hci_socket.c revision 1.13
1 /* $NetBSD: hci_socket.c,v 1.13 2007/12/30 18:26:42 plunky Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.13 2007/12/30 18:26:42 plunky Exp $"); 35 36 /* load symbolic names */ 37 #ifdef BLUETOOTH_DEBUG 38 #define PRUREQUESTS 39 #define PRCOREQUESTS 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/domain.h> 44 #include <sys/kauth.h> 45 #include <sys/kernel.h> 46 #include <sys/mbuf.h> 47 #include <sys/proc.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/systm.h> 52 53 #include <netbt/bluetooth.h> 54 #include <netbt/hci.h> 55 56 /******************************************************************************* 57 * 58 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 59 * 60 */ 61 62 /* 63 * the raw HCI protocol control block 64 */ 65 struct hci_pcb { 66 struct socket *hp_socket; /* socket */ 67 unsigned int hp_flags; /* flags */ 68 bdaddr_t hp_laddr; /* local address */ 69 bdaddr_t hp_raddr; /* remote address */ 70 struct hci_filter hp_efilter; /* user event filter */ 71 struct hci_filter hp_pfilter; /* user packet filter */ 72 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 73 }; 74 75 /* hp_flags */ 76 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 77 #define HCI_DIRECTION (1<<1) /* direction control messages */ 78 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 79 80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 81 82 /* sysctl defaults */ 83 int hci_sendspace = HCI_CMD_PKT_SIZE; 84 int hci_recvspace = 4096; 85 86 /* supported commands opcode table */ 87 static const struct { 88 uint16_t opcode; 89 uint8_t offs; /* 0 - 63 */ 90 uint8_t mask; /* bit 0 - 7 */ 91 int16_t length; /* -1 if privileged */ 92 } hci_cmds[] = { 93 { HCI_CMD_INQUIRY, 94 0, 0x01, sizeof(hci_inquiry_cp) }, 95 { HCI_CMD_INQUIRY_CANCEL, 96 0, 0x02, -1 }, 97 { HCI_CMD_PERIODIC_INQUIRY, 98 0, 0x04, -1 }, 99 { HCI_CMD_EXIT_PERIODIC_INQUIRY, 100 0, 0x08, -1 }, 101 { HCI_CMD_CREATE_CON, 102 0, 0x10, -1 }, 103 { HCI_CMD_DISCONNECT, 104 0, 0x20, -1 }, 105 { HCI_CMD_ADD_SCO_CON, 106 0, 0x40, -1 }, 107 { HCI_CMD_CREATE_CON_CANCEL, 108 0, 0x80, -1 }, 109 { HCI_CMD_ACCEPT_CON, 110 1, 0x01, -1 }, 111 { HCI_CMD_REJECT_CON, 112 1, 0x02, -1 }, 113 { HCI_CMD_LINK_KEY_REP, 114 1, 0x04, -1 }, 115 { HCI_CMD_LINK_KEY_NEG_REP, 116 1, 0x08, -1 }, 117 { HCI_CMD_PIN_CODE_REP, 118 1, 0x10, -1 }, 119 { HCI_CMD_PIN_CODE_NEG_REP, 120 1, 0x20, -1 }, 121 { HCI_CMD_CHANGE_CON_PACKET_TYPE, 122 1, 0x40, -1 }, 123 { HCI_CMD_AUTH_REQ, 124 1, 0x80, -1 }, 125 { HCI_CMD_SET_CON_ENCRYPTION, 126 2, 0x01, -1 }, 127 { HCI_CMD_CHANGE_CON_LINK_KEY, 128 2, 0x02, -1 }, 129 { HCI_CMD_MASTER_LINK_KEY, 130 2, 0x04, -1 }, 131 { HCI_CMD_REMOTE_NAME_REQ, 132 2, 0x08, sizeof(hci_remote_name_req_cp) }, 133 { HCI_CMD_REMOTE_NAME_REQ_CANCEL, 134 2, 0x10, -1 }, 135 { HCI_CMD_READ_REMOTE_FEATURES, 136 2, 0x20, sizeof(hci_read_remote_features_cp) }, 137 { HCI_CMD_READ_REMOTE_EXTENDED_FEATURES, 138 2, 0x40, sizeof(hci_read_remote_extended_features_cp) }, 139 { HCI_CMD_READ_REMOTE_VER_INFO, 140 2, 0x80, sizeof(hci_read_remote_ver_info_cp) }, 141 { HCI_CMD_READ_CLOCK_OFFSET, 142 3, 0x01, sizeof(hci_read_clock_offset_cp) }, 143 { HCI_CMD_READ_LMP_HANDLE, 144 3, 0x02, sizeof(hci_read_lmp_handle_cp) }, 145 { HCI_CMD_HOLD_MODE, 146 4, 0x02, -1 }, 147 { HCI_CMD_SNIFF_MODE, 148 4, 0x04, -1 }, 149 { HCI_CMD_EXIT_SNIFF_MODE, 150 4, 0x08, -1 }, 151 { HCI_CMD_PARK_MODE, 152 4, 0x10, -1 }, 153 { HCI_CMD_EXIT_PARK_MODE, 154 4, 0x20, -1 }, 155 { HCI_CMD_QOS_SETUP, 156 4, 0x40, -1 }, 157 { HCI_CMD_ROLE_DISCOVERY, 158 4, 0x80, sizeof(hci_role_discovery_cp) }, 159 { HCI_CMD_SWITCH_ROLE, 160 5, 0x01, -1 }, 161 { HCI_CMD_READ_LINK_POLICY_SETTINGS, 162 5, 0x02, sizeof(hci_read_link_policy_settings_cp) }, 163 { HCI_CMD_WRITE_LINK_POLICY_SETTINGS, 164 5, 0x04, -1 }, 165 { HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS, 166 5, 0x08, 0 }, 167 { HCI_CMD_WRITE_DEFAULT_LINK_POLICY_SETTINGS, 168 5, 0x10, -1 }, 169 { HCI_CMD_FLOW_SPECIFICATION, 170 5, 0x20, -1 }, 171 { HCI_CMD_SET_EVENT_MASK, 172 5, 0x40, -1 }, 173 { HCI_CMD_RESET, 174 5, 0x80, -1 }, 175 { HCI_CMD_SET_EVENT_FILTER, 176 6, 0x01, -1 }, 177 { HCI_CMD_FLUSH, 178 6, 0x02, -1 }, 179 { HCI_CMD_READ_PIN_TYPE, 180 6, 0x04, 0 }, 181 { HCI_CMD_WRITE_PIN_TYPE, 182 6, 0x08, -1 }, 183 { HCI_CMD_CREATE_NEW_UNIT_KEY, 184 6, 0x10, -1 }, 185 { HCI_CMD_READ_STORED_LINK_KEY, 186 6, 0x20, -1 }, 187 { HCI_CMD_WRITE_STORED_LINK_KEY, 188 6, 0x40, -1 }, 189 { HCI_CMD_DELETE_STORED_LINK_KEY, 190 6, 0x80, -1 }, 191 { HCI_CMD_WRITE_LOCAL_NAME, 192 7, 0x01, -1 }, 193 { HCI_CMD_READ_LOCAL_NAME, 194 7, 0x02, 0 }, 195 { HCI_CMD_READ_CON_ACCEPT_TIMEOUT, 196 7, 0x04, 0 }, 197 { HCI_CMD_WRITE_CON_ACCEPT_TIMEOUT, 198 7, 0x08, -1 }, 199 { HCI_CMD_READ_PAGE_TIMEOUT, 200 7, 0x10, 0 }, 201 { HCI_CMD_WRITE_PAGE_TIMEOUT, 202 7, 0x20, -1 }, 203 { HCI_CMD_READ_SCAN_ENABLE, 204 7, 0x40, 0 }, 205 { HCI_CMD_WRITE_SCAN_ENABLE, 206 7, 0x80, -1 }, 207 { HCI_CMD_READ_PAGE_SCAN_ACTIVITY, 208 8, 0x01, 0 }, 209 { HCI_CMD_WRITE_PAGE_SCAN_ACTIVITY, 210 8, 0x02, -1 }, 211 { HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY, 212 8, 0x04, 0 }, 213 { HCI_CMD_WRITE_INQUIRY_SCAN_ACTIVITY, 214 8, 0x08, -1 }, 215 { HCI_CMD_READ_AUTH_ENABLE, 216 8, 0x10, 0 }, 217 { HCI_CMD_WRITE_AUTH_ENABLE, 218 8, 0x20, -1 }, 219 { HCI_CMD_READ_ENCRYPTION_MODE, 220 8, 0x40, 0 }, 221 { HCI_CMD_WRITE_ENCRYPTION_MODE, 222 8, 0x80, -1 }, 223 { HCI_CMD_READ_UNIT_CLASS, 224 9, 0x01, 0 }, 225 { HCI_CMD_WRITE_UNIT_CLASS, 226 9, 0x02, -1 }, 227 { HCI_CMD_READ_VOICE_SETTING, 228 9, 0x04, 0 }, 229 { HCI_CMD_WRITE_VOICE_SETTING, 230 9, 0x08, -1 }, 231 { HCI_CMD_READ_AUTO_FLUSH_TIMEOUT, 232 9, 0x10, sizeof(hci_read_auto_flush_timeout_cp) }, 233 { HCI_CMD_WRITE_AUTO_FLUSH_TIMEOUT, 234 9, 0x20, -1 }, 235 { HCI_CMD_READ_NUM_BROADCAST_RETRANS, 236 9, 0x40, 0 }, 237 { HCI_CMD_WRITE_NUM_BROADCAST_RETRANS, 238 9, 0x80, -1 }, 239 { HCI_CMD_READ_HOLD_MODE_ACTIVITY, 240 10, 0x01, 0 }, 241 { HCI_CMD_WRITE_HOLD_MODE_ACTIVITY, 242 10, 0x02, -1 }, 243 { HCI_CMD_READ_XMIT_LEVEL, 244 10, 0x04, sizeof(hci_read_xmit_level_cp) }, 245 { HCI_CMD_READ_SCO_FLOW_CONTROL, 246 10, 0x08, 0 }, 247 { HCI_CMD_WRITE_SCO_FLOW_CONTROL, 248 10, 0x10, -1 }, 249 { HCI_CMD_HC2H_FLOW_CONTROL, 250 10, 0x20, -1 }, 251 { HCI_CMD_HOST_BUFFER_SIZE, 252 10, 0x40, -1 }, 253 { HCI_CMD_HOST_NUM_COMPL_PKTS, 254 10, 0x80, -1 }, 255 { HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT, 256 11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) }, 257 { HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT, 258 11, 0x02, -1 }, 259 { HCI_CMD_READ_NUM_SUPPORTED_IAC, 260 11, 0x04, 0 }, 261 { HCI_CMD_READ_IAC_LAP, 262 11, 0x08, 0 }, 263 { HCI_CMD_WRITE_IAC_LAP, 264 11, 0x10, -1 }, 265 { HCI_CMD_READ_PAGE_SCAN_PERIOD, 266 11, 0x20, 0 }, 267 { HCI_CMD_WRITE_PAGE_SCAN_PERIOD, 268 11, 0x40, -1 }, 269 { HCI_CMD_READ_PAGE_SCAN, 270 11, 0x80, 0 }, 271 { HCI_CMD_WRITE_PAGE_SCAN, 272 12, 0x01, -1 }, 273 { HCI_CMD_SET_AFH_CLASSIFICATION, 274 12, 0x02, -1 }, 275 { HCI_CMD_READ_INQUIRY_SCAN_TYPE, 276 12, 0x10, 0 }, 277 { HCI_CMD_WRITE_INQUIRY_SCAN_TYPE, 278 12, 0x20, -1 }, 279 { HCI_CMD_READ_INQUIRY_MODE, 280 12, 0x40, 0 }, 281 { HCI_CMD_WRITE_INQUIRY_MODE, 282 12, 0x80, -1 }, 283 { HCI_CMD_READ_PAGE_SCAN_TYPE, 284 13, 0x01, 0 }, 285 { HCI_CMD_WRITE_PAGE_SCAN_TYPE, 286 13, 0x02, -1 }, 287 { HCI_CMD_READ_AFH_ASSESSMENT, 288 13, 0x04, 0 }, 289 { HCI_CMD_WRITE_AFH_ASSESSMENT, 290 13, 0x08, -1 }, 291 { HCI_CMD_READ_LOCAL_VER, 292 14, 0x08, 0 }, 293 { HCI_CMD_READ_LOCAL_COMMANDS, 294 14, 0x10, 0 }, 295 { HCI_CMD_READ_LOCAL_FEATURES, 296 14, 0x20, 0 }, 297 { HCI_CMD_READ_LOCAL_EXTENDED_FEATURES, 298 14, 0x40, sizeof(hci_read_local_extended_features_cp) }, 299 { HCI_CMD_READ_BUFFER_SIZE, 300 14, 0x80, 0 }, 301 { HCI_CMD_READ_COUNTRY_CODE, 302 15, 0x01, 0 }, 303 { HCI_CMD_READ_BDADDR, 304 15, 0x02, 0 }, 305 { HCI_CMD_READ_FAILED_CONTACT_CNTR, 306 15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) }, 307 { HCI_CMD_RESET_FAILED_CONTACT_CNTR, 308 15, 0x08, -1 }, 309 { HCI_CMD_READ_LINK_QUALITY, 310 15, 0x10, sizeof(hci_read_link_quality_cp) }, 311 { HCI_CMD_READ_RSSI, 312 15, 0x20, sizeof(hci_read_rssi_cp) }, 313 { HCI_CMD_READ_AFH_CHANNEL_MAP, 314 15, 0x40, sizeof(hci_read_afh_channel_map_cp) }, 315 { HCI_CMD_READ_CLOCK, 316 15, 0x80, sizeof(hci_read_clock_cp) }, 317 { HCI_CMD_READ_LOOPBACK_MODE, 318 16, 0x01, 0 }, 319 { HCI_CMD_WRITE_LOOPBACK_MODE, 320 16, 0x02, -1 }, 321 { HCI_CMD_ENABLE_UNIT_UNDER_TEST, 322 16, 0x04, -1 }, 323 { HCI_CMD_SETUP_SCO_CON, 324 16, 0x08, -1 }, 325 { HCI_CMD_ACCEPT_SCO_CON_REQ, 326 16, 0x10, -1 }, 327 { HCI_CMD_REJECT_SCO_CON_REQ, 328 16, 0x20, -1 }, 329 }; 330 331 /* 332 * Security filter routines for unprivileged users. 333 * Allow all but a few critical events, and only permit read commands. 334 * If a unit is given, verify the command is supported. 335 */ 336 337 static int 338 hci_security_check_opcode(struct hci_unit *unit, uint16_t opcode) 339 { 340 int i; 341 342 for (i = 0 ; i < __arraycount(hci_cmds) ; i++) { 343 if (opcode != hci_cmds[i].opcode) 344 continue; 345 346 if (unit == NULL 347 || (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) 348 return hci_cmds[i].length; 349 350 break; 351 } 352 353 return -1; 354 } 355 356 static int 357 hci_security_check_event(uint8_t event) 358 { 359 360 switch (event) { 361 case HCI_EVENT_RETURN_LINK_KEYS: 362 case HCI_EVENT_LINK_KEY_NOTIFICATION: 363 case HCI_EVENT_VENDOR: 364 return -1; /* disallowed */ 365 } 366 367 return 0; /* ok */ 368 } 369 370 /* 371 * When command packet reaches the device, we can drop 372 * it from the socket buffer (called from hci_output_acl) 373 */ 374 void 375 hci_drop(void *arg) 376 { 377 struct socket *so = arg; 378 379 sbdroprecord(&so->so_snd); 380 sowwakeup(so); 381 } 382 383 /* 384 * HCI socket is going away and has some pending packets. We let them 385 * go by design, but remove the context pointer as it will be invalid 386 * and we no longer need to be notified. 387 */ 388 static void 389 hci_cmdwait_flush(struct socket *so) 390 { 391 struct hci_unit *unit; 392 struct socket *ctx; 393 struct mbuf *m; 394 395 DPRINTF("flushing %p\n", so); 396 397 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 398 m = MBUFQ_FIRST(&unit->hci_cmdwait); 399 while (m != NULL) { 400 ctx = M_GETCTX(m, struct socket *); 401 if (ctx == so) 402 M_SETCTX(m, NULL); 403 404 m = MBUFQ_NEXT(m); 405 } 406 } 407 } 408 409 /* 410 * HCI send packet 411 * This came from userland, so check it out. 412 */ 413 static int 414 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 415 { 416 struct hci_unit *unit; 417 struct mbuf *m0; 418 hci_cmd_hdr_t hdr; 419 int err; 420 421 KASSERT(m != NULL); 422 KASSERT(addr != NULL); 423 424 /* wants at least a header to start with */ 425 if (m->m_pkthdr.len < sizeof(hdr)) { 426 err = EMSGSIZE; 427 goto bad; 428 } 429 m_copydata(m, 0, sizeof(hdr), &hdr); 430 hdr.opcode = le16toh(hdr.opcode); 431 432 /* only allows CMD packets to be sent */ 433 if (hdr.type != HCI_CMD_PKT) { 434 err = EINVAL; 435 goto bad; 436 } 437 438 /* validates packet length */ 439 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 440 err = EMSGSIZE; 441 goto bad; 442 } 443 444 /* finds destination */ 445 unit = hci_unit_lookup(addr); 446 if (unit == NULL) { 447 err = ENETDOWN; 448 goto bad; 449 } 450 451 /* security checks for unprivileged users */ 452 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 453 && hci_security_check_opcode(unit, hdr.opcode) != hdr.length) { 454 err = EPERM; 455 goto bad; 456 } 457 458 /* makess a copy for precious to keep */ 459 m0 = m_copypacket(m, M_DONTWAIT); 460 if (m0 == NULL) { 461 err = ENOMEM; 462 goto bad; 463 } 464 sbappendrecord(&pcb->hp_socket->so_snd, m0); 465 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 466 467 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev), 468 HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode)); 469 470 /* Sendss it */ 471 if (unit->hci_num_cmd_pkts == 0) 472 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 473 else 474 hci_output_cmd(unit, m); 475 476 return 0; 477 478 bad: 479 DPRINTF("packet (%d bytes) not sent (error %d)\n", 480 m->m_pkthdr.len, err); 481 if (m) m_freem(m); 482 return err; 483 } 484 485 /* 486 * User Request. 487 * up is socket 488 * m is either 489 * optional mbuf chain containing message 490 * ioctl command (PRU_CONTROL) 491 * nam is either 492 * optional mbuf chain containing an address 493 * ioctl data (PRU_CONTROL) 494 * optionally, protocol number (PRU_ATTACH) 495 * ctl is optional mbuf chain containing socket options 496 * l is pointer to process requesting action (if any) 497 * 498 * we are responsible for disposing of m and ctl if 499 * they are mbuf chains 500 */ 501 int 502 hci_usrreq(struct socket *up, int req, struct mbuf *m, 503 struct mbuf *nam, struct mbuf *ctl, struct lwp *l) 504 { 505 struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb; 506 struct sockaddr_bt *sa; 507 int err = 0; 508 509 DPRINTFN(2, "%s\n", prurequests[req]); 510 511 switch(req) { 512 case PRU_CONTROL: 513 return hci_ioctl((unsigned long)m, (void *)nam, l); 514 515 case PRU_PURGEIF: 516 return EOPNOTSUPP; 517 518 case PRU_ATTACH: 519 if (pcb) 520 return EINVAL; 521 522 err = soreserve(up, hci_sendspace, hci_recvspace); 523 if (err) 524 return err; 525 526 pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO); 527 if (pcb == NULL) 528 return ENOMEM; 529 530 up->so_pcb = pcb; 531 pcb->hp_socket = up; 532 533 if (l == NULL || kauth_authorize_generic(l->l_cred, 534 KAUTH_GENERIC_ISSUSER, NULL) == 0) 535 pcb->hp_flags |= HCI_PRIVILEGED; 536 537 /* 538 * Set default user filter. By default, socket only passes 539 * Command_Complete and Command_Status Events. 540 */ 541 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 542 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 543 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 544 545 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 546 547 return 0; 548 } 549 550 /* anything after here *requires* a pcb */ 551 if (pcb == NULL) { 552 err = EINVAL; 553 goto release; 554 } 555 556 switch(req) { 557 case PRU_DISCONNECT: 558 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 559 560 /* XXX we cannot call soisdisconnected() here, as it sets 561 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 562 * that soisconnected() does not clear these and if you 563 * try to reconnect this socket (which is permitted) you 564 * get a broken pipe when you try to write any data. 565 */ 566 up->so_state &= ~SS_ISCONNECTED; 567 break; 568 569 case PRU_ABORT: 570 soisdisconnected(up); 571 /* fall through to */ 572 case PRU_DETACH: 573 if (up->so_snd.sb_mb != NULL) 574 hci_cmdwait_flush(up); 575 576 up->so_pcb = NULL; 577 LIST_REMOVE(pcb, hp_next); 578 free(pcb, M_PCB); 579 return 0; 580 581 case PRU_BIND: 582 KASSERT(nam != NULL); 583 sa = mtod(nam, struct sockaddr_bt *); 584 585 if (sa->bt_len != sizeof(struct sockaddr_bt)) 586 return EINVAL; 587 588 if (sa->bt_family != AF_BLUETOOTH) 589 return EAFNOSUPPORT; 590 591 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 592 593 if (bdaddr_any(&sa->bt_bdaddr)) 594 pcb->hp_flags |= HCI_PROMISCUOUS; 595 else 596 pcb->hp_flags &= ~HCI_PROMISCUOUS; 597 598 return 0; 599 600 case PRU_CONNECT: 601 KASSERT(nam != NULL); 602 sa = mtod(nam, struct sockaddr_bt *); 603 604 if (sa->bt_len != sizeof(struct sockaddr_bt)) 605 return EINVAL; 606 607 if (sa->bt_family != AF_BLUETOOTH) 608 return EAFNOSUPPORT; 609 610 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 611 return EADDRNOTAVAIL; 612 613 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 614 soisconnected(up); 615 return 0; 616 617 case PRU_PEERADDR: 618 KASSERT(nam != NULL); 619 sa = mtod(nam, struct sockaddr_bt *); 620 621 memset(sa, 0, sizeof(struct sockaddr_bt)); 622 nam->m_len = 623 sa->bt_len = sizeof(struct sockaddr_bt); 624 sa->bt_family = AF_BLUETOOTH; 625 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 626 return 0; 627 628 case PRU_SOCKADDR: 629 KASSERT(nam != NULL); 630 sa = mtod(nam, struct sockaddr_bt *); 631 632 memset(sa, 0, sizeof(struct sockaddr_bt)); 633 nam->m_len = 634 sa->bt_len = sizeof(struct sockaddr_bt); 635 sa->bt_family = AF_BLUETOOTH; 636 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 637 return 0; 638 639 case PRU_SHUTDOWN: 640 socantsendmore(up); 641 break; 642 643 case PRU_SEND: 644 sa = NULL; 645 if (nam) { 646 sa = mtod(nam, struct sockaddr_bt *); 647 648 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 649 err = EINVAL; 650 goto release; 651 } 652 653 if (sa->bt_family != AF_BLUETOOTH) { 654 err = EAFNOSUPPORT; 655 goto release; 656 } 657 } 658 659 if (ctl) /* have no use for this */ 660 m_freem(ctl); 661 662 return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 663 664 case PRU_SENSE: 665 return 0; /* (no sense - Doh!) */ 666 667 case PRU_RCVD: 668 case PRU_RCVOOB: 669 return EOPNOTSUPP; /* (no release) */ 670 671 case PRU_ACCEPT: 672 case PRU_CONNECT2: 673 case PRU_LISTEN: 674 case PRU_SENDOOB: 675 case PRU_FASTTIMO: 676 case PRU_SLOWTIMO: 677 case PRU_PROTORCV: 678 case PRU_PROTOSEND: 679 err = EOPNOTSUPP; 680 break; 681 682 default: 683 UNKNOWN(req); 684 err = EOPNOTSUPP; 685 break; 686 } 687 688 release: 689 if (m) 690 m_freem(m); 691 if (ctl) 692 m_freem(ctl); 693 return err; 694 } 695 696 /* 697 * get/set socket options 698 */ 699 int 700 hci_ctloutput(int req, struct socket *so, int level, 701 int optname, struct mbuf **opt) 702 { 703 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 704 struct mbuf *m; 705 int err = 0; 706 707 DPRINTFN(2, "req %s\n", prcorequests[req]); 708 709 if (pcb == NULL) 710 return EINVAL; 711 712 if (level != BTPROTO_HCI) 713 return ENOPROTOOPT; 714 715 switch(req) { 716 case PRCO_GETOPT: 717 m = m_get(M_WAIT, MT_SOOPTS); 718 switch (optname) { 719 case SO_HCI_EVT_FILTER: 720 m->m_len = sizeof(struct hci_filter); 721 memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len); 722 break; 723 724 case SO_HCI_PKT_FILTER: 725 m->m_len = sizeof(struct hci_filter); 726 memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len); 727 break; 728 729 case SO_HCI_DIRECTION: 730 m->m_len = sizeof(int); 731 if (pcb->hp_flags & HCI_DIRECTION) 732 *mtod(m, int *) = 1; 733 else 734 *mtod(m, int *) = 0; 735 break; 736 737 default: 738 err = ENOPROTOOPT; 739 m_freem(m); 740 m = NULL; 741 break; 742 } 743 *opt = m; 744 break; 745 746 case PRCO_SETOPT: 747 m = *opt; 748 if (m) switch (optname) { 749 case SO_HCI_EVT_FILTER: /* set event filter */ 750 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 751 memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len); 752 break; 753 754 case SO_HCI_PKT_FILTER: /* set packet filter */ 755 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 756 memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len); 757 break; 758 759 case SO_HCI_DIRECTION: /* request direction ctl messages */ 760 if (*mtod(m, int *)) 761 pcb->hp_flags |= HCI_DIRECTION; 762 else 763 pcb->hp_flags &= ~HCI_DIRECTION; 764 break; 765 766 default: 767 err = ENOPROTOOPT; 768 break; 769 } 770 m_freem(m); 771 break; 772 773 default: 774 err = ENOPROTOOPT; 775 break; 776 } 777 778 return err; 779 } 780 781 /* 782 * HCI mbuf tap routine 783 * 784 * copy packets to any raw HCI sockets that wish (and are 785 * permitted) to see them 786 */ 787 void 788 hci_mtap(struct mbuf *m, struct hci_unit *unit) 789 { 790 struct hci_pcb *pcb; 791 struct mbuf *m0, *ctlmsg, **ctl; 792 struct sockaddr_bt sa; 793 uint8_t type; 794 uint8_t event; 795 uint16_t opcode; 796 797 KASSERT(m->m_len >= sizeof(type)); 798 799 type = *mtod(m, uint8_t *); 800 801 memset(&sa, 0, sizeof(sa)); 802 sa.bt_len = sizeof(struct sockaddr_bt); 803 sa.bt_family = AF_BLUETOOTH; 804 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 805 806 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 807 /* 808 * filter according to source address 809 */ 810 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 811 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 812 continue; 813 814 /* 815 * filter according to packet type filter 816 */ 817 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 818 continue; 819 820 /* 821 * filter according to event/security filters 822 */ 823 switch(type) { 824 case HCI_EVENT_PKT: 825 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 826 827 event = mtod(m, hci_event_hdr_t *)->event; 828 829 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 830 continue; 831 832 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 833 && hci_security_check_event(event) == -1) 834 continue; 835 break; 836 837 case HCI_CMD_PKT: 838 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 839 840 opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 841 842 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 843 && hci_security_check_opcode(NULL, opcode) == -1) 844 continue; 845 break; 846 847 case HCI_ACL_DATA_PKT: 848 case HCI_SCO_DATA_PKT: 849 default: 850 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 851 continue; 852 853 break; 854 } 855 856 /* 857 * create control messages 858 */ 859 ctlmsg = NULL; 860 ctl = &ctlmsg; 861 if (pcb->hp_flags & HCI_DIRECTION) { 862 int dir = m->m_flags & M_LINK0 ? 1 : 0; 863 864 *ctl = sbcreatecontrol(&dir, sizeof(dir), 865 SCM_HCI_DIRECTION, BTPROTO_HCI); 866 867 if (*ctl != NULL) 868 ctl = &((*ctl)->m_next); 869 } 870 871 /* 872 * copy to socket 873 */ 874 m0 = m_copypacket(m, M_DONTWAIT); 875 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 876 (struct sockaddr *)&sa, m0, ctlmsg)) { 877 sorwakeup(pcb->hp_socket); 878 } else { 879 m_freem(ctlmsg); 880 m_freem(m0); 881 } 882 } 883 } 884
Indexes created Thu Sep 25 08:09:54 GMT 2025