1 /* $NetBSD: hci_socket.c,v 1.48 2024/07/05 04:31:53 rin Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.48 2024/07/05 04:31:53 rin Exp $"); 35 36 /* load symbolic names */ 37 #ifdef BLUETOOTH_DEBUG 38 #define PRUREQUESTS 39 #define PRCOREQUESTS 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/domain.h> 44 #include <sys/kauth.h> 45 #include <sys/kernel.h> 46 #include <sys/kmem.h> 47 #include <sys/mbuf.h> 48 #include <sys/proc.h> 49 #include <sys/protosw.h> 50 #include <sys/socket.h> 51 #include <sys/socketvar.h> 52 #include <sys/systm.h> 53 54 #include <netbt/bluetooth.h> 55 #include <netbt/hci.h> 56 57 /******************************************************************************* 58 * 59 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 60 * 61 */ 62 63 /* 64 * the raw HCI protocol control block 65 */ 66 struct hci_pcb { 67 struct socket *hp_socket; /* socket */ 68 kauth_cred_t hp_cred; /* owner credential */ 69 unsigned int hp_flags; /* flags */ 70 bdaddr_t hp_laddr; /* local address */ 71 bdaddr_t hp_raddr; /* remote address */ 72 struct hci_filter hp_efilter; /* user event filter */ 73 struct hci_filter hp_pfilter; /* user packet filter */ 74 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 75 }; 76 77 /* hp_flags */ 78 #define HCI_DIRECTION (1<<1) /* direction control messages */ 79 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 80 81 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 82 83 /* sysctl defaults */ 84 int hci_sendspace = HCI_CMD_PKT_SIZE; 85 int hci_recvspace = 4096; 86 87 /* unprivileged commands opcode table */ 88 static const struct { 89 uint16_t opcode; 90 uint8_t offs; /* 0 - 63 */ 91 uint8_t mask; /* bit 0 - 7 */ 92 uint8_t length; /* approved length */ 93 } hci_cmds[] = { 94 { HCI_CMD_INQUIRY, 95 0, 0x01, sizeof(hci_inquiry_cp) }, 96 { HCI_CMD_REMOTE_NAME_REQ, 97 2, 0x08, sizeof(hci_remote_name_req_cp) }, 98 { HCI_CMD_READ_REMOTE_FEATURES, 99 2, 0x20, sizeof(hci_read_remote_features_cp) }, 100 { HCI_CMD_READ_REMOTE_EXTENDED_FEATURES, 101 2, 0x40, sizeof(hci_read_remote_extended_features_cp) }, 102 { HCI_CMD_READ_REMOTE_VER_INFO, 103 2, 0x80, sizeof(hci_read_remote_ver_info_cp) }, 104 { HCI_CMD_READ_CLOCK_OFFSET, 105 3, 0x01, sizeof(hci_read_clock_offset_cp) }, 106 { HCI_CMD_READ_LMP_HANDLE, 107 3, 0x02, sizeof(hci_read_lmp_handle_cp) }, 108 { HCI_CMD_ROLE_DISCOVERY, 109 4, 0x80, sizeof(hci_role_discovery_cp) }, 110 { HCI_CMD_READ_LINK_POLICY_SETTINGS, 111 5, 0x02, sizeof(hci_read_link_policy_settings_cp) }, 112 { HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS, 113 5, 0x08, 0 }, 114 { HCI_CMD_READ_PIN_TYPE, 115 6, 0x04, 0 }, 116 { HCI_CMD_READ_LOCAL_NAME, 117 7, 0x02, 0 }, 118 { HCI_CMD_READ_CON_ACCEPT_TIMEOUT, 119 7, 0x04, 0 }, 120 { HCI_CMD_READ_PAGE_TIMEOUT, 121 7, 0x10, 0 }, 122 { HCI_CMD_READ_SCAN_ENABLE, 123 7, 0x40, 0 }, 124 { HCI_CMD_READ_PAGE_SCAN_ACTIVITY, 125 8, 0x01, 0 }, 126 { HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY, 127 8, 0x04, 0 }, 128 { HCI_CMD_READ_AUTH_ENABLE, 129 8, 0x10, 0 }, 130 { HCI_CMD_READ_ENCRYPTION_MODE, 131 8, 0x40, 0 }, 132 { HCI_CMD_READ_UNIT_CLASS, 133 9, 0x01, 0 }, 134 { HCI_CMD_READ_VOICE_SETTING, 135 9, 0x04, 0 }, 136 { HCI_CMD_READ_AUTO_FLUSH_TIMEOUT, 137 9, 0x10, sizeof(hci_read_auto_flush_timeout_cp) }, 138 { HCI_CMD_READ_NUM_BROADCAST_RETRANS, 139 9, 0x40, 0 }, 140 { HCI_CMD_READ_HOLD_MODE_ACTIVITY, 141 10, 0x01, 0 }, 142 { HCI_CMD_READ_XMIT_LEVEL, 143 10, 0x04, sizeof(hci_read_xmit_level_cp) }, 144 { HCI_CMD_READ_SCO_FLOW_CONTROL, 145 10, 0x08, 0 }, 146 { HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT, 147 11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) }, 148 { HCI_CMD_READ_NUM_SUPPORTED_IAC, 149 11, 0x04, 0 }, 150 { HCI_CMD_READ_IAC_LAP, 151 11, 0x08, 0 }, 152 { HCI_CMD_READ_PAGE_SCAN_PERIOD, 153 11, 0x20, 0 }, 154 { HCI_CMD_READ_PAGE_SCAN, 155 11, 0x80, 0 }, 156 { HCI_CMD_READ_INQUIRY_SCAN_TYPE, 157 12, 0x10, 0 }, 158 { HCI_CMD_READ_INQUIRY_MODE, 159 12, 0x40, 0 }, 160 { HCI_CMD_READ_PAGE_SCAN_TYPE, 161 13, 0x01, 0 }, 162 { HCI_CMD_READ_AFH_ASSESSMENT, 163 13, 0x04, 0 }, 164 { HCI_CMD_READ_LOCAL_VER, 165 14, 0x08, 0 }, 166 { HCI_CMD_READ_LOCAL_COMMANDS, 167 14, 0x10, 0 }, 168 { HCI_CMD_READ_LOCAL_FEATURES, 169 14, 0x20, 0 }, 170 { HCI_CMD_READ_LOCAL_EXTENDED_FEATURES, 171 14, 0x40, sizeof(hci_read_local_extended_features_cp) }, 172 { HCI_CMD_READ_BUFFER_SIZE, 173 14, 0x80, 0 }, 174 { HCI_CMD_READ_COUNTRY_CODE, 175 15, 0x01, 0 }, 176 { HCI_CMD_READ_BDADDR, 177 15, 0x02, 0 }, 178 { HCI_CMD_READ_FAILED_CONTACT_CNTR, 179 15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) }, 180 { HCI_CMD_READ_LINK_QUALITY, 181 15, 0x10, sizeof(hci_read_link_quality_cp) }, 182 { HCI_CMD_READ_RSSI, 183 15, 0x20, sizeof(hci_read_rssi_cp) }, 184 { HCI_CMD_READ_AFH_CHANNEL_MAP, 185 15, 0x40, sizeof(hci_read_afh_channel_map_cp) }, 186 { HCI_CMD_READ_CLOCK, 187 15, 0x80, sizeof(hci_read_clock_cp) }, 188 { HCI_CMD_READ_LOOPBACK_MODE, 189 16, 0x01, 0 }, 190 { HCI_CMD_READ_EXTENDED_INQUIRY_RSP, 191 17, 0x01, 0 }, 192 { HCI_CMD_READ_SIMPLE_PAIRING_MODE, 193 17, 0x20, 0 }, 194 { HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER, 195 18, 0x01, 0 }, 196 { HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING, 197 18, 0x04, 0 }, 198 { HCI_CMD_READ_ENCRYPTION_KEY_SIZE, 199 20, 0x10, sizeof(hci_read_encryption_key_size_cp) }, 200 }; 201 202 /* 203 * supply a basic device send/recv policy 204 */ 205 static int 206 hci_device_cb(kauth_cred_t cred, kauth_action_t action, void *cookie, 207 void *arg0, void *arg1, void *arg2, void *arg3) 208 { 209 int i, result; 210 211 result = KAUTH_RESULT_DEFER; 212 213 switch (action) { 214 case KAUTH_DEVICE_BLUETOOTH_SEND: { 215 struct hci_unit *unit = (struct hci_unit *)arg0; 216 hci_cmd_hdr_t *hdr = (hci_cmd_hdr_t *)arg1; 217 218 /* 219 * Allow sending unprivileged commands if the packet size 220 * is correct and the unit claims to support it 221 */ 222 223 if (hdr->type != HCI_CMD_PKT) 224 break; 225 226 for (i = 0; i < __arraycount(hci_cmds); i++) { 227 if (hdr->opcode == hci_cmds[i].opcode 228 && hdr->length == hci_cmds[i].length 229 && (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) { 230 result = KAUTH_RESULT_ALLOW; 231 break; 232 } 233 } 234 235 break; 236 } 237 238 case KAUTH_DEVICE_BLUETOOTH_RECV: 239 switch((uint8_t)(uintptr_t)arg0) { 240 case HCI_CMD_PKT: { 241 uint16_t opcode = (uint16_t)(uintptr_t)arg1; 242 243 /* 244 * Allow to see any unprivileged command packet 245 */ 246 247 for (i = 0; i < __arraycount(hci_cmds); i++) { 248 if (opcode == hci_cmds[i].opcode) { 249 result = KAUTH_RESULT_ALLOW; 250 break; 251 } 252 } 253 254 break; 255 } 256 257 case HCI_EVENT_PKT: { 258 uint8_t event = (uint8_t)(uintptr_t)arg1; 259 260 /* 261 * Allow to receive most events 262 */ 263 264 switch (event) { 265 case HCI_EVENT_RETURN_LINK_KEYS: 266 case HCI_EVENT_LINK_KEY_NOTIFICATION: 267 case HCI_EVENT_USER_CONFIRM_REQ: 268 case HCI_EVENT_USER_PASSKEY_NOTIFICATION: 269 case HCI_EVENT_VENDOR: 270 break; 271 272 default: 273 result = KAUTH_RESULT_ALLOW; 274 break; 275 } 276 277 break; 278 } 279 280 case HCI_ACL_DATA_PKT: 281 case HCI_SCO_DATA_PKT: { 282 /* uint16_t handle = (uint16_t)(uintptr_t)arg1; */ 283 /* 284 * don't normally allow receiving data packets 285 */ 286 break; 287 } 288 289 default: 290 break; 291 } 292 293 break; 294 295 default: 296 break; 297 } 298 299 return result; 300 } 301 302 /* 303 * HCI protocol init routine, 304 * - set up a kauth listener to provide basic packet access policy 305 */ 306 void 307 hci_init(void) 308 { 309 310 if (kauth_listen_scope(KAUTH_SCOPE_DEVICE, hci_device_cb, NULL) == NULL) 311 panic("Bluetooth HCI: cannot listen on device scope"); 312 } 313 314 /* 315 * When command packet reaches the device, we can drop 316 * it from the socket buffer (called from hci_output_acl) 317 */ 318 void 319 hci_drop(void *arg) 320 { 321 struct socket *so = arg; 322 323 sbdroprecord(&so->so_snd); 324 sowwakeup(so); 325 } 326 327 /* 328 * HCI socket is going away and has some pending packets. We let them 329 * go by design, but remove the context pointer as it will be invalid 330 * and we no longer need to be notified. 331 */ 332 static void 333 hci_cmdwait_flush(struct socket *so) 334 { 335 struct hci_unit *unit; 336 struct socket *ctx; 337 struct mbuf *m; 338 339 DPRINTF("flushing %p\n", so); 340 341 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 342 m = MBUFQ_FIRST(&unit->hci_cmdwait); 343 while (m != NULL) { 344 ctx = M_GETCTX(m, struct socket *); 345 if (ctx == so) 346 M_SETCTX(m, NULL); 347 348 m = MBUFQ_NEXT(m); 349 } 350 } 351 } 352 353 static int 354 hci_attach(struct socket *so, int proto) 355 { 356 struct hci_pcb *pcb; 357 int error; 358 359 KASSERT(so->so_pcb == NULL); 360 361 if (so->so_lock == NULL) { 362 mutex_obj_hold(bt_lock); 363 so->so_lock = bt_lock; 364 solock(so); 365 } 366 KASSERT(solocked(so)); 367 368 error = soreserve(so, hci_sendspace, hci_recvspace); 369 if (error) { 370 return error; 371 } 372 373 pcb = kmem_zalloc(sizeof(struct hci_pcb), KM_SLEEP); 374 pcb->hp_cred = kauth_cred_dup(curlwp->l_cred); 375 pcb->hp_socket = so; 376 377 /* 378 * Set default user filter. By default, socket only passes 379 * Command_Complete and Command_Status Events. 380 */ 381 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 382 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 383 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 384 385 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 386 so->so_pcb = pcb; 387 388 return 0; 389 } 390 391 static void 392 hci_detach(struct socket *so) 393 { 394 struct hci_pcb *pcb; 395 396 pcb = (struct hci_pcb *)so->so_pcb; 397 KASSERT(pcb != NULL); 398 399 if (so->so_snd.sb_mb != NULL) 400 hci_cmdwait_flush(so); 401 402 if (pcb->hp_cred != NULL) 403 kauth_cred_free(pcb->hp_cred); 404 405 so->so_pcb = NULL; 406 LIST_REMOVE(pcb, hp_next); 407 kmem_free(pcb, sizeof(*pcb)); 408 } 409 410 static int 411 hci_accept(struct socket *so, struct sockaddr *nam) 412 { 413 KASSERT(solocked(so)); 414 415 return EOPNOTSUPP; 416 } 417 418 static int 419 hci_bind(struct socket *so, struct sockaddr *nam, struct lwp *l) 420 { 421 struct hci_pcb *pcb = so->so_pcb; 422 struct sockaddr_bt *sa = (struct sockaddr_bt *)nam; 423 424 KASSERT(solocked(so)); 425 KASSERT(pcb != NULL); 426 KASSERT(nam != NULL); 427 428 if (sa->bt_len != sizeof(struct sockaddr_bt)) 429 return EINVAL; 430 431 if (sa->bt_family != AF_BLUETOOTH) 432 return EAFNOSUPPORT; 433 434 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 435 436 if (bdaddr_any(&sa->bt_bdaddr)) 437 pcb->hp_flags |= HCI_PROMISCUOUS; 438 else 439 pcb->hp_flags &= ~HCI_PROMISCUOUS; 440 441 return 0; 442 } 443 444 static int 445 hci_listen(struct socket *so, struct lwp *l) 446 { 447 KASSERT(solocked(so)); 448 449 return EOPNOTSUPP; 450 } 451 452 static int 453 hci_connect(struct socket *so, struct sockaddr *nam, struct lwp *l) 454 { 455 struct hci_pcb *pcb = so->so_pcb; 456 struct sockaddr_bt *sa = (struct sockaddr_bt *)nam; 457 458 KASSERT(solocked(so)); 459 KASSERT(pcb != NULL); 460 KASSERT(nam != NULL); 461 462 if (sa->bt_len != sizeof(struct sockaddr_bt)) 463 return EINVAL; 464 465 if (sa->bt_family != AF_BLUETOOTH) 466 return EAFNOSUPPORT; 467 468 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 469 return EADDRNOTAVAIL; 470 471 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 472 soisconnected(so); 473 return 0; 474 } 475 476 static int 477 hci_connect2(struct socket *so, struct socket *so2) 478 { 479 KASSERT(solocked(so)); 480 481 return EOPNOTSUPP; 482 } 483 484 static int 485 hci_disconnect(struct socket *so) 486 { 487 struct hci_pcb *pcb = so->so_pcb; 488 489 KASSERT(solocked(so)); 490 KASSERT(pcb != NULL); 491 492 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 493 494 /* XXX we cannot call soisdisconnected() here, as it sets 495 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 496 * that soisconnected() does not clear these and if you 497 * try to reconnect this socket (which is permitted) you 498 * get a broken pipe when you try to write any data. 499 */ 500 so->so_state &= ~SS_ISCONNECTED; 501 return 0; 502 } 503 504 static int 505 hci_shutdown(struct socket *so) 506 { 507 KASSERT(solocked(so)); 508 509 socantsendmore(so); 510 return 0; 511 } 512 513 static int 514 hci_abort(struct socket *so) 515 { 516 KASSERT(solocked(so)); 517 518 soisdisconnected(so); 519 hci_detach(so); 520 return 0; 521 } 522 523 static int 524 hci_ioctl(struct socket *so, u_long cmd, void *nam, struct ifnet *ifp) 525 { 526 int err; 527 mutex_enter(bt_lock); 528 err = hci_ioctl_pcb(cmd, nam); 529 mutex_exit(bt_lock); 530 return err; 531 } 532 533 static int 534 hci_stat(struct socket *so, struct stat *ub) 535 { 536 KASSERT(solocked(so)); 537 538 return 0; 539 } 540 541 static int 542 hci_peeraddr(struct socket *so, struct sockaddr *nam) 543 { 544 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 545 struct sockaddr_bt *sa = (struct sockaddr_bt *)nam; 546 547 KASSERT(solocked(so)); 548 KASSERT(pcb != NULL); 549 KASSERT(nam != NULL); 550 551 memset(sa, 0, sizeof(struct sockaddr_bt)); 552 sa->bt_len = sizeof(struct sockaddr_bt); 553 sa->bt_family = AF_BLUETOOTH; 554 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 555 return 0; 556 } 557 558 static int 559 hci_sockaddr(struct socket *so, struct sockaddr *nam) 560 { 561 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 562 struct sockaddr_bt *sa = (struct sockaddr_bt *)nam; 563 564 KASSERT(solocked(so)); 565 KASSERT(pcb != NULL); 566 KASSERT(nam != NULL); 567 568 memset(sa, 0, sizeof(struct sockaddr_bt)); 569 sa->bt_len = sizeof(struct sockaddr_bt); 570 sa->bt_family = AF_BLUETOOTH; 571 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 572 return 0; 573 } 574 575 static int 576 hci_rcvd(struct socket *so, int flags, struct lwp *l) 577 { 578 KASSERT(solocked(so)); 579 580 return EOPNOTSUPP; 581 } 582 583 static int 584 hci_recvoob(struct socket *so, struct mbuf *m, int flags) 585 { 586 KASSERT(solocked(so)); 587 588 return EOPNOTSUPP; 589 } 590 591 static int 592 hci_send(struct socket *so, struct mbuf *m, struct sockaddr *nam, 593 struct mbuf *control, struct lwp *l) 594 { 595 struct hci_pcb *pcb = so->so_pcb; 596 struct sockaddr_bt *sa = (struct sockaddr_bt *)nam; 597 struct hci_unit *unit; 598 struct mbuf *m0; 599 hci_cmd_hdr_t hdr; 600 int err = 0; 601 602 KASSERT(solocked(so)); 603 KASSERT(pcb != NULL); 604 KASSERT(m != NULL); 605 606 m_freem(control); /* have no use for this */ 607 608 if (sa) { 609 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 610 err = EINVAL; 611 goto bad; 612 } 613 614 if (sa->bt_family != AF_BLUETOOTH) { 615 err = EAFNOSUPPORT; 616 goto bad; 617 } 618 } 619 620 /* 621 * this came from userland, so we check it out first 622 */ 623 624 /* wants at least a header to start with */ 625 if (m->m_pkthdr.len < sizeof(hdr)) { 626 err = EMSGSIZE; 627 goto bad; 628 } 629 m_copydata(m, 0, sizeof(hdr), &hdr); 630 hdr.opcode = le16toh(hdr.opcode); 631 632 /* only allows CMD packets to be sent */ 633 if (hdr.type != HCI_CMD_PKT) { 634 err = EINVAL; 635 goto bad; 636 } 637 638 /* validates packet length */ 639 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 640 err = EMSGSIZE; 641 goto bad; 642 } 643 644 /* finds destination */ 645 unit = hci_unit_lookup((sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 646 if (unit == NULL) { 647 err = ENETDOWN; 648 goto bad; 649 } 650 651 /* security checks for unprivileged users */ 652 if (pcb->hp_cred != NULL 653 && kauth_authorize_device(pcb->hp_cred, 654 KAUTH_DEVICE_BLUETOOTH_SEND, 655 unit, &hdr, NULL, NULL) != 0) { 656 err = EPERM; 657 goto bad; 658 } 659 660 /* makess a copy for precious to keep */ 661 m0 = m_copypacket(m, M_DONTWAIT); 662 if (m0 == NULL) { 663 err = ENOMEM; 664 goto bad; 665 } 666 sbappendrecord(&pcb->hp_socket->so_snd, m0); 667 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 668 669 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev), 670 HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode)); 671 672 /* Sendss it */ 673 if (unit->hci_num_cmd_pkts == 0) 674 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 675 else 676 hci_output_cmd(unit, m); 677 678 return 0; 679 680 bad: 681 DPRINTF("packet (%d bytes) not sent (error %d)\n", 682 m->m_pkthdr.len, err); 683 m_freem(m); 684 685 return err; 686 } 687 688 static int 689 hci_sendoob(struct socket *so, struct mbuf *m, struct mbuf *control) 690 { 691 KASSERT(solocked(so)); 692 693 m_freem(m); 694 m_freem(control); 695 696 return EOPNOTSUPP; 697 } 698 699 static int 700 hci_purgeif(struct socket *so, struct ifnet *ifp) 701 { 702 703 return EOPNOTSUPP; 704 } 705 706 /* 707 * get/set socket options 708 */ 709 int 710 hci_ctloutput(int req, struct socket *so, struct sockopt *sopt) 711 { 712 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 713 int optval, err = 0; 714 715 DPRINTFN(2, "req %s\n", prcorequests[req]); 716 717 if (pcb == NULL) 718 return EINVAL; 719 720 if (sopt->sopt_level != BTPROTO_HCI) 721 return ENOPROTOOPT; 722 723 switch(req) { 724 case PRCO_GETOPT: 725 switch (sopt->sopt_name) { 726 case SO_HCI_EVT_FILTER: 727 err = sockopt_set(sopt, &pcb->hp_efilter, 728 sizeof(struct hci_filter)); 729 730 break; 731 732 case SO_HCI_PKT_FILTER: 733 err = sockopt_set(sopt, &pcb->hp_pfilter, 734 sizeof(struct hci_filter)); 735 736 break; 737 738 case SO_HCI_DIRECTION: 739 err = sockopt_setint(sopt, 740 (pcb->hp_flags & HCI_DIRECTION ? 1 : 0)); 741 742 break; 743 744 default: 745 err = ENOPROTOOPT; 746 break; 747 } 748 break; 749 750 case PRCO_SETOPT: 751 switch (sopt->sopt_name) { 752 case SO_HCI_EVT_FILTER: /* set event filter */ 753 err = sockopt_get(sopt, &pcb->hp_efilter, 754 sizeof(pcb->hp_efilter)); 755 756 break; 757 758 case SO_HCI_PKT_FILTER: /* set packet filter */ 759 err = sockopt_get(sopt, &pcb->hp_pfilter, 760 sizeof(pcb->hp_pfilter)); 761 762 break; 763 764 case SO_HCI_DIRECTION: /* request direction ctl messages */ 765 err = sockopt_getint(sopt, &optval); 766 if (err) 767 break; 768 769 if (optval) 770 pcb->hp_flags |= HCI_DIRECTION; 771 else 772 pcb->hp_flags &= ~HCI_DIRECTION; 773 break; 774 775 default: 776 err = ENOPROTOOPT; 777 break; 778 } 779 break; 780 781 default: 782 err = ENOPROTOOPT; 783 break; 784 } 785 786 return err; 787 } 788 789 /* 790 * HCI mbuf tap routine 791 * 792 * copy packets to any raw HCI sockets that wish (and are 793 * permitted) to see them 794 */ 795 void 796 hci_mtap(struct mbuf *m, struct hci_unit *unit) 797 { 798 struct hci_pcb *pcb; 799 struct mbuf *m0, *ctlmsg, **ctl; 800 struct sockaddr_bt sa; 801 uint8_t type; 802 uint8_t event; 803 uint16_t arg1; 804 805 KASSERT(m->m_len >= sizeof(type)); 806 807 type = *mtod(m, uint8_t *); 808 809 memset(&sa, 0, sizeof(sa)); 810 sa.bt_len = sizeof(struct sockaddr_bt); 811 sa.bt_family = AF_BLUETOOTH; 812 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 813 814 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 815 /* 816 * filter according to source address 817 */ 818 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 819 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 820 continue; 821 822 /* 823 * filter according to packet type filter 824 */ 825 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 826 continue; 827 828 /* 829 * filter according to event/security filters 830 */ 831 switch(type) { 832 case HCI_EVENT_PKT: 833 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 834 835 event = mtod(m, hci_event_hdr_t *)->event; 836 837 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 838 continue; 839 840 arg1 = event; 841 break; 842 843 case HCI_CMD_PKT: 844 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 845 arg1 = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 846 break; 847 848 case HCI_ACL_DATA_PKT: 849 KASSERT(m->m_len >= sizeof(hci_acldata_hdr_t)); 850 arg1 = le16toh(mtod(m, hci_acldata_hdr_t *)->con_handle); 851 arg1 = HCI_CON_HANDLE(arg1); 852 break; 853 854 case HCI_SCO_DATA_PKT: 855 KASSERT(m->m_len >= sizeof(hci_scodata_hdr_t)); 856 arg1 = le16toh(mtod(m, hci_scodata_hdr_t *)->con_handle); 857 arg1 = HCI_CON_HANDLE(arg1); 858 break; 859 860 default: 861 arg1 = 0; 862 break; 863 } 864 865 if (pcb->hp_cred != NULL 866 && kauth_authorize_device(pcb->hp_cred, 867 KAUTH_DEVICE_BLUETOOTH_RECV, 868 KAUTH_ARG(type), KAUTH_ARG(arg1), NULL, NULL) != 0) 869 continue; 870 871 /* 872 * create control messages 873 */ 874 ctlmsg = NULL; 875 ctl = &ctlmsg; 876 if (pcb->hp_flags & HCI_DIRECTION) { 877 int dir = m->m_flags & M_LINK0 ? 1 : 0; 878 879 *ctl = sbcreatecontrol(&dir, sizeof(dir), 880 SCM_HCI_DIRECTION, BTPROTO_HCI); 881 882 if (*ctl != NULL) 883 ctl = &((*ctl)->m_next); 884 } 885 if (pcb->hp_socket->so_options & SO_TIMESTAMP) { 886 struct timeval tv; 887 888 microtime(&tv); 889 *ctl = sbcreatecontrol(&tv, sizeof(tv), 890 SCM_TIMESTAMP, SOL_SOCKET); 891 892 if (*ctl != NULL) 893 ctl = &((*ctl)->m_next); 894 } 895 896 /* 897 * copy to socket 898 */ 899 m0 = m_copypacket(m, M_DONTWAIT); 900 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 901 (struct sockaddr *)&sa, m0, ctlmsg)) { 902 sorwakeup(pcb->hp_socket); 903 } else { 904 m_freem(ctlmsg); 905 m_freem(m0); 906 } 907 } 908 } 909 910 PR_WRAP_USRREQS(hci) 911 912 #define hci_attach hci_attach_wrapper 913 #define hci_detach hci_detach_wrapper 914 #define hci_accept hci_accept_wrapper 915 #define hci_bind hci_bind_wrapper 916 #define hci_listen hci_listen_wrapper 917 #define hci_connect hci_connect_wrapper 918 #define hci_connect2 hci_connect2_wrapper 919 #define hci_disconnect hci_disconnect_wrapper 920 #define hci_shutdown hci_shutdown_wrapper 921 #define hci_abort hci_abort_wrapper 922 #define hci_ioctl hci_ioctl_wrapper 923 #define hci_stat hci_stat_wrapper 924 #define hci_peeraddr hci_peeraddr_wrapper 925 #define hci_sockaddr hci_sockaddr_wrapper 926 #define hci_rcvd hci_rcvd_wrapper 927 #define hci_recvoob hci_recvoob_wrapper 928 #define hci_send hci_send_wrapper 929 #define hci_sendoob hci_sendoob_wrapper 930 #define hci_purgeif hci_purgeif_wrapper 931 932 const struct pr_usrreqs hci_usrreqs = { 933 .pr_attach = hci_attach, 934 .pr_detach = hci_detach, 935 .pr_accept = hci_accept, 936 .pr_bind = hci_bind, 937 .pr_listen = hci_listen, 938 .pr_connect = hci_connect, 939 .pr_connect2 = hci_connect2, 940 .pr_disconnect = hci_disconnect, 941 .pr_shutdown = hci_shutdown, 942 .pr_abort = hci_abort, 943 .pr_ioctl = hci_ioctl, 944 .pr_stat = hci_stat, 945 .pr_peeraddr = hci_peeraddr, 946 .pr_sockaddr = hci_sockaddr, 947 .pr_rcvd = hci_rcvd, 948 .pr_recvoob = hci_recvoob, 949 .pr_send = hci_send, 950 .pr_sendoob = hci_sendoob, 951 .pr_purgeif = hci_purgeif, 952 }; 953
Indexes created Sat Sep 20 22:09:52 GMT 2025