586 static struct sk_buff *create_monitor_ctrl_command(struct sock *sk, u16 index, 587 u16 opcode, u16 len, 588 const void *buf) 589 { 590 struct hci_mon_hdr *hdr; 591 struct sk_buff *skb; 592 593 skb = bt_skb_alloc(6 + len, GFP_ATOMIC); 594 if (!skb) 595 return NULL; 596 597 put_unaligned_le32(hci_pi(sk)->cookie, skb_put(skb, 4)); 598 put_unaligned_le16(opcode, skb_put(skb, 2)); 599 600 if (buf) 601 skb_put_data(skb, buf, len); 602 603 __net_timestamp(skb); 604 605 hdr = skb_push(skb, HCI_MON_HDR_SIZE); 606 hdr->opcode = cpu_to_le16(HCI_MON_CTRL_COMMAND); 607 hdr->index = cpu_to_le16(index); 608 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 609 610 return skb; 611 } 612 613 static void __printf(2, 3) 614 send_monitor_note(struct sock *sk, const char *fmt, ...) 615 { 616 size_t len; 617 struct hci_mon_hdr *hdr; 618 struct sk_buff *skb; 619 va_list args; 620 621 va_start(args, fmt); 622 len = vsnprintf(NULL, 0, fmt, args); 623 va_end(args); 624 625 skb = bt_skb_alloc(len + 1, GFP_ATOMIC); 626 if (!skb) 627 return; 628 629 va_start(args, fmt); 630 vsprintf(skb_put(skb, len), fmt, args); 631 *(u8 *)skb_put(skb, 1) = 0; 632 va_end(args); 633 634 __net_timestamp(skb); 635 636 hdr = (void *)skb_push(skb, HCI_MON_HDR_SIZE); 637 hdr->opcode = cpu_to_le16(HCI_MON_SYSTEM_NOTE); 638 hdr->index = cpu_to_le16(HCI_DEV_NONE); 639 hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE); 640 641 if (sock_queue_rcv_skb(sk, skb)) 642 kfree_skb(skb); 643 } 644 645 static void send_monitor_replay(struct sock *sk) 646 { 647 struct hci_dev *hdev; 648 649 read_lock(&hci_dev_list_lock); 650 651 list_for_each_entry(hdev, &hci_dev_list, list) { 652 struct sk_buff *skb; 653 654 skb = create_monitor_event(hdev, HCI_DEV_REG); 655 if (!skb) 656 continue; 657 658 if (sock_queue_rcv_skb(sk, skb)) 659 kfree_skb(skb); 660 661 if (!test_bit(HCI_RUNNING, &hdev->flags)) 662 continue; 663 664 skb = create_monitor_event(hdev, HCI_DEV_OPEN); 665 if (!skb) 666 continue; 667 668 if (sock_queue_rcv_skb(sk, skb)) 669 kfree_skb(skb); 670 671 if (test_bit(HCI_UP, &hdev->flags)) 672 skb = create_monitor_event(hdev, HCI_DEV_UP); 673 else if (hci_dev_test_flag(hdev, HCI_SETUP)) 674 skb = create_monitor_event(hdev, HCI_DEV_SETUP); 675 else 676 skb = NULL; 677 678 if (skb) { 679 if (sock_queue_rcv_skb(sk, skb)) 680 kfree_skb(skb); 681 } 682 } 683 684 read_unlock(&hci_dev_list_lock); 685 } 686 687 static void send_monitor_control_replay(struct sock *mon_sk) 688 { 689 struct sock *sk; 690 691 read_lock(&hci_sk_list.lock); 692 693 sk_for_each(sk, &hci_sk_list.head) { 694 struct sk_buff *skb; 695 696 skb = create_monitor_ctrl_open(sk); 697 if (!skb) 698 continue; 699 700 if (sock_queue_rcv_skb(mon_sk, skb)) 701 kfree_skb(skb); 702 } 703 704 read_unlock(&hci_sk_list.lock); 705 } 706 707 /* Generate internal stack event */ 708 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data) 709 { 710 struct hci_event_hdr *hdr; 711 struct hci_ev_stack_internal *ev; 712 struct sk_buff *skb; 713 714 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC); 715 if (!skb) 716 return; 717 718 hdr = skb_put(skb, HCI_EVENT_HDR_SIZE); 719 hdr->evt = HCI_EV_STACK_INTERNAL; 720 hdr->plen = sizeof(*ev) + dlen; 721 722 ev = skb_put(skb, sizeof(*ev) + dlen); 723 ev->type = type; 724 memcpy(ev->data, data, dlen); 725 726 bt_cb(skb)->incoming = 1; 727 __net_timestamp(skb); 728 729 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 730 hci_send_to_sock(hdev, skb); 731 kfree_skb(skb); 732 } 733 734 void hci_sock_dev_event(struct hci_dev *hdev, int event) 735 { 736 BT_DBG("hdev %s event %d", hdev->name, event); 737 738 if (atomic_read(&monitor_promisc)) { 739 struct sk_buff *skb; 740 741 /* Send event to monitor */ 742 skb = create_monitor_event(hdev, event); 743 if (skb) { 744 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 745 HCI_SOCK_TRUSTED, NULL); 746 kfree_skb(skb); 747 } 748 } 749 750 if (event <= HCI_DEV_DOWN) { 751 struct hci_ev_si_device ev; 752 753 /* Send event to sockets */ 754 ev.event = event; 755 ev.dev_id = hdev->id; 756 hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev); 757 } 758 759 if (event == HCI_DEV_UNREG) { 760 struct sock *sk; 761 762 /* Detach sockets from device */ 763 read_lock(&hci_sk_list.lock); 764 sk_for_each(sk, &hci_sk_list.head) { 765 lock_sock(sk); 766 if (hci_pi(sk)->hdev == hdev) { 767 hci_pi(sk)->hdev = NULL; 768 sk->sk_err = EPIPE; 769 sk->sk_state = BT_OPEN; 770 sk->sk_state_change(sk); 771 772 hci_dev_put(hdev); 773 } 774 release_sock(sk); 775 } 776 read_unlock(&hci_sk_list.lock); 777 } 778 } 779 780 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel) 781 { 782 struct hci_mgmt_chan *c; 783 784 list_for_each_entry(c, &mgmt_chan_list, list) { 785 if (c->channel == channel) 786 return c; 787 } 788 789 return NULL; 790 } 791 792 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel) 793 { 794 struct hci_mgmt_chan *c; 795 796 mutex_lock(&mgmt_chan_list_lock); 797 c = __hci_mgmt_chan_find(channel); 798 mutex_unlock(&mgmt_chan_list_lock); 799 800 return c; 801 } 802 803 int hci_mgmt_chan_register(struct hci_mgmt_chan *c) 804 { 805 if (c->channel < HCI_CHANNEL_CONTROL) 806 return -EINVAL; 807 808 mutex_lock(&mgmt_chan_list_lock); 809 if (__hci_mgmt_chan_find(c->channel)) { 810 mutex_unlock(&mgmt_chan_list_lock); 811 return -EALREADY; 812 } 813 814 list_add_tail(&c->list, &mgmt_chan_list); 815 816 mutex_unlock(&mgmt_chan_list_lock); 817 818 return 0; 819 } 820 EXPORT_SYMBOL(hci_mgmt_chan_register); 821 822 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c) 823 { 824 mutex_lock(&mgmt_chan_list_lock); 825 list_del(&c->list); 826 mutex_unlock(&mgmt_chan_list_lock); 827 } 828 EXPORT_SYMBOL(hci_mgmt_chan_unregister); 829 830 static int hci_sock_release(struct socket *sock) 831 { 832 struct sock *sk = sock->sk; 833 struct hci_dev *hdev; 834 struct sk_buff *skb; 835 836 BT_DBG("sock %p sk %p", sock, sk); 837 838 if (!sk) 839 return 0; 840 841 lock_sock(sk); 842 843 switch (hci_pi(sk)->channel) { 844 case HCI_CHANNEL_MONITOR: 845 atomic_dec(&monitor_promisc); 846 break; 847 case HCI_CHANNEL_RAW: 848 case HCI_CHANNEL_USER: 849 case HCI_CHANNEL_CONTROL: 850 /* Send event to monitor */ 851 skb = create_monitor_ctrl_close(sk); 852 if (skb) { 853 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 854 HCI_SOCK_TRUSTED, NULL); 855 kfree_skb(skb); 856 } 857 858 hci_sock_free_cookie(sk); 859 break; 860 } 861 862 bt_sock_unlink(&hci_sk_list, sk); 863 864 hdev = hci_pi(sk)->hdev; 865 if (hdev) { 866 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 867 /* When releasing a user channel exclusive access, 868 * call hci_dev_do_close directly instead of calling 869 * hci_dev_close to ensure the exclusive access will 870 * be released and the controller brought back down. 871 * 872 * The checking of HCI_AUTO_OFF is not needed in this 873 * case since it will have been cleared already when 874 * opening the user channel. 875 */ 876 hci_dev_do_close(hdev); 877 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 878 mgmt_index_added(hdev); 879 } 880 881 atomic_dec(&hdev->promisc); 882 hci_dev_put(hdev); 883 } 884 885 sock_orphan(sk); 886 887 skb_queue_purge(&sk->sk_receive_queue); 888 skb_queue_purge(&sk->sk_write_queue); 889 890 release_sock(sk); 891 sock_put(sk); 892 return 0; 893 } 894 895 static int hci_sock_reject_list_add(struct hci_dev *hdev, void __user *arg) 896 { 897 bdaddr_t bdaddr; 898 int err; 899 900 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 901 return -EFAULT; 902 903 hci_dev_lock(hdev); 904 905 err = hci_bdaddr_list_add(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 906 907 hci_dev_unlock(hdev); 908 909 return err; 910 } 911 912 static int hci_sock_reject_list_del(struct hci_dev *hdev, void __user *arg) 913 { 914 bdaddr_t bdaddr; 915 int err; 916 917 if (copy_from_user(&bdaddr, arg, sizeof(bdaddr))) 918 return -EFAULT; 919 920 hci_dev_lock(hdev); 921 922 err = hci_bdaddr_list_del(&hdev->reject_list, &bdaddr, BDADDR_BREDR); 923 924 hci_dev_unlock(hdev); 925 926 return err; 927 } 928 929 /* Ioctls that require bound socket */ 930 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, 931 unsigned long arg) 932 { 933 struct hci_dev *hdev = hci_pi(sk)->hdev; 934 935 if (!hdev) 936 return -EBADFD; 937 938 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 939 return -EBUSY; 940 941 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 942 return -EOPNOTSUPP; 943 944 if (hdev->dev_type != HCI_PRIMARY) 945 return -EOPNOTSUPP; 946 947 switch (cmd) { 948 case HCISETRAW: 949 if (!capable(CAP_NET_ADMIN)) 950 return -EPERM; 951 return -EOPNOTSUPP; 952 953 case HCIGETCONNINFO: 954 return hci_get_conn_info(hdev, (void __user *)arg); 955 956 case HCIGETAUTHINFO: 957 return hci_get_auth_info(hdev, (void __user *)arg); 958 959 case HCIBLOCKADDR: 960 if (!capable(CAP_NET_ADMIN)) 961 return -EPERM; 962 return hci_sock_reject_list_add(hdev, (void __user *)arg); 963 964 case HCIUNBLOCKADDR: 965 if (!capable(CAP_NET_ADMIN)) 966 return -EPERM; 967 return hci_sock_reject_list_del(hdev, (void __user *)arg); 968 } 969 970 return -ENOIOCTLCMD; 971 } 972 973 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd, 974 unsigned long arg) 975 { 976 void __user *argp = (void __user *)arg; 977 struct sock *sk = sock->sk; 978 int err; 979 980 BT_DBG("cmd %x arg %lx", cmd, arg); 981 982 lock_sock(sk); 983 984 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 985 err = -EBADFD; 986 goto done; 987 } 988 989 /* When calling an ioctl on an unbound raw socket, then ensure 990 * that the monitor gets informed. Ensure that the resulting event 991 * is only send once by checking if the cookie exists or not. The 992 * socket cookie will be only ever generated once for the lifetime 993 * of a given socket. 994 */ 995 if (hci_sock_gen_cookie(sk)) { 996 struct sk_buff *skb; 997 998 if (capable(CAP_NET_ADMIN)) 999 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1000 1001 /* Send event to monitor */ 1002 skb = create_monitor_ctrl_open(sk); 1003 if (skb) { 1004 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1005 HCI_SOCK_TRUSTED, NULL); 1006 kfree_skb(skb); 1007 } 1008 } 1009 1010 release_sock(sk); 1011 1012 switch (cmd) { 1013 case HCIGETDEVLIST: 1014 return hci_get_dev_list(argp); 1015 1016 case HCIGETDEVINFO: 1017 return hci_get_dev_info(argp); 1018 1019 case HCIGETCONNLIST: 1020 return hci_get_conn_list(argp); 1021 1022 case HCIDEVUP: 1023 if (!capable(CAP_NET_ADMIN)) 1024 return -EPERM; 1025 return hci_dev_open(arg); 1026 1027 case HCIDEVDOWN: 1028 if (!capable(CAP_NET_ADMIN)) 1029 return -EPERM; 1030 return hci_dev_close(arg); 1031 1032 case HCIDEVRESET: 1033 if (!capable(CAP_NET_ADMIN)) 1034 return -EPERM; 1035 return hci_dev_reset(arg); 1036 1037 case HCIDEVRESTAT: 1038 if (!capable(CAP_NET_ADMIN)) 1039 return -EPERM; 1040 return hci_dev_reset_stat(arg); 1041 1042 case HCISETSCAN: 1043 case HCISETAUTH: 1044 case HCISETENCRYPT: 1045 case HCISETPTYPE: 1046 case HCISETLINKPOL: 1047 case HCISETLINKMODE: 1048 case HCISETACLMTU: 1049 case HCISETSCOMTU: 1050 if (!capable(CAP_NET_ADMIN)) 1051 return -EPERM; 1052 return hci_dev_cmd(cmd, argp); 1053 1054 case HCIINQUIRY: 1055 return hci_inquiry(argp); 1056 } 1057 1058 lock_sock(sk); 1059 1060 err = hci_sock_bound_ioctl(sk, cmd, arg); 1061 1062 done: 1063 release_sock(sk); 1064 return err; 1065 } 1066 1067 #ifdef CONFIG_COMPAT 1068 static int hci_sock_compat_ioctl(struct socket *sock, unsigned int cmd, 1069 unsigned long arg) 1070 { 1071 switch (cmd) { 1072 case HCIDEVUP: 1073 case HCIDEVDOWN: 1074 case HCIDEVRESET: 1075 case HCIDEVRESTAT: 1076 return hci_sock_ioctl(sock, cmd, arg); 1077 } 1078 1079 return hci_sock_ioctl(sock, cmd, (unsigned long)compat_ptr(arg)); 1080 } 1081 #endif 1082 1083 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, 1084 int addr_len) 1085 { 1086 struct sockaddr_hci haddr; 1087 struct sock *sk = sock->sk; 1088 struct hci_dev *hdev = NULL; 1089 struct sk_buff *skb; 1090 int len, err = 0; 1091 1092 BT_DBG("sock %p sk %p", sock, sk); 1093 1094 if (!addr) 1095 return -EINVAL; 1096 1097 memset(&haddr, 0, sizeof(haddr)); 1098 len = min_t(unsigned int, sizeof(haddr), addr_len); 1099 memcpy(&haddr, addr, len); 1100 1101 if (haddr.hci_family != AF_BLUETOOTH) 1102 return -EINVAL; 1103 1104 lock_sock(sk); 1105 1106 if (sk->sk_state == BT_BOUND) { 1107 err = -EALREADY; 1108 goto done; 1109 } 1110 1111 switch (haddr.hci_channel) { 1112 case HCI_CHANNEL_RAW: 1113 if (hci_pi(sk)->hdev) { 1114 err = -EALREADY; 1115 goto done; 1116 } 1117 1118 if (haddr.hci_dev != HCI_DEV_NONE) { 1119 hdev = hci_dev_get(haddr.hci_dev); 1120 if (!hdev) { 1121 err = -ENODEV; 1122 goto done; 1123 } 1124 1125 atomic_inc(&hdev->promisc); 1126 } 1127 1128 hci_pi(sk)->channel = haddr.hci_channel; 1129 1130 if (!hci_sock_gen_cookie(sk)) { 1131 /* In the case when a cookie has already been assigned, 1132 * then there has been already an ioctl issued against 1133 * an unbound socket and with that triggered an open 1134 * notification. Send a close notification first to 1135 * allow the state transition to bounded. 1136 */ 1137 skb = create_monitor_ctrl_close(sk); 1138 if (skb) { 1139 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1140 HCI_SOCK_TRUSTED, NULL); 1141 kfree_skb(skb); 1142 } 1143 } 1144 1145 if (capable(CAP_NET_ADMIN)) 1146 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1147 1148 hci_pi(sk)->hdev = hdev; 1149 1150 /* Send event to monitor */ 1151 skb = create_monitor_ctrl_open(sk); 1152 if (skb) { 1153 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1154 HCI_SOCK_TRUSTED, NULL); 1155 kfree_skb(skb); 1156 } 1157 break; 1158 1159 case HCI_CHANNEL_USER: 1160 if (hci_pi(sk)->hdev) { 1161 err = -EALREADY; 1162 goto done; 1163 } 1164 1165 if (haddr.hci_dev == HCI_DEV_NONE) { 1166 err = -EINVAL; 1167 goto done; 1168 } 1169 1170 if (!capable(CAP_NET_ADMIN)) { 1171 err = -EPERM; 1172 goto done; 1173 } 1174 1175 hdev = hci_dev_get(haddr.hci_dev); 1176 if (!hdev) { 1177 err = -ENODEV; 1178 goto done; 1179 } 1180 1181 if (test_bit(HCI_INIT, &hdev->flags) || 1182 hci_dev_test_flag(hdev, HCI_SETUP) || 1183 hci_dev_test_flag(hdev, HCI_CONFIG) || 1184 (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) && 1185 test_bit(HCI_UP, &hdev->flags))) { 1186 err = -EBUSY; 1187 hci_dev_put(hdev); 1188 goto done; 1189 } 1190 1191 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) { 1192 err = -EUSERS; 1193 hci_dev_put(hdev); 1194 goto done; 1195 } 1196 1197 mgmt_index_removed(hdev); 1198 1199 err = hci_dev_open(hdev->id); 1200 if (err) { 1201 if (err == -EALREADY) { 1202 /* In case the transport is already up and 1203 * running, clear the error here. 1204 * 1205 * This can happen when opening a user 1206 * channel and HCI_AUTO_OFF grace period 1207 * is still active. 1208 */ 1209 err = 0; 1210 } else { 1211 hci_dev_clear_flag(hdev, HCI_USER_CHANNEL); 1212 mgmt_index_added(hdev); 1213 hci_dev_put(hdev); 1214 goto done; 1215 } 1216 } 1217 1218 hci_pi(sk)->channel = haddr.hci_channel; 1219 1220 if (!hci_sock_gen_cookie(sk)) { 1221 /* In the case when a cookie has already been assigned, 1222 * this socket will transition from a raw socket into 1223 * a user channel socket. For a clean transition, send 1224 * the close notification first. 1225 */ 1226 skb = create_monitor_ctrl_close(sk); 1227 if (skb) { 1228 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1229 HCI_SOCK_TRUSTED, NULL); 1230 kfree_skb(skb); 1231 } 1232 } 1233 1234 /* The user channel is restricted to CAP_NET_ADMIN 1235 * capabilities and with that implicitly trusted. 1236 */ 1237 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1238 1239 hci_pi(sk)->hdev = hdev; 1240 1241 /* Send event to monitor */ 1242 skb = create_monitor_ctrl_open(sk); 1243 if (skb) { 1244 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1245 HCI_SOCK_TRUSTED, NULL); 1246 kfree_skb(skb); 1247 } 1248 1249 atomic_inc(&hdev->promisc); 1250 break; 1251 1252 case HCI_CHANNEL_MONITOR: 1253 if (haddr.hci_dev != HCI_DEV_NONE) { 1254 err = -EINVAL; 1255 goto done; 1256 } 1257 1258 if (!capable(CAP_NET_RAW)) { 1259 err = -EPERM; 1260 goto done; 1261 } 1262 1263 hci_pi(sk)->channel = haddr.hci_channel; 1264 1265 /* The monitor interface is restricted to CAP_NET_RAW 1266 * capabilities and with that implicitly trusted. 1267 */ 1268 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1269 1270 send_monitor_note(sk, "Linux version %s (%s)", 1271 init_utsname()->release, 1272 init_utsname()->machine); 1273 send_monitor_note(sk, "Bluetooth subsystem version %u.%u", 1274 BT_SUBSYS_VERSION, BT_SUBSYS_REVISION); 1275 send_monitor_replay(sk); 1276 send_monitor_control_replay(sk); 1277 1278 atomic_inc(&monitor_promisc); 1279 break; 1280 1281 case HCI_CHANNEL_LOGGING: 1282 if (haddr.hci_dev != HCI_DEV_NONE) { 1283 err = -EINVAL; 1284 goto done; 1285 } 1286 1287 if (!capable(CAP_NET_ADMIN)) { 1288 err = -EPERM; 1289 goto done; 1290 } 1291 1292 hci_pi(sk)->channel = haddr.hci_channel; 1293 break; 1294 1295 default: 1296 if (!hci_mgmt_chan_find(haddr.hci_channel)) { 1297 err = -EINVAL; 1298 goto done; 1299 } 1300 1301 if (haddr.hci_dev != HCI_DEV_NONE) { 1302 err = -EINVAL; 1303 goto done; 1304 } 1305 1306 /* Users with CAP_NET_ADMIN capabilities are allowed 1307 * access to all management commands and events. For 1308 * untrusted users the interface is restricted and 1309 * also only untrusted events are sent. 1310 */ 1311 if (capable(CAP_NET_ADMIN)) 1312 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED); 1313 1314 hci_pi(sk)->channel = haddr.hci_channel; 1315 1316 /* At the moment the index and unconfigured index events 1317 * are enabled unconditionally. Setting them on each 1318 * socket when binding keeps this functionality. They 1319 * however might be cleared later and then sending of these 1320 * events will be disabled, but that is then intentional. 1321 * 1322 * This also enables generic events that are safe to be 1323 * received by untrusted users. Example for such events 1324 * are changes to settings, class of device, name etc. 1325 */ 1326 if (hci_pi(sk)->channel == HCI_CHANNEL_CONTROL) { 1327 if (!hci_sock_gen_cookie(sk)) { 1328 /* In the case when a cookie has already been 1329 * assigned, this socket will transition from 1330 * a raw socket into a control socket. To 1331 * allow for a clean transition, send the 1332 * close notification first. 1333 */ 1334 skb = create_monitor_ctrl_close(sk); 1335 if (skb) { 1336 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1337 HCI_SOCK_TRUSTED, NULL); 1338 kfree_skb(skb); 1339 } 1340 } 1341 1342 /* Send event to monitor */ 1343 skb = create_monitor_ctrl_open(sk); 1344 if (skb) { 1345 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1346 HCI_SOCK_TRUSTED, NULL); 1347 kfree_skb(skb); 1348 } 1349 1350 hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS); 1351 hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 1352 hci_sock_set_flag(sk, HCI_MGMT_OPTION_EVENTS); 1353 hci_sock_set_flag(sk, HCI_MGMT_SETTING_EVENTS); 1354 hci_sock_set_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1355 hci_sock_set_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1356 } 1357 break; 1358 } 1359 1360 sk->sk_state = BT_BOUND; 1361 1362 done: 1363 release_sock(sk); 1364 return err; 1365 } 1366 1367 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, 1368 int peer) 1369 { 1370 struct sockaddr_hci *haddr = (struct sockaddr_hci *)addr; 1371 struct sock *sk = sock->sk; 1372 struct hci_dev *hdev; 1373 int err = 0; 1374 1375 BT_DBG("sock %p sk %p", sock, sk); 1376 1377 if (peer) 1378 return -EOPNOTSUPP; 1379 1380 lock_sock(sk); 1381 1382 hdev = hci_pi(sk)->hdev; 1383 if (!hdev) { 1384 err = -EBADFD; 1385 goto done; 1386 } 1387 1388 haddr->hci_family = AF_BLUETOOTH; 1389 haddr->hci_dev = hdev->id; 1390 haddr->hci_channel= hci_pi(sk)->channel; 1391 err = sizeof(*haddr); 1392 1393 done: 1394 release_sock(sk); 1395 return err; 1396 } 1397 1398 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg, 1399 struct sk_buff *skb) 1400 { 1401 __u8 mask = hci_pi(sk)->cmsg_mask; 1402 1403 if (mask & HCI_CMSG_DIR) { 1404 int incoming = bt_cb(skb)->incoming; 1405 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming), 1406 &incoming); 1407 } 1408 1409 if (mask & HCI_CMSG_TSTAMP) { 1410 #ifdef CONFIG_COMPAT 1411 struct old_timeval32 ctv; 1412 #endif 1413 struct __kernel_old_timeval tv; 1414 void *data; 1415 int len; 1416 1417 skb_get_timestamp(skb, &tv); 1418 1419 data = &tv; 1420 len = sizeof(tv); 1421 #ifdef CONFIG_COMPAT 1422 if (!COMPAT_USE_64BIT_TIME && 1423 (msg->msg_flags & MSG_CMSG_COMPAT)) { 1424 ctv.tv_sec = tv.tv_sec; 1425 ctv.tv_usec = tv.tv_usec; 1426 data = &ctv; 1427 len = sizeof(ctv); 1428 } 1429 #endif 1430 1431 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data); 1432 } 1433 } 1434 1435 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1436 size_t len, int flags) 1437 { 1438 int noblock = flags & MSG_DONTWAIT; 1439 struct sock *sk = sock->sk; 1440 struct sk_buff *skb; 1441 int copied, err; 1442 unsigned int skblen; 1443 1444 BT_DBG("sock %p, sk %p", sock, sk); 1445 1446 if (flags & MSG_OOB) 1447 return -EOPNOTSUPP; 1448 1449 if (hci_pi(sk)->channel == HCI_CHANNEL_LOGGING) 1450 return -EOPNOTSUPP; 1451 1452 if (sk->sk_state == BT_CLOSED) 1453 return 0; 1454 1455 skb = skb_recv_datagram(sk, flags, noblock, &err); 1456 if (!skb) 1457 return err; 1458 1459 skblen = skb->len; 1460 copied = skb->len; 1461 if (len < copied) { 1462 msg->msg_flags |= MSG_TRUNC; 1463 copied = len; 1464 } 1465 1466 skb_reset_transport_header(skb); 1467 err = skb_copy_datagram_msg(skb, 0, msg, copied); 1468 1469 switch (hci_pi(sk)->channel) { 1470 case HCI_CHANNEL_RAW: 1471 hci_sock_cmsg(sk, msg, skb); 1472 break; 1473 case HCI_CHANNEL_USER: 1474 case HCI_CHANNEL_MONITOR: 1475 sock_recv_timestamp(msg, sk, skb); 1476 break; 1477 default: 1478 if (hci_mgmt_chan_find(hci_pi(sk)->channel)) 1479 sock_recv_timestamp(msg, sk, skb); 1480 break; 1481 } 1482 1483 skb_free_datagram(sk, skb); 1484 1485 if (flags & MSG_TRUNC) 1486 copied = skblen; 1487 1488 return err ? : copied; 1489 } 1490 1491 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk, 1492 struct msghdr *msg, size_t msglen) 1493 { 1494 void *buf; 1495 u8 *cp; 1496 struct mgmt_hdr *hdr; 1497 u16 opcode, index, len; 1498 struct hci_dev *hdev = NULL; 1499 const struct hci_mgmt_handler *handler; 1500 bool var_len, no_hdev; 1501 int err; 1502 1503 BT_DBG("got %zu bytes", msglen); 1504 1505 if (msglen < sizeof(*hdr)) 1506 return -EINVAL; 1507 1508 buf = kmalloc(msglen, GFP_KERNEL); 1509 if (!buf) 1510 return -ENOMEM; 1511 1512 if (memcpy_from_msg(buf, msg, msglen)) { 1513 err = -EFAULT; 1514 goto done; 1515 } 1516 1517 hdr = buf; 1518 opcode = __le16_to_cpu(hdr->opcode); 1519 index = __le16_to_cpu(hdr->index); 1520 len = __le16_to_cpu(hdr->len); 1521 1522 if (len != msglen - sizeof(*hdr)) { 1523 err = -EINVAL; 1524 goto done; 1525 } 1526 1527 if (chan->channel == HCI_CHANNEL_CONTROL) { 1528 struct sk_buff *skb; 1529 1530 /* Send event to monitor */ 1531 skb = create_monitor_ctrl_command(sk, index, opcode, len, 1532 buf + sizeof(*hdr)); 1533 if (skb) { 1534 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, 1535 HCI_SOCK_TRUSTED, NULL); 1536 kfree_skb(skb); 1537 } 1538 } 1539 1540 if (opcode >= chan->handler_count || 1541 chan->handlers[opcode].func == NULL) { 1542 BT_DBG("Unknown op %u", opcode); 1543 err = mgmt_cmd_status(sk, index, opcode, 1544 MGMT_STATUS_UNKNOWN_COMMAND); 1545 goto done; 1546 } 1547 1548 handler = &chan->handlers[opcode]; 1549 1550 if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) && 1551 !(handler->flags & HCI_MGMT_UNTRUSTED)) { 1552 err = mgmt_cmd_status(sk, index, opcode, 1553 MGMT_STATUS_PERMISSION_DENIED); 1554 goto done; 1555 } 1556 1557 if (index != MGMT_INDEX_NONE) { 1558 hdev = hci_dev_get(index); 1559 if (!hdev) { 1560 err = mgmt_cmd_status(sk, index, opcode, 1561 MGMT_STATUS_INVALID_INDEX); 1562 goto done; 1563 } 1564 1565 if (hci_dev_test_flag(hdev, HCI_SETUP) || 1566 hci_dev_test_flag(hdev, HCI_CONFIG) || 1567 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1568 err = mgmt_cmd_status(sk, index, opcode, 1569 MGMT_STATUS_INVALID_INDEX); 1570 goto done; 1571 } 1572 1573 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1574 !(handler->flags & HCI_MGMT_UNCONFIGURED)) { 1575 err = mgmt_cmd_status(sk, index, opcode, 1576 MGMT_STATUS_INVALID_INDEX); 1577 goto done; 1578 } 1579 } 1580 1581 if (!(handler->flags & HCI_MGMT_HDEV_OPTIONAL)) { 1582 no_hdev = (handler->flags & HCI_MGMT_NO_HDEV); 1583 if (no_hdev != !hdev) { 1584 err = mgmt_cmd_status(sk, index, opcode, 1585 MGMT_STATUS_INVALID_INDEX); 1586 goto done; 1587 } 1588 } 1589 1590 var_len = (handler->flags & HCI_MGMT_VAR_LEN); 1591 if ((var_len && len < handler->data_len) || 1592 (!var_len && len != handler->data_len)) { 1593 err = mgmt_cmd_status(sk, index, opcode, 1594 MGMT_STATUS_INVALID_PARAMS); 1595 goto done; 1596 } 1597 1598 if (hdev && chan->hdev_init) 1599 chan->hdev_init(sk, hdev); 1600 1601 cp = buf + sizeof(*hdr); 1602 1603 err = handler->func(sk, hdev, cp, len); 1604 if (err < 0) 1605 goto done; 1606 1607 err = msglen; 1608 1609 done: 1610 if (hdev) 1611 hci_dev_put(hdev); 1612 1613 kfree(buf); 1614 return err; 1615 } 1616 1617 static int hci_logging_frame(struct sock *sk, struct msghdr *msg, int len) 1618 { 1619 struct hci_mon_hdr *hdr; 1620 struct sk_buff *skb; 1621 struct hci_dev *hdev; 1622 u16 index; 1623 int err; 1624 1625 /* The logging frame consists at minimum of the standard header, 1626 * the priority byte, the ident length byte and at least one string 1627 * terminator NUL byte. Anything shorter are invalid packets. 1628 */ 1629 if (len < sizeof(*hdr) + 3) 1630 return -EINVAL; 1631 1632 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); 1633 if (!skb) 1634 return err; 1635 1636 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 1637 err = -EFAULT; 1638 goto drop; 1639 } 1640 1641 hdr = (void *)skb->data; 1642 1643 if (__le16_to_cpu(hdr->len) != len - sizeof(*hdr)) { 1644 err = -EINVAL; 1645 goto drop; 1646 } 1647 1648 if (__le16_to_cpu(hdr->opcode) == 0x0000) { 1649 __u8 priority = skb->data[sizeof(*hdr)]; 1650 __u8 ident_len = skb->data[sizeof(*hdr) + 1]; 1651 1652 /* Only the priorities 0-7 are valid and with that any other 1653 * value results in an invalid packet. 1654 * 1655 * The priority byte is followed by an ident length byte and 1656 * the NUL terminated ident string. Check that the ident 1657 * length is not overflowing the packet and also that the 1658 * ident string itself is NUL terminated. In case the ident 1659 * length is zero, the length value actually doubles as NUL 1660 * terminator identifier. 1661 * 1662 * The message follows the ident string (if present) and 1663 * must be NUL terminated. Otherwise it is not a valid packet. 1664 */ 1665 if (priority > 7 || skb->data[len - 1] != 0x00 || 1666 ident_len > len - sizeof(*hdr) - 3 || 1667 skb->data[sizeof(*hdr) + ident_len + 1] != 0x00) { 1668 err = -EINVAL; 1669 goto drop; 1670 } 1671 } else { 1672 err = -EINVAL; 1673 goto drop; 1674 } 1675 1676 index = __le16_to_cpu(hdr->index); 1677 1678 if (index != MGMT_INDEX_NONE) { 1679 hdev = hci_dev_get(index); 1680 if (!hdev) { 1681 err = -ENODEV; 1682 goto drop; 1683 } 1684 } else { 1685 hdev = NULL; 1686 } 1687 1688 hdr->opcode = cpu_to_le16(HCI_MON_USER_LOGGING); 1689 1690 hci_send_to_channel(HCI_CHANNEL_MONITOR, skb, HCI_SOCK_TRUSTED, NULL); 1691 err = len; 1692 1693 if (hdev) 1694 hci_dev_put(hdev); 1695 1696 drop: 1697 kfree_skb(skb); 1698 return err; 1699 } 1700 1701 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, 1702 size_t len) 1703 { 1704 struct sock *sk = sock->sk; 1705 struct hci_mgmt_chan *chan; 1706 struct hci_dev *hdev; 1707 struct sk_buff *skb; 1708 int err; 1709 1710 BT_DBG("sock %p sk %p", sock, sk); 1711 1712 if (msg->msg_flags & MSG_OOB) 1713 return -EOPNOTSUPP; 1714 1715 if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE| 1716 MSG_CMSG_COMPAT)) 1717 return -EINVAL; 1718 1719 if (len < 4 || len > HCI_MAX_FRAME_SIZE) 1720 return -EINVAL; 1721 1722 lock_sock(sk); 1723 1724 switch (hci_pi(sk)->channel) { 1725 case HCI_CHANNEL_RAW: 1726 case HCI_CHANNEL_USER: 1727 break; 1728 case HCI_CHANNEL_MONITOR: 1729 err = -EOPNOTSUPP; 1730 goto done; 1731 case HCI_CHANNEL_LOGGING: 1732 err = hci_logging_frame(sk, msg, len); 1733 goto done; 1734 default: 1735 mutex_lock(&mgmt_chan_list_lock); 1736 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel); 1737 if (chan) 1738 err = hci_mgmt_cmd(chan, sk, msg, len); 1739 else 1740 err = -EINVAL; 1741 1742 mutex_unlock(&mgmt_chan_list_lock); 1743 goto done; 1744 } 1745 1746 hdev = hci_pi(sk)->hdev; 1747 if (!hdev) { 1748 err = -EBADFD; 1749 goto done; 1750 } 1751 1752 if (!test_bit(HCI_UP, &hdev->flags)) { 1753 err = -ENETDOWN; 1754 goto done; 1755 } 1756 1757 skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err); 1758 if (!skb) 1759 goto done; 1760 1761 if (memcpy_from_msg(skb_put(skb, len), msg, len)) { 1762 err = -EFAULT; 1763 goto drop; 1764 } 1765 1766 hci_skb_pkt_type(skb) = skb->data[0]; 1767 skb_pull(skb, 1); 1768 1769 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) { 1770 /* No permission check is needed for user channel 1771 * since that gets enforced when binding the socket. 1772 * 1773 * However check that the packet type is valid. 1774 */ 1775 if (hci_skb_pkt_type(skb) != HCI_COMMAND_PKT && 1776 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1777 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1778 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { 1779 err = -EINVAL; 1780 goto drop; 1781 } 1782 1783 skb_queue_tail(&hdev->raw_q, skb); 1784 queue_work(hdev->workqueue, &hdev->tx_work); 1785 } else if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) { 1786 u16 opcode = get_unaligned_le16(skb->data); 1787 u16 ogf = hci_opcode_ogf(opcode); 1788 u16 ocf = hci_opcode_ocf(opcode); 1789 1790 if (((ogf > HCI_SFLT_MAX_OGF) || 1791 !hci_test_bit(ocf & HCI_FLT_OCF_BITS, 1792 &hci_sec_filter.ocf_mask[ogf])) && 1793 !capable(CAP_NET_RAW)) { 1794 err = -EPERM; 1795 goto drop; 1796 } 1797 1798 /* Since the opcode has already been extracted here, store 1799 * a copy of the value for later use by the drivers. 1800 */ 1801 hci_skb_opcode(skb) = opcode; 1802 1803 if (ogf == 0x3f) { 1804 skb_queue_tail(&hdev->raw_q, skb); 1805 queue_work(hdev->workqueue, &hdev->tx_work); 1806 } else { 1807 /* Stand-alone HCI commands must be flagged as 1808 * single-command requests. 1809 */ 1810 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 1811 1812 skb_queue_tail(&hdev->cmd_q, skb); 1813 queue_work(hdev->workqueue, &hdev->cmd_work); 1814 } 1815 } else { 1816 if (!capable(CAP_NET_RAW)) { 1817 err = -EPERM; 1818 goto drop; 1819 } 1820 1821 if (hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT && 1822 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT && 1823 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) { 1824 err = -EINVAL; 1825 goto drop; 1826 } 1827 1828 skb_queue_tail(&hdev->raw_q, skb); 1829 queue_work(hdev->workqueue, &hdev->tx_work); 1830 } 1831 1832 err = len; 1833 1834 done: 1835 release_sock(sk); 1836 return err; 1837 1838 drop: 1839 kfree_skb(skb); 1840 goto done; 1841 } 1842 1843 static int hci_sock_setsockopt(struct socket *sock, int level, int optname, 1844 sockptr_t optval, unsigned int len) 1845 { 1846 struct hci_ufilter uf = { .opcode = 0 }; 1847 struct sock *sk = sock->sk; 1848 int err = 0, opt = 0; 1849 1850 BT_DBG("sk %p, opt %d", sk, optname); 1851 1852 if (level != SOL_HCI) 1853 return -ENOPROTOOPT; 1854 1855 lock_sock(sk); 1856 1857 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1858 err = -EBADFD; 1859 goto done; 1860 } 1861 1862 switch (optname) { 1863 case HCI_DATA_DIR: 1864 if (copy_from_sockptr(&opt, optval, sizeof(opt))) { 1865 err = -EFAULT; 1866 break; 1867 } 1868 1869 if (opt) 1870 hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR; 1871 else 1872 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR; 1873 break; 1874 1875 case HCI_TIME_STAMP: 1876 if (copy_from_sockptr(&opt, optval, sizeof(opt))) { 1877 err = -EFAULT; 1878 break; 1879 } 1880 1881 if (opt) 1882 hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP; 1883 else 1884 hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP; 1885 break; 1886 1887 case HCI_FILTER: 1888 { 1889 struct hci_filter *f = &hci_pi(sk)->filter; 1890 1891 uf.type_mask = f->type_mask; 1892 uf.opcode = f->opcode; 1893 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 1894 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 1895 } 1896 1897 len = min_t(unsigned int, len, sizeof(uf)); 1898 if (copy_from_sockptr(&uf, optval, len)) { 1899 err = -EFAULT; 1900 break; 1901 } 1902 1903 if (!capable(CAP_NET_RAW)) { 1904 uf.type_mask &= hci_sec_filter.type_mask; 1905 uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0); 1906 uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1); 1907 } 1908 1909 { 1910 struct hci_filter *f = &hci_pi(sk)->filter; 1911 1912 f->type_mask = uf.type_mask; 1913 f->opcode = uf.opcode; 1914 *((u32 *) f->event_mask + 0) = uf.event_mask[0]; 1915 *((u32 *) f->event_mask + 1) = uf.event_mask[1]; 1916 } 1917 break; 1918 1919 default: 1920 err = -ENOPROTOOPT; 1921 break; 1922 } 1923 1924 done: 1925 release_sock(sk); 1926 return err; 1927 } 1928 1929 static int hci_sock_getsockopt(struct socket *sock, int level, int optname, 1930 char __user *optval, int __user *optlen) 1931 { 1932 struct hci_ufilter uf; 1933 struct sock *sk = sock->sk; 1934 int len, opt, err = 0; 1935 1936 BT_DBG("sk %p, opt %d", sk, optname); 1937 1938 if (level != SOL_HCI) 1939 return -ENOPROTOOPT; 1940 1941 if (get_user(len, optlen)) 1942 return -EFAULT; 1943 1944 lock_sock(sk); 1945 1946 if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) { 1947 err = -EBADFD; 1948 goto done; 1949 } 1950 1951 switch (optname) { 1952 case HCI_DATA_DIR: 1953 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR) 1954 opt = 1; 1955 else 1956 opt = 0; 1957 1958 if (put_user(opt, optval)) 1959 err = -EFAULT; 1960 break; 1961 1962 case HCI_TIME_STAMP: 1963 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP) 1964 opt = 1; 1965 else 1966 opt = 0; 1967 1968 if (put_user(opt, optval)) 1969 err = -EFAULT; 1970 break; 1971 1972 case HCI_FILTER: 1973 { 1974 struct hci_filter *f = &hci_pi(sk)->filter; 1975 1976 memset(&uf, 0, sizeof(uf)); 1977 uf.type_mask = f->type_mask; 1978 uf.opcode = f->opcode; 1979 uf.event_mask[0] = *((u32 *) f->event_mask + 0); 1980 uf.event_mask[1] = *((u32 *) f->event_mask + 1); 1981 } 1982 1983 len = min_t(unsigned int, len, sizeof(uf)); 1984 if (copy_to_user(optval, &uf, len)) 1985 err = -EFAULT; 1986 break; 1987 1988 default: 1989 err = -ENOPROTOOPT; 1990 break; 1991 } 1992 1993 done: 1994 release_sock(sk); 1995 return err; 1996 } 1997 1998 static const struct proto_ops hci_sock_ops = { 1999 .family = PF_BLUETOOTH, 2000 .owner = THIS_MODULE, 2001 .release = hci_sock_release, 2002 .bind = hci_sock_bind, 2003 .getname = hci_sock_getname, 2004 .sendmsg = hci_sock_sendmsg, 2005 .recvmsg = hci_sock_recvmsg, 2006 .ioctl = hci_sock_ioctl, 2007 #ifdef CONFIG_COMPAT 2008 .compat_ioctl = hci_sock_compat_ioctl, 2009 #endif 2010 .poll = datagram_poll, 2011 .listen = sock_no_listen, 2012 .shutdown = sock_no_shutdown, 2013 .setsockopt = hci_sock_setsockopt, 2014 .getsockopt = hci_sock_getsockopt, 2015 .connect = sock_no_connect, 2016 .socketpair = sock_no_socketpair, 2017 .accept = sock_no_accept, 2018 .mmap = sock_no_mmap 2019 }; 2020 2021 static struct proto hci_sk_proto = { 2022 .name = "HCI", 2023 .owner = THIS_MODULE, 2024 .obj_size = sizeof(struct hci_pinfo) 2025 }; 2026 2027 static int hci_sock_create(struct net *net, struct socket *sock, int protocol, 2028 int kern) 2029 { 2030 struct sock *sk; 2031 2032 BT_DBG("sock %p", sock); 2033 2034 if (sock->type != SOCK_RAW) 2035 return -ESOCKTNOSUPPORT; 2036 2037 sock->ops = &hci_sock_ops; 2038 2039 sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto, kern); 2040 if (!sk) 2041 return -ENOMEM; 2042 2043 sock_init_data(sock, sk); 2044 2045 sock_reset_flag(sk, SOCK_ZAPPED); 2046 2047 sk->sk_protocol = protocol; 2048 2049 sock->state = SS_UNCONNECTED; 2050 sk->sk_state = BT_OPEN; 2051 2052 bt_sock_link(&hci_sk_list, sk); 2053 return 0; 2054 } 2055 2056 static const struct net_proto_family hci_sock_family_ops = { 2057 .family = PF_BLUETOOTH, 2058 .owner = THIS_MODULE, 2059 .create = hci_sock_create, 2060 }; 2061 2062 int __init hci_sock_init(void) 2063 { 2064 int err; 2065 2066 BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr)); 2067 2068 err = proto_register(&hci_sk_proto, 0); 2069 if (err < 0) 2070 return err; 2071 2072 err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops); 2073 if (err < 0) { 2074 BT_ERR("HCI socket registration failed"); 2075 goto error; 2076 } 2077 2078 err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL); 2079 if (err < 0) { 2080 BT_ERR("Failed to create HCI proc file"); 2081 bt_sock_unregister(BTPROTO_HCI); 2082 goto error; 2083 } 2084 2085 BT_INFO("HCI socket layer initialized"); 2086 2087 return 0; 2088 2089 error: 2090 proto_unregister(&hci_sk_proto); 2091 return err; 2092 } 2093 2094 void hci_sock_cleanup(void) 2095 { 2096 bt_procfs_cleanup(&init_net, "hci"); 2097 bt_sock_unregister(BTPROTO_HCI); 2098 proto_unregister(&hci_sk_proto); 2099 } 2100