hci_socket.c revision 1.14
1 /* $NetBSD: hci_socket.c,v 1.14 2008/02/10 17:40:54 plunky Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.14 2008/02/10 17:40:54 plunky Exp $"); 35 36 /* load symbolic names */ 37 #ifdef BLUETOOTH_DEBUG 38 #define PRUREQUESTS 39 #define PRCOREQUESTS 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/domain.h> 44 #include <sys/kauth.h> 45 #include <sys/kernel.h> 46 #include <sys/mbuf.h> 47 #include <sys/proc.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/systm.h> 52 53 #include <netbt/bluetooth.h> 54 #include <netbt/hci.h> 55 56 /******************************************************************************* 57 * 58 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 59 * 60 */ 61 62 /* 63 * the raw HCI protocol control block 64 */ 65 struct hci_pcb { 66 struct socket *hp_socket; /* socket */ 67 unsigned int hp_flags; /* flags */ 68 bdaddr_t hp_laddr; /* local address */ 69 bdaddr_t hp_raddr; /* remote address */ 70 struct hci_filter hp_efilter; /* user event filter */ 71 struct hci_filter hp_pfilter; /* user packet filter */ 72 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 73 }; 74 75 /* hp_flags */ 76 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 77 #define HCI_DIRECTION (1<<1) /* direction control messages */ 78 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 79 80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 81 82 /* sysctl defaults */ 83 int hci_sendspace = HCI_CMD_PKT_SIZE; 84 int hci_recvspace = 4096; 85 86 /* supported commands opcode table */ 87 static const struct { 88 uint16_t opcode; 89 uint8_t offs; /* 0 - 63 */ 90 uint8_t mask; /* bit 0 - 7 */ 91 int16_t length; /* -1 if privileged */ 92 } hci_cmds[] = { 93 { HCI_CMD_INQUIRY, 94 0, 0x01, sizeof(hci_inquiry_cp) }, 95 { HCI_CMD_INQUIRY_CANCEL, 96 0, 0x02, -1 }, 97 { HCI_CMD_PERIODIC_INQUIRY, 98 0, 0x04, -1 }, 99 { HCI_CMD_EXIT_PERIODIC_INQUIRY, 100 0, 0x08, -1 }, 101 { HCI_CMD_CREATE_CON, 102 0, 0x10, -1 }, 103 { HCI_CMD_DISCONNECT, 104 0, 0x20, -1 }, 105 { HCI_CMD_ADD_SCO_CON, 106 0, 0x40, -1 }, 107 { HCI_CMD_CREATE_CON_CANCEL, 108 0, 0x80, -1 }, 109 { HCI_CMD_ACCEPT_CON, 110 1, 0x01, -1 }, 111 { HCI_CMD_REJECT_CON, 112 1, 0x02, -1 }, 113 { HCI_CMD_LINK_KEY_REP, 114 1, 0x04, -1 }, 115 { HCI_CMD_LINK_KEY_NEG_REP, 116 1, 0x08, -1 }, 117 { HCI_CMD_PIN_CODE_REP, 118 1, 0x10, -1 }, 119 { HCI_CMD_PIN_CODE_NEG_REP, 120 1, 0x20, -1 }, 121 { HCI_CMD_CHANGE_CON_PACKET_TYPE, 122 1, 0x40, -1 }, 123 { HCI_CMD_AUTH_REQ, 124 1, 0x80, -1 }, 125 { HCI_CMD_SET_CON_ENCRYPTION, 126 2, 0x01, -1 }, 127 { HCI_CMD_CHANGE_CON_LINK_KEY, 128 2, 0x02, -1 }, 129 { HCI_CMD_MASTER_LINK_KEY, 130 2, 0x04, -1 }, 131 { HCI_CMD_REMOTE_NAME_REQ, 132 2, 0x08, sizeof(hci_remote_name_req_cp) }, 133 { HCI_CMD_REMOTE_NAME_REQ_CANCEL, 134 2, 0x10, -1 }, 135 { HCI_CMD_READ_REMOTE_FEATURES, 136 2, 0x20, sizeof(hci_read_remote_features_cp) }, 137 { HCI_CMD_READ_REMOTE_EXTENDED_FEATURES, 138 2, 0x40, sizeof(hci_read_remote_extended_features_cp) }, 139 { HCI_CMD_READ_REMOTE_VER_INFO, 140 2, 0x80, sizeof(hci_read_remote_ver_info_cp) }, 141 { HCI_CMD_READ_CLOCK_OFFSET, 142 3, 0x01, sizeof(hci_read_clock_offset_cp) }, 143 { HCI_CMD_READ_LMP_HANDLE, 144 3, 0x02, sizeof(hci_read_lmp_handle_cp) }, 145 { HCI_CMD_HOLD_MODE, 146 4, 0x02, -1 }, 147 { HCI_CMD_SNIFF_MODE, 148 4, 0x04, -1 }, 149 { HCI_CMD_EXIT_SNIFF_MODE, 150 4, 0x08, -1 }, 151 { HCI_CMD_PARK_MODE, 152 4, 0x10, -1 }, 153 { HCI_CMD_EXIT_PARK_MODE, 154 4, 0x20, -1 }, 155 { HCI_CMD_QOS_SETUP, 156 4, 0x40, -1 }, 157 { HCI_CMD_ROLE_DISCOVERY, 158 4, 0x80, sizeof(hci_role_discovery_cp) }, 159 { HCI_CMD_SWITCH_ROLE, 160 5, 0x01, -1 }, 161 { HCI_CMD_READ_LINK_POLICY_SETTINGS, 162 5, 0x02, sizeof(hci_read_link_policy_settings_cp) }, 163 { HCI_CMD_WRITE_LINK_POLICY_SETTINGS, 164 5, 0x04, -1 }, 165 { HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS, 166 5, 0x08, 0 }, 167 { HCI_CMD_WRITE_DEFAULT_LINK_POLICY_SETTINGS, 168 5, 0x10, -1 }, 169 { HCI_CMD_FLOW_SPECIFICATION, 170 5, 0x20, -1 }, 171 { HCI_CMD_SET_EVENT_MASK, 172 5, 0x40, -1 }, 173 { HCI_CMD_RESET, 174 5, 0x80, -1 }, 175 { HCI_CMD_SET_EVENT_FILTER, 176 6, 0x01, -1 }, 177 { HCI_CMD_FLUSH, 178 6, 0x02, -1 }, 179 { HCI_CMD_READ_PIN_TYPE, 180 6, 0x04, 0 }, 181 { HCI_CMD_WRITE_PIN_TYPE, 182 6, 0x08, -1 }, 183 { HCI_CMD_CREATE_NEW_UNIT_KEY, 184 6, 0x10, -1 }, 185 { HCI_CMD_READ_STORED_LINK_KEY, 186 6, 0x20, -1 }, 187 { HCI_CMD_WRITE_STORED_LINK_KEY, 188 6, 0x40, -1 }, 189 { HCI_CMD_DELETE_STORED_LINK_KEY, 190 6, 0x80, -1 }, 191 { HCI_CMD_WRITE_LOCAL_NAME, 192 7, 0x01, -1 }, 193 { HCI_CMD_READ_LOCAL_NAME, 194 7, 0x02, 0 }, 195 { HCI_CMD_READ_CON_ACCEPT_TIMEOUT, 196 7, 0x04, 0 }, 197 { HCI_CMD_WRITE_CON_ACCEPT_TIMEOUT, 198 7, 0x08, -1 }, 199 { HCI_CMD_READ_PAGE_TIMEOUT, 200 7, 0x10, 0 }, 201 { HCI_CMD_WRITE_PAGE_TIMEOUT, 202 7, 0x20, -1 }, 203 { HCI_CMD_READ_SCAN_ENABLE, 204 7, 0x40, 0 }, 205 { HCI_CMD_WRITE_SCAN_ENABLE, 206 7, 0x80, -1 }, 207 { HCI_CMD_READ_PAGE_SCAN_ACTIVITY, 208 8, 0x01, 0 }, 209 { HCI_CMD_WRITE_PAGE_SCAN_ACTIVITY, 210 8, 0x02, -1 }, 211 { HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY, 212 8, 0x04, 0 }, 213 { HCI_CMD_WRITE_INQUIRY_SCAN_ACTIVITY, 214 8, 0x08, -1 }, 215 { HCI_CMD_READ_AUTH_ENABLE, 216 8, 0x10, 0 }, 217 { HCI_CMD_WRITE_AUTH_ENABLE, 218 8, 0x20, -1 }, 219 { HCI_CMD_READ_ENCRYPTION_MODE, 220 8, 0x40, 0 }, 221 { HCI_CMD_WRITE_ENCRYPTION_MODE, 222 8, 0x80, -1 }, 223 { HCI_CMD_READ_UNIT_CLASS, 224 9, 0x01, 0 }, 225 { HCI_CMD_WRITE_UNIT_CLASS, 226 9, 0x02, -1 }, 227 { HCI_CMD_READ_VOICE_SETTING, 228 9, 0x04, 0 }, 229 { HCI_CMD_WRITE_VOICE_SETTING, 230 9, 0x08, -1 }, 231 { HCI_CMD_READ_AUTO_FLUSH_TIMEOUT, 232 9, 0x10, sizeof(hci_read_auto_flush_timeout_cp) }, 233 { HCI_CMD_WRITE_AUTO_FLUSH_TIMEOUT, 234 9, 0x20, -1 }, 235 { HCI_CMD_READ_NUM_BROADCAST_RETRANS, 236 9, 0x40, 0 }, 237 { HCI_CMD_WRITE_NUM_BROADCAST_RETRANS, 238 9, 0x80, -1 }, 239 { HCI_CMD_READ_HOLD_MODE_ACTIVITY, 240 10, 0x01, 0 }, 241 { HCI_CMD_WRITE_HOLD_MODE_ACTIVITY, 242 10, 0x02, -1 }, 243 { HCI_CMD_READ_XMIT_LEVEL, 244 10, 0x04, sizeof(hci_read_xmit_level_cp) }, 245 { HCI_CMD_READ_SCO_FLOW_CONTROL, 246 10, 0x08, 0 }, 247 { HCI_CMD_WRITE_SCO_FLOW_CONTROL, 248 10, 0x10, -1 }, 249 { HCI_CMD_HC2H_FLOW_CONTROL, 250 10, 0x20, -1 }, 251 { HCI_CMD_HOST_BUFFER_SIZE, 252 10, 0x40, -1 }, 253 { HCI_CMD_HOST_NUM_COMPL_PKTS, 254 10, 0x80, -1 }, 255 { HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT, 256 11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) }, 257 { HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT, 258 11, 0x02, -1 }, 259 { HCI_CMD_READ_NUM_SUPPORTED_IAC, 260 11, 0x04, 0 }, 261 { HCI_CMD_READ_IAC_LAP, 262 11, 0x08, 0 }, 263 { HCI_CMD_WRITE_IAC_LAP, 264 11, 0x10, -1 }, 265 { HCI_CMD_READ_PAGE_SCAN_PERIOD, 266 11, 0x20, 0 }, 267 { HCI_CMD_WRITE_PAGE_SCAN_PERIOD, 268 11, 0x40, -1 }, 269 { HCI_CMD_READ_PAGE_SCAN, 270 11, 0x80, 0 }, 271 { HCI_CMD_WRITE_PAGE_SCAN, 272 12, 0x01, -1 }, 273 { HCI_CMD_SET_AFH_CLASSIFICATION, 274 12, 0x02, -1 }, 275 { HCI_CMD_READ_INQUIRY_SCAN_TYPE, 276 12, 0x10, 0 }, 277 { HCI_CMD_WRITE_INQUIRY_SCAN_TYPE, 278 12, 0x20, -1 }, 279 { HCI_CMD_READ_INQUIRY_MODE, 280 12, 0x40, 0 }, 281 { HCI_CMD_WRITE_INQUIRY_MODE, 282 12, 0x80, -1 }, 283 { HCI_CMD_READ_PAGE_SCAN_TYPE, 284 13, 0x01, 0 }, 285 { HCI_CMD_WRITE_PAGE_SCAN_TYPE, 286 13, 0x02, -1 }, 287 { HCI_CMD_READ_AFH_ASSESSMENT, 288 13, 0x04, 0 }, 289 { HCI_CMD_WRITE_AFH_ASSESSMENT, 290 13, 0x08, -1 }, 291 { HCI_CMD_READ_LOCAL_VER, 292 14, 0x08, 0 }, 293 { HCI_CMD_READ_LOCAL_COMMANDS, 294 14, 0x10, 0 }, 295 { HCI_CMD_READ_LOCAL_FEATURES, 296 14, 0x20, 0 }, 297 { HCI_CMD_READ_LOCAL_EXTENDED_FEATURES, 298 14, 0x40, sizeof(hci_read_local_extended_features_cp) }, 299 { HCI_CMD_READ_BUFFER_SIZE, 300 14, 0x80, 0 }, 301 { HCI_CMD_READ_COUNTRY_CODE, 302 15, 0x01, 0 }, 303 { HCI_CMD_READ_BDADDR, 304 15, 0x02, 0 }, 305 { HCI_CMD_READ_FAILED_CONTACT_CNTR, 306 15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) }, 307 { HCI_CMD_RESET_FAILED_CONTACT_CNTR, 308 15, 0x08, -1 }, 309 { HCI_CMD_READ_LINK_QUALITY, 310 15, 0x10, sizeof(hci_read_link_quality_cp) }, 311 { HCI_CMD_READ_RSSI, 312 15, 0x20, sizeof(hci_read_rssi_cp) }, 313 { HCI_CMD_READ_AFH_CHANNEL_MAP, 314 15, 0x40, sizeof(hci_read_afh_channel_map_cp) }, 315 { HCI_CMD_READ_CLOCK, 316 15, 0x80, sizeof(hci_read_clock_cp) }, 317 { HCI_CMD_READ_LOOPBACK_MODE, 318 16, 0x01, 0 }, 319 { HCI_CMD_WRITE_LOOPBACK_MODE, 320 16, 0x02, -1 }, 321 { HCI_CMD_ENABLE_UNIT_UNDER_TEST, 322 16, 0x04, -1 }, 323 { HCI_CMD_SETUP_SCO_CON, 324 16, 0x08, -1 }, 325 { HCI_CMD_ACCEPT_SCO_CON_REQ, 326 16, 0x10, -1 }, 327 { HCI_CMD_REJECT_SCO_CON_REQ, 328 16, 0x20, -1 }, 329 { HCI_CMD_READ_EXTENDED_INQUIRY_RSP, 330 17, 0x01, 0 }, 331 { HCI_CMD_WRITE_EXTENDED_INQUIRY_RSP, 332 17, 0x02, -1 }, 333 { HCI_CMD_REFRESH_ENCRYPTION_KEY, 334 17, 0x04, -1 }, 335 { HCI_CMD_SNIFF_SUBRATING, 336 17, 0x10, -1 }, 337 { HCI_CMD_READ_SIMPLE_PAIRING_MODE, 338 17, 0x20, 0 }, 339 { HCI_CMD_WRITE_SIMPLE_PAIRING_MODE, 340 17, 0x40, -1 }, 341 { HCI_CMD_READ_LOCAL_OOB_DATA, 342 17, 0x80, -1 }, 343 { HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER, 344 18, 0x01, 0 }, 345 { HCI_CMD_WRITE_INQUIRY_RSP_XMIT_POWER, 346 18, 0x02, -1 }, 347 { HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING, 348 18, 0x04, 0 }, 349 { HCI_CMD_WRITE_DEFAULT_ERRDATA_REPORTING, 350 18, 0x08, -1 }, 351 { HCI_CMD_IO_CAPABILITY_REP, 352 18, 0x80, -1 }, 353 { HCI_CMD_USER_CONFIRM_REP, 354 19, 0x01, -1 }, 355 { HCI_CMD_USER_CONFIRM_NEG_REP, 356 19, 0x02, -1 }, 357 { HCI_CMD_USER_PASSKEY_REP, 358 19, 0x04, -1 }, 359 { HCI_CMD_USER_PASSKEY_NEG_REP, 360 19, 0x08, -1 }, 361 { HCI_CMD_OOB_DATA_REP, 362 19, 0x10, -1 }, 363 { HCI_CMD_WRITE_SIMPLE_PAIRING_DEBUG_MODE, 364 19, 0x20, -1 }, 365 { HCI_CMD_ENHANCED_FLUSH, 366 19, 0x40, -1 }, 367 { HCI_CMD_OOB_DATA_NEG_REP, 368 19, 0x80, -1 }, 369 { HCI_CMD_SEND_KEYPRESS_NOTIFICATION, 370 20, 0x40, -1 }, 371 { HCI_CMD_IO_CAPABILITY_NEG_REP, 372 20, 0x80, -1 }, 373 }; 374 375 /* 376 * Security filter routines for unprivileged users. 377 * Allow all but a few critical events, and only permit read commands. 378 * If a unit is given, verify the command is supported. 379 */ 380 381 static int 382 hci_security_check_opcode(struct hci_unit *unit, uint16_t opcode) 383 { 384 int i; 385 386 for (i = 0 ; i < __arraycount(hci_cmds) ; i++) { 387 if (opcode != hci_cmds[i].opcode) 388 continue; 389 390 if (unit == NULL 391 || (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) 392 return hci_cmds[i].length; 393 394 break; 395 } 396 397 return -1; 398 } 399 400 static int 401 hci_security_check_event(uint8_t event) 402 { 403 404 switch (event) { 405 case HCI_EVENT_RETURN_LINK_KEYS: 406 case HCI_EVENT_LINK_KEY_NOTIFICATION: 407 case HCI_EVENT_USER_CONFIRM_REQ: 408 case HCI_EVENT_USER_PASSKEY_NOTIFICATION: 409 case HCI_EVENT_VENDOR: 410 return -1; /* disallowed */ 411 } 412 413 return 0; /* ok */ 414 } 415 416 /* 417 * When command packet reaches the device, we can drop 418 * it from the socket buffer (called from hci_output_acl) 419 */ 420 void 421 hci_drop(void *arg) 422 { 423 struct socket *so = arg; 424 425 sbdroprecord(&so->so_snd); 426 sowwakeup(so); 427 } 428 429 /* 430 * HCI socket is going away and has some pending packets. We let them 431 * go by design, but remove the context pointer as it will be invalid 432 * and we no longer need to be notified. 433 */ 434 static void 435 hci_cmdwait_flush(struct socket *so) 436 { 437 struct hci_unit *unit; 438 struct socket *ctx; 439 struct mbuf *m; 440 441 DPRINTF("flushing %p\n", so); 442 443 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 444 m = MBUFQ_FIRST(&unit->hci_cmdwait); 445 while (m != NULL) { 446 ctx = M_GETCTX(m, struct socket *); 447 if (ctx == so) 448 M_SETCTX(m, NULL); 449 450 m = MBUFQ_NEXT(m); 451 } 452 } 453 } 454 455 /* 456 * HCI send packet 457 * This came from userland, so check it out. 458 */ 459 static int 460 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 461 { 462 struct hci_unit *unit; 463 struct mbuf *m0; 464 hci_cmd_hdr_t hdr; 465 int err; 466 467 KASSERT(m != NULL); 468 KASSERT(addr != NULL); 469 470 /* wants at least a header to start with */ 471 if (m->m_pkthdr.len < sizeof(hdr)) { 472 err = EMSGSIZE; 473 goto bad; 474 } 475 m_copydata(m, 0, sizeof(hdr), &hdr); 476 hdr.opcode = le16toh(hdr.opcode); 477 478 /* only allows CMD packets to be sent */ 479 if (hdr.type != HCI_CMD_PKT) { 480 err = EINVAL; 481 goto bad; 482 } 483 484 /* validates packet length */ 485 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 486 err = EMSGSIZE; 487 goto bad; 488 } 489 490 /* finds destination */ 491 unit = hci_unit_lookup(addr); 492 if (unit == NULL) { 493 err = ENETDOWN; 494 goto bad; 495 } 496 497 /* security checks for unprivileged users */ 498 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 499 && hci_security_check_opcode(unit, hdr.opcode) != hdr.length) { 500 err = EPERM; 501 goto bad; 502 } 503 504 /* makess a copy for precious to keep */ 505 m0 = m_copypacket(m, M_DONTWAIT); 506 if (m0 == NULL) { 507 err = ENOMEM; 508 goto bad; 509 } 510 sbappendrecord(&pcb->hp_socket->so_snd, m0); 511 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 512 513 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev), 514 HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode)); 515 516 /* Sendss it */ 517 if (unit->hci_num_cmd_pkts == 0) 518 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 519 else 520 hci_output_cmd(unit, m); 521 522 return 0; 523 524 bad: 525 DPRINTF("packet (%d bytes) not sent (error %d)\n", 526 m->m_pkthdr.len, err); 527 if (m) m_freem(m); 528 return err; 529 } 530 531 /* 532 * User Request. 533 * up is socket 534 * m is either 535 * optional mbuf chain containing message 536 * ioctl command (PRU_CONTROL) 537 * nam is either 538 * optional mbuf chain containing an address 539 * ioctl data (PRU_CONTROL) 540 * optionally, protocol number (PRU_ATTACH) 541 * ctl is optional mbuf chain containing socket options 542 * l is pointer to process requesting action (if any) 543 * 544 * we are responsible for disposing of m and ctl if 545 * they are mbuf chains 546 */ 547 int 548 hci_usrreq(struct socket *up, int req, struct mbuf *m, 549 struct mbuf *nam, struct mbuf *ctl, struct lwp *l) 550 { 551 struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb; 552 struct sockaddr_bt *sa; 553 int err = 0; 554 555 DPRINTFN(2, "%s\n", prurequests[req]); 556 557 switch(req) { 558 case PRU_CONTROL: 559 return hci_ioctl((unsigned long)m, (void *)nam, l); 560 561 case PRU_PURGEIF: 562 return EOPNOTSUPP; 563 564 case PRU_ATTACH: 565 if (pcb) 566 return EINVAL; 567 568 err = soreserve(up, hci_sendspace, hci_recvspace); 569 if (err) 570 return err; 571 572 pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO); 573 if (pcb == NULL) 574 return ENOMEM; 575 576 up->so_pcb = pcb; 577 pcb->hp_socket = up; 578 579 if (l == NULL || kauth_authorize_generic(l->l_cred, 580 KAUTH_GENERIC_ISSUSER, NULL) == 0) 581 pcb->hp_flags |= HCI_PRIVILEGED; 582 583 /* 584 * Set default user filter. By default, socket only passes 585 * Command_Complete and Command_Status Events. 586 */ 587 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 588 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 589 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 590 591 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 592 593 return 0; 594 } 595 596 /* anything after here *requires* a pcb */ 597 if (pcb == NULL) { 598 err = EINVAL; 599 goto release; 600 } 601 602 switch(req) { 603 case PRU_DISCONNECT: 604 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 605 606 /* XXX we cannot call soisdisconnected() here, as it sets 607 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 608 * that soisconnected() does not clear these and if you 609 * try to reconnect this socket (which is permitted) you 610 * get a broken pipe when you try to write any data. 611 */ 612 up->so_state &= ~SS_ISCONNECTED; 613 break; 614 615 case PRU_ABORT: 616 soisdisconnected(up); 617 /* fall through to */ 618 case PRU_DETACH: 619 if (up->so_snd.sb_mb != NULL) 620 hci_cmdwait_flush(up); 621 622 up->so_pcb = NULL; 623 LIST_REMOVE(pcb, hp_next); 624 free(pcb, M_PCB); 625 return 0; 626 627 case PRU_BIND: 628 KASSERT(nam != NULL); 629 sa = mtod(nam, struct sockaddr_bt *); 630 631 if (sa->bt_len != sizeof(struct sockaddr_bt)) 632 return EINVAL; 633 634 if (sa->bt_family != AF_BLUETOOTH) 635 return EAFNOSUPPORT; 636 637 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 638 639 if (bdaddr_any(&sa->bt_bdaddr)) 640 pcb->hp_flags |= HCI_PROMISCUOUS; 641 else 642 pcb->hp_flags &= ~HCI_PROMISCUOUS; 643 644 return 0; 645 646 case PRU_CONNECT: 647 KASSERT(nam != NULL); 648 sa = mtod(nam, struct sockaddr_bt *); 649 650 if (sa->bt_len != sizeof(struct sockaddr_bt)) 651 return EINVAL; 652 653 if (sa->bt_family != AF_BLUETOOTH) 654 return EAFNOSUPPORT; 655 656 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 657 return EADDRNOTAVAIL; 658 659 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 660 soisconnected(up); 661 return 0; 662 663 case PRU_PEERADDR: 664 KASSERT(nam != NULL); 665 sa = mtod(nam, struct sockaddr_bt *); 666 667 memset(sa, 0, sizeof(struct sockaddr_bt)); 668 nam->m_len = 669 sa->bt_len = sizeof(struct sockaddr_bt); 670 sa->bt_family = AF_BLUETOOTH; 671 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 672 return 0; 673 674 case PRU_SOCKADDR: 675 KASSERT(nam != NULL); 676 sa = mtod(nam, struct sockaddr_bt *); 677 678 memset(sa, 0, sizeof(struct sockaddr_bt)); 679 nam->m_len = 680 sa->bt_len = sizeof(struct sockaddr_bt); 681 sa->bt_family = AF_BLUETOOTH; 682 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 683 return 0; 684 685 case PRU_SHUTDOWN: 686 socantsendmore(up); 687 break; 688 689 case PRU_SEND: 690 sa = NULL; 691 if (nam) { 692 sa = mtod(nam, struct sockaddr_bt *); 693 694 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 695 err = EINVAL; 696 goto release; 697 } 698 699 if (sa->bt_family != AF_BLUETOOTH) { 700 err = EAFNOSUPPORT; 701 goto release; 702 } 703 } 704 705 if (ctl) /* have no use for this */ 706 m_freem(ctl); 707 708 return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 709 710 case PRU_SENSE: 711 return 0; /* (no sense - Doh!) */ 712 713 case PRU_RCVD: 714 case PRU_RCVOOB: 715 return EOPNOTSUPP; /* (no release) */ 716 717 case PRU_ACCEPT: 718 case PRU_CONNECT2: 719 case PRU_LISTEN: 720 case PRU_SENDOOB: 721 case PRU_FASTTIMO: 722 case PRU_SLOWTIMO: 723 case PRU_PROTORCV: 724 case PRU_PROTOSEND: 725 err = EOPNOTSUPP; 726 break; 727 728 default: 729 UNKNOWN(req); 730 err = EOPNOTSUPP; 731 break; 732 } 733 734 release: 735 if (m) 736 m_freem(m); 737 if (ctl) 738 m_freem(ctl); 739 return err; 740 } 741 742 /* 743 * get/set socket options 744 */ 745 int 746 hci_ctloutput(int req, struct socket *so, int level, 747 int optname, struct mbuf **opt) 748 { 749 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 750 struct mbuf *m; 751 int err = 0; 752 753 DPRINTFN(2, "req %s\n", prcorequests[req]); 754 755 if (pcb == NULL) 756 return EINVAL; 757 758 if (level != BTPROTO_HCI) 759 return ENOPROTOOPT; 760 761 switch(req) { 762 case PRCO_GETOPT: 763 m = m_get(M_WAIT, MT_SOOPTS); 764 switch (optname) { 765 case SO_HCI_EVT_FILTER: 766 m->m_len = sizeof(struct hci_filter); 767 memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len); 768 break; 769 770 case SO_HCI_PKT_FILTER: 771 m->m_len = sizeof(struct hci_filter); 772 memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len); 773 break; 774 775 case SO_HCI_DIRECTION: 776 m->m_len = sizeof(int); 777 if (pcb->hp_flags & HCI_DIRECTION) 778 *mtod(m, int *) = 1; 779 else 780 *mtod(m, int *) = 0; 781 break; 782 783 default: 784 err = ENOPROTOOPT; 785 m_freem(m); 786 m = NULL; 787 break; 788 } 789 *opt = m; 790 break; 791 792 case PRCO_SETOPT: 793 m = *opt; 794 if (m) switch (optname) { 795 case SO_HCI_EVT_FILTER: /* set event filter */ 796 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 797 memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len); 798 break; 799 800 case SO_HCI_PKT_FILTER: /* set packet filter */ 801 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 802 memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len); 803 break; 804 805 case SO_HCI_DIRECTION: /* request direction ctl messages */ 806 if (*mtod(m, int *)) 807 pcb->hp_flags |= HCI_DIRECTION; 808 else 809 pcb->hp_flags &= ~HCI_DIRECTION; 810 break; 811 812 default: 813 err = ENOPROTOOPT; 814 break; 815 } 816 m_freem(m); 817 break; 818 819 default: 820 err = ENOPROTOOPT; 821 break; 822 } 823 824 return err; 825 } 826 827 /* 828 * HCI mbuf tap routine 829 * 830 * copy packets to any raw HCI sockets that wish (and are 831 * permitted) to see them 832 */ 833 void 834 hci_mtap(struct mbuf *m, struct hci_unit *unit) 835 { 836 struct hci_pcb *pcb; 837 struct mbuf *m0, *ctlmsg, **ctl; 838 struct sockaddr_bt sa; 839 uint8_t type; 840 uint8_t event; 841 uint16_t opcode; 842 843 KASSERT(m->m_len >= sizeof(type)); 844 845 type = *mtod(m, uint8_t *); 846 847 memset(&sa, 0, sizeof(sa)); 848 sa.bt_len = sizeof(struct sockaddr_bt); 849 sa.bt_family = AF_BLUETOOTH; 850 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 851 852 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 853 /* 854 * filter according to source address 855 */ 856 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 857 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 858 continue; 859 860 /* 861 * filter according to packet type filter 862 */ 863 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 864 continue; 865 866 /* 867 * filter according to event/security filters 868 */ 869 switch(type) { 870 case HCI_EVENT_PKT: 871 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 872 873 event = mtod(m, hci_event_hdr_t *)->event; 874 875 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 876 continue; 877 878 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 879 && hci_security_check_event(event) == -1) 880 continue; 881 break; 882 883 case HCI_CMD_PKT: 884 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 885 886 opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 887 888 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 889 && hci_security_check_opcode(NULL, opcode) == -1) 890 continue; 891 break; 892 893 case HCI_ACL_DATA_PKT: 894 case HCI_SCO_DATA_PKT: 895 default: 896 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 897 continue; 898 899 break; 900 } 901 902 /* 903 * create control messages 904 */ 905 ctlmsg = NULL; 906 ctl = &ctlmsg; 907 if (pcb->hp_flags & HCI_DIRECTION) { 908 int dir = m->m_flags & M_LINK0 ? 1 : 0; 909 910 *ctl = sbcreatecontrol(&dir, sizeof(dir), 911 SCM_HCI_DIRECTION, BTPROTO_HCI); 912 913 if (*ctl != NULL) 914 ctl = &((*ctl)->m_next); 915 } 916 917 /* 918 * copy to socket 919 */ 920 m0 = m_copypacket(m, M_DONTWAIT); 921 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 922 (struct sockaddr *)&sa, m0, ctlmsg)) { 923 sorwakeup(pcb->hp_socket); 924 } else { 925 m_freem(ctlmsg); 926 m_freem(m0); 927 } 928 } 929 } 930
Indexes created Thu Sep 25 08:09:54 GMT 2025