sys/netbt/hci_socket.c

   1 /* $DragonFly: src/sys/netbt/hci_socket.c,v 1.3 2008/06/20 20:52:29 aggelos Exp $ */
   2 /* $OpenBSD: src/sys/netbt/hci_socket.c,v 1.5 2008/02/24 21:34:48 uwe Exp $ */
   3 /* $NetBSD: hci_socket.c,v 1.14 2008/02/10 17:40:54 plunky Exp $ */
   4
   5 /*-
   6  * Copyright (c) 2005 Iain Hibbert.
   7  * Copyright (c) 2006 Itronix Inc.
   8  * All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. The name of Itronix Inc. may not be used to endorse
  19  *    or promote products derived from this software without specific
  20  *    prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  25  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
  26  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  27  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  29  * ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  32  * POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 /* load symbolic names */
  36 #ifdef BLUETOOTH_DEBUG
  37 #define PRUREQUESTS
  38 #define PRCOREQUESTS
  39 #endif
  40
  41 #include <sys/param.h>
  42 #include <sys/domain.h>
  43 #include <sys/kernel.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/proc.h>
  46 #include <sys/priv.h>
  47 #include <sys/protosw.h>
  48 #include <sys/socket.h>
  49 #include <sys/socketvar.h>
  50 #include <sys/systm.h>
  51 #include <sys/endian.h>
  52 #include <net/if.h>
  53 #include <net/if_var.h>
  54 #include <sys/sysctl.h>
  55 #include <sys/thread2.h>
  56
  57 #include <netbt/bluetooth.h>
  58 #include <netbt/hci.h>
  59
  60 /*******************************************************************************
  61  *
  62  * HCI SOCK_RAW Sockets - for control of Bluetooth Devices
  63  *
  64  */
  65
  66 /*
  67  * the raw HCI protocol control block
  68  */
  69 struct hci_pcb {
  70         struct socket           *hp_socket;     /* socket */
  71         unsigned int            hp_flags;       /* flags */
  72         bdaddr_t                hp_laddr;       /* local address */
  73         bdaddr_t                hp_raddr;       /* remote address */
  74         struct hci_filter       hp_efilter;     /* user event filter */
  75         struct hci_filter       hp_pfilter;     /* user packet filter */
  76         LIST_ENTRY(hci_pcb)     hp_next;        /* next HCI pcb */
  77 };
  78
  79 /* hp_flags */
  80 #define HCI_PRIVILEGED          (1<<0)  /* no security filter for root */
  81 #define HCI_DIRECTION           (1<<1)  /* direction control messages */
  82 #define HCI_PROMISCUOUS         (1<<2)  /* listen to all units */
  83
  84 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb);
  85
  86 /* sysctl defaults */
  87 int hci_sendspace = HCI_CMD_PKT_SIZE;
  88 int hci_recvspace = 4096;
  89
  90 extern struct pr_usrreqs hci_usrreqs;
  91
  92 /* Prototypes for usrreqs methods. */
  93 static int hci_sabort (struct socket *so);
  94 static int hci_sdetach(struct socket *so);
  95 static int hci_sdisconnect (struct socket *so);
  96 static int hci_scontrol (struct socket *so, u_long cmd, caddr_t data,
  97                                     struct ifnet *ifp, struct thread *td);
  98 static int hci_sattach (struct socket *so, int proto,
  99                                struct pru_attach_info *ai);
 100 static int hci_sbind (struct socket *so, struct sockaddr *nam,
 101                                  struct thread *td);
 102 static int hci_sconnect (struct socket *so, struct sockaddr *nam,
 103                                     struct thread *td);
 104 static int hci_speeraddr (struct socket *so, struct sockaddr **nam);
 105 static int hci_ssockaddr (struct socket *so, struct sockaddr **nam);
 106 static int hci_sshutdown (struct socket *so);
 107 static int hci_ssend (struct socket *so, int flags, struct mbuf *m,
 108                                  struct sockaddr *addr, struct mbuf *control,
 109                                  struct thread *td);
 110
 111 /* supported commands opcode table */
 112 static const struct {
 113         uint16_t        opcode;
 114         uint8_t         offs;   /* 0 - 63 */
 115         uint8_t         mask;   /* bit 0 - 7 */
 116         int16_t         length; /* -1 if privileged */
 117 } hci_cmds[] = {
 118         { HCI_CMD_INQUIRY,
 119           0,  0x01, sizeof(hci_inquiry_cp) },
 120         { HCI_CMD_INQUIRY_CANCEL,
 121           0,  0x02, -1 },
 122         { HCI_CMD_PERIODIC_INQUIRY,
 123           0,  0x04, -1 },
 124         { HCI_CMD_EXIT_PERIODIC_INQUIRY,
 125           0,  0x08, -1 },
 126         { HCI_CMD_CREATE_CON,
 127           0,  0x10, -1 },
 128         { HCI_CMD_DISCONNECT,
 129           0,  0x20, -1 },
 130         { HCI_CMD_ADD_SCO_CON,
 131           0,  0x40, -1 },
 132         { HCI_CMD_CREATE_CON_CANCEL,
 133           0,  0x80, -1 },
 134         { HCI_CMD_ACCEPT_CON,
 135           1,  0x01, -1 },
 136         { HCI_CMD_REJECT_CON,
 137           1,  0x02, -1 },
 138         { HCI_CMD_LINK_KEY_REP,
 139           1,  0x04, -1 },
 140         { HCI_CMD_LINK_KEY_NEG_REP,
 141           1,  0x08, -1 },
 142         { HCI_CMD_PIN_CODE_REP,
 143           1,  0x10, -1 },
 144         { HCI_CMD_PIN_CODE_NEG_REP,
 145           1,  0x20, -1 },
 146         { HCI_CMD_CHANGE_CON_PACKET_TYPE,
 147           1,  0x40, -1 },
 148         { HCI_CMD_AUTH_REQ,
 149           1,  0x80, -1 },
 150         { HCI_CMD_SET_CON_ENCRYPTION,
 151           2,  0x01, -1 },
 152         { HCI_CMD_CHANGE_CON_LINK_KEY,
 153           2,  0x02, -1 },
 154         { HCI_CMD_MASTER_LINK_KEY,
 155           2,  0x04, -1 },
 156         { HCI_CMD_REMOTE_NAME_REQ,
 157           2,  0x08, sizeof(hci_remote_name_req_cp) },
 158         { HCI_CMD_REMOTE_NAME_REQ_CANCEL,
 159           2,  0x10, -1 },
 160         { HCI_CMD_READ_REMOTE_FEATURES,
 161           2,  0x20, sizeof(hci_read_remote_features_cp) },
 162         { HCI_CMD_READ_REMOTE_EXTENDED_FEATURES,
 163           2,  0x40, sizeof(hci_read_remote_extended_features_cp) },
 164         { HCI_CMD_READ_REMOTE_VER_INFO,
 165           2,  0x80, sizeof(hci_read_remote_ver_info_cp) },
 166         { HCI_CMD_READ_CLOCK_OFFSET,
 167           3,  0x01, sizeof(hci_read_clock_offset_cp) },
 168         { HCI_CMD_READ_LMP_HANDLE,
 169           3,  0x02, sizeof(hci_read_lmp_handle_cp) },
 170         { HCI_CMD_HOLD_MODE,
 171           4,  0x02, -1 },
 172         { HCI_CMD_SNIFF_MODE,
 173           4,  0x04, -1 },
 174         { HCI_CMD_EXIT_SNIFF_MODE,
 175           4,  0x08, -1 },
 176         { HCI_CMD_PARK_MODE,
 177           4,  0x10, -1 },
 178         { HCI_CMD_EXIT_PARK_MODE,
 179           4,  0x20, -1 },
 180         { HCI_CMD_QOS_SETUP,
 181           4,  0x40, -1 },
 182         { HCI_CMD_ROLE_DISCOVERY,
 183           4,  0x80, sizeof(hci_role_discovery_cp) },
 184         { HCI_CMD_SWITCH_ROLE,
 185           5,  0x01, -1 },
 186         { HCI_CMD_READ_LINK_POLICY_SETTINGS,
 187           5,  0x02, sizeof(hci_read_link_policy_settings_cp) },
 188         { HCI_CMD_WRITE_LINK_POLICY_SETTINGS,
 189           5,  0x04, -1 },
 190         { HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS,
 191           5,  0x08, 0 },
 192         { HCI_CMD_WRITE_DEFAULT_LINK_POLICY_SETTINGS,
 193           5,  0x10, -1 },
 194         { HCI_CMD_FLOW_SPECIFICATION,
 195           5,  0x20, -1 },
 196         { HCI_CMD_SET_EVENT_MASK,
 197           5,  0x40, -1 },
 198         { HCI_CMD_RESET,
 199           5,  0x80, -1 },
 200         { HCI_CMD_SET_EVENT_FILTER,
 201           6,  0x01, -1 },
 202         { HCI_CMD_FLUSH,
 203           6,  0x02, -1 },
 204         { HCI_CMD_READ_PIN_TYPE,
 205           6,  0x04, 0 },
 206         { HCI_CMD_WRITE_PIN_TYPE,
 207           6,  0x08, -1 },
 208         { HCI_CMD_CREATE_NEW_UNIT_KEY,
 209           6,  0x10, -1 },
 210         { HCI_CMD_READ_STORED_LINK_KEY,
 211           6,  0x20, -1 },
 212         { HCI_CMD_WRITE_STORED_LINK_KEY,
 213           6,  0x40, -1 },
 214         { HCI_CMD_DELETE_STORED_LINK_KEY,
 215           6,  0x80, -1 },
 216         { HCI_CMD_WRITE_LOCAL_NAME,
 217           7,  0x01, -1 },
 218         { HCI_CMD_READ_LOCAL_NAME,
 219           7,  0x02, 0 },
 220         { HCI_CMD_READ_CON_ACCEPT_TIMEOUT,
 221           7,  0x04, 0 },
 222         { HCI_CMD_WRITE_CON_ACCEPT_TIMEOUT,
 223           7,  0x08, -1 },
 224         { HCI_CMD_READ_PAGE_TIMEOUT,
 225           7,  0x10, 0 },
 226         { HCI_CMD_WRITE_PAGE_TIMEOUT,
 227           7,  0x20, -1 },
 228         { HCI_CMD_READ_SCAN_ENABLE,
 229           7,  0x40, 0 },
 230         { HCI_CMD_WRITE_SCAN_ENABLE,
 231           7,  0x80, -1 },
 232         { HCI_CMD_READ_PAGE_SCAN_ACTIVITY,
 233           8,  0x01, 0 },
 234         { HCI_CMD_WRITE_PAGE_SCAN_ACTIVITY,
 235           8,  0x02, -1 },
 236         { HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY,
 237           8,  0x04, 0 },
 238         { HCI_CMD_WRITE_INQUIRY_SCAN_ACTIVITY,
 239           8,  0x08, -1 },
 240         { HCI_CMD_READ_AUTH_ENABLE,
 241           8,  0x10, 0 },
 242         { HCI_CMD_WRITE_AUTH_ENABLE,
 243           8,  0x20, -1 },
 244         { HCI_CMD_READ_ENCRYPTION_MODE,
 245           8,  0x40, 0 },
 246         { HCI_CMD_WRITE_ENCRYPTION_MODE,
 247           8,  0x80, -1 },
 248         { HCI_CMD_READ_UNIT_CLASS,
 249           9,  0x01, 0 },
 250         { HCI_CMD_WRITE_UNIT_CLASS,
 251           9,  0x02, -1 },
 252         { HCI_CMD_READ_VOICE_SETTING,
 253           9,  0x04, 0 },
 254         { HCI_CMD_WRITE_VOICE_SETTING,
 255           9,  0x08, -1 },
 256         { HCI_CMD_READ_AUTO_FLUSH_TIMEOUT,
 257           9,  0x10, sizeof(hci_read_auto_flush_timeout_cp) },
 258         { HCI_CMD_WRITE_AUTO_FLUSH_TIMEOUT,
 259           9,  0x20, -1 },
 260         { HCI_CMD_READ_NUM_BROADCAST_RETRANS,
 261           9,  0x40, 0 },
 262         { HCI_CMD_WRITE_NUM_BROADCAST_RETRANS,
 263           9,  0x80, -1 },
 264         { HCI_CMD_READ_HOLD_MODE_ACTIVITY,
 265           10, 0x01, 0 },
 266         { HCI_CMD_WRITE_HOLD_MODE_ACTIVITY,
 267           10, 0x02, -1 },
 268         { HCI_CMD_READ_XMIT_LEVEL,
 269           10, 0x04, sizeof(hci_read_xmit_level_cp) },
 270         { HCI_CMD_READ_SCO_FLOW_CONTROL,
 271           10, 0x08, 0 },
 272         { HCI_CMD_WRITE_SCO_FLOW_CONTROL,
 273           10, 0x10, -1 },
 274         { HCI_CMD_HC2H_FLOW_CONTROL,
 275           10, 0x20, -1 },
 276         { HCI_CMD_HOST_BUFFER_SIZE,
 277           10, 0x40, -1 },
 278         { HCI_CMD_HOST_NUM_COMPL_PKTS,
 279           10, 0x80, -1 },
 280         { HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT,
 281           11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) },
 282         { HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT,
 283           11, 0x02, -1 },
 284         { HCI_CMD_READ_NUM_SUPPORTED_IAC,
 285           11, 0x04, 0 },
 286         { HCI_CMD_READ_IAC_LAP,
 287           11, 0x08, 0 },
 288         { HCI_CMD_WRITE_IAC_LAP,
 289           11, 0x10, -1 },
 290         { HCI_CMD_READ_PAGE_SCAN_PERIOD,
 291           11, 0x20, 0 },
 292         { HCI_CMD_WRITE_PAGE_SCAN_PERIOD,
 293           11, 0x40, -1 },
 294         { HCI_CMD_READ_PAGE_SCAN,
 295           11, 0x80, 0 },
 296         { HCI_CMD_WRITE_PAGE_SCAN,
 297           12, 0x01, -1 },
 298         { HCI_CMD_SET_AFH_CLASSIFICATION,
 299           12, 0x02, -1 },
 300         { HCI_CMD_READ_INQUIRY_SCAN_TYPE,
 301           12, 0x10, 0 },
 302         { HCI_CMD_WRITE_INQUIRY_SCAN_TYPE,
 303           12, 0x20, -1 },
 304         { HCI_CMD_READ_INQUIRY_MODE,
 305           12, 0x40, 0 },
 306         { HCI_CMD_WRITE_INQUIRY_MODE,
 307           12, 0x80, -1 },
 308         { HCI_CMD_READ_PAGE_SCAN_TYPE,
 309           13, 0x01, 0 },
 310         { HCI_CMD_WRITE_PAGE_SCAN_TYPE,
 311           13, 0x02, -1 },
 312         { HCI_CMD_READ_AFH_ASSESSMENT,
 313           13, 0x04, 0 },
 314         { HCI_CMD_WRITE_AFH_ASSESSMENT,
 315           13, 0x08, -1 },
 316         { HCI_CMD_READ_LOCAL_VER,
 317           14, 0x08, 0 },
 318         { HCI_CMD_READ_LOCAL_COMMANDS,
 319           14, 0x10, 0 },
 320         { HCI_CMD_READ_LOCAL_FEATURES,
 321           14, 0x20, 0 },
 322         { HCI_CMD_READ_LOCAL_EXTENDED_FEATURES,
 323           14, 0x40, sizeof(hci_read_local_extended_features_cp) },
 324         { HCI_CMD_READ_BUFFER_SIZE,
 325           14, 0x80, 0 },
 326         { HCI_CMD_READ_COUNTRY_CODE,
 327           15, 0x01, 0 },
 328         { HCI_CMD_READ_BDADDR,
 329           15, 0x02, 0 },
 330         { HCI_CMD_READ_FAILED_CONTACT_CNTR,
 331           15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) },
 332         { HCI_CMD_RESET_FAILED_CONTACT_CNTR,
 333           15, 0x08, -1 },
 334         { HCI_CMD_READ_LINK_QUALITY,
 335           15, 0x10, sizeof(hci_read_link_quality_cp) },
 336         { HCI_CMD_READ_RSSI,
 337           15, 0x20, sizeof(hci_read_rssi_cp) },
 338         { HCI_CMD_READ_AFH_CHANNEL_MAP,
 339           15, 0x40, sizeof(hci_read_afh_channel_map_cp) },
 340         { HCI_CMD_READ_CLOCK,
 341           15, 0x80, sizeof(hci_read_clock_cp) },
 342         { HCI_CMD_READ_LOOPBACK_MODE,
 343           16, 0x01, 0 },
 344         { HCI_CMD_WRITE_LOOPBACK_MODE,
 345           16, 0x02, -1 },
 346         { HCI_CMD_ENABLE_UNIT_UNDER_TEST,
 347           16, 0x04, -1 },
 348         { HCI_CMD_SETUP_SCO_CON,
 349           16, 0x08, -1 },
 350         { HCI_CMD_ACCEPT_SCO_CON_REQ,
 351           16, 0x10, -1 },
 352         { HCI_CMD_REJECT_SCO_CON_REQ,
 353           16, 0x20, -1 },
 354         { HCI_CMD_READ_EXTENDED_INQUIRY_RSP,
 355           17, 0x01, 0 },
 356         { HCI_CMD_WRITE_EXTENDED_INQUIRY_RSP,
 357           17, 0x02, -1 },
 358         { HCI_CMD_REFRESH_ENCRYPTION_KEY,
 359           17, 0x04, -1 },
 360         { HCI_CMD_SNIFF_SUBRATING,
 361           17, 0x10, -1 },
 362         { HCI_CMD_READ_SIMPLE_PAIRING_MODE,
 363           17, 0x20, 0 },
 364         { HCI_CMD_WRITE_SIMPLE_PAIRING_MODE,
 365           17, 0x40, -1 },
 366         { HCI_CMD_READ_LOCAL_OOB_DATA,
 367           17, 0x80, -1 },
 368         { HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER,
 369           18, 0x01, 0 },
 370         { HCI_CMD_WRITE_INQUIRY_RSP_XMIT_POWER,
 371           18, 0x02, -1 },
 372         { HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING,
 373           18, 0x04, 0 },
 374         { HCI_CMD_WRITE_DEFAULT_ERRDATA_REPORTING,
 375           18, 0x08, -1 },
 376         { HCI_CMD_IO_CAPABILITY_REP,
 377           18, 0x80, -1 },
 378         { HCI_CMD_USER_CONFIRM_REP,
 379           19, 0x01, -1 },
 380         { HCI_CMD_USER_CONFIRM_NEG_REP,
 381           19, 0x02, -1 },
 382         { HCI_CMD_USER_PASSKEY_REP,
 383           19, 0x04, -1 },
 384         { HCI_CMD_USER_PASSKEY_NEG_REP,
 385           19, 0x08, -1 },
 386         { HCI_CMD_OOB_DATA_REP,
 387           19, 0x10, -1 },
 388         { HCI_CMD_WRITE_SIMPLE_PAIRING_DEBUG_MODE,
 389           19, 0x20, -1 },
 390         { HCI_CMD_ENHANCED_FLUSH,
 391           19, 0x40, -1 },
 392         { HCI_CMD_OOB_DATA_NEG_REP,
 393           19, 0x80, -1 },
 394         { HCI_CMD_SEND_KEYPRESS_NOTIFICATION,
 395           20, 0x40, -1 },
 396         { HCI_CMD_IO_CAPABILITY_NEG_REP,
 397           20, 0x80, -1 },
 398 };
 399
 400 /*
 401  * Security filter routines for unprivileged users.
 402  *      Allow all but a few critical events, and only permit read commands.
 403  *      If a unit is given, verify the command is supported.
 404  */
 405
 406 static int
 407 hci_security_check_opcode(struct hci_unit *unit, uint16_t opcode)
 408 {
 409         int i;
 410
 411         for (i = 0 ; i < sizeof(hci_cmds) / sizeof(hci_cmds[0]); i++) {
 412                 if (opcode != hci_cmds[i].opcode)
 413                         continue;
 414
 415                 if (unit == NULL
 416                     || (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask))
 417                         return hci_cmds[i].length;
 418
 419                 break;
 420         }
 421
 422         return -1;
 423 }
 424
 425 static int
 426 hci_security_check_event(uint8_t event)
 427 {
 428
 429         switch (event) {
 430         case HCI_EVENT_RETURN_LINK_KEYS:
 431         case HCI_EVENT_LINK_KEY_NOTIFICATION:
 432         case HCI_EVENT_USER_CONFIRM_REQ:
 433         case HCI_EVENT_USER_PASSKEY_NOTIFICATION:
 434         case HCI_EVENT_VENDOR:
 435                 return -1;      /* disallowed */
 436         }
 437
 438         return 0;       /* ok */
 439 }
 440
 441 /*
 442  * When command packet reaches the device, we can drop
 443  * it from the socket buffer (called from hci_output_acl)
 444  */
 445 void
 446 hci_drop(void *arg)
 447 {
 448         struct socket *so = arg;
 449
 450         sbdroprecord(&so->so_snd.sb);
 451         sowwakeup(so);
 452 }
 453
 454 /*
 455  * HCI socket is going away and has some pending packets. We let them
 456  * go by design, but remove the context pointer as it will be invalid
 457  * and we no longer need to be notified.
 458  */
 459 static void
 460 hci_cmdwait_flush(struct socket *so)
 461 {
 462         struct hci_unit *unit;
 463         struct socket *ctx;
 464         struct mbuf *m;
 465
 466         DPRINTF("flushing %p\n", so);
 467
 468         TAILQ_FOREACH(unit, &hci_unit_list, hci_next) {
 469                 IF_POLL(&unit->hci_cmdwait, m);
 470                 while (m != NULL) {
 471                         ctx = M_GETCTX(m, struct socket *);
 472                         if (ctx == so)
 473                                 M_SETCTX(m, NULL);
 474
 475                         m = m->m_nextpkt;
 476                 }
 477         }
 478 }
 479
 480 /*
 481  * HCI send packet
 482  *     This came from userland, so check it out.
 483  */
 484 static int
 485 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr)
 486 {
 487         struct hci_unit *unit;
 488         struct mbuf *m0;
 489         hci_cmd_hdr_t hdr;
 490         int err;
 491
 492         KKASSERT(m != NULL);
 493         KKASSERT(addr != NULL);
 494
 495         /* wants at least a header to start with */
 496         if (m->m_pkthdr.len < sizeof(hdr)) {
 497                 err = EMSGSIZE;
 498                 goto bad;
 499         }
 500         m_copydata(m, 0, sizeof(hdr), (caddr_t)&hdr);
 501         hdr.opcode = letoh16(hdr.opcode);
 502
 503         /* only allows CMD packets to be sent */
 504         if (hdr.type != HCI_CMD_PKT) {
 505                 err = EINVAL;
 506                 goto bad;
 507         }
 508
 509         /* validates packet length */
 510         if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) {
 511                 err = EMSGSIZE;
 512                 goto bad;
 513         }
 514
 515         /* finds destination */
 516         unit = hci_unit_lookup(addr);
 517         if (unit == NULL) {
 518                 err = ENETDOWN;
 519                 goto bad;
 520         }
 521
 522         /* security checks for unprivileged users */
 523         if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
 524             && hci_security_check_opcode(unit, hdr.opcode) != hdr.length) {
 525                 err = EPERM;
 526                 goto bad;
 527         }
 528
 529         /* makes a copy for precious to keep */
 530         m0 = m_copym(m, 0, M_COPYALL, MB_DONTWAIT);
 531         if (m0 == NULL) {
 532                 err = ENOMEM;
 533                 goto bad;
 534         }
 535         sbappendrecord(&pcb->hp_socket->so_snd.sb, m0);
 536         M_SETCTX(m, pcb->hp_socket);    /* enable drop callback */
 537
 538         DPRINTFN(2, "(%s) opcode (%03x|%04x)\n",
 539                 device_get_nameunit(unit->hci_dev),
 540                 HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode));
 541
 542         /* Sendss it */
 543         if (unit->hci_num_cmd_pkts == 0)
 544                 IF_ENQUEUE(&unit->hci_cmdwait, m);
 545         else
 546                 hci_output_cmd(unit, m);
 547
 548         return 0;
 549
 550 bad:
 551         DPRINTF("packet (%d bytes) not sent (error %d)\n",
 552             m->m_pkthdr.len, err);
 553         if (m) m_freem(m);
 554         return err;
 555 }
 556
 557 /*
 558  * Implementation of usrreqs.
 559  */
 560 static int
 561 hci_sabort (struct socket *so)
 562 {
 563         /* struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;  */
 564
 565         soisdisconnected(so);
 566         return hci_sdetach(so);
 567 }
 568
 569 static int
 570 hci_sdetach(struct socket *so)
 571 {
 572         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 573
 574         if (pcb == NULL)
 575                 return EINVAL;
 576         if (so->so_snd.ssb_mb != NULL)
 577                 hci_cmdwait_flush(so);
 578
 579         so->so_pcb = NULL;
 580         LIST_REMOVE(pcb, hp_next);
 581         kfree(pcb, M_PCB);
 582
 583         return 0;
 584 }
 585
 586 static int
 587 hci_sdisconnect (struct socket *so)
 588 {
 589         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 590
 591         if (pcb==NULL)
 592                 return EINVAL;
 593
 594         bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY);
 595         /*
 596          * XXX We cannot call soisdisconnected() here, as it sets
 597          * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem is that
 598          * soisconnected() does not clear these and if you try to reconnect
 599          * this socket (which is permitted) you get a broken pipe when you
 600          * try to write any data.
 601          */
 602         so->so_state &= ~SS_ISCONNECTED;
 603
 604         return 0;
 605 }
 606
 607 static int
 608 hci_scontrol (struct socket *so, u_long cmd, caddr_t data, struct ifnet *ifp,
 609     struct thread *td)
 610 {
 611         return hci_ioctl(cmd, (void*)data, NULL);
 612 }
 613
 614 static int
 615 hci_sattach (struct socket *so, int proto, struct pru_attach_info *ai)
 616 {
 617         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 618         int err = 0;
 619
 620         if (pcb)
 621                 return EINVAL;
 622
 623         err = soreserve(so, hci_sendspace, hci_recvspace,NULL);
 624         if (err)
 625                 return err;
 626
 627         pcb = kmalloc(sizeof *pcb, M_PCB, M_NOWAIT | M_ZERO);
 628         if (pcb == NULL)
 629                 return ENOMEM;
 630
 631         so->so_pcb = pcb;
 632         pcb->hp_socket = so;
 633
 634         if (curproc == NULL || priv_check(curthread, PRIV_ROOT) == 0)
 635                 pcb->hp_flags |= HCI_PRIVILEGED;
 636
 637         /*
 638          * Set default user filter. By default, socket only passes
 639          * Command_Complete and Command_Status Events.
 640          */
 641         hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter);
 642         hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter);
 643         hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter);
 644
 645         crit_enter();
 646         LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next);
 647         crit_exit();
 648
 649         return 0;
 650 }
 651
 652 static int
 653 hci_sbind (struct socket *so, struct sockaddr *nam,
 654                                  struct thread *td)
 655 {
 656         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 657         struct sockaddr_bt *sa;
 658
 659         KKASSERT(nam != NULL);
 660         sa = (struct sockaddr_bt *)nam;
 661
 662         if (sa->bt_len != sizeof(struct sockaddr_bt))
 663                 return EINVAL;
 664
 665         if (sa->bt_family != AF_BLUETOOTH)
 666                 return EAFNOSUPPORT;
 667
 668         bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr);
 669
 670         if (bdaddr_any(&sa->bt_bdaddr))
 671                 pcb->hp_flags |= HCI_PROMISCUOUS;
 672         else
 673                 pcb->hp_flags &= ~HCI_PROMISCUOUS;
 674
 675         return 0;
 676 }
 677
 678 static int
 679 hci_sconnect (struct socket *so, struct sockaddr *nam,
 680                                     struct thread *td)
 681 {
 682         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 683         struct sockaddr_bt *sa;
 684         KKASSERT(nam != NULL);
 685         sa = (struct sockaddr_bt *)nam;
 686
 687         if (sa->bt_len != sizeof(struct sockaddr_bt))
 688                 return EINVAL;
 689
 690         if (sa->bt_family != AF_BLUETOOTH)
 691                 return EAFNOSUPPORT;
 692
 693         if (hci_unit_lookup(&sa->bt_bdaddr) == NULL)
 694                 return EADDRNOTAVAIL;
 695
 696         bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr);
 697         soisconnected(so);
 698
 699         return 0;
 700 }
 701
 702 static int
 703 hci_speeraddr (struct socket *so, struct sockaddr **nam)
 704 {
 705         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 706         struct sockaddr_bt *sa;
 707
 708         KKASSERT(nam != NULL);
 709         sa = (struct sockaddr_bt *)nam;
 710
 711         memset(sa, 0, sizeof(struct sockaddr_bt));
 712         sa->bt_len = sizeof(struct sockaddr_bt);
 713         sa->bt_family = AF_BLUETOOTH;
 714         bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr);
 715
 716         return 0;
 717 }
 718
 719 static int
 720 hci_ssockaddr (struct socket *so, struct sockaddr **nam)
 721 {
 722         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 723         struct sockaddr_bt *sa;
 724
 725         KKASSERT(nam != NULL);
 726         sa = (struct sockaddr_bt *)nam;
 727
 728         memset(sa, 0, sizeof(struct sockaddr_bt));
 729         sa->bt_len = sizeof(struct sockaddr_bt);
 730         sa->bt_family = AF_BLUETOOTH;
 731         bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr);
 732
 733         return 0;
 734 }
 735
 736 static int
 737 hci_sshutdown (struct socket *so)
 738 {
 739         socantsendmore(so);
 740         return 0;
 741 }
 742
 743 static int
 744 hci_ssend (struct socket *so, int flags, struct mbuf *m,
 745                                  struct sockaddr *addr, struct mbuf *control,
 746                                  struct thread *td)
 747 {
 748         int err = 0;
 749         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 750         struct sockaddr_bt *sa;
 751
 752         sa = NULL;
 753         if (addr) {
 754                 sa = (struct sockaddr_bt *)addr;
 755
 756                 if (sa->bt_len != sizeof(struct sockaddr_bt)) {
 757                         err = EINVAL;
 758                         if (m) m_freem(m);
 759                         if (control) m_freem(control);
 760                         return err;
 761                 }
 762
 763                 if (sa->bt_family != AF_BLUETOOTH) {
 764                         err = EAFNOSUPPORT;
 765                         if (m) m_freem(m);
 766                         if (control) m_freem(control);
 767                         return err;
 768                 }
 769         }
 770
 771         if (control) /* have no use for this */
 772                 m_freem(control);
 773
 774         return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr));
 775 }
 776
 777 /*
 778  * get/set socket options
 779  */
 780 int
 781 hci_ctloutput (struct socket *so, struct sockopt *sopt)
 782 {
 783         struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
 784         int idir = 0;
 785         int err = 0;
 786
 787 #ifdef notyet                   /* XXX */
 788         DPRINTFN(2, "req %s\n", prcorequests[req]);
 789 #endif
 790
 791         if (pcb == NULL)
 792                 return EINVAL;
 793
 794         if (sopt->sopt_level != BTPROTO_HCI)
 795                 return ENOPROTOOPT;
 796
 797         switch(sopt->sopt_dir) {
 798         case PRCO_GETOPT:
 799                 switch (sopt->sopt_name) {
 800                 case SO_HCI_EVT_FILTER:
 801                         soopt_from_kbuf(sopt, &pcb->hp_efilter,
 802                             sizeof(struct hci_filter));
 803                         break;
 804
 805                 case SO_HCI_PKT_FILTER:
 806                         soopt_from_kbuf(sopt, &pcb->hp_pfilter,
 807                             sizeof(struct hci_filter));
 808                         break;
 809
 810                 case SO_HCI_DIRECTION:
 811                         if (pcb->hp_flags & HCI_DIRECTION)
 812                                 idir = 1;
 813                         else
 814                                 idir = 0;
 815                         soopt_from_kbuf(sopt, &idir, sizeof(int));
 816                         break;
 817
 818                 default:
 819                         err = ENOPROTOOPT;
 820                         break;
 821                 }
 822                 break;
 823
 824         case PRCO_SETOPT:
 825                 switch (sopt->sopt_name) {
 826                 case SO_HCI_EVT_FILTER: /* set event filter */
 827                         err = soopt_to_kbuf(sopt, &pcb->hp_efilter,
 828                             sizeof(struct hci_filter),
 829                             sizeof(struct hci_filter));
 830                         break;
 831
 832                 case SO_HCI_PKT_FILTER: /* set packet filter */
 833                         err = soopt_to_kbuf(sopt, &pcb->hp_pfilter,
 834                             sizeof(struct hci_filter),
 835                             sizeof(struct hci_filter));
 836                         break;
 837
 838                 case SO_HCI_DIRECTION:  /* request direction ctl messages */
 839                         err = soopt_to_kbuf(sopt, &idir, sizeof(int),
 840                             sizeof(int));
 841                         if (err) break;
 842                         if (idir)
 843                                 pcb->hp_flags |= HCI_DIRECTION;
 844                         else
 845                                 pcb->hp_flags &= ~HCI_DIRECTION;
 846                         break;
 847
 848                 default:
 849                         err = ENOPROTOOPT;
 850                         break;
 851                 }
 852                 break;
 853
 854         default:
 855                 err = ENOPROTOOPT;
 856                 break;
 857         }
 858
 859         return err;
 860 }
 861
 862 /*
 863  * HCI mbuf tap routine
 864  *
 865  * copy packets to any raw HCI sockets that wish (and are
 866  * permitted) to see them
 867  */
 868 void
 869 hci_mtap(struct mbuf *m, struct hci_unit *unit)
 870 {
 871         struct hci_pcb *pcb;
 872         struct mbuf *m0, *ctlmsg, **ctl;
 873         struct sockaddr_bt sa;
 874         uint8_t type;
 875         uint8_t event;
 876         uint16_t opcode;
 877
 878         KKASSERT(m->m_len >= sizeof(type));
 879
 880         type = *mtod(m, uint8_t *);
 881
 882         memset(&sa, 0, sizeof(sa));
 883         sa.bt_len = sizeof(struct sockaddr_bt);
 884         sa.bt_family = AF_BLUETOOTH;
 885         bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr);
 886
 887         LIST_FOREACH(pcb, &hci_pcb, hp_next) {
 888                 /*
 889                  * filter according to source address
 890                  */
 891                 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0
 892                     && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0)
 893                         continue;
 894
 895                 /*
 896                  * filter according to packet type filter
 897                  */
 898                 if (hci_filter_test(type, &pcb->hp_pfilter) == 0)
 899                         continue;
 900
 901                 /*
 902                  * filter according to event/security filters
 903                  */
 904                 switch(type) {
 905                 case HCI_EVENT_PKT:
 906                         KKASSERT(m->m_len >= sizeof(hci_event_hdr_t));
 907
 908                         event = mtod(m, hci_event_hdr_t *)->event;
 909
 910                         if (hci_filter_test(event, &pcb->hp_efilter) == 0)
 911                                 continue;
 912
 913                         if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
 914                             && hci_security_check_event(event) == -1)
 915                                 continue;
 916                         break;
 917
 918                 case HCI_CMD_PKT:
 919                         KKASSERT(m->m_len >= sizeof(hci_cmd_hdr_t));
 920
 921                         opcode = letoh16(mtod(m, hci_cmd_hdr_t *)->opcode);
 922
 923                         if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
 924                             && hci_security_check_opcode(NULL, opcode) == -1)
 925                                 continue;
 926                         break;
 927
 928                 case HCI_ACL_DATA_PKT:
 929                 case HCI_SCO_DATA_PKT:
 930                 default:
 931                         if ((pcb->hp_flags & HCI_PRIVILEGED) == 0)
 932                                 continue;
 933
 934                         break;
 935                 }
 936
 937                 /*
 938                  * create control messages
 939                  */
 940                 ctlmsg = NULL;
 941                 ctl = &ctlmsg;
 942                 if (pcb->hp_flags & HCI_DIRECTION) {
 943                         int dir = m->m_flags & IFF_LINK0 ? 1 : 0;
 944
 945                         *ctl = sbcreatecontrol((void *)&dir, sizeof(dir),
 946                             SCM_HCI_DIRECTION, BTPROTO_HCI);
 947
 948                         if (*ctl != NULL)
 949                                 ctl = &((*ctl)->m_next);
 950                 }
 951
 952                 /*
 953                  * copy to socket
 954                  */
 955                 m0 = m_copym(m, 0, M_COPYALL, MB_DONTWAIT);
 956                 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv.sb,
 957                                 (struct sockaddr *)&sa, m0, ctlmsg)) {
 958                         sorwakeup(pcb->hp_socket);
 959                 } else {
 960                         m_freem(ctlmsg);
 961                         m_freem(m0);
 962                 }
 963         }
 964 }
 965
 966 struct pr_usrreqs hci_usrreqs = {
 967         .pru_abort = hci_sabort,
 968         .pru_accept = pru_accept_notsupp,
 969         .pru_attach = hci_sattach,
 970         .pru_bind = hci_sbind,
 971         .pru_connect = hci_sconnect,
 972         .pru_connect2 = pru_connect2_notsupp,
 973         .pru_control = hci_scontrol,
 974         .pru_detach = hci_sdetach,
 975         .pru_disconnect = hci_sdisconnect,
 976         .pru_listen = pru_listen_notsupp,
 977         .pru_peeraddr = hci_speeraddr,
 978         .pru_rcvd = pru_rcvd_notsupp,
 979         .pru_rcvoob = pru_rcvoob_notsupp,
 980         .pru_send = hci_ssend,
 981         .pru_sense = pru_sense_null,
 982         .pru_shutdown = hci_sshutdown,
 983         .pru_sockaddr = hci_ssockaddr,
 984         .pru_sosend = sosend,
 985         .pru_soreceive = soreceive,
 986         .pru_sopoll = sopoll
 987 };