Home | History | Annotate | Line # | Download | only in netbt
hci_socket.c revision 1.26 
      1 /*	$NetBSD: hci_socket.c,v 1.26 2014/07/01 05:49:18 rtr Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 2005 Iain Hibbert.
      5  * Copyright (c) 2006 Itronix Inc.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. The name of Itronix Inc. may not be used to endorse
     17  *    or promote products derived from this software without specific
     18  *    prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
     22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
     24  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     25  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
     27  * ON ANY THEORY OF LIABILITY, WHETHER IN
     28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
     30  * POSSIBILITY OF SUCH DAMAGE.
     31  */
     32 
     33 #include <sys/cdefs.h>
     34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.26 2014/07/01 05:49:18 rtr Exp $");
     35 
     36 /* load symbolic names */
     37 #ifdef BLUETOOTH_DEBUG
     38 #define PRUREQUESTS
     39 #define PRCOREQUESTS
     40 #endif
     41 
     42 #include <sys/param.h>
     43 #include <sys/domain.h>
     44 #include <sys/kauth.h>
     45 #include <sys/kernel.h>
     46 #include <sys/kmem.h>
     47 #include <sys/mbuf.h>
     48 #include <sys/proc.h>
     49 #include <sys/protosw.h>
     50 #include <sys/socket.h>
     51 #include <sys/socketvar.h>
     52 #include <sys/systm.h>
     53 
     54 #include <netbt/bluetooth.h>
     55 #include <netbt/hci.h>
     56 
     57 /*******************************************************************************
     58  *
     59  * HCI SOCK_RAW Sockets - for control of Bluetooth Devices
     60  *
     61  */
     62 
     63 /*
     64  * the raw HCI protocol control block
     65  */
     66 struct hci_pcb {
     67 	struct socket		*hp_socket;	/* socket */
     68 	kauth_cred_t		hp_cred;	/* owner credential */
     69 	unsigned int		hp_flags;	/* flags */
     70 	bdaddr_t		hp_laddr;	/* local address */
     71 	bdaddr_t		hp_raddr;	/* remote address */
     72 	struct hci_filter	hp_efilter;	/* user event filter */
     73 	struct hci_filter	hp_pfilter;	/* user packet filter */
     74 	LIST_ENTRY(hci_pcb)	hp_next;	/* next HCI pcb */
     75 };
     76 
     77 /* hp_flags */
     78 #define HCI_DIRECTION		(1<<1)	/* direction control messages */
     79 #define HCI_PROMISCUOUS		(1<<2)	/* listen to all units */
     80 
     81 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb);
     82 
     83 /* sysctl defaults */
     84 int hci_sendspace = HCI_CMD_PKT_SIZE;
     85 int hci_recvspace = 4096;
     86 
     87 /* unprivileged commands opcode table */
     88 static const struct {
     89 	uint16_t	opcode;
     90 	uint8_t		offs;	/* 0 - 63 */
     91 	uint8_t		mask;	/* bit 0 - 7 */
     92 	uint8_t		length;	/* approved length */
     93 } hci_cmds[] = {
     94 	{ HCI_CMD_INQUIRY,
     95 	  0,  0x01, sizeof(hci_inquiry_cp) },
     96 	{ HCI_CMD_REMOTE_NAME_REQ,
     97 	  2,  0x08, sizeof(hci_remote_name_req_cp) },
     98 	{ HCI_CMD_READ_REMOTE_FEATURES,
     99 	  2,  0x20, sizeof(hci_read_remote_features_cp) },
    100 	{ HCI_CMD_READ_REMOTE_EXTENDED_FEATURES,
    101 	  2,  0x40, sizeof(hci_read_remote_extended_features_cp) },
    102 	{ HCI_CMD_READ_REMOTE_VER_INFO,
    103 	  2,  0x80, sizeof(hci_read_remote_ver_info_cp) },
    104 	{ HCI_CMD_READ_CLOCK_OFFSET,
    105 	  3,  0x01, sizeof(hci_read_clock_offset_cp) },
    106 	{ HCI_CMD_READ_LMP_HANDLE,
    107 	  3,  0x02, sizeof(hci_read_lmp_handle_cp) },
    108 	{ HCI_CMD_ROLE_DISCOVERY,
    109 	  4,  0x80, sizeof(hci_role_discovery_cp) },
    110 	{ HCI_CMD_READ_LINK_POLICY_SETTINGS,
    111 	  5,  0x02, sizeof(hci_read_link_policy_settings_cp) },
    112 	{ HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS,
    113 	  5,  0x08, 0 },
    114 	{ HCI_CMD_READ_PIN_TYPE,
    115 	  6,  0x04, 0 },
    116 	{ HCI_CMD_READ_LOCAL_NAME,
    117 	  7,  0x02, 0 },
    118 	{ HCI_CMD_READ_CON_ACCEPT_TIMEOUT,
    119 	  7,  0x04, 0 },
    120 	{ HCI_CMD_READ_PAGE_TIMEOUT,
    121 	  7,  0x10, 0 },
    122 	{ HCI_CMD_READ_SCAN_ENABLE,
    123 	  7,  0x40, 0 },
    124 	{ HCI_CMD_READ_PAGE_SCAN_ACTIVITY,
    125 	  8,  0x01, 0 },
    126 	{ HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY,
    127 	  8,  0x04, 0 },
    128 	{ HCI_CMD_READ_AUTH_ENABLE,
    129 	  8,  0x10, 0 },
    130 	{ HCI_CMD_READ_ENCRYPTION_MODE,
    131 	  8,  0x40, 0 },
    132 	{ HCI_CMD_READ_UNIT_CLASS,
    133 	  9,  0x01, 0 },
    134 	{ HCI_CMD_READ_VOICE_SETTING,
    135 	  9,  0x04, 0 },
    136 	{ HCI_CMD_READ_AUTO_FLUSH_TIMEOUT,
    137 	  9,  0x10, sizeof(hci_read_auto_flush_timeout_cp) },
    138 	{ HCI_CMD_READ_NUM_BROADCAST_RETRANS,
    139 	  9,  0x40, 0 },
    140 	{ HCI_CMD_READ_HOLD_MODE_ACTIVITY,
    141 	  10, 0x01, 0 },
    142 	{ HCI_CMD_READ_XMIT_LEVEL,
    143 	  10, 0x04, sizeof(hci_read_xmit_level_cp) },
    144 	{ HCI_CMD_READ_SCO_FLOW_CONTROL,
    145 	  10, 0x08, 0 },
    146 	{ HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT,
    147 	  11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) },
    148 	{ HCI_CMD_READ_NUM_SUPPORTED_IAC,
    149 	  11, 0x04, 0 },
    150 	{ HCI_CMD_READ_IAC_LAP,
    151 	  11, 0x08, 0 },
    152 	{ HCI_CMD_READ_PAGE_SCAN_PERIOD,
    153 	  11, 0x20, 0 },
    154 	{ HCI_CMD_READ_PAGE_SCAN,
    155 	  11, 0x80, 0 },
    156 	{ HCI_CMD_READ_INQUIRY_SCAN_TYPE,
    157 	  12, 0x10, 0 },
    158 	{ HCI_CMD_READ_INQUIRY_MODE,
    159 	  12, 0x40, 0 },
    160 	{ HCI_CMD_READ_PAGE_SCAN_TYPE,
    161 	  13, 0x01, 0 },
    162 	{ HCI_CMD_READ_AFH_ASSESSMENT,
    163 	  13, 0x04, 0 },
    164 	{ HCI_CMD_READ_LOCAL_VER,
    165 	  14, 0x08, 0 },
    166 	{ HCI_CMD_READ_LOCAL_COMMANDS,
    167 	  14, 0x10, 0 },
    168 	{ HCI_CMD_READ_LOCAL_FEATURES,
    169 	  14, 0x20, 0 },
    170 	{ HCI_CMD_READ_LOCAL_EXTENDED_FEATURES,
    171 	  14, 0x40, sizeof(hci_read_local_extended_features_cp) },
    172 	{ HCI_CMD_READ_BUFFER_SIZE,
    173 	  14, 0x80, 0 },
    174 	{ HCI_CMD_READ_COUNTRY_CODE,
    175 	  15, 0x01, 0 },
    176 	{ HCI_CMD_READ_BDADDR,
    177 	  15, 0x02, 0 },
    178 	{ HCI_CMD_READ_FAILED_CONTACT_CNTR,
    179 	  15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) },
    180 	{ HCI_CMD_READ_LINK_QUALITY,
    181 	  15, 0x10, sizeof(hci_read_link_quality_cp) },
    182 	{ HCI_CMD_READ_RSSI,
    183 	  15, 0x20, sizeof(hci_read_rssi_cp) },
    184 	{ HCI_CMD_READ_AFH_CHANNEL_MAP,
    185 	  15, 0x40, sizeof(hci_read_afh_channel_map_cp) },
    186 	{ HCI_CMD_READ_CLOCK,
    187 	  15, 0x80, sizeof(hci_read_clock_cp) },
    188 	{ HCI_CMD_READ_LOOPBACK_MODE,
    189 	  16, 0x01, 0 },
    190 	{ HCI_CMD_READ_EXTENDED_INQUIRY_RSP,
    191 	  17, 0x01, 0 },
    192 	{ HCI_CMD_READ_SIMPLE_PAIRING_MODE,
    193 	  17, 0x20, 0 },
    194 	{ HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER,
    195 	  18, 0x01, 0 },
    196 	{ HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING,
    197 	  18, 0x04, 0 },
    198 };
    199 
    200 /*
    201  * supply a basic device send/recv policy
    202  */
    203 static int
    204 hci_device_cb(kauth_cred_t cred, kauth_action_t action, void *cookie,
    205     void *arg0, void *arg1, void *arg2, void *arg3)
    206 {
    207 	int i, result;
    208 
    209 	result = KAUTH_RESULT_DEFER;
    210 
    211 	switch (action) {
    212 	case KAUTH_DEVICE_BLUETOOTH_SEND: {
    213 		struct hci_unit *unit = (struct hci_unit *)arg0;
    214 		hci_cmd_hdr_t *hdr = (hci_cmd_hdr_t *)arg1;
    215 
    216 		/*
    217 		 * Allow sending unprivileged commands if the packet size
    218 		 * is correct and the unit claims to support it
    219 		 */
    220 
    221 		if (hdr->type != HCI_CMD_PKT)
    222 			break;
    223 
    224 		for (i = 0; i < __arraycount(hci_cmds); i++) {
    225 			if (hdr->opcode == hci_cmds[i].opcode
    226 			    && hdr->length == hci_cmds[i].length
    227 			    && (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask)) {
    228 				result = KAUTH_RESULT_ALLOW;
    229 				break;
    230 			}
    231 		}
    232 
    233 		break;
    234 		}
    235 
    236 	case KAUTH_DEVICE_BLUETOOTH_RECV:
    237 		switch((uint8_t)(uintptr_t)arg0) {
    238 		case HCI_CMD_PKT: {
    239 			uint16_t opcode = (uint16_t)(uintptr_t)arg1;
    240 
    241 			/*
    242 			 * Allow to see any unprivileged command packet
    243 			 */
    244 
    245 			for (i = 0; i < __arraycount(hci_cmds); i++) {
    246 				if (opcode == hci_cmds[i].opcode) {
    247 					result = KAUTH_RESULT_ALLOW;
    248 					break;
    249 				}
    250 			}
    251 
    252 			break;
    253 			}
    254 
    255 		case HCI_EVENT_PKT: {
    256 			uint8_t event = (uint8_t)(uintptr_t)arg1;
    257 
    258 			/*
    259 			 * Allow to receive most events
    260 			 */
    261 
    262 			switch (event) {
    263 			case HCI_EVENT_RETURN_LINK_KEYS:
    264 			case HCI_EVENT_LINK_KEY_NOTIFICATION:
    265 			case HCI_EVENT_USER_CONFIRM_REQ:
    266 			case HCI_EVENT_USER_PASSKEY_NOTIFICATION:
    267 			case HCI_EVENT_VENDOR:
    268 				break;
    269 
    270 			default:
    271 				result = KAUTH_RESULT_ALLOW;
    272 				break;
    273 			}
    274 
    275 		    	break;
    276 			}
    277 
    278 		case HCI_ACL_DATA_PKT:
    279 		case HCI_SCO_DATA_PKT: {
    280 			/* uint16_t handle = (uint16_t)(uintptr_t)arg1; */
    281 			/*
    282 			 * don't normally allow receiving data packets
    283 			 */
    284 			break;
    285 			}
    286 
    287 		default:
    288 			break;
    289 		}
    290 
    291 		break;
    292 
    293 	default:
    294 		break;
    295 	}
    296 
    297 	return result;
    298 }
    299 
    300 /*
    301  * HCI protocol init routine,
    302  * - set up a kauth listener to provide basic packet access policy
    303  */
    304 void
    305 hci_init(void)
    306 {
    307 
    308 	if (kauth_listen_scope(KAUTH_SCOPE_DEVICE, hci_device_cb, NULL) == NULL)
    309 		panic("Bluetooth HCI: cannot listen on device scope");
    310 }
    311 
    312 /*
    313  * When command packet reaches the device, we can drop
    314  * it from the socket buffer (called from hci_output_acl)
    315  */
    316 void
    317 hci_drop(void *arg)
    318 {
    319 	struct socket *so = arg;
    320 
    321 	sbdroprecord(&so->so_snd);
    322 	sowwakeup(so);
    323 }
    324 
    325 /*
    326  * HCI socket is going away and has some pending packets. We let them
    327  * go by design, but remove the context pointer as it will be invalid
    328  * and we no longer need to be notified.
    329  */
    330 static void
    331 hci_cmdwait_flush(struct socket *so)
    332 {
    333 	struct hci_unit *unit;
    334 	struct socket *ctx;
    335 	struct mbuf *m;
    336 
    337 	DPRINTF("flushing %p\n", so);
    338 
    339 	SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) {
    340 		m = MBUFQ_FIRST(&unit->hci_cmdwait);
    341 		while (m != NULL) {
    342 			ctx = M_GETCTX(m, struct socket *);
    343 			if (ctx == so)
    344 				M_SETCTX(m, NULL);
    345 
    346 			m = MBUFQ_NEXT(m);
    347 		}
    348 	}
    349 }
    350 
    351 /*
    352  * HCI send packet
    353  *     This came from userland, so check it out.
    354  */
    355 static int
    356 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr)
    357 {
    358 	struct hci_unit *unit;
    359 	struct mbuf *m0;
    360 	hci_cmd_hdr_t hdr;
    361 	int err;
    362 
    363 	KASSERT(m != NULL);
    364 	KASSERT(addr != NULL);
    365 
    366 	/* wants at least a header to start with */
    367 	if (m->m_pkthdr.len < sizeof(hdr)) {
    368 		err = EMSGSIZE;
    369 		goto bad;
    370 	}
    371 	m_copydata(m, 0, sizeof(hdr), &hdr);
    372 	hdr.opcode = le16toh(hdr.opcode);
    373 
    374 	/* only allows CMD packets to be sent */
    375 	if (hdr.type != HCI_CMD_PKT) {
    376 		err = EINVAL;
    377 		goto bad;
    378 	}
    379 
    380 	/* validates packet length */
    381 	if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) {
    382 		err = EMSGSIZE;
    383 		goto bad;
    384 	}
    385 
    386 	/* finds destination */
    387 	unit = hci_unit_lookup(addr);
    388 	if (unit == NULL) {
    389 		err = ENETDOWN;
    390 		goto bad;
    391 	}
    392 
    393 	/* security checks for unprivileged users */
    394 	if (pcb->hp_cred != NULL
    395 	    && kauth_authorize_device(pcb->hp_cred,
    396 	    KAUTH_DEVICE_BLUETOOTH_SEND,
    397 	    unit, &hdr, NULL, NULL) != 0) {
    398 		err = EPERM;
    399 		goto bad;
    400 	}
    401 
    402 	/* makess a copy for precious to keep */
    403 	m0 = m_copypacket(m, M_DONTWAIT);
    404 	if (m0 == NULL) {
    405 		err = ENOMEM;
    406 		goto bad;
    407 	}
    408 	sbappendrecord(&pcb->hp_socket->so_snd, m0);
    409 	M_SETCTX(m, pcb->hp_socket);	/* enable drop callback */
    410 
    411 	DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev),
    412 		HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode));
    413 
    414 	/* Sendss it */
    415 	if (unit->hci_num_cmd_pkts == 0)
    416 		MBUFQ_ENQUEUE(&unit->hci_cmdwait, m);
    417 	else
    418 		hci_output_cmd(unit, m);
    419 
    420 	return 0;
    421 
    422 bad:
    423 	DPRINTF("packet (%d bytes) not sent (error %d)\n",
    424 			m->m_pkthdr.len, err);
    425 	if (m) m_freem(m);
    426 	return err;
    427 }
    428 
    429 static int
    430 hci_attach(struct socket *so, int proto)
    431 {
    432 	struct hci_pcb *pcb;
    433 	int error;
    434 
    435 	KASSERT(so->so_pcb == NULL);
    436 
    437 	if (so->so_lock == NULL) {
    438 		mutex_obj_hold(bt_lock);
    439 		so->so_lock = bt_lock;
    440 		solock(so);
    441 	}
    442 	KASSERT(solocked(so));
    443 
    444 	error = soreserve(so, hci_sendspace, hci_recvspace);
    445 	if (error) {
    446 		return error;
    447 	}
    448 
    449 	pcb = kmem_zalloc(sizeof(struct hci_pcb), KM_SLEEP);
    450 	pcb->hp_cred = kauth_cred_dup(curlwp->l_cred);
    451 	pcb->hp_socket = so;
    452 
    453 	/*
    454 	 * Set default user filter. By default, socket only passes
    455 	 * Command_Complete and Command_Status Events.
    456 	 */
    457 	hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter);
    458 	hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter);
    459 	hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter);
    460 
    461 	LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next);
    462 	so->so_pcb = pcb;
    463 
    464 	return 0;
    465 }
    466 
    467 static void
    468 hci_detach(struct socket *so)
    469 {
    470 	struct hci_pcb *pcb;
    471 
    472 	pcb = (struct hci_pcb *)so->so_pcb;
    473 	KASSERT(pcb != NULL);
    474 
    475 	if (so->so_snd.sb_mb != NULL)
    476 		hci_cmdwait_flush(so);
    477 
    478 	if (pcb->hp_cred != NULL)
    479 		kauth_cred_free(pcb->hp_cred);
    480 
    481 	so->so_pcb = NULL;
    482 	LIST_REMOVE(pcb, hp_next);
    483 	kmem_free(pcb, sizeof(*pcb));
    484 }
    485 
    486 static int
    487 hci_ioctl(struct socket *up, u_long cmd, void *nam, struct ifnet *ifp)
    488 {
    489 	int err;
    490 	mutex_enter(bt_lock);
    491 	err = hci_ioctl_pcb(cmd, nam);
    492 	mutex_exit(bt_lock);
    493 	return err;
    494 }
    495 
    496 /*
    497  * User Request.
    498  * up is socket
    499  * m is optional mbuf chain containing message
    500  * nam is optional mbuf chain containing an address
    501  * ctl is optional mbuf chain containing socket options
    502  * l is pointer to process requesting action (if any)
    503  *
    504  * we are responsible for disposing of m and ctl
    505  */
    506 static int
    507 hci_usrreq(struct socket *up, int req, struct mbuf *m,
    508 		struct mbuf *nam, struct mbuf *ctl, struct lwp *l)
    509 {
    510 	struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb;
    511 	struct sockaddr_bt *sa;
    512 	int err = 0;
    513 
    514 	DPRINTFN(2, "%s\n", prurequests[req]);
    515 	KASSERT(req != PRU_ATTACH);
    516 	KASSERT(req != PRU_DETACH);
    517 	KASSERT(req != PRU_CONTROL);
    518 
    519 	switch(req) {
    520 	case PRU_PURGEIF:
    521 		return EOPNOTSUPP;
    522 	}
    523 
    524 	/* anything after here *requires* a pcb */
    525 	if (pcb == NULL) {
    526 		err = EINVAL;
    527 		goto release;
    528 	}
    529 
    530 	switch(req) {
    531 	case PRU_DISCONNECT:
    532 		bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY);
    533 
    534 		/* XXX we cannot call soisdisconnected() here, as it sets
    535 		 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being,
    536 		 * that soisconnected() does not clear these and if you
    537 		 * try to reconnect this socket (which is permitted) you
    538 		 * get a broken pipe when you try to write any data.
    539 		 */
    540 		up->so_state &= ~SS_ISCONNECTED;
    541 		break;
    542 
    543 	case PRU_ABORT:
    544 		soisdisconnected(up);
    545 		hci_detach(up);
    546 		return 0;
    547 
    548 	case PRU_BIND:
    549 		KASSERT(nam != NULL);
    550 		sa = mtod(nam, struct sockaddr_bt *);
    551 
    552 		if (sa->bt_len != sizeof(struct sockaddr_bt))
    553 			return EINVAL;
    554 
    555 		if (sa->bt_family != AF_BLUETOOTH)
    556 			return EAFNOSUPPORT;
    557 
    558 		bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr);
    559 
    560 		if (bdaddr_any(&sa->bt_bdaddr))
    561 			pcb->hp_flags |= HCI_PROMISCUOUS;
    562 		else
    563 			pcb->hp_flags &= ~HCI_PROMISCUOUS;
    564 
    565 		return 0;
    566 
    567 	case PRU_CONNECT:
    568 		KASSERT(nam != NULL);
    569 		sa = mtod(nam, struct sockaddr_bt *);
    570 
    571 		if (sa->bt_len != sizeof(struct sockaddr_bt))
    572 			return EINVAL;
    573 
    574 		if (sa->bt_family != AF_BLUETOOTH)
    575 			return EAFNOSUPPORT;
    576 
    577 		if (hci_unit_lookup(&sa->bt_bdaddr) == NULL)
    578 			return EADDRNOTAVAIL;
    579 
    580 		bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr);
    581 		soisconnected(up);
    582 		return 0;
    583 
    584 	case PRU_PEERADDR:
    585 		KASSERT(nam != NULL);
    586 		sa = mtod(nam, struct sockaddr_bt *);
    587 
    588 		memset(sa, 0, sizeof(struct sockaddr_bt));
    589 		nam->m_len =
    590 		sa->bt_len = sizeof(struct sockaddr_bt);
    591 		sa->bt_family = AF_BLUETOOTH;
    592 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr);
    593 		return 0;
    594 
    595 	case PRU_SOCKADDR:
    596 		KASSERT(nam != NULL);
    597 		sa = mtod(nam, struct sockaddr_bt *);
    598 
    599 		memset(sa, 0, sizeof(struct sockaddr_bt));
    600 		nam->m_len =
    601 		sa->bt_len = sizeof(struct sockaddr_bt);
    602 		sa->bt_family = AF_BLUETOOTH;
    603 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr);
    604 		return 0;
    605 
    606 	case PRU_SHUTDOWN:
    607 		socantsendmore(up);
    608 		break;
    609 
    610 	case PRU_SEND:
    611 		sa = NULL;
    612 		if (nam) {
    613 			sa = mtod(nam, struct sockaddr_bt *);
    614 
    615 			if (sa->bt_len != sizeof(struct sockaddr_bt)) {
    616 				err = EINVAL;
    617 				goto release;
    618 			}
    619 
    620 			if (sa->bt_family != AF_BLUETOOTH) {
    621 				err = EAFNOSUPPORT;
    622 				goto release;
    623 			}
    624 		}
    625 
    626 		if (ctl) /* have no use for this */
    627 			m_freem(ctl);
    628 
    629 		return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr));
    630 
    631 	case PRU_SENSE:
    632 		return 0;		/* (no sense - Doh!) */
    633 
    634 	case PRU_RCVD:
    635 	case PRU_RCVOOB:
    636 		return EOPNOTSUPP;	/* (no release) */
    637 
    638 	case PRU_ACCEPT:
    639 	case PRU_CONNECT2:
    640 	case PRU_LISTEN:
    641 	case PRU_SENDOOB:
    642 	case PRU_FASTTIMO:
    643 	case PRU_SLOWTIMO:
    644 	case PRU_PROTORCV:
    645 	case PRU_PROTOSEND:
    646 		err = EOPNOTSUPP;
    647 		break;
    648 
    649 	default:
    650 		UNKNOWN(req);
    651 		err = EOPNOTSUPP;
    652 		break;
    653 	}
    654 
    655 release:
    656 	if (m)
    657 		m_freem(m);
    658 	if (ctl)
    659 		m_freem(ctl);
    660 	return err;
    661 }
    662 
    663 /*
    664  * get/set socket options
    665  */
    666 int
    667 hci_ctloutput(int req, struct socket *so, struct sockopt *sopt)
    668 {
    669 	struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
    670 	int optval, err = 0;
    671 
    672 	DPRINTFN(2, "req %s\n", prcorequests[req]);
    673 
    674 	if (pcb == NULL)
    675 		return EINVAL;
    676 
    677 	if (sopt->sopt_level != BTPROTO_HCI)
    678 		return ENOPROTOOPT;
    679 
    680 	switch(req) {
    681 	case PRCO_GETOPT:
    682 		switch (sopt->sopt_name) {
    683 		case SO_HCI_EVT_FILTER:
    684 			err = sockopt_set(sopt, &pcb->hp_efilter,
    685 			    sizeof(struct hci_filter));
    686 
    687 			break;
    688 
    689 		case SO_HCI_PKT_FILTER:
    690 			err = sockopt_set(sopt, &pcb->hp_pfilter,
    691 			    sizeof(struct hci_filter));
    692 
    693 			break;
    694 
    695 		case SO_HCI_DIRECTION:
    696 			err = sockopt_setint(sopt,
    697 			    (pcb->hp_flags & HCI_DIRECTION ? 1 : 0));
    698 
    699 			break;
    700 
    701 		default:
    702 			err = ENOPROTOOPT;
    703 			break;
    704 		}
    705 		break;
    706 
    707 	case PRCO_SETOPT:
    708 		switch (sopt->sopt_name) {
    709 		case SO_HCI_EVT_FILTER:	/* set event filter */
    710 			err = sockopt_get(sopt, &pcb->hp_efilter,
    711 			    sizeof(pcb->hp_efilter));
    712 
    713 			break;
    714 
    715 		case SO_HCI_PKT_FILTER:	/* set packet filter */
    716 			err = sockopt_get(sopt, &pcb->hp_pfilter,
    717 			    sizeof(pcb->hp_pfilter));
    718 
    719 			break;
    720 
    721 		case SO_HCI_DIRECTION:	/* request direction ctl messages */
    722 			err = sockopt_getint(sopt, &optval);
    723 			if (err)
    724 				break;
    725 
    726 			if (optval)
    727 				pcb->hp_flags |= HCI_DIRECTION;
    728 			else
    729 				pcb->hp_flags &= ~HCI_DIRECTION;
    730 			break;
    731 
    732 		default:
    733 			err = ENOPROTOOPT;
    734 			break;
    735 		}
    736 		break;
    737 
    738 	default:
    739 		err = ENOPROTOOPT;
    740 		break;
    741 	}
    742 
    743 	return err;
    744 }
    745 
    746 /*
    747  * HCI mbuf tap routine
    748  *
    749  * copy packets to any raw HCI sockets that wish (and are
    750  * permitted) to see them
    751  */
    752 void
    753 hci_mtap(struct mbuf *m, struct hci_unit *unit)
    754 {
    755 	struct hci_pcb *pcb;
    756 	struct mbuf *m0, *ctlmsg, **ctl;
    757 	struct sockaddr_bt sa;
    758 	uint8_t type;
    759 	uint8_t event;
    760 	uint16_t arg1;
    761 
    762 	KASSERT(m->m_len >= sizeof(type));
    763 
    764 	type = *mtod(m, uint8_t *);
    765 
    766 	memset(&sa, 0, sizeof(sa));
    767 	sa.bt_len = sizeof(struct sockaddr_bt);
    768 	sa.bt_family = AF_BLUETOOTH;
    769 	bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr);
    770 
    771 	LIST_FOREACH(pcb, &hci_pcb, hp_next) {
    772 		/*
    773 		 * filter according to source address
    774 		 */
    775 		if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0
    776 		    && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0)
    777 			continue;
    778 
    779 		/*
    780 		 * filter according to packet type filter
    781 		 */
    782 		if (hci_filter_test(type, &pcb->hp_pfilter) == 0)
    783 			continue;
    784 
    785 		/*
    786 		 * filter according to event/security filters
    787 		 */
    788 		switch(type) {
    789 		case HCI_EVENT_PKT:
    790 			KASSERT(m->m_len >= sizeof(hci_event_hdr_t));
    791 
    792 			event = mtod(m, hci_event_hdr_t *)->event;
    793 
    794 			if (hci_filter_test(event, &pcb->hp_efilter) == 0)
    795 				continue;
    796 
    797 			arg1 = event;
    798 			break;
    799 
    800 		case HCI_CMD_PKT:
    801 			KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t));
    802 			arg1 = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode);
    803 			break;
    804 
    805 		case HCI_ACL_DATA_PKT:
    806 			KASSERT(m->m_len >= sizeof(hci_acldata_hdr_t));
    807 			arg1 = le16toh(mtod(m, hci_acldata_hdr_t *)->con_handle);
    808 			arg1 = HCI_CON_HANDLE(arg1);
    809 			break;
    810 
    811 		case HCI_SCO_DATA_PKT:
    812 			KASSERT(m->m_len >= sizeof(hci_scodata_hdr_t));
    813 			arg1 = le16toh(mtod(m, hci_scodata_hdr_t *)->con_handle);
    814 			arg1 = HCI_CON_HANDLE(arg1);
    815 			break;
    816 
    817 		default:
    818 			arg1 = 0;
    819 			break;
    820 		}
    821 
    822 		if (pcb->hp_cred != NULL
    823 		    && kauth_authorize_device(pcb->hp_cred,
    824 		    KAUTH_DEVICE_BLUETOOTH_RECV,
    825 		    KAUTH_ARG(type), KAUTH_ARG(arg1), NULL, NULL) != 0)
    826 			continue;
    827 
    828 		/*
    829 		 * create control messages
    830 		 */
    831 		ctlmsg = NULL;
    832 		ctl = &ctlmsg;
    833 		if (pcb->hp_flags & HCI_DIRECTION) {
    834 			int dir = m->m_flags & M_LINK0 ? 1 : 0;
    835 
    836 			*ctl = sbcreatecontrol(&dir, sizeof(dir),
    837 			    SCM_HCI_DIRECTION, BTPROTO_HCI);
    838 
    839 			if (*ctl != NULL)
    840 				ctl = &((*ctl)->m_next);
    841 		}
    842 		if (pcb->hp_socket->so_options & SO_TIMESTAMP) {
    843 			struct timeval tv;
    844 
    845 			microtime(&tv);
    846 			*ctl = sbcreatecontrol(&tv, sizeof(tv),
    847 			    SCM_TIMESTAMP, SOL_SOCKET);
    848 
    849 			if (*ctl != NULL)
    850 				ctl = &((*ctl)->m_next);
    851 		}
    852 
    853 		/*
    854 		 * copy to socket
    855 		 */
    856 		m0 = m_copypacket(m, M_DONTWAIT);
    857 		if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv,
    858 				(struct sockaddr *)&sa, m0, ctlmsg)) {
    859 			sorwakeup(pcb->hp_socket);
    860 		} else {
    861 			m_freem(ctlmsg);
    862 			m_freem(m0);
    863 		}
    864 	}
    865 }
    866 
    867 PR_WRAP_USRREQS(hci)
    868 
    869 #define	hci_attach		hci_attach_wrapper
    870 #define	hci_detach		hci_detach_wrapper
    871 #define	hci_ioctl		hci_ioctl_wrapper
    872 #define	hci_usrreq		hci_usrreq_wrapper
    873 
    874 const struct pr_usrreqs hci_usrreqs = {
    875 	.pr_attach	= hci_attach,
    876 	.pr_detach	= hci_detach,
    877 	.pr_ioctl	= hci_ioctl,
    878 	.pr_generic	= hci_usrreq,
    879 };
    880