xref: /netbsd-src/sys/netbt/hci_socket.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: hci_socket.c,v 1.12 2007/11/10 23:12:23 plunky Exp $	*/
2 
3 /*-
4  * Copyright (c) 2005 Iain Hibbert.
5  * Copyright (c) 2006 Itronix Inc.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The name of Itronix Inc. may not be used to endorse
17  *    or promote products derived from this software without specific
18  *    prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
24  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27  * ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.12 2007/11/10 23:12:23 plunky Exp $");
35 
36 /* load symbolic names */
37 #ifdef BLUETOOTH_DEBUG
38 #define PRUREQUESTS
39 #define PRCOREQUESTS
40 #endif
41 
42 #include <sys/param.h>
43 #include <sys/domain.h>
44 #include <sys/kauth.h>
45 #include <sys/kernel.h>
46 #include <sys/mbuf.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/systm.h>
52 
53 #include <netbt/bluetooth.h>
54 #include <netbt/hci.h>
55 
56 /*******************************************************************************
57  *
58  * HCI SOCK_RAW Sockets - for control of Bluetooth Devices
59  *
60  */
61 
62 /*
63  * the raw HCI protocol control block
64  */
65 struct hci_pcb {
66 	struct socket		*hp_socket;	/* socket */
67 	unsigned int		hp_flags;	/* flags */
68 	bdaddr_t		hp_laddr;	/* local address */
69 	bdaddr_t		hp_raddr;	/* remote address */
70 	struct hci_filter	hp_efilter;	/* user event filter */
71 	struct hci_filter	hp_pfilter;	/* user packet filter */
72 	LIST_ENTRY(hci_pcb)	hp_next;	/* next HCI pcb */
73 };
74 
75 /* hp_flags */
76 #define HCI_PRIVILEGED		(1<<0)	/* no security filter for root */
77 #define HCI_DIRECTION		(1<<1)	/* direction control messages */
78 #define HCI_PROMISCUOUS		(1<<2)	/* listen to all units */
79 
80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb);
81 
82 /* sysctl defaults */
83 int hci_sendspace = HCI_CMD_PKT_SIZE;
84 int hci_recvspace = 4096;
85 
86 /*
87  * Security filter routines for unprivileged users.
88  *	Allow all but a few critical events, and only permit read commands.
89  */
90 
91 static int
92 hci_security_check_opcode(uint16_t opcode)
93 {
94 
95 	switch (opcode) {
96 	/* Link control */
97 	case HCI_CMD_INQUIRY:
98 		return sizeof(hci_inquiry_cp);
99 	case HCI_CMD_REMOTE_NAME_REQ:
100 		return sizeof(hci_remote_name_req_cp);
101 	case HCI_CMD_READ_REMOTE_FEATURES:
102 		return sizeof(hci_read_remote_features_cp);
103 	case HCI_CMD_READ_REMOTE_EXTENDED_FEATURES:
104 		return sizeof(hci_read_remote_extended_features_cp);
105 	case HCI_CMD_READ_REMOTE_VER_INFO:
106 		return sizeof(hci_read_remote_ver_info_cp);
107 	case HCI_CMD_READ_CLOCK_OFFSET:
108 		return sizeof(hci_read_clock_offset_cp);
109 	case HCI_CMD_READ_LMP_HANDLE:
110 		return sizeof(hci_read_lmp_handle_cp);
111 
112 	/* Link policy */
113 	case HCI_CMD_ROLE_DISCOVERY:
114 		return sizeof(hci_role_discovery_cp);
115 	case HCI_CMD_READ_LINK_POLICY_SETTINGS:
116 		return sizeof(hci_read_link_policy_settings_cp);
117 	case HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS:
118 		return 0;	/* No command parameters */
119 
120 	/* Host controller and baseband */
121 	case HCI_CMD_READ_PIN_TYPE:
122 	case HCI_CMD_READ_LOCAL_NAME:
123 	case HCI_CMD_READ_CON_ACCEPT_TIMEOUT:
124 	case HCI_CMD_READ_PAGE_TIMEOUT:
125 	case HCI_CMD_READ_SCAN_ENABLE:
126 	case HCI_CMD_READ_PAGE_SCAN_ACTIVITY:
127 	case HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY:
128 	case HCI_CMD_READ_AUTH_ENABLE:
129 	case HCI_CMD_READ_ENCRYPTION_MODE:
130 	case HCI_CMD_READ_UNIT_CLASS:
131 	case HCI_CMD_READ_VOICE_SETTING:
132 		return 0;	/* No command parameters */
133 	case HCI_CMD_READ_AUTO_FLUSH_TIMEOUT:
134 		return sizeof(hci_read_auto_flush_timeout_cp);
135 	case HCI_CMD_READ_NUM_BROADCAST_RETRANS:
136 	case HCI_CMD_READ_HOLD_MODE_ACTIVITY:
137 		return 0;	/* No command parameters */
138 	case HCI_CMD_READ_XMIT_LEVEL:
139 		return sizeof(hci_read_xmit_level_cp);
140 	case HCI_CMD_READ_SCO_FLOW_CONTROL:
141 		return 0;	/* No command parameters */
142 	case HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT:
143 		return sizeof(hci_read_link_supervision_timeout_cp);
144 	case HCI_CMD_READ_NUM_SUPPORTED_IAC:
145 	case HCI_CMD_READ_IAC_LAP:
146 	case HCI_CMD_READ_PAGE_SCAN_PERIOD:
147 	case HCI_CMD_READ_PAGE_SCAN:
148 	case HCI_CMD_READ_INQUIRY_SCAN_TYPE:
149 	case HCI_CMD_READ_INQUIRY_MODE:
150 	case HCI_CMD_READ_PAGE_SCAN_TYPE:
151 	case HCI_CMD_READ_AFH_ASSESSMENT:
152 		return 0;	/* No command parameters */
153 
154 	/* Informational */
155 	case HCI_CMD_READ_LOCAL_VER:
156 	case HCI_CMD_READ_LOCAL_COMMANDS:
157 	case HCI_CMD_READ_LOCAL_FEATURES:
158 		return 0;	/* No command parameters */
159 	case HCI_CMD_READ_LOCAL_EXTENDED_FEATURES:
160 		return sizeof(hci_read_local_extended_features_cp);
161 	case HCI_CMD_READ_BUFFER_SIZE:
162 	case HCI_CMD_READ_COUNTRY_CODE:
163 	case HCI_CMD_READ_BDADDR:
164 		return 0;	/* No command parameters */
165 
166 	/* Status */
167 	case HCI_CMD_READ_FAILED_CONTACT_CNTR:
168 		return sizeof(hci_read_failed_contact_cntr_cp);
169 	case HCI_CMD_READ_LINK_QUALITY:
170 		return sizeof(hci_read_link_quality_cp);
171 	case HCI_CMD_READ_RSSI:
172 		return sizeof(hci_read_rssi_cp);
173 	case HCI_CMD_READ_AFH_CHANNEL_MAP:
174 		return sizeof(hci_read_afh_channel_map_cp);
175 	case HCI_CMD_READ_CLOCK:
176 		return sizeof(hci_read_clock_cp);
177 
178 	/* Testing */
179 	case HCI_CMD_READ_LOOPBACK_MODE:
180 		return 0;	/* No command parameters */
181 	}
182 
183 	return -1;	/* disallowed */
184 }
185 
186 static int
187 hci_security_check_event(uint8_t event)
188 {
189 
190 	switch (event) {
191 	case HCI_EVENT_RETURN_LINK_KEYS:
192 	case HCI_EVENT_LINK_KEY_NOTIFICATION:
193 	case HCI_EVENT_VENDOR:
194 		return -1;	/* disallowed */
195 	}
196 
197 	return 0;	/* ok */
198 }
199 
200 /*
201  * When command packet reaches the device, we can drop
202  * it from the socket buffer (called from hci_output_acl)
203  */
204 void
205 hci_drop(void *arg)
206 {
207 	struct socket *so = arg;
208 
209 	sbdroprecord(&so->so_snd);
210 	sowwakeup(so);
211 }
212 
213 /*
214  * HCI socket is going away and has some pending packets. We let them
215  * go by design, but remove the context pointer as it will be invalid
216  * and we no longer need to be notified.
217  */
218 static void
219 hci_cmdwait_flush(struct socket *so)
220 {
221 	struct hci_unit *unit;
222 	struct socket *ctx;
223 	struct mbuf *m;
224 
225 	DPRINTF("flushing %p\n", so);
226 
227 	SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) {
228 		m = MBUFQ_FIRST(&unit->hci_cmdwait);
229 		while (m != NULL) {
230 			ctx = M_GETCTX(m, struct socket *);
231 			if (ctx == so)
232 				M_SETCTX(m, NULL);
233 
234 			m = MBUFQ_NEXT(m);
235 		}
236 	}
237 }
238 
239 /*
240  * HCI send packet
241  *     This came from userland, so check it out.
242  */
243 static int
244 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr)
245 {
246 	struct hci_unit *unit;
247 	struct mbuf *m0;
248 	hci_cmd_hdr_t hdr;
249 	int err;
250 
251 	KASSERT(m != NULL);
252 	KASSERT(addr != NULL);
253 
254 	/* wants at least a header to start with */
255 	if (m->m_pkthdr.len < sizeof(hdr)) {
256 		err = EMSGSIZE;
257 		goto bad;
258 	}
259 	m_copydata(m, 0, sizeof(hdr), &hdr);
260 
261 	/* only allows CMD packets to be sent */
262 	if (hdr.type != HCI_CMD_PKT) {
263 		err = EINVAL;
264 		goto bad;
265 	}
266 
267 	/* validates packet length */
268 	if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) {
269 		err = EMSGSIZE;
270 		goto bad;
271 	}
272 
273 	/* security checks for unprivileged users */
274 	if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
275 	    && hci_security_check_opcode(le16toh(hdr.opcode)) != hdr.length) {
276 		err = EPERM;
277 		goto bad;
278 	}
279 
280 	/* finds destination */
281 	unit = hci_unit_lookup(addr);
282 	if (unit == NULL) {
283 		err = ENETDOWN;
284 		goto bad;
285 	}
286 
287 	/* makess a copy for precious to keep */
288 	m0 = m_copypacket(m, M_DONTWAIT);
289 	if (m0 == NULL) {
290 		err = ENOMEM;
291 		goto bad;
292 	}
293 	sbappendrecord(&pcb->hp_socket->so_snd, m0);
294 	M_SETCTX(m, pcb->hp_socket);	/* enable drop callback */
295 
296 	DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", device_xname(unit->hci_dev),
297 		HCI_OGF(le16toh(hdr.opcode)), HCI_OCF(le16toh(hdr.opcode)));
298 
299 	/* Sendss it */
300 	if (unit->hci_num_cmd_pkts == 0)
301 		MBUFQ_ENQUEUE(&unit->hci_cmdwait, m);
302 	else
303 		hci_output_cmd(unit, m);
304 
305 	return 0;
306 
307 bad:
308 	DPRINTF("packet (%d bytes) not sent (error %d)\n",
309 			m->m_pkthdr.len, err);
310 	if (m) m_freem(m);
311 	return err;
312 }
313 
314 /*
315  * User Request.
316  * up is socket
317  * m is either
318  *	optional mbuf chain containing message
319  *	ioctl command (PRU_CONTROL)
320  * nam is either
321  *	optional mbuf chain containing an address
322  *	ioctl data (PRU_CONTROL)
323  *      optionally, protocol number (PRU_ATTACH)
324  * ctl is optional mbuf chain containing socket options
325  * l is pointer to process requesting action (if any)
326  *
327  * we are responsible for disposing of m and ctl if
328  * they are mbuf chains
329  */
330 int
331 hci_usrreq(struct socket *up, int req, struct mbuf *m,
332 		struct mbuf *nam, struct mbuf *ctl, struct lwp *l)
333 {
334 	struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb;
335 	struct sockaddr_bt *sa;
336 	int err = 0;
337 
338 	DPRINTFN(2, "%s\n", prurequests[req]);
339 
340 	switch(req) {
341 	case PRU_CONTROL:
342 		return hci_ioctl((unsigned long)m, (void *)nam, l);
343 
344 	case PRU_PURGEIF:
345 		return EOPNOTSUPP;
346 
347 	case PRU_ATTACH:
348 		if (pcb)
349 			return EINVAL;
350 
351 		err = soreserve(up, hci_sendspace, hci_recvspace);
352 		if (err)
353 			return err;
354 
355 		pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO);
356 		if (pcb == NULL)
357 			return ENOMEM;
358 
359 		up->so_pcb = pcb;
360 		pcb->hp_socket = up;
361 
362 		if (l == NULL || kauth_authorize_generic(l->l_cred,
363 		    KAUTH_GENERIC_ISSUSER, NULL) == 0)
364 			pcb->hp_flags |= HCI_PRIVILEGED;
365 
366 		/*
367 		 * Set default user filter. By default, socket only passes
368 		 * Command_Complete and Command_Status Events.
369 		 */
370 		hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter);
371 		hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter);
372 		hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter);
373 
374 		LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next);
375 
376 		return 0;
377 	}
378 
379 	/* anything after here *requires* a pcb */
380 	if (pcb == NULL) {
381 		err = EINVAL;
382 		goto release;
383 	}
384 
385 	switch(req) {
386 	case PRU_DISCONNECT:
387 		bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY);
388 
389 		/* XXX we cannot call soisdisconnected() here, as it sets
390 		 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being,
391 		 * that soisconnected() does not clear these and if you
392 		 * try to reconnect this socket (which is permitted) you
393 		 * get a broken pipe when you try to write any data.
394 		 */
395 		up->so_state &= ~SS_ISCONNECTED;
396 		break;
397 
398 	case PRU_ABORT:
399 		soisdisconnected(up);
400 		/* fall through to */
401 	case PRU_DETACH:
402 		if (up->so_snd.sb_mb != NULL)
403 			hci_cmdwait_flush(up);
404 
405 		up->so_pcb = NULL;
406 		LIST_REMOVE(pcb, hp_next);
407 		free(pcb, M_PCB);
408 		return 0;
409 
410 	case PRU_BIND:
411 		KASSERT(nam != NULL);
412 		sa = mtod(nam, struct sockaddr_bt *);
413 
414 		if (sa->bt_len != sizeof(struct sockaddr_bt))
415 			return EINVAL;
416 
417 		if (sa->bt_family != AF_BLUETOOTH)
418 			return EAFNOSUPPORT;
419 
420 		bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr);
421 
422 		if (bdaddr_any(&sa->bt_bdaddr))
423 			pcb->hp_flags |= HCI_PROMISCUOUS;
424 		else
425 			pcb->hp_flags &= ~HCI_PROMISCUOUS;
426 
427 		return 0;
428 
429 	case PRU_CONNECT:
430 		KASSERT(nam != NULL);
431 		sa = mtod(nam, struct sockaddr_bt *);
432 
433 		if (sa->bt_len != sizeof(struct sockaddr_bt))
434 			return EINVAL;
435 
436 		if (sa->bt_family != AF_BLUETOOTH)
437 			return EAFNOSUPPORT;
438 
439 		if (hci_unit_lookup(&sa->bt_bdaddr) == NULL)
440 			return EADDRNOTAVAIL;
441 
442 		bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr);
443 		soisconnected(up);
444 		return 0;
445 
446 	case PRU_PEERADDR:
447 		KASSERT(nam != NULL);
448 		sa = mtod(nam, struct sockaddr_bt *);
449 
450 		memset(sa, 0, sizeof(struct sockaddr_bt));
451 		nam->m_len =
452 		sa->bt_len = sizeof(struct sockaddr_bt);
453 		sa->bt_family = AF_BLUETOOTH;
454 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr);
455 		return 0;
456 
457 	case PRU_SOCKADDR:
458 		KASSERT(nam != NULL);
459 		sa = mtod(nam, struct sockaddr_bt *);
460 
461 		memset(sa, 0, sizeof(struct sockaddr_bt));
462 		nam->m_len =
463 		sa->bt_len = sizeof(struct sockaddr_bt);
464 		sa->bt_family = AF_BLUETOOTH;
465 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr);
466 		return 0;
467 
468 	case PRU_SHUTDOWN:
469 		socantsendmore(up);
470 		break;
471 
472 	case PRU_SEND:
473 		sa = NULL;
474 		if (nam) {
475 			sa = mtod(nam, struct sockaddr_bt *);
476 
477 			if (sa->bt_len != sizeof(struct sockaddr_bt)) {
478 				err = EINVAL;
479 				goto release;
480 			}
481 
482 			if (sa->bt_family != AF_BLUETOOTH) {
483 				err = EAFNOSUPPORT;
484 				goto release;
485 			}
486 		}
487 
488 		if (ctl) /* have no use for this */
489 			m_freem(ctl);
490 
491 		return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr));
492 
493 	case PRU_SENSE:
494 		return 0;		/* (no sense - Doh!) */
495 
496 	case PRU_RCVD:
497 	case PRU_RCVOOB:
498 		return EOPNOTSUPP;	/* (no release) */
499 
500 	case PRU_ACCEPT:
501 	case PRU_CONNECT2:
502 	case PRU_LISTEN:
503 	case PRU_SENDOOB:
504 	case PRU_FASTTIMO:
505 	case PRU_SLOWTIMO:
506 	case PRU_PROTORCV:
507 	case PRU_PROTOSEND:
508 		err = EOPNOTSUPP;
509 		break;
510 
511 	default:
512 		UNKNOWN(req);
513 		err = EOPNOTSUPP;
514 		break;
515 	}
516 
517 release:
518 	if (m)
519 		m_freem(m);
520 	if (ctl)
521 		m_freem(ctl);
522 	return err;
523 }
524 
525 /*
526  * get/set socket options
527  */
528 int
529 hci_ctloutput(int req, struct socket *so, int level,
530 		int optname, struct mbuf **opt)
531 {
532 	struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
533 	struct mbuf *m;
534 	int err = 0;
535 
536 	DPRINTFN(2, "req %s\n", prcorequests[req]);
537 
538 	if (pcb == NULL)
539 		return EINVAL;
540 
541 	if (level != BTPROTO_HCI)
542 		return ENOPROTOOPT;
543 
544 	switch(req) {
545 	case PRCO_GETOPT:
546 		m = m_get(M_WAIT, MT_SOOPTS);
547 		switch (optname) {
548 		case SO_HCI_EVT_FILTER:
549 			m->m_len = sizeof(struct hci_filter);
550 			memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len);
551 			break;
552 
553 		case SO_HCI_PKT_FILTER:
554 			m->m_len = sizeof(struct hci_filter);
555 			memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len);
556 			break;
557 
558 		case SO_HCI_DIRECTION:
559 			m->m_len = sizeof(int);
560 			if (pcb->hp_flags & HCI_DIRECTION)
561 				*mtod(m, int *) = 1;
562 			else
563 				*mtod(m, int *) = 0;
564 			break;
565 
566 		default:
567 			err = ENOPROTOOPT;
568 			m_freem(m);
569 			m = NULL;
570 			break;
571 		}
572 		*opt = m;
573 		break;
574 
575 	case PRCO_SETOPT:
576 		m = *opt;
577 		if (m) switch (optname) {
578 		case SO_HCI_EVT_FILTER:	/* set event filter */
579 			m->m_len = min(m->m_len, sizeof(struct hci_filter));
580 			memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len);
581 			break;
582 
583 		case SO_HCI_PKT_FILTER:	/* set packet filter */
584 			m->m_len = min(m->m_len, sizeof(struct hci_filter));
585 			memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len);
586 			break;
587 
588 		case SO_HCI_DIRECTION:	/* request direction ctl messages */
589 			if (*mtod(m, int *))
590 				pcb->hp_flags |= HCI_DIRECTION;
591 			else
592 				pcb->hp_flags &= ~HCI_DIRECTION;
593 			break;
594 
595 		default:
596 			err = ENOPROTOOPT;
597 			break;
598 		}
599 		m_freem(m);
600 		break;
601 
602 	default:
603 		err = ENOPROTOOPT;
604 		break;
605 	}
606 
607 	return err;
608 }
609 
610 /*
611  * HCI mbuf tap routine
612  *
613  * copy packets to any raw HCI sockets that wish (and are
614  * permitted) to see them
615  */
616 void
617 hci_mtap(struct mbuf *m, struct hci_unit *unit)
618 {
619 	struct hci_pcb *pcb;
620 	struct mbuf *m0, *ctlmsg, **ctl;
621 	struct sockaddr_bt sa;
622 	uint8_t type;
623 	uint8_t event;
624 	uint16_t opcode;
625 
626 	KASSERT(m->m_len >= sizeof(type));
627 
628 	type = *mtod(m, uint8_t *);
629 
630 	memset(&sa, 0, sizeof(sa));
631 	sa.bt_len = sizeof(struct sockaddr_bt);
632 	sa.bt_family = AF_BLUETOOTH;
633 	bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr);
634 
635 	LIST_FOREACH(pcb, &hci_pcb, hp_next) {
636 		/*
637 		 * filter according to source address
638 		 */
639 		if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0
640 		    && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0)
641 			continue;
642 
643 		/*
644 		 * filter according to packet type filter
645 		 */
646 		if (hci_filter_test(type, &pcb->hp_pfilter) == 0)
647 			continue;
648 
649 		/*
650 		 * filter according to event/security filters
651 		 */
652 		switch(type) {
653 		case HCI_EVENT_PKT:
654 			KASSERT(m->m_len >= sizeof(hci_event_hdr_t));
655 
656 			event = mtod(m, hci_event_hdr_t *)->event;
657 
658 			if (hci_filter_test(event, &pcb->hp_efilter) == 0)
659 				continue;
660 
661 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
662 			    && hci_security_check_event(event) == -1)
663 				continue;
664 			break;
665 
666 		case HCI_CMD_PKT:
667 			KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t));
668 
669 			opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode);
670 
671 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
672 			    && hci_security_check_opcode(opcode) == -1)
673 				continue;
674 			break;
675 
676 		case HCI_ACL_DATA_PKT:
677 		case HCI_SCO_DATA_PKT:
678 		default:
679 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0)
680 				continue;
681 
682 			break;
683 		}
684 
685 		/*
686 		 * create control messages
687 		 */
688 		ctlmsg = NULL;
689 		ctl = &ctlmsg;
690 		if (pcb->hp_flags & HCI_DIRECTION) {
691 			int dir = m->m_flags & M_LINK0 ? 1 : 0;
692 
693 			*ctl = sbcreatecontrol(&dir, sizeof(dir),
694 			    SCM_HCI_DIRECTION, BTPROTO_HCI);
695 
696 			if (*ctl != NULL)
697 				ctl = &((*ctl)->m_next);
698 		}
699 
700 		/*
701 		 * copy to socket
702 		 */
703 		m0 = m_copypacket(m, M_DONTWAIT);
704 		if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv,
705 				(struct sockaddr *)&sa, m0, ctlmsg)) {
706 			sorwakeup(pcb->hp_socket);
707 		} else {
708 			m_freem(ctlmsg);
709 			m_freem(m0);
710 		}
711 	}
712 }
713