sys/netgraph/bluetooth/socket/ng_btsocket_hci_raw.c

   1 /*
   2  * ng_btsocket_hci_raw.c
   3  */
   4
   5 /*-
   6  * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
   7  *
   8  * Copyright (c) 2001-2002 Maksim Yevmenkin <m_evmenkin@yahoo.com>
   9  * All rights reserved.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  *
  32  * $Id: ng_btsocket_hci_raw.c,v 1.14 2003/09/14 23:29:06 max Exp $
  33  * $FreeBSD$
  34  */
  35
  36 #include <sys/param.h>
  37 #include <sys/systm.h>
  38 #include <sys/bitstring.h>
  39 #include <sys/domain.h>
  40 #include <sys/endian.h>
  41 #include <sys/errno.h>
  42 #include <sys/filedesc.h>
  43 #include <sys/ioccom.h>
  44 #include <sys/kernel.h>
  45 #include <sys/lock.h>
  46 #include <sys/malloc.h>
  47 #include <sys/mbuf.h>
  48 #include <sys/mutex.h>
  49 #include <sys/priv.h>
  50 #include <sys/protosw.h>
  51 #include <sys/queue.h>
  52 #include <sys/socket.h>
  53 #include <sys/socketvar.h>
  54 #include <sys/sysctl.h>
  55 #include <sys/taskqueue.h>
  56
  57 #include <net/vnet.h>
  58
  59 #include <netgraph/ng_message.h>
  60 #include <netgraph/netgraph.h>
  61 #include <netgraph/bluetooth/include/ng_bluetooth.h>
  62 #include <netgraph/bluetooth/include/ng_hci.h>
  63 #include <netgraph/bluetooth/include/ng_l2cap.h>
  64 #include <netgraph/bluetooth/include/ng_btsocket.h>
  65 #include <netgraph/bluetooth/include/ng_btsocket_hci_raw.h>
  66
  67 /* MALLOC define */
  68 #ifdef NG_SEPARATE_MALLOC
  69 static MALLOC_DEFINE(M_NETGRAPH_BTSOCKET_HCI_RAW, "netgraph_btsocks_hci_raw",
  70         "Netgraph Bluetooth raw HCI sockets");
  71 #else
  72 #define M_NETGRAPH_BTSOCKET_HCI_RAW M_NETGRAPH
  73 #endif /* NG_SEPARATE_MALLOC */
  74
  75 /* Netgraph node methods */
  76 static ng_constructor_t ng_btsocket_hci_raw_node_constructor;
  77 static ng_rcvmsg_t      ng_btsocket_hci_raw_node_rcvmsg;
  78 static ng_shutdown_t    ng_btsocket_hci_raw_node_shutdown;
  79 static ng_newhook_t     ng_btsocket_hci_raw_node_newhook;
  80 static ng_connect_t     ng_btsocket_hci_raw_node_connect;
  81 static ng_rcvdata_t     ng_btsocket_hci_raw_node_rcvdata;
  82 static ng_disconnect_t  ng_btsocket_hci_raw_node_disconnect;
  83
  84 static void             ng_btsocket_hci_raw_input (void *, int);
  85 static void             ng_btsocket_hci_raw_output(node_p, hook_p, void *, int);
  86 static void             ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p,
  87                                                    struct mbuf **,
  88                                                    struct mbuf *);
  89 static int              ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p,
  90                                                    struct mbuf *, int);
  91
  92 #define ng_btsocket_hci_raw_wakeup_input_task() \
  93         taskqueue_enqueue(taskqueue_swi, &ng_btsocket_hci_raw_task)
  94
  95 /* Security filter */
  96 struct ng_btsocket_hci_raw_sec_filter {
  97         bitstr_t        bit_decl(events, 0xff);
  98         bitstr_t        bit_decl(commands[0x3f], 0x3ff);
  99 };
 100
 101 /* Netgraph type descriptor */
 102 static struct ng_type typestruct = {
 103         .version =      NG_ABI_VERSION,
 104         .name =         NG_BTSOCKET_HCI_RAW_NODE_TYPE,
 105         .constructor =  ng_btsocket_hci_raw_node_constructor,
 106         .rcvmsg =       ng_btsocket_hci_raw_node_rcvmsg,
 107         .shutdown =     ng_btsocket_hci_raw_node_shutdown,
 108         .newhook =      ng_btsocket_hci_raw_node_newhook,
 109         .connect =      ng_btsocket_hci_raw_node_connect,
 110         .rcvdata =      ng_btsocket_hci_raw_node_rcvdata,
 111         .disconnect =   ng_btsocket_hci_raw_node_disconnect,
 112 };
 113
 114 /* Globals */
 115 static u_int32_t                                ng_btsocket_hci_raw_debug_level;
 116 static u_int32_t                                ng_btsocket_hci_raw_ioctl_timeout;
 117 static node_p                                   ng_btsocket_hci_raw_node;
 118 static struct ng_bt_itemq                       ng_btsocket_hci_raw_queue;
 119 static struct mtx                               ng_btsocket_hci_raw_queue_mtx;
 120 static struct task                              ng_btsocket_hci_raw_task;
 121 static LIST_HEAD(, ng_btsocket_hci_raw_pcb)     ng_btsocket_hci_raw_sockets;
 122 static struct mtx                               ng_btsocket_hci_raw_sockets_mtx;
 123 static u_int32_t                                ng_btsocket_hci_raw_token;
 124 static struct mtx                               ng_btsocket_hci_raw_token_mtx;
 125 static struct ng_btsocket_hci_raw_sec_filter    *ng_btsocket_hci_raw_sec_filter;
 126 static struct timeval                           ng_btsocket_hci_raw_lasttime;
 127 static int                                      ng_btsocket_hci_raw_curpps;
 128
 129 /* Sysctl tree */
 130 SYSCTL_DECL(_net_bluetooth_hci_sockets);
 131 static SYSCTL_NODE(_net_bluetooth_hci_sockets, OID_AUTO, raw, CTLFLAG_RW,
 132         0, "Bluetooth raw HCI sockets family");
 133 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, debug_level, CTLFLAG_RW,
 134         &ng_btsocket_hci_raw_debug_level, NG_BTSOCKET_WARN_LEVEL,
 135         "Bluetooth raw HCI sockets debug level");
 136 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, ioctl_timeout, CTLFLAG_RW,
 137         &ng_btsocket_hci_raw_ioctl_timeout, 5,
 138         "Bluetooth raw HCI sockets ioctl timeout");
 139 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_len, CTLFLAG_RD,
 140         &ng_btsocket_hci_raw_queue.len, 0,
 141         "Bluetooth raw HCI sockets input queue length");
 142 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_maxlen, CTLFLAG_RD,
 143         &ng_btsocket_hci_raw_queue.maxlen, 0,
 144         "Bluetooth raw HCI sockets input queue max. length");
 145 SYSCTL_UINT(_net_bluetooth_hci_sockets_raw, OID_AUTO, queue_drops, CTLFLAG_RD,
 146         &ng_btsocket_hci_raw_queue.drops, 0,
 147         "Bluetooth raw HCI sockets input queue drops");
 148
 149 /* Debug */
 150 #define NG_BTSOCKET_HCI_RAW_INFO \
 151         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_INFO_LEVEL && \
 152             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 153                 printf
 154
 155 #define NG_BTSOCKET_HCI_RAW_WARN \
 156         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_WARN_LEVEL && \
 157             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 158                 printf
 159
 160 #define NG_BTSOCKET_HCI_RAW_ERR \
 161         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ERR_LEVEL && \
 162             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 163                 printf
 164
 165 #define NG_BTSOCKET_HCI_RAW_ALERT \
 166         if (ng_btsocket_hci_raw_debug_level >= NG_BTSOCKET_ALERT_LEVEL && \
 167             ppsratecheck(&ng_btsocket_hci_raw_lasttime, &ng_btsocket_hci_raw_curpps, 1)) \
 168                 printf
 169
 170 /****************************************************************************
 171  ****************************************************************************
 172  **                          Netgraph specific
 173  ****************************************************************************
 174  ****************************************************************************/
 175
 176 /*
 177  * Netgraph node constructor. Do not allow to create node of this type.
 178  */
 179
 180 static int
 181 ng_btsocket_hci_raw_node_constructor(node_p node)
 182 {
 183         return (EINVAL);
 184 } /* ng_btsocket_hci_raw_node_constructor */
 185
 186 /*
 187  * Netgraph node destructor. Just let old node go and create new fresh one.
 188  */
 189
 190 static int
 191 ng_btsocket_hci_raw_node_shutdown(node_p node)
 192 {
 193         int     error = 0;
 194
 195         NG_NODE_UNREF(node);
 196
 197         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
 198         if (error  != 0) {
 199                 NG_BTSOCKET_HCI_RAW_ALERT(
 200 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
 201
 202                 ng_btsocket_hci_raw_node = NULL;
 203
 204                 return (ENOMEM);
 205         }
 206
 207         error = ng_name_node(ng_btsocket_hci_raw_node,
 208                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
 209         if (error != 0) {
 210                 NG_BTSOCKET_HCI_RAW_ALERT(
 211 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
 212
 213                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
 214                 ng_btsocket_hci_raw_node = NULL;
 215
 216                 return (EINVAL);
 217         }
 218
 219         return (0);
 220 } /* ng_btsocket_hci_raw_node_shutdown */
 221
 222 /*
 223  * Create new hook. Just say "yes"
 224  */
 225
 226 static int
 227 ng_btsocket_hci_raw_node_newhook(node_p node, hook_p hook, char const *name)
 228 {
 229         return (0);
 230 } /* ng_btsocket_hci_raw_node_newhook */
 231
 232 /*
 233  * Connect hook. Just say "yes"
 234  */
 235
 236 static int
 237 ng_btsocket_hci_raw_node_connect(hook_p hook)
 238 {
 239         return (0);
 240 } /* ng_btsocket_hci_raw_node_connect */
 241
 242 /*
 243  * Disconnect hook
 244  */
 245
 246 static int
 247 ng_btsocket_hci_raw_node_disconnect(hook_p hook)
 248 {
 249         return (0);
 250 } /* ng_btsocket_hci_raw_node_disconnect */
 251
 252 /*
 253  * Receive control message.
 254  * Make sure it is a message from HCI node and it is a response.
 255  * Enqueue item and schedule input task.
 256  */
 257
 258 static int
 259 ng_btsocket_hci_raw_node_rcvmsg(node_p node, item_p item, hook_p lasthook)
 260 {
 261         struct ng_mesg  *msg = NGI_MSG(item); /* item still has message */
 262         int              error = 0;
 263
 264         /*
 265          * Check for empty sockets list creates LOR when both sender and
 266          * receiver device are connected to the same host, so remove it
 267          * for now
 268          */
 269
 270         if (msg != NULL &&
 271             (msg->header.typecookie == NGM_HCI_COOKIE ||
 272              msg->header.typecookie == NGM_GENERIC_COOKIE) &&
 273             msg->header.flags & NGF_RESP) {
 274                 if (msg->header.token == 0) {
 275                         NG_FREE_ITEM(item);
 276                         return (0);
 277                 }
 278
 279                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 280                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
 281                         NG_BTSOCKET_HCI_RAW_ERR(
 282 "%s: Input queue is full\n", __func__);
 283
 284                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
 285                         NG_FREE_ITEM(item);
 286                         error = ENOBUFS;
 287                 } else {
 288                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
 289                         error = ng_btsocket_hci_raw_wakeup_input_task();
 290                 }
 291                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 292         } else {
 293                 NG_FREE_ITEM(item);
 294                 error = EINVAL;
 295         }
 296
 297         return (error);
 298 } /* ng_btsocket_hci_raw_node_rcvmsg */
 299
 300 /*
 301  * Receive packet from the one of our hook.
 302  * Prepend every packet with sockaddr_hci and record sender's node name.
 303  * Enqueue item and schedule input task.
 304  */
 305
 306 static int
 307 ng_btsocket_hci_raw_node_rcvdata(hook_p hook, item_p item)
 308 {
 309         struct mbuf     *nam = NULL;
 310         int              error;
 311
 312         /*
 313          * Check for empty sockets list creates LOR when both sender and
 314          * receiver device are connected to the same host, so remove it
 315          * for now
 316          */
 317
 318         MGET(nam, M_NOWAIT, MT_SONAME);
 319         if (nam != NULL) {
 320                 struct sockaddr_hci     *sa = mtod(nam, struct sockaddr_hci *);
 321
 322                 nam->m_len = sizeof(struct sockaddr_hci);
 323
 324                 sa->hci_len = sizeof(*sa);
 325                 sa->hci_family = AF_BLUETOOTH;
 326                 strlcpy(sa->hci_node, NG_PEER_NODE_NAME(hook),
 327                         sizeof(sa->hci_node));
 328
 329                 NGI_GET_M(item, nam->m_next);
 330                 NGI_M(item) = nam;
 331
 332                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 333                 if (NG_BT_ITEMQ_FULL(&ng_btsocket_hci_raw_queue)) {
 334                         NG_BTSOCKET_HCI_RAW_ERR(
 335 "%s: Input queue is full\n", __func__);
 336
 337                         NG_BT_ITEMQ_DROP(&ng_btsocket_hci_raw_queue);
 338                         NG_FREE_ITEM(item);
 339                         error = ENOBUFS;
 340                 } else {
 341                         NG_BT_ITEMQ_ENQUEUE(&ng_btsocket_hci_raw_queue, item);
 342                         error = ng_btsocket_hci_raw_wakeup_input_task();
 343                 }
 344                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 345         } else {
 346                 NG_BTSOCKET_HCI_RAW_ERR(
 347 "%s: Failed to allocate address mbuf\n", __func__);
 348
 349                 NG_FREE_ITEM(item);
 350                 error = ENOBUFS;
 351         }
 352
 353         return (error);
 354 } /* ng_btsocket_hci_raw_node_rcvdata */
 355
 356 /****************************************************************************
 357  ****************************************************************************
 358  **                              Sockets specific
 359  ****************************************************************************
 360  ****************************************************************************/
 361
 362 /*
 363  * Get next token. We need token to avoid theoretical race where process
 364  * submits ioctl() message then interrupts ioctl() and re-submits another
 365  * ioctl() on the same socket *before* first ioctl() complete.
 366  */
 367
 368 static void
 369 ng_btsocket_hci_raw_get_token(u_int32_t *token)
 370 {
 371         mtx_lock(&ng_btsocket_hci_raw_token_mtx);
 372
 373         if (++ ng_btsocket_hci_raw_token == 0)
 374                 ng_btsocket_hci_raw_token = 1;
 375
 376         *token = ng_btsocket_hci_raw_token;
 377
 378         mtx_unlock(&ng_btsocket_hci_raw_token_mtx);
 379 } /* ng_btsocket_hci_raw_get_token */
 380
 381 /*
 382  * Send Netgraph message to the node - do not expect reply
 383  */
 384
 385 static int
 386 ng_btsocket_hci_raw_send_ngmsg(char *path, int cmd, void *arg, int arglen)
 387 {
 388         struct ng_mesg  *msg = NULL;
 389         int              error = 0;
 390
 391         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, arglen, M_NOWAIT);
 392         if (msg == NULL)
 393                 return (ENOMEM);
 394
 395         if (arg != NULL && arglen > 0)
 396                 bcopy(arg, msg->data, arglen);
 397
 398         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
 399
 400         return (error);
 401 } /* ng_btsocket_hci_raw_send_ngmsg */
 402
 403 /*
 404  * Send Netgraph message to the node (no data) and wait for reply
 405  */
 406
 407 static int
 408 ng_btsocket_hci_raw_send_sync_ngmsg(ng_btsocket_hci_raw_pcb_p pcb, char *path,
 409                 int cmd, void *rsp, int rsplen)
 410 {
 411         struct ng_mesg  *msg = NULL;
 412         int              error = 0;
 413
 414         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 415
 416         NG_MKMESSAGE(msg, NGM_HCI_COOKIE, cmd, 0, M_NOWAIT);
 417         if (msg == NULL)
 418                 return (ENOMEM);
 419
 420         ng_btsocket_hci_raw_get_token(&msg->header.token);
 421         pcb->token = msg->header.token;
 422         pcb->msg = NULL;
 423
 424         NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
 425         if (error != 0) {
 426                 pcb->token = 0;
 427                 return (error);
 428         }
 429
 430         error = msleep(&pcb->msg, &pcb->pcb_mtx, PZERO|PCATCH, "hcictl",
 431                         ng_btsocket_hci_raw_ioctl_timeout * hz);
 432         pcb->token = 0;
 433
 434         if (error != 0)
 435                 return (error);
 436
 437         if (pcb->msg != NULL && pcb->msg->header.cmd == cmd)
 438                 bcopy(pcb->msg->data, rsp, rsplen);
 439         else
 440                 error = EINVAL;
 441
 442         NG_FREE_MSG(pcb->msg); /* checks for != NULL */
 443
 444         return (0);
 445 } /* ng_btsocket_hci_raw_send_sync_ngmsg */
 446
 447 /*
 448  * Create control information for the packet
 449  */
 450
 451 static void
 452 ng_btsocket_hci_raw_savctl(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf **ctl,
 453                 struct mbuf *m)
 454 {
 455         int             dir;
 456         struct timeval  tv;
 457
 458         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 459
 460         if (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION) {
 461                 dir = (m->m_flags & M_PROTO1)? 1 : 0;
 462                 *ctl = sbcreatecontrol((caddr_t) &dir, sizeof(dir),
 463                                         SCM_HCI_RAW_DIRECTION, SOL_HCI_RAW);
 464                 if (*ctl != NULL)
 465                         ctl = &((*ctl)->m_next);
 466         }
 467
 468         if (pcb->so->so_options & SO_TIMESTAMP) {
 469                 microtime(&tv);
 470                 *ctl = sbcreatecontrol((caddr_t) &tv, sizeof(tv),
 471                                         SCM_TIMESTAMP, SOL_SOCKET);
 472                 if (*ctl != NULL)
 473                         ctl = &((*ctl)->m_next);
 474         }
 475 } /* ng_btsocket_hci_raw_savctl */
 476
 477 /*
 478  * Raw HCI sockets data input routine
 479  */
 480
 481 static void
 482 ng_btsocket_hci_raw_data_input(struct mbuf *nam)
 483 {
 484         ng_btsocket_hci_raw_pcb_p        pcb = NULL;
 485         struct mbuf                     *m0 = NULL, *m = NULL;
 486         struct sockaddr_hci             *sa = NULL;
 487
 488         m0 = nam->m_next;
 489         nam->m_next = NULL;
 490
 491         KASSERT((nam->m_type == MT_SONAME),
 492                 ("%s: m_type=%d\n", __func__, nam->m_type));
 493         KASSERT((m0->m_flags & M_PKTHDR),
 494                 ("%s: m_flags=%#x\n", __func__, m0->m_flags));
 495
 496         sa = mtod(nam, struct sockaddr_hci *);
 497
 498         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 499
 500         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
 501
 502                 mtx_lock(&pcb->pcb_mtx);
 503
 504                 /*
 505                  * If socket was bound then check address and
 506                  *  make sure it matches.
 507                  */
 508
 509                 if (pcb->addr.hci_node[0] != 0 &&
 510                     strcmp(sa->hci_node, pcb->addr.hci_node) != 0)
 511                         goto next;
 512
 513                 /*
 514                  * Check packet against filters
 515                  * XXX do we have to call m_pullup() here?
 516                  */
 517
 518                 if (ng_btsocket_hci_raw_filter(pcb, m0, 1) != 0)
 519                         goto next;
 520
 521                 /*
 522                  * Make a copy of the packet, append to the socket's
 523                  * receive queue and wakeup socket. sbappendaddr()
 524                  * will check if socket has enough buffer space.
 525                  */
 526
 527                 m = m_dup(m0, M_NOWAIT);
 528                 if (m != NULL) {
 529                         struct mbuf     *ctl = NULL;
 530
 531                         ng_btsocket_hci_raw_savctl(pcb, &ctl, m);
 532
 533                         if (sbappendaddr(&pcb->so->so_rcv,
 534                                         (struct sockaddr *) sa, m, ctl))
 535                                 sorwakeup(pcb->so);
 536                         else {
 537                                 NG_BTSOCKET_HCI_RAW_INFO(
 538 "%s: sbappendaddr() failed\n", __func__);
 539
 540                                 NG_FREE_M(m);
 541                                 NG_FREE_M(ctl);
 542                         }
 543                 }
 544 next:
 545                 mtx_unlock(&pcb->pcb_mtx);
 546         }
 547
 548         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 549
 550         NG_FREE_M(nam);
 551         NG_FREE_M(m0);
 552 } /* ng_btsocket_hci_raw_data_input */
 553
 554 /*
 555  * Raw HCI sockets message input routine
 556  */
 557
 558 static void
 559 ng_btsocket_hci_raw_msg_input(struct ng_mesg *msg)
 560 {
 561         ng_btsocket_hci_raw_pcb_p       pcb = NULL;
 562
 563         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 564
 565         LIST_FOREACH(pcb, &ng_btsocket_hci_raw_sockets, next) {
 566                 mtx_lock(&pcb->pcb_mtx);
 567
 568                 if (msg->header.token == pcb->token) {
 569                         pcb->msg = msg;
 570                         wakeup(&pcb->msg);
 571
 572                         mtx_unlock(&pcb->pcb_mtx);
 573                         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 574
 575                         return;
 576                 }
 577
 578                 mtx_unlock(&pcb->pcb_mtx);
 579         }
 580
 581         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 582
 583         NG_FREE_MSG(msg); /* checks for != NULL */
 584 } /* ng_btsocket_hci_raw_msg_input */
 585
 586 /*
 587  * Raw HCI sockets input routines
 588  */
 589
 590 static void
 591 ng_btsocket_hci_raw_input(void *context, int pending)
 592 {
 593         item_p  item = NULL;
 594
 595         for (;;) {
 596                 mtx_lock(&ng_btsocket_hci_raw_queue_mtx);
 597                 NG_BT_ITEMQ_DEQUEUE(&ng_btsocket_hci_raw_queue, item);
 598                 mtx_unlock(&ng_btsocket_hci_raw_queue_mtx);
 599
 600                 if (item == NULL)
 601                         break;
 602
 603                 switch(item->el_flags & NGQF_TYPE) {
 604                 case NGQF_DATA: {
 605                         struct mbuf     *m = NULL;
 606
 607                         NGI_GET_M(item, m);
 608                         ng_btsocket_hci_raw_data_input(m);
 609                         } break;
 610
 611                 case NGQF_MESG: {
 612                         struct ng_mesg  *msg = NULL;
 613
 614                         NGI_GET_MSG(item, msg);
 615                         ng_btsocket_hci_raw_msg_input(msg);
 616                         } break;
 617
 618                 default:
 619                         KASSERT(0,
 620 ("%s: invalid item type=%ld\n", __func__, (item->el_flags & NGQF_TYPE)));
 621                         break;
 622                 }
 623
 624                 NG_FREE_ITEM(item);
 625         }
 626 } /* ng_btsocket_hci_raw_input */
 627
 628 /*
 629  * Raw HCI sockets output routine
 630  */
 631
 632 static void
 633 ng_btsocket_hci_raw_output(node_p node, hook_p hook, void *arg1, int arg2)
 634 {
 635         struct mbuf             *nam = (struct mbuf *) arg1, *m = NULL;
 636         struct sockaddr_hci     *sa = NULL;
 637         int                      error;
 638
 639         m = nam->m_next;
 640         nam->m_next = NULL;
 641
 642         KASSERT((nam->m_type == MT_SONAME),
 643                 ("%s: m_type=%d\n", __func__, nam->m_type));
 644         KASSERT((m->m_flags & M_PKTHDR),
 645                 ("%s: m_flags=%#x\n", __func__, m->m_flags));
 646
 647         sa = mtod(nam, struct sockaddr_hci *);
 648
 649         /*
 650          * Find downstream hook
 651          * XXX For now access node hook list directly. Should be safe because
 652          * we used ng_send_fn() and we should have exclusive lock on the node.
 653          */
 654
 655         LIST_FOREACH(hook, &node->nd_hooks, hk_hooks) {
 656                 if (hook == NULL || NG_HOOK_NOT_VALID(hook) ||
 657                     NG_NODE_NOT_VALID(NG_PEER_NODE(hook)))
 658                         continue;
 659
 660                 if (strcmp(sa->hci_node, NG_PEER_NODE_NAME(hook)) == 0) {
 661                         NG_SEND_DATA_ONLY(error, hook, m); /* sets m to NULL */
 662                         break;
 663                 }
 664         }
 665
 666         NG_FREE_M(nam); /* check for != NULL */
 667         NG_FREE_M(m);
 668 } /* ng_btsocket_hci_raw_output */
 669
 670 /*
 671  * Check frame against security and socket filters.
 672  * d (direction bit) == 1 means incoming frame.
 673  */
 674
 675 static int
 676 ng_btsocket_hci_raw_filter(ng_btsocket_hci_raw_pcb_p pcb, struct mbuf *m, int d)
 677 {
 678         int     type, event, opcode;
 679
 680         mtx_assert(&pcb->pcb_mtx, MA_OWNED);
 681
 682         switch ((type = *mtod(m, u_int8_t *))) {
 683         case NG_HCI_CMD_PKT:
 684                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)) {
 685                         opcode = le16toh(mtod(m, ng_hci_cmd_pkt_t *)->opcode);
 686
 687                         if (!bit_test(
 688 ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF(opcode) - 1],
 689 NG_HCI_OCF(opcode) - 1))
 690                                 return (EPERM);
 691                 }
 692
 693                 if (d && !bit_test(pcb->filter.packet_mask, NG_HCI_CMD_PKT - 1))
 694                         return (EPERM);
 695                 break;
 696
 697         case NG_HCI_ACL_DATA_PKT:
 698         case NG_HCI_SCO_DATA_PKT:
 699                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED) ||
 700                     !bit_test(pcb->filter.packet_mask, type - 1) ||
 701                     !d)
 702                         return (EPERM);
 703                 break;
 704
 705         case NG_HCI_EVENT_PKT:
 706                 if (!d)
 707                         return (EINVAL);
 708
 709                 event = mtod(m, ng_hci_event_pkt_t *)->event - 1;
 710
 711                 if (!(pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED))
 712                         if (!bit_test(ng_btsocket_hci_raw_sec_filter->events, event))
 713                                 return (EPERM);
 714
 715                 if (!bit_test(pcb->filter.event_mask, event))
 716                         return (EPERM);
 717                 break;
 718
 719         default:
 720                 return (EINVAL);
 721         }
 722
 723         return (0);
 724 } /* ng_btsocket_hci_raw_filter */
 725
 726 /*
 727  * Initialize everything
 728  */
 729
 730 void
 731 ng_btsocket_hci_raw_init(void)
 732 {
 733         bitstr_t        *f = NULL;
 734         int              error = 0;
 735
 736         /* Skip initialization of globals for non-default instances. */
 737         if (!IS_DEFAULT_VNET(curvnet))
 738                 return;
 739
 740         ng_btsocket_hci_raw_node = NULL;
 741         ng_btsocket_hci_raw_debug_level = NG_BTSOCKET_WARN_LEVEL;
 742         ng_btsocket_hci_raw_ioctl_timeout = 5;
 743
 744         /* Register Netgraph node type */
 745         error = ng_newtype(&typestruct);
 746         if (error != 0) {
 747                 NG_BTSOCKET_HCI_RAW_ALERT(
 748 "%s: Could not register Netgraph node type, error=%d\n", __func__, error);
 749
 750                 return;
 751         }
 752
 753         /* Create Netgrapg node */
 754         error = ng_make_node_common(&typestruct, &ng_btsocket_hci_raw_node);
 755         if (error != 0) {
 756                 NG_BTSOCKET_HCI_RAW_ALERT(
 757 "%s: Could not create Netgraph node, error=%d\n", __func__, error);
 758
 759                 ng_btsocket_hci_raw_node = NULL;
 760
 761                 return;
 762         }
 763
 764         error = ng_name_node(ng_btsocket_hci_raw_node,
 765                                 NG_BTSOCKET_HCI_RAW_NODE_TYPE);
 766         if (error != 0) {
 767                 NG_BTSOCKET_HCI_RAW_ALERT(
 768 "%s: Could not name Netgraph node, error=%d\n", __func__, error);
 769
 770                 NG_NODE_UNREF(ng_btsocket_hci_raw_node);
 771                 ng_btsocket_hci_raw_node = NULL;
 772
 773                 return;
 774         }
 775
 776         /* Create input queue */
 777         NG_BT_ITEMQ_INIT(&ng_btsocket_hci_raw_queue, 300);
 778         mtx_init(&ng_btsocket_hci_raw_queue_mtx,
 779                 "btsocks_hci_raw_queue_mtx", NULL, MTX_DEF);
 780         TASK_INIT(&ng_btsocket_hci_raw_task, 0,
 781                 ng_btsocket_hci_raw_input, NULL);
 782
 783         /* Create list of sockets */
 784         LIST_INIT(&ng_btsocket_hci_raw_sockets);
 785         mtx_init(&ng_btsocket_hci_raw_sockets_mtx,
 786                 "btsocks_hci_raw_sockets_mtx", NULL, MTX_DEF);
 787
 788         /* Tokens */
 789         ng_btsocket_hci_raw_token = 0;
 790         mtx_init(&ng_btsocket_hci_raw_token_mtx,
 791                 "btsocks_hci_raw_token_mtx", NULL, MTX_DEF);
 792
 793         /*
 794          * Security filter
 795          * XXX never free()ed
 796          */
 797         ng_btsocket_hci_raw_sec_filter =
 798             malloc(sizeof(struct ng_btsocket_hci_raw_sec_filter),
 799                 M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
 800         if (ng_btsocket_hci_raw_sec_filter == NULL) {
 801                 printf("%s: Could not allocate security filter!\n", __func__);
 802                 return;
 803         }
 804
 805         /*
 806          * XXX How paranoid can we get?
 807          *
 808          * Initialize security filter. If bit is set in the mask then
 809          * unprivileged socket is allowed to send (receive) this command
 810          * (event).
 811          */
 812
 813         /* Enable all events */
 814         memset(&ng_btsocket_hci_raw_sec_filter->events, 0xff,
 815                 sizeof(ng_btsocket_hci_raw_sec_filter->events)/
 816                         sizeof(ng_btsocket_hci_raw_sec_filter->events[0]));
 817
 818         /* Disable some critical events */
 819         f = ng_btsocket_hci_raw_sec_filter->events;
 820         bit_clear(f, NG_HCI_EVENT_RETURN_LINK_KEYS - 1);
 821         bit_clear(f, NG_HCI_EVENT_LINK_KEY_NOTIFICATION - 1);
 822         bit_clear(f, NG_HCI_EVENT_VENDOR - 1);
 823
 824         /* Commands - Link control */
 825         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_CONTROL-1];
 826         bit_set(f, NG_HCI_OCF_INQUIRY - 1);
 827         bit_set(f, NG_HCI_OCF_INQUIRY_CANCEL - 1);
 828         bit_set(f, NG_HCI_OCF_PERIODIC_INQUIRY - 1);
 829         bit_set(f, NG_HCI_OCF_EXIT_PERIODIC_INQUIRY - 1);
 830         bit_set(f, NG_HCI_OCF_REMOTE_NAME_REQ - 1);
 831         bit_set(f, NG_HCI_OCF_READ_REMOTE_FEATURES - 1);
 832         bit_set(f, NG_HCI_OCF_READ_REMOTE_VER_INFO - 1);
 833         bit_set(f, NG_HCI_OCF_READ_CLOCK_OFFSET - 1);
 834
 835         /* Commands - Link policy */
 836         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LINK_POLICY-1];
 837         bit_set(f, NG_HCI_OCF_ROLE_DISCOVERY - 1);
 838         bit_set(f, NG_HCI_OCF_READ_LINK_POLICY_SETTINGS - 1);
 839
 840         /* Commands - Host controller and baseband */
 841         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_HC_BASEBAND-1];
 842         bit_set(f, NG_HCI_OCF_READ_PIN_TYPE - 1);
 843         bit_set(f, NG_HCI_OCF_READ_LOCAL_NAME - 1);
 844         bit_set(f, NG_HCI_OCF_READ_CON_ACCEPT_TIMO - 1);
 845         bit_set(f, NG_HCI_OCF_READ_PAGE_TIMO - 1);
 846         bit_set(f, NG_HCI_OCF_READ_SCAN_ENABLE - 1);
 847         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_ACTIVITY - 1);
 848         bit_set(f, NG_HCI_OCF_READ_INQUIRY_SCAN_ACTIVITY - 1);
 849         bit_set(f, NG_HCI_OCF_READ_AUTH_ENABLE - 1);
 850         bit_set(f, NG_HCI_OCF_READ_ENCRYPTION_MODE - 1);
 851         bit_set(f, NG_HCI_OCF_READ_UNIT_CLASS - 1);
 852         bit_set(f, NG_HCI_OCF_READ_VOICE_SETTINGS - 1);
 853         bit_set(f, NG_HCI_OCF_READ_AUTO_FLUSH_TIMO - 1);
 854         bit_set(f, NG_HCI_OCF_READ_NUM_BROADCAST_RETRANS - 1);
 855         bit_set(f, NG_HCI_OCF_READ_HOLD_MODE_ACTIVITY - 1);
 856         bit_set(f, NG_HCI_OCF_READ_XMIT_LEVEL - 1);
 857         bit_set(f, NG_HCI_OCF_READ_SCO_FLOW_CONTROL - 1);
 858         bit_set(f, NG_HCI_OCF_READ_LINK_SUPERVISION_TIMO - 1);
 859         bit_set(f, NG_HCI_OCF_READ_SUPPORTED_IAC_NUM - 1);
 860         bit_set(f, NG_HCI_OCF_READ_IAC_LAP - 1);
 861         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN_PERIOD - 1);
 862         bit_set(f, NG_HCI_OCF_READ_PAGE_SCAN - 1);
 863
 864         /* Commands - Informational */
 865         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_INFO - 1];
 866         bit_set(f, NG_HCI_OCF_READ_LOCAL_VER - 1);
 867         bit_set(f, NG_HCI_OCF_READ_LOCAL_FEATURES - 1);
 868         bit_set(f, NG_HCI_OCF_READ_BUFFER_SIZE - 1);
 869         bit_set(f, NG_HCI_OCF_READ_COUNTRY_CODE - 1);
 870         bit_set(f, NG_HCI_OCF_READ_BDADDR - 1);
 871
 872         /* Commands - Status */
 873         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_STATUS - 1];
 874         bit_set(f, NG_HCI_OCF_READ_FAILED_CONTACT_CNTR - 1);
 875         bit_set(f, NG_HCI_OCF_GET_LINK_QUALITY - 1);
 876         bit_set(f, NG_HCI_OCF_READ_RSSI - 1);
 877
 878         /* Commands - Testing */
 879         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_TESTING - 1];
 880         bit_set(f, NG_HCI_OCF_READ_LOOPBACK_MODE - 1);
 881         /*Commands - LE*/
 882         f = ng_btsocket_hci_raw_sec_filter->commands[NG_HCI_OGF_LE -1];
 883
 884 } /* ng_btsocket_hci_raw_init */
 885
 886 /*
 887  * Abort connection on socket
 888  */
 889
 890 void
 891 ng_btsocket_hci_raw_abort(struct socket *so)
 892 {
 893 } /* ng_btsocket_hci_raw_abort */
 894
 895 void
 896 ng_btsocket_hci_raw_close(struct socket *so)
 897 {
 898 } /* ng_btsocket_hci_raw_close */
 899
 900 /*
 901  * Create new raw HCI socket
 902  */
 903
 904 int
 905 ng_btsocket_hci_raw_attach(struct socket *so, int proto, struct thread *td)
 906 {
 907         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
 908         int                             error = 0;
 909
 910         if (pcb != NULL)
 911                 return (EISCONN);
 912
 913         if (ng_btsocket_hci_raw_node == NULL)
 914                 return (EPROTONOSUPPORT);
 915         if (proto != BLUETOOTH_PROTO_HCI)
 916                 return (EPROTONOSUPPORT);
 917         if (so->so_type != SOCK_RAW)
 918                 return (ESOCKTNOSUPPORT);
 919
 920         error = soreserve(so, NG_BTSOCKET_HCI_RAW_SENDSPACE,
 921                                 NG_BTSOCKET_HCI_RAW_RECVSPACE);
 922         if (error != 0)
 923                 return (error);
 924
 925         pcb = malloc(sizeof(*pcb),
 926                 M_NETGRAPH_BTSOCKET_HCI_RAW, M_NOWAIT|M_ZERO);
 927         if (pcb == NULL)
 928                 return (ENOMEM);
 929
 930         so->so_pcb = (caddr_t) pcb;
 931         pcb->so = so;
 932
 933         if (priv_check(td, PRIV_NETBLUETOOTH_RAW) == 0)
 934                 pcb->flags |= NG_BTSOCKET_HCI_RAW_PRIVILEGED;
 935
 936         /*
 937          * Set default socket filter. By default socket only accepts HCI
 938          * Command_Complete and Command_Status event packets.
 939          */
 940
 941         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_COMPL - 1);
 942         bit_set(pcb->filter.event_mask, NG_HCI_EVENT_COMMAND_STATUS - 1);
 943
 944         mtx_init(&pcb->pcb_mtx, "btsocks_hci_raw_pcb_mtx", NULL, MTX_DEF);
 945
 946         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
 947         LIST_INSERT_HEAD(&ng_btsocket_hci_raw_sockets, pcb, next);
 948         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
 949
 950         return (0);
 951 } /* ng_btsocket_hci_raw_attach */
 952
 953 /*
 954  * Bind raw HCI socket
 955  */
 956
 957 int
 958 ng_btsocket_hci_raw_bind(struct socket *so, struct sockaddr *nam,
 959                 struct thread *td)
 960 {
 961         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
 962         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
 963
 964         if (pcb == NULL)
 965                 return (EINVAL);
 966         if (ng_btsocket_hci_raw_node == NULL)
 967                 return (EINVAL);
 968
 969         if (sa == NULL)
 970                 return (EINVAL);
 971         if (sa->hci_family != AF_BLUETOOTH)
 972                 return (EAFNOSUPPORT);
 973         if (sa->hci_len != sizeof(*sa))
 974                 return (EINVAL);
 975         if (sa->hci_node[0] == 0)
 976                 return (EINVAL);
 977
 978         mtx_lock(&pcb->pcb_mtx);
 979         bcopy(sa, &pcb->addr, sizeof(pcb->addr));
 980         mtx_unlock(&pcb->pcb_mtx);
 981
 982         return (0);
 983 } /* ng_btsocket_hci_raw_bind */
 984
 985 /*
 986  * Connect raw HCI socket
 987  */
 988
 989 int
 990 ng_btsocket_hci_raw_connect(struct socket *so, struct sockaddr *nam,
 991                 struct thread *td)
 992 {
 993         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
 994         struct sockaddr_hci             *sa = (struct sockaddr_hci *) nam;
 995
 996         if (pcb == NULL)
 997                 return (EINVAL);
 998         if (ng_btsocket_hci_raw_node == NULL)
 999                 return (EINVAL);
1000
1001         if (sa == NULL)
1002                 return (EINVAL);
1003         if (sa->hci_family != AF_BLUETOOTH)
1004                 return (EAFNOSUPPORT);
1005         if (sa->hci_len != sizeof(*sa))
1006                 return (EINVAL);
1007         if (sa->hci_node[0] == 0)
1008                 return (EDESTADDRREQ);
1009
1010         mtx_lock(&pcb->pcb_mtx);
1011
1012         if (bcmp(sa, &pcb->addr, sizeof(pcb->addr)) != 0) {
1013                 mtx_unlock(&pcb->pcb_mtx);
1014                 return (EADDRNOTAVAIL);
1015         }
1016
1017         soisconnected(so);
1018
1019         mtx_unlock(&pcb->pcb_mtx);
1020
1021         return (0);
1022 } /* ng_btsocket_hci_raw_connect */
1023
1024 /*
1025  * Process ioctl on socket
1026  */
1027
1028 int
1029 ng_btsocket_hci_raw_control(struct socket *so, u_long cmd, caddr_t data,
1030                 struct ifnet *ifp, struct thread *td)
1031 {
1032         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1033         char                             path[NG_NODESIZ + 1];
1034         struct ng_mesg                  *msg = NULL;
1035         int                              error = 0;
1036
1037         if (pcb == NULL)
1038                 return (EINVAL);
1039         if (ng_btsocket_hci_raw_node == NULL)
1040                 return (EINVAL);
1041
1042         mtx_lock(&pcb->pcb_mtx);
1043
1044         /* Check if we have device name */
1045         if (pcb->addr.hci_node[0] == 0) {
1046                 mtx_unlock(&pcb->pcb_mtx);
1047                 return (EHOSTUNREACH);
1048         }
1049
1050         /* Check if we have pending ioctl() */
1051         if (pcb->token != 0) {
1052                 mtx_unlock(&pcb->pcb_mtx);
1053                 return (EBUSY);
1054         }
1055
1056         snprintf(path, sizeof(path), "%s:", pcb->addr.hci_node);
1057
1058         switch (cmd) {
1059         case SIOC_HCI_RAW_NODE_GET_STATE: {
1060                 struct ng_btsocket_hci_raw_node_state   *p =
1061                         (struct ng_btsocket_hci_raw_node_state *) data;
1062
1063                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1064                                 NGM_HCI_NODE_GET_STATE,
1065                                 &p->state, sizeof(p->state));
1066                 } break;
1067
1068         case SIOC_HCI_RAW_NODE_INIT:
1069                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1070                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1071                                         NGM_HCI_NODE_INIT, NULL, 0);
1072                 else
1073                         error = EPERM;
1074                 break;
1075
1076         case SIOC_HCI_RAW_NODE_GET_DEBUG: {
1077                 struct ng_btsocket_hci_raw_node_debug   *p =
1078                         (struct ng_btsocket_hci_raw_node_debug *) data;
1079
1080                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1081                                 NGM_HCI_NODE_GET_DEBUG,
1082                                 &p->debug, sizeof(p->debug));
1083                 } break;
1084
1085         case SIOC_HCI_RAW_NODE_SET_DEBUG: {
1086                 struct ng_btsocket_hci_raw_node_debug   *p =
1087                         (struct ng_btsocket_hci_raw_node_debug *) data;
1088
1089                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1090                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1091                                         NGM_HCI_NODE_SET_DEBUG, &p->debug,
1092                                         sizeof(p->debug));
1093                 else
1094                         error = EPERM;
1095                 } break;
1096
1097         case SIOC_HCI_RAW_NODE_GET_BUFFER: {
1098                 struct ng_btsocket_hci_raw_node_buffer  *p =
1099                         (struct ng_btsocket_hci_raw_node_buffer *) data;
1100
1101                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1102                                 NGM_HCI_NODE_GET_BUFFER,
1103                                 &p->buffer, sizeof(p->buffer));
1104                 } break;
1105
1106         case SIOC_HCI_RAW_NODE_GET_BDADDR: {
1107                 struct ng_btsocket_hci_raw_node_bdaddr  *p =
1108                         (struct ng_btsocket_hci_raw_node_bdaddr *) data;
1109
1110                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1111                                 NGM_HCI_NODE_GET_BDADDR,
1112                                 &p->bdaddr, sizeof(p->bdaddr));
1113                 } break;
1114
1115         case SIOC_HCI_RAW_NODE_GET_FEATURES: {
1116                 struct ng_btsocket_hci_raw_node_features        *p =
1117                         (struct ng_btsocket_hci_raw_node_features *) data;
1118
1119                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1120                                 NGM_HCI_NODE_GET_FEATURES,
1121                                 &p->features, sizeof(p->features));
1122                 } break;
1123
1124         case SIOC_HCI_RAW_NODE_GET_STAT: {
1125                 struct ng_btsocket_hci_raw_node_stat    *p =
1126                         (struct ng_btsocket_hci_raw_node_stat *) data;
1127
1128                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1129                                 NGM_HCI_NODE_GET_STAT,
1130                                 &p->stat, sizeof(p->stat));
1131                 } break;
1132
1133         case SIOC_HCI_RAW_NODE_RESET_STAT:
1134                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1135                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1136                                         NGM_HCI_NODE_RESET_STAT, NULL, 0);
1137                 else
1138                         error = EPERM;
1139                 break;
1140
1141         case SIOC_HCI_RAW_NODE_FLUSH_NEIGHBOR_CACHE:
1142                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1143                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1144                                         NGM_HCI_NODE_FLUSH_NEIGHBOR_CACHE,
1145                                         NULL, 0);
1146                 else
1147                         error = EPERM;
1148                 break;
1149
1150         case SIOC_HCI_RAW_NODE_GET_NEIGHBOR_CACHE:  {
1151                 struct ng_btsocket_hci_raw_node_neighbor_cache  *p =
1152                         (struct ng_btsocket_hci_raw_node_neighbor_cache *) data;
1153                 ng_hci_node_get_neighbor_cache_ep               *p1 = NULL;
1154                 ng_hci_node_neighbor_cache_entry_ep             *p2 = NULL;
1155
1156                 if (p->num_entries <= 0 ||
1157                     p->num_entries > NG_HCI_MAX_NEIGHBOR_NUM ||
1158                     p->entries == NULL) {
1159                         mtx_unlock(&pcb->pcb_mtx);
1160                         return (EINVAL);
1161                 }
1162
1163                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE,
1164                         NGM_HCI_NODE_GET_NEIGHBOR_CACHE, 0, M_NOWAIT);
1165                 if (msg == NULL) {
1166                         mtx_unlock(&pcb->pcb_mtx);
1167                         return (ENOMEM);
1168                 }
1169                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1170                 pcb->token = msg->header.token;
1171                 pcb->msg = NULL;
1172
1173                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1174                 if (error != 0) {
1175                         pcb->token = 0;
1176                         mtx_unlock(&pcb->pcb_mtx);
1177                         return (error);
1178                 }
1179
1180                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1181                                 PZERO|PCATCH, "hcictl",
1182                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1183                 pcb->token = 0;
1184
1185                 if (error != 0) {
1186                         mtx_unlock(&pcb->pcb_mtx);
1187                         return (error);
1188                 }
1189
1190                 msg = pcb->msg;
1191                 pcb->msg = NULL;
1192
1193                 mtx_unlock(&pcb->pcb_mtx);
1194
1195                 if (msg != NULL &&
1196                     msg->header.cmd == NGM_HCI_NODE_GET_NEIGHBOR_CACHE) {
1197                         /* Return data back to user space */
1198                         p1 = (ng_hci_node_get_neighbor_cache_ep *)(msg->data);
1199                         p2 = (ng_hci_node_neighbor_cache_entry_ep *)(p1 + 1);
1200
1201                         p->num_entries = min(p->num_entries, p1->num_entries);
1202                         if (p->num_entries > 0)
1203                                 error = copyout((caddr_t) p2,
1204                                                 (caddr_t) p->entries,
1205                                                 p->num_entries * sizeof(*p2));
1206                 } else
1207                         error = EINVAL;
1208
1209                 NG_FREE_MSG(msg); /* checks for != NULL */
1210                 return (error);
1211                 } /* NOTREACHED */
1212
1213         case SIOC_HCI_RAW_NODE_GET_CON_LIST: {
1214                 struct ng_btsocket_hci_raw_con_list     *p =
1215                         (struct ng_btsocket_hci_raw_con_list *) data;
1216                 ng_hci_node_con_list_ep                 *p1 = NULL;
1217                 ng_hci_node_con_ep                      *p2 = NULL;
1218
1219                 if (p->num_connections == 0 ||
1220                     p->num_connections > NG_HCI_MAX_CON_NUM ||
1221                     p->connections == NULL) {
1222                         mtx_unlock(&pcb->pcb_mtx);
1223                         return (EINVAL);
1224                 }
1225
1226                 NG_MKMESSAGE(msg, NGM_HCI_COOKIE, NGM_HCI_NODE_GET_CON_LIST,
1227                         0, M_NOWAIT);
1228                 if (msg == NULL) {
1229                         mtx_unlock(&pcb->pcb_mtx);
1230                         return (ENOMEM);
1231                 }
1232                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1233                 pcb->token = msg->header.token;
1234                 pcb->msg = NULL;
1235
1236                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, path, 0);
1237                 if (error != 0) {
1238                         pcb->token = 0;
1239                         mtx_unlock(&pcb->pcb_mtx);
1240                         return (error);
1241                 }
1242
1243                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1244                                 PZERO|PCATCH, "hcictl",
1245                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1246                 pcb->token = 0;
1247
1248                 if (error != 0) {
1249                         mtx_unlock(&pcb->pcb_mtx);
1250                         return (error);
1251                 }
1252
1253                 msg = pcb->msg;
1254                 pcb->msg = NULL;
1255
1256                 mtx_unlock(&pcb->pcb_mtx);
1257
1258                 if (msg != NULL &&
1259                     msg->header.cmd == NGM_HCI_NODE_GET_CON_LIST) {
1260                         /* Return data back to user space */
1261                         p1 = (ng_hci_node_con_list_ep *)(msg->data);
1262                         p2 = (ng_hci_node_con_ep *)(p1 + 1);
1263
1264                         p->num_connections = min(p->num_connections,
1265                                                 p1->num_connections);
1266                         if (p->num_connections > 0)
1267                                 error = copyout((caddr_t) p2,
1268                                         (caddr_t) p->connections,
1269                                         p->num_connections * sizeof(*p2));
1270                 } else
1271                         error = EINVAL;
1272
1273                 NG_FREE_MSG(msg); /* checks for != NULL */
1274                 return (error);
1275                 } /* NOTREACHED */
1276
1277         case SIOC_HCI_RAW_NODE_GET_LINK_POLICY_MASK: {
1278                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p =
1279                         (struct ng_btsocket_hci_raw_node_link_policy_mask *)
1280                                 data;
1281
1282                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1283                                 NGM_HCI_NODE_GET_LINK_POLICY_SETTINGS_MASK,
1284                                 &p->policy_mask, sizeof(p->policy_mask));
1285                 } break;
1286
1287         case SIOC_HCI_RAW_NODE_SET_LINK_POLICY_MASK: {
1288                 struct ng_btsocket_hci_raw_node_link_policy_mask        *p =
1289                         (struct ng_btsocket_hci_raw_node_link_policy_mask *)
1290                                 data;
1291
1292                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1293                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1294                                         NGM_HCI_NODE_SET_LINK_POLICY_SETTINGS_MASK,
1295                                         &p->policy_mask,
1296                                         sizeof(p->policy_mask));
1297                 else
1298                         error = EPERM;
1299                 } break;
1300
1301         case SIOC_HCI_RAW_NODE_GET_PACKET_MASK: {
1302                 struct ng_btsocket_hci_raw_node_packet_mask     *p =
1303                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1304
1305                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1306                                 NGM_HCI_NODE_GET_PACKET_MASK,
1307                                 &p->packet_mask, sizeof(p->packet_mask));
1308                 } break;
1309
1310         case SIOC_HCI_RAW_NODE_SET_PACKET_MASK: {
1311                 struct ng_btsocket_hci_raw_node_packet_mask     *p =
1312                         (struct ng_btsocket_hci_raw_node_packet_mask *) data;
1313
1314                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1315                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1316                                         NGM_HCI_NODE_SET_PACKET_MASK,
1317                                         &p->packet_mask,
1318                                         sizeof(p->packet_mask));
1319                 else
1320                         error = EPERM;
1321                 } break;
1322
1323         case SIOC_HCI_RAW_NODE_GET_ROLE_SWITCH: {
1324                 struct ng_btsocket_hci_raw_node_role_switch     *p =
1325                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1326
1327                 error = ng_btsocket_hci_raw_send_sync_ngmsg(pcb, path,
1328                                 NGM_HCI_NODE_GET_ROLE_SWITCH,
1329                                 &p->role_switch, sizeof(p->role_switch));
1330                 } break;
1331
1332         case SIOC_HCI_RAW_NODE_SET_ROLE_SWITCH: {
1333                 struct ng_btsocket_hci_raw_node_role_switch     *p =
1334                         (struct ng_btsocket_hci_raw_node_role_switch *) data;
1335
1336                 if (pcb->flags & NG_BTSOCKET_HCI_RAW_PRIVILEGED)
1337                         error = ng_btsocket_hci_raw_send_ngmsg(path,
1338                                         NGM_HCI_NODE_SET_ROLE_SWITCH,
1339                                         &p->role_switch,
1340                                         sizeof(p->role_switch));
1341                 else
1342                         error = EPERM;
1343                 } break;
1344
1345         case SIOC_HCI_RAW_NODE_LIST_NAMES: {
1346                 struct ng_btsocket_hci_raw_node_list_names      *nl =
1347                         (struct ng_btsocket_hci_raw_node_list_names *) data;
1348                 struct nodeinfo                                 *ni = nl->names;
1349
1350                 if (nl->num_names == 0) {
1351                         mtx_unlock(&pcb->pcb_mtx);
1352                         return (EINVAL);
1353                 }
1354
1355                 NG_MKMESSAGE(msg, NGM_GENERIC_COOKIE, NGM_LISTNAMES,
1356                         0, M_NOWAIT);
1357                 if (msg == NULL) {
1358                         mtx_unlock(&pcb->pcb_mtx);
1359                         return (ENOMEM);
1360                 }
1361                 ng_btsocket_hci_raw_get_token(&msg->header.token);
1362                 pcb->token = msg->header.token;
1363                 pcb->msg = NULL;
1364
1365                 NG_SEND_MSG_PATH(error, ng_btsocket_hci_raw_node, msg, ".:", 0);
1366                 if (error != 0) {
1367                         pcb->token = 0;
1368                         mtx_unlock(&pcb->pcb_mtx);
1369                         return (error);
1370                 }
1371
1372                 error = msleep(&pcb->msg, &pcb->pcb_mtx,
1373                                 PZERO|PCATCH, "hcictl",
1374                                 ng_btsocket_hci_raw_ioctl_timeout * hz);
1375                 pcb->token = 0;
1376
1377                 if (error != 0) {
1378                         mtx_unlock(&pcb->pcb_mtx);
1379                         return (error);
1380                 }
1381
1382                 msg = pcb->msg;
1383                 pcb->msg = NULL;
1384
1385                 mtx_unlock(&pcb->pcb_mtx);
1386
1387                 if (msg != NULL && msg->header.cmd == NGM_LISTNAMES) {
1388                         /* Return data back to user space */
1389                         struct namelist *nl1 = (struct namelist *) msg->data;
1390                         struct nodeinfo *ni1 = &nl1->nodeinfo[0];
1391
1392                         while (nl->num_names > 0 && nl1->numnames > 0) {
1393                                 if (strcmp(ni1->type, NG_HCI_NODE_TYPE) == 0) {
1394                                         error = copyout((caddr_t) ni1,
1395                                                         (caddr_t) ni,
1396                                                         sizeof(*ni));
1397                                         if (error != 0)
1398                                                 break;
1399
1400                                         nl->num_names --;
1401                                         ni ++;
1402                                 }
1403
1404                                 nl1->numnames --;
1405                                 ni1 ++;
1406                         }
1407
1408                         nl->num_names = ni - nl->names;
1409                 } else
1410                         error = EINVAL;
1411
1412                 NG_FREE_MSG(msg); /* checks for != NULL */
1413                 return (error);
1414                 } /* NOTREACHED */
1415
1416         default:
1417                 error = EINVAL;
1418                 break;
1419         }
1420
1421         mtx_unlock(&pcb->pcb_mtx);
1422
1423         return (error);
1424 } /* ng_btsocket_hci_raw_control */
1425
1426 /*
1427  * Process getsockopt/setsockopt system calls
1428  */
1429
1430 int
1431 ng_btsocket_hci_raw_ctloutput(struct socket *so, struct sockopt *sopt)
1432 {
1433         ng_btsocket_hci_raw_pcb_p               pcb = so2hci_raw_pcb(so);
1434         struct ng_btsocket_hci_raw_filter       filter;
1435         int                                     error = 0, dir;
1436
1437         if (pcb == NULL)
1438                 return (EINVAL);
1439         if (ng_btsocket_hci_raw_node == NULL)
1440                 return (EINVAL);
1441
1442         if (sopt->sopt_level != SOL_HCI_RAW)
1443                 return (0);
1444
1445         mtx_lock(&pcb->pcb_mtx);
1446
1447         switch (sopt->sopt_dir) {
1448         case SOPT_GET:
1449                 switch (sopt->sopt_name) {
1450                 case SO_HCI_RAW_FILTER:
1451                         error = sooptcopyout(sopt, &pcb->filter,
1452                                                 sizeof(pcb->filter));
1453                         break;
1454
1455                 case SO_HCI_RAW_DIRECTION:
1456                         dir = (pcb->flags & NG_BTSOCKET_HCI_RAW_DIRECTION)?1:0;
1457                         error = sooptcopyout(sopt, &dir, sizeof(dir));
1458                         break;
1459
1460                 default:
1461                         error = EINVAL;
1462                         break;
1463                 }
1464                 break;
1465
1466         case SOPT_SET:
1467                 switch (sopt->sopt_name) {
1468                 case SO_HCI_RAW_FILTER:
1469                         error = sooptcopyin(sopt, &filter, sizeof(filter),
1470                                                 sizeof(filter));
1471                         if (error == 0)
1472                                 bcopy(&filter, &pcb->filter,
1473                                                 sizeof(pcb->filter));
1474                         break;
1475
1476                 case SO_HCI_RAW_DIRECTION:
1477                         error = sooptcopyin(sopt, &dir, sizeof(dir),
1478                                                 sizeof(dir));
1479                         if (error != 0)
1480                                 break;
1481
1482                         if (dir)
1483                                 pcb->flags |= NG_BTSOCKET_HCI_RAW_DIRECTION;
1484                         else
1485                                 pcb->flags &= ~NG_BTSOCKET_HCI_RAW_DIRECTION;
1486                         break;
1487
1488                 default:
1489                         error = EINVAL;
1490                         break;
1491                 }
1492                 break;
1493
1494         default:
1495                 error = EINVAL;
1496                 break;
1497         }
1498
1499         mtx_unlock(&pcb->pcb_mtx);
1500
1501         return (error);
1502 } /* ng_btsocket_hci_raw_ctloutput */
1503
1504 /*
1505  * Detach raw HCI socket
1506  */
1507
1508 void
1509 ng_btsocket_hci_raw_detach(struct socket *so)
1510 {
1511         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1512
1513         KASSERT(pcb != NULL, ("ng_btsocket_hci_raw_detach: pcb == NULL"));
1514
1515         if (ng_btsocket_hci_raw_node == NULL)
1516                 return;
1517
1518         mtx_lock(&ng_btsocket_hci_raw_sockets_mtx);
1519         mtx_lock(&pcb->pcb_mtx);
1520
1521         LIST_REMOVE(pcb, next);
1522
1523         mtx_unlock(&pcb->pcb_mtx);
1524         mtx_unlock(&ng_btsocket_hci_raw_sockets_mtx);
1525
1526         mtx_destroy(&pcb->pcb_mtx);
1527
1528         bzero(pcb, sizeof(*pcb));
1529         free(pcb, M_NETGRAPH_BTSOCKET_HCI_RAW);
1530
1531         so->so_pcb = NULL;
1532 } /* ng_btsocket_hci_raw_detach */
1533
1534 /*
1535  * Disconnect raw HCI socket
1536  */
1537
1538 int
1539 ng_btsocket_hci_raw_disconnect(struct socket *so)
1540 {
1541         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1542
1543         if (pcb == NULL)
1544                 return (EINVAL);
1545         if (ng_btsocket_hci_raw_node == NULL)
1546                 return (EINVAL);
1547
1548         mtx_lock(&pcb->pcb_mtx);
1549         soisdisconnected(so);
1550         mtx_unlock(&pcb->pcb_mtx);
1551
1552         return (0);
1553 } /* ng_btsocket_hci_raw_disconnect */
1554
1555 /*
1556  * Get socket peer's address
1557  */
1558
1559 int
1560 ng_btsocket_hci_raw_peeraddr(struct socket *so, struct sockaddr **nam)
1561 {
1562         return (ng_btsocket_hci_raw_sockaddr(so, nam));
1563 } /* ng_btsocket_hci_raw_peeraddr */
1564
1565 /*
1566  * Send data
1567  */
1568
1569 int
1570 ng_btsocket_hci_raw_send(struct socket *so, int flags, struct mbuf *m,
1571                 struct sockaddr *sa, struct mbuf *control, struct thread *td)
1572 {
1573         ng_btsocket_hci_raw_pcb_p        pcb = so2hci_raw_pcb(so);
1574         struct mbuf                     *nam = NULL;
1575         int                              error = 0;
1576
1577         if (ng_btsocket_hci_raw_node == NULL) {
1578                 error = ENETDOWN;
1579                 goto drop;
1580         }
1581         if (pcb == NULL) {
1582                 error = EINVAL;
1583                 goto drop;
1584         }
1585         if (control != NULL) {
1586                 error = EINVAL;
1587                 goto drop;
1588         }
1589
1590         if (m->m_pkthdr.len < sizeof(ng_hci_cmd_pkt_t) ||
1591             m->m_pkthdr.len > sizeof(ng_hci_cmd_pkt_t) + NG_HCI_CMD_PKT_SIZE) {
1592                 error = EMSGSIZE;
1593                 goto drop;
1594         }
1595
1596         if (m->m_len < sizeof(ng_hci_cmd_pkt_t)) {
1597                 if ((m = m_pullup(m, sizeof(ng_hci_cmd_pkt_t))) == NULL) {
1598                         error = ENOBUFS;
1599                         goto drop;
1600                 }
1601         }
1602         if (*mtod(m, u_int8_t *) != NG_HCI_CMD_PKT) {
1603                 error = ENOTSUP;
1604                 goto drop;
1605         }
1606
1607         mtx_lock(&pcb->pcb_mtx);
1608
1609         error = ng_btsocket_hci_raw_filter(pcb, m, 0);
1610         if (error != 0) {
1611                 mtx_unlock(&pcb->pcb_mtx);
1612                 goto drop;
1613         }
1614
1615         if (sa == NULL) {
1616                 if (pcb->addr.hci_node[0] == 0) {
1617                         mtx_unlock(&pcb->pcb_mtx);
1618                         error = EDESTADDRREQ;
1619                         goto drop;
1620                 }
1621
1622                 sa = (struct sockaddr *) &pcb->addr;
1623         }
1624
1625         MGET(nam, M_NOWAIT, MT_SONAME);
1626         if (nam == NULL) {
1627                 mtx_unlock(&pcb->pcb_mtx);
1628                 error = ENOBUFS;
1629                 goto drop;
1630         }
1631
1632         nam->m_len = sizeof(struct sockaddr_hci);
1633         bcopy(sa,mtod(nam, struct sockaddr_hci *),sizeof(struct sockaddr_hci));
1634
1635         nam->m_next = m;
1636         m = NULL;
1637
1638         mtx_unlock(&pcb->pcb_mtx);
1639
1640         return (ng_send_fn(ng_btsocket_hci_raw_node, NULL,
1641                                 ng_btsocket_hci_raw_output, nam, 0));
1642 drop:
1643         NG_FREE_M(control); /* NG_FREE_M checks for != NULL */
1644         NG_FREE_M(nam);
1645         NG_FREE_M(m);
1646
1647         return (error);
1648 } /* ng_btsocket_hci_raw_send */
1649
1650 /*
1651  * Get socket address
1652  */
1653
1654 int
1655 ng_btsocket_hci_raw_sockaddr(struct socket *so, struct sockaddr **nam)
1656 {
1657         ng_btsocket_hci_raw_pcb_p       pcb = so2hci_raw_pcb(so);
1658         struct sockaddr_hci             sa;
1659
1660         if (pcb == NULL)
1661                 return (EINVAL);
1662         if (ng_btsocket_hci_raw_node == NULL)
1663                 return (EINVAL);
1664
1665         bzero(&sa, sizeof(sa));
1666         sa.hci_len = sizeof(sa);
1667         sa.hci_family = AF_BLUETOOTH;
1668
1669         mtx_lock(&pcb->pcb_mtx);
1670         strlcpy(sa.hci_node, pcb->addr.hci_node, sizeof(sa.hci_node));
1671         mtx_unlock(&pcb->pcb_mtx);
1672
1673         *nam = sodupsockaddr((struct sockaddr *) &sa, M_NOWAIT);
1674
1675         return ((*nam == NULL)? ENOMEM : 0);
1676 } /* ng_btsocket_hci_raw_sockaddr */
1677