1 /* $OpenBSD: src/sys/netbt/hci_socket.c,v 1.5 2008/02/24 21:34:48 uwe Exp $ */ 2 /* $NetBSD: hci_socket.c,v 1.14 2008/02/10 17:40:54 plunky Exp $ */ 3 4 /*- 5 * Copyright (c) 2005 Iain Hibbert. 6 * Copyright (c) 2006 Itronix Inc. 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. The name of Itronix Inc. may not be used to endorse 18 * or promote products derived from this software without specific 19 * prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 23 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 24 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 25 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 26 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 27 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 28 * ON ANY THEORY OF LIABILITY, WHETHER IN 29 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 30 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 31 * POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 /* load symbolic names */ 35 #ifdef BLUETOOTH_DEBUG 36 #define PRUREQUESTS 37 #define PRCOREQUESTS 38 #endif 39 40 #include <sys/param.h> 41 #include <sys/domain.h> 42 #include <sys/kernel.h> 43 #include <sys/malloc.h> 44 #include <sys/mbuf.h> 45 #include <sys/proc.h> 46 #include <sys/caps.h> 47 #include <sys/protosw.h> 48 #include <sys/socket.h> 49 #include <sys/socketvar.h> 50 #include <sys/systm.h> 51 #include <sys/endian.h> 52 #include <net/if.h> 53 #include <net/if_var.h> 54 #include <sys/sysctl.h> 55 56 #include <sys/thread2.h> 57 #include <sys/socketvar2.h> 58 #include <sys/msgport2.h> 59 60 #include <netbt/bluetooth.h> 61 #include <netbt/hci.h> 62 63 /******************************************************************************* 64 * 65 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 66 * 67 */ 68 69 /* 70 * the raw HCI protocol control block 71 */ 72 struct hci_pcb { 73 struct socket *hp_socket; /* socket */ 74 unsigned int hp_flags; /* flags */ 75 bdaddr_t hp_laddr; /* local address */ 76 bdaddr_t hp_raddr; /* remote address */ 77 struct hci_filter hp_efilter; /* user event filter */ 78 struct hci_filter hp_pfilter; /* user packet filter */ 79 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 80 }; 81 82 /* hp_flags */ 83 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 84 #define HCI_DIRECTION (1<<1) /* direction control messages */ 85 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 86 87 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 88 89 /* sysctl defaults */ 90 int hci_sendspace = HCI_CMD_PKT_SIZE; 91 int hci_recvspace = 4096; 92 93 extern struct pr_usrreqs hci_usrreqs; 94 95 /* Prototypes for usrreqs methods. */ 96 static void hci_sdetach(netmsg_t msg); 97 98 /* supported commands opcode table */ 99 static const struct { 100 uint16_t opcode; 101 uint8_t offs; /* 0 - 63 */ 102 uint8_t mask; /* bit 0 - 7 */ 103 int16_t length; /* -1 if privileged */ 104 } hci_cmds[] = { 105 { HCI_CMD_INQUIRY, 106 0, 0x01, sizeof(hci_inquiry_cp) }, 107 { HCI_CMD_INQUIRY_CANCEL, 108 0, 0x02, -1 }, 109 { HCI_CMD_PERIODIC_INQUIRY, 110 0, 0x04, -1 }, 111 { HCI_CMD_EXIT_PERIODIC_INQUIRY, 112 0, 0x08, -1 }, 113 { HCI_CMD_CREATE_CON, 114 0, 0x10, -1 }, 115 { HCI_CMD_DISCONNECT, 116 0, 0x20, -1 }, 117 { HCI_CMD_ADD_SCO_CON, 118 0, 0x40, -1 }, 119 { HCI_CMD_CREATE_CON_CANCEL, 120 0, 0x80, -1 }, 121 { HCI_CMD_ACCEPT_CON, 122 1, 0x01, -1 }, 123 { HCI_CMD_REJECT_CON, 124 1, 0x02, -1 }, 125 { HCI_CMD_LINK_KEY_REP, 126 1, 0x04, -1 }, 127 { HCI_CMD_LINK_KEY_NEG_REP, 128 1, 0x08, -1 }, 129 { HCI_CMD_PIN_CODE_REP, 130 1, 0x10, -1 }, 131 { HCI_CMD_PIN_CODE_NEG_REP, 132 1, 0x20, -1 }, 133 { HCI_CMD_CHANGE_CON_PACKET_TYPE, 134 1, 0x40, -1 }, 135 { HCI_CMD_AUTH_REQ, 136 1, 0x80, -1 }, 137 { HCI_CMD_SET_CON_ENCRYPTION, 138 2, 0x01, -1 }, 139 { HCI_CMD_CHANGE_CON_LINK_KEY, 140 2, 0x02, -1 }, 141 { HCI_CMD_MASTER_LINK_KEY, 142 2, 0x04, -1 }, 143 { HCI_CMD_REMOTE_NAME_REQ, 144 2, 0x08, sizeof(hci_remote_name_req_cp) }, 145 { HCI_CMD_REMOTE_NAME_REQ_CANCEL, 146 2, 0x10, -1 }, 147 { HCI_CMD_READ_REMOTE_FEATURES, 148 2, 0x20, sizeof(hci_read_remote_features_cp) }, 149 { HCI_CMD_READ_REMOTE_EXTENDED_FEATURES, 150 2, 0x40, sizeof(hci_read_remote_extended_features_cp) }, 151 { HCI_CMD_READ_REMOTE_VER_INFO, 152 2, 0x80, sizeof(hci_read_remote_ver_info_cp) }, 153 { HCI_CMD_READ_CLOCK_OFFSET, 154 3, 0x01, sizeof(hci_read_clock_offset_cp) }, 155 { HCI_CMD_READ_LMP_HANDLE, 156 3, 0x02, sizeof(hci_read_lmp_handle_cp) }, 157 { HCI_CMD_HOLD_MODE, 158 4, 0x02, -1 }, 159 { HCI_CMD_SNIFF_MODE, 160 4, 0x04, -1 }, 161 { HCI_CMD_EXIT_SNIFF_MODE, 162 4, 0x08, -1 }, 163 { HCI_CMD_PARK_MODE, 164 4, 0x10, -1 }, 165 { HCI_CMD_EXIT_PARK_MODE, 166 4, 0x20, -1 }, 167 { HCI_CMD_QOS_SETUP, 168 4, 0x40, -1 }, 169 { HCI_CMD_ROLE_DISCOVERY, 170 4, 0x80, sizeof(hci_role_discovery_cp) }, 171 { HCI_CMD_SWITCH_ROLE, 172 5, 0x01, -1 }, 173 { HCI_CMD_READ_LINK_POLICY_SETTINGS, 174 5, 0x02, sizeof(hci_read_link_policy_settings_cp) }, 175 { HCI_CMD_WRITE_LINK_POLICY_SETTINGS, 176 5, 0x04, -1 }, 177 { HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS, 178 5, 0x08, 0 }, 179 { HCI_CMD_WRITE_DEFAULT_LINK_POLICY_SETTINGS, 180 5, 0x10, -1 }, 181 { HCI_CMD_FLOW_SPECIFICATION, 182 5, 0x20, -1 }, 183 { HCI_CMD_SET_EVENT_MASK, 184 5, 0x40, -1 }, 185 { HCI_CMD_RESET, 186 5, 0x80, -1 }, 187 { HCI_CMD_SET_EVENT_FILTER, 188 6, 0x01, -1 }, 189 { HCI_CMD_FLUSH, 190 6, 0x02, -1 }, 191 { HCI_CMD_READ_PIN_TYPE, 192 6, 0x04, 0 }, 193 { HCI_CMD_WRITE_PIN_TYPE, 194 6, 0x08, -1 }, 195 { HCI_CMD_CREATE_NEW_UNIT_KEY, 196 6, 0x10, -1 }, 197 { HCI_CMD_READ_STORED_LINK_KEY, 198 6, 0x20, -1 }, 199 { HCI_CMD_WRITE_STORED_LINK_KEY, 200 6, 0x40, -1 }, 201 { HCI_CMD_DELETE_STORED_LINK_KEY, 202 6, 0x80, -1 }, 203 { HCI_CMD_WRITE_LOCAL_NAME, 204 7, 0x01, -1 }, 205 { HCI_CMD_READ_LOCAL_NAME, 206 7, 0x02, 0 }, 207 { HCI_CMD_READ_CON_ACCEPT_TIMEOUT, 208 7, 0x04, 0 }, 209 { HCI_CMD_WRITE_CON_ACCEPT_TIMEOUT, 210 7, 0x08, -1 }, 211 { HCI_CMD_READ_PAGE_TIMEOUT, 212 7, 0x10, 0 }, 213 { HCI_CMD_WRITE_PAGE_TIMEOUT, 214 7, 0x20, -1 }, 215 { HCI_CMD_READ_SCAN_ENABLE, 216 7, 0x40, 0 }, 217 { HCI_CMD_WRITE_SCAN_ENABLE, 218 7, 0x80, -1 }, 219 { HCI_CMD_READ_PAGE_SCAN_ACTIVITY, 220 8, 0x01, 0 }, 221 { HCI_CMD_WRITE_PAGE_SCAN_ACTIVITY, 222 8, 0x02, -1 }, 223 { HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY, 224 8, 0x04, 0 }, 225 { HCI_CMD_WRITE_INQUIRY_SCAN_ACTIVITY, 226 8, 0x08, -1 }, 227 { HCI_CMD_READ_AUTH_ENABLE, 228 8, 0x10, 0 }, 229 { HCI_CMD_WRITE_AUTH_ENABLE, 230 8, 0x20, -1 }, 231 { HCI_CMD_READ_ENCRYPTION_MODE, 232 8, 0x40, 0 }, 233 { HCI_CMD_WRITE_ENCRYPTION_MODE, 234 8, 0x80, -1 }, 235 { HCI_CMD_READ_UNIT_CLASS, 236 9, 0x01, 0 }, 237 { HCI_CMD_WRITE_UNIT_CLASS, 238 9, 0x02, -1 }, 239 { HCI_CMD_READ_VOICE_SETTING, 240 9, 0x04, 0 }, 241 { HCI_CMD_WRITE_VOICE_SETTING, 242 9, 0x08, -1 }, 243 { HCI_CMD_READ_AUTO_FLUSH_TIMEOUT, 244 9, 0x10, sizeof(hci_read_auto_flush_timeout_cp) }, 245 { HCI_CMD_WRITE_AUTO_FLUSH_TIMEOUT, 246 9, 0x20, -1 }, 247 { HCI_CMD_READ_NUM_BROADCAST_RETRANS, 248 9, 0x40, 0 }, 249 { HCI_CMD_WRITE_NUM_BROADCAST_RETRANS, 250 9, 0x80, -1 }, 251 { HCI_CMD_READ_HOLD_MODE_ACTIVITY, 252 10, 0x01, 0 }, 253 { HCI_CMD_WRITE_HOLD_MODE_ACTIVITY, 254 10, 0x02, -1 }, 255 { HCI_CMD_READ_XMIT_LEVEL, 256 10, 0x04, sizeof(hci_read_xmit_level_cp) }, 257 { HCI_CMD_READ_SCO_FLOW_CONTROL, 258 10, 0x08, 0 }, 259 { HCI_CMD_WRITE_SCO_FLOW_CONTROL, 260 10, 0x10, -1 }, 261 { HCI_CMD_HC2H_FLOW_CONTROL, 262 10, 0x20, -1 }, 263 { HCI_CMD_HOST_BUFFER_SIZE, 264 10, 0x40, -1 }, 265 { HCI_CMD_HOST_NUM_COMPL_PKTS, 266 10, 0x80, -1 }, 267 { HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT, 268 11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) }, 269 { HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT, 270 11, 0x02, -1 }, 271 { HCI_CMD_READ_NUM_SUPPORTED_IAC, 272 11, 0x04, 0 }, 273 { HCI_CMD_READ_IAC_LAP, 274 11, 0x08, 0 }, 275 { HCI_CMD_WRITE_IAC_LAP, 276 11, 0x10, -1 }, 277 { HCI_CMD_READ_PAGE_SCAN_PERIOD, 278 11, 0x20, 0 }, 279 { HCI_CMD_WRITE_PAGE_SCAN_PERIOD, 280 11, 0x40, -1 }, 281 { HCI_CMD_READ_PAGE_SCAN, 282 11, 0x80, 0 }, 283 { HCI_CMD_WRITE_PAGE_SCAN, 284 12, 0x01, -1 }, 285 { HCI_CMD_SET_AFH_CLASSIFICATION, 286 12, 0x02, -1 }, 287 { HCI_CMD_READ_INQUIRY_SCAN_TYPE, 288 12, 0x10, 0 }, 289 { HCI_CMD_WRITE_INQUIRY_SCAN_TYPE, 290 12, 0x20, -1 }, 291 { HCI_CMD_READ_INQUIRY_MODE, 292 12, 0x40, 0 }, 293 { HCI_CMD_WRITE_INQUIRY_MODE, 294 12, 0x80, -1 }, 295 { HCI_CMD_READ_PAGE_SCAN_TYPE, 296 13, 0x01, 0 }, 297 { HCI_CMD_WRITE_PAGE_SCAN_TYPE, 298 13, 0x02, -1 }, 299 { HCI_CMD_READ_AFH_ASSESSMENT, 300 13, 0x04, 0 }, 301 { HCI_CMD_WRITE_AFH_ASSESSMENT, 302 13, 0x08, -1 }, 303 { HCI_CMD_READ_LOCAL_VER, 304 14, 0x08, 0 }, 305 { HCI_CMD_READ_LOCAL_COMMANDS, 306 14, 0x10, 0 }, 307 { HCI_CMD_READ_LOCAL_FEATURES, 308 14, 0x20, 0 }, 309 { HCI_CMD_READ_LOCAL_EXTENDED_FEATURES, 310 14, 0x40, sizeof(hci_read_local_extended_features_cp) }, 311 { HCI_CMD_READ_BUFFER_SIZE, 312 14, 0x80, 0 }, 313 { HCI_CMD_READ_COUNTRY_CODE, 314 15, 0x01, 0 }, 315 { HCI_CMD_READ_BDADDR, 316 15, 0x02, 0 }, 317 { HCI_CMD_READ_FAILED_CONTACT_CNTR, 318 15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) }, 319 { HCI_CMD_RESET_FAILED_CONTACT_CNTR, 320 15, 0x08, -1 }, 321 { HCI_CMD_READ_LINK_QUALITY, 322 15, 0x10, sizeof(hci_read_link_quality_cp) }, 323 { HCI_CMD_READ_RSSI, 324 15, 0x20, sizeof(hci_read_rssi_cp) }, 325 { HCI_CMD_READ_AFH_CHANNEL_MAP, 326 15, 0x40, sizeof(hci_read_afh_channel_map_cp) }, 327 { HCI_CMD_READ_CLOCK, 328 15, 0x80, sizeof(hci_read_clock_cp) }, 329 { HCI_CMD_READ_LOOPBACK_MODE, 330 16, 0x01, 0 }, 331 { HCI_CMD_WRITE_LOOPBACK_MODE, 332 16, 0x02, -1 }, 333 { HCI_CMD_ENABLE_UNIT_UNDER_TEST, 334 16, 0x04, -1 }, 335 { HCI_CMD_SETUP_SCO_CON, 336 16, 0x08, -1 }, 337 { HCI_CMD_ACCEPT_SCO_CON_REQ, 338 16, 0x10, -1 }, 339 { HCI_CMD_REJECT_SCO_CON_REQ, 340 16, 0x20, -1 }, 341 { HCI_CMD_READ_EXTENDED_INQUIRY_RSP, 342 17, 0x01, 0 }, 343 { HCI_CMD_WRITE_EXTENDED_INQUIRY_RSP, 344 17, 0x02, -1 }, 345 { HCI_CMD_REFRESH_ENCRYPTION_KEY, 346 17, 0x04, -1 }, 347 { HCI_CMD_SNIFF_SUBRATING, 348 17, 0x10, -1 }, 349 { HCI_CMD_READ_SIMPLE_PAIRING_MODE, 350 17, 0x20, 0 }, 351 { HCI_CMD_WRITE_SIMPLE_PAIRING_MODE, 352 17, 0x40, -1 }, 353 { HCI_CMD_READ_LOCAL_OOB_DATA, 354 17, 0x80, -1 }, 355 { HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER, 356 18, 0x01, 0 }, 357 { HCI_CMD_WRITE_INQUIRY_RSP_XMIT_POWER, 358 18, 0x02, -1 }, 359 { HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING, 360 18, 0x04, 0 }, 361 { HCI_CMD_WRITE_DEFAULT_ERRDATA_REPORTING, 362 18, 0x08, -1 }, 363 { HCI_CMD_IO_CAPABILITY_REP, 364 18, 0x80, -1 }, 365 { HCI_CMD_USER_CONFIRM_REP, 366 19, 0x01, -1 }, 367 { HCI_CMD_USER_CONFIRM_NEG_REP, 368 19, 0x02, -1 }, 369 { HCI_CMD_USER_PASSKEY_REP, 370 19, 0x04, -1 }, 371 { HCI_CMD_USER_PASSKEY_NEG_REP, 372 19, 0x08, -1 }, 373 { HCI_CMD_OOB_DATA_REP, 374 19, 0x10, -1 }, 375 { HCI_CMD_WRITE_SIMPLE_PAIRING_DEBUG_MODE, 376 19, 0x20, -1 }, 377 { HCI_CMD_ENHANCED_FLUSH, 378 19, 0x40, -1 }, 379 { HCI_CMD_OOB_DATA_NEG_REP, 380 19, 0x80, -1 }, 381 { HCI_CMD_SEND_KEYPRESS_NOTIFICATION, 382 20, 0x40, -1 }, 383 { HCI_CMD_IO_CAPABILITY_NEG_REP, 384 20, 0x80, -1 }, 385 }; 386 387 /* 388 * Security filter routines for unprivileged users. 389 * Allow all but a few critical events, and only permit read commands. 390 * If a unit is given, verify the command is supported. 391 */ 392 393 static int 394 hci_security_check_opcode(struct hci_unit *unit, uint16_t opcode) 395 { 396 int i; 397 398 for (i = 0 ; i < NELEM(hci_cmds); i++) { 399 if (opcode != hci_cmds[i].opcode) 400 continue; 401 402 if (unit == NULL 403 || (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) 404 return hci_cmds[i].length; 405 406 break; 407 } 408 409 return -1; 410 } 411 412 static int 413 hci_security_check_event(uint8_t event) 414 { 415 416 switch (event) { 417 case HCI_EVENT_RETURN_LINK_KEYS: 418 case HCI_EVENT_LINK_KEY_NOTIFICATION: 419 case HCI_EVENT_USER_CONFIRM_REQ: 420 case HCI_EVENT_USER_PASSKEY_NOTIFICATION: 421 case HCI_EVENT_VENDOR: 422 return -1; /* disallowed */ 423 } 424 425 return 0; /* ok */ 426 } 427 428 /* 429 * When command packet reaches the device, we can drop 430 * it from the socket buffer (called from hci_output_acl) 431 */ 432 void 433 hci_drop(void *arg) 434 { 435 struct socket *so = arg; 436 437 sbdroprecord(&so->so_snd.sb); 438 sowwakeup(so); 439 } 440 441 /* 442 * HCI socket is going away and has some pending packets. We let them 443 * go by design, but remove the context pointer as it will be invalid 444 * and we no longer need to be notified. 445 */ 446 static void 447 hci_cmdwait_flush(struct socket *so) 448 { 449 struct hci_unit *unit; 450 struct socket *ctx; 451 struct mbuf *m; 452 453 DPRINTF("flushing %p\n", so); 454 455 TAILQ_FOREACH(unit, &hci_unit_list, hci_next) { 456 IF_POLL(&unit->hci_cmdwait, m); 457 while (m != NULL) { 458 ctx = M_GETCTX(m, struct socket *); 459 if (ctx == so) 460 M_SETCTX(m, NULL); 461 462 m = m->m_nextpkt; 463 } 464 } 465 } 466 467 /* 468 * HCI send packet 469 * This came from userland, so check it out. 470 */ 471 static int 472 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 473 { 474 struct hci_unit *unit; 475 struct mbuf *m0; 476 hci_cmd_hdr_t hdr; 477 int err; 478 479 KKASSERT(m != NULL); 480 KKASSERT(addr != NULL); 481 482 /* wants at least a header to start with */ 483 if (m->m_pkthdr.len < sizeof(hdr)) { 484 err = EMSGSIZE; 485 goto bad; 486 } 487 m_copydata(m, 0, sizeof(hdr), (caddr_t)&hdr); 488 hdr.opcode = letoh16(hdr.opcode); 489 490 /* only allows CMD packets to be sent */ 491 if (hdr.type != HCI_CMD_PKT) { 492 err = EINVAL; 493 goto bad; 494 } 495 496 /* validates packet length */ 497 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 498 err = EMSGSIZE; 499 goto bad; 500 } 501 502 /* finds destination */ 503 unit = hci_unit_lookup(addr); 504 if (unit == NULL) { 505 err = ENETDOWN; 506 goto bad; 507 } 508 509 /* security checks for unprivileged users */ 510 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 511 && hci_security_check_opcode(unit, hdr.opcode) != hdr.length) { 512 err = EPERM; 513 goto bad; 514 } 515 516 /* makes a copy for precious to keep */ 517 m0 = m_copym(m, 0, M_COPYALL, M_NOWAIT); 518 if (m0 == NULL) { 519 err = ENOMEM; 520 goto bad; 521 } 522 sbappendrecord(&pcb->hp_socket->so_snd.sb, m0); 523 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 524 525 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", 526 device_get_nameunit(unit->hci_dev), 527 HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode)); 528 529 /* Sendss it */ 530 if (unit->hci_num_cmd_pkts == 0) 531 IF_ENQUEUE(&unit->hci_cmdwait, m); 532 else 533 hci_output_cmd(unit, m); 534 535 return 0; 536 537 bad: 538 DPRINTF("packet (%d bytes) not sent (error %d)\n", 539 m->m_pkthdr.len, err); 540 if (m) m_freem(m); 541 return err; 542 } 543 544 /* 545 * Implementation of usrreqs. 546 * 547 * NOTE: (so) is referenced from soabort*() and netmsg_pru_abort() 548 * will sofree() it when we return. 549 */ 550 static void 551 hci_sabort(netmsg_t msg) 552 { 553 /* struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; */ 554 555 soisdisconnected(msg->abort.base.nm_so); 556 hci_sdetach(msg); 557 /* msg now invalid */ 558 } 559 560 static void 561 hci_sdetach(netmsg_t msg) 562 { 563 struct socket *so = msg->detach.base.nm_so; 564 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 565 int error; 566 567 if (pcb == NULL) { 568 error = EINVAL; 569 } else { 570 if (so->so_snd.ssb_mb != NULL) 571 hci_cmdwait_flush(so); 572 573 so->so_pcb = NULL; 574 sofree(so); /* remove pcb ref */ 575 576 LIST_REMOVE(pcb, hp_next); 577 kfree(pcb, M_PCB); 578 error = 0; 579 } 580 lwkt_replymsg(&msg->detach.base.lmsg, error); 581 } 582 583 static void 584 hci_sdisconnect(netmsg_t msg) 585 { 586 struct socket *so = msg->disconnect.base.nm_so; 587 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 588 int error; 589 590 if (pcb) { 591 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 592 /* 593 * XXX We cannot call soisdisconnected() here, as it sets 594 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem is that 595 * soisconnected() does not clear these and if you try to 596 * reconnect this socket (which is permitted) you get a 597 * broken pipe when you try to write any data. 598 */ 599 soclrstate(so, SS_ISCONNECTED); 600 error = 0; 601 } else { 602 error = EINVAL; 603 } 604 lwkt_replymsg(&msg->disconnect.base.lmsg, error); 605 } 606 607 static void 608 hci_scontrol(netmsg_t msg) 609 { 610 int error; 611 612 error = hci_ioctl(msg->control.nm_cmd, 613 (void *)msg->control.nm_data, 614 NULL); 615 lwkt_replymsg(&msg->control.base.lmsg, error); 616 } 617 618 static void 619 hci_sattach(netmsg_t msg) 620 { 621 struct socket *so = msg->attach.base.nm_so; 622 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 623 int error; 624 625 if (pcb) { 626 error = EINVAL; 627 goto out; 628 } 629 630 error = soreserve(so, hci_sendspace, hci_recvspace,NULL); 631 if (error) 632 goto out; 633 634 pcb = kmalloc(sizeof *pcb, M_PCB, M_NOWAIT | M_ZERO); 635 if (pcb == NULL) { 636 error = ENOMEM; 637 goto out; 638 } 639 640 soreference(so); 641 so->so_pcb = pcb; 642 pcb->hp_socket = so; 643 644 if (curproc == NULL || caps_priv_check_self(SYSCAP_RESTRICTEDROOT) == 0) 645 pcb->hp_flags |= HCI_PRIVILEGED; 646 647 /* 648 * Set default user filter. By default, socket only passes 649 * Command_Complete and Command_Status Events. 650 */ 651 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 652 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 653 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 654 655 crit_enter(); 656 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 657 crit_exit(); 658 error = 0; 659 out: 660 lwkt_replymsg(&msg->attach.base.lmsg, error); 661 } 662 663 static void 664 hci_sbind(netmsg_t msg) 665 { 666 struct socket *so = msg->bind.base.nm_so; 667 struct sockaddr *nam = msg->bind.nm_nam; 668 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 669 struct sockaddr_bt *sa; 670 int error; 671 672 KKASSERT(nam != NULL); 673 sa = (struct sockaddr_bt *)nam; 674 675 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 676 error = EINVAL; 677 goto out; 678 } 679 680 if (sa->bt_family != AF_BLUETOOTH) { 681 error = EAFNOSUPPORT; 682 goto out; 683 } 684 685 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 686 687 if (bdaddr_any(&sa->bt_bdaddr)) 688 pcb->hp_flags |= HCI_PROMISCUOUS; 689 else 690 pcb->hp_flags &= ~HCI_PROMISCUOUS; 691 error = 0; 692 out: 693 lwkt_replymsg(&msg->bind.base.lmsg, error); 694 } 695 696 static void 697 hci_sconnect(netmsg_t msg) 698 { 699 struct socket *so = msg->connect.base.nm_so; 700 struct sockaddr *nam = msg->connect.nm_nam; 701 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 702 struct sockaddr_bt *sa; 703 int error; 704 705 KKASSERT(nam != NULL); 706 sa = (struct sockaddr_bt *)nam; 707 708 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 709 error = EINVAL; 710 goto out; 711 } 712 713 if (sa->bt_family != AF_BLUETOOTH) { 714 error = EAFNOSUPPORT; 715 goto out; 716 } 717 718 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) { 719 error = EADDRNOTAVAIL; 720 goto out; 721 } 722 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 723 soisconnected(so); 724 error = 0; 725 out: 726 lwkt_replymsg(&msg->connect.base.lmsg, error); 727 } 728 729 static void 730 hci_speeraddr(netmsg_t msg) 731 { 732 struct socket *so = msg->peeraddr.base.nm_so; 733 struct sockaddr **nam = msg->peeraddr.nm_nam; 734 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 735 struct sockaddr_bt *sa; 736 737 KKASSERT(nam != NULL); 738 sa = (struct sockaddr_bt *)nam; 739 740 memset(sa, 0, sizeof(struct sockaddr_bt)); 741 sa->bt_len = sizeof(struct sockaddr_bt); 742 sa->bt_family = AF_BLUETOOTH; 743 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 744 745 lwkt_replymsg(&msg->connect.base.lmsg, 0); 746 } 747 748 static void 749 hci_ssockaddr(netmsg_t msg) 750 { 751 struct socket *so = msg->sockaddr.base.nm_so; 752 struct sockaddr **nam = msg->sockaddr.nm_nam; 753 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 754 struct sockaddr_bt *sa; 755 756 KKASSERT(nam != NULL); 757 sa = (struct sockaddr_bt *)nam; 758 759 memset(sa, 0, sizeof(struct sockaddr_bt)); 760 sa->bt_len = sizeof(struct sockaddr_bt); 761 sa->bt_family = AF_BLUETOOTH; 762 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 763 764 lwkt_replymsg(&msg->connect.base.lmsg, 0); 765 } 766 767 static void 768 hci_sshutdown(netmsg_t msg) 769 { 770 struct socket *so = msg->shutdown.base.nm_so; 771 772 socantsendmore(so); 773 lwkt_replymsg(&msg->connect.base.lmsg, 0); 774 } 775 776 static void 777 hci_ssend(netmsg_t msg) 778 { 779 struct socket *so = msg->send.base.nm_so; 780 struct mbuf *m = msg->send.nm_m; 781 struct sockaddr *addr = msg->send.nm_addr; 782 struct mbuf *control = msg->send.nm_control; 783 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 784 struct sockaddr_bt *sa; 785 int error; 786 787 sa = NULL; 788 if (addr) { 789 sa = (struct sockaddr_bt *)addr; 790 791 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 792 error = EINVAL; 793 goto out; 794 } 795 796 if (sa->bt_family != AF_BLUETOOTH) { 797 error = EAFNOSUPPORT; 798 goto out; 799 } 800 } 801 802 /* have no use for this */ 803 if (control) { 804 m_freem(control); 805 control = NULL; 806 } 807 error = hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 808 m = NULL; 809 810 out: 811 if (m) 812 m_freem(m); 813 if (control) 814 m_freem(control); 815 lwkt_replymsg(&msg->send.base.lmsg, error); 816 } 817 818 /* 819 * get/set socket options 820 */ 821 void 822 hci_ctloutput(netmsg_t msg) 823 { 824 struct socket *so = msg->ctloutput.base.nm_so; 825 struct sockopt *sopt = msg->ctloutput.nm_sopt; 826 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 827 int idir = 0; 828 int error = 0; 829 830 #ifdef notyet /* XXX */ 831 DPRINTFN(2, "req %s\n", prcorequests[req]); 832 #endif 833 834 if (pcb == NULL) { 835 error = EINVAL; 836 goto out; 837 } 838 839 if (sopt->sopt_level != BTPROTO_HCI) { 840 error = ENOPROTOOPT; 841 goto out; 842 } 843 844 switch(sopt->sopt_dir) { 845 case PRCO_GETOPT: 846 switch (sopt->sopt_name) { 847 case SO_HCI_EVT_FILTER: 848 soopt_from_kbuf(sopt, &pcb->hp_efilter, 849 sizeof(struct hci_filter)); 850 break; 851 852 case SO_HCI_PKT_FILTER: 853 soopt_from_kbuf(sopt, &pcb->hp_pfilter, 854 sizeof(struct hci_filter)); 855 break; 856 857 case SO_HCI_DIRECTION: 858 if (pcb->hp_flags & HCI_DIRECTION) 859 idir = 1; 860 else 861 idir = 0; 862 soopt_from_kbuf(sopt, &idir, sizeof(int)); 863 break; 864 865 default: 866 error = ENOPROTOOPT; 867 break; 868 } 869 break; 870 871 case PRCO_SETOPT: 872 switch (sopt->sopt_name) { 873 case SO_HCI_EVT_FILTER: /* set event filter */ 874 error = soopt_to_kbuf(sopt, &pcb->hp_efilter, 875 sizeof(struct hci_filter), 876 sizeof(struct hci_filter)); 877 break; 878 879 case SO_HCI_PKT_FILTER: /* set packet filter */ 880 error = soopt_to_kbuf(sopt, &pcb->hp_pfilter, 881 sizeof(struct hci_filter), 882 sizeof(struct hci_filter)); 883 break; 884 885 case SO_HCI_DIRECTION: /* request direction ctl messages */ 886 error = soopt_to_kbuf(sopt, &idir, sizeof(int), 887 sizeof(int)); 888 if (error) 889 break; 890 if (idir) 891 pcb->hp_flags |= HCI_DIRECTION; 892 else 893 pcb->hp_flags &= ~HCI_DIRECTION; 894 break; 895 896 default: 897 error = ENOPROTOOPT; 898 break; 899 } 900 break; 901 902 default: 903 error = ENOPROTOOPT; 904 break; 905 } 906 out: 907 lwkt_replymsg(&msg->ctloutput.base.lmsg, error); 908 } 909 910 /* 911 * HCI mbuf tap routine 912 * 913 * copy packets to any raw HCI sockets that wish (and are 914 * permitted) to see them 915 */ 916 void 917 hci_mtap(struct mbuf *m, struct hci_unit *unit) 918 { 919 struct hci_pcb *pcb; 920 struct mbuf *m0, *ctlmsg, **ctl; 921 struct sockaddr_bt sa; 922 uint8_t type; 923 uint8_t event; 924 uint16_t opcode; 925 926 KKASSERT(m->m_len >= sizeof(type)); 927 928 type = *mtod(m, uint8_t *); 929 930 memset(&sa, 0, sizeof(sa)); 931 sa.bt_len = sizeof(struct sockaddr_bt); 932 sa.bt_family = AF_BLUETOOTH; 933 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 934 935 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 936 /* 937 * filter according to source address 938 */ 939 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 940 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 941 continue; 942 943 /* 944 * filter according to packet type filter 945 */ 946 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 947 continue; 948 949 /* 950 * filter according to event/security filters 951 */ 952 switch(type) { 953 case HCI_EVENT_PKT: 954 KKASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 955 956 event = mtod(m, hci_event_hdr_t *)->event; 957 958 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 959 continue; 960 961 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 962 && hci_security_check_event(event) == -1) 963 continue; 964 break; 965 966 case HCI_CMD_PKT: 967 KKASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 968 969 opcode = letoh16(mtod(m, hci_cmd_hdr_t *)->opcode); 970 971 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 972 && hci_security_check_opcode(NULL, opcode) == -1) 973 continue; 974 break; 975 976 case HCI_ACL_DATA_PKT: 977 case HCI_SCO_DATA_PKT: 978 default: 979 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 980 continue; 981 982 break; 983 } 984 985 /* 986 * create control messages 987 */ 988 ctlmsg = NULL; 989 ctl = &ctlmsg; 990 if (pcb->hp_flags & HCI_DIRECTION) { 991 int dir = m->m_flags & IFF_LINK0 ? 1 : 0; 992 993 *ctl = sbcreatecontrol((void *)&dir, sizeof(dir), 994 SCM_HCI_DIRECTION, BTPROTO_HCI); 995 996 if (*ctl != NULL) 997 ctl = &((*ctl)->m_next); 998 } 999 1000 /* 1001 * copy to socket 1002 */ 1003 m0 = m_copym(m, 0, M_COPYALL, M_NOWAIT); 1004 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv.sb, 1005 (struct sockaddr *)&sa, m0, ctlmsg)) { 1006 sorwakeup(pcb->hp_socket); 1007 } else { 1008 m_freem(ctlmsg); 1009 m_freem(m0); 1010 } 1011 } 1012 } 1013 1014 struct pr_usrreqs hci_usrreqs = { 1015 .pru_abort = hci_sabort, 1016 .pru_accept = pr_generic_notsupp, 1017 .pru_attach = hci_sattach, 1018 .pru_bind = hci_sbind, 1019 .pru_connect = hci_sconnect, 1020 .pru_connect2 = pr_generic_notsupp, 1021 .pru_control = hci_scontrol, 1022 .pru_detach = hci_sdetach, 1023 .pru_disconnect = hci_sdisconnect, 1024 .pru_listen = pr_generic_notsupp, 1025 .pru_peeraddr = hci_speeraddr, 1026 .pru_rcvd = pr_generic_notsupp, 1027 .pru_rcvoob = pr_generic_notsupp, 1028 .pru_send = hci_ssend, 1029 .pru_sense = pru_sense_null, 1030 .pru_shutdown = hci_sshutdown, 1031 .pru_sockaddr = hci_ssockaddr, 1032 .pru_sosend = sosend, 1033 .pru_soreceive = soreceive 1034 }; 1035