hci_socket.c revision 1.15
1 /* $NetBSD: hci_socket.c,v 1.15 2008/04/24 11:38:37 ad Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.15 2008/04/24 11:38:37 ad Exp $"); 35 36 /* load symbolic names */ 37 #ifdef BLUETOOTH_DEBUG 38 #define PRUREQUESTS 39 #define PRCOREQUESTS 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/domain.h> 44 #include <sys/kauth.h> 45 #include <sys/kernel.h> 46 #include <sys/mbuf.h> 47 #include <sys/proc.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/systm.h> 52 53 #include <netbt/bluetooth.h> 54 #include <netbt/hci.h> 55 56 /******************************************************************************* 57 * 58 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 59 * 60 */ 61 62 /* 63 * the raw HCI protocol control block 64 */ 65 struct hci_pcb { 66 struct socket *hp_socket; /* socket */ 67 unsigned int hp_flags; /* flags */ 68 bdaddr_t hp_laddr; /* local address */ 69 bdaddr_t hp_raddr; /* remote address */ 70 struct hci_filter hp_efilter; /* user event filter */ 71 struct hci_filter hp_pfilter; /* user packet filter */ 72 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 73 }; 74 75 /* hp_flags */ 76 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 77 #define HCI_DIRECTION (1<<1) /* direction control messages */ 78 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 79 80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 81 82 /* sysctl defaults */ 83 int hci_sendspace = HCI_CMD_PKT_SIZE; 84 int hci_recvspace = 4096; 85 86 /* supported commands opcode table */ 87 static const struct { 88 uint16_t opcode; 89 uint8_t offs; /* 0 - 63 */ 90 uint8_t mask; /* bit 0 - 7 */ 91 int16_t length; /* -1 if privileged */ 92 } hci_cmds[] = { 93 { HCI_CMD_INQUIRY, 94 0, 0x01, sizeof(hci_inquiry_cp) }, 95 { HCI_CMD_INQUIRY_CANCEL, 96 0, 0x02, -1 }, 97 { HCI_CMD_PERIODIC_INQUIRY, 98 0, 0x04, -1 }, 99 { HCI_CMD_EXIT_PERIODIC_INQUIRY, 100 0, 0x08, -1 }, 101 { HCI_CMD_CREATE_CON, 102 0, 0x10, -1 }, 103 { HCI_CMD_DISCONNECT, 104 0, 0x20, -1 }, 105 { HCI_CMD_ADD_SCO_CON, 106 0, 0x40, -1 }, 107 { HCI_CMD_CREATE_CON_CANCEL, 108 0, 0x80, -1 }, 109 { HCI_CMD_ACCEPT_CON, 110 1, 0x01, -1 }, 111 { HCI_CMD_REJECT_CON, 112 1, 0x02, -1 }, 113 { HCI_CMD_LINK_KEY_REP, 114 1, 0x04, -1 }, 115 { HCI_CMD_LINK_KEY_NEG_REP, 116 1, 0x08, -1 }, 117 { HCI_CMD_PIN_CODE_REP, 118 1, 0x10, -1 }, 119 { HCI_CMD_PIN_CODE_NEG_REP, 120 1, 0x20, -1 }, 121 { HCI_CMD_CHANGE_CON_PACKET_TYPE, 122 1, 0x40, -1 }, 123 { HCI_CMD_AUTH_REQ, 124 1, 0x80, -1 }, 125 { HCI_CMD_SET_CON_ENCRYPTION, 126 2, 0x01, -1 }, 127 { HCI_CMD_CHANGE_CON_LINK_KEY, 128 2, 0x02, -1 }, 129 { HCI_CMD_MASTER_LINK_KEY, 130 2, 0x04, -1 }, 131 { HCI_CMD_REMOTE_NAME_REQ, 132 2, 0x08, sizeof(hci_remote_name_req_cp) }, 133 { HCI_CMD_REMOTE_NAME_REQ_CANCEL, 134 2, 0x10, -1 }, 135 { HCI_CMD_READ_REMOTE_FEATURES, 136 2, 0x20, sizeof(hci_read_remote_features_cp) }, 137 { HCI_CMD_READ_REMOTE_EXTENDED_FEATURES, 138 2, 0x40, sizeof(hci_read_remote_extended_features_cp) }, 139 { HCI_CMD_READ_REMOTE_VER_INFO, 140 2, 0x80, sizeof(hci_read_remote_ver_info_cp) }, 141 { HCI_CMD_READ_CLOCK_OFFSET, 142 3, 0x01, sizeof(hci_read_clock_offset_cp) }, 143 { HCI_CMD_READ_LMP_HANDLE, 144 3, 0x02, sizeof(hci_read_lmp_handle_cp) }, 145 { HCI_CMD_HOLD_MODE, 146 4, 0x02, -1 }, 147 { HCI_CMD_SNIFF_MODE, 148 4, 0x04, -1 }, 149 { HCI_CMD_EXIT_SNIFF_MODE, 150 4, 0x08, -1 }, 151 { HCI_CMD_PARK_MODE, 152 4, 0x10, -1 }, 153 { HCI_CMD_EXIT_PARK_MODE, 154 4, 0x20, -1 }, 155 { HCI_CMD_QOS_SETUP, 156 4, 0x40, -1 }, 157 { HCI_CMD_ROLE_DISCOVERY, 158 4, 0x80, sizeof(hci_role_discovery_cp) }, 159 { HCI_CMD_SWITCH_ROLE, 160 5, 0x01, -1 }, 161 { HCI_CMD_READ_LINK_POLICY_SETTINGS, 162 5, 0x02, sizeof(hci_read_link_policy_settings_cp) }, 163 { HCI_CMD_WRITE_LINK_POLICY_SETTINGS, 164 5, 0x04, -1 }, 165 { HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS, 166 5, 0x08, 0 }, 167 { HCI_CMD_WRITE_DEFAULT_LINK_POLICY_SETTINGS, 168 5, 0x10, -1 }, 169 { HCI_CMD_FLOW_SPECIFICATION, 170 5, 0x20, -1 }, 171 { HCI_CMD_SET_EVENT_MASK, 172 5, 0x40, -1 }, 173 { HCI_CMD_RESET, 174 5, 0x80, -1 }, 175 { HCI_CMD_SET_EVENT_FILTER, 176 6, 0x01, -1 }, 177 { HCI_CMD_FLUSH, 178 6, 0x02, -1 }, 179 { HCI_CMD_READ_PIN_TYPE, 180 6, 0x04, 0 }, 181 { HCI_CMD_WRITE_PIN_TYPE, 182 6, 0x08, -1 }, 183 { HCI_CMD_CREATE_NEW_UNIT_KEY, 184 6, 0x10, -1 }, 185 { HCI_CMD_READ_STORED_LINK_KEY, 186 6, 0x20, -1 }, 187 { HCI_CMD_WRITE_STORED_LINK_KEY, 188 6, 0x40, -1 }, 189 { HCI_CMD_DELETE_STORED_LINK_KEY, 190 6, 0x80, -1 }, 191 { HCI_CMD_WRITE_LOCAL_NAME, 192 7, 0x01, -1 }, 193 { HCI_CMD_READ_LOCAL_NAME, 194 7, 0x02, 0 }, 195 { HCI_CMD_READ_CON_ACCEPT_TIMEOUT, 196 7, 0x04, 0 }, 197 { HCI_CMD_WRITE_CON_ACCEPT_TIMEOUT, 198 7, 0x08, -1 }, 199 { HCI_CMD_READ_PAGE_TIMEOUT, 200 7, 0x10, 0 }, 201 { HCI_CMD_WRITE_PAGE_TIMEOUT, 202 7, 0x20, -1 }, 203 { HCI_CMD_READ_SCAN_ENABLE, 204 7, 0x40, 0 }, 205 { HCI_CMD_WRITE_SCAN_ENABLE, 206 7, 0x80, -1 }, 207 { HCI_CMD_READ_PAGE_SCAN_ACTIVITY, 208 8, 0x01, 0 }, 209 { HCI_CMD_WRITE_PAGE_SCAN_ACTIVITY, 210 8, 0x02, -1 }, 211 { HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY, 212 8, 0x04, 0 }, 213 { HCI_CMD_WRITE_INQUIRY_SCAN_ACTIVITY, 214 8, 0x08, -1 }, 215 { HCI_CMD_READ_AUTH_ENABLE, 216 8, 0x10, 0 }, 217 { HCI_CMD_WRITE_AUTH_ENABLE, 218 8, 0x20, -1 }, 219 { HCI_CMD_READ_ENCRYPTION_MODE, 220 8, 0x40, 0 }, 221 { HCI_CMD_WRITE_ENCRYPTION_MODE, 222 8, 0x80, -1 }, 223 { HCI_CMD_READ_UNIT_CLASS, 224 9, 0x01, 0 }, 225 { HCI_CMD_WRITE_UNIT_CLASS, 226 9, 0x02, -1 }, 227 { HCI_CMD_READ_VOICE_SETTING, 228 9, 0x04, 0 }, 229 { HCI_CMD_WRITE_VOICE_SETTING, 230 9, 0x08, -1 }, 231 { HCI_CMD_READ_AUTO_FLUSH_TIMEOUT, 232 9, 0x10, sizeof(hci_read_auto_flush_timeout_cp) }, 233 { HCI_CMD_WRITE_AUTO_FLUSH_TIMEOUT, 234 9, 0x20, -1 }, 235 { HCI_CMD_READ_NUM_BROADCAST_RETRANS, 236 9, 0x40, 0 }, 237 { HCI_CMD_WRITE_NUM_BROADCAST_RETRANS, 238 9, 0x80, -1 }, 239 { HCI_CMD_READ_HOLD_MODE_ACTIVITY, 240 10, 0x01, 0 }, 241 { HCI_CMD_WRITE_HOLD_MODE_ACTIVITY, 242 10, 0x02, -1 }, 243 { HCI_CMD_READ_XMIT_LEVEL, 244 10, 0x04, sizeof(hci_read_xmit_level_cp) }, 245 { HCI_CMD_READ_SCO_FLOW_CONTROL, 246 10, 0x08, 0 }, 247 { HCI_CMD_WRITE_SCO_FLOW_CONTROL, 248 10, 0x10, -1 }, 249 { HCI_CMD_HC2H_FLOW_CONTROL, 250 10, 0x20, -1 }, 251 { HCI_CMD_HOST_BUFFER_SIZE, 252 10, 0x40, -1 }, 253 { HCI_CMD_HOST_NUM_COMPL_PKTS, 254 10, 0x80, -1 }, 255 { HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT, 256 11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) }, 257 { HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT, 258 11, 0x02, -1 }, 259 { HCI_CMD_READ_NUM_SUPPORTED_IAC, 260 11, 0x04, 0 }, 261 { HCI_CMD_READ_IAC_LAP, 262 11, 0x08, 0 }, 263 { HCI_CMD_WRITE_IAC_LAP, 264 11, 0x10, -1 }, 265 { HCI_CMD_READ_PAGE_SCAN_PERIOD, 266 11, 0x20, 0 }, 267 { HCI_CMD_WRITE_PAGE_SCAN_PERIOD, 268 11, 0x40, -1 }, 269 { HCI_CMD_READ_PAGE_SCAN, 270 11, 0x80, 0 }, 271 { HCI_CMD_WRITE_PAGE_SCAN, 272 12, 0x01, -1 }, 273 { HCI_CMD_SET_AFH_CLASSIFICATION, 274 12, 0x02, -1 }, 275 { HCI_CMD_READ_INQUIRY_SCAN_TYPE, 276 12, 0x10, 0 }, 277 { HCI_CMD_WRITE_INQUIRY_SCAN_TYPE, 278 12, 0x20, -1 }, 279 { HCI_CMD_READ_INQUIRY_MODE, 280 12, 0x40, 0 }, 281 { HCI_CMD_WRITE_INQUIRY_MODE, 282 12, 0x80, -1 }, 283 { HCI_CMD_READ_PAGE_SCAN_TYPE, 284 13, 0x01, 0 }, 285 { HCI_CMD_WRITE_PAGE_SCAN_TYPE, 286 13, 0x02, -1 }, 287 { HCI_CMD_READ_AFH_ASSESSMENT, 288 13, 0x04, 0 }, 289 { HCI_CMD_WRITE_AFH_ASSESSMENT, 290 13, 0x08, -1 }, 291 { HCI_CMD_READ_LOCAL_VER, 292 14, 0x08, 0 }, 293 { HCI_CMD_READ_LOCAL_COMMANDS, 294 14, 0x10, 0 }, 295 { HCI_CMD_READ_LOCAL_FEATURES, 296 14, 0x20, 0 }, 297 { HCI_CMD_READ_LOCAL_EXTENDED_FEATURES, 298 14, 0x40, sizeof(hci_read_local_extended_features_cp) }, 299 { HCI_CMD_READ_BUFFER_SIZE, 300 14, 0x80, 0 }, 301 { HCI_CMD_READ_COUNTRY_CODE, 302 15, 0x01, 0 }, 303 { HCI_CMD_READ_BDADDR, 304 15, 0x02, 0 }, 305 { HCI_CMD_READ_FAILED_CONTACT_CNTR, 306 15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) }, 307 { HCI_CMD_RESET_FAILED_CONTACT_CNTR, 308 15, 0x08, -1 }, 309 { HCI_CMD_READ_LINK_QUALITY, 310 15, 0x10, sizeof(hci_read_link_quality_cp) }, 311 { HCI_CMD_READ_RSSI, 312 15, 0x20, sizeof(hci_read_rssi_cp) }, 313 { HCI_CMD_READ_AFH_CHANNEL_MAP, 314 15, 0x40, sizeof(hci_read_afh_channel_map_cp) }, 315 { HCI_CMD_READ_CLOCK, 316 15, 0x80, sizeof(hci_read_clock_cp) }, 317 { HCI_CMD_READ_LOOPBACK_MODE, 318 16, 0x01, 0 }, 319 { HCI_CMD_WRITE_LOOPBACK_MODE, 320 16, 0x02, -1 }, 321 { HCI_CMD_ENABLE_UNIT_UNDER_TEST, 322 16, 0x04, -1 }, 323 { HCI_CMD_SETUP_SCO_CON, 324 16, 0x08, -1 }, 325 { HCI_CMD_ACCEPT_SCO_CON_REQ, 326 16, 0x10, -1 }, 327 { HCI_CMD_REJECT_SCO_CON_REQ, 328 16, 0x20, -1 }, 329 { HCI_CMD_READ_EXTENDED_INQUIRY_RSP, 330 17, 0x01, 0 }, 331 { HCI_CMD_WRITE_EXTENDED_INQUIRY_RSP, 332 17, 0x02, -1 }, 333 { HCI_CMD_REFRESH_ENCRYPTION_KEY, 334 17, 0x04, -1 }, 335 { HCI_CMD_SNIFF_SUBRATING, 336 17, 0x10, -1 }, 337 { HCI_CMD_READ_SIMPLE_PAIRING_MODE, 338 17, 0x20, 0 }, 339 { HCI_CMD_WRITE_SIMPLE_PAIRING_MODE, 340 17, 0x40, -1 }, 341 { HCI_CMD_READ_LOCAL_OOB_DATA, 342 17, 0x80, -1 }, 343 { HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER, 344 18, 0x01, 0 }, 345 { HCI_CMD_WRITE_INQUIRY_RSP_XMIT_POWER, 346 18, 0x02, -1 }, 347 { HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING, 348 18, 0x04, 0 }, 349 { HCI_CMD_WRITE_DEFAULT_ERRDATA_REPORTING, 350 18, 0x08, -1 }, 351 { HCI_CMD_IO_CAPABILITY_REP, 352 18, 0x80, -1 }, 353 { HCI_CMD_USER_CONFIRM_REP, 354 19, 0x01, -1 }, 355 { HCI_CMD_USER_CONFIRM_NEG_REP, 356 19, 0x02, -1 }, 357 { HCI_CMD_USER_PASSKEY_REP, 358 19, 0x04, -1 }, 359 { HCI_CMD_USER_PASSKEY_NEG_REP, 360 19, 0x08, -1 }, 361 { HCI_CMD_OOB_DATA_REP, 362 19, 0x10, -1 }, 363 { HCI_CMD_WRITE_SIMPLE_PAIRING_DEBUG_MODE, 364 19, 0x20, -1 }, 365 { HCI_CMD_ENHANCED_FLUSH, 366 19, 0x40, -1 }, 367 { HCI_CMD_OOB_DATA_NEG_REP, 368 19, 0x80, -1 }, 369 { HCI_CMD_SEND_KEYPRESS_NOTIFICATION, 370 20, 0x40, -1 }, 371 { HCI_CMD_IO_CAPABILITY_NEG_REP, 372 20, 0x80, -1 }, 373 }; 374 375 /* 376 * Security filter routines for unprivileged users. 377 * Allow all but a few critical events, and only permit read commands. 378 * If a unit is given, verify the command is supported. 379 */ 380 381 static int 382 hci_security_check_opcode(struct hci_unit *unit, uint16_t opcode) 383 { 384 int i; 385 386 for (i = 0 ; i < __arraycount(hci_cmds) ; i++) { 387 if (opcode != hci_cmds[i].opcode) 388 continue; 389 390 if (unit == NULL 391 || (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) 392 return hci_cmds[i].length; 393 394 break; 395 } 396 397 return -1; 398 } 399 400 static int 401 hci_security_check_event(uint8_t event) 402 { 403 404 switch (event) { 405 case HCI_EVENT_RETURN_LINK_KEYS: 406 case HCI_EVENT_LINK_KEY_NOTIFICATION: 407 case HCI_EVENT_USER_CONFIRM_REQ: 408 case HCI_EVENT_USER_PASSKEY_NOTIFICATION: 409 case HCI_EVENT_VENDOR: 410 return -1; /* disallowed */ 411 } 412 413 return 0; /* ok */ 414 } 415 416 /* 417 * When command packet reaches the device, we can drop 418 * it from the socket buffer (called from hci_output_acl) 419 */ 420 void 421 hci_drop(void *arg) 422 { 423 struct socket *so = arg; 424 425 sbdroprecord(&so->so_snd); 426 sowwakeup(so); 427 } 428 429 /* 430 * HCI socket is going away and has some pending packets. We let them 431 * go by design, but remove the context pointer as it will be invalid 432 * and we no longer need to be notified. 433 */ 434 static void 435 hci_cmdwait_flush(struct socket *so) 436 { 437 struct hci_unit *unit; 438 struct socket *ctx; 439 struct mbuf *m; 440 441 DPRINTF("flushing %p\n", so); 442 443 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 444 m = MBUFQ_FIRST(&unit->hci_cmdwait); 445 while (m != NULL) { 446 ctx = M_GETCTX(m, struct socket *); 447 if (ctx == so) 448 M_SETCTX(m, NULL); 449 450 m = MBUFQ_NEXT(m); 451 } 452 } 453 } 454 455 /* 456 * HCI send packet 457 * This came from userland, so check it out. 458 */ 459 static int 460 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 461 { 462 struct hci_unit *unit; 463 struct mbuf *m0; 464 hci_cmd_hdr_t hdr; 465 int err; 466 467 KASSERT(m != NULL); 468 KASSERT(addr != NULL); 469 470 /* wants at least a header to start with */ 471 if (m->m_pkthdr.len < sizeof(hdr)) { 472 err = EMSGSIZE; 473 goto bad; 474 } 475 m_copydata(m, 0, sizeof(hdr), &hdr); 476 hdr.opcode = le16toh(hdr.opcode); 477 478 /* only allows CMD packets to be sent */ 479 if (hdr.type != HCI_CMD_PKT) { 480 err = EINVAL; 481 goto bad; 482 } 483 484 /* validates packet length */ 485 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 486 err = EMSGSIZE; 487 goto bad; 488 } 489 490 /* finds destination */ 491 unit = hci_unit_lookup(addr); 492 if (unit == NULL) { 493 err = ENETDOWN; 494 goto bad; 495 } 496 497 /* security checks for unprivileged users */ 498 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 499 && hci_security_check_opcode(unit, hdr.opcode) != hdr.length) { 500 err = EPERM; 501 goto bad; 502 } 503 504 /* makess a copy for precious to keep */ 505 m0 = m_copypacket(m, M_DONTWAIT); 506 if (m0 == NULL) { 507 err = ENOMEM; 508 goto bad; 509 } 510 sbappendrecord(&pcb->hp_socket->so_snd, m0); 511 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 512 513 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev), 514 HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode)); 515 516 /* Sendss it */ 517 if (unit->hci_num_cmd_pkts == 0) 518 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 519 else 520 hci_output_cmd(unit, m); 521 522 return 0; 523 524 bad: 525 DPRINTF("packet (%d bytes) not sent (error %d)\n", 526 m->m_pkthdr.len, err); 527 if (m) m_freem(m); 528 return err; 529 } 530 531 /* 532 * User Request. 533 * up is socket 534 * m is either 535 * optional mbuf chain containing message 536 * ioctl command (PRU_CONTROL) 537 * nam is either 538 * optional mbuf chain containing an address 539 * ioctl data (PRU_CONTROL) 540 * optionally, protocol number (PRU_ATTACH) 541 * ctl is optional mbuf chain containing socket options 542 * l is pointer to process requesting action (if any) 543 * 544 * we are responsible for disposing of m and ctl if 545 * they are mbuf chains 546 */ 547 int 548 hci_usrreq(struct socket *up, int req, struct mbuf *m, 549 struct mbuf *nam, struct mbuf *ctl, struct lwp *l) 550 { 551 struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb; 552 struct sockaddr_bt *sa; 553 int err = 0; 554 555 DPRINTFN(2, "%s\n", prurequests[req]); 556 557 switch(req) { 558 case PRU_CONTROL: 559 return hci_ioctl((unsigned long)m, (void *)nam, l); 560 561 case PRU_PURGEIF: 562 return EOPNOTSUPP; 563 564 case PRU_ATTACH: 565 if (up->so_lock == NULL) { 566 mutex_obj_hold(bt_lock); 567 up->so_lock = bt_lock; 568 solock(up); 569 } 570 KASSERT(solocked(up)); 571 if (pcb) 572 return EINVAL; 573 err = soreserve(up, hci_sendspace, hci_recvspace); 574 if (err) 575 return err; 576 577 pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO); 578 if (pcb == NULL) 579 return ENOMEM; 580 581 up->so_pcb = pcb; 582 pcb->hp_socket = up; 583 584 if (l == NULL || kauth_authorize_generic(l->l_cred, 585 KAUTH_GENERIC_ISSUSER, NULL) == 0) 586 pcb->hp_flags |= HCI_PRIVILEGED; 587 588 /* 589 * Set default user filter. By default, socket only passes 590 * Command_Complete and Command_Status Events. 591 */ 592 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 593 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 594 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 595 596 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 597 598 return 0; 599 } 600 601 /* anything after here *requires* a pcb */ 602 if (pcb == NULL) { 603 err = EINVAL; 604 goto release; 605 } 606 607 switch(req) { 608 case PRU_DISCONNECT: 609 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 610 611 /* XXX we cannot call soisdisconnected() here, as it sets 612 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 613 * that soisconnected() does not clear these and if you 614 * try to reconnect this socket (which is permitted) you 615 * get a broken pipe when you try to write any data. 616 */ 617 up->so_state &= ~SS_ISCONNECTED; 618 break; 619 620 case PRU_ABORT: 621 soisdisconnected(up); 622 /* fall through to */ 623 case PRU_DETACH: 624 if (up->so_snd.sb_mb != NULL) 625 hci_cmdwait_flush(up); 626 627 up->so_pcb = NULL; 628 LIST_REMOVE(pcb, hp_next); 629 free(pcb, M_PCB); 630 return 0; 631 632 case PRU_BIND: 633 KASSERT(nam != NULL); 634 sa = mtod(nam, struct sockaddr_bt *); 635 636 if (sa->bt_len != sizeof(struct sockaddr_bt)) 637 return EINVAL; 638 639 if (sa->bt_family != AF_BLUETOOTH) 640 return EAFNOSUPPORT; 641 642 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 643 644 if (bdaddr_any(&sa->bt_bdaddr)) 645 pcb->hp_flags |= HCI_PROMISCUOUS; 646 else 647 pcb->hp_flags &= ~HCI_PROMISCUOUS; 648 649 return 0; 650 651 case PRU_CONNECT: 652 KASSERT(nam != NULL); 653 sa = mtod(nam, struct sockaddr_bt *); 654 655 if (sa->bt_len != sizeof(struct sockaddr_bt)) 656 return EINVAL; 657 658 if (sa->bt_family != AF_BLUETOOTH) 659 return EAFNOSUPPORT; 660 661 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 662 return EADDRNOTAVAIL; 663 664 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 665 soisconnected(up); 666 return 0; 667 668 case PRU_PEERADDR: 669 KASSERT(nam != NULL); 670 sa = mtod(nam, struct sockaddr_bt *); 671 672 memset(sa, 0, sizeof(struct sockaddr_bt)); 673 nam->m_len = 674 sa->bt_len = sizeof(struct sockaddr_bt); 675 sa->bt_family = AF_BLUETOOTH; 676 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 677 return 0; 678 679 case PRU_SOCKADDR: 680 KASSERT(nam != NULL); 681 sa = mtod(nam, struct sockaddr_bt *); 682 683 memset(sa, 0, sizeof(struct sockaddr_bt)); 684 nam->m_len = 685 sa->bt_len = sizeof(struct sockaddr_bt); 686 sa->bt_family = AF_BLUETOOTH; 687 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 688 return 0; 689 690 case PRU_SHUTDOWN: 691 socantsendmore(up); 692 break; 693 694 case PRU_SEND: 695 sa = NULL; 696 if (nam) { 697 sa = mtod(nam, struct sockaddr_bt *); 698 699 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 700 err = EINVAL; 701 goto release; 702 } 703 704 if (sa->bt_family != AF_BLUETOOTH) { 705 err = EAFNOSUPPORT; 706 goto release; 707 } 708 } 709 710 if (ctl) /* have no use for this */ 711 m_freem(ctl); 712 713 return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 714 715 case PRU_SENSE: 716 return 0; /* (no sense - Doh!) */ 717 718 case PRU_RCVD: 719 case PRU_RCVOOB: 720 return EOPNOTSUPP; /* (no release) */ 721 722 case PRU_ACCEPT: 723 case PRU_CONNECT2: 724 case PRU_LISTEN: 725 case PRU_SENDOOB: 726 case PRU_FASTTIMO: 727 case PRU_SLOWTIMO: 728 case PRU_PROTORCV: 729 case PRU_PROTOSEND: 730 err = EOPNOTSUPP; 731 break; 732 733 default: 734 UNKNOWN(req); 735 err = EOPNOTSUPP; 736 break; 737 } 738 739 release: 740 if (m) 741 m_freem(m); 742 if (ctl) 743 m_freem(ctl); 744 return err; 745 } 746 747 /* 748 * get/set socket options 749 */ 750 int 751 hci_ctloutput(int req, struct socket *so, int level, 752 int optname, struct mbuf **opt) 753 { 754 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 755 struct mbuf *m; 756 int err = 0; 757 758 DPRINTFN(2, "req %s\n", prcorequests[req]); 759 760 if (pcb == NULL) 761 return EINVAL; 762 763 if (level != BTPROTO_HCI) 764 return ENOPROTOOPT; 765 766 switch(req) { 767 case PRCO_GETOPT: 768 m = m_get(M_WAIT, MT_SOOPTS); 769 switch (optname) { 770 case SO_HCI_EVT_FILTER: 771 m->m_len = sizeof(struct hci_filter); 772 memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len); 773 break; 774 775 case SO_HCI_PKT_FILTER: 776 m->m_len = sizeof(struct hci_filter); 777 memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len); 778 break; 779 780 case SO_HCI_DIRECTION: 781 m->m_len = sizeof(int); 782 if (pcb->hp_flags & HCI_DIRECTION) 783 *mtod(m, int *) = 1; 784 else 785 *mtod(m, int *) = 0; 786 break; 787 788 default: 789 err = ENOPROTOOPT; 790 m_freem(m); 791 m = NULL; 792 break; 793 } 794 *opt = m; 795 break; 796 797 case PRCO_SETOPT: 798 m = *opt; 799 if (m) switch (optname) { 800 case SO_HCI_EVT_FILTER: /* set event filter */ 801 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 802 memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len); 803 break; 804 805 case SO_HCI_PKT_FILTER: /* set packet filter */ 806 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 807 memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len); 808 break; 809 810 case SO_HCI_DIRECTION: /* request direction ctl messages */ 811 if (*mtod(m, int *)) 812 pcb->hp_flags |= HCI_DIRECTION; 813 else 814 pcb->hp_flags &= ~HCI_DIRECTION; 815 break; 816 817 default: 818 err = ENOPROTOOPT; 819 break; 820 } 821 m_freem(m); 822 break; 823 824 default: 825 err = ENOPROTOOPT; 826 break; 827 } 828 829 return err; 830 } 831 832 /* 833 * HCI mbuf tap routine 834 * 835 * copy packets to any raw HCI sockets that wish (and are 836 * permitted) to see them 837 */ 838 void 839 hci_mtap(struct mbuf *m, struct hci_unit *unit) 840 { 841 struct hci_pcb *pcb; 842 struct mbuf *m0, *ctlmsg, **ctl; 843 struct sockaddr_bt sa; 844 uint8_t type; 845 uint8_t event; 846 uint16_t opcode; 847 848 KASSERT(m->m_len >= sizeof(type)); 849 850 type = *mtod(m, uint8_t *); 851 852 memset(&sa, 0, sizeof(sa)); 853 sa.bt_len = sizeof(struct sockaddr_bt); 854 sa.bt_family = AF_BLUETOOTH; 855 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 856 857 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 858 /* 859 * filter according to source address 860 */ 861 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 862 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 863 continue; 864 865 /* 866 * filter according to packet type filter 867 */ 868 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 869 continue; 870 871 /* 872 * filter according to event/security filters 873 */ 874 switch(type) { 875 case HCI_EVENT_PKT: 876 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 877 878 event = mtod(m, hci_event_hdr_t *)->event; 879 880 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 881 continue; 882 883 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 884 && hci_security_check_event(event) == -1) 885 continue; 886 break; 887 888 case HCI_CMD_PKT: 889 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 890 891 opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 892 893 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 894 && hci_security_check_opcode(NULL, opcode) == -1) 895 continue; 896 break; 897 898 case HCI_ACL_DATA_PKT: 899 case HCI_SCO_DATA_PKT: 900 default: 901 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 902 continue; 903 904 break; 905 } 906 907 /* 908 * create control messages 909 */ 910 ctlmsg = NULL; 911 ctl = &ctlmsg; 912 if (pcb->hp_flags & HCI_DIRECTION) { 913 int dir = m->m_flags & M_LINK0 ? 1 : 0; 914 915 *ctl = sbcreatecontrol(&dir, sizeof(dir), 916 SCM_HCI_DIRECTION, BTPROTO_HCI); 917 918 if (*ctl != NULL) 919 ctl = &((*ctl)->m_next); 920 } 921 922 /* 923 * copy to socket 924 */ 925 m0 = m_copypacket(m, M_DONTWAIT); 926 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 927 (struct sockaddr *)&sa, m0, ctlmsg)) { 928 sorwakeup(pcb->hp_socket); 929 } else { 930 m_freem(ctlmsg); 931 m_freem(m0); 932 } 933 } 934 } 935
Indexes created Fri Sep 26 08:10:20 GMT 2025