xref: /netbsd-src/sys/netbt/hci_socket.c (revision d48f14661dda8638fee055ba15d35bdfb29b9fa8)
1 /*	$NetBSD: hci_socket.c,v 1.1 2006/06/19 15:44:45 gdamore Exp $	*/
2 
3 /*-
4  * Copyright (c) 2005 Iain Hibbert.
5  * Copyright (c) 2006 Itronix Inc.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The name of Itronix Inc. may not be used to endorse
17  *    or promote products derived from this software without specific
18  *    prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY ITRONIX INC. ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
22  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
23  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL ITRONIX INC. BE LIABLE FOR ANY
24  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
25  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
26  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
27  * ON ANY THEORY OF LIABILITY, WHETHER IN
28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30  * POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __KERNEL_RCSID(0, "$NetBSD: hci_socket.c,v 1.1 2006/06/19 15:44:45 gdamore Exp $");
35 
36 #include "opt_bluetooth.h"
37 #ifdef BLUETOOTH_DEBUG
38 #define PRUREQUESTS
39 #define PRCOREQUESTS
40 #endif
41 
42 #include <sys/param.h>
43 #include <sys/domain.h>
44 #include <sys/kauth.h>
45 #include <sys/kernel.h>
46 #include <sys/mbuf.h>
47 #include <sys/proc.h>
48 #include <sys/protosw.h>
49 #include <sys/socket.h>
50 #include <sys/socketvar.h>
51 #include <sys/systm.h>
52 
53 #include <netbt/bluetooth.h>
54 #include <netbt/hci.h>
55 
56 /*******************************************************************************
57  *
58  * HCI SOCK_RAW Sockets - for control of Bluetooth Devices
59  *
60  */
61 
62 /*
63  * the raw HCI protocol control block
64  */
65 struct hci_pcb {
66 	struct socket		*hp_socket;	/* socket */
67 	unsigned int		hp_flags;	/* flags */
68 	bdaddr_t		hp_laddr;	/* local address */
69 	bdaddr_t		hp_raddr;	/* remote address */
70 	struct hci_filter	hp_efilter;	/* user event filter */
71 	struct hci_filter	hp_pfilter;	/* user packet filter */
72 	LIST_ENTRY(hci_pcb)	hp_next;	/* next HCI pcb */
73 };
74 
75 /* hp_flags */
76 #define HCI_PRIVILEGED		(1<<0)	/* no security filter for root */
77 #define HCI_DIRECTION		(1<<1)	/* direction control messages */
78 #define HCI_PROMISCUOUS		(1<<2)	/* listen to all units */
79 
80 LIST_HEAD(hci_pcb_list, hci_pcb) hci_pcb = LIST_HEAD_INITIALIZER(hci_pcb);
81 
82 /* sysctl defaults */
83 int hci_sendspace = HCI_CMD_PKT_SIZE;
84 int hci_recvspace = 4096;
85 
86 /*
87  * Security filter routines
88  *	The security mask is an bit array.
89  *	If the bit is set, the opcode/event is permitted.
90  *	I only allocate the security mask if needed, and give it back
91  *      if requested as its quite a chunk. This could no doubt be made
92  *	somewhat bit more memory efficient given that most OGF/OCF's are
93  *	not used, but this way is quick.
94  */
95 #define HCI_OPCODE_MASK_SIZE	0x800
96 
97 uint32_t *hci_event_mask = NULL;
98 uint32_t *hci_opcode_mask = NULL;
99 
100 static __inline int
101 hci_security_check_opcode(uint16_t opcode)
102 {
103 
104 	return (hci_opcode_mask[opcode >> 5] & (1 << (opcode & 0x1f)));
105 }
106 
107 static __inline int
108 hci_security_check_event(uint8_t event)
109 {
110 
111 	return (hci_event_mask[event >> 5] & (1 << (event & 0x1f)));
112 }
113 
114 static __inline void
115 hci_security_set_opcode(uint16_t opcode)
116 {
117 
118 	hci_opcode_mask[opcode >> 5] |= (1 << (opcode & 0x1f));
119 }
120 
121 static __inline void
122 hci_security_clr_event(uint8_t event)
123 {
124 
125 	hci_event_mask[event >> 5] &= ~(1 << (event & 0x1f));
126 }
127 
128 static int
129 hci_security_init(void)
130 {
131 
132 	if (hci_event_mask)
133 		return 0;
134 
135 	// XXX could wait?
136 	hci_event_mask = malloc(HCI_EVENT_MASK_SIZE + HCI_OPCODE_MASK_SIZE,
137 				M_BLUETOOTH, M_NOWAIT | M_ZERO);
138 	if (hci_event_mask == NULL) {
139 		DPRINTF("no memory\n");
140 		return ENOMEM;
141 	}
142 
143 	hci_opcode_mask = hci_event_mask + HCI_EVENT_MASK_SIZE;
144 
145 	/* Events */
146 	/* enable all but a few critical events */
147 	memset(hci_event_mask, 0xff,
148 		HCI_EVENT_MASK_SIZE * sizeof(*hci_event_mask));
149 	hci_security_clr_event(HCI_EVENT_RETURN_LINK_KEYS);
150 	hci_security_clr_event(HCI_EVENT_LINK_KEY_NOTIFICATION);
151 	hci_security_clr_event(HCI_EVENT_VENDOR);
152 
153 	/* Commands - Link control */
154 	hci_security_set_opcode(HCI_CMD_INQUIRY);
155 	hci_security_set_opcode(HCI_CMD_REMOTE_NAME_REQ);
156 	hci_security_set_opcode(HCI_CMD_READ_REMOTE_FEATURES);
157 	hci_security_set_opcode(HCI_CMD_READ_REMOTE_EXTENDED_FEATURES);
158 	hci_security_set_opcode(HCI_CMD_READ_REMOTE_VER_INFO);
159 	hci_security_set_opcode(HCI_CMD_READ_CLOCK_OFFSET);
160 	hci_security_set_opcode(HCI_CMD_READ_LMP_HANDLE);
161 
162 	/* Commands - Link policy */
163 	hci_security_set_opcode(HCI_CMD_ROLE_DISCOVERY);
164 	hci_security_set_opcode(HCI_CMD_READ_LINK_POLICY_SETTINGS);
165 	hci_security_set_opcode(HCI_CMD_READ_DEFAULT_LINK_POLICY_SETTINGS);
166 
167 	/* Commands - Host controller and baseband */
168 	hci_security_set_opcode(HCI_CMD_READ_PIN_TYPE);
169 	hci_security_set_opcode(HCI_CMD_READ_LOCAL_NAME);
170 	hci_security_set_opcode(HCI_CMD_READ_CON_ACCEPT_TIMEOUT);
171 	hci_security_set_opcode(HCI_CMD_READ_PAGE_TIMEOUT);
172 	hci_security_set_opcode(HCI_CMD_READ_SCAN_ENABLE);
173 	hci_security_set_opcode(HCI_CMD_READ_PAGE_SCAN_ACTIVITY);
174 	hci_security_set_opcode(HCI_CMD_READ_INQUIRY_SCAN_ACTIVITY);
175 	hci_security_set_opcode(HCI_CMD_READ_AUTH_ENABLE);
176 	hci_security_set_opcode(HCI_CMD_READ_ENCRYPTION_MODE);
177 	hci_security_set_opcode(HCI_CMD_READ_UNIT_CLASS);
178 	hci_security_set_opcode(HCI_CMD_READ_VOICE_SETTING);
179 	hci_security_set_opcode(HCI_CMD_READ_AUTO_FLUSH_TIMEOUT);
180 	hci_security_set_opcode(HCI_CMD_READ_NUM_BROADCAST_RETRANS);
181 	hci_security_set_opcode(HCI_CMD_READ_HOLD_MODE_ACTIVITY);
182 	hci_security_set_opcode(HCI_CMD_READ_XMIT_LEVEL);
183 	hci_security_set_opcode(HCI_CMD_READ_SCO_FLOW_CONTROL);
184 	hci_security_set_opcode(HCI_CMD_READ_LINK_SUPERVISION_TIMEOUT);
185 	hci_security_set_opcode(HCI_CMD_READ_NUM_SUPPORTED_IAC);
186 	hci_security_set_opcode(HCI_CMD_READ_IAC_LAP);
187 	hci_security_set_opcode(HCI_CMD_READ_PAGE_SCAN_PERIOD);
188 	hci_security_set_opcode(HCI_CMD_READ_PAGE_SCAN);
189 	hci_security_set_opcode(HCI_CMD_READ_INQUIRY_SCAN_TYPE);
190 	hci_security_set_opcode(HCI_CMD_READ_INQUIRY_MODE);
191 	hci_security_set_opcode(HCI_CMD_READ_PAGE_SCAN_TYPE);
192 	hci_security_set_opcode(HCI_CMD_READ_AFH_ASSESSMENT);
193 
194 	/* Commands - Informational */
195 	hci_security_set_opcode(HCI_CMD_READ_LOCAL_VER);
196 	hci_security_set_opcode(HCI_CMD_READ_LOCAL_COMMANDS);
197 	hci_security_set_opcode(HCI_CMD_READ_LOCAL_FEATURES);
198 	hci_security_set_opcode(HCI_CMD_READ_LOCAL_EXTENDED_FEATURES);
199 	hci_security_set_opcode(HCI_CMD_READ_BUFFER_SIZE);
200 	hci_security_set_opcode(HCI_CMD_READ_COUNTRY_CODE);
201 	hci_security_set_opcode(HCI_CMD_READ_BDADDR);
202 
203 	/* Commands - Status */
204 	hci_security_set_opcode(HCI_CMD_READ_FAILED_CONTACT_CNTR);
205 	hci_security_set_opcode(HCI_CMD_READ_LINK_QUALITY);
206 	hci_security_set_opcode(HCI_CMD_READ_RSSI);
207 	hci_security_set_opcode(HCI_CMD_READ_AFH_CHANNEL_MAP);
208 	hci_security_set_opcode(HCI_CMD_READ_CLOCK);
209 
210 	/* Commands - Testing */
211 	hci_security_set_opcode(HCI_CMD_READ_LOOPBACK_MODE);
212 
213 	return 0;
214 }
215 
216 /*
217  * When command packet reaches the device, we can drop
218  * it from the socket buffer (called from hci_output_acl)
219  */
220 void
221 hci_drop(void *arg)
222 {
223 	struct socket *so = arg;
224 
225 	sbdroprecord(&so->so_snd);
226 	sowwakeup(so);
227 }
228 
229 /*
230  * HCI socket is going away and has some pending packets. We let them
231  * go by design, but remove the context pointer as it will be invalid
232  * and we no longer need to be notified.
233  */
234 static void
235 hci_cmdwait_flush(struct socket *so)
236 {
237 	struct hci_unit *unit;
238 	struct socket *ctx;
239 	struct mbuf *m;
240 
241 	DPRINTF("flushing %p\n", so);
242 
243 	SIMPLEQ_FOREACH(unit, &hci_unit_list, hci_next) {
244 		m = MBUFQ_FIRST(&unit->hci_cmdwait);
245 		while (m != NULL) {
246 			ctx = M_GETCTX(m, struct socket *);
247 			if (ctx == so)
248 				M_SETCTX(m, NULL);
249 
250 			m = MBUFQ_NEXT(m);
251 		}
252 	}
253 }
254 
255 /*
256  * HCI send packet
257  *     This came from userland, so check it out.
258  */
259 static int
260 hci_send(struct hci_pcb *pcb, struct mbuf *m, bdaddr_t *addr)
261 {
262 	struct hci_unit *unit;
263 	struct mbuf *m0;
264 	hci_cmd_hdr_t hdr;
265 	int err;
266 
267 	KASSERT(m);
268 	KASSERT(addr);
269 
270 	/* wants at least a header to start with */
271 	if (m->m_pkthdr.len < sizeof(hdr)) {
272 		err = EMSGSIZE;
273 		goto bad;
274 	}
275 	m_copydata(m, 0, sizeof(hdr), &hdr);
276 
277 	/* only allows CMD packets to be sent */
278 	if (hdr.type != HCI_CMD_PKT) {
279 		err = EINVAL;
280 		goto bad;
281 	}
282 
283 	/* validates packet length */
284 	if (m->m_pkthdr.len != sizeof(hdr) + hdr.length) {
285 		err = EMSGSIZE;
286 		goto bad;
287 	}
288 
289 	/* security checks for unprivileged users */
290 	if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
291 	    && (hci_security_check_opcode(le16toh(hdr.opcode)) == 0)) {
292 		err = EPERM;
293 		goto bad;
294 	}
295 
296 	/* finds destination */
297 	unit = hci_unit_lookup(addr);
298 	if (unit == NULL) {
299 		err = ENETDOWN;
300 		goto bad;
301 	}
302 
303 	/* makess a copy for precious to keep */
304 	m0 = m_copypacket(m, M_DONTWAIT);
305 	if (m0 == NULL) {
306 		err = ENOMEM;
307 		goto bad;
308 	}
309 	sbappendrecord(&pcb->hp_socket->so_snd, m0);
310 	M_SETCTX(m, pcb->hp_socket);	/* enable drop callback */
311 
312 	DPRINTFN(2, "(%s) opcode (%03x|%04x)\n", unit->hci_devname,
313 		HCI_OGF(le16toh(hdr.opcode)), HCI_OCF(le16toh(hdr.opcode)));
314 
315 	/* Sendss it */
316 	if (unit->hci_num_cmd_pkts == 0)
317 		MBUFQ_ENQUEUE(&unit->hci_cmdwait, m);
318 	else
319 		hci_output_cmd(unit, m);
320 
321 	return 0;
322 
323 bad:
324 	DPRINTF("packet (%d bytes) not sent (error %d)\n",
325 			m->m_pkthdr.len, err);
326 	if (m) m_freem(m);
327 	return err;
328 }
329 
330 /*
331  * User Request.
332  * up is socket
333  * m is either
334  *	optional mbuf chain containing message
335  *	ioctl command (PRU_CONTROL)
336  * nam is either
337  *	optional mbuf chain containing an address
338  *	ioctl data (PRU_CONTROL)
339  *      optionally, protocol number (PRU_ATTACH)
340  * ctl is optional mbuf chain containing socket options
341  * l is pointer to process requesting action (if any)
342  *
343  * we are responsible for disposing of m and ctl if
344  * they are mbuf chains
345  */
346 int
347 hci_usrreq(struct socket *up, int req, struct mbuf *m,
348 		struct mbuf *nam, struct mbuf *ctl, struct lwp *l)
349 {
350 	struct hci_pcb *pcb = (struct hci_pcb *)up->so_pcb;
351 	struct sockaddr_bt *sa;
352 	struct proc *p;
353 	int err = 0, flags;
354 
355 	DPRINTFN(2, "%s\n", prurequests[req]);
356 
357 	p = (l == NULL) ? NULL : l->l_proc;
358 
359 	switch(req) {
360 	case PRU_CONTROL:
361 		return hci_ioctl((unsigned long)m, (void *)nam, p);
362 
363 	case PRU_PURGEIF:
364 		return EOPNOTSUPP;
365 
366 	case PRU_ATTACH:
367 		if (pcb)
368 			return EINVAL;
369 
370 		flags = 0;
371 		if (p != NULL && kauth_authorize_generic(p->p_cred,
372 					    KAUTH_GENERIC_ISSUSER,
373 					    &p->p_acflag)) {
374 			err = hci_security_init();
375 			if (err)
376 				return err;
377 		} else {
378 			flags = HCI_PRIVILEGED;
379 		}
380 
381 		err = soreserve(up, hci_sendspace, hci_recvspace);
382 		if (err)
383 			return err;
384 
385 		pcb = malloc(sizeof(struct hci_pcb), M_PCB, M_NOWAIT | M_ZERO);
386 		if (pcb == NULL)
387 			return ENOMEM;
388 
389 		up->so_pcb = pcb;
390 		pcb->hp_socket = up;
391 		pcb->hp_flags = flags;
392 
393 		/*
394 		 * Set default user filter. By default, socket only passes
395 		 * Command_Complete and Command_Status Events.
396 		 */
397 		hci_filter_set(HCI_EVENT_COMMAND_COMPL, &pcb->hp_efilter);
398 		hci_filter_set(HCI_EVENT_COMMAND_STATUS, &pcb->hp_efilter);
399 		hci_filter_set(HCI_EVENT_PKT, &pcb->hp_pfilter);
400 
401 		LIST_INSERT_HEAD(&hci_pcb, pcb, hp_next);
402 
403 		return 0;
404 	}
405 
406 	/* anything after here *requires* a pcb */
407 	if (pcb == NULL) {
408 		err = EINVAL;
409 		goto release;
410 	}
411 
412 	switch(req) {
413 	case PRU_DISCONNECT:
414 		bdaddr_copy(&pcb->hp_raddr, BDADDR_ANY);
415 
416 		/* XXX we cannot call soisdisconnected() here, as it sets
417 		 * SS_CANTRCVMORE and SS_CANTSENDMORE. The problem being,
418 		 * that soisconnected() does not clear these and if you
419 		 * try to reconnect this socket (which is permitted) you
420 		 * get a broken pipe when you try to write any data.
421 		 */
422 		up->so_state &= ~SS_ISCONNECTED;
423 		break;
424 
425 	case PRU_ABORT:
426 		soisdisconnected(up);
427 		/* fall through to */
428 	case PRU_DETACH:
429 		if (up->so_snd.sb_mb != NULL)
430 			hci_cmdwait_flush(up);
431 
432 		up->so_pcb = NULL;
433 		LIST_REMOVE(pcb, hp_next);
434 		free(pcb, M_PCB);
435 		return 0;
436 
437 	case PRU_BIND:
438 		KASSERT(nam);
439 		sa = mtod(nam, struct sockaddr_bt *);
440 
441 		if (sa->bt_len != sizeof(struct sockaddr_bt))
442 			return EINVAL;
443 
444 		if (sa->bt_family != AF_BLUETOOTH)
445 			return EAFNOSUPPORT;
446 
447 		bdaddr_copy(&pcb->hp_laddr, &sa->bt_bdaddr);
448 
449 		if (bdaddr_any(&sa->bt_bdaddr))
450 			pcb->hp_flags |= HCI_PROMISCUOUS;
451 		else
452 			pcb->hp_flags &= ~HCI_PROMISCUOUS;
453 
454 		return 0;
455 
456 	case PRU_CONNECT:
457 		KASSERT(nam);
458 		sa = mtod(nam, struct sockaddr_bt *);
459 
460 		if (sa->bt_len != sizeof(struct sockaddr_bt))
461 			return EINVAL;
462 
463 		if (sa->bt_family != AF_BLUETOOTH)
464 			return EAFNOSUPPORT;
465 
466 		if (hci_unit_lookup(&sa->bt_bdaddr) == NULL)
467 			return EADDRNOTAVAIL;
468 
469 		bdaddr_copy(&pcb->hp_raddr, &sa->bt_bdaddr);
470 		soisconnected(up);
471 		return 0;
472 
473 	case PRU_PEERADDR:
474 		KASSERT(nam);
475 		sa = mtod(nam, struct sockaddr_bt *);
476 
477 		memset(sa, 0, sizeof(struct sockaddr_bt));
478 		nam->m_len =
479 		sa->bt_len = sizeof(struct sockaddr_bt);
480 		sa->bt_family = AF_BLUETOOTH;
481 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_raddr);
482 		return 0;
483 
484 	case PRU_SOCKADDR:
485 		KASSERT(nam);
486 		sa = mtod(nam, struct sockaddr_bt *);
487 
488 		memset(sa, 0, sizeof(struct sockaddr_bt));
489 		nam->m_len =
490 		sa->bt_len = sizeof(struct sockaddr_bt);
491 		sa->bt_family = AF_BLUETOOTH;
492 		bdaddr_copy(&sa->bt_bdaddr, &pcb->hp_laddr);
493 		return 0;
494 
495 	case PRU_SHUTDOWN:
496 		socantsendmore(up);
497 		break;
498 
499 	case PRU_SEND:
500 		sa = NULL;
501 		if (nam) {
502 			sa = mtod(nam, struct sockaddr_bt *);
503 
504 			if (sa->bt_len != sizeof(struct sockaddr_bt)) {
505 				err = EINVAL;
506 				goto release;
507 			}
508 
509 			if (sa->bt_family != AF_BLUETOOTH) {
510 				err = EAFNOSUPPORT;
511 				goto release;
512 			}
513 		}
514 
515 		if (ctl) /* have no use for this */
516 			m_freem(ctl);
517 
518 		return hci_send(pcb, m, (sa ? &sa->bt_bdaddr : &pcb->hp_raddr));
519 
520 	case PRU_SENSE:
521 		return 0;		/* (no sense - Doh!) */
522 
523 	case PRU_RCVD:
524 	case PRU_RCVOOB:
525 		return EOPNOTSUPP;	/* (no release) */
526 
527 	case PRU_ACCEPT:
528 	case PRU_CONNECT2:
529 	case PRU_LISTEN:
530 	case PRU_SENDOOB:
531 	case PRU_FASTTIMO:
532 	case PRU_SLOWTIMO:
533 	case PRU_PROTORCV:
534 	case PRU_PROTOSEND:
535 		err = EOPNOTSUPP;
536 		break;
537 
538 	default:
539 		UNKNOWN(req);
540 		err = EOPNOTSUPP;
541 		break;
542 	}
543 
544 release:
545 	if (m) m_freem(m);
546 	if (ctl) m_freem(ctl);
547 	return err;
548 }
549 
550 /*
551  * System is short on memory.
552  */
553 void
554 hci_drain(void)
555 {
556 
557 	/*
558 	 * We can give the security masks back, if there
559 	 * are no unprivileged sockets in operation..
560 	 */
561 	if (hci_event_mask) {
562 		struct hci_pcb *pcb;
563 
564 		LIST_FOREACH(pcb, &hci_pcb, hp_next) {
565 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0)
566 				break;
567 		}
568 
569 		if (pcb == NULL) {
570 			free(hci_event_mask, M_BLUETOOTH);
571 			hci_event_mask = NULL;
572 			hci_opcode_mask = NULL;
573 		}
574 	}
575 }
576 
577 /*
578  * get/set socket options
579  */
580 int
581 hci_ctloutput(int req, struct socket *so, int level,
582 		int optname, struct mbuf **opt)
583 {
584 	struct hci_pcb *pcb = (struct hci_pcb *)so->so_pcb;
585 	struct mbuf *m;
586 	int err = 0;
587 
588 	DPRINTFN(2, "req %s\n", prcorequests[req]);
589 
590 	if (pcb == NULL)
591 		return EINVAL;
592 
593 	if (level != BTPROTO_HCI)
594 		return 0;
595 
596 	switch(req) {
597 	case PRCO_GETOPT:
598 		m = m_get(M_WAIT, MT_SOOPTS);
599 		switch (optname) {
600 		case SO_HCI_EVT_FILTER:
601 			m->m_len = sizeof(struct hci_filter);
602 			memcpy(mtod(m, void *), &pcb->hp_efilter, m->m_len);
603 			break;
604 
605 		case SO_HCI_PKT_FILTER:
606 			m->m_len = sizeof(struct hci_filter);
607 			memcpy(mtod(m, void *), &pcb->hp_pfilter, m->m_len);
608 			break;
609 
610 		case SO_HCI_DIRECTION:
611 			m->m_len = sizeof(int);
612 			if (pcb->hp_flags & HCI_DIRECTION)
613 				*mtod(m, int *) = 1;
614 			else
615 				*mtod(m, int *) = 0;
616 			break;
617 
618 		default:
619 			err = EINVAL;
620 			m_freem(m);
621 			m = NULL;
622 			break;
623 		}
624 		*opt = m;
625 		break;
626 
627 	case PRCO_SETOPT:
628 		m = *opt;
629 		if (m) switch (optname) {
630 		case SO_HCI_EVT_FILTER:	/* set event filter */
631 			m->m_len = min(m->m_len, sizeof(struct hci_filter));
632 			memcpy(&pcb->hp_efilter, mtod(m, void *), m->m_len);
633 			break;
634 
635 		case SO_HCI_PKT_FILTER:	/* set packet filter */
636 			m->m_len = min(m->m_len, sizeof(struct hci_filter));
637 			memcpy(&pcb->hp_pfilter, mtod(m, void *), m->m_len);
638 			break;
639 
640 		case SO_HCI_DIRECTION:	/* request direction ctl messages */
641 			if (*mtod(m, int *))
642 				pcb->hp_flags |= HCI_DIRECTION;
643 			else
644 				pcb->hp_flags &= ~HCI_DIRECTION;
645 			break;
646 
647 		default:
648 			err = EINVAL;
649 			break;
650 		}
651 		m_freem(m);
652 		break;
653 
654 	default:
655 		err = EINVAL;
656 		break;
657 	}
658 
659 	return err;
660 }
661 
662 /*
663  * HCI mbuf tap routine
664  *
665  * copy packets to any raw HCI sockets that wish (and are
666  * permitted) to see them
667  */
668 void
669 hci_mtap(struct mbuf *m, struct hci_unit *unit)
670 {
671 	struct hci_pcb *pcb;
672 	struct mbuf *m0, *ctlmsg, **ctl;
673 	struct sockaddr_bt sa;
674 	uint8_t type;
675 	uint8_t event;
676 	uint16_t opcode;
677 
678 	KASSERT(m->m_len >= sizeof(type));
679 
680 	type = *mtod(m, uint8_t *);
681 
682 	memset(&sa, 0, sizeof(sa));
683 	sa.bt_len = sizeof(struct sockaddr_bt);
684 	sa.bt_family = AF_BLUETOOTH;
685 	bdaddr_copy(&sa.bt_bdaddr, &unit->hci_bdaddr);
686 
687 	LIST_FOREACH(pcb, &hci_pcb, hp_next) {
688 		/*
689 		 * filter according to source address
690 		 */
691 		if ((pcb->hp_flags & HCI_PROMISCUOUS) == 0
692 		    && bdaddr_same(&pcb->hp_laddr, &sa.bt_bdaddr) == 0)
693 			continue;
694 
695 		/*
696 		 * filter according to packet type filter
697 		 */
698 		if (hci_filter_test(type, &pcb->hp_pfilter) == 0)
699 			continue;
700 
701 		/*
702 		 * filter according to event/security filters
703 		 */
704 		switch(type) {
705 		case HCI_EVENT_PKT:
706 			KASSERT(m->m_len >= sizeof(hci_event_hdr_t));
707 
708 			event = mtod(m, hci_event_hdr_t *)->event;
709 
710 			if (hci_filter_test(event, &pcb->hp_efilter) == 0)
711 				continue;
712 
713 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
714 			    && hci_security_check_event(event) == 0)
715 				continue;
716 			break;
717 
718 		case HCI_CMD_PKT:
719 			KASSERT(m->m_len >= sizeof(hci_cmd_hdr_t));
720 
721 			opcode = le16toh(mtod(m, hci_cmd_hdr_t *)->opcode);
722 
723 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0
724 			    && hci_security_check_opcode(opcode) == 0)
725 				continue;
726 			break;
727 
728 		case HCI_ACL_DATA_PKT:
729 		case HCI_SCO_DATA_PKT:
730 		default:
731 			if ((pcb->hp_flags & HCI_PRIVILEGED) == 0)
732 				continue;
733 
734 			break;
735 		}
736 
737 		/*
738 		 * create control messages
739 		 */
740 		ctlmsg = NULL;
741 		ctl = &ctlmsg;
742 		if (pcb->hp_flags & HCI_DIRECTION) {
743 			int dir = m->m_flags & M_LINK0 ? 1 : 0;
744 
745 			*ctl = sbcreatecontrol((caddr_t)&dir, sizeof(dir),
746 			    SCM_HCI_DIRECTION, BTPROTO_HCI);
747 
748 			if (*ctl != NULL)
749 				ctl = &((*ctl)->m_next);
750 		}
751 
752 		/*
753 		 * copy to socket
754 		 */
755 		m0 = m_copypacket(m, M_DONTWAIT);
756 		if (m0 && sbappendaddr(&pcb->hp_socket->so_rcv,
757 				(struct sockaddr *)&sa, m0, ctlmsg)) {
758 			sorwakeup(pcb->hp_socket);
759 		} else {
760 			m_freem(ctlmsg);
761 			m_freem(m0);
762 		}
763 	}
764 }
765