hci_socket.c revision 1.9
1 /* $NetBSD: hci_socket.c,v 1.9 2007/03/30 20:47:02 plunky Exp $ */ 2 3 /*- 4 * Copyright (c) 2005 Iain Hibbert. 5 * Copyright (c) 2006 Itronix Inc. 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 2. Redistributions in binary form must reproduce the above copyright 14 * notice, this list of conditions and the following disclaimer in the 15 * documentation and/or other materials provided with the distribution. 16 * 3. The name of Itronix Inc. may not be used to endorse 17 * or promote products derived from this software without specific 18 * prior written permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND 21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 22 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 23 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY 24 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES 25 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 26 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND 27 * ON ANY THEORY OF LIABILITY, WHETHER IN 28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 30 * POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.9 2007/03/30 20:47:02 plunky Exp $"); 35 36 #include "opt_bluetooth.h" 37 #ifdef BLUETOOTH_DEBUG 38 #define PRCOREQUESTS 39 #endif 40 41 #include <sys/param.h> 42 #include <sys/domain.h> 43 #include <sys/kauth.h> 44 #include <sys/kernel.h> 45 #include <sys/mbuf.h> 46 #include <sys/proc.h> 47 #include <sys/protosw.h> 48 #include <sys/socket.h> 49 #include <sys/socketvar.h> 50 #include <sys/systm.h> 51 52 #include <netbt/bluetooth.h> 53 #include <netbt/hci.h> 54 55 /******************************************************************************* 56 * 57 * HCI SOCK_RAW Sockets - for control of Bluetooth Devices 58 * 59 */ 60 61 /* 62 * the raw HCI protocol control block 63 */ 64 struct hci_pcb { 65 struct socket *hp_socket; /* socket */ 66 unsigned int hp_flags; /* flags */ 67 bdaddr_t hp_laddr; /* local address */ 68 bdaddr_t hp_raddr; /* remote address */ 69 struct hci_filter hp_efilter; /* user event filter */ 70 struct hci_filter hp_pfilter; /* user packet filter */ 71 LIST_ENTRY(hci_pcb) hp_next; /* next HCI pcb */ 72 }; 73 74 /* hp_flags */ 75 #define HCI_PRIVILEGED (1<<0) /* no security filter for root */ 76 #define HCI_DIRECTION (1<<1) /* direction control messages */ 77 #define HCI_PROMISCUOUS (1<<2) /* listen to all units */ 78 79 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb); 80 81 /* sysctl defaults */ 82 int hci_sendspace = HCI_CMD_PKT_SIZE; 83 int hci_recvspace = 4096; 84 85 /* 86 * Security filter routines for unprivileged users. 87 * Allow all but a few critical events, and only permit read commands. 88 */ 89 90 static int 91 hci_security_check_opcode(uint16_t opcode) 92 { 93 94 switch (opcode) { 95 /* Link control */ 96 case HCI_CMD_INQUIRY: 97 return sizeof(hci_inquiry_cp); 98 case HCI_CMD_REMOTE_NAME_REQ: 99 return sizeof(hci_remote_name_req_cp); 100 case HCI_CMD_READ_REMOTE_FEATURES: 101 return sizeof(hci_read_remote_features_cp); 102 case HCI_CMD_READ_REMOTE_EXTENDED_FEATURES: 103 return sizeof(hci_read_remote_extended_features_cp); 104 case HCI_CMD_READ_REMOTE_VER_INFO: 105 return sizeof(hci_read_remote_ver_info_cp); 106 case HCI_CMD_READ_CLOCK_OFFSET: 107 return sizeof(hci_read_clock_offset_cp); 108 case HCI_CMD_READ_LMP_HANDLE: 109 return sizeof(hci_read_lmp_handle_cp); 110 111 /* Link policy */ 112 case HCI_CMD_ROLE_DISCOVERY: 113 return sizeof(hci_role_discovery_cp); 114 case HCI_CMD_READ_LINK_POLICY_SETTINGS: 115 return sizeof(hci_read_link_policy_settings_cp); 116 case HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS: 117 return 0; /* No command parameters */ 118 119 /* Host controller and baseband */ 120 case HCI_CMD_READ_PIN_TYPE: 121 case HCI_CMD_READ_LOCAL_NAME: 122 case HCI_CMD_READ_CON_ACCEPT_TIMEOUT: 123 case HCI_CMD_READ_PAGE_TIMEOUT: 124 case HCI_CMD_READ_SCAN_ENABLE: 125 case HCI_CMD_READ_PAGE_SCAN_ACTIVITY: 126 case HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY: 127 case HCI_CMD_READ_AUTH_ENABLE: 128 case HCI_CMD_READ_ENCRYPTION_MODE: 129 case HCI_CMD_READ_UNIT_CLASS: 130 case HCI_CMD_READ_VOICE_SETTING: 131 return 0; /* No command parameters */ 132 case HCI_CMD_READ_AUTO_FLUSH_TIMEOUT: 133 return sizeof(hci_read_auto_flush_timeout_cp); 134 case HCI_CMD_READ_NUM_BROADCAST_RETRANS: 135 case HCI_CMD_READ_HOLD_MODE_ACTIVITY: 136 return 0; /* No command parameters */ 137 case HCI_CMD_READ_XMIT_LEVEL: 138 return sizeof(hci_read_xmit_level_cp); 139 case HCI_CMD_READ_SCO_FLOW_CONTROL: 140 return 0; /* No command parameters */ 141 case HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT: 142 return sizeof(hci_read_link_supervision_timeout_cp); 143 case HCI_CMD_READ_NUM_SUPPORTED_IAC: 144 case HCI_CMD_READ_IAC_LAP: 145 case HCI_CMD_READ_PAGE_SCAN_PERIOD: 146 case HCI_CMD_READ_PAGE_SCAN: 147 case HCI_CMD_READ_INQUIRY_SCAN_TYPE: 148 case HCI_CMD_READ_INQUIRY_MODE: 149 case HCI_CMD_READ_PAGE_SCAN_TYPE: 150 case HCI_CMD_READ_AFH_ASSESSMENT: 151 return 0; /* No command parameters */ 152 153 /* Informational */ 154 case HCI_CMD_READ_LOCAL_VER: 155 case HCI_CMD_READ_LOCAL_COMMANDS: 156 case HCI_CMD_READ_LOCAL_FEATURES: 157 return 0; /* No command parameters */ 158 case HCI_CMD_READ_LOCAL_EXTENDED_FEATURES: 159 return sizeof(hci_read_local_extended_features_cp); 160 case HCI_CMD_READ_BUFFER_SIZE: 161 case HCI_CMD_READ_COUNTRY_CODE: 162 case HCI_CMD_READ_BDADDR: 163 return 0; /* No command parameters */ 164 165 /* Status */ 166 case HCI_CMD_READ_FAILED_CONTACT_CNTR: 167 return sizeof(hci_read_failed_contact_cntr_cp); 168 case HCI_CMD_READ_LINK_QUALITY: 169 return sizeof(hci_read_link_quality_cp); 170 case HCI_CMD_READ_RSSI: 171 return sizeof(hci_read_rssi_cp); 172 case HCI_CMD_READ_AFH_CHANNEL_MAP: 173 return sizeof(hci_read_afh_channel_map_cp); 174 case HCI_CMD_READ_CLOCK: 175 return sizeof(hci_read_clock_cp); 176 177 /* Testing */ 178 case HCI_CMD_READ_LOOPBACK_MODE: 179 return 0; /* No command parameters */ 180 } 181 182 return -1; /* disallowed */ 183 } 184 185 static int 186 hci_security_check_event(uint8_t event) 187 { 188 189 switch (event) { 190 case HCI_EVENT_RETURN_LINK_KEYS: 191 case HCI_EVENT_LINK_KEY_NOTIFICATION: 192 case HCI_EVENT_VENDOR: 193 return -1; /* disallowed */ 194 } 195 196 return 0; /* ok */ 197 } 198 199 /* 200 * When command packet reaches the device, we can drop 201 * it from the socket buffer (called from hci_output_acl) 202 */ 203 void 204 hci_drop(void *arg) 205 { 206 struct socket *so = arg; 207 208 sbdroprecord(&so->so_snd); 209 sowwakeup(so); 210 } 211 212 /* 213 * HCI socket is going away and has some pending packets. We let them 214 * go by design, but remove the context pointer as it will be invalid 215 * and we no longer need to be notified. 216 */ 217 static void 218 hci_cmdwait_flush(struct socket *so) 219 { 220 struct hci_unit *unit; 221 struct socket *ctx; 222 struct mbuf *m; 223 224 DPRINTF("flushing %p\n", so); 225 226 SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) { 227 m = MBUFQ_FIRST(&unit->hci_cmdwait); 228 while (m != NULL) { 229 ctx = M_GETCTX(m, struct socket *); 230 if (ctx == so) 231 M_SETCTX(m, NULL); 232 233 m = MBUFQ_NEXT(m); 234 } 235 } 236 } 237 238 /* 239 * HCI send packet 240 * This came from userland, so check it out. 241 */ 242 static int 243 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr) 244 { 245 struct hci_unit *unit; 246 struct mbuf *m0; 247 hci_cmd_hdr_t hdr; 248 int err; 249 250 KASSERT(m != NULL); 251 KASSERT(addr != NULL); 252 253 /* wants at least a header to start with */ 254 if (m->m_pkthdr.len < sizeof(hdr)) { 255 err = EMSGSIZE; 256 goto bad; 257 } 258 m_copydata(m, 0, sizeof(hdr), &hdr); 259 260 /* only allows CMD packets to be sent */ 261 if (hdr.type != HCI_CMD_PKT) { 262 err = EINVAL; 263 goto bad; 264 } 265 266 /* validates packet length */ 267 if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) { 268 err = EMSGSIZE; 269 goto bad; 270 } 271 272 /* security checks for unprivileged users */ 273 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 274 && hci_security_check_opcode(le16toh(hdr.opcode)) != hdr.length) { 275 err = EPERM; 276 goto bad; 277 } 278 279 /* finds destination */ 280 unit = hci_unit_lookup(addr); 281 if (unit == NULL) { 282 err = ENETDOWN; 283 goto bad; 284 } 285 286 /* makess a copy for precious to keep */ 287 m0 = m_copypacket(m, M_DONTWAIT); 288 if (m0 == NULL) { 289 err = ENOMEM; 290 goto bad; 291 } 292 sbappendrecord(&pcb->hp_socket->so_snd, m0); 293 M_SETCTX(m, pcb->hp_socket); /* enable drop callback */ 294 295 DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", unit->hci_devname, 296 HCI_OGF(le16toh(hdr.opcode)), HCI_OCF(le16toh(hdr.opcode))); 297 298 /* Sendss it */ 299 if (unit->hci_num_cmd_pkts == 0) 300 MBUFQ_ENQUEUE(&unit->hci_cmdwait, m); 301 else 302 hci_output_cmd(unit, m); 303 304 return 0; 305 306 bad: 307 DPRINTF("packet (%d bytes) not sent (error %d)\n", 308 m->m_pkthdr.len, err); 309 if (m) m_freem(m); 310 return err; 311 } 312 313 /* 314 * User Request. 315 * up is socket 316 * m is either 317 * optional mbuf chain containing message 318 * ioctl command (PRU_CONTROL) 319 * nam is either 320 * optional mbuf chain containing an address 321 * ioctl data (PRU_CONTROL) 322 * optionally, protocol number (PRU_ATTACH) 323 * ctl is optional mbuf chain containing socket options 324 * l is pointer to process requesting action (if any) 325 * 326 * we are responsible for disposing of m and ctl if 327 * they are mbuf chains 328 */ 329 int 330 hci_usrreq(struct socket *up, int req, struct mbuf *m, 331 struct mbuf *nam, struct mbuf *ctl, struct lwp *l) 332 { 333 struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb; 334 struct sockaddr_bt *sa; 335 int err = 0; 336 337 DPRINTFN(2, "%s\n", prurequests[req]); 338 339 switch(req) { 340 case PRU_CONTROL: 341 return hci_ioctl((unsigned long)m, (void *)nam, l); 342 343 case PRU_PURGEIF: 344 return EOPNOTSUPP; 345 346 case PRU_ATTACH: 347 if (pcb) 348 return EINVAL; 349 350 err = soreserve(up, hci_sendspace, hci_recvspace); 351 if (err) 352 return err; 353 354 pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO); 355 if (pcb == NULL) 356 return ENOMEM; 357 358 up->so_pcb = pcb; 359 pcb->hp_socket = up; 360 361 if (l == NULL || kauth_authorize_generic(l->l_cred, 362 KAUTH_GENERIC_ISSUSER, NULL) == 0) 363 pcb->hp_flags |= HCI_PRIVILEGED; 364 365 /* 366 * Set default user filter. By default, socket only passes 367 * Command_Complete and Command_Status Events. 368 */ 369 hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter); 370 hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter); 371 hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter); 372 373 LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next); 374 375 return 0; 376 } 377 378 /* anything after here *requires* a pcb */ 379 if (pcb == NULL) { 380 err = EINVAL; 381 goto release; 382 } 383 384 switch(req) { 385 case PRU_DISCONNECT: 386 bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY); 387 388 /* XXX we cannot call soisdisconnected() here, as it sets 389 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being, 390 * that soisconnected() does not clear these and if you 391 * try to reconnect this socket (which is permitted) you 392 * get a broken pipe when you try to write any data. 393 */ 394 up->so_state &= ~SS_ISCONNECTED; 395 break; 396 397 case PRU_ABORT: 398 soisdisconnected(up); 399 /* fall through to */ 400 case PRU_DETACH: 401 if (up->so_snd.sb_mb != NULL) 402 hci_cmdwait_flush(up); 403 404 up->so_pcb = NULL; 405 LIST_REMOVE(pcb, hp_next); 406 free(pcb, M_PCB); 407 return 0; 408 409 case PRU_BIND: 410 KASSERT(nam != NULL); 411 sa = mtod(nam, struct sockaddr_bt *); 412 413 if (sa->bt_len != sizeof(struct sockaddr_bt)) 414 return EINVAL; 415 416 if (sa->bt_family != AF_BLUETOOTH) 417 return EAFNOSUPPORT; 418 419 bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr); 420 421 if (bdaddr_any(&sa->bt_bdaddr)) 422 pcb->hp_flags |= HCI_PROMISCUOUS; 423 else 424 pcb->hp_flags &= ~HCI_PROMISCUOUS; 425 426 return 0; 427 428 case PRU_CONNECT: 429 KASSERT(nam != NULL); 430 sa = mtod(nam, struct sockaddr_bt *); 431 432 if (sa->bt_len != sizeof(struct sockaddr_bt)) 433 return EINVAL; 434 435 if (sa->bt_family != AF_BLUETOOTH) 436 return EAFNOSUPPORT; 437 438 if (hci_unit_lookup(&sa->bt_bdaddr) == NULL) 439 return EADDRNOTAVAIL; 440 441 bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr); 442 soisconnected(up); 443 return 0; 444 445 case PRU_PEERADDR: 446 KASSERT(nam != NULL); 447 sa = mtod(nam, struct sockaddr_bt *); 448 449 memset(sa, 0, sizeof(struct sockaddr_bt)); 450 nam->m_len = 451 sa->bt_len = sizeof(struct sockaddr_bt); 452 sa->bt_family = AF_BLUETOOTH; 453 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr); 454 return 0; 455 456 case PRU_SOCKADDR: 457 KASSERT(nam != NULL); 458 sa = mtod(nam, struct sockaddr_bt *); 459 460 memset(sa, 0, sizeof(struct sockaddr_bt)); 461 nam->m_len = 462 sa->bt_len = sizeof(struct sockaddr_bt); 463 sa->bt_family = AF_BLUETOOTH; 464 bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr); 465 return 0; 466 467 case PRU_SHUTDOWN: 468 socantsendmore(up); 469 break; 470 471 case PRU_SEND: 472 sa = NULL; 473 if (nam) { 474 sa = mtod(nam, struct sockaddr_bt *); 475 476 if (sa->bt_len != sizeof(struct sockaddr_bt)) { 477 err = EINVAL; 478 goto release; 479 } 480 481 if (sa->bt_family != AF_BLUETOOTH) { 482 err = EAFNOSUPPORT; 483 goto release; 484 } 485 } 486 487 if (ctl) /* have no use for this */ 488 m_freem(ctl); 489 490 return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr)); 491 492 case PRU_SENSE: 493 return 0; /* (no sense - Doh!) */ 494 495 case PRU_RCVD: 496 case PRU_RCVOOB: 497 return EOPNOTSUPP; /* (no release) */ 498 499 case PRU_ACCEPT: 500 case PRU_CONNECT2: 501 case PRU_LISTEN: 502 case PRU_SENDOOB: 503 case PRU_FASTTIMO: 504 case PRU_SLOWTIMO: 505 case PRU_PROTORCV: 506 case PRU_PROTOSEND: 507 err = EOPNOTSUPP; 508 break; 509 510 default: 511 UNKNOWN(req); 512 err = EOPNOTSUPP; 513 break; 514 } 515 516 release: 517 if (m) 518 m_freem(m); 519 if (ctl) 520 m_freem(ctl); 521 return err; 522 } 523 524 /* 525 * get/set socket options 526 */ 527 int 528 hci_ctloutput(int req, struct socket *so, int level, 529 int optname, struct mbuf **opt) 530 { 531 struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb; 532 struct mbuf *m; 533 int err = 0; 534 535 DPRINTFN(2, "req %s\n", prcorequests[req]); 536 537 if (pcb == NULL) 538 return EINVAL; 539 540 if (level != BTPROTO_HCI) 541 return ENOPROTOOPT; 542 543 switch(req) { 544 case PRCO_GETOPT: 545 m = m_get(M_WAIT, MT_SOOPTS); 546 switch (optname) { 547 case SO_HCI_EVT_FILTER: 548 m->m_len = sizeof(struct hci_filter); 549 memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len); 550 break; 551 552 case SO_HCI_PKT_FILTER: 553 m->m_len = sizeof(struct hci_filter); 554 memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len); 555 break; 556 557 case SO_HCI_DIRECTION: 558 m->m_len = sizeof(int); 559 if (pcb->hp_flags & HCI_DIRECTION) 560 *mtod(m, int *) = 1; 561 else 562 *mtod(m, int *) = 0; 563 break; 564 565 default: 566 err = ENOPROTOOPT; 567 m_freem(m); 568 m = NULL; 569 break; 570 } 571 *opt = m; 572 break; 573 574 case PRCO_SETOPT: 575 m = *opt; 576 if (m) switch (optname) { 577 case SO_HCI_EVT_FILTER: /* set event filter */ 578 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 579 memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len); 580 break; 581 582 case SO_HCI_PKT_FILTER: /* set packet filter */ 583 m->m_len = min(m->m_len, sizeof(struct hci_filter)); 584 memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len); 585 break; 586 587 case SO_HCI_DIRECTION: /* request direction ctl messages */ 588 if (*mtod(m, int *)) 589 pcb->hp_flags |= HCI_DIRECTION; 590 else 591 pcb->hp_flags &= ~HCI_DIRECTION; 592 break; 593 594 default: 595 err = ENOPROTOOPT; 596 break; 597 } 598 m_freem(m); 599 break; 600 601 default: 602 err = ENOPROTOOPT; 603 break; 604 } 605 606 return err; 607 } 608 609 /* 610 * HCI mbuf tap routine 611 * 612 * copy packets to any raw HCI sockets that wish (and are 613 * permitted) to see them 614 */ 615 void 616 hci_mtap(struct mbuf *m, struct hci_unit *unit) 617 { 618 struct hci_pcb *pcb; 619 struct mbuf *m0, *ctlmsg, **ctl; 620 struct sockaddr_bt sa; 621 uint8_t type; 622 uint8_t event; 623 uint16_t opcode; 624 625 KASSERT(m->m_len >= sizeof(type)); 626 627 type = *mtod(m, uint8_t *); 628 629 memset(&sa, 0, sizeof(sa)); 630 sa.bt_len = sizeof(struct sockaddr_bt); 631 sa.bt_family = AF_BLUETOOTH; 632 bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr); 633 634 LIST_FOREACH(pcb, &hci_pcb, hp_next) { 635 /* 636 * filter according to source address 637 */ 638 if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0 639 && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0) 640 continue; 641 642 /* 643 * filter according to packet type filter 644 */ 645 if (hci_filter_test(type, &pcb->hp_pfilter) == 0) 646 continue; 647 648 /* 649 * filter according to event/security filters 650 */ 651 switch(type) { 652 case HCI_EVENT_PKT: 653 KASSERT(m->m_len >= sizeof(hci_event_hdr_t)); 654 655 event = mtod(m, hci_event_hdr_t *)->event; 656 657 if (hci_filter_test(event, &pcb->hp_efilter) == 0) 658 continue; 659 660 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 661 && hci_security_check_event(event) == -1) 662 continue; 663 break; 664 665 case HCI_CMD_PKT: 666 KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t)); 667 668 opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode); 669 670 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0 671 && hci_security_check_opcode(opcode) == -1) 672 continue; 673 break; 674 675 case HCI_ACL_DATA_PKT: 676 case HCI_SCO_DATA_PKT: 677 default: 678 if ((pcb->hp_flags & HCI_PRIVILEGED) == 0) 679 continue; 680 681 break; 682 } 683 684 /* 685 * create control messages 686 */ 687 ctlmsg = NULL; 688 ctl = &ctlmsg; 689 if (pcb->hp_flags & HCI_DIRECTION) { 690 int dir = m->m_flags & M_LINK0 ? 1 : 0; 691 692 *ctl = sbcreatecontrol((void *)&dir, sizeof(dir), 693 SCM_HCI_DIRECTION, BTPROTO_HCI); 694 695 if (*ctl != NULL) 696 ctl = &((*ctl)->m_next); 697 } 698 699 /* 700 * copy to socket 701 */ 702 m0 = m_copypacket(m, M_DONTWAIT); 703 if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv, 704 (struct sockaddr *)&sa, m0, ctlmsg)) { 705 sorwakeup(pcb->hp_socket); 706 } else { 707 m_freem(ctlmsg); 708 m_freem(m0); 709 } 710 } 711 } 712
Indexes created Thu Sep 25 16:09:42 GMT 2025