Home | History | Annotate | Line # | Download | only in netbt
hci_socket.c revision 1.18 
      1 /*	$NetBSD: hci_socket.c,v 1.18 2009/08/10 18:25:20 plunky Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2005 Iain Hibbert.
      5  * Copyright (c) 2006 Itronix Inc.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. The name of Itronix Inc. may not be used to endorse
     17  *    or promote products derived from this software without specific
     18  *    prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
     24  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     25  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
     27  * ON ANY THEORY OF LIABILITY, WHETHER IN
     28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30  * POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 #include <sys/cdefs.h>
     34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.18 2009/08/10 18:25:20 plunky Exp $");
     35 
     36 /* load symbolic names */
     37 #ifdef BLUETOOTH_DEBUG
     38 #define PRUREQUESTS
     39 #define PRCOREQUESTS
     40 #endif
     41 
     42 #include <sys/param.h>
     43 #include <sys/domain.h>
     44 #include <sys/kauth.h>
     45 #include <sys/kernel.h>
     46 #include <sys/mbuf.h>
     47 #include <sys/proc.h>
     48 #include <sys/protosw.h>
     49 #include <sys/socket.h>
     50 #include <sys/socketvar.h>
     51 #include <sys/systm.h>
     52 
     53 #include <netbt/bluetooth.h>
     54 #include <netbt/hci.h>
     55 
     56 /*******************************************************************************
     57  *
     58  * HCI SOCK_RAW Sockets - for control of Bluetooth Devices
     59  *
     60  */
     61 
     62 /*
     63  * the raw HCI protocol control block
     64  */
     65 struct hci_pcb {
     66 	struct socket		*hp_socket;	/* socket */
     67 	kauth_cred_t		hp_cred;	/* owner credential */
     68 	unsigned int		hp_flags;	/* flags */
     69 	bdaddr_t		hp_laddr;	/* local address */
     70 	bdaddr_t		hp_raddr;	/* remote address */
     71 	struct hci_filter	hp_efilter;	/* user event filter */
     72 	struct hci_filter	hp_pfilter;	/* user packet filter */
     73 	LIST_ENTRY(hci_pcb)	hp_next;	/* next HCI pcb */
     74 };
     75 
     76 /* hp_flags */
     77 #define HCI_DIRECTION		(1<<1)	/* direction control messages */
     78 #define HCI_PROMISCUOUS		(1<<2)	/* listen to all units */
     79 
     80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb);
     81 
     82 /* sysctl defaults */
     83 int hci_sendspace = HCI_CMD_PKT_SIZE;
     84 int hci_recvspace = 4096;
     85 
     86 /* unprivileged commands opcode table */
     87 static const struct {
     88 	uint16_t	opcode;
     89 	uint8_t		offs;	/* 0 - 63 */
     90 	uint8_t		mask;	/* bit 0 - 7 */
     91 	uint8_t		length;	/* approved length */
     92 } hci_cmds[] = {
     93 	{ HCI_CMD_INQUIRY,
     94 	  0,  0x01, sizeof(hci_inquiry_cp) },
     95 	{ HCI_CMD_REMOTE_NAME_REQ,
     96 	  2,  0x08, sizeof(hci_remote_name_req_cp) },
     97 	{ HCI_CMD_READ_REMOTE_FEATURES,
     98 	  2,  0x20, sizeof(hci_read_remote_features_cp) },
     99 	{ HCI_CMD_READ_REMOTE_EXTENDED_FEATURES,
    100 	  2,  0x40, sizeof(hci_read_remote_extended_features_cp) },
    101 	{ HCI_CMD_READ_REMOTE_VER_INFO,
    102 	  2,  0x80, sizeof(hci_read_remote_ver_info_cp) },
    103 	{ HCI_CMD_READ_CLOCK_OFFSET,
    104 	  3,  0x01, sizeof(hci_read_clock_offset_cp) },
    105 	{ HCI_CMD_READ_LMP_HANDLE,
    106 	  3,  0x02, sizeof(hci_read_lmp_handle_cp) },
    107 	{ HCI_CMD_ROLE_DISCOVERY,
    108 	  4,  0x80, sizeof(hci_role_discovery_cp) },
    109 	{ HCI_CMD_READ_LINK_POLICY_SETTINGS,
    110 	  5,  0x02, sizeof(hci_read_link_policy_settings_cp) },
    111 	{ HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS,
    112 	  5,  0x08, 0 },
    113 	{ HCI_CMD_READ_PIN_TYPE,
    114 	  6,  0x04, 0 },
    115 	{ HCI_CMD_READ_LOCAL_NAME,
    116 	  7,  0x02, 0 },
    117 	{ HCI_CMD_READ_CON_ACCEPT_TIMEOUT,
    118 	  7,  0x04, 0 },
    119 	{ HCI_CMD_READ_PAGE_TIMEOUT,
    120 	  7,  0x10, 0 },
    121 	{ HCI_CMD_READ_SCAN_ENABLE,
    122 	  7,  0x40, 0 },
    123 	{ HCI_CMD_READ_PAGE_SCAN_ACTIVITY,
    124 	  8,  0x01, 0 },
    125 	{ HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY,
    126 	  8,  0x04, 0 },
    127 	{ HCI_CMD_READ_AUTH_ENABLE,
    128 	  8,  0x10, 0 },
    129 	{ HCI_CMD_READ_ENCRYPTION_MODE,
    130 	  8,  0x40, 0 },
    131 	{ HCI_CMD_READ_UNIT_CLASS,
    132 	  9,  0x01, 0 },
    133 	{ HCI_CMD_READ_VOICE_SETTING,
    134 	  9,  0x04, 0 },
    135 	{ HCI_CMD_READ_AUTO_FLUSH_TIMEOUT,
    136 	  9,  0x10, sizeof(hci_read_auto_flush_timeout_cp) },
    137 	{ HCI_CMD_READ_NUM_BROADCAST_RETRANS,
    138 	  9,  0x40, 0 },
    139 	{ HCI_CMD_READ_HOLD_MODE_ACTIVITY,
    140 	  10, 0x01, 0 },
    141 	{ HCI_CMD_READ_XMIT_LEVEL,
    142 	  10, 0x04, sizeof(hci_read_xmit_level_cp) },
    143 	{ HCI_CMD_READ_SCO_FLOW_CONTROL,
    144 	  10, 0x08, 0 },
    145 	{ HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT,
    146 	  11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) },
    147 	{ HCI_CMD_READ_NUM_SUPPORTED_IAC,
    148 	  11, 0x04, 0 },
    149 	{ HCI_CMD_READ_IAC_LAP,
    150 	  11, 0x08, 0 },
    151 	{ HCI_CMD_READ_PAGE_SCAN_PERIOD,
    152 	  11, 0x20, 0 },
    153 	{ HCI_CMD_READ_PAGE_SCAN,
    154 	  11, 0x80, 0 },
    155 	{ HCI_CMD_READ_INQUIRY_SCAN_TYPE,
    156 	  12, 0x10, 0 },
    157 	{ HCI_CMD_READ_INQUIRY_MODE,
    158 	  12, 0x40, 0 },
    159 	{ HCI_CMD_READ_PAGE_SCAN_TYPE,
    160 	  13, 0x01, 0 },
    161 	{ HCI_CMD_READ_AFH_ASSESSMENT,
    162 	  13, 0x04, 0 },
    163 	{ HCI_CMD_READ_LOCAL_VER,
    164 	  14, 0x08, 0 },
    165 	{ HCI_CMD_READ_LOCAL_COMMANDS,
    166 	  14, 0x10, 0 },
    167 	{ HCI_CMD_READ_LOCAL_FEATURES,
    168 	  14, 0x20, 0 },
    169 	{ HCI_CMD_READ_LOCAL_EXTENDED_FEATURES,
    170 	  14, 0x40, sizeof(hci_read_local_extended_features_cp) },
    171 	{ HCI_CMD_READ_BUFFER_SIZE,
    172 	  14, 0x80, 0 },
    173 	{ HCI_CMD_READ_COUNTRY_CODE,
    174 	  15, 0x01, 0 },
    175 	{ HCI_CMD_READ_BDADDR,
    176 	  15, 0x02, 0 },
    177 	{ HCI_CMD_READ_FAILED_CONTACT_CNTR,
    178 	  15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) },
    179 	{ HCI_CMD_READ_LINK_QUALITY,
    180 	  15, 0x10, sizeof(hci_read_link_quality_cp) },
    181 	{ HCI_CMD_READ_RSSI,
    182 	  15, 0x20, sizeof(hci_read_rssi_cp) },
    183 	{ HCI_CMD_READ_AFH_CHANNEL_MAP,
    184 	  15, 0x40, sizeof(hci_read_afh_channel_map_cp) },
    185 	{ HCI_CMD_READ_CLOCK,
    186 	  15, 0x80, sizeof(hci_read_clock_cp) },
    187 	{ HCI_CMD_READ_LOOPBACK_MODE,
    188 	  16, 0x01, 0 },
    189 	{ HCI_CMD_READ_EXTENDED_INQUIRY_RSP,
    190 	  17, 0x01, 0 },
    191 	{ HCI_CMD_READ_SIMPLE_PAIRING_MODE,
    192 	  17, 0x20, 0 },
    193 	{ HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER,
    194 	  18, 0x01, 0 },
    195 	{ HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING,
    196 	  18, 0x04, 0 },
    197 };
    198 
    199 /*
    200  * supply a basic device send/recv policy
    201  */
    202 static int
    203 hci_device_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
    204     void *arg0, void *arg1, void *arg2, void *arg3)
    205 {
    206 	int i, result;
    207 
    208 	result = KAUTH_RESULT_DEFER;
    209 
    210 	switch (action) {
    211 	case KAUTH_DEVICE_BLUETOOTH_SEND_COMMAND: {
    212 		struct hci_unit *unit = (struct hci_unit *)arg0;
    213 		hci_cmd_hdr_t *hdr = (hci_cmd_hdr_t *)arg1;
    214 
    215 		/*
    216 		 * Allow sending unprivileged commands if the packet size
    217 		 * is correct and the unit claims to support it
    218 		 */
    219 
    220 		for (i = 0; i < __arraycount(hci_cmds); i++) {
    221 			if (hdr->opcode == hci_cmds[i].opcode
    222 			    && hdr->length == hci_cmds[i].length
    223 			    && (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) {
    224 				result = KAUTH_RESULT_ALLOW;
    225 				break;
    226 			}
    227 		}
    228 
    229 		break;
    230 		}
    231 
    232 	case KAUTH_DEVICE_BLUETOOTH_RECV_COMMAND: {
    233 		uint16_t opcode = (uint16_t)(uintptr_t)arg0;
    234 
    235 		/*
    236 		 * Allow to see any unprivileged command packet
    237 		 */
    238 
    239 		for (i = 0; i < __arraycount(hci_cmds); i++) {
    240 			if (opcode == hci_cmds[i].opcode) {
    241 				result = KAUTH_RESULT_ALLOW;
    242 				break;
    243 			}
    244 		}
    245 
    246 		break;
    247 		}
    248 
    249 	case KAUTH_DEVICE_BLUETOOTH_RECV_EVENT: {
    250 		uint8_t event = (uint8_t)(uintptr_t)arg0;
    251 
    252 		/*
    253 		 * Allow to receive most events
    254 		 */
    255 
    256 		switch (event) {
    257 		case HCI_EVENT_RETURN_LINK_KEYS:
    258 		case HCI_EVENT_LINK_KEY_NOTIFICATION:
    259 		case HCI_EVENT_USER_CONFIRM_REQ:
    260 		case HCI_EVENT_USER_PASSKEY_NOTIFICATION:
    261 		case HCI_EVENT_VENDOR:
    262 			break;
    263 
    264 		default:
    265 			result = KAUTH_RESULT_ALLOW;
    266 			break;
    267 		}
    268 
    269 		break;
    270 		}
    271 
    272 	case KAUTH_DEVICE_BLUETOOTH_RECV_DATA:	/* arg0 == type */
    273 		/*
    274 		 * don't normally allow receiving data packets
    275 		 */
    276 		break;
    277 
    278 	default:
    279 		break;
    280 	}
    281 
    282 	return result;
    283 }
    284 
    285 /*
    286  * HCI protocol init routine,
    287  * - set up a kauth listener to provide basic packet access policy
    288  */
    289 void
    290 hci_init(void)
    291 {
    292 
    293 	if (kauth_listen_scope(KAUTH_SCOPE_DEVICE, hci_device_cb, NULL) == NULL)
    294 		panic("Bluetooth HCI: cannot listen on device scope");
    295 }
    296 
    297 /*
    298  * When command packet reaches the device, we can drop
    299  * it from the socket buffer (called from hci_output_acl)
    300  */
    301 void
    302 hci_drop(void *arg)
    303 {
    304 	struct socket *so = arg;
    305 
    306 	sbdroprecord(&so->so_snd);
    307 	sowwakeup(so);
    308 }
    309 
    310 /*
    311  * HCI socket is going away and has some pending packets. We let them
    312  * go by design, but remove the context pointer as it will be invalid
    313  * and we no longer need to be notified.
    314  */
    315 static void
    316 hci_cmdwait_flush(struct socket *so)
    317 {
    318 	struct hci_unit *unit;
    319 	struct socket *ctx;
    320 	struct mbuf *m;
    321 
    322 	DPRINTF("flushing %p\n", so);
    323 
    324 	SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) {
    325 		m = MBUFQ_FIRST(&unit->hci_cmdwait);
    326 		while (m != NULL) {
    327 			ctx = M_GETCTX(m, struct socket *);
    328 			if (ctx == so)
    329 				M_SETCTX(m, NULL);
    330 
    331 			m = MBUFQ_NEXT(m);
    332 		}
    333 	}
    334 }
    335 
    336 /*
    337  * HCI send packet
    338  *     This came from userland, so check it out.
    339  */
    340 static int
    341 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr)
    342 {
    343 	struct hci_unit *unit;
    344 	struct mbuf *m0;
    345 	hci_cmd_hdr_t hdr;
    346 	int err;
    347 
    348 	KASSERT(m != NULL);
    349 	KASSERT(addr != NULL);
    350 
    351 	/* wants at least a header to start with */
    352 	if (m->m_pkthdr.len < sizeof(hdr)) {
    353 		err = EMSGSIZE;
    354 		goto bad;
    355 	}
    356 	m_copydata(m, 0, sizeof(hdr), &hdr);
    357 	hdr.opcode = le16toh(hdr.opcode);
    358 
    359 	/* only allows CMD packets to be sent */
    360 	if (hdr.type != HCI_CMD_PKT) {
    361 		err = EINVAL;
    362 		goto bad;
    363 	}
    364 
    365 	/* validates packet length */
    366 	if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) {
    367 		err = EMSGSIZE;
    368 		goto bad;
    369 	}
    370 
    371 	/* finds destination */
    372 	unit = hci_unit_lookup(addr);
    373 	if (unit == NULL) {
    374 		err = ENETDOWN;
    375 		goto bad;
    376 	}
    377 
    378 	/* security checks for unprivileged users */
    379 	if (pcb->hp_cred != NULL
    380 	    && kauth_authorize_device(pcb->hp_cred,
    381 	    KAUTH_DEVICE_BLUETOOTH_SEND_COMMAND,
    382 	    unit, &hdr, NULL, NULL) != 0) {
    383 		err = EPERM;
    384 		goto bad;
    385 	}
    386 
    387 	/* makess a copy for precious to keep */
    388 	m0 = m_copypacket(m, M_DONTWAIT);
    389 	if (m0 == NULL) {
    390 		err = ENOMEM;
    391 		goto bad;
    392 	}
    393 	sbappendrecord(&pcb->hp_socket->so_snd, m0);
    394 	M_SETCTX(m, pcb->hp_socket);	/* enable drop callback */
    395 
    396 	DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev),
    397 		HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode));
    398 
    399 	/* Sendss it */
    400 	if (unit->hci_num_cmd_pkts == 0)
    401 		MBUFQ_ENQUEUE(&unit->hci_cmdwait, m);
    402 	else
    403 		hci_output_cmd(unit, m);
    404 
    405 	return 0;
    406 
    407 bad:
    408 	DPRINTF("packet (%d bytes) not sent (error %d)\n",
    409 			m->m_pkthdr.len, err);
    410 	if (m) m_freem(m);
    411 	return err;
    412 }
    413 
    414 /*
    415  * User Request.
    416  * up is socket
    417  * m is either
    418  *	optional mbuf chain containing message
    419  *	ioctl command (PRU_CONTROL)
    420  * nam is either
    421  *	optional mbuf chain containing an address
    422  *	ioctl data (PRU_CONTROL)
    423  *      optionally, protocol number (PRU_ATTACH)
    424  * ctl is optional mbuf chain containing socket options
    425  * l is pointer to process requesting action (if any)
    426  *
    427  * we are responsible for disposing of m and ctl if
    428  * they are mbuf chains
    429  */
    430 int
    431 hci_usrreq(struct socket *up, int req, struct mbuf *m,
    432 		struct mbuf *nam, struct mbuf *ctl, struct lwp *l)
    433 {
    434 	struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb;
    435 	struct sockaddr_bt *sa;
    436 	int err = 0;
    437 
    438 	DPRINTFN(2, "%s\n", prurequests[req]);
    439 
    440 	switch(req) {
    441 	case PRU_CONTROL:
    442 		mutex_enter(bt_lock);
    443 		err = hci_ioctl((unsigned long)m, (void *)nam, l);
    444 		mutex_exit(bt_lock);
    445 		return err;
    446 
    447 	case PRU_PURGEIF:
    448 		return EOPNOTSUPP;
    449 
    450 	case PRU_ATTACH:
    451 		if (up->so_lock == NULL) {
    452 			mutex_obj_hold(bt_lock);
    453 			up->so_lock = bt_lock;
    454 			solock(up);
    455 		}
    456 		KASSERT(solocked(up));
    457 		if (pcb)
    458 			return EINVAL;
    459 		err = soreserve(up, hci_sendspace, hci_recvspace);
    460 		if (err)
    461 			return err;
    462 
    463 		pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO);
    464 		if (pcb == NULL)
    465 			return ENOMEM;
    466 
    467 		up->so_pcb = pcb;
    468 		pcb->hp_socket = up;
    469 
    470 		if (l != NULL)
    471 			pcb->hp_cred = kauth_cred_dup(l->l_cred);
    472 
    473 		/*
    474 		 * Set default user filter. By default, socket only passes
    475 		 * Command_Complete and Command_Status Events.
    476 		 */
    477 		hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter);
    478 		hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter);
    479 		hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter);
    480 
    481 		LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next);
    482 
    483 		return 0;
    484 	}
    485 
    486 	/* anything after here *requires* a pcb */
    487 	if (pcb == NULL) {
    488 		err = EINVAL;
    489 		goto release;
    490 	}
    491 
    492 	switch(req) {
    493 	case PRU_DISCONNECT:
    494 		bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY);
    495 
    496 		/* XXX we cannot call soisdisconnected() here, as it sets
    497 		 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being,
    498 		 * that soisconnected() does not clear these and if you
    499 		 * try to reconnect this socket (which is permitted) you
    500 		 * get a broken pipe when you try to write any data.
    501 		 */
    502 		up->so_state &= ~SS_ISCONNECTED;
    503 		break;
    504 
    505 	case PRU_ABORT:
    506 		soisdisconnected(up);
    507 		/* fall through to */
    508 	case PRU_DETACH:
    509 		if (up->so_snd.sb_mb != NULL)
    510 			hci_cmdwait_flush(up);
    511 
    512 		if (pcb->hp_cred != NULL)
    513 			kauth_cred_free(pcb->hp_cred);
    514 
    515 		up->so_pcb = NULL;
    516 		LIST_REMOVE(pcb, hp_next);
    517 		free(pcb, M_PCB);
    518 		return 0;
    519 
    520 	case PRU_BIND:
    521 		KASSERT(nam != NULL);
    522 		sa = mtod(nam, struct sockaddr_bt *);
    523 
    524 		if (sa->bt_len != sizeof(struct sockaddr_bt))
    525 			return EINVAL;
    526 
    527 		if (sa->bt_family != AF_BLUETOOTH)
    528 			return EAFNOSUPPORT;
    529 
    530 		bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr);
    531 
    532 		if (bdaddr_any(&sa->bt_bdaddr))
    533 			pcb->hp_flags |= HCI_PROMISCUOUS;
    534 		else
    535 			pcb->hp_flags &= ~HCI_PROMISCUOUS;
    536 
    537 		return 0;
    538 
    539 	case PRU_CONNECT:
    540 		KASSERT(nam != NULL);
    541 		sa = mtod(nam, struct sockaddr_bt *);
    542 
    543 		if (sa->bt_len != sizeof(struct sockaddr_bt))
    544 			return EINVAL;
    545 
    546 		if (sa->bt_family != AF_BLUETOOTH)
    547 			return EAFNOSUPPORT;
    548 
    549 		if (hci_unit_lookup(&sa->bt_bdaddr) == NULL)
    550 			return EADDRNOTAVAIL;
    551 
    552 		bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr);
    553 		soisconnected(up);
    554 		return 0;
    555 
    556 	case PRU_PEERADDR:
    557 		KASSERT(nam != NULL);
    558 		sa = mtod(nam, struct sockaddr_bt *);
    559 
    560 		memset(sa, 0, sizeof(struct sockaddr_bt));
    561 		nam->m_len =
    562 		sa->bt_len = sizeof(struct sockaddr_bt);
    563 		sa->bt_family = AF_BLUETOOTH;
    564 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr);
    565 		return 0;
    566 
    567 	case PRU_SOCKADDR:
    568 		KASSERT(nam != NULL);
    569 		sa = mtod(nam, struct sockaddr_bt *);
    570 
    571 		memset(sa, 0, sizeof(struct sockaddr_bt));
    572 		nam->m_len =
    573 		sa->bt_len = sizeof(struct sockaddr_bt);
    574 		sa->bt_family = AF_BLUETOOTH;
    575 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr);
    576 		return 0;
    577 
    578 	case PRU_SHUTDOWN:
    579 		socantsendmore(up);
    580 		break;
    581 
    582 	case PRU_SEND:
    583 		sa = NULL;
    584 		if (nam) {
    585 			sa = mtod(nam, struct sockaddr_bt *);
    586 
    587 			if (sa->bt_len != sizeof(struct sockaddr_bt)) {
    588 				err = EINVAL;
    589 				goto release;
    590 			}
    591 
    592 			if (sa->bt_family != AF_BLUETOOTH) {
    593 				err = EAFNOSUPPORT;
    594 				goto release;
    595 			}
    596 		}
    597 
    598 		if (ctl) /* have no use for this */
    599 			m_freem(ctl);
    600 
    601 		return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr));
    602 
    603 	case PRU_SENSE:
    604 		return 0;		/* (no sense - Doh!) */
    605 
    606 	case PRU_RCVD:
    607 	case PRU_RCVOOB:
    608 		return EOPNOTSUPP;	/* (no release) */
    609 
    610 	case PRU_ACCEPT:
    611 	case PRU_CONNECT2:
    612 	case PRU_LISTEN:
    613 	case PRU_SENDOOB:
    614 	case PRU_FASTTIMO:
    615 	case PRU_SLOWTIMO:
    616 	case PRU_PROTORCV:
    617 	case PRU_PROTOSEND:
    618 		err = EOPNOTSUPP;
    619 		break;
    620 
    621 	default:
    622 		UNKNOWN(req);
    623 		err = EOPNOTSUPP;
    624 		break;
    625 	}
    626 
    627 release:
    628 	if (m)
    629 		m_freem(m);
    630 	if (ctl)
    631 		m_freem(ctl);
    632 	return err;
    633 }
    634 
    635 /*
    636  * get/set socket options
    637  */
    638 int
    639 hci_ctloutput(int req, struct socket *so, struct sockopt *sopt)
    640 {
    641 	struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
    642 	int optval, err = 0;
    643 
    644 	DPRINTFN(2, "req %s\n", prcorequests[req]);
    645 
    646 	if (pcb == NULL)
    647 		return EINVAL;
    648 
    649 	if (sopt->sopt_level != BTPROTO_HCI)
    650 		return ENOPROTOOPT;
    651 
    652 	switch(req) {
    653 	case PRCO_GETOPT:
    654 		switch (sopt->sopt_name) {
    655 		case SO_HCI_EVT_FILTER:
    656 			err = sockopt_set(sopt, &pcb->hp_efilter,
    657 			    sizeof(struct hci_filter));
    658 
    659 			break;
    660 
    661 		case SO_HCI_PKT_FILTER:
    662 			err = sockopt_set(sopt, &pcb->hp_pfilter,
    663 			    sizeof(struct hci_filter));
    664 
    665 			break;
    666 
    667 		case SO_HCI_DIRECTION:
    668 			err = sockopt_setint(sopt,
    669 			    (pcb->hp_flags & HCI_DIRECTION ? 1 : 0));
    670 
    671 			break;
    672 
    673 		default:
    674 			err = ENOPROTOOPT;
    675 			break;
    676 		}
    677 		break;
    678 
    679 	case PRCO_SETOPT:
    680 		switch (sopt->sopt_name) {
    681 		case SO_HCI_EVT_FILTER:	/* set event filter */
    682 			err = sockopt_get(sopt, &pcb->hp_efilter,
    683 			    sizeof(pcb->hp_efilter));
    684 
    685 			break;
    686 
    687 		case SO_HCI_PKT_FILTER:	/* set packet filter */
    688 			err = sockopt_get(sopt, &pcb->hp_pfilter,
    689 			    sizeof(pcb->hp_pfilter));
    690 
    691 			break;
    692 
    693 		case SO_HCI_DIRECTION:	/* request direction ctl messages */
    694 			err = sockopt_getint(sopt, &optval);
    695 			if (err)
    696 				break;
    697 
    698 			if (optval)
    699 				pcb->hp_flags |= HCI_DIRECTION;
    700 			else
    701 				pcb->hp_flags &= ~HCI_DIRECTION;
    702 			break;
    703 
    704 		default:
    705 			err = ENOPROTOOPT;
    706 			break;
    707 		}
    708 		break;
    709 
    710 	default:
    711 		err = ENOPROTOOPT;
    712 		break;
    713 	}
    714 
    715 	return err;
    716 }
    717 
    718 /*
    719  * HCI mbuf tap routine
    720  *
    721  * copy packets to any raw HCI sockets that wish (and are
    722  * permitted) to see them
    723  */
    724 void
    725 hci_mtap(struct mbuf *m, struct hci_unit *unit)
    726 {
    727 	struct hci_pcb *pcb;
    728 	struct mbuf *m0, *ctlmsg, **ctl;
    729 	struct sockaddr_bt sa;
    730 	uint8_t type;
    731 	uint8_t event;
    732 	uint16_t opcode;
    733 
    734 	KASSERT(m->m_len >= sizeof(type));
    735 
    736 	type = *mtod(m, uint8_t *);
    737 
    738 	memset(&sa, 0, sizeof(sa));
    739 	sa.bt_len = sizeof(struct sockaddr_bt);
    740 	sa.bt_family = AF_BLUETOOTH;
    741 	bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr);
    742 
    743 	LIST_FOREACH(pcb, &hci_pcb, hp_next) {
    744 		/*
    745 		 * filter according to source address
    746 		 */
    747 		if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0
    748 		    && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0)
    749 			continue;
    750 
    751 		/*
    752 		 * filter according to packet type filter
    753 		 */
    754 		if (hci_filter_test(type, &pcb->hp_pfilter) == 0)
    755 			continue;
    756 
    757 		/*
    758 		 * filter according to event/security filters
    759 		 */
    760 		switch(type) {
    761 		case HCI_EVENT_PKT:
    762 			KASSERT(m->m_len >= sizeof(hci_event_hdr_t));
    763 
    764 			event = mtod(m, hci_event_hdr_t *)->event;
    765 
    766 			if (hci_filter_test(event, &pcb->hp_efilter) == 0)
    767 				continue;
    768 
    769 			if (pcb->hp_cred != NULL
    770 			    && kauth_authorize_device(pcb->hp_cred,
    771 			    KAUTH_DEVICE_BLUETOOTH_RECV_EVENT,
    772 			    KAUTH_ARG(event), NULL, NULL, NULL) != 0)
    773 				continue;
    774 
    775 			break;
    776 
    777 		case HCI_CMD_PKT:
    778 			KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t));
    779 
    780 			opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode);
    781 
    782 			if (pcb->hp_cred != NULL
    783 			    && kauth_authorize_device(pcb->hp_cred,
    784 			    KAUTH_DEVICE_BLUETOOTH_RECV_COMMAND,
    785 			    KAUTH_ARG(opcode), NULL, NULL, NULL) != 0)
    786 				continue;
    787 
    788 			break;
    789 
    790 		case HCI_ACL_DATA_PKT:
    791 		case HCI_SCO_DATA_PKT:
    792 		default:
    793 			if (pcb->hp_cred != NULL
    794 			    && kauth_authorize_device(pcb->hp_cred,
    795 			    KAUTH_DEVICE_BLUETOOTH_RECV_DATA,
    796 			    KAUTH_ARG(type), NULL, NULL, NULL) != 0)
    797 				continue;
    798 
    799 			break;
    800 		}
    801 
    802 		/*
    803 		 * create control messages
    804 		 */
    805 		ctlmsg = NULL;
    806 		ctl = &ctlmsg;
    807 		if (pcb->hp_flags & HCI_DIRECTION) {
    808 			int dir = m->m_flags & M_LINK0 ? 1 : 0;
    809 
    810 			*ctl = sbcreatecontrol(&dir, sizeof(dir),
    811 			    SCM_HCI_DIRECTION, BTPROTO_HCI);
    812 
    813 			if (*ctl != NULL)
    814 				ctl = &((*ctl)->m_next);
    815 		}
    816 
    817 		/*
    818 		 * copy to socket
    819 		 */
    820 		m0 = m_copypacket(m, M_DONTWAIT);
    821 		if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv,
    822 				(struct sockaddr *)&sa, m0, ctlmsg)) {
    823 			sorwakeup(pcb->hp_socket);
    824 		} else {
    825 			m_freem(ctlmsg);
    826 			m_freem(m0);
    827 		}
    828 	}
    829 }
    830