]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/blob - sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c
Update nvi to 2.2.0-05ed8b9
[FreeBSD/FreeBSD.git] / sys / netgraph / bluetooth / socket / ng_btsocket_hci_raw.c
1 /*
2  * ng_btsocket_hci_raw.c
3  */
4
5 /*-
6  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
7  *
8  * Copyright (c) 2001-2002 Maksim Yevmenkin <m_evmenkin@yahoo.com>
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  * $Id: ng_btsocket_hci_raw.c,v 1.14 2003/09/14 23:29:06 max Exp $
33  * $FreeBSD$
34  */
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/bitstring.h>
39 #include <sys/domain.h>
40 #include <sys/endian.h>
41 #include <sys/errno.h>
42 #include <sys/filedesc.h>
43 #include <sys/ioccom.h>
44 #include <sys/kernel.h>
45 #include <sys/lock.h>
46 #include <sys/malloc.h>
47 #include <sys/mbuf.h>
48 #include <sys/mutex.h>
49 #include <sys/priv.h>
50 #include <sys/protosw.h>
51 #include <sys/queue.h>
52 #include <sys/socket.h>
53 #include <sys/socketvar.h>
54 #include <sys/sysctl.h>
55 #include <sys/taskqueue.h>
56
57 #include <net/vnet.h>
58
59 #include <netgraph/ng_message.h>
60 #include <netgraph/netgraph.h>
61 #include <netgraph/bluetooth/include/ng_bluetooth.h>
62 #include <netgraph/bluetooth/include/ng_hci.h>
63 #include <netgraph/bluetooth/include/ng_l2cap.h>
64 #include <netgraph/bluetooth/include/ng_btsocket.h>
65 #include <netgraph/bluetooth/include/ng_btsocket_hci_raw.h>
66
67 /* MALLOC define */
68 #ifdef NG_SEPARATE_MALLOC
69 static MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_HCI_RAW, "netgraph_btsocks_hci_raw",
70         "Netgraph Bluetooth raw HCI sockets");
71 #else
72 #define M_NETGRAPH_BTSOCKET_HCI_RAW M_NETGRAPH
73 #endif /* NG_SEPARATE_MALLOC */
74
75 /* Netgraph node methods */
76 static ng_constructor_t ng_btsocket_hci_raw_node_constructor;
77 static ng_rcvmsg_t      ng_btsocket_hci_raw_node_rcvmsg;
78 static ng_shutdown_t    ng_btsocket_hci_raw_node_shutdown;
79 static ng_newhook_t     ng_btsocket_hci_raw_node_newhook;
80 static ng_connect_t     ng_btsocket_hci_raw_node_connect;
81 static ng_rcvdata_t     ng_btsocket_hci_raw_node_rcvdata;
82 static ng_disconnect_t  ng_btsocket_hci_raw_node_disconnect;
83
84 static void             ng_btsocket_hci_raw_input (void *, int);
85 static void             ng_btsocket_hci_raw_output(node_p, hook_p, void *, int);
86 static void             ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p, 
87                                                    struct mbuf **,
88                                                    struct mbuf *); 
89 static int              ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p,
90                                                    struct mbuf *, int);
91
92 #define ng_btsocket_hci_raw_wakeup_input_task() \
93         taskqueue_enqueue(taskqueue_swi, &ng_btsocket_hci_raw_task)
94
95 /* Security filter */
96 struct ng_btsocket_hci_raw_sec_filter {
97         bitstr_t        bit_decl(events, 0xff);
98         bitstr_t        bit_decl(commands[0x3f], 0x3ff);
99 };
100
101 /* Netgraph type descriptor */
102 static struct ng_type typestruct = {
103         .version =      NG_ABI_VERSION,
104         .name =         NG_BTSOCKET_HCI_RAW_NODE_TYPE,
105         .constructor =  ng_btsocket_hci_raw_node_constructor,
106         .rcvmsg =       ng_btsocket_hci_raw_node_rcvmsg,
107         .shutdown =     ng_btsocket_hci_raw_node_shutdown,
108         .newhook =      ng_btsocket_hci_raw_node_newhook,
109         .connect =      ng_btsocket_hci_raw_node_connect,
110         .rcvdata =      ng_btsocket_hci_raw_node_rcvdata,
111         .disconnect =   ng_btsocket_hci_raw_node_disconnect,
112 };
113
114 /* Globals */
115 static u_int32_t                                ng_btsocket_hci_raw_debug_level;
116 static u_int32_t                                ng_btsocket_hci_raw_ioctl_timeout;
117 static node_p                                   ng_btsocket_hci_raw_node;
118 static struct ng_bt_itemq                       ng_btsocket_hci_raw_queue;
119 static struct mtx                               ng_btsocket_hci_raw_queue_mtx;
120 static struct task                              ng_btsocket_hci_raw_task;
121 static LIST_HEAD(, ng_btsocket_hci_raw_pcb)     ng_btsocket_hci_raw_sockets;
122 static struct mtx                               ng_btsocket_hci_raw_sockets_mtx;
123 static u_int32_t                                ng_btsocket_hci_raw_token;
124 static struct mtx                               ng_btsocket_hci_raw_token_mtx;
125 static struct ng_btsocket_hci_raw_sec_filter    *ng_btsocket_hci_raw_sec_filter;
126 static struct timeval                           ng_btsocket_hci_raw_lasttime;
127 static int                                      ng_btsocket_hci_raw_curpps;
128
129 /* Sysctl tree */
130 SYSCTL_DECL(_net_bluetooth_hci_sockets);
131 static SYSCTL_NODE(_net_bluetooth_hci_sockets, OID_AUTO, raw,
132     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
133     "Bluetooth raw HCI sockets family");
134 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, debug_level, CTLFLAG_RW,
135         &ng_btsocket_hci_raw_debug_level, NG_BTSOCKET_WARN_LEVEL,
136         "Bluetooth raw HCI sockets debug level");
137 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, ioctl_timeout, CTLFLAG_RW,
138         &ng_btsocket_hci_raw_ioctl_timeout, 5,
139         "Bluetooth raw HCI sockets ioctl timeout");
140 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_len, CTLFLAG_RD,
141         &ng_btsocket_hci_raw_queue.len, 0,
142         "Bluetooth raw HCI sockets input queue length");
143 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_maxlen, CTLFLAG_RD,
144         &ng_btsocket_hci_raw_queue.maxlen, 0,
145         "Bluetooth raw HCI sockets input queue max. length");
146 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_drops, CTLFLAG_RD,
147         &ng_btsocket_hci_raw_queue.drops, 0,
148         "Bluetooth raw HCI sockets input queue drops");
149
150 /* Debug */
151 #define NG_BTSOCKET_HCI_RAW_INFO \
152         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_INFO_LEVEL && \
153             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
154                 printf
155
156 #define NG_BTSOCKET_HCI_RAW_WARN \
157         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_WARN_LEVEL && \
158             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
159                 printf
160
161 #define NG_BTSOCKET_HCI_RAW_ERR \
162         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ERR_LEVEL && \
163             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
164                 printf
165
166 #define NG_BTSOCKET_HCI_RAW_ALERT \
167         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ALERT_LEVEL && \
168             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
169                 printf
170
171 /****************************************************************************
172  ****************************************************************************
173  **                          Netgraph specific
174  ****************************************************************************
175  ****************************************************************************/
176
177 /*
178  * Netgraph node constructor. Do not allow to create node of this type.
179  */
180
181 static int
182 ng_btsocket_hci_raw_node_constructor(node_p node)
183 {
184         return (EINVAL);
185 } /* ng_btsocket_hci_raw_node_constructor */
186
187 /*
188  * Netgraph node destructor. Just let old node go and create new fresh one.
189  */
190
191 static int
192 ng_btsocket_hci_raw_node_shutdown(node_p node)
193 {
194         int     error = 0;
195
196         NG_NODE_UNREF(node);
197
198         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
199         if (error  != 0) {
200                 NG_BTSOCKET_HCI_RAW_ALERT(
201 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
202
203                 ng_btsocket_hci_raw_node = NULL;
204
205                 return (ENOMEM);
206         }
207
208         error = ng_name_node(ng_btsocket_hci_raw_node,
209                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
210         if (error != 0) {
211                 NG_BTSOCKET_HCI_RAW_ALERT(
212 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
213
214                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
215                 ng_btsocket_hci_raw_node = NULL;
216
217                 return (EINVAL);
218         }
219
220         return (0);
221 } /* ng_btsocket_hci_raw_node_shutdown */
222
223 /*
224  * Create new hook. Just say "yes"
225  */
226
227 static int
228 ng_btsocket_hci_raw_node_newhook(node_p node, hook_p hook, char const *name)
229 {
230         return (0);
231 } /* ng_btsocket_hci_raw_node_newhook */
232
233 /*
234  * Connect hook. Just say "yes"
235  */
236
237 static int
238 ng_btsocket_hci_raw_node_connect(hook_p hook)
239 {
240         return (0);
241 } /* ng_btsocket_hci_raw_node_connect */
242
243 /*
244  * Disconnect hook
245  */
246
247 static int
248 ng_btsocket_hci_raw_node_disconnect(hook_p hook)
249 {
250         return (0);
251 } /* ng_btsocket_hci_raw_node_disconnect */
252
253 /*
254  * Receive control message.
255  * Make sure it is a message from HCI node and it is a response.
256  * Enqueue item and schedule input task.
257  */
258
259 static int
260 ng_btsocket_hci_raw_node_rcvmsg(node_p node, item_p item, hook_p lasthook) 
261 {
262         struct ng_mesg  *msg = NGI_MSG(item); /* item still has message */
263         int              error = 0;
264
265         /*
266          * Check for empty sockets list creates LOR when both sender and
267          * receiver device are connected to the same host, so remove it
268          * for now
269          */
270
271         if (msg != NULL &&
272             (msg->header.typecookie == NGM_HCI_COOKIE ||
273              msg->header.typecookie == NGM_GENERIC_COOKIE) &&
274             msg->header.flags & NGF_RESP) {
275                 if (msg->header.token == 0) {
276                         NG_FREE_ITEM(item);
277                         return (0);
278                 }
279
280                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
281                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
282                         NG_BTSOCKET_HCI_RAW_ERR(
283 "%s: Input queue is full\n", __func__);
284
285                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
286                         NG_FREE_ITEM(item);
287                         error = ENOBUFS;
288                 } else {
289                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
290                         error = ng_btsocket_hci_raw_wakeup_input_task();
291                 }
292                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
293         } else {
294                 NG_FREE_ITEM(item);
295                 error = EINVAL;
296         }
297
298         return (error);
299 } /* ng_btsocket_hci_raw_node_rcvmsg */
300
301 /*
302  * Receive packet from the one of our hook.
303  * Prepend every packet with sockaddr_hci and record sender's node name.
304  * Enqueue item and schedule input task.
305  */
306
307 static int
308 ng_btsocket_hci_raw_node_rcvdata(hook_p hook, item_p item)
309 {
310         struct mbuf     *nam = NULL;
311         int              error;
312
313         /*
314          * Check for empty sockets list creates LOR when both sender and
315          * receiver device are connected to the same host, so remove it
316          * for now
317          */
318
319         MGET(nam, M_NOWAIT, MT_SONAME);
320         if (nam != NULL) {
321                 struct sockaddr_hci     *sa = mtod(nam, struct sockaddr_hci *);
322
323                 nam->m_len = sizeof(struct sockaddr_hci);
324
325                 sa->hci_len = sizeof(*sa);
326                 sa->hci_family = AF_BLUETOOTH;
327                 strlcpy(sa->hci_node, NG_PEER_NODE_NAME(hook),
328                         sizeof(sa->hci_node));
329
330                 NGI_GET_M(item, nam->m_next);
331                 NGI_M(item) = nam;
332
333                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
334                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
335                         NG_BTSOCKET_HCI_RAW_ERR(
336 "%s: Input queue is full\n", __func__);
337
338                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
339                         NG_FREE_ITEM(item);
340                         error = ENOBUFS;
341                 } else {
342                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
343                         error = ng_btsocket_hci_raw_wakeup_input_task();
344                 }
345                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
346         } else {
347                 NG_BTSOCKET_HCI_RAW_ERR(
348 "%s: Failed to allocate address mbuf\n", __func__);
349
350                 NG_FREE_ITEM(item);
351                 error = ENOBUFS;
352         }
353
354         return (error);
355 } /* ng_btsocket_hci_raw_node_rcvdata */
356
357 /****************************************************************************
358  ****************************************************************************
359  **                              Sockets specific
360  ****************************************************************************
361  ****************************************************************************/
362
363 /*
364  * Get next token. We need token to avoid theoretical race where process
365  * submits ioctl() message then interrupts ioctl() and re-submits another
366  * ioctl() on the same socket *before* first ioctl() complete.
367  */
368
369 static void
370 ng_btsocket_hci_raw_get_token(u_int32_t *token)
371 {
372         mtx_lock(&ng_btsocket_hci_raw_token_mtx);
373   
374         if (++ ng_btsocket_hci_raw_token == 0)
375                 ng_btsocket_hci_raw_token = 1;
376
377         *token = ng_btsocket_hci_raw_token;
378
379         mtx_unlock(&ng_btsocket_hci_raw_token_mtx);
380 } /* ng_btsocket_hci_raw_get_token */
381
382 /*
383  * Send Netgraph message to the node - do not expect reply
384  */
385
386 static int
387 ng_btsocket_hci_raw_send_ngmsg(char *path, int cmd, void *arg, int arglen)
388 {
389         struct ng_mesg  *msg = NULL;
390         int              error = 0;
391
392         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, arglen, M_NOWAIT);
393         if (msg == NULL)
394                 return (ENOMEM);
395
396         if (arg != NULL && arglen > 0)
397                 bcopy(arg, msg->data, arglen);
398
399         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
400
401         return (error);
402 } /* ng_btsocket_hci_raw_send_ngmsg */
403
404 /*
405  * Send Netgraph message to the node (no data) and wait for reply 
406  */
407
408 static int
409 ng_btsocket_hci_raw_send_sync_ngmsg(ng_btsocket_hci_raw_pcb_p pcb, char *path,
410                 int cmd, void *rsp, int rsplen)
411 {
412         struct ng_mesg  *msg = NULL;
413         int              error = 0;
414
415         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
416
417         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, 0, M_NOWAIT);
418         if (msg == NULL)
419                 return (ENOMEM);
420
421         ng_btsocket_hci_raw_get_token(&msg->header.token);
422         pcb->token = msg->header.token;
423         pcb->msg = NULL;
424
425         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
426         if (error != 0) {
427                 pcb->token = 0;
428                 return (error);
429         }
430
431         error = msleep(&pcb->msg, &pcb->pcb_mtx, PZERO|PCATCH, "hcictl", 
432                         ng_btsocket_hci_raw_ioctl_timeout * hz);
433         pcb->token = 0;
434
435         if (error != 0)
436                 return (error);
437
438         if (pcb->msg != NULL && pcb->msg->header.cmd == cmd)
439                 bcopy(pcb->msg->data, rsp, rsplen);
440         else
441                 error = EINVAL;
442
443         NG_FREE_MSG(pcb->msg); /* checks for != NULL */
444
445         return (0);
446 } /* ng_btsocket_hci_raw_send_sync_ngmsg */
447
448 /*
449  * Create control information for the packet
450  */
451
452 static void
453 ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf **ctl,
454                 struct mbuf *m) 
455 {
456         int             dir;
457         struct timeval  tv;
458
459         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
460
461         if (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION) {
462                 dir = (m->m_flags & M_PROTO1)? 1 : 0;
463                 *ctl = sbcreatecontrol((caddr_t) &dir, sizeof(dir),
464                                         SCM_HCI_RAW_DIRECTION, SOL_HCI_RAW);
465                 if (*ctl != NULL)
466                         ctl = &((*ctl)->m_next);
467         }
468
469         if (pcb->so->so_options & SO_TIMESTAMP) {
470                 microtime(&tv);
471                 *ctl = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
472                                         SCM_TIMESTAMP, SOL_SOCKET);
473                 if (*ctl != NULL)
474                         ctl = &((*ctl)->m_next);
475         }
476 } /* ng_btsocket_hci_raw_savctl */
477
478 /*
479  * Raw HCI sockets data input routine
480  */
481
482 static void
483 ng_btsocket_hci_raw_data_input(struct mbuf *nam)
484 {
485         ng_btsocket_hci_raw_pcb_p        pcb = NULL;
486         struct mbuf                     *m0 = NULL, *m = NULL;
487         struct sockaddr_hci             *sa = NULL;
488
489         m0 = nam->m_next;
490         nam->m_next = NULL;
491
492         KASSERT((nam->m_type == MT_SONAME),
493                 ("%s: m_type=%d\n", __func__, nam->m_type));
494         KASSERT((m0->m_flags & M_PKTHDR),
495                 ("%s: m_flags=%#x\n", __func__, m0->m_flags));
496
497         sa = mtod(nam, struct sockaddr_hci *);
498
499         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
500
501         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
502                 mtx_lock(&pcb->pcb_mtx);
503
504                 /*
505                  * If socket was bound then check address and
506                  *  make sure it matches.
507                  */
508
509                 if (pcb->addr.hci_node[0] != 0 &&
510                     strcmp(sa->hci_node, pcb->addr.hci_node) != 0)
511                         goto next;
512
513                 /*
514                  * Check packet against filters
515                  * XXX do we have to call m_pullup() here?
516                  */
517
518                 if (ng_btsocket_hci_raw_filter(pcb, m0, 1) != 0)
519                         goto next;
520
521                 /*
522                  * Make a copy of the packet, append to the socket's
523                  * receive queue and wakeup socket. sbappendaddr()
524                  * will check if socket has enough buffer space.
525                  */
526
527                 m = m_dup(m0, M_NOWAIT);
528                 if (m != NULL) {
529                         struct mbuf     *ctl = NULL;
530
531                         ng_btsocket_hci_raw_savctl(pcb, &ctl, m);
532
533                         if (sbappendaddr(&pcb->so->so_rcv, 
534                                         (struct sockaddr *) sa, m, ctl))
535                                 sorwakeup(pcb->so);
536                         else {
537                                 NG_BTSOCKET_HCI_RAW_INFO(
538 "%s: sbappendaddr() failed\n", __func__);
539
540                                 NG_FREE_M(m);
541                                 NG_FREE_M(ctl);
542                         }
543                 }
544 next:
545                 mtx_unlock(&pcb->pcb_mtx);
546         }
547
548         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
549
550         NG_FREE_M(nam);
551         NG_FREE_M(m0);
552 } /* ng_btsocket_hci_raw_data_input */ 
553
554 /*
555  * Raw HCI sockets message input routine
556  */
557
558 static void
559 ng_btsocket_hci_raw_msg_input(struct ng_mesg *msg)
560 {
561         ng_btsocket_hci_raw_pcb_p       pcb = NULL;
562
563         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
564
565         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
566                 mtx_lock(&pcb->pcb_mtx);
567
568                 if (msg->header.token == pcb->token) {
569                         pcb->msg = msg;
570                         wakeup(&pcb->msg);
571
572                         mtx_unlock(&pcb->pcb_mtx);
573                         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
574
575                         return;
576                 }
577
578                 mtx_unlock(&pcb->pcb_mtx);
579         }
580
581         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
582
583         NG_FREE_MSG(msg); /* checks for != NULL */
584 } /* ng_btsocket_hci_raw_msg_input */
585
586 /*
587  * Raw HCI sockets input routines
588  */
589
590 static void
591 ng_btsocket_hci_raw_input(void *context, int pending)
592 {
593         item_p  item = NULL;
594
595         for (;;) {
596                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
597                 NG_BT_ITEMQ_DEQUEUE(&ng_btsocket_hci_raw_queue, item);
598                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
599
600                 if (item == NULL)
601                         break;
602
603                 switch(item->el_flags & NGQF_TYPE) {
604                 case NGQF_DATA: {
605                         struct mbuf     *m = NULL;
606
607                         NGI_GET_M(item, m);
608                         ng_btsocket_hci_raw_data_input(m);
609                         } break;
610
611                 case NGQF_MESG: {
612                         struct ng_mesg  *msg = NULL;
613
614                         NGI_GET_MSG(item, msg);
615                         ng_btsocket_hci_raw_msg_input(msg);
616                         } break;
617
618                 default:
619                         KASSERT(0, 
620 ("%s: invalid item type=%ld\n", __func__, (item->el_flags & NGQF_TYPE)));
621                         break;
622                 }
623
624                 NG_FREE_ITEM(item);
625         }
626 } /* ng_btsocket_hci_raw_input */
627
628 /*
629  * Raw HCI sockets output routine
630  */
631
632 static void
633 ng_btsocket_hci_raw_output(node_p node, hook_p hook, void *arg1, int arg2)
634 {
635         struct mbuf             *nam = (struct mbuf *) arg1, *m = NULL;
636         struct sockaddr_hci     *sa = NULL;
637         int                      error;
638
639         m = nam->m_next;
640         nam->m_next = NULL;
641
642         KASSERT((nam->m_type == MT_SONAME),
643                 ("%s: m_type=%d\n", __func__, nam->m_type));
644         KASSERT((m->m_flags & M_PKTHDR),
645                 ("%s: m_flags=%#x\n", __func__, m->m_flags));
646
647         sa = mtod(nam, struct sockaddr_hci *);
648
649         /*
650          * Find downstream hook
651          * XXX For now access node hook list directly. Should be safe because
652          * we used ng_send_fn() and we should have exclusive lock on the node.
653          */
654
655         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
656                 if (hook == NULL || NG_HOOK_NOT_VALID(hook) || 
657                     NG_NODE_NOT_VALID(NG_PEER_NODE(hook)))
658                         continue;
659
660                 if (strcmp(sa->hci_node, NG_PEER_NODE_NAME(hook)) == 0) {
661                         NG_SEND_DATA_ONLY(error, hook, m); /* sets m to NULL */
662                         break;
663                 }
664         }
665
666         NG_FREE_M(nam); /* check for != NULL */
667         NG_FREE_M(m);
668 } /* ng_btsocket_hci_raw_output */
669
670 /*
671  * Check frame against security and socket filters. 
672  * d (direction bit) == 1 means incoming frame.
673  */
674
675 static int
676 ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf *m, int d)
677 {
678         int     type, event, opcode;
679
680         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
681
682         switch ((type = *mtod(m, u_int8_t *))) {
683         case NG_HCI_CMD_PKT:
684                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)) {
685                         opcode = le16toh(mtod(m, ng_hci_cmd_pkt_t *)->opcode);
686                 
687                         if (!bit_test(
688 ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF(opcode) - 1],
689 NG_HCI_OCF(opcode) - 1))
690                                 return (EPERM);
691                 }
692
693                 if (d && !bit_test(pcb->filter.packet_mask, NG_HCI_CMD_PKT - 1))
694                         return (EPERM);
695                 break;
696
697         case NG_HCI_ACL_DATA_PKT:
698         case NG_HCI_SCO_DATA_PKT:
699                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED) ||
700                     !bit_test(pcb->filter.packet_mask, type - 1) ||
701                     !d)
702                         return (EPERM);
703                 break;
704
705         case NG_HCI_EVENT_PKT:
706                 if (!d)
707                         return (EINVAL);
708
709                 event = mtod(m, ng_hci_event_pkt_t *)->event - 1;
710
711                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED))
712                         if (!bit_test(ng_btsocket_hci_raw_sec_filter->events, event))
713                                 return (EPERM);
714
715                 if (!bit_test(pcb->filter.event_mask, event))
716                         return (EPERM);
717                 break;
718
719         default:
720                 return (EINVAL);
721         }
722
723         return (0);
724 } /* ng_btsocket_hci_raw_filter */
725
726 /*
727  * Initialize everything
728  */
729
730 void
731 ng_btsocket_hci_raw_init(void)
732 {
733         bitstr_t        *f = NULL;
734         int              error = 0;
735
736         /* Skip initialization of globals for non-default instances. */
737         if (!IS_DEFAULT_VNET(curvnet))
738                 return;
739
740         ng_btsocket_hci_raw_node = NULL;
741         ng_btsocket_hci_raw_debug_level = NG_BTSOCKET_WARN_LEVEL;
742         ng_btsocket_hci_raw_ioctl_timeout = 5;
743
744         /* Register Netgraph node type */
745         error = ng_newtype(&typestruct);
746         if (error != 0) {
747                 NG_BTSOCKET_HCI_RAW_ALERT(
748 "%s: Could not register Netgraph node type, error=%d\n", __func__, error);
749
750                 return;
751         }
752
753         /* Create Netgrapg node */
754         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
755         if (error != 0) {
756                 NG_BTSOCKET_HCI_RAW_ALERT(
757 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
758
759                 ng_btsocket_hci_raw_node = NULL;
760
761                 return;
762         }
763
764         error = ng_name_node(ng_btsocket_hci_raw_node,
765                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
766         if (error != 0) {
767                 NG_BTSOCKET_HCI_RAW_ALERT(
768 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
769
770                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
771                 ng_btsocket_hci_raw_node = NULL;
772
773                 return;
774         }
775
776         /* Create input queue */
777         NG_BT_ITEMQ_INIT(&ng_btsocket_hci_raw_queue, 300);
778         mtx_init(&ng_btsocket_hci_raw_queue_mtx,
779                 "btsocks_hci_raw_queue_mtx", NULL, MTX_DEF);
780         TASK_INIT(&ng_btsocket_hci_raw_task, 0,
781                 ng_btsocket_hci_raw_input, NULL);
782
783         /* Create list of sockets */
784         LIST_INIT(&ng_btsocket_hci_raw_sockets);
785         mtx_init(&ng_btsocket_hci_raw_sockets_mtx,
786                 "btsocks_hci_raw_sockets_mtx", NULL, MTX_DEF);
787
788         /* Tokens */
789         ng_btsocket_hci_raw_token = 0;
790         mtx_init(&ng_btsocket_hci_raw_token_mtx,
791                 "btsocks_hci_raw_token_mtx", NULL, MTX_DEF);
792
793         /* 
794          * Security filter
795          * XXX never free()ed
796          */
797         ng_btsocket_hci_raw_sec_filter =
798             malloc(sizeof(struct ng_btsocket_hci_raw_sec_filter), 
799                 M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
800         if (ng_btsocket_hci_raw_sec_filter == NULL) {
801                 printf("%s: Could not allocate security filter!\n", __func__);
802                 return;
803         }
804
805         /*
806          * XXX How paranoid can we get? 
807          *
808          * Initialize security filter. If bit is set in the mask then
809          * unprivileged socket is allowed to send (receive) this command
810          * (event).
811          */
812
813         /* Enable all events */
814         memset(&ng_btsocket_hci_raw_sec_filter->events, 0xff,
815                 sizeof(ng_btsocket_hci_raw_sec_filter->events)/
816                         sizeof(ng_btsocket_hci_raw_sec_filter->events[0]));
817
818         /* Disable some critical events */
819         f = ng_btsocket_hci_raw_sec_filter->events;
820         bit_clear(f, NG_HCI_EVENT_RETURN_LINK_KEYS - 1);
821         bit_clear(f, NG_HCI_EVENT_LINK_KEY_NOTIFICATION - 1);
822         bit_clear(f, NG_HCI_EVENT_VENDOR - 1);
823
824         /* Commands - Link control */
825         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_CONTROL-1];
826         bit_set(f, NG_HCI_OCF_INQUIRY - 1);
827         bit_set(f, NG_HCI_OCF_INQUIRY_CANCEL - 1);
828         bit_set(f, NG_HCI_OCF_PERIODIC_INQUIRY - 1);
829         bit_set(f, NG_HCI_OCF_EXIT_PERIODIC_INQUIRY - 1);
830         bit_set(f, NG_HCI_OCF_REMOTE_NAME_REQ - 1);
831         bit_set(f, NG_HCI_OCF_READ_REMOTE_FEATURES - 1);
832         bit_set(f, NG_HCI_OCF_READ_REMOTE_VER_INFO - 1);
833         bit_set(f, NG_HCI_OCF_READ_CLOCK_OFFSET - 1);
834
835         /* Commands - Link policy */
836         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_POLICY-1];
837         bit_set(f, NG_HCI_OCF_ROLE_DISCOVERY - 1);
838         bit_set(f, NG_HCI_OCF_READ_LINK_POLICY_SETTINGS - 1);
839
840         /* Commands - Host controller and baseband */
841         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_HC_BASEBAND-1];
842         bit_set(f, NG_HCI_OCF_READ_PIN_TYPE - 1);
843         bit_set(f, NG_HCI_OCF_READ_LOCAL_NAME - 1);
844         bit_set(f, NG_HCI_OCF_READ_CON_ACCEPT_TIMO - 1);
845         bit_set(f, NG_HCI_OCF_READ_PAGE_TIMO - 1);
846         bit_set(f, NG_HCI_OCF_READ_SCAN_ENABLE - 1);
847         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_ACTIVITY - 1);
848         bit_set(f, NG_HCI_OCF_READ_INQUIRY_SCAN_ACTIVITY - 1);
849         bit_set(f, NG_HCI_OCF_READ_AUTH_ENABLE - 1);
850         bit_set(f, NG_HCI_OCF_READ_ENCRYPTION_MODE - 1);
851         bit_set(f, NG_HCI_OCF_READ_UNIT_CLASS - 1);
852         bit_set(f, NG_HCI_OCF_READ_VOICE_SETTINGS - 1);
853         bit_set(f, NG_HCI_OCF_READ_AUTO_FLUSH_TIMO - 1);
854         bit_set(f, NG_HCI_OCF_READ_NUM_BROADCAST_RETRANS - 1);
855         bit_set(f, NG_HCI_OCF_READ_HOLD_MODE_ACTIVITY - 1);
856         bit_set(f, NG_HCI_OCF_READ_XMIT_LEVEL - 1);
857         bit_set(f, NG_HCI_OCF_READ_SCO_FLOW_CONTROL - 1);
858         bit_set(f, NG_HCI_OCF_READ_LINK_SUPERVISION_TIMO - 1);
859         bit_set(f, NG_HCI_OCF_READ_SUPPORTED_IAC_NUM - 1);
860         bit_set(f, NG_HCI_OCF_READ_IAC_LAP - 1);
861         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_PERIOD - 1);
862         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN - 1);
863         bit_set(f, NG_HCI_OCF_READ_LE_HOST_SUPPORTED -1);
864
865         /* Commands - Informational */
866         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_INFO - 1];
867         bit_set(f, NG_HCI_OCF_READ_LOCAL_VER - 1);
868         bit_set(f, NG_HCI_OCF_READ_LOCAL_FEATURES - 1);
869         bit_set(f, NG_HCI_OCF_READ_BUFFER_SIZE - 1);
870         bit_set(f, NG_HCI_OCF_READ_COUNTRY_CODE - 1);
871         bit_set(f, NG_HCI_OCF_READ_BDADDR - 1);
872
873         /* Commands - Status */
874         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_STATUS - 1];
875         bit_set(f, NG_HCI_OCF_READ_FAILED_CONTACT_CNTR - 1);
876         bit_set(f, NG_HCI_OCF_GET_LINK_QUALITY - 1);
877         bit_set(f, NG_HCI_OCF_READ_RSSI - 1);
878
879         /* Commands - Testing */
880         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_TESTING - 1];
881         bit_set(f, NG_HCI_OCF_READ_LOOPBACK_MODE - 1);
882         /*Commands - LE*/
883         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LE -1];
884         bit_set(f, NG_HCI_OCF_LE_SET_SCAN_ENABLE - 1);
885         bit_set(f, NG_HCI_OCF_LE_SET_SCAN_PARAMETERS - 1);
886         bit_set(f, NG_HCI_OCF_LE_READ_LOCAL_SUPPORTED_FEATURES - 1);
887         bit_set(f, NG_HCI_OCF_LE_READ_BUFFER_SIZE - 1);
888         bit_set(f, NG_HCI_OCF_LE_READ_WHITE_LIST_SIZE - 1);
889
890 } /* ng_btsocket_hci_raw_init */
891
892 /*
893  * Abort connection on socket
894  */
895
896 void
897 ng_btsocket_hci_raw_abort(struct socket *so)
898 {
899 } /* ng_btsocket_hci_raw_abort */
900
901 void
902 ng_btsocket_hci_raw_close(struct socket *so)
903 {
904 } /* ng_btsocket_hci_raw_close */
905
906 /*
907  * Create new raw HCI socket
908  */
909
910 int
911 ng_btsocket_hci_raw_attach(struct socket *so, int proto, struct thread *td)
912 {
913         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
914         int                             error = 0;
915
916         if (pcb != NULL)
917                 return (EISCONN);
918
919         if (ng_btsocket_hci_raw_node == NULL)
920                 return (EPROTONOSUPPORT);
921         if (proto != BLUETOOTH_PROTO_HCI)
922                 return (EPROTONOSUPPORT);
923         if (so->so_type != SOCK_RAW)
924                 return (ESOCKTNOSUPPORT);
925
926         error = soreserve(so, NG_BTSOCKET_HCI_RAW_SENDSPACE,
927                                 NG_BTSOCKET_HCI_RAW_RECVSPACE);
928         if (error != 0)
929                 return (error);
930
931         pcb = malloc(sizeof(*pcb), 
932                 M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
933         if (pcb == NULL)
934                 return (ENOMEM);
935
936         so->so_pcb = (caddr_t) pcb;
937         pcb->so = so;
938
939         if (priv_check(td, PRIV_NETBLUETOOTH_RAW) == 0)
940                 pcb->flags |= NG_BTSOCKET_HCI_RAW_PRIVILEGED;
941
942         /*
943          * Set default socket filter. By default socket only accepts HCI
944          * Command_Complete and Command_Status event packets.
945          */
946
947         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_COMPL - 1);
948         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_STATUS - 1);
949
950         mtx_init(&pcb->pcb_mtx, "btsocks_hci_raw_pcb_mtx", NULL, MTX_DEF);
951
952         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
953         LIST_INSERT_HEAD(&ng_btsocket_hci_raw_sockets, pcb, next);
954         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
955
956         return (0);
957 } /* ng_btsocket_hci_raw_attach */
958
959 /*
960  * Bind raw HCI socket
961  */
962
963 int
964 ng_btsocket_hci_raw_bind(struct socket *so, struct sockaddr *nam,
965                 struct thread *td)
966 {
967         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
968         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
969
970         if (pcb == NULL)
971                 return (EINVAL);
972         if (ng_btsocket_hci_raw_node == NULL)
973                 return (EINVAL);
974
975         if (sa == NULL)
976                 return (EINVAL);
977         if (sa->hci_family != AF_BLUETOOTH)
978                 return (EAFNOSUPPORT);
979         if (sa->hci_len != sizeof(*sa))
980                 return (EINVAL);
981         if (sa->hci_node[0] == 0)
982                 return (EINVAL);
983
984         mtx_lock(&pcb->pcb_mtx);
985         bcopy(sa, &pcb->addr, sizeof(pcb->addr));
986         mtx_unlock(&pcb->pcb_mtx);
987
988         return (0);
989 } /* ng_btsocket_hci_raw_bind */
990
991 /*
992  * Connect raw HCI socket
993  */
994
995 int
996 ng_btsocket_hci_raw_connect(struct socket *so, struct sockaddr *nam,
997                 struct thread *td)
998 {
999         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1000         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
1001
1002         if (pcb == NULL)
1003                 return (EINVAL);
1004         if (ng_btsocket_hci_raw_node == NULL)
1005                 return (EINVAL);
1006
1007         if (sa == NULL)
1008                 return (EINVAL);
1009         if (sa->hci_family != AF_BLUETOOTH)
1010                 return (EAFNOSUPPORT);
1011         if (sa->hci_len != sizeof(*sa))
1012                 return (EINVAL);
1013         if (sa->hci_node[0] == 0)
1014                 return (EDESTADDRREQ);
1015
1016         mtx_lock(&pcb->pcb_mtx);
1017
1018         if (bcmp(sa, &pcb->addr, sizeof(pcb->addr)) != 0) {
1019                 mtx_unlock(&pcb->pcb_mtx);
1020                 return (EADDRNOTAVAIL);
1021         }
1022
1023         soisconnected(so);
1024
1025         mtx_unlock(&pcb->pcb_mtx);
1026
1027         return (0);
1028 } /* ng_btsocket_hci_raw_connect */
1029
1030 /*
1031  * Process ioctl on socket
1032  */
1033
1034 int
1035 ng_btsocket_hci_raw_control(struct socket *so, u_long cmd, caddr_t data,
1036                 struct ifnet *ifp, struct thread *td)
1037 {
1038         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1039         char                             path[NG_NODESIZ + 1];
1040         struct ng_mesg                  *msg = NULL;
1041         int                              error = 0;
1042
1043         if (pcb == NULL)
1044                 return (EINVAL);
1045         if (ng_btsocket_hci_raw_node == NULL)
1046                 return (EINVAL);
1047
1048         mtx_lock(&pcb->pcb_mtx);
1049
1050         /* Check if we have device name */
1051         if (pcb->addr.hci_node[0] == 0) {
1052                 mtx_unlock(&pcb->pcb_mtx);
1053                 return (EHOSTUNREACH);
1054         }
1055
1056         /* Check if we have pending ioctl() */
1057         if (pcb->token != 0) {
1058                 mtx_unlock(&pcb->pcb_mtx);
1059                 return (EBUSY);
1060         }
1061
1062         snprintf(path, sizeof(path), "%s:", pcb->addr.hci_node);
1063
1064         switch (cmd) {
1065         case SIOC_HCI_RAW_NODE_GET_STATE: {
1066                 struct ng_btsocket_hci_raw_node_state   *p =
1067                         (struct ng_btsocket_hci_raw_node_state *) data;
1068
1069                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path, 
1070                                 NGM_HCI_NODE_GET_STATE,
1071                                 &p->state, sizeof(p->state));
1072                 } break;
1073
1074         case SIOC_HCI_RAW_NODE_INIT:
1075                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1076                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1077                                         NGM_HCI_NODE_INIT, NULL, 0);
1078                 else
1079                         error = EPERM;
1080                 break;
1081
1082         case SIOC_HCI_RAW_NODE_GET_DEBUG: {
1083                 struct ng_btsocket_hci_raw_node_debug   *p = 
1084                         (struct ng_btsocket_hci_raw_node_debug *) data;
1085
1086                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1087                                 NGM_HCI_NODE_GET_DEBUG,
1088                                 &p->debug, sizeof(p->debug));
1089                 } break;
1090
1091         case SIOC_HCI_RAW_NODE_SET_DEBUG: {
1092                 struct ng_btsocket_hci_raw_node_debug   *p = 
1093                         (struct ng_btsocket_hci_raw_node_debug *) data;
1094
1095                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1096                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1097                                         NGM_HCI_NODE_SET_DEBUG, &p->debug,
1098                                         sizeof(p->debug));
1099                 else
1100                         error = EPERM;
1101                 } break;
1102
1103         case SIOC_HCI_RAW_NODE_GET_BUFFER: {
1104                 struct ng_btsocket_hci_raw_node_buffer  *p = 
1105                         (struct ng_btsocket_hci_raw_node_buffer *) data;
1106
1107                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1108                                 NGM_HCI_NODE_GET_BUFFER,
1109                                 &p->buffer, sizeof(p->buffer));
1110                 } break;
1111
1112         case SIOC_HCI_RAW_NODE_GET_BDADDR: {
1113                 struct ng_btsocket_hci_raw_node_bdaddr  *p = 
1114                         (struct ng_btsocket_hci_raw_node_bdaddr *) data;
1115
1116                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1117                                 NGM_HCI_NODE_GET_BDADDR,
1118                                 &p->bdaddr, sizeof(p->bdaddr));
1119                 } break;
1120
1121         case SIOC_HCI_RAW_NODE_GET_FEATURES: {
1122                 struct ng_btsocket_hci_raw_node_features        *p = 
1123                         (struct ng_btsocket_hci_raw_node_features *) data;
1124
1125                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1126                                 NGM_HCI_NODE_GET_FEATURES,
1127                                 &p->features, sizeof(p->features));
1128                 } break;
1129
1130         case SIOC_HCI_RAW_NODE_GET_STAT: {
1131                 struct ng_btsocket_hci_raw_node_stat    *p = 
1132                         (struct ng_btsocket_hci_raw_node_stat *) data;
1133
1134                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1135                                 NGM_HCI_NODE_GET_STAT,
1136                                 &p->stat, sizeof(p->stat));
1137                 } break;
1138
1139         case SIOC_HCI_RAW_NODE_RESET_STAT:
1140                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1141                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1142                                         NGM_HCI_NODE_RESET_STAT, NULL, 0);
1143                 else
1144                         error = EPERM;
1145                 break;
1146
1147         case SIOC_HCI_RAW_NODE_FLUSH_NEIGHBOR_CACHE:
1148                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1149                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1150                                         NGM_HCI_NODE_FLUSH_NEIGHBOR_CACHE,
1151                                         NULL, 0);
1152                 else
1153                         error = EPERM;
1154                 break;
1155
1156         case SIOC_HCI_RAW_NODE_GET_NEIGHBOR_CACHE:  {
1157                 struct ng_btsocket_hci_raw_node_neighbor_cache  *p = 
1158                         (struct ng_btsocket_hci_raw_node_neighbor_cache *) data;
1159                 ng_hci_node_get_neighbor_cache_ep               *p1 = NULL;
1160                 ng_hci_node_neighbor_cache_entry_ep             *p2 = NULL;
1161
1162                 if (p->num_entries <= 0 || 
1163                     p->num_entries > NG_HCI_MAX_NEIGHBOR_NUM ||
1164                     p->entries == NULL) {
1165                         mtx_unlock(&pcb->pcb_mtx);
1166                         return (EINVAL);
1167                 }
1168
1169                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE,
1170                         NGM_HCI_NODE_GET_NEIGHBOR_CACHE, 0, M_NOWAIT);
1171                 if (msg == NULL) {
1172                         mtx_unlock(&pcb->pcb_mtx);
1173                         return (ENOMEM);
1174                 }
1175                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1176                 pcb->token = msg->header.token;
1177                 pcb->msg = NULL;
1178
1179                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1180                 if (error != 0) {
1181                         pcb->token = 0;
1182                         mtx_unlock(&pcb->pcb_mtx);
1183                         return (error);
1184                 }
1185
1186                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1187                                 PZERO|PCATCH, "hcictl", 
1188                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1189                 pcb->token = 0;
1190
1191                 if (error != 0) {
1192                         mtx_unlock(&pcb->pcb_mtx);
1193                         return (error);
1194                 }
1195
1196                 msg = pcb->msg;
1197                 pcb->msg = NULL;
1198
1199                 mtx_unlock(&pcb->pcb_mtx);
1200                 
1201                 if (msg != NULL &&
1202                     msg->header.cmd == NGM_HCI_NODE_GET_NEIGHBOR_CACHE) {
1203                         /* Return data back to user space */
1204                         p1 = (ng_hci_node_get_neighbor_cache_ep *)(msg->data);
1205                         p2 = (ng_hci_node_neighbor_cache_entry_ep *)(p1 + 1);
1206
1207                         p->num_entries = min(p->num_entries, p1->num_entries);
1208                         if (p->num_entries > 0)
1209                                 error = copyout((caddr_t) p2, 
1210                                                 (caddr_t) p->entries,
1211                                                 p->num_entries * sizeof(*p2));
1212                 } else
1213                         error = EINVAL;
1214
1215                 NG_FREE_MSG(msg); /* checks for != NULL */
1216                 return (error);
1217                 } /* NOTREACHED */
1218
1219         case SIOC_HCI_RAW_NODE_GET_CON_LIST: {
1220                 struct ng_btsocket_hci_raw_con_list     *p = 
1221                         (struct ng_btsocket_hci_raw_con_list *) data;
1222                 ng_hci_node_con_list_ep                 *p1 = NULL;
1223                 ng_hci_node_con_ep                      *p2 = NULL;
1224
1225                 if (p->num_connections == 0 ||
1226                     p->num_connections > NG_HCI_MAX_CON_NUM ||
1227                     p->connections == NULL) {
1228                         mtx_unlock(&pcb->pcb_mtx);
1229                         return (EINVAL);
1230                 }
1231
1232                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE, NGM_HCI_NODE_GET_CON_LIST,
1233                         0, M_NOWAIT);
1234                 if (msg == NULL) {
1235                         mtx_unlock(&pcb->pcb_mtx);
1236                         return (ENOMEM);
1237                 }
1238                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1239                 pcb->token = msg->header.token;
1240                 pcb->msg = NULL;
1241
1242                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1243                 if (error != 0) {
1244                         pcb->token = 0;
1245                         mtx_unlock(&pcb->pcb_mtx);
1246                         return (error);
1247                 }
1248
1249                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1250                                 PZERO|PCATCH, "hcictl", 
1251                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1252                 pcb->token = 0;
1253
1254                 if (error != 0) {
1255                         mtx_unlock(&pcb->pcb_mtx);
1256                         return (error);
1257                 }
1258
1259                 msg = pcb->msg;
1260                 pcb->msg = NULL;
1261
1262                 mtx_unlock(&pcb->pcb_mtx);
1263
1264                 if (msg != NULL &&
1265                     msg->header.cmd == NGM_HCI_NODE_GET_CON_LIST) {
1266                         /* Return data back to user space */
1267                         p1 = (ng_hci_node_con_list_ep *)(msg->data);
1268                         p2 = (ng_hci_node_con_ep *)(p1 + 1);
1269
1270                         p->num_connections = min(p->num_connections,
1271                                                 p1->num_connections);
1272                         if (p->num_connections > 0)
1273                                 error = copyout((caddr_t) p2, 
1274                                         (caddr_t) p->connections,
1275                                         p->num_connections * sizeof(*p2));
1276                 } else
1277                         error = EINVAL;
1278
1279                 NG_FREE_MSG(msg); /* checks for != NULL */
1280                 return (error);
1281                 } /* NOTREACHED */
1282
1283         case SIOC_HCI_RAW_NODE_GET_LINK_POLICY_MASK: {
1284                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p = 
1285                         (struct ng_btsocket_hci_raw_node_link_policy_mask *) 
1286                                 data;
1287
1288                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1289                                 NGM_HCI_NODE_GET_LINK_POLICY_SETTINGS_MASK,
1290                                 &p->policy_mask, sizeof(p->policy_mask));
1291                 } break;
1292
1293         case SIOC_HCI_RAW_NODE_SET_LINK_POLICY_MASK: {
1294                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p = 
1295                         (struct ng_btsocket_hci_raw_node_link_policy_mask *) 
1296                                 data;
1297
1298                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1299                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1300                                         NGM_HCI_NODE_SET_LINK_POLICY_SETTINGS_MASK,
1301                                         &p->policy_mask,
1302                                         sizeof(p->policy_mask));
1303                 else
1304                         error = EPERM;
1305                 } break;
1306
1307         case SIOC_HCI_RAW_NODE_GET_PACKET_MASK: {
1308                 struct ng_btsocket_hci_raw_node_packet_mask     *p = 
1309                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1310
1311                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1312                                 NGM_HCI_NODE_GET_PACKET_MASK,
1313                                 &p->packet_mask, sizeof(p->packet_mask));
1314                 } break;
1315
1316         case SIOC_HCI_RAW_NODE_SET_PACKET_MASK: {
1317                 struct ng_btsocket_hci_raw_node_packet_mask     *p = 
1318                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1319
1320                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1321                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1322                                         NGM_HCI_NODE_SET_PACKET_MASK,
1323                                         &p->packet_mask,
1324                                         sizeof(p->packet_mask));
1325                 else
1326                         error = EPERM;
1327                 } break;
1328
1329         case SIOC_HCI_RAW_NODE_GET_ROLE_SWITCH: {
1330                 struct ng_btsocket_hci_raw_node_role_switch     *p = 
1331                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1332
1333                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1334                                 NGM_HCI_NODE_GET_ROLE_SWITCH,
1335                                 &p->role_switch, sizeof(p->role_switch));
1336                 } break;
1337
1338         case SIOC_HCI_RAW_NODE_SET_ROLE_SWITCH: {
1339                 struct ng_btsocket_hci_raw_node_role_switch     *p = 
1340                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1341
1342                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1343                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1344                                         NGM_HCI_NODE_SET_ROLE_SWITCH,
1345                                         &p->role_switch,
1346                                         sizeof(p->role_switch));
1347                 else
1348                         error = EPERM;
1349                 } break;
1350
1351         case SIOC_HCI_RAW_NODE_LIST_NAMES: {
1352                 struct ng_btsocket_hci_raw_node_list_names      *nl =
1353                         (struct ng_btsocket_hci_raw_node_list_names *) data;
1354                 struct nodeinfo                                 *ni = nl->names;
1355
1356                 if (nl->num_names == 0) {
1357                         mtx_unlock(&pcb->pcb_mtx);
1358                         return (EINVAL);
1359                 }
1360
1361                 NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_LISTNAMES,
1362                         0, M_NOWAIT);
1363                 if (msg == NULL) {
1364                         mtx_unlock(&pcb->pcb_mtx);
1365                         return (ENOMEM);
1366                 }
1367                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1368                 pcb->token = msg->header.token;
1369                 pcb->msg = NULL;
1370
1371                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, ".:", 0);
1372                 if (error != 0) {
1373                         pcb->token = 0;
1374                         mtx_unlock(&pcb->pcb_mtx);
1375                         return (error);
1376                 }
1377
1378                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1379                                 PZERO|PCATCH, "hcictl",
1380                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1381                 pcb->token = 0;
1382
1383                 if (error != 0) {
1384                         mtx_unlock(&pcb->pcb_mtx);
1385                         return (error);
1386                 }
1387
1388                 msg = pcb->msg;
1389                 pcb->msg = NULL;
1390
1391                 mtx_unlock(&pcb->pcb_mtx);
1392
1393                 if (msg != NULL && msg->header.cmd == NGM_LISTNAMES) {
1394                         /* Return data back to user space */
1395                         struct namelist *nl1 = (struct namelist *) msg->data;
1396                         struct nodeinfo *ni1 = &nl1->nodeinfo[0];
1397
1398                         while (nl->num_names > 0 && nl1->numnames > 0) {
1399                                 if (strcmp(ni1->type, NG_HCI_NODE_TYPE) == 0) {
1400                                         error = copyout((caddr_t) ni1,
1401                                                         (caddr_t) ni,
1402                                                         sizeof(*ni));
1403                                         if (error != 0)
1404                                                 break;
1405
1406                                         nl->num_names --;
1407                                         ni ++;
1408                                 }
1409
1410                                 nl1->numnames --;
1411                                 ni1 ++;
1412                         }
1413
1414                         nl->num_names = ni - nl->names;
1415                 } else
1416                         error = EINVAL;
1417
1418                 NG_FREE_MSG(msg); /* checks for != NULL */
1419                 return (error);
1420                 } /* NOTREACHED */
1421
1422         default:
1423                 error = EINVAL;
1424                 break;
1425         }
1426
1427         mtx_unlock(&pcb->pcb_mtx);
1428
1429         return (error);
1430 } /* ng_btsocket_hci_raw_control */
1431
1432 /*
1433  * Process getsockopt/setsockopt system calls
1434  */
1435
1436 int
1437 ng_btsocket_hci_raw_ctloutput(struct socket *so, struct sockopt *sopt)
1438 {
1439         ng_btsocket_hci_raw_pcb_p               pcb = so2hci_raw_pcb(so);
1440         struct ng_btsocket_hci_raw_filter       filter;
1441         int                                     error = 0, dir;
1442
1443         if (pcb == NULL)
1444                 return (EINVAL);
1445         if (ng_btsocket_hci_raw_node == NULL)
1446                 return (EINVAL);
1447
1448         if (sopt->sopt_level != SOL_HCI_RAW)
1449                 return (0);
1450
1451         mtx_lock(&pcb->pcb_mtx);
1452
1453         switch (sopt->sopt_dir) {
1454         case SOPT_GET:
1455                 switch (sopt->sopt_name) {
1456                 case SO_HCI_RAW_FILTER:
1457                         error = sooptcopyout(sopt, &pcb->filter,
1458                                                 sizeof(pcb->filter));
1459                         break;
1460
1461                 case SO_HCI_RAW_DIRECTION:
1462                         dir = (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION)?1:0;
1463                         error = sooptcopyout(sopt, &dir, sizeof(dir));
1464                         break;
1465
1466                 default:
1467                         error = EINVAL;
1468                         break;
1469                 }
1470                 break;
1471
1472         case SOPT_SET:
1473                 switch (sopt->sopt_name) {
1474                 case SO_HCI_RAW_FILTER:
1475                         error = sooptcopyin(sopt, &filter, sizeof(filter),
1476                                                 sizeof(filter));
1477                         if (error == 0)
1478                                 bcopy(&filter, &pcb->filter,
1479                                                 sizeof(pcb->filter));
1480                         break;
1481
1482                 case SO_HCI_RAW_DIRECTION:
1483                         error = sooptcopyin(sopt, &dir, sizeof(dir),
1484                                                 sizeof(dir));
1485                         if (error != 0)
1486                                 break;
1487
1488                         if (dir)
1489                                 pcb->flags |= NG_BTSOCKET_HCI_RAW_DIRECTION;
1490                         else
1491                                 pcb->flags &= ~NG_BTSOCKET_HCI_RAW_DIRECTION;
1492                         break;
1493
1494                 default:
1495                         error = EINVAL;
1496                         break;
1497                 }
1498                 break;
1499
1500         default:
1501                 error = EINVAL;
1502                 break;
1503         }
1504
1505         mtx_unlock(&pcb->pcb_mtx);
1506
1507         return (error);
1508 } /* ng_btsocket_hci_raw_ctloutput */
1509
1510 /*
1511  * Detach raw HCI socket
1512  */
1513
1514 void
1515 ng_btsocket_hci_raw_detach(struct socket *so)
1516 {
1517         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1518
1519         KASSERT(pcb != NULL, ("ng_btsocket_hci_raw_detach: pcb == NULL"));
1520
1521         if (ng_btsocket_hci_raw_node == NULL)
1522                 return;
1523
1524         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
1525         mtx_lock(&pcb->pcb_mtx);
1526
1527         LIST_REMOVE(pcb, next);
1528
1529         mtx_unlock(&pcb->pcb_mtx);
1530         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
1531
1532         mtx_destroy(&pcb->pcb_mtx);
1533
1534         bzero(pcb, sizeof(*pcb));
1535         free(pcb, M_NETGRAPH_BTSOCKET_HCI_RAW);
1536
1537         so->so_pcb = NULL;
1538 } /* ng_btsocket_hci_raw_detach */
1539
1540 /*
1541  * Disconnect raw HCI socket
1542  */
1543
1544 int
1545 ng_btsocket_hci_raw_disconnect(struct socket *so)
1546 {
1547         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1548
1549         if (pcb == NULL)
1550                 return (EINVAL);
1551         if (ng_btsocket_hci_raw_node == NULL)
1552                 return (EINVAL);
1553
1554         mtx_lock(&pcb->pcb_mtx);
1555         soisdisconnected(so);
1556         mtx_unlock(&pcb->pcb_mtx);
1557
1558         return (0);
1559 } /* ng_btsocket_hci_raw_disconnect */
1560
1561 /*
1562  * Get socket peer's address
1563  */
1564
1565 int
1566 ng_btsocket_hci_raw_peeraddr(struct socket *so, struct sockaddr **nam)
1567 {
1568         return (ng_btsocket_hci_raw_sockaddr(so, nam));
1569 } /* ng_btsocket_hci_raw_peeraddr */
1570
1571 /*
1572  * Send data
1573  */
1574
1575 int
1576 ng_btsocket_hci_raw_send(struct socket *so, int flags, struct mbuf *m,
1577                 struct sockaddr *sa, struct mbuf *control, struct thread *td)
1578 {
1579         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1580         struct mbuf                     *nam = NULL;
1581         int                              error = 0;
1582
1583         if (ng_btsocket_hci_raw_node == NULL) {
1584                 error = ENETDOWN;
1585                 goto drop;
1586         }
1587         if (pcb == NULL) {
1588                 error = EINVAL;
1589                 goto drop;
1590         }
1591         if (control != NULL) {
1592                 error = EINVAL;
1593                 goto drop;
1594         }
1595
1596         if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t) ||
1597             m->m_pkthdr.len > sizeof(ng_hci_cmd_pkt_t) + NG_HCI_CMD_PKT_SIZE) {
1598                 error = EMSGSIZE;
1599                 goto drop;
1600         }
1601
1602         if (m->m_len < sizeof(ng_hci_cmd_pkt_t)) {
1603                 if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
1604                         error = ENOBUFS;
1605                         goto drop;
1606                 }
1607         }
1608         if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
1609                 error = ENOTSUP;
1610                 goto drop;
1611         }
1612
1613         mtx_lock(&pcb->pcb_mtx);
1614
1615         error = ng_btsocket_hci_raw_filter(pcb, m, 0);
1616         if (error != 0) {
1617                 mtx_unlock(&pcb->pcb_mtx);
1618                 goto drop;
1619         }
1620
1621         if (sa == NULL) {
1622                 if (pcb->addr.hci_node[0] == 0) {
1623                         mtx_unlock(&pcb->pcb_mtx);
1624                         error = EDESTADDRREQ;
1625                         goto drop;
1626                 }
1627
1628                 sa = (struct sockaddr *) &pcb->addr;
1629         }
1630
1631         MGET(nam, M_NOWAIT, MT_SONAME);
1632         if (nam == NULL) {
1633                 mtx_unlock(&pcb->pcb_mtx);
1634                 error = ENOBUFS;
1635                 goto drop;
1636         }
1637
1638         nam->m_len = sizeof(struct sockaddr_hci);
1639         bcopy(sa,mtod(nam, struct sockaddr_hci *),sizeof(struct sockaddr_hci));
1640
1641         nam->m_next = m;
1642         m = NULL;
1643
1644         mtx_unlock(&pcb->pcb_mtx);
1645
1646         return (ng_send_fn(ng_btsocket_hci_raw_node, NULL, 
1647                                 ng_btsocket_hci_raw_output, nam, 0));
1648 drop:
1649         NG_FREE_M(control); /* NG_FREE_M checks for != NULL */
1650         NG_FREE_M(nam);
1651         NG_FREE_M(m);
1652
1653         return (error);
1654 } /* ng_btsocket_hci_raw_send */
1655
1656 /*
1657  * Get socket address
1658  */
1659
1660 int
1661 ng_btsocket_hci_raw_sockaddr(struct socket *so, struct sockaddr **nam)
1662 {
1663         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1664         struct sockaddr_hci             sa;
1665
1666         if (pcb == NULL)
1667                 return (EINVAL);
1668         if (ng_btsocket_hci_raw_node == NULL)
1669                 return (EINVAL);
1670
1671         bzero(&sa, sizeof(sa));
1672         sa.hci_len = sizeof(sa);
1673         sa.hci_family = AF_BLUETOOTH;
1674
1675         mtx_lock(&pcb->pcb_mtx);
1676         strlcpy(sa.hci_node, pcb->addr.hci_node, sizeof(sa.hci_node));
1677         mtx_unlock(&pcb->pcb_mtx);
1678
1679         *nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
1680
1681         return ((*nam == NULL)? ENOMEM : 0);
1682 } /* ng_btsocket_hci_raw_sockaddr */