hci_socket.c revision 1.10
1 /* $NetBSD: hci_socket.c,v 1.10 2007/03/31 18:17:13 plunky Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.10 2007/03/31 18:17:13 plunky Exp $"); 35 36 /* load symbolic names */ 37 #ifdef BLUETOOTH_DEBUG 38 #define PRUREQUESTS 39 #define PRCOREQUESTS 40 #endif 41 42 #include <sys/param.h> 43 #include <sys/domain.h> 44 #include <sys/kauth.h> 45 #include <sys/kernel.h> 46 #include <sys/mbuf.h> 47 #include <sys/proc.h> 48 #include <sys/protosw.h> 49 #include <sys/socket.h> 50 #include <sys/socketvar.h> 51 #include <sys/systm.h> 52 53 #include <netbt/bluetooth.h> 54 #include <netbt/hci.h> 55 56 /******************************************************************************* 57 * 58 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 59 * 60 */ 61 62 /* 63 * the raw HCI protocol control block 64 */ 65 struct hci_pcb { 66 struct socket *hp_socket; /* socket */ 67 unsigned int hp_flags; /* flags */ 68 bdaddr_t hp_laddr; /* local address */ 69 bdaddr_t hp_raddr; /* remote address */ 70 struct hci_filter hp_efilter; /* user event filter */ 71 struct hci_filter hp_pfilter; /* user packet filter */ 72 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 73 }; 74 75 /* hp_flags */ 76 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 77 #define HCI_DIRECTION (1<<1) /* direction control messages */ 78 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 79 80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 81 82 /* sysctl defaults */ 83 int hci_sendspace = HCI_CMD_PKT_SIZE; 84 int hci_recvspace = 4096; 85 86 /* 87 * Security filter routines for unprivileged users. 88 * Allow all but a few critical events, and only permit read commands. 89 */ 90 91 static int 92 hci_security_check_opcode(uint16_t opcode) 93 { 94 95 switch (opcode) { 96 /* Link control */ 97 case HCI_CMD_INQUIRY: 98 return sizeof(hci_inquiry_cp); 99 case HCI_CMD_REMOTE_NAME_REQ: 100 return sizeof(hci_remote_name_req_cp); 101 case HCI_CMD_READ_REMOTE_FEATURES: 102 return sizeof(hci_read_remote_features_cp); 103 case HCI_CMD_READ_REMOTE_EXTENDED_FEATURES: 104 return sizeof(hci_read_remote_extended_features_cp); 105 case HCI_CMD_READ_REMOTE_VER_INFO: 106 return sizeof(hci_read_remote_ver_info_cp); 107 case HCI_CMD_READ_CLOCK_OFFSET: 108 return sizeof(hci_read_clock_offset_cp); 109 case HCI_CMD_READ_LMP_HANDLE: 110 return sizeof(hci_read_lmp_handle_cp); 111 112 /* Link policy */ 113 case HCI_CMD_ROLE_DISCOVERY: 114 return sizeof(hci_role_discovery_cp); 115 case HCI_CMD_READ_LINK_POLICY_SETTINGS: 116 return sizeof(hci_read_link_policy_settings_cp); 117 case HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS: 118 return 0; /* No command parameters */ 119 120 /* Host controller and baseband */ 121 case HCI_CMD_READ_PIN_TYPE: 122 case HCI_CMD_READ_LOCAL_NAME: 123 case HCI_CMD_READ_CON_ACCEPT_TIMEOUT: 124 case HCI_CMD_READ_PAGE_TIMEOUT: 125 case HCI_CMD_READ_SCAN_ENABLE: 126 case HCI_CMD_READ_PAGE_SCAN_ACTIVITY: 127 case HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY: 128 case HCI_CMD_READ_AUTH_ENABLE: 129 case HCI_CMD_READ_ENCRYPTION_MODE: 130 case HCI_CMD_READ_UNIT_CLASS: 131 case HCI_CMD_READ_VOICE_SETTING: 132 return 0; /* No command parameters */ 133 case HCI_CMD_READ_AUTO_FLUSH_TIMEOUT: 134 return sizeof(hci_read_auto_flush_timeout_cp); 135 case HCI_CMD_READ_NUM_BROADCAST_RETRANS: 136 case HCI_CMD_READ_HOLD_MODE_ACTIVITY: 137 return 0; /* No command parameters */ 138 case HCI_CMD_READ_XMIT_LEVEL: 139 return sizeof(hci_read_xmit_level_cp); 140 case HCI_CMD_READ_SCO_FLOW_CONTROL: 141 return 0; /* No command parameters */ 142 case HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT: 143 return sizeof(hci_read_link_supervision_timeout_cp); 144 case HCI_CMD_READ_NUM_SUPPORTED_IAC: 145 case HCI_CMD_READ_IAC_LAP: 146 case HCI_CMD_READ_PAGE_SCAN_PERIOD: 147 case HCI_CMD_READ_PAGE_SCAN: 148 case HCI_CMD_READ_INQUIRY_SCAN_TYPE: 149 case HCI_CMD_READ_INQUIRY_MODE: 150 case HCI_CMD_READ_PAGE_SCAN_TYPE: 151 case HCI_CMD_READ_AFH_ASSESSMENT: 152 return 0; /* No command parameters */ 153 154 /* Informational */ 155 case HCI_CMD_READ_LOCAL_VER: 156 case HCI_CMD_READ_LOCAL_COMMANDS: 157 case HCI_CMD_READ_LOCAL_FEATURES: 158 return 0; /* No command parameters */ 159 case HCI_CMD_READ_LOCAL_EXTENDED_FEATURES: 160 return sizeof(hci_read_local_extended_features_cp); 161 case HCI_CMD_READ_BUFFER_SIZE: 162 case HCI_CMD_READ_COUNTRY_CODE: 163 case HCI_CMD_READ_BDADDR: 164 return 0; /* No command parameters */ 165 166 /* Status */ 167 case HCI_CMD_READ_FAILED_CONTACT_CNTR: 168 return sizeof(hci_read_failed_contact_cntr_cp); 169 case HCI_CMD_READ_LINK_QUALITY: 170 return sizeof(hci_read_link_quality_cp); 171 case HCI_CMD_READ_RSSI: 172 return sizeof(hci_read_rssi_cp); 173 case HCI_CMD_READ_AFH_CHANNEL_MAP: 174 return sizeof(hci_read_afh_channel_map_cp); 175 case HCI_CMD_READ_CLOCK: 176 return sizeof(hci_read_clock_cp); 177 178 /* Testing */ 179 case HCI_CMD_READ_LOOPBACK_MODE: 180 return 0; /* No command parameters */ 181 } 182 183 return -1; /* disallowed */ 184 } 185 186 static int 187 hci_security_check_event(uint8_t event) 188 { 189 190 switch (event) { 191 case HCI_EVENT_RETURN_LINK_KEYS: 192 case HCI_EVENT_LINK_KEY_NOTIFICATION: 193 case HCI_EVENT_VENDOR: 194 return -1; /* disallowed */ 195 } 196 197 return 0; /* ok */ 198 } 199 200 /* 201 * When command packet reaches the device, we can drop 202 * it from the socket buffer (called from hci_output_acl) 203 */ 204 void 205 hci_drop(void *arg) 206 { 207 struct socket *so = arg; 208 209 sbdroprecord(&so->so_snd); 210 sowwakeup(so); 211 } 212 213 /* 214 * HCI socket is going away and has some pending packets. We let them 215 * go by design, but remove the context pointer as it will be invalid 216 * and we no longer need to be notified. 217 */ 218 static void 219 hci_cmdwait_flush(struct socket *so) 220 { 221 struct hci_unit *unit; 222 struct socket *ctx; 223 struct mbuf *m; 224 225 DPRINTF("flushing %p\n", so); 226 227 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 228 m = MBUFQ_FIRST(&unit->hci_cmdwait); 229 while (m != NULL) { 230 ctx = M_GETCTX(m, struct socket *); 231 if (ctx == so) 232 M_SETCTX(m, NULL); 233 234 m = MBUFQ_NEXT(m); 235 } 236 } 237 } 238 239 /* 240 * HCI send packet 241 * This came from userland, so check it out. 242 */ 243 static int 244 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 245 { 246 struct hci_unit *unit; 247 struct mbuf *m0; 248 hci_cmd_hdr_t hdr; 249 int err; 250 251 KASSERT(m != NULL); 252 KASSERT(addr != NULL); 253 254 /* wants at least a header to start with */ 255 if (m->m_pkthdr.len < sizeof(hdr)) { 256 err = EMSGSIZE; 257 goto bad; 258 } 259 m_copydata(m, 0, sizeof(hdr), &hdr); 260 261 /* only allows CMD packets to be sent */ 262 if (hdr.type != HCI_CMD_PKT) { 263 err = EINVAL; 264 goto bad; 265 } 266 267 /* validates packet length */ 268 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 269 err = EMSGSIZE; 270 goto bad; 271 } 272 273 /* security checks for unprivileged users */ 274 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 275 && hci_security_check_opcode(le16toh(hdr.opcode)) != hdr.length) { 276 err = EPERM; 277 goto bad; 278 } 279 280 /* finds destination */ 281 unit = hci_unit_lookup(addr); 282 if (unit == NULL) { 283 err = ENETDOWN; 284 goto bad; 285 } 286 287 /* makess a copy for precious to keep */ 288 m0 = m_copypacket(m, M_DONTWAIT); 289 if (m0 == NULL) { 290 err = ENOMEM; 291 goto bad; 292 } 293 sbappendrecord(&pcb->hp_socket->so_snd, m0); 294 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 295 296 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", unit->hci_devname, 297 HCI_OGF(le16toh(hdr.opcode)), HCI_OCF(le16toh(hdr.opcode))); 298 299 /* Sendss it */ 300 if (unit->hci_num_cmd_pkts == 0) 301 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 302 else 303 hci_output_cmd(unit, m); 304 305 return 0; 306 307 bad: 308 DPRINTF("packet (%d bytes) not sent (error %d)\n", 309 m->m_pkthdr.len, err); 310 if (m) m_freem(m); 311 return err; 312 } 313 314 /* 315 * User Request. 316 * up is socket 317 * m is either 318 * optional mbuf chain containing message 319 * ioctl command (PRU_CONTROL) 320 * nam is either 321 * optional mbuf chain containing an address 322 * ioctl data (PRU_CONTROL) 323 * optionally, protocol number (PRU_ATTACH) 324 * ctl is optional mbuf chain containing socket options 325 * l is pointer to process requesting action (if any) 326 * 327 * we are responsible for disposing of m and ctl if 328 * they are mbuf chains 329 */ 330 int 331 hci_usrreq(struct socket *up, int req, struct mbuf *m, 332 struct mbuf *nam, struct mbuf *ctl, struct lwp *l) 333 { 334 struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb; 335 struct sockaddr_bt *sa; 336 int err = 0; 337 338 DPRINTFN(2, "%s\n", prurequests[req]); 339 340 switch(req) { 341 case PRU_CONTROL: 342 return hci_ioctl((unsigned long)m, (void *)nam, l); 343 344 case PRU_PURGEIF: 345 return EOPNOTSUPP; 346 347 case PRU_ATTACH: 348 if (pcb) 349 return EINVAL; 350 351 err = soreserve(up, hci_sendspace, hci_recvspace); 352 if (err) 353 return err; 354 355 pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO); 356 if (pcb == NULL) 357 return ENOMEM; 358 359 up->so_pcb = pcb; 360 pcb->hp_socket = up; 361 362 if (l == NULL || kauth_authorize_generic(l->l_cred, 363 KAUTH_GENERIC_ISSUSER, NULL) == 0) 364 pcb->hp_flags |= HCI_PRIVILEGED; 365 366 /* 367 * Set default user filter. By default, socket only passes 368 * Command_Complete and Command_Status Events. 369 */ 370 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 371 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 372 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 373 374 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 375 376 return 0; 377 } 378 379 /* anything after here *requires* a pcb */ 380 if (pcb == NULL) { 381 err = EINVAL; 382 goto release; 383 } 384 385 switch(req) { 386 case PRU_DISCONNECT: 387 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 388 389 /* XXX we cannot call soisdisconnected() here, as it sets 390 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 391 * that soisconnected() does not clear these and if you 392 * try to reconnect this socket (which is permitted) you 393 * get a broken pipe when you try to write any data. 394 */ 395 up->so_state &= ~SS_ISCONNECTED; 396 break; 397 398 case PRU_ABORT: 399 soisdisconnected(up); 400 /* fall through to */ 401 case PRU_DETACH: 402 if (up->so_snd.sb_mb != NULL) 403 hci_cmdwait_flush(up); 404 405 up->so_pcb = NULL; 406 LIST_REMOVE(pcb, hp_next); 407 free(pcb, M_PCB); 408 return 0; 409 410 case PRU_BIND: 411 KASSERT(nam != NULL); 412 sa = mtod(nam, struct sockaddr_bt *); 413 414 if (sa->bt_len != sizeof(struct sockaddr_bt)) 415 return EINVAL; 416 417 if (sa->bt_family != AF_BLUETOOTH) 418 return EAFNOSUPPORT; 419 420 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 421 422 if (bdaddr_any(&sa->bt_bdaddr)) 423 pcb->hp_flags |= HCI_PROMISCUOUS; 424 else 425 pcb->hp_flags &= ~HCI_PROMISCUOUS; 426 427 return 0; 428 429 case PRU_CONNECT: 430 KASSERT(nam != NULL); 431 sa = mtod(nam, struct sockaddr_bt *); 432 433 if (sa->bt_len != sizeof(struct sockaddr_bt)) 434 return EINVAL; 435 436 if (sa->bt_family != AF_BLUETOOTH) 437 return EAFNOSUPPORT; 438 439 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 440 return EADDRNOTAVAIL; 441 442 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 443 soisconnected(up); 444 return 0; 445 446 case PRU_PEERADDR: 447 KASSERT(nam != NULL); 448 sa = mtod(nam, struct sockaddr_bt *); 449 450 memset(sa, 0, sizeof(struct sockaddr_bt)); 451 nam->m_len = 452 sa->bt_len = sizeof(struct sockaddr_bt); 453 sa->bt_family = AF_BLUETOOTH; 454 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 455 return 0; 456 457 case PRU_SOCKADDR: 458 KASSERT(nam != NULL); 459 sa = mtod(nam, struct sockaddr_bt *); 460 461 memset(sa, 0, sizeof(struct sockaddr_bt)); 462 nam->m_len = 463 sa->bt_len = sizeof(struct sockaddr_bt); 464 sa->bt_family = AF_BLUETOOTH; 465 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 466 return 0; 467 468 case PRU_SHUTDOWN: 469 socantsendmore(up); 470 break; 471 472 case PRU_SEND: 473 sa = NULL; 474 if (nam) { 475 sa = mtod(nam, struct sockaddr_bt *); 476 477 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 478 err = EINVAL; 479 goto release; 480 } 481 482 if (sa->bt_family != AF_BLUETOOTH) { 483 err = EAFNOSUPPORT; 484 goto release; 485 } 486 } 487 488 if (ctl) /* have no use for this */ 489 m_freem(ctl); 490 491 return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 492 493 case PRU_SENSE: 494 return 0; /* (no sense - Doh!) */ 495 496 case PRU_RCVD: 497 case PRU_RCVOOB: 498 return EOPNOTSUPP; /* (no release) */ 499 500 case PRU_ACCEPT: 501 case PRU_CONNECT2: 502 case PRU_LISTEN: 503 case PRU_SENDOOB: 504 case PRU_FASTTIMO: 505 case PRU_SLOWTIMO: 506 case PRU_PROTORCV: 507 case PRU_PROTOSEND: 508 err = EOPNOTSUPP; 509 break; 510 511 default: 512 UNKNOWN(req); 513 err = EOPNOTSUPP; 514 break; 515 } 516 517 release: 518 if (m) 519 m_freem(m); 520 if (ctl) 521 m_freem(ctl); 522 return err; 523 } 524 525 /* 526 * get/set socket options 527 */ 528 int 529 hci_ctloutput(int req, struct socket *so, int level, 530 int optname, struct mbuf **opt) 531 { 532 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 533 struct mbuf *m; 534 int err = 0; 535 536 DPRINTFN(2, "req %s\n", prcorequests[req]); 537 538 if (pcb == NULL) 539 return EINVAL; 540 541 if (level != BTPROTO_HCI) 542 return ENOPROTOOPT; 543 544 switch(req) { 545 case PRCO_GETOPT: 546 m = m_get(M_WAIT, MT_SOOPTS); 547 switch (optname) { 548 case SO_HCI_EVT_FILTER: 549 m->m_len = sizeof(struct hci_filter); 550 memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len); 551 break; 552 553 case SO_HCI_PKT_FILTER: 554 m->m_len = sizeof(struct hci_filter); 555 memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len); 556 break; 557 558 case SO_HCI_DIRECTION: 559 m->m_len = sizeof(int); 560 if (pcb->hp_flags & HCI_DIRECTION) 561 *mtod(m, int *) = 1; 562 else 563 *mtod(m, int *) = 0; 564 break; 565 566 default: 567 err = ENOPROTOOPT; 568 m_freem(m); 569 m = NULL; 570 break; 571 } 572 *opt = m; 573 break; 574 575 case PRCO_SETOPT: 576 m = *opt; 577 if (m) switch (optname) { 578 case SO_HCI_EVT_FILTER: /* set event filter */ 579 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 580 memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len); 581 break; 582 583 case SO_HCI_PKT_FILTER: /* set packet filter */ 584 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 585 memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len); 586 break; 587 588 case SO_HCI_DIRECTION: /* request direction ctl messages */ 589 if (*mtod(m, int *)) 590 pcb->hp_flags |= HCI_DIRECTION; 591 else 592 pcb->hp_flags &= ~HCI_DIRECTION; 593 break; 594 595 default: 596 err = ENOPROTOOPT; 597 break; 598 } 599 m_freem(m); 600 break; 601 602 default: 603 err = ENOPROTOOPT; 604 break; 605 } 606 607 return err; 608 } 609 610 /* 611 * HCI mbuf tap routine 612 * 613 * copy packets to any raw HCI sockets that wish (and are 614 * permitted) to see them 615 */ 616 void 617 hci_mtap(struct mbuf *m, struct hci_unit *unit) 618 { 619 struct hci_pcb *pcb; 620 struct mbuf *m0, *ctlmsg, **ctl; 621 struct sockaddr_bt sa; 622 uint8_t type; 623 uint8_t event; 624 uint16_t opcode; 625 626 KASSERT(m->m_len >= sizeof(type)); 627 628 type = *mtod(m, uint8_t *); 629 630 memset(&sa, 0, sizeof(sa)); 631 sa.bt_len = sizeof(struct sockaddr_bt); 632 sa.bt_family = AF_BLUETOOTH; 633 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 634 635 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 636 /* 637 * filter according to source address 638 */ 639 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 640 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 641 continue; 642 643 /* 644 * filter according to packet type filter 645 */ 646 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 647 continue; 648 649 /* 650 * filter according to event/security filters 651 */ 652 switch(type) { 653 case HCI_EVENT_PKT: 654 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 655 656 event = mtod(m, hci_event_hdr_t *)->event; 657 658 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 659 continue; 660 661 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 662 && hci_security_check_event(event) == -1) 663 continue; 664 break; 665 666 case HCI_CMD_PKT: 667 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 668 669 opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 670 671 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 672 && hci_security_check_opcode(opcode) == -1) 673 continue; 674 break; 675 676 case HCI_ACL_DATA_PKT: 677 case HCI_SCO_DATA_PKT: 678 default: 679 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 680 continue; 681 682 break; 683 } 684 685 /* 686 * create control messages 687 */ 688 ctlmsg = NULL; 689 ctl = &ctlmsg; 690 if (pcb->hp_flags & HCI_DIRECTION) { 691 int dir = m->m_flags & M_LINK0 ? 1 : 0; 692 693 *ctl = sbcreatecontrol((void *)&dir, sizeof(dir), 694 SCM_HCI_DIRECTION, BTPROTO_HCI); 695 696 if (*ctl != NULL) 697 ctl = &((*ctl)->m_next); 698 } 699 700 /* 701 * copy to socket 702 */ 703 m0 = m_copypacket(m, M_DONTWAIT); 704 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 705 (struct sockaddr *)&sa, m0, ctlmsg)) { 706 sorwakeup(pcb->hp_socket); 707 } else { 708 m_freem(ctlmsg); 709 m_freem(m0); 710 } 711 } 712 } 713
Indexes created Fri Sep 26 08:10:20 GMT 2025