1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4 
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6 
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10 
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24 
25 /* Bluetooth address family and sockets. */
26 
27 #include <linux/module.h>
28 #include <linux/debugfs.h>
29 #include <linux/stringify.h>
30 #include <linux/sched/signal.h>
31 
32 #include <asm/ioctls.h>
33 
34 #include <net/bluetooth/bluetooth.h>
35 #include <linux/proc_fs.h>
36 
37 #include <linux/ethtool.h>
38 #include <linux/sockios.h>
39 
40 #include "leds.h"
41 #include "selftest.h"
42 
43 /* Bluetooth sockets */
44 #define BT_MAX_PROTO	(BTPROTO_LAST + 1)
45 static const struct net_proto_family *bt_proto[BT_MAX_PROTO];
46 static DEFINE_RWLOCK(bt_proto_lock);
47 
48 static struct lock_class_key bt_lock_key[BT_MAX_PROTO];
49 static const char *const bt_key_strings[BT_MAX_PROTO] = {
50 	"sk_lock-AF_BLUETOOTH-BTPROTO_L2CAP",
51 	"sk_lock-AF_BLUETOOTH-BTPROTO_HCI",
52 	"sk_lock-AF_BLUETOOTH-BTPROTO_SCO",
53 	"sk_lock-AF_BLUETOOTH-BTPROTO_RFCOMM",
54 	"sk_lock-AF_BLUETOOTH-BTPROTO_BNEP",
55 	"sk_lock-AF_BLUETOOTH-BTPROTO_CMTP",
56 	"sk_lock-AF_BLUETOOTH-BTPROTO_HIDP",
57 	"sk_lock-AF_BLUETOOTH-BTPROTO_AVDTP",
58 	"sk_lock-AF_BLUETOOTH-BTPROTO_ISO",
59 };
60 
61 static struct lock_class_key bt_slock_key[BT_MAX_PROTO];
62 static const char *const bt_slock_key_strings[BT_MAX_PROTO] = {
63 	"slock-AF_BLUETOOTH-BTPROTO_L2CAP",
64 	"slock-AF_BLUETOOTH-BTPROTO_HCI",
65 	"slock-AF_BLUETOOTH-BTPROTO_SCO",
66 	"slock-AF_BLUETOOTH-BTPROTO_RFCOMM",
67 	"slock-AF_BLUETOOTH-BTPROTO_BNEP",
68 	"slock-AF_BLUETOOTH-BTPROTO_CMTP",
69 	"slock-AF_BLUETOOTH-BTPROTO_HIDP",
70 	"slock-AF_BLUETOOTH-BTPROTO_AVDTP",
71 	"slock-AF_BLUETOOTH-BTPROTO_ISO",
72 };
73 
74 void bt_sock_reclassify_lock(struct sock *sk, int proto)
75 {
76 	BUG_ON(!sk);
77 	BUG_ON(!sock_allow_reclassification(sk));
78 
79 	sock_lock_init_class_and_name(sk,
80 				      bt_slock_key_strings[proto], &bt_slock_key[proto],
81 				      bt_key_strings[proto], &bt_lock_key[proto]);
82 }
83 EXPORT_SYMBOL(bt_sock_reclassify_lock);
84 
85 int bt_sock_register(int proto, const struct net_proto_family *ops)
86 {
87 	int err = 0;
88 
89 	if (proto < 0 || proto >= BT_MAX_PROTO)
90 		return -EINVAL;
91 
92 	write_lock(&bt_proto_lock);
93 
94 	if (bt_proto[proto])
95 		err = -EEXIST;
96 	else
97 		bt_proto[proto] = ops;
98 
99 	write_unlock(&bt_proto_lock);
100 
101 	return err;
102 }
103 EXPORT_SYMBOL(bt_sock_register);
104 
105 void bt_sock_unregister(int proto)
106 {
107 	if (proto < 0 || proto >= BT_MAX_PROTO)
108 		return;
109 
110 	write_lock(&bt_proto_lock);
111 	bt_proto[proto] = NULL;
112 	write_unlock(&bt_proto_lock);
113 }
114 EXPORT_SYMBOL(bt_sock_unregister);
115 
116 static int bt_sock_create(struct net *net, struct socket *sock, int proto,
117 			  int kern)
118 {
119 	int err;
120 
121 	if (net != &init_net)
122 		return -EAFNOSUPPORT;
123 
124 	if (proto < 0 || proto >= BT_MAX_PROTO)
125 		return -EINVAL;
126 
127 	if (!bt_proto[proto])
128 		request_module("bt-proto-%d", proto);
129 
130 	err = -EPROTONOSUPPORT;
131 
132 	read_lock(&bt_proto_lock);
133 
134 	if (bt_proto[proto] && try_module_get(bt_proto[proto]->owner)) {
135 		err = bt_proto[proto]->create(net, sock, proto, kern);
136 		if (!err)
137 			bt_sock_reclassify_lock(sock->sk, proto);
138 		module_put(bt_proto[proto]->owner);
139 	}
140 
141 	read_unlock(&bt_proto_lock);
142 
143 	return err;
144 }
145 
146 struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
147 			   struct proto *prot, int proto, gfp_t prio, int kern)
148 {
149 	struct sock *sk;
150 
151 	sk = sk_alloc(net, PF_BLUETOOTH, prio, prot, kern);
152 	if (!sk)
153 		return NULL;
154 
155 	sock_init_data(sock, sk);
156 	INIT_LIST_HEAD(&bt_sk(sk)->accept_q);
157 
158 	sock_reset_flag(sk, SOCK_ZAPPED);
159 
160 	sk->sk_protocol = proto;
161 	sk->sk_state    = BT_OPEN;
162 
163 	/* Init peer information so it can be properly monitored */
164 	if (!kern) {
165 		spin_lock(&sk->sk_peer_lock);
166 		sk->sk_peer_pid  = get_pid(task_tgid(current));
167 		sk->sk_peer_cred = get_current_cred();
168 		spin_unlock(&sk->sk_peer_lock);
169 	}
170 
171 	return sk;
172 }
173 EXPORT_SYMBOL(bt_sock_alloc);
174 
175 void bt_sock_link(struct bt_sock_list *l, struct sock *sk)
176 {
177 	write_lock(&l->lock);
178 	sk_add_node(sk, &l->head);
179 	write_unlock(&l->lock);
180 }
181 EXPORT_SYMBOL(bt_sock_link);
182 
183 void bt_sock_unlink(struct bt_sock_list *l, struct sock *sk)
184 {
185 	write_lock(&l->lock);
186 	sk_del_node_init(sk);
187 	write_unlock(&l->lock);
188 }
189 EXPORT_SYMBOL(bt_sock_unlink);
190 
191 bool bt_sock_linked(struct bt_sock_list *l, struct sock *s)
192 {
193 	struct sock *sk;
194 
195 	if (!l || !s)
196 		return false;
197 
198 	read_lock(&l->lock);
199 
200 	sk_for_each(sk, &l->head) {
201 		if (s == sk) {
202 			read_unlock(&l->lock);
203 			return true;
204 		}
205 	}
206 
207 	read_unlock(&l->lock);
208 
209 	return false;
210 }
211 EXPORT_SYMBOL(bt_sock_linked);
212 
213 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
214 {
215 	const struct cred *old_cred;
216 	struct pid *old_pid;
217 
218 	BT_DBG("parent %p, sk %p", parent, sk);
219 
220 	sock_hold(sk);
221 
222 	if (bh)
223 		bh_lock_sock_nested(sk);
224 	else
225 		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
226 
227 	list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q);
228 	bt_sk(sk)->parent = parent;
229 
230 	/* Copy credentials from parent since for incoming connections the
231 	 * socket is allocated by the kernel.
232 	 */
233 	spin_lock(&sk->sk_peer_lock);
234 	old_pid = sk->sk_peer_pid;
235 	old_cred = sk->sk_peer_cred;
236 	sk->sk_peer_pid = get_pid(parent->sk_peer_pid);
237 	sk->sk_peer_cred = get_cred(parent->sk_peer_cred);
238 	spin_unlock(&sk->sk_peer_lock);
239 
240 	put_pid(old_pid);
241 	put_cred(old_cred);
242 
243 	if (bh)
244 		bh_unlock_sock(sk);
245 	else
246 		release_sock(sk);
247 
248 	sk_acceptq_added(parent);
249 }
250 EXPORT_SYMBOL(bt_accept_enqueue);
251 
252 /* Calling function must hold the sk lock.
253  * bt_sk(sk)->parent must be non-NULL meaning sk is in the parent list.
254  */
255 void bt_accept_unlink(struct sock *sk)
256 {
257 	BT_DBG("sk %p state %d", sk, sk->sk_state);
258 
259 	list_del_init(&bt_sk(sk)->accept_q);
260 	sk_acceptq_removed(bt_sk(sk)->parent);
261 	bt_sk(sk)->parent = NULL;
262 	sock_put(sk);
263 }
264 EXPORT_SYMBOL(bt_accept_unlink);
265 
266 struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
267 {
268 	struct bt_sock *s, *n;
269 	struct sock *sk;
270 
271 	BT_DBG("parent %p", parent);
272 
273 restart:
274 	list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) {
275 		sk = (struct sock *)s;
276 
277 		/* Prevent early freeing of sk due to unlink and sock_kill */
278 		sock_hold(sk);
279 		lock_sock(sk);
280 
281 		/* Check sk has not already been unlinked via
282 		 * bt_accept_unlink() due to serialisation caused by sk locking
283 		 */
284 		if (!bt_sk(sk)->parent) {
285 			BT_DBG("sk %p, already unlinked", sk);
286 			release_sock(sk);
287 			sock_put(sk);
288 
289 			/* Restart the loop as sk is no longer in the list
290 			 * and also avoid a potential infinite loop because
291 			 * list_for_each_entry_safe() is not thread safe.
292 			 */
293 			goto restart;
294 		}
295 
296 		/* sk is safely in the parent list so reduce reference count */
297 		sock_put(sk);
298 
299 		/* FIXME: Is this check still needed */
300 		if (sk->sk_state == BT_CLOSED) {
301 			bt_accept_unlink(sk);
302 			release_sock(sk);
303 			continue;
304 		}
305 
306 		if (sk->sk_state == BT_CONNECTED || !newsock ||
307 		    test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) {
308 			bt_accept_unlink(sk);
309 			if (newsock)
310 				sock_graft(sk, newsock);
311 
312 			release_sock(sk);
313 			return sk;
314 		}
315 
316 		release_sock(sk);
317 	}
318 
319 	return NULL;
320 }
321 EXPORT_SYMBOL(bt_accept_dequeue);
322 
323 int bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
324 		    int flags)
325 {
326 	struct sock *sk = sock->sk;
327 	struct sk_buff *skb;
328 	size_t copied;
329 	size_t skblen;
330 	int err;
331 
332 	BT_DBG("sock %p sk %p len %zu", sock, sk, len);
333 
334 	if (flags & MSG_OOB)
335 		return -EOPNOTSUPP;
336 
337 	skb = skb_recv_datagram(sk, flags, &err);
338 	if (!skb) {
339 		if (sk->sk_shutdown & RCV_SHUTDOWN)
340 			err = 0;
341 
342 		return err;
343 	}
344 
345 	skblen = skb->len;
346 	copied = skb->len;
347 	if (len < copied) {
348 		msg->msg_flags |= MSG_TRUNC;
349 		copied = len;
350 	}
351 
352 	skb_reset_transport_header(skb);
353 	err = skb_copy_datagram_msg(skb, 0, msg, copied);
354 	if (err == 0) {
355 		sock_recv_cmsgs(msg, sk, skb);
356 
357 		if (msg->msg_name && bt_sk(sk)->skb_msg_name)
358 			bt_sk(sk)->skb_msg_name(skb, msg->msg_name,
359 						&msg->msg_namelen);
360 
361 		if (test_bit(BT_SK_PKT_STATUS, &bt_sk(sk)->flags)) {
362 			u8 pkt_status = hci_skb_pkt_status(skb);
363 
364 			put_cmsg(msg, SOL_BLUETOOTH, BT_SCM_PKT_STATUS,
365 				 sizeof(pkt_status), &pkt_status);
366 		}
367 	}
368 
369 	skb_free_datagram(sk, skb);
370 
371 	if (flags & MSG_TRUNC)
372 		copied = skblen;
373 
374 	return err ? : copied;
375 }
376 EXPORT_SYMBOL(bt_sock_recvmsg);
377 
378 static long bt_sock_data_wait(struct sock *sk, long timeo)
379 {
380 	DECLARE_WAITQUEUE(wait, current);
381 
382 	add_wait_queue(sk_sleep(sk), &wait);
383 	for (;;) {
384 		set_current_state(TASK_INTERRUPTIBLE);
385 
386 		if (!skb_queue_empty(&sk->sk_receive_queue))
387 			break;
388 
389 		if (sk->sk_err || (sk->sk_shutdown & RCV_SHUTDOWN))
390 			break;
391 
392 		if (signal_pending(current) || !timeo)
393 			break;
394 
395 		sk_set_bit(SOCKWQ_ASYNC_WAITDATA, sk);
396 		release_sock(sk);
397 		timeo = schedule_timeout(timeo);
398 		lock_sock(sk);
399 		sk_clear_bit(SOCKWQ_ASYNC_WAITDATA, sk);
400 	}
401 
402 	__set_current_state(TASK_RUNNING);
403 	remove_wait_queue(sk_sleep(sk), &wait);
404 	return timeo;
405 }
406 
407 int bt_sock_stream_recvmsg(struct socket *sock, struct msghdr *msg,
408 			   size_t size, int flags)
409 {
410 	struct sock *sk = sock->sk;
411 	int err = 0;
412 	size_t target, copied = 0;
413 	long timeo;
414 
415 	if (flags & MSG_OOB)
416 		return -EOPNOTSUPP;
417 
418 	BT_DBG("sk %p size %zu", sk, size);
419 
420 	lock_sock(sk);
421 
422 	target = sock_rcvlowat(sk, flags & MSG_WAITALL, size);
423 	timeo  = sock_rcvtimeo(sk, flags & MSG_DONTWAIT);
424 
425 	do {
426 		struct sk_buff *skb;
427 		int chunk;
428 
429 		skb = skb_dequeue(&sk->sk_receive_queue);
430 		if (!skb) {
431 			if (copied >= target)
432 				break;
433 
434 			err = sock_error(sk);
435 			if (err)
436 				break;
437 			if (sk->sk_shutdown & RCV_SHUTDOWN)
438 				break;
439 
440 			err = -EAGAIN;
441 			if (!timeo)
442 				break;
443 
444 			timeo = bt_sock_data_wait(sk, timeo);
445 
446 			if (signal_pending(current)) {
447 				err = sock_intr_errno(timeo);
448 				goto out;
449 			}
450 			continue;
451 		}
452 
453 		chunk = min_t(unsigned int, skb->len, size);
454 		if (skb_copy_datagram_msg(skb, 0, msg, chunk)) {
455 			skb_queue_head(&sk->sk_receive_queue, skb);
456 			if (!copied)
457 				copied = -EFAULT;
458 			break;
459 		}
460 		copied += chunk;
461 		size   -= chunk;
462 
463 		sock_recv_cmsgs(msg, sk, skb);
464 
465 		if (!(flags & MSG_PEEK)) {
466 			int skb_len = skb_headlen(skb);
467 
468 			if (chunk <= skb_len) {
469 				__skb_pull(skb, chunk);
470 			} else {
471 				struct sk_buff *frag;
472 
473 				__skb_pull(skb, skb_len);
474 				chunk -= skb_len;
475 
476 				skb_walk_frags(skb, frag) {
477 					if (chunk <= frag->len) {
478 						/* Pulling partial data */
479 						skb->len -= chunk;
480 						skb->data_len -= chunk;
481 						__skb_pull(frag, chunk);
482 						break;
483 					} else if (frag->len) {
484 						/* Pulling all frag data */
485 						chunk -= frag->len;
486 						skb->len -= frag->len;
487 						skb->data_len -= frag->len;
488 						__skb_pull(frag, frag->len);
489 					}
490 				}
491 			}
492 
493 			if (skb->len) {
494 				skb_queue_head(&sk->sk_receive_queue, skb);
495 				break;
496 			}
497 			kfree_skb(skb);
498 
499 		} else {
500 			/* put message back and return */
501 			skb_queue_head(&sk->sk_receive_queue, skb);
502 			break;
503 		}
504 	} while (size);
505 
506 out:
507 	release_sock(sk);
508 	return copied ? : err;
509 }
510 EXPORT_SYMBOL(bt_sock_stream_recvmsg);
511 
512 static inline __poll_t bt_accept_poll(struct sock *parent)
513 {
514 	struct bt_sock *s, *n;
515 	struct sock *sk;
516 
517 	list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) {
518 		sk = (struct sock *)s;
519 		if (sk->sk_state == BT_CONNECTED ||
520 		    (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags) &&
521 		     sk->sk_state == BT_CONNECT2))
522 			return EPOLLIN | EPOLLRDNORM;
523 	}
524 
525 	return 0;
526 }
527 
528 __poll_t bt_sock_poll(struct file *file, struct socket *sock,
529 		      poll_table *wait)
530 {
531 	struct sock *sk = sock->sk;
532 	__poll_t mask = 0;
533 
534 	poll_wait(file, sk_sleep(sk), wait);
535 
536 	if (sk->sk_state == BT_LISTEN)
537 		return bt_accept_poll(sk);
538 
539 	if (sk->sk_err || !skb_queue_empty_lockless(&sk->sk_error_queue))
540 		mask |= EPOLLERR |
541 			(sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? EPOLLPRI : 0);
542 
543 	if (sk->sk_shutdown & RCV_SHUTDOWN)
544 		mask |= EPOLLRDHUP | EPOLLIN | EPOLLRDNORM;
545 
546 	if (sk->sk_shutdown == SHUTDOWN_MASK)
547 		mask |= EPOLLHUP;
548 
549 	if (!skb_queue_empty_lockless(&sk->sk_receive_queue))
550 		mask |= EPOLLIN | EPOLLRDNORM;
551 
552 	if (sk->sk_state == BT_CLOSED)
553 		mask |= EPOLLHUP;
554 
555 	if (sk->sk_state == BT_CONNECT ||
556 	    sk->sk_state == BT_CONNECT2 ||
557 	    sk->sk_state == BT_CONFIG)
558 		return mask;
559 
560 	if (!test_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags) && sock_writeable(sk))
561 		mask |= EPOLLOUT | EPOLLWRNORM | EPOLLWRBAND;
562 	else
563 		sk_set_bit(SOCKWQ_ASYNC_NOSPACE, sk);
564 
565 	return mask;
566 }
567 EXPORT_SYMBOL(bt_sock_poll);
568 
569 static int bt_ethtool_get_ts_info(struct sock *sk, unsigned int index,
570 				  void __user *useraddr)
571 {
572 	struct ethtool_ts_info info;
573 	struct kernel_ethtool_ts_info ts_info = {};
574 	int ret;
575 
576 	ret = hci_ethtool_ts_info(index, sk->sk_protocol, &ts_info);
577 	if (ret == -ENODEV)
578 		return ret;
579 	else if (ret < 0)
580 		return -EIO;
581 
582 	memset(&info, 0, sizeof(info));
583 
584 	info.cmd = ETHTOOL_GET_TS_INFO;
585 	info.so_timestamping = ts_info.so_timestamping;
586 	info.phc_index = ts_info.phc_index;
587 	info.tx_types = ts_info.tx_types;
588 	info.rx_filters = ts_info.rx_filters;
589 
590 	if (copy_to_user(useraddr, &info, sizeof(info)))
591 		return -EFAULT;
592 
593 	return 0;
594 }
595 
596 static int bt_ethtool(struct sock *sk, const struct ifreq *ifr,
597 		      void __user *useraddr)
598 {
599 	unsigned int index;
600 	u32 ethcmd;
601 	int n;
602 
603 	if (copy_from_user(&ethcmd, useraddr, sizeof(ethcmd)))
604 		return -EFAULT;
605 
606 	if (sscanf(ifr->ifr_name, "hci%u%n", &index, &n) != 1 ||
607 	    n != strlen(ifr->ifr_name))
608 		return -ENODEV;
609 
610 	switch (ethcmd) {
611 	case ETHTOOL_GET_TS_INFO:
612 		return bt_ethtool_get_ts_info(sk, index, useraddr);
613 	}
614 
615 	return -EOPNOTSUPP;
616 }
617 
618 static int bt_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
619 {
620 	struct sock *sk = sock->sk;
621 	struct ifreq ifr = {};
622 	void __user *data;
623 	char *colon;
624 	int ret = -ENOIOCTLCMD;
625 
626 	if (get_user_ifreq(&ifr, &data, arg))
627 		return -EFAULT;
628 
629 	ifr.ifr_name[IFNAMSIZ - 1] = 0;
630 	colon = strchr(ifr.ifr_name, ':');
631 	if (colon)
632 		*colon = 0;
633 
634 	switch (cmd) {
635 	case SIOCETHTOOL:
636 		ret = bt_ethtool(sk, &ifr, data);
637 		break;
638 	}
639 
640 	if (colon)
641 		*colon = ':';
642 
643 	if (put_user_ifreq(&ifr, arg))
644 		return -EFAULT;
645 
646 	return ret;
647 }
648 
649 int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
650 {
651 	struct sock *sk = sock->sk;
652 	struct sk_buff *skb;
653 	long amount;
654 	int err;
655 
656 	BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);
657 
658 	switch (cmd) {
659 	case TIOCOUTQ:
660 		if (sk->sk_state == BT_LISTEN)
661 			return -EINVAL;
662 
663 		amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
664 		if (amount < 0)
665 			amount = 0;
666 		err = put_user(amount, (int __user *)arg);
667 		break;
668 
669 	case TIOCINQ:
670 		if (sk->sk_state == BT_LISTEN)
671 			return -EINVAL;
672 
673 		spin_lock(&sk->sk_receive_queue.lock);
674 		skb = skb_peek(&sk->sk_receive_queue);
675 		amount = skb ? skb->len : 0;
676 		spin_unlock(&sk->sk_receive_queue.lock);
677 
678 		err = put_user(amount, (int __user *)arg);
679 		break;
680 
681 	case SIOCETHTOOL:
682 		err = bt_dev_ioctl(sock, cmd, (void __user *)arg);
683 		break;
684 
685 	default:
686 		err = -ENOIOCTLCMD;
687 		break;
688 	}
689 
690 	return err;
691 }
692 EXPORT_SYMBOL(bt_sock_ioctl);
693 
694 /* This function expects the sk lock to be held when called */
695 int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
696 {
697 	DECLARE_WAITQUEUE(wait, current);
698 	int err = 0;
699 
700 	BT_DBG("sk %p", sk);
701 
702 	add_wait_queue(sk_sleep(sk), &wait);
703 	set_current_state(TASK_INTERRUPTIBLE);
704 	while (sk->sk_state != state) {
705 		if (!timeo) {
706 			err = -EINPROGRESS;
707 			break;
708 		}
709 
710 		if (signal_pending(current)) {
711 			err = sock_intr_errno(timeo);
712 			break;
713 		}
714 
715 		release_sock(sk);
716 		timeo = schedule_timeout(timeo);
717 		lock_sock(sk);
718 		set_current_state(TASK_INTERRUPTIBLE);
719 
720 		err = sock_error(sk);
721 		if (err)
722 			break;
723 	}
724 	__set_current_state(TASK_RUNNING);
725 	remove_wait_queue(sk_sleep(sk), &wait);
726 	return err;
727 }
728 EXPORT_SYMBOL(bt_sock_wait_state);
729 
730 /* This function expects the sk lock to be held when called */
731 int bt_sock_wait_ready(struct sock *sk, unsigned int msg_flags)
732 {
733 	DECLARE_WAITQUEUE(wait, current);
734 	unsigned long timeo;
735 	int err = 0;
736 
737 	BT_DBG("sk %p", sk);
738 
739 	timeo = sock_sndtimeo(sk, !!(msg_flags & MSG_DONTWAIT));
740 
741 	add_wait_queue(sk_sleep(sk), &wait);
742 	set_current_state(TASK_INTERRUPTIBLE);
743 	while (test_bit(BT_SK_SUSPEND, &bt_sk(sk)->flags)) {
744 		if (!timeo) {
745 			err = -EAGAIN;
746 			break;
747 		}
748 
749 		if (signal_pending(current)) {
750 			err = sock_intr_errno(timeo);
751 			break;
752 		}
753 
754 		release_sock(sk);
755 		timeo = schedule_timeout(timeo);
756 		lock_sock(sk);
757 		set_current_state(TASK_INTERRUPTIBLE);
758 
759 		err = sock_error(sk);
760 		if (err)
761 			break;
762 	}
763 	__set_current_state(TASK_RUNNING);
764 	remove_wait_queue(sk_sleep(sk), &wait);
765 
766 	return err;
767 }
768 EXPORT_SYMBOL(bt_sock_wait_ready);
769 
770 #ifdef CONFIG_PROC_FS
771 static void *bt_seq_start(struct seq_file *seq, loff_t *pos)
772 	__acquires(seq->private->l->lock)
773 {
774 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
775 
776 	read_lock(&l->lock);
777 	return seq_hlist_start_head(&l->head, *pos);
778 }
779 
780 static void *bt_seq_next(struct seq_file *seq, void *v, loff_t *pos)
781 {
782 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
783 
784 	return seq_hlist_next(v, &l->head, pos);
785 }
786 
787 static void bt_seq_stop(struct seq_file *seq, void *v)
788 	__releases(seq->private->l->lock)
789 {
790 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
791 
792 	read_unlock(&l->lock);
793 }
794 
795 static int bt_seq_show(struct seq_file *seq, void *v)
796 {
797 	struct bt_sock_list *l = pde_data(file_inode(seq->file));
798 
799 	if (v == SEQ_START_TOKEN) {
800 		seq_puts(seq, "sk               RefCnt Rmem   Wmem   User   Inode  Parent");
801 
802 		if (l->custom_seq_show) {
803 			seq_putc(seq, ' ');
804 			l->custom_seq_show(seq, v);
805 		}
806 
807 		seq_putc(seq, '\n');
808 	} else {
809 		struct sock *sk = sk_entry(v);
810 		struct bt_sock *bt = bt_sk(sk);
811 
812 		seq_printf(seq,
813 			   "%pK %-6d %-6u %-6u %-6u %-6lu %-6lu",
814 			   sk,
815 			   refcount_read(&sk->sk_refcnt),
816 			   sk_rmem_alloc_get(sk),
817 			   sk_wmem_alloc_get(sk),
818 			   from_kuid(seq_user_ns(seq), sock_i_uid(sk)),
819 			   sock_i_ino(sk),
820 			   bt->parent ? sock_i_ino(bt->parent) : 0LU);
821 
822 		if (l->custom_seq_show) {
823 			seq_putc(seq, ' ');
824 			l->custom_seq_show(seq, v);
825 		}
826 
827 		seq_putc(seq, '\n');
828 	}
829 	return 0;
830 }
831 
832 static const struct seq_operations bt_seq_ops = {
833 	.start = bt_seq_start,
834 	.next  = bt_seq_next,
835 	.stop  = bt_seq_stop,
836 	.show  = bt_seq_show,
837 };
838 
839 int bt_procfs_init(struct net *net, const char *name,
840 		   struct bt_sock_list *sk_list,
841 		   int (*seq_show)(struct seq_file *, void *))
842 {
843 	sk_list->custom_seq_show = seq_show;
844 
845 	if (!proc_create_seq_data(name, 0, net->proc_net, &bt_seq_ops, sk_list))
846 		return -ENOMEM;
847 	return 0;
848 }
849 
850 void bt_procfs_cleanup(struct net *net, const char *name)
851 {
852 	remove_proc_entry(name, net->proc_net);
853 }
854 #else
855 int bt_procfs_init(struct net *net, const char *name,
856 		   struct bt_sock_list *sk_list,
857 		   int (*seq_show)(struct seq_file *, void *))
858 {
859 	return 0;
860 }
861 
862 void bt_procfs_cleanup(struct net *net, const char *name)
863 {
864 }
865 #endif
866 EXPORT_SYMBOL(bt_procfs_init);
867 EXPORT_SYMBOL(bt_procfs_cleanup);
868 
869 static const struct net_proto_family bt_sock_family_ops = {
870 	.owner	= THIS_MODULE,
871 	.family	= PF_BLUETOOTH,
872 	.create	= bt_sock_create,
873 };
874 
875 struct dentry *bt_debugfs;
876 EXPORT_SYMBOL_GPL(bt_debugfs);
877 
878 #define VERSION __stringify(BT_SUBSYS_VERSION) "." \
879 		__stringify(BT_SUBSYS_REVISION)
880 
881 static int __init bt_init(void)
882 {
883 	int err;
884 
885 	sock_skb_cb_check_size(sizeof(struct bt_skb_cb));
886 
887 	BT_INFO("Core ver %s", VERSION);
888 
889 	err = bt_selftest();
890 	if (err < 0)
891 		return err;
892 
893 	bt_debugfs = debugfs_create_dir("bluetooth", NULL);
894 
895 	bt_leds_init();
896 
897 	err = bt_sysfs_init();
898 	if (err < 0)
899 		goto cleanup_led;
900 
901 	err = sock_register(&bt_sock_family_ops);
902 	if (err)
903 		goto cleanup_sysfs;
904 
905 	BT_INFO("HCI device and connection manager initialized");
906 
907 	err = hci_sock_init();
908 	if (err)
909 		goto unregister_socket;
910 
911 	err = l2cap_init();
912 	if (err)
913 		goto cleanup_socket;
914 
915 	err = sco_init();
916 	if (err)
917 		goto cleanup_cap;
918 
919 	err = mgmt_init();
920 	if (err)
921 		goto cleanup_sco;
922 
923 	return 0;
924 
925 cleanup_sco:
926 	sco_exit();
927 cleanup_cap:
928 	l2cap_exit();
929 cleanup_socket:
930 	hci_sock_cleanup();
931 unregister_socket:
932 	sock_unregister(PF_BLUETOOTH);
933 cleanup_sysfs:
934 	bt_sysfs_cleanup();
935 cleanup_led:
936 	bt_leds_cleanup();
937 	debugfs_remove_recursive(bt_debugfs);
938 	return err;
939 }
940 
941 static void __exit bt_exit(void)
942 {
943 	iso_exit();
944 
945 	mgmt_exit();
946 
947 	sco_exit();
948 
949 	l2cap_exit();
950 
951 	hci_sock_cleanup();
952 
953 	sock_unregister(PF_BLUETOOTH);
954 
955 	bt_sysfs_cleanup();
956 
957 	bt_leds_cleanup();
958 
959 	debugfs_remove_recursive(bt_debugfs);
960 }
961 
962 subsys_initcall(bt_init);
963 module_exit(bt_exit);
964 
965 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
966 MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
967 MODULE_VERSION(VERSION);
968 MODULE_LICENSE("GPL");
969 MODULE_ALIAS_NETPROTO(PF_BLUETOOTH);
970