xref: /netbsd-src/sys/netbt/hci_socket.c (revision 267197ec1eebfcb9810ea27a89625b6ddf68e3e7)
1 /*	$NetBSD: hci_socket.c,v 1.14 2008/02/10 17:40:54 plunky Exp $	*/
2 
3 /*-
4  * Copyright (c) 2005 Iain Hibbert.
5  * Copyright (c) 2006 Itronix Inc.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The name of Itronix Inc. may not be used to endorse
17  *    or promote products derived from this software without specific
18  *    prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
24  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27  * ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.14 2008/02/10 17:40:54 plunky Exp $");
35 
36 /* load symbolic names */
37 #ifdef BLUETOOTH_DEBUG
38 #define PRUREQUESTS
39 #define PRCOREQUESTS
40 #endif
41 
42 #include <sys/param.h>
43 #include <sys/domain.h>
44 #include <sys/kauth.h>
45 #include <sys/kernel.h>
46 #include <sys/mbuf.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/systm.h>
52 
53 #include <netbt/bluetooth.h>
54 #include <netbt/hci.h>
55 
56 /*******************************************************************************
57  *
58  * HCI SOCK_RAW Sockets - for control of Bluetooth Devices
59  *
60  */
61 
62 /*
63  * the raw HCI protocol control block
64  */
65 struct hci_pcb {
66 	struct socket		*hp_socket;	/* socket */
67 	unsigned int		hp_flags;	/* flags */
68 	bdaddr_t		hp_laddr;	/* local address */
69 	bdaddr_t		hp_raddr;	/* remote address */
70 	struct hci_filter	hp_efilter;	/* user event filter */
71 	struct hci_filter	hp_pfilter;	/* user packet filter */
72 	LIST_ENTRY(hci_pcb)	hp_next;	/* next HCI pcb */
73 };
74 
75 /* hp_flags */
76 #define HCI_PRIVILEGED		(1<<0)	/* no security filter for root */
77 #define HCI_DIRECTION		(1<<1)	/* direction control messages */
78 #define HCI_PROMISCUOUS		(1<<2)	/* listen to all units */
79 
80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb);
81 
82 /* sysctl defaults */
83 int hci_sendspace = HCI_CMD_PKT_SIZE;
84 int hci_recvspace = 4096;
85 
86 /* supported commands opcode table */
87 static const struct {
88 	uint16_t	opcode;
89 	uint8_t		offs;	/* 0 - 63 */
90 	uint8_t		mask;	/* bit 0 - 7 */
91 	int16_t		length;	/* -1 if privileged */
92 } hci_cmds[] = {
93 	{ HCI_CMD_INQUIRY,
94 	  0,  0x01, sizeof(hci_inquiry_cp) },
95 	{ HCI_CMD_INQUIRY_CANCEL,
96 	  0,  0x02, -1 },
97 	{ HCI_CMD_PERIODIC_INQUIRY,
98 	  0,  0x04, -1 },
99 	{ HCI_CMD_EXIT_PERIODIC_INQUIRY,
100 	  0,  0x08, -1 },
101 	{ HCI_CMD_CREATE_CON,
102 	  0,  0x10, -1 },
103 	{ HCI_CMD_DISCONNECT,
104 	  0,  0x20, -1 },
105 	{ HCI_CMD_ADD_SCO_CON,
106 	  0,  0x40, -1 },
107 	{ HCI_CMD_CREATE_CON_CANCEL,
108 	  0,  0x80, -1 },
109 	{ HCI_CMD_ACCEPT_CON,
110 	  1,  0x01, -1 },
111 	{ HCI_CMD_REJECT_CON,
112 	  1,  0x02, -1 },
113 	{ HCI_CMD_LINK_KEY_REP,
114 	  1,  0x04, -1 },
115 	{ HCI_CMD_LINK_KEY_NEG_REP,
116 	  1,  0x08, -1 },
117 	{ HCI_CMD_PIN_CODE_REP,
118 	  1,  0x10, -1 },
119 	{ HCI_CMD_PIN_CODE_NEG_REP,
120 	  1,  0x20, -1 },
121 	{ HCI_CMD_CHANGE_CON_PACKET_TYPE,
122 	  1,  0x40, -1 },
123 	{ HCI_CMD_AUTH_REQ,
124 	  1,  0x80, -1 },
125 	{ HCI_CMD_SET_CON_ENCRYPTION,
126 	  2,  0x01, -1 },
127 	{ HCI_CMD_CHANGE_CON_LINK_KEY,
128 	  2,  0x02, -1 },
129 	{ HCI_CMD_MASTER_LINK_KEY,
130 	  2,  0x04, -1 },
131 	{ HCI_CMD_REMOTE_NAME_REQ,
132 	  2,  0x08, sizeof(hci_remote_name_req_cp) },
133 	{ HCI_CMD_REMOTE_NAME_REQ_CANCEL,
134 	  2,  0x10, -1 },
135 	{ HCI_CMD_READ_REMOTE_FEATURES,
136 	  2,  0x20, sizeof(hci_read_remote_features_cp) },
137 	{ HCI_CMD_READ_REMOTE_EXTENDED_FEATURES,
138 	  2,  0x40, sizeof(hci_read_remote_extended_features_cp) },
139 	{ HCI_CMD_READ_REMOTE_VER_INFO,
140 	  2,  0x80, sizeof(hci_read_remote_ver_info_cp) },
141 	{ HCI_CMD_READ_CLOCK_OFFSET,
142 	  3,  0x01, sizeof(hci_read_clock_offset_cp) },
143 	{ HCI_CMD_READ_LMP_HANDLE,
144 	  3,  0x02, sizeof(hci_read_lmp_handle_cp) },
145 	{ HCI_CMD_HOLD_MODE,
146 	  4,  0x02, -1 },
147 	{ HCI_CMD_SNIFF_MODE,
148 	  4,  0x04, -1 },
149 	{ HCI_CMD_EXIT_SNIFF_MODE,
150 	  4,  0x08, -1 },
151 	{ HCI_CMD_PARK_MODE,
152 	  4,  0x10, -1 },
153 	{ HCI_CMD_EXIT_PARK_MODE,
154 	  4,  0x20, -1 },
155 	{ HCI_CMD_QOS_SETUP,
156 	  4,  0x40, -1 },
157 	{ HCI_CMD_ROLE_DISCOVERY,
158 	  4,  0x80, sizeof(hci_role_discovery_cp) },
159 	{ HCI_CMD_SWITCH_ROLE,
160 	  5,  0x01, -1 },
161 	{ HCI_CMD_READ_LINK_POLICY_SETTINGS,
162 	  5,  0x02, sizeof(hci_read_link_policy_settings_cp) },
163 	{ HCI_CMD_WRITE_LINK_POLICY_SETTINGS,
164 	  5,  0x04, -1 },
165 	{ HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS,
166 	  5,  0x08, 0 },
167 	{ HCI_CMD_WRITE_DEFAULT_LINK_POLICY_SETTINGS,
168 	  5,  0x10, -1 },
169 	{ HCI_CMD_FLOW_SPECIFICATION,
170 	  5,  0x20, -1 },
171 	{ HCI_CMD_SET_EVENT_MASK,
172 	  5,  0x40, -1 },
173 	{ HCI_CMD_RESET,
174 	  5,  0x80, -1 },
175 	{ HCI_CMD_SET_EVENT_FILTER,
176 	  6,  0x01, -1 },
177 	{ HCI_CMD_FLUSH,
178 	  6,  0x02, -1 },
179 	{ HCI_CMD_READ_PIN_TYPE,
180 	  6,  0x04, 0 },
181 	{ HCI_CMD_WRITE_PIN_TYPE,
182 	  6,  0x08, -1 },
183 	{ HCI_CMD_CREATE_NEW_UNIT_KEY,
184 	  6,  0x10, -1 },
185 	{ HCI_CMD_READ_STORED_LINK_KEY,
186 	  6,  0x20, -1 },
187 	{ HCI_CMD_WRITE_STORED_LINK_KEY,
188 	  6,  0x40, -1 },
189 	{ HCI_CMD_DELETE_STORED_LINK_KEY,
190 	  6,  0x80, -1 },
191 	{ HCI_CMD_WRITE_LOCAL_NAME,
192 	  7,  0x01, -1 },
193 	{ HCI_CMD_READ_LOCAL_NAME,
194 	  7,  0x02, 0 },
195 	{ HCI_CMD_READ_CON_ACCEPT_TIMEOUT,
196 	  7,  0x04, 0 },
197 	{ HCI_CMD_WRITE_CON_ACCEPT_TIMEOUT,
198 	  7,  0x08, -1 },
199 	{ HCI_CMD_READ_PAGE_TIMEOUT,
200 	  7,  0x10, 0 },
201 	{ HCI_CMD_WRITE_PAGE_TIMEOUT,
202 	  7,  0x20, -1 },
203 	{ HCI_CMD_READ_SCAN_ENABLE,
204 	  7,  0x40, 0 },
205 	{ HCI_CMD_WRITE_SCAN_ENABLE,
206 	  7,  0x80, -1 },
207 	{ HCI_CMD_READ_PAGE_SCAN_ACTIVITY,
208 	  8,  0x01, 0 },
209 	{ HCI_CMD_WRITE_PAGE_SCAN_ACTIVITY,
210 	  8,  0x02, -1 },
211 	{ HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY,
212 	  8,  0x04, 0 },
213 	{ HCI_CMD_WRITE_INQUIRY_SCAN_ACTIVITY,
214 	  8,  0x08, -1 },
215 	{ HCI_CMD_READ_AUTH_ENABLE,
216 	  8,  0x10, 0 },
217 	{ HCI_CMD_WRITE_AUTH_ENABLE,
218 	  8,  0x20, -1 },
219 	{ HCI_CMD_READ_ENCRYPTION_MODE,
220 	  8,  0x40, 0 },
221 	{ HCI_CMD_WRITE_ENCRYPTION_MODE,
222 	  8,  0x80, -1 },
223 	{ HCI_CMD_READ_UNIT_CLASS,
224 	  9,  0x01, 0 },
225 	{ HCI_CMD_WRITE_UNIT_CLASS,
226 	  9,  0x02, -1 },
227 	{ HCI_CMD_READ_VOICE_SETTING,
228 	  9,  0x04, 0 },
229 	{ HCI_CMD_WRITE_VOICE_SETTING,
230 	  9,  0x08, -1 },
231 	{ HCI_CMD_READ_AUTO_FLUSH_TIMEOUT,
232 	  9,  0x10, sizeof(hci_read_auto_flush_timeout_cp) },
233 	{ HCI_CMD_WRITE_AUTO_FLUSH_TIMEOUT,
234 	  9,  0x20, -1 },
235 	{ HCI_CMD_READ_NUM_BROADCAST_RETRANS,
236 	  9,  0x40, 0 },
237 	{ HCI_CMD_WRITE_NUM_BROADCAST_RETRANS,
238 	  9,  0x80, -1 },
239 	{ HCI_CMD_READ_HOLD_MODE_ACTIVITY,
240 	  10, 0x01, 0 },
241 	{ HCI_CMD_WRITE_HOLD_MODE_ACTIVITY,
242 	  10, 0x02, -1 },
243 	{ HCI_CMD_READ_XMIT_LEVEL,
244 	  10, 0x04, sizeof(hci_read_xmit_level_cp) },
245 	{ HCI_CMD_READ_SCO_FLOW_CONTROL,
246 	  10, 0x08, 0 },
247 	{ HCI_CMD_WRITE_SCO_FLOW_CONTROL,
248 	  10, 0x10, -1 },
249 	{ HCI_CMD_HC2H_FLOW_CONTROL,
250 	  10, 0x20, -1 },
251 	{ HCI_CMD_HOST_BUFFER_SIZE,
252 	  10, 0x40, -1 },
253 	{ HCI_CMD_HOST_NUM_COMPL_PKTS,
254 	  10, 0x80, -1 },
255 	{ HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT,
256 	  11, 0x01, sizeof(hci_read_link_supervision_timeout_cp) },
257 	{ HCI_CMD_WRITE_LINK_SUPERVISION_TIMEOUT,
258 	  11, 0x02, -1 },
259 	{ HCI_CMD_READ_NUM_SUPPORTED_IAC,
260 	  11, 0x04, 0 },
261 	{ HCI_CMD_READ_IAC_LAP,
262 	  11, 0x08, 0 },
263 	{ HCI_CMD_WRITE_IAC_LAP,
264 	  11, 0x10, -1 },
265 	{ HCI_CMD_READ_PAGE_SCAN_PERIOD,
266 	  11, 0x20, 0 },
267 	{ HCI_CMD_WRITE_PAGE_SCAN_PERIOD,
268 	  11, 0x40, -1 },
269 	{ HCI_CMD_READ_PAGE_SCAN,
270 	  11, 0x80, 0 },
271 	{ HCI_CMD_WRITE_PAGE_SCAN,
272 	  12, 0x01, -1 },
273 	{ HCI_CMD_SET_AFH_CLASSIFICATION,
274 	  12, 0x02, -1 },
275 	{ HCI_CMD_READ_INQUIRY_SCAN_TYPE,
276 	  12, 0x10, 0 },
277 	{ HCI_CMD_WRITE_INQUIRY_SCAN_TYPE,
278 	  12, 0x20, -1 },
279 	{ HCI_CMD_READ_INQUIRY_MODE,
280 	  12, 0x40, 0 },
281 	{ HCI_CMD_WRITE_INQUIRY_MODE,
282 	  12, 0x80, -1 },
283 	{ HCI_CMD_READ_PAGE_SCAN_TYPE,
284 	  13, 0x01, 0 },
285 	{ HCI_CMD_WRITE_PAGE_SCAN_TYPE,
286 	  13, 0x02, -1 },
287 	{ HCI_CMD_READ_AFH_ASSESSMENT,
288 	  13, 0x04, 0 },
289 	{ HCI_CMD_WRITE_AFH_ASSESSMENT,
290 	  13, 0x08, -1 },
291 	{ HCI_CMD_READ_LOCAL_VER,
292 	  14, 0x08, 0 },
293 	{ HCI_CMD_READ_LOCAL_COMMANDS,
294 	  14, 0x10, 0 },
295 	{ HCI_CMD_READ_LOCAL_FEATURES,
296 	  14, 0x20, 0 },
297 	{ HCI_CMD_READ_LOCAL_EXTENDED_FEATURES,
298 	  14, 0x40, sizeof(hci_read_local_extended_features_cp) },
299 	{ HCI_CMD_READ_BUFFER_SIZE,
300 	  14, 0x80, 0 },
301 	{ HCI_CMD_READ_COUNTRY_CODE,
302 	  15, 0x01, 0 },
303 	{ HCI_CMD_READ_BDADDR,
304 	  15, 0x02, 0 },
305 	{ HCI_CMD_READ_FAILED_CONTACT_CNTR,
306 	  15, 0x04, sizeof(hci_read_failed_contact_cntr_cp) },
307 	{ HCI_CMD_RESET_FAILED_CONTACT_CNTR,
308 	  15, 0x08, -1 },
309 	{ HCI_CMD_READ_LINK_QUALITY,
310 	  15, 0x10, sizeof(hci_read_link_quality_cp) },
311 	{ HCI_CMD_READ_RSSI,
312 	  15, 0x20, sizeof(hci_read_rssi_cp) },
313 	{ HCI_CMD_READ_AFH_CHANNEL_MAP,
314 	  15, 0x40, sizeof(hci_read_afh_channel_map_cp) },
315 	{ HCI_CMD_READ_CLOCK,
316 	  15, 0x80, sizeof(hci_read_clock_cp) },
317 	{ HCI_CMD_READ_LOOPBACK_MODE,
318 	  16, 0x01, 0 },
319 	{ HCI_CMD_WRITE_LOOPBACK_MODE,
320 	  16, 0x02, -1 },
321 	{ HCI_CMD_ENABLE_UNIT_UNDER_TEST,
322 	  16, 0x04, -1 },
323 	{ HCI_CMD_SETUP_SCO_CON,
324 	  16, 0x08, -1 },
325 	{ HCI_CMD_ACCEPT_SCO_CON_REQ,
326 	  16, 0x10, -1 },
327 	{ HCI_CMD_REJECT_SCO_CON_REQ,
328 	  16, 0x20, -1 },
329 	{ HCI_CMD_READ_EXTENDED_INQUIRY_RSP,
330 	  17, 0x01, 0 },
331 	{ HCI_CMD_WRITE_EXTENDED_INQUIRY_RSP,
332 	  17, 0x02, -1 },
333 	{ HCI_CMD_REFRESH_ENCRYPTION_KEY,
334 	  17, 0x04, -1 },
335 	{ HCI_CMD_SNIFF_SUBRATING,
336 	  17, 0x10, -1 },
337 	{ HCI_CMD_READ_SIMPLE_PAIRING_MODE,
338 	  17, 0x20, 0 },
339 	{ HCI_CMD_WRITE_SIMPLE_PAIRING_MODE,
340 	  17, 0x40, -1 },
341 	{ HCI_CMD_READ_LOCAL_OOB_DATA,
342 	  17, 0x80, -1 },
343 	{ HCI_CMD_READ_INQUIRY_RSP_XMIT_POWER,
344 	  18, 0x01, 0 },
345 	{ HCI_CMD_WRITE_INQUIRY_RSP_XMIT_POWER,
346 	  18, 0x02, -1 },
347 	{ HCI_CMD_READ_DEFAULT_ERRDATA_REPORTING,
348 	  18, 0x04, 0 },
349 	{ HCI_CMD_WRITE_DEFAULT_ERRDATA_REPORTING,
350 	  18, 0x08, -1 },
351 	{ HCI_CMD_IO_CAPABILITY_REP,
352 	  18, 0x80, -1 },
353 	{ HCI_CMD_USER_CONFIRM_REP,
354 	  19, 0x01, -1 },
355 	{ HCI_CMD_USER_CONFIRM_NEG_REP,
356 	  19, 0x02, -1 },
357 	{ HCI_CMD_USER_PASSKEY_REP,
358 	  19, 0x04, -1 },
359 	{ HCI_CMD_USER_PASSKEY_NEG_REP,
360 	  19, 0x08, -1 },
361 	{ HCI_CMD_OOB_DATA_REP,
362 	  19, 0x10, -1 },
363 	{ HCI_CMD_WRITE_SIMPLE_PAIRING_DEBUG_MODE,
364 	  19, 0x20, -1 },
365 	{ HCI_CMD_ENHANCED_FLUSH,
366 	  19, 0x40, -1 },
367 	{ HCI_CMD_OOB_DATA_NEG_REP,
368 	  19, 0x80, -1 },
369 	{ HCI_CMD_SEND_KEYPRESS_NOTIFICATION,
370 	  20, 0x40, -1 },
371 	{ HCI_CMD_IO_CAPABILITY_NEG_REP,
372 	  20, 0x80, -1 },
373 };
374 
375 /*
376  * Security filter routines for unprivileged users.
377  *	Allow all but a few critical events, and only permit read commands.
378  *	If a unit is given, verify the command is supported.
379  */
380 
381 static int
382 hci_security_check_opcode(struct hci_unit *unit, uint16_t opcode)
383 {
384 	int i;
385 
386 	for (i = 0 ; i < __arraycount(hci_cmds) ; i++) {
387 		if (opcode != hci_cmds[i].opcode)
388 			continue;
389 
390 		if (unit == NULL
391 		    || (unit->hci_cmds[hci_cmds[i].offs] & hci_cmds[i].mask))
392 			return hci_cmds[i].length;
393 
394 		break;
395 	}
396 
397 	return -1;
398 }
399 
400 static int
401 hci_security_check_event(uint8_t event)
402 {
403 
404 	switch (event) {
405 	case HCI_EVENT_RETURN_LINK_KEYS:
406 	case HCI_EVENT_LINK_KEY_NOTIFICATION:
407 	case HCI_EVENT_USER_CONFIRM_REQ:
408 	case HCI_EVENT_USER_PASSKEY_NOTIFICATION:
409 	case HCI_EVENT_VENDOR:
410 		return -1;	/* disallowed */
411 	}
412 
413 	return 0;	/* ok */
414 }
415 
416 /*
417  * When command packet reaches the device, we can drop
418  * it from the socket buffer (called from hci_output_acl)
419  */
420 void
421 hci_drop(void *arg)
422 {
423 	struct socket *so = arg;
424 
425 	sbdroprecord(&so->so_snd);
426 	sowwakeup(so);
427 }
428 
429 /*
430  * HCI socket is going away and has some pending packets. We let them
431  * go by design, but remove the context pointer as it will be invalid
432  * and we no longer need to be notified.
433  */
434 static void
435 hci_cmdwait_flush(struct socket *so)
436 {
437 	struct hci_unit *unit;
438 	struct socket *ctx;
439 	struct mbuf *m;
440 
441 	DPRINTF("flushing %p\n", so);
442 
443 	SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) {
444 		m = MBUFQ_FIRST(&unit->hci_cmdwait);
445 		while (m != NULL) {
446 			ctx = M_GETCTX(m, struct socket *);
447 			if (ctx == so)
448 				M_SETCTX(m, NULL);
449 
450 			m = MBUFQ_NEXT(m);
451 		}
452 	}
453 }
454 
455 /*
456  * HCI send packet
457  *     This came from userland, so check it out.
458  */
459 static int
460 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr)
461 {
462 	struct hci_unit *unit;
463 	struct mbuf *m0;
464 	hci_cmd_hdr_t hdr;
465 	int err;
466 
467 	KASSERT(m != NULL);
468 	KASSERT(addr != NULL);
469 
470 	/* wants at least a header to start with */
471 	if (m->m_pkthdr.len < sizeof(hdr)) {
472 		err = EMSGSIZE;
473 		goto bad;
474 	}
475 	m_copydata(m, 0, sizeof(hdr), &hdr);
476 	hdr.opcode = le16toh(hdr.opcode);
477 
478 	/* only allows CMD packets to be sent */
479 	if (hdr.type != HCI_CMD_PKT) {
480 		err = EINVAL;
481 		goto bad;
482 	}
483 
484 	/* validates packet length */
485 	if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) {
486 		err = EMSGSIZE;
487 		goto bad;
488 	}
489 
490 	/* finds destination */
491 	unit = hci_unit_lookup(addr);
492 	if (unit == NULL) {
493 		err = ENETDOWN;
494 		goto bad;
495 	}
496 
497 	/* security checks for unprivileged users */
498 	if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
499 	    && hci_security_check_opcode(unit, hdr.opcode) != hdr.length) {
500 		err = EPERM;
501 		goto bad;
502 	}
503 
504 	/* makess a copy for precious to keep */
505 	m0 = m_copypacket(m, M_DONTWAIT);
506 	if (m0 == NULL) {
507 		err = ENOMEM;
508 		goto bad;
509 	}
510 	sbappendrecord(&pcb->hp_socket->so_snd, m0);
511 	M_SETCTX(m, pcb->hp_socket);	/* enable drop callback */
512 
513 	DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev),
514 		HCI_OGF(hdr.opcode), HCI_OCF(hdr.opcode));
515 
516 	/* Sendss it */
517 	if (unit->hci_num_cmd_pkts == 0)
518 		MBUFQ_ENQUEUE(&unit->hci_cmdwait, m);
519 	else
520 		hci_output_cmd(unit, m);
521 
522 	return 0;
523 
524 bad:
525 	DPRINTF("packet (%d bytes) not sent (error %d)\n",
526 			m->m_pkthdr.len, err);
527 	if (m) m_freem(m);
528 	return err;
529 }
530 
531 /*
532  * User Request.
533  * up is socket
534  * m is either
535  *	optional mbuf chain containing message
536  *	ioctl command (PRU_CONTROL)
537  * nam is either
538  *	optional mbuf chain containing an address
539  *	ioctl data (PRU_CONTROL)
540  *      optionally, protocol number (PRU_ATTACH)
541  * ctl is optional mbuf chain containing socket options
542  * l is pointer to process requesting action (if any)
543  *
544  * we are responsible for disposing of m and ctl if
545  * they are mbuf chains
546  */
547 int
548 hci_usrreq(struct socket *up, int req, struct mbuf *m,
549 		struct mbuf *nam, struct mbuf *ctl, struct lwp *l)
550 {
551 	struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb;
552 	struct sockaddr_bt *sa;
553 	int err = 0;
554 
555 	DPRINTFN(2, "%s\n", prurequests[req]);
556 
557 	switch(req) {
558 	case PRU_CONTROL:
559 		return hci_ioctl((unsigned long)m, (void *)nam, l);
560 
561 	case PRU_PURGEIF:
562 		return EOPNOTSUPP;
563 
564 	case PRU_ATTACH:
565 		if (pcb)
566 			return EINVAL;
567 
568 		err = soreserve(up, hci_sendspace, hci_recvspace);
569 		if (err)
570 			return err;
571 
572 		pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO);
573 		if (pcb == NULL)
574 			return ENOMEM;
575 
576 		up->so_pcb = pcb;
577 		pcb->hp_socket = up;
578 
579 		if (l == NULL || kauth_authorize_generic(l->l_cred,
580 		    KAUTH_GENERIC_ISSUSER, NULL) == 0)
581 			pcb->hp_flags |= HCI_PRIVILEGED;
582 
583 		/*
584 		 * Set default user filter. By default, socket only passes
585 		 * Command_Complete and Command_Status Events.
586 		 */
587 		hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter);
588 		hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter);
589 		hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter);
590 
591 		LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next);
592 
593 		return 0;
594 	}
595 
596 	/* anything after here *requires* a pcb */
597 	if (pcb == NULL) {
598 		err = EINVAL;
599 		goto release;
600 	}
601 
602 	switch(req) {
603 	case PRU_DISCONNECT:
604 		bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY);
605 
606 		/* XXX we cannot call soisdisconnected() here, as it sets
607 		 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being,
608 		 * that soisconnected() does not clear these and if you
609 		 * try to reconnect this socket (which is permitted) you
610 		 * get a broken pipe when you try to write any data.
611 		 */
612 		up->so_state &= ~SS_ISCONNECTED;
613 		break;
614 
615 	case PRU_ABORT:
616 		soisdisconnected(up);
617 		/* fall through to */
618 	case PRU_DETACH:
619 		if (up->so_snd.sb_mb != NULL)
620 			hci_cmdwait_flush(up);
621 
622 		up->so_pcb = NULL;
623 		LIST_REMOVE(pcb, hp_next);
624 		free(pcb, M_PCB);
625 		return 0;
626 
627 	case PRU_BIND:
628 		KASSERT(nam != NULL);
629 		sa = mtod(nam, struct sockaddr_bt *);
630 
631 		if (sa->bt_len != sizeof(struct sockaddr_bt))
632 			return EINVAL;
633 
634 		if (sa->bt_family != AF_BLUETOOTH)
635 			return EAFNOSUPPORT;
636 
637 		bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr);
638 
639 		if (bdaddr_any(&sa->bt_bdaddr))
640 			pcb->hp_flags |= HCI_PROMISCUOUS;
641 		else
642 			pcb->hp_flags &= ~HCI_PROMISCUOUS;
643 
644 		return 0;
645 
646 	case PRU_CONNECT:
647 		KASSERT(nam != NULL);
648 		sa = mtod(nam, struct sockaddr_bt *);
649 
650 		if (sa->bt_len != sizeof(struct sockaddr_bt))
651 			return EINVAL;
652 
653 		if (sa->bt_family != AF_BLUETOOTH)
654 			return EAFNOSUPPORT;
655 
656 		if (hci_unit_lookup(&sa->bt_bdaddr) == NULL)
657 			return EADDRNOTAVAIL;
658 
659 		bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr);
660 		soisconnected(up);
661 		return 0;
662 
663 	case PRU_PEERADDR:
664 		KASSERT(nam != NULL);
665 		sa = mtod(nam, struct sockaddr_bt *);
666 
667 		memset(sa, 0, sizeof(struct sockaddr_bt));
668 		nam->m_len =
669 		sa->bt_len = sizeof(struct sockaddr_bt);
670 		sa->bt_family = AF_BLUETOOTH;
671 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr);
672 		return 0;
673 
674 	case PRU_SOCKADDR:
675 		KASSERT(nam != NULL);
676 		sa = mtod(nam, struct sockaddr_bt *);
677 
678 		memset(sa, 0, sizeof(struct sockaddr_bt));
679 		nam->m_len =
680 		sa->bt_len = sizeof(struct sockaddr_bt);
681 		sa->bt_family = AF_BLUETOOTH;
682 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr);
683 		return 0;
684 
685 	case PRU_SHUTDOWN:
686 		socantsendmore(up);
687 		break;
688 
689 	case PRU_SEND:
690 		sa = NULL;
691 		if (nam) {
692 			sa = mtod(nam, struct sockaddr_bt *);
693 
694 			if (sa->bt_len != sizeof(struct sockaddr_bt)) {
695 				err = EINVAL;
696 				goto release;
697 			}
698 
699 			if (sa->bt_family != AF_BLUETOOTH) {
700 				err = EAFNOSUPPORT;
701 				goto release;
702 			}
703 		}
704 
705 		if (ctl) /* have no use for this */
706 			m_freem(ctl);
707 
708 		return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr));
709 
710 	case PRU_SENSE:
711 		return 0;		/* (no sense - Doh!) */
712 
713 	case PRU_RCVD:
714 	case PRU_RCVOOB:
715 		return EOPNOTSUPP;	/* (no release) */
716 
717 	case PRU_ACCEPT:
718 	case PRU_CONNECT2:
719 	case PRU_LISTEN:
720 	case PRU_SENDOOB:
721 	case PRU_FASTTIMO:
722 	case PRU_SLOWTIMO:
723 	case PRU_PROTORCV:
724 	case PRU_PROTOSEND:
725 		err = EOPNOTSUPP;
726 		break;
727 
728 	default:
729 		UNKNOWN(req);
730 		err = EOPNOTSUPP;
731 		break;
732 	}
733 
734 release:
735 	if (m)
736 		m_freem(m);
737 	if (ctl)
738 		m_freem(ctl);
739 	return err;
740 }
741 
742 /*
743  * get/set socket options
744  */
745 int
746 hci_ctloutput(int req, struct socket *so, int level,
747 		int optname, struct mbuf **opt)
748 {
749 	struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
750 	struct mbuf *m;
751 	int err = 0;
752 
753 	DPRINTFN(2, "req %s\n", prcorequests[req]);
754 
755 	if (pcb == NULL)
756 		return EINVAL;
757 
758 	if (level != BTPROTO_HCI)
759 		return ENOPROTOOPT;
760 
761 	switch(req) {
762 	case PRCO_GETOPT:
763 		m = m_get(M_WAIT, MT_SOOPTS);
764 		switch (optname) {
765 		case SO_HCI_EVT_FILTER:
766 			m->m_len = sizeof(struct hci_filter);
767 			memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len);
768 			break;
769 
770 		case SO_HCI_PKT_FILTER:
771 			m->m_len = sizeof(struct hci_filter);
772 			memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len);
773 			break;
774 
775 		case SO_HCI_DIRECTION:
776 			m->m_len = sizeof(int);
777 			if (pcb->hp_flags & HCI_DIRECTION)
778 				*mtod(m, int *) = 1;
779 			else
780 				*mtod(m, int *) = 0;
781 			break;
782 
783 		default:
784 			err = ENOPROTOOPT;
785 			m_freem(m);
786 			m = NULL;
787 			break;
788 		}
789 		*opt = m;
790 		break;
791 
792 	case PRCO_SETOPT:
793 		m = *opt;
794 		if (m) switch (optname) {
795 		case SO_HCI_EVT_FILTER:	/* set event filter */
796 			m->m_len = min(m->m_len, sizeof(struct hci_filter));
797 			memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len);
798 			break;
799 
800 		case SO_HCI_PKT_FILTER:	/* set packet filter */
801 			m->m_len = min(m->m_len, sizeof(struct hci_filter));
802 			memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len);
803 			break;
804 
805 		case SO_HCI_DIRECTION:	/* request direction ctl messages */
806 			if (*mtod(m, int *))
807 				pcb->hp_flags |= HCI_DIRECTION;
808 			else
809 				pcb->hp_flags &= ~HCI_DIRECTION;
810 			break;
811 
812 		default:
813 			err = ENOPROTOOPT;
814 			break;
815 		}
816 		m_freem(m);
817 		break;
818 
819 	default:
820 		err = ENOPROTOOPT;
821 		break;
822 	}
823 
824 	return err;
825 }
826 
827 /*
828  * HCI mbuf tap routine
829  *
830  * copy packets to any raw HCI sockets that wish (and are
831  * permitted) to see them
832  */
833 void
834 hci_mtap(struct mbuf *m, struct hci_unit *unit)
835 {
836 	struct hci_pcb *pcb;
837 	struct mbuf *m0, *ctlmsg, **ctl;
838 	struct sockaddr_bt sa;
839 	uint8_t type;
840 	uint8_t event;
841 	uint16_t opcode;
842 
843 	KASSERT(m->m_len >= sizeof(type));
844 
845 	type = *mtod(m, uint8_t *);
846 
847 	memset(&sa, 0, sizeof(sa));
848 	sa.bt_len = sizeof(struct sockaddr_bt);
849 	sa.bt_family = AF_BLUETOOTH;
850 	bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr);
851 
852 	LIST_FOREACH(pcb, &hci_pcb, hp_next) {
853 		/*
854 		 * filter according to source address
855 		 */
856 		if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0
857 		    && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0)
858 			continue;
859 
860 		/*
861 		 * filter according to packet type filter
862 		 */
863 		if (hci_filter_test(type, &pcb->hp_pfilter) == 0)
864 			continue;
865 
866 		/*
867 		 * filter according to event/security filters
868 		 */
869 		switch(type) {
870 		case HCI_EVENT_PKT:
871 			KASSERT(m->m_len >= sizeof(hci_event_hdr_t));
872 
873 			event = mtod(m, hci_event_hdr_t *)->event;
874 
875 			if (hci_filter_test(event, &pcb->hp_efilter) == 0)
876 				continue;
877 
878 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
879 			    && hci_security_check_event(event) == -1)
880 				continue;
881 			break;
882 
883 		case HCI_CMD_PKT:
884 			KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t));
885 
886 			opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode);
887 
888 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
889 			    && hci_security_check_opcode(NULL, opcode) == -1)
890 				continue;
891 			break;
892 
893 		case HCI_ACL_DATA_PKT:
894 		case HCI_SCO_DATA_PKT:
895 		default:
896 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0)
897 				continue;
898 
899 			break;
900 		}
901 
902 		/*
903 		 * create control messages
904 		 */
905 		ctlmsg = NULL;
906 		ctl = &ctlmsg;
907 		if (pcb->hp_flags & HCI_DIRECTION) {
908 			int dir = m->m_flags & M_LINK0 ? 1 : 0;
909 
910 			*ctl = sbcreatecontrol(&dir, sizeof(dir),
911 			    SCM_HCI_DIRECTION, BTPROTO_HCI);
912 
913 			if (*ctl != NULL)
914 				ctl = &((*ctl)->m_next);
915 		}
916 
917 		/*
918 		 * copy to socket
919 		 */
920 		m0 = m_copypacket(m, M_DONTWAIT);
921 		if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv,
922 				(struct sockaddr *)&sa, m0, ctlmsg)) {
923 			sorwakeup(pcb->hp_socket);
924 		} else {
925 			m_freem(ctlmsg);
926 			m_freem(m0);
927 		}
928 	}
929 }
930