kernel/net/bluetooth/hci_sock.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI sockets. */
  26
  27 #include <linux/export.h>
  28 #include <asm/unaligned.h>
  29
  30 #include <net/bluetooth/bluetooth.h>
  31 #include <net/bluetooth/hci_core.h>
  32 #include <net/bluetooth/hci_mon.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "mgmt_util.h"
  36
  37 static LIST_HEAD(mgmt_chan_list);
  38 static DEFINE_MUTEX(mgmt_chan_list_lock);
  39
  40 static atomic_t monitor_promisc = ATOMIC_INIT(0);
  41
  42 /* ----- HCI socket interface ----- */
  43
  44 /* Socket info */
  45 #define hci_pi(sk) ((struct hci_pinfo *) sk)
  46
  47 struct hci_pinfo {
  48         struct bt_sock    bt;
  49         struct hci_dev    *hdev;
  50         struct hci_filter filter;
  51         __u32             cmsg_mask;
  52         unsigned short    channel;
  53         unsigned long     flags;
  54 };
  55
  56 void hci_sock_set_flag(struct sock *sk, int nr)
  57 {
  58         set_bit(nr, &hci_pi(sk)->flags);
  59 }
  60
  61 void hci_sock_clear_flag(struct sock *sk, int nr)
  62 {
  63         clear_bit(nr, &hci_pi(sk)->flags);
  64 }
  65
  66 int hci_sock_test_flag(struct sock *sk, int nr)
  67 {
  68         return test_bit(nr, &hci_pi(sk)->flags);
  69 }
  70
  71 unsigned short hci_sock_get_channel(struct sock *sk)
  72 {
  73         return hci_pi(sk)->channel;
  74 }
  75
  76 static inline int hci_test_bit(int nr, const void *addr)
  77 {
  78         return *((const __u32 *) addr + (nr >> 5)) & ((__u32) 1 << (nr & 31));
  79 }
  80
  81 /* Security filter */
  82 #define HCI_SFLT_MAX_OGF  5
  83
  84 struct hci_sec_filter {
  85         __u32 type_mask;
  86         __u32 event_mask[2];
  87         __u32 ocf_mask[HCI_SFLT_MAX_OGF + 1][4];
  88 };
  89
  90 static const struct hci_sec_filter hci_sec_filter = {
  91         /* Packet types */
  92         0x10,
  93         /* Events */
  94         { 0x1000d9fe, 0x0000b00c },
  95         /* Commands */
  96         {
  97                 { 0x0 },
  98                 /* OGF_LINK_CTL */
  99                 { 0xbe000006, 0x00000001, 0x00000000, 0x00 },
 100                 /* OGF_LINK_POLICY */
 101                 { 0x00005200, 0x00000000, 0x00000000, 0x00 },
 102                 /* OGF_HOST_CTL */
 103                 { 0xaab00200, 0x2b402aaa, 0x05220154, 0x00 },
 104                 /* OGF_INFO_PARAM */
 105                 { 0x000002be, 0x00000000, 0x00000000, 0x00 },
 106                 /* OGF_STATUS_PARAM */
 107                 { 0x000000ea, 0x00000000, 0x00000000, 0x00 }
 108         }
 109 };
 110
 111 static struct bt_sock_list hci_sk_list = {
 112         .lock = __RW_LOCK_UNLOCKED(hci_sk_list.lock)
 113 };
 114
 115 static bool is_filtered_packet(struct sock *sk, struct sk_buff *skb)
 116 {
 117         struct hci_filter *flt;
 118         int flt_type, flt_event;
 119
 120         /* Apply filter */
 121         flt = &hci_pi(sk)->filter;
 122
 123         if (bt_cb(skb)->pkt_type == HCI_VENDOR_PKT)
 124                 flt_type = 0;
 125         else
 126                 flt_type = bt_cb(skb)->pkt_type & HCI_FLT_TYPE_BITS;
 127
 128         if (!test_bit(flt_type, &flt->type_mask))
 129                 return true;
 130
 131         /* Extra filter for event packets only */
 132         if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT)
 133                 return false;
 134
 135         flt_event = (*(__u8 *)skb->data & HCI_FLT_EVENT_BITS);
 136
 137         if (!hci_test_bit(flt_event, &flt->event_mask))
 138                 return true;
 139
 140         /* Check filter only when opcode is set */
 141         if (!flt->opcode)
 142                 return false;
 143
 144         if (flt_event == HCI_EV_CMD_COMPLETE &&
 145             flt->opcode != get_unaligned((__le16 *)(skb->data + 3)))
 146                 return true;
 147
 148         if (flt_event == HCI_EV_CMD_STATUS &&
 149             flt->opcode != get_unaligned((__le16 *)(skb->data + 4)))
 150                 return true;
 151
 152         return false;
 153 }
 154
 155 /* Send frame to RAW socket */
 156 void hci_send_to_sock(struct hci_dev *hdev, struct sk_buff *skb)
 157 {
 158         struct sock *sk;
 159         struct sk_buff *skb_copy = NULL;
 160
 161         BT_DBG("hdev %p len %d", hdev, skb->len);
 162
 163         read_lock(&hci_sk_list.lock);
 164
 165         sk_for_each(sk, &hci_sk_list.head) {
 166                 struct sk_buff *nskb;
 167
 168                 if (sk->sk_state != BT_BOUND || hci_pi(sk)->hdev != hdev)
 169                         continue;
 170
 171                 /* Don't send frame to the socket it came from */
 172                 if (skb->sk == sk)
 173                         continue;
 174
 175                 if (hci_pi(sk)->channel == HCI_CHANNEL_RAW) {
 176                         if (is_filtered_packet(sk, skb))
 177                                 continue;
 178                 } else if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
 179                         if (!bt_cb(skb)->incoming)
 180                                 continue;
 181                         if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&
 182                             bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
 183                             bt_cb(skb)->pkt_type != HCI_SCODATA_PKT)
 184                                 continue;
 185                 } else {
 186                         /* Don't send frame to other channel types */
 187                         continue;
 188                 }
 189
 190                 if (!skb_copy) {
 191                         /* Create a private copy with headroom */
 192                         skb_copy = __pskb_copy_fclone(skb, 1, GFP_ATOMIC, true);
 193                         if (!skb_copy)
 194                                 continue;
 195
 196                         /* Put type byte before the data */
 197                         memcpy(skb_push(skb_copy, 1), &bt_cb(skb)->pkt_type, 1);
 198                 }
 199
 200                 nskb = skb_clone(skb_copy, GFP_ATOMIC);
 201                 if (!nskb)
 202                         continue;
 203
 204                 if (sock_queue_rcv_skb(sk, nskb))
 205                         kfree_skb(nskb);
 206         }
 207
 208         read_unlock(&hci_sk_list.lock);
 209
 210         kfree_skb(skb_copy);
 211 }
 212
 213 /* Send frame to sockets with specific channel */
 214 void hci_send_to_channel(unsigned short channel, struct sk_buff *skb,
 215                          int flag, struct sock *skip_sk)
 216 {
 217         struct sock *sk;
 218
 219         BT_DBG("channel %u len %d", channel, skb->len);
 220
 221         read_lock(&hci_sk_list.lock);
 222
 223         sk_for_each(sk, &hci_sk_list.head) {
 224                 struct sk_buff *nskb;
 225
 226                 /* Ignore socket without the flag set */
 227                 if (!hci_sock_test_flag(sk, flag))
 228                         continue;
 229
 230                 /* Skip the original socket */
 231                 if (sk == skip_sk)
 232                         continue;
 233
 234                 if (sk->sk_state != BT_BOUND)
 235                         continue;
 236
 237                 if (hci_pi(sk)->channel != channel)
 238                         continue;
 239
 240                 nskb = skb_clone(skb, GFP_ATOMIC);
 241                 if (!nskb)
 242                         continue;
 243
 244                 if (sock_queue_rcv_skb(sk, nskb))
 245                         kfree_skb(nskb);
 246         }
 247
 248         read_unlock(&hci_sk_list.lock);
 249 }
 250
 251 /* Send frame to monitor socket */
 252 void hci_send_to_monitor(struct hci_dev *hdev, struct sk_buff *skb)
 253 {
 254         struct sk_buff *skb_copy = NULL;
 255         struct hci_mon_hdr *hdr;
 256         __le16 opcode;
 257
 258         if (!atomic_read(&monitor_promisc))
 259                 return;
 260
 261         BT_DBG("hdev %p len %d", hdev, skb->len);
 262
 263         switch (bt_cb(skb)->pkt_type) {
 264         case HCI_COMMAND_PKT:
 265                 opcode = cpu_to_le16(HCI_MON_COMMAND_PKT);
 266                 break;
 267         case HCI_EVENT_PKT:
 268                 opcode = cpu_to_le16(HCI_MON_EVENT_PKT);
 269                 break;
 270         case HCI_ACLDATA_PKT:
 271                 if (bt_cb(skb)->incoming)
 272                         opcode = cpu_to_le16(HCI_MON_ACL_RX_PKT);
 273                 else
 274                         opcode = cpu_to_le16(HCI_MON_ACL_TX_PKT);
 275                 break;
 276         case HCI_SCODATA_PKT:
 277                 if (bt_cb(skb)->incoming)
 278                         opcode = cpu_to_le16(HCI_MON_SCO_RX_PKT);
 279                 else
 280                         opcode = cpu_to_le16(HCI_MON_SCO_TX_PKT);
 281                 break;
 282         default:
 283                 return;
 284         }
 285
 286         /* Create a private copy with headroom */
 287         skb_copy = __pskb_copy_fclone(skb, HCI_MON_HDR_SIZE, GFP_ATOMIC, true);
 288         if (!skb_copy)
 289                 return;
 290
 291         /* Put header before the data */
 292         hdr = (void *) skb_push(skb_copy, HCI_MON_HDR_SIZE);
 293         hdr->opcode = opcode;
 294         hdr->index = cpu_to_le16(hdev->id);
 295         hdr->len = cpu_to_le16(skb->len);
 296
 297         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb_copy,
 298                             HCI_SOCK_TRUSTED, NULL);
 299         kfree_skb(skb_copy);
 300 }
 301
 302 static struct sk_buff *create_monitor_event(struct hci_dev *hdev, int event)
 303 {
 304         struct hci_mon_hdr *hdr;
 305         struct hci_mon_new_index *ni;
 306         struct sk_buff *skb;
 307         __le16 opcode;
 308
 309         switch (event) {
 310         case HCI_DEV_REG:
 311                 skb = bt_skb_alloc(HCI_MON_NEW_INDEX_SIZE, GFP_ATOMIC);
 312                 if (!skb)
 313                         return NULL;
 314
 315                 ni = (void *) skb_put(skb, HCI_MON_NEW_INDEX_SIZE);
 316                 ni->type = hdev->dev_type;
 317                 ni->bus = hdev->bus;
 318                 bacpy(&ni->bdaddr, &hdev->bdaddr);
 319                 memcpy(ni->name, hdev->name, 8);
 320
 321                 opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
 322                 break;
 323
 324         case HCI_DEV_UNREG:
 325                 skb = bt_skb_alloc(0, GFP_ATOMIC);
 326                 if (!skb)
 327                         return NULL;
 328
 329                 opcode = cpu_to_le16(HCI_MON_DEL_INDEX);
 330                 break;
 331
 332         default:
 333                 return NULL;
 334         }
 335
 336         __net_timestamp(skb);
 337
 338         hdr = (void *) skb_push(skb, HCI_MON_HDR_SIZE);
 339         hdr->opcode = opcode;
 340         hdr->index = cpu_to_le16(hdev->id);
 341         hdr->len = cpu_to_le16(skb->len - HCI_MON_HDR_SIZE);
 342
 343         return skb;
 344 }
 345
 346 static void send_monitor_replay(struct sock *sk)
 347 {
 348         struct hci_dev *hdev;
 349
 350         read_lock(&hci_dev_list_lock);
 351
 352         list_for_each_entry(hdev, &hci_dev_list, list) {
 353                 struct sk_buff *skb;
 354
 355                 skb = create_monitor_event(hdev, HCI_DEV_REG);
 356                 if (!skb)
 357                         continue;
 358
 359                 if (sock_queue_rcv_skb(sk, skb))
 360                         kfree_skb(skb);
 361         }
 362
 363         read_unlock(&hci_dev_list_lock);
 364 }
 365
 366 /* Generate internal stack event */
 367 static void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
 368 {
 369         struct hci_event_hdr *hdr;
 370         struct hci_ev_stack_internal *ev;
 371         struct sk_buff *skb;
 372
 373         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
 374         if (!skb)
 375                 return;
 376
 377         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
 378         hdr->evt  = HCI_EV_STACK_INTERNAL;
 379         hdr->plen = sizeof(*ev) + dlen;
 380
 381         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
 382         ev->type = type;
 383         memcpy(ev->data, data, dlen);
 384
 385         bt_cb(skb)->incoming = 1;
 386         __net_timestamp(skb);
 387
 388         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
 389         hci_send_to_sock(hdev, skb);
 390         kfree_skb(skb);
 391 }
 392
 393 void hci_sock_dev_event(struct hci_dev *hdev, int event)
 394 {
 395         struct hci_ev_si_device ev;
 396
 397         BT_DBG("hdev %s event %d", hdev->name, event);
 398
 399         /* Send event to monitor */
 400         if (atomic_read(&monitor_promisc)) {
 401                 struct sk_buff *skb;
 402
 403                 skb = create_monitor_event(hdev, event);
 404                 if (skb) {
 405                         hci_send_to_channel(HCI_CHANNEL_MONITOR, skb,
 406                                             HCI_SOCK_TRUSTED, NULL);
 407                         kfree_skb(skb);
 408                 }
 409         }
 410
 411         /* Send event to sockets */
 412         ev.event  = event;
 413         ev.dev_id = hdev->id;
 414         hci_si_event(NULL, HCI_EV_SI_DEVICE, sizeof(ev), &ev);
 415
 416         if (event == HCI_DEV_UNREG) {
 417                 struct sock *sk;
 418
 419                 /* Detach sockets from device */
 420                 read_lock(&hci_sk_list.lock);
 421                 sk_for_each(sk, &hci_sk_list.head) {
 422                         bh_lock_sock_nested(sk);
 423                         if (hci_pi(sk)->hdev == hdev) {
 424                                 hci_pi(sk)->hdev = NULL;
 425                                 sk->sk_err = EPIPE;
 426                                 sk->sk_state = BT_OPEN;
 427                                 sk->sk_state_change(sk);
 428
 429                                 hci_dev_put(hdev);
 430                         }
 431                         bh_unlock_sock(sk);
 432                 }
 433                 read_unlock(&hci_sk_list.lock);
 434         }
 435 }
 436
 437 static struct hci_mgmt_chan *__hci_mgmt_chan_find(unsigned short channel)
 438 {
 439         struct hci_mgmt_chan *c;
 440
 441         list_for_each_entry(c, &mgmt_chan_list, list) {
 442                 if (c->channel == channel)
 443                         return c;
 444         }
 445
 446         return NULL;
 447 }
 448
 449 static struct hci_mgmt_chan *hci_mgmt_chan_find(unsigned short channel)
 450 {
 451         struct hci_mgmt_chan *c;
 452
 453         mutex_lock(&mgmt_chan_list_lock);
 454         c = __hci_mgmt_chan_find(channel);
 455         mutex_unlock(&mgmt_chan_list_lock);
 456
 457         return c;
 458 }
 459
 460 int hci_mgmt_chan_register(struct hci_mgmt_chan *c)
 461 {
 462         if (c->channel < HCI_CHANNEL_CONTROL)
 463                 return -EINVAL;
 464
 465         mutex_lock(&mgmt_chan_list_lock);
 466         if (__hci_mgmt_chan_find(c->channel)) {
 467                 mutex_unlock(&mgmt_chan_list_lock);
 468                 return -EALREADY;
 469         }
 470
 471         list_add_tail(&c->list, &mgmt_chan_list);
 472
 473         mutex_unlock(&mgmt_chan_list_lock);
 474
 475         return 0;
 476 }
 477 EXPORT_SYMBOL(hci_mgmt_chan_register);
 478
 479 void hci_mgmt_chan_unregister(struct hci_mgmt_chan *c)
 480 {
 481         mutex_lock(&mgmt_chan_list_lock);
 482         list_del(&c->list);
 483         mutex_unlock(&mgmt_chan_list_lock);
 484 }
 485 EXPORT_SYMBOL(hci_mgmt_chan_unregister);
 486
 487 static int hci_sock_release(struct socket *sock)
 488 {
 489         struct sock *sk = sock->sk;
 490         struct hci_dev *hdev;
 491
 492         BT_DBG("sock %p sk %p", sock, sk);
 493
 494         if (!sk)
 495                 return 0;
 496
 497         hdev = hci_pi(sk)->hdev;
 498
 499         if (hci_pi(sk)->channel == HCI_CHANNEL_MONITOR)
 500                 atomic_dec(&monitor_promisc);
 501
 502         bt_sock_unlink(&hci_sk_list, sk);
 503
 504         if (hdev) {
 505                 if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
 506                         mgmt_index_added(hdev);
 507                         hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
 508                         hci_dev_close(hdev->id);
 509                 }
 510
 511                 atomic_dec(&hdev->promisc);
 512                 hci_dev_put(hdev);
 513         }
 514
 515         sock_orphan(sk);
 516
 517         skb_queue_purge(&sk->sk_receive_queue);
 518         skb_queue_purge(&sk->sk_write_queue);
 519
 520         sock_put(sk);
 521         return 0;
 522 }
 523
 524 static int hci_sock_blacklist_add(struct hci_dev *hdev, void __user *arg)
 525 {
 526         bdaddr_t bdaddr;
 527         int err;
 528
 529         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
 530                 return -EFAULT;
 531
 532         hci_dev_lock(hdev);
 533
 534         err = hci_bdaddr_list_add(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
 535
 536         hci_dev_unlock(hdev);
 537
 538         return err;
 539 }
 540
 541 static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg)
 542 {
 543         bdaddr_t bdaddr;
 544         int err;
 545
 546         if (copy_from_user(&bdaddr, arg, sizeof(bdaddr)))
 547                 return -EFAULT;
 548
 549         hci_dev_lock(hdev);
 550
 551         err = hci_bdaddr_list_del(&hdev->blacklist, &bdaddr, BDADDR_BREDR);
 552
 553         hci_dev_unlock(hdev);
 554
 555         return err;
 556 }
 557
 558 /* Ioctls that require bound socket */
 559 static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd,
 560                                 unsigned long arg)
 561 {
 562         struct hci_dev *hdev = hci_pi(sk)->hdev;
 563
 564         if (!hdev)
 565                 return -EBADFD;
 566
 567         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
 568                 return -EBUSY;
 569
 570         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
 571                 return -EOPNOTSUPP;
 572
 573         if (hdev->dev_type != HCI_BREDR)
 574                 return -EOPNOTSUPP;
 575
 576         switch (cmd) {
 577         case HCISETRAW:
 578                 if (!capable(CAP_NET_ADMIN))
 579                         return -EPERM;
 580                 return -EOPNOTSUPP;
 581
 582         case HCIGETCONNINFO:
 583                 return hci_get_conn_info(hdev, (void __user *) arg);
 584
 585         case HCIGETAUTHINFO:
 586                 return hci_get_auth_info(hdev, (void __user *) arg);
 587
 588         case HCIBLOCKADDR:
 589                 if (!capable(CAP_NET_ADMIN))
 590                         return -EPERM;
 591                 return hci_sock_blacklist_add(hdev, (void __user *) arg);
 592
 593         case HCIUNBLOCKADDR:
 594                 if (!capable(CAP_NET_ADMIN))
 595                         return -EPERM;
 596                 return hci_sock_blacklist_del(hdev, (void __user *) arg);
 597         }
 598
 599         return -ENOIOCTLCMD;
 600 }
 601
 602 static int hci_sock_ioctl(struct socket *sock, unsigned int cmd,
 603                           unsigned long arg)
 604 {
 605         void __user *argp = (void __user *) arg;
 606         struct sock *sk = sock->sk;
 607         int err;
 608
 609         BT_DBG("cmd %x arg %lx", cmd, arg);
 610
 611         lock_sock(sk);
 612
 613         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
 614                 err = -EBADFD;
 615                 goto done;
 616         }
 617
 618         release_sock(sk);
 619
 620         switch (cmd) {
 621         case HCIGETDEVLIST:
 622                 return hci_get_dev_list(argp);
 623
 624         case HCIGETDEVINFO:
 625                 return hci_get_dev_info(argp);
 626
 627         case HCIGETCONNLIST:
 628                 return hci_get_conn_list(argp);
 629
 630         case HCIDEVUP:
 631                 if (!capable(CAP_NET_ADMIN))
 632                         return -EPERM;
 633                 return hci_dev_open(arg);
 634
 635         case HCIDEVDOWN:
 636                 if (!capable(CAP_NET_ADMIN))
 637                         return -EPERM;
 638                 return hci_dev_close(arg);
 639
 640         case HCIDEVRESET:
 641                 if (!capable(CAP_NET_ADMIN))
 642                         return -EPERM;
 643                 return hci_dev_reset(arg);
 644
 645         case HCIDEVRESTAT:
 646                 if (!capable(CAP_NET_ADMIN))
 647                         return -EPERM;
 648                 return hci_dev_reset_stat(arg);
 649
 650         case HCISETSCAN:
 651         case HCISETAUTH:
 652         case HCISETENCRYPT:
 653         case HCISETPTYPE:
 654         case HCISETLINKPOL:
 655         case HCISETLINKMODE:
 656         case HCISETACLMTU:
 657         case HCISETSCOMTU:
 658                 if (!capable(CAP_NET_ADMIN))
 659                         return -EPERM;
 660                 return hci_dev_cmd(cmd, argp);
 661
 662         case HCIINQUIRY:
 663                 return hci_inquiry(argp);
 664         }
 665
 666         lock_sock(sk);
 667
 668         err = hci_sock_bound_ioctl(sk, cmd, arg);
 669
 670 done:
 671         release_sock(sk);
 672         return err;
 673 }
 674
 675 static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
 676                          int addr_len)
 677 {
 678         struct sockaddr_hci haddr;
 679         struct sock *sk = sock->sk;
 680         struct hci_dev *hdev = NULL;
 681         int len, err = 0;
 682
 683         BT_DBG("sock %p sk %p", sock, sk);
 684
 685         if (!addr)
 686                 return -EINVAL;
 687
 688         memset(&haddr, 0, sizeof(haddr));
 689         len = min_t(unsigned int, sizeof(haddr), addr_len);
 690         memcpy(&haddr, addr, len);
 691
 692         if (haddr.hci_family != AF_BLUETOOTH)
 693                 return -EINVAL;
 694
 695         lock_sock(sk);
 696
 697         if (sk->sk_state == BT_BOUND) {
 698                 err = -EALREADY;
 699                 goto done;
 700         }
 701
 702         switch (haddr.hci_channel) {
 703         case HCI_CHANNEL_RAW:
 704                 if (hci_pi(sk)->hdev) {
 705                         err = -EALREADY;
 706                         goto done;
 707                 }
 708
 709                 if (haddr.hci_dev != HCI_DEV_NONE) {
 710                         hdev = hci_dev_get(haddr.hci_dev);
 711                         if (!hdev) {
 712                                 err = -ENODEV;
 713                                 goto done;
 714                         }
 715
 716                         atomic_inc(&hdev->promisc);
 717                 }
 718
 719                 hci_pi(sk)->hdev = hdev;
 720                 break;
 721
 722         case HCI_CHANNEL_USER:
 723                 if (hci_pi(sk)->hdev) {
 724                         err = -EALREADY;
 725                         goto done;
 726                 }
 727
 728                 if (haddr.hci_dev == HCI_DEV_NONE) {
 729                         err = -EINVAL;
 730                         goto done;
 731                 }
 732
 733                 if (!capable(CAP_NET_ADMIN)) {
 734                         err = -EPERM;
 735                         goto done;
 736                 }
 737
 738                 hdev = hci_dev_get(haddr.hci_dev);
 739                 if (!hdev) {
 740                         err = -ENODEV;
 741                         goto done;
 742                 }
 743
 744                 if (test_bit(HCI_UP, &hdev->flags) ||
 745                     test_bit(HCI_INIT, &hdev->flags) ||
 746                     hci_dev_test_flag(hdev, HCI_SETUP) ||
 747                     hci_dev_test_flag(hdev, HCI_CONFIG)) {
 748                         err = -EBUSY;
 749                         hci_dev_put(hdev);
 750                         goto done;
 751                 }
 752
 753                 if (hci_dev_test_and_set_flag(hdev, HCI_USER_CHANNEL)) {
 754                         err = -EUSERS;
 755                         hci_dev_put(hdev);
 756                         goto done;
 757                 }
 758
 759                 mgmt_index_removed(hdev);
 760
 761                 err = hci_dev_open(hdev->id);
 762                 if (err) {
 763                         hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
 764                         mgmt_index_added(hdev);
 765                         hci_dev_put(hdev);
 766                         goto done;
 767                 }
 768
 769                 atomic_inc(&hdev->promisc);
 770
 771                 hci_pi(sk)->hdev = hdev;
 772                 break;
 773
 774         case HCI_CHANNEL_MONITOR:
 775                 if (haddr.hci_dev != HCI_DEV_NONE) {
 776                         err = -EINVAL;
 777                         goto done;
 778                 }
 779
 780                 if (!capable(CAP_NET_RAW)) {
 781                         err = -EPERM;
 782                         goto done;
 783                 }
 784
 785                 /* The monitor interface is restricted to CAP_NET_RAW
 786                  * capabilities and with that implicitly trusted.
 787                  */
 788                 hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
 789
 790                 send_monitor_replay(sk);
 791
 792                 atomic_inc(&monitor_promisc);
 793                 break;
 794
 795         default:
 796                 if (!hci_mgmt_chan_find(haddr.hci_channel)) {
 797                         err = -EINVAL;
 798                         goto done;
 799                 }
 800
 801                 if (haddr.hci_dev != HCI_DEV_NONE) {
 802                         err = -EINVAL;
 803                         goto done;
 804                 }
 805
 806                 /* Users with CAP_NET_ADMIN capabilities are allowed
 807                  * access to all management commands and events. For
 808                  * untrusted users the interface is restricted and
 809                  * also only untrusted events are sent.
 810                  */
 811                 if (capable(CAP_NET_ADMIN))
 812                         hci_sock_set_flag(sk, HCI_SOCK_TRUSTED);
 813
 814                 /* At the moment the index and unconfigured index events
 815                  * are enabled unconditionally. Setting them on each
 816                  * socket when binding keeps this functionality. They
 817                  * however might be cleared later and then sending of these
 818                  * events will be disabled, but that is then intentional.
 819                  *
 820                  * This also enables generic events that are safe to be
 821                  * received by untrusted users. Example for such events
 822                  * are changes to settings, class of device, name etc.
 823                  */
 824                 if (haddr.hci_channel == HCI_CHANNEL_CONTROL) {
 825                         hci_sock_set_flag(sk, HCI_MGMT_INDEX_EVENTS);
 826                         hci_sock_set_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS);
 827                         hci_sock_set_flag(sk, HCI_MGMT_GENERIC_EVENTS);
 828                 }
 829                 break;
 830         }
 831
 832
 833         hci_pi(sk)->channel = haddr.hci_channel;
 834         sk->sk_state = BT_BOUND;
 835
 836 done:
 837         release_sock(sk);
 838         return err;
 839 }
 840
 841 static int hci_sock_getname(struct socket *sock, struct sockaddr *addr,
 842                             int *addr_len, int peer)
 843 {
 844         struct sockaddr_hci *haddr = (struct sockaddr_hci *) addr;
 845         struct sock *sk = sock->sk;
 846         struct hci_dev *hdev;
 847         int err = 0;
 848
 849         BT_DBG("sock %p sk %p", sock, sk);
 850
 851         if (peer)
 852                 return -EOPNOTSUPP;
 853
 854         lock_sock(sk);
 855
 856         hdev = hci_pi(sk)->hdev;
 857         if (!hdev) {
 858                 err = -EBADFD;
 859                 goto done;
 860         }
 861
 862         *addr_len = sizeof(*haddr);
 863         haddr->hci_family = AF_BLUETOOTH;
 864         haddr->hci_dev    = hdev->id;
 865         haddr->hci_channel= hci_pi(sk)->channel;
 866
 867 done:
 868         release_sock(sk);
 869         return err;
 870 }
 871
 872 static void hci_sock_cmsg(struct sock *sk, struct msghdr *msg,
 873                           struct sk_buff *skb)
 874 {
 875         __u32 mask = hci_pi(sk)->cmsg_mask;
 876
 877         if (mask & HCI_CMSG_DIR) {
 878                 int incoming = bt_cb(skb)->incoming;
 879                 put_cmsg(msg, SOL_HCI, HCI_CMSG_DIR, sizeof(incoming),
 880                          &incoming);
 881         }
 882
 883         if (mask & HCI_CMSG_TSTAMP) {
 884 #ifdef CONFIG_COMPAT
 885                 struct compat_timeval ctv;
 886 #endif
 887                 struct timeval tv;
 888                 void *data;
 889                 int len;
 890
 891                 skb_get_timestamp(skb, &tv);
 892
 893                 data = &tv;
 894                 len = sizeof(tv);
 895 #ifdef CONFIG_COMPAT
 896                 if (!COMPAT_USE_64BIT_TIME &&
 897                     (msg->msg_flags & MSG_CMSG_COMPAT)) {
 898                         ctv.tv_sec = tv.tv_sec;
 899                         ctv.tv_usec = tv.tv_usec;
 900                         data = &ctv;
 901                         len = sizeof(ctv);
 902                 }
 903 #endif
 904
 905                 put_cmsg(msg, SOL_HCI, HCI_CMSG_TSTAMP, len, data);
 906         }
 907 }
 908
 909 static int hci_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
 910                             int flags)
 911 {
 912         int noblock = flags & MSG_DONTWAIT;
 913         struct sock *sk = sock->sk;
 914         struct sk_buff *skb;
 915         int copied, err;
 916
 917         BT_DBG("sock %p, sk %p", sock, sk);
 918
 919         if (flags & (MSG_OOB))
 920                 return -EOPNOTSUPP;
 921
 922         if (sk->sk_state == BT_CLOSED)
 923                 return 0;
 924
 925         skb = skb_recv_datagram(sk, flags, noblock, &err);
 926         if (!skb)
 927                 return err;
 928
 929         copied = skb->len;
 930         if (len < copied) {
 931                 msg->msg_flags |= MSG_TRUNC;
 932                 copied = len;
 933         }
 934
 935         skb_reset_transport_header(skb);
 936         err = skb_copy_datagram_msg(skb, 0, msg, copied);
 937
 938         switch (hci_pi(sk)->channel) {
 939         case HCI_CHANNEL_RAW:
 940                 hci_sock_cmsg(sk, msg, skb);
 941                 break;
 942         case HCI_CHANNEL_USER:
 943         case HCI_CHANNEL_MONITOR:
 944                 sock_recv_timestamp(msg, sk, skb);
 945                 break;
 946         default:
 947                 if (hci_mgmt_chan_find(hci_pi(sk)->channel))
 948                         sock_recv_timestamp(msg, sk, skb);
 949                 break;
 950         }
 951
 952         skb_free_datagram(sk, skb);
 953
 954         return err ? : copied;
 955 }
 956
 957 static int hci_mgmt_cmd(struct hci_mgmt_chan *chan, struct sock *sk,
 958                         struct msghdr *msg, size_t msglen)
 959 {
 960         void *buf;
 961         u8 *cp;
 962         struct mgmt_hdr *hdr;
 963         u16 opcode, index, len;
 964         struct hci_dev *hdev = NULL;
 965         const struct hci_mgmt_handler *handler;
 966         bool var_len, no_hdev;
 967         int err;
 968
 969         BT_DBG("got %zu bytes", msglen);
 970
 971         if (msglen < sizeof(*hdr))
 972                 return -EINVAL;
 973
 974         buf = kmalloc(msglen, GFP_KERNEL);
 975         if (!buf)
 976                 return -ENOMEM;
 977
 978         if (memcpy_from_msg(buf, msg, msglen)) {
 979                 err = -EFAULT;
 980                 goto done;
 981         }
 982
 983         hdr = buf;
 984         opcode = __le16_to_cpu(hdr->opcode);
 985         index = __le16_to_cpu(hdr->index);
 986         len = __le16_to_cpu(hdr->len);
 987
 988         if (len != msglen - sizeof(*hdr)) {
 989                 err = -EINVAL;
 990                 goto done;
 991         }
 992
 993         if (opcode >= chan->handler_count ||
 994             chan->handlers[opcode].func == NULL) {
 995                 BT_DBG("Unknown op %u", opcode);
 996                 err = mgmt_cmd_status(sk, index, opcode,
 997                                       MGMT_STATUS_UNKNOWN_COMMAND);
 998                 goto done;
 999         }
1000
1001         handler = &chan->handlers[opcode];
1002
1003         if (!hci_sock_test_flag(sk, HCI_SOCK_TRUSTED) &&
1004             !(handler->flags & HCI_MGMT_UNTRUSTED)) {
1005                 err = mgmt_cmd_status(sk, index, opcode,
1006                                       MGMT_STATUS_PERMISSION_DENIED);
1007                 goto done;
1008         }
1009
1010         if (index != MGMT_INDEX_NONE) {
1011                 hdev = hci_dev_get(index);
1012                 if (!hdev) {
1013                         err = mgmt_cmd_status(sk, index, opcode,
1014                                               MGMT_STATUS_INVALID_INDEX);
1015                         goto done;
1016                 }
1017
1018                 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1019                     hci_dev_test_flag(hdev, HCI_CONFIG) ||
1020                     hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1021                         err = mgmt_cmd_status(sk, index, opcode,
1022                                               MGMT_STATUS_INVALID_INDEX);
1023                         goto done;
1024                 }
1025
1026                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1027                     !(handler->flags & HCI_MGMT_UNCONFIGURED)) {
1028                         err = mgmt_cmd_status(sk, index, opcode,
1029                                               MGMT_STATUS_INVALID_INDEX);
1030                         goto done;
1031                 }
1032         }
1033
1034         no_hdev = (handler->flags & HCI_MGMT_NO_HDEV);
1035         if (no_hdev != !hdev) {
1036                 err = mgmt_cmd_status(sk, index, opcode,
1037                                       MGMT_STATUS_INVALID_INDEX);
1038                 goto done;
1039         }
1040
1041         var_len = (handler->flags & HCI_MGMT_VAR_LEN);
1042         if ((var_len && len < handler->data_len) ||
1043             (!var_len && len != handler->data_len)) {
1044                 err = mgmt_cmd_status(sk, index, opcode,
1045                                       MGMT_STATUS_INVALID_PARAMS);
1046                 goto done;
1047         }
1048
1049         if (hdev && chan->hdev_init)
1050                 chan->hdev_init(sk, hdev);
1051
1052         cp = buf + sizeof(*hdr);
1053
1054         err = handler->func(sk, hdev, cp, len);
1055         if (err < 0)
1056                 goto done;
1057
1058         err = msglen;
1059
1060 done:
1061         if (hdev)
1062                 hci_dev_put(hdev);
1063
1064         kfree(buf);
1065         return err;
1066 }
1067
1068 static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
1069                             size_t len)
1070 {
1071         struct sock *sk = sock->sk;
1072         struct hci_mgmt_chan *chan;
1073         struct hci_dev *hdev;
1074         struct sk_buff *skb;
1075         int err;
1076
1077         BT_DBG("sock %p sk %p", sock, sk);
1078
1079         if (msg->msg_flags & MSG_OOB)
1080                 return -EOPNOTSUPP;
1081
1082         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
1083                 return -EINVAL;
1084
1085         if (len < 4 || len > HCI_MAX_FRAME_SIZE)
1086                 return -EINVAL;
1087
1088         lock_sock(sk);
1089
1090         switch (hci_pi(sk)->channel) {
1091         case HCI_CHANNEL_RAW:
1092         case HCI_CHANNEL_USER:
1093                 break;
1094         case HCI_CHANNEL_MONITOR:
1095                 err = -EOPNOTSUPP;
1096                 goto done;
1097         default:
1098                 mutex_lock(&mgmt_chan_list_lock);
1099                 chan = __hci_mgmt_chan_find(hci_pi(sk)->channel);
1100                 if (chan)
1101                         err = hci_mgmt_cmd(chan, sk, msg, len);
1102                 else
1103                         err = -EINVAL;
1104
1105                 mutex_unlock(&mgmt_chan_list_lock);
1106                 goto done;
1107         }
1108
1109         hdev = hci_pi(sk)->hdev;
1110         if (!hdev) {
1111                 err = -EBADFD;
1112                 goto done;
1113         }
1114
1115         if (!test_bit(HCI_UP, &hdev->flags)) {
1116                 err = -ENETDOWN;
1117                 goto done;
1118         }
1119
1120         skb = bt_skb_send_alloc(sk, len, msg->msg_flags & MSG_DONTWAIT, &err);
1121         if (!skb)
1122                 goto done;
1123
1124         if (memcpy_from_msg(skb_put(skb, len), msg, len)) {
1125                 err = -EFAULT;
1126                 goto drop;
1127         }
1128
1129         bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
1130         skb_pull(skb, 1);
1131
1132         if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
1133                 /* No permission check is needed for user channel
1134                  * since that gets enforced when binding the socket.
1135                  *
1136                  * However check that the packet type is valid.
1137                  */
1138                 if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
1139                     bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
1140                     bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
1141                         err = -EINVAL;
1142                         goto drop;
1143                 }
1144
1145                 skb_queue_tail(&hdev->raw_q, skb);
1146                 queue_work(hdev->workqueue, &hdev->tx_work);
1147         } else if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
1148                 u16 opcode = get_unaligned_le16(skb->data);
1149                 u16 ogf = hci_opcode_ogf(opcode);
1150                 u16 ocf = hci_opcode_ocf(opcode);
1151
1152                 if (((ogf > HCI_SFLT_MAX_OGF) ||
1153                      !hci_test_bit(ocf & HCI_FLT_OCF_BITS,
1154                                    &hci_sec_filter.ocf_mask[ogf])) &&
1155                     !capable(CAP_NET_RAW)) {
1156                         err = -EPERM;
1157                         goto drop;
1158                 }
1159
1160                 if (ogf == 0x3f) {
1161                         skb_queue_tail(&hdev->raw_q, skb);
1162                         queue_work(hdev->workqueue, &hdev->tx_work);
1163                 } else {
1164                         /* Stand-alone HCI commands must be flagged as
1165                          * single-command requests.
1166                          */
1167                         bt_cb(skb)->req.start = true;
1168
1169                         skb_queue_tail(&hdev->cmd_q, skb);
1170                         queue_work(hdev->workqueue, &hdev->cmd_work);
1171                 }
1172         } else {
1173                 if (!capable(CAP_NET_RAW)) {
1174                         err = -EPERM;
1175                         goto drop;
1176                 }
1177
1178                 skb_queue_tail(&hdev->raw_q, skb);
1179                 queue_work(hdev->workqueue, &hdev->tx_work);
1180         }
1181
1182         err = len;
1183
1184 done:
1185         release_sock(sk);
1186         return err;
1187
1188 drop:
1189         kfree_skb(skb);
1190         goto done;
1191 }
1192
1193 static int hci_sock_setsockopt(struct socket *sock, int level, int optname,
1194                                char __user *optval, unsigned int len)
1195 {
1196         struct hci_ufilter uf = { .opcode = 0 };
1197         struct sock *sk = sock->sk;
1198         int err = 0, opt = 0;
1199
1200         BT_DBG("sk %p, opt %d", sk, optname);
1201
1202         lock_sock(sk);
1203
1204         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1205                 err = -EBADFD;
1206                 goto done;
1207         }
1208
1209         switch (optname) {
1210         case HCI_DATA_DIR:
1211                 if (get_user(opt, (int __user *)optval)) {
1212                         err = -EFAULT;
1213                         break;
1214                 }
1215
1216                 if (opt)
1217                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_DIR;
1218                 else
1219                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_DIR;
1220                 break;
1221
1222         case HCI_TIME_STAMP:
1223                 if (get_user(opt, (int __user *)optval)) {
1224                         err = -EFAULT;
1225                         break;
1226                 }
1227
1228                 if (opt)
1229                         hci_pi(sk)->cmsg_mask |= HCI_CMSG_TSTAMP;
1230                 else
1231                         hci_pi(sk)->cmsg_mask &= ~HCI_CMSG_TSTAMP;
1232                 break;
1233
1234         case HCI_FILTER:
1235                 {
1236                         struct hci_filter *f = &hci_pi(sk)->filter;
1237
1238                         uf.type_mask = f->type_mask;
1239                         uf.opcode    = f->opcode;
1240                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1241                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1242                 }
1243
1244                 len = min_t(unsigned int, len, sizeof(uf));
1245                 if (copy_from_user(&uf, optval, len)) {
1246                         err = -EFAULT;
1247                         break;
1248                 }
1249
1250                 if (!capable(CAP_NET_RAW)) {
1251                         uf.type_mask &= hci_sec_filter.type_mask;
1252                         uf.event_mask[0] &= *((u32 *) hci_sec_filter.event_mask + 0);
1253                         uf.event_mask[1] &= *((u32 *) hci_sec_filter.event_mask + 1);
1254                 }
1255
1256                 {
1257                         struct hci_filter *f = &hci_pi(sk)->filter;
1258
1259                         f->type_mask = uf.type_mask;
1260                         f->opcode    = uf.opcode;
1261                         *((u32 *) f->event_mask + 0) = uf.event_mask[0];
1262                         *((u32 *) f->event_mask + 1) = uf.event_mask[1];
1263                 }
1264                 break;
1265
1266         default:
1267                 err = -ENOPROTOOPT;
1268                 break;
1269         }
1270
1271 done:
1272         release_sock(sk);
1273         return err;
1274 }
1275
1276 static int hci_sock_getsockopt(struct socket *sock, int level, int optname,
1277                                char __user *optval, int __user *optlen)
1278 {
1279         struct hci_ufilter uf;
1280         struct sock *sk = sock->sk;
1281         int len, opt, err = 0;
1282
1283         BT_DBG("sk %p, opt %d", sk, optname);
1284
1285         if (get_user(len, optlen))
1286                 return -EFAULT;
1287
1288         lock_sock(sk);
1289
1290         if (hci_pi(sk)->channel != HCI_CHANNEL_RAW) {
1291                 err = -EBADFD;
1292                 goto done;
1293         }
1294
1295         switch (optname) {
1296         case HCI_DATA_DIR:
1297                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_DIR)
1298                         opt = 1;
1299                 else
1300                         opt = 0;
1301
1302                 if (put_user(opt, optval))
1303                         err = -EFAULT;
1304                 break;
1305
1306         case HCI_TIME_STAMP:
1307                 if (hci_pi(sk)->cmsg_mask & HCI_CMSG_TSTAMP)
1308                         opt = 1;
1309                 else
1310                         opt = 0;
1311
1312                 if (put_user(opt, optval))
1313                         err = -EFAULT;
1314                 break;
1315
1316         case HCI_FILTER:
1317                 {
1318                         struct hci_filter *f = &hci_pi(sk)->filter;
1319
1320                         memset(&uf, 0, sizeof(uf));
1321                         uf.type_mask = f->type_mask;
1322                         uf.opcode    = f->opcode;
1323                         uf.event_mask[0] = *((u32 *) f->event_mask + 0);
1324                         uf.event_mask[1] = *((u32 *) f->event_mask + 1);
1325                 }
1326
1327                 len = min_t(unsigned int, len, sizeof(uf));
1328                 if (copy_to_user(optval, &uf, len))
1329                         err = -EFAULT;
1330                 break;
1331
1332         default:
1333                 err = -ENOPROTOOPT;
1334                 break;
1335         }
1336
1337 done:
1338         release_sock(sk);
1339         return err;
1340 }
1341
1342 static const struct proto_ops hci_sock_ops = {
1343         .family         = PF_BLUETOOTH,
1344         .owner          = THIS_MODULE,
1345         .release        = hci_sock_release,
1346         .bind           = hci_sock_bind,
1347         .getname        = hci_sock_getname,
1348         .sendmsg        = hci_sock_sendmsg,
1349         .recvmsg        = hci_sock_recvmsg,
1350         .ioctl          = hci_sock_ioctl,
1351         .poll           = datagram_poll,
1352         .listen         = sock_no_listen,
1353         .shutdown       = sock_no_shutdown,
1354         .setsockopt     = hci_sock_setsockopt,
1355         .getsockopt     = hci_sock_getsockopt,
1356         .connect        = sock_no_connect,
1357         .socketpair     = sock_no_socketpair,
1358         .accept         = sock_no_accept,
1359         .mmap           = sock_no_mmap
1360 };
1361
1362 static struct proto hci_sk_proto = {
1363         .name           = "HCI",
1364         .owner          = THIS_MODULE,
1365         .obj_size       = sizeof(struct hci_pinfo)
1366 };
1367
1368 static int hci_sock_create(struct net *net, struct socket *sock, int protocol,
1369                            int kern)
1370 {
1371         struct sock *sk;
1372
1373         BT_DBG("sock %p", sock);
1374
1375         if (sock->type != SOCK_RAW)
1376                 return -ESOCKTNOSUPPORT;
1377
1378         sock->ops = &hci_sock_ops;
1379
1380         sk = sk_alloc(net, PF_BLUETOOTH, GFP_ATOMIC, &hci_sk_proto);
1381         if (!sk)
1382                 return -ENOMEM;
1383
1384         sock_init_data(sock, sk);
1385
1386         sock_reset_flag(sk, SOCK_ZAPPED);
1387
1388         sk->sk_protocol = protocol;
1389
1390         sock->state = SS_UNCONNECTED;
1391         sk->sk_state = BT_OPEN;
1392
1393         bt_sock_link(&hci_sk_list, sk);
1394         return 0;
1395 }
1396
1397 static const struct net_proto_family hci_sock_family_ops = {
1398         .family = PF_BLUETOOTH,
1399         .owner  = THIS_MODULE,
1400         .create = hci_sock_create,
1401 };
1402
1403 int __init hci_sock_init(void)
1404 {
1405         int err;
1406
1407         BUILD_BUG_ON(sizeof(struct sockaddr_hci) > sizeof(struct sockaddr));
1408
1409         err = proto_register(&hci_sk_proto, 0);
1410         if (err < 0)
1411                 return err;
1412
1413         err = bt_sock_register(BTPROTO_HCI, &hci_sock_family_ops);
1414         if (err < 0) {
1415                 BT_ERR("HCI socket registration failed");
1416                 goto error;
1417         }
1418
1419         err = bt_procfs_init(&init_net, "hci", &hci_sk_list, NULL);
1420         if (err < 0) {
1421                 BT_ERR("Failed to create HCI proc file");
1422                 bt_sock_unregister(BTPROTO_HCI);
1423                 goto error;
1424         }
1425
1426         BT_INFO("HCI socket layer initialized");
1427
1428         return 0;
1429
1430 error:
1431         proto_unregister(&hci_sk_proto);
1432         return err;
1433 }
1434
1435 void hci_sock_cleanup(void)
1436 {
1437         bt_procfs_cleanup(&init_net, "hci");
1438         bt_sock_unregister(BTPROTO_HCI);
1439         proto_unregister(&hci_sk_proto);
1440 }